@paradow/ledge 0.32.0 → 0.34.0

package/dist/cli/daemon-UJTMG3D4.js

@@ -1,2322 +0,0 @@
-import {
-  AttachmentStore,
-  fileJournal,
-  loginShellEnv,
-  quote,
-  reapOwner,
-  rpOf,
-  startPoller,
-  startServer,
-  tasksJournal,
-  teamsJournal
-} from "./chunk-EGXOBQZI.js";
-import "./chunk-OLLQBK6N.js";
-import "./chunk-QQVWFOPU.js";
-import {
-  QUESTION_TOOLS,
-  crossSession,
-  crossSessionNotices,
-  ledgeBody,
-  ledgeMessages,
-  ledgeNotice,
-  ledgePeer,
-  ledgeTask,
-  ledgeTeamNotice,
-  mailId,
-  readPeers,
-  reduce,
-  stripNote
-} from "./chunk-VGAPV4DC.js";
-import "./chunk-5FKHISVK.js";
-import {
-  agentMessages
-} from "./chunk-IE52REEI.js";
-import {
-  DEFAULT_RELAY_URL,
-  DevicePollResponseSchema,
-  DeviceStartResponseSchema,
-  MobileConfigSchema,
-  PAIR_LABEL_MAX,
-  PushSendResultSchema,
-  RELAY_CLOSE_SIGNED_OUT,
-  RecentSchema,
-  RelayServerMessageSchema,
-  SealedFrameSchema,
-  SessionSchema,
-  backendOf
-} from "./chunk-2BLPGRLO.js";
-import {
-  LEDGE_VERSION
-} from "./chunk-M7364G3S.js";
-import {
-  SERVICE,
-  inDaemonService,
-  tmuxServerAtRisk
-} from "./chunk-K7UEKSB2.js";
-import {
-  realTmux,
-  runFile
-} from "./chunk-NLL2EQJ2.js";
-import {
-  log
-} from "./chunk-6IYPRUQG.js";
-import {
-  ensureLedgeDir,
-  paths
-} from "./chunk-HOOHS3MX.js";
-import "./chunk-U67V476Y.js";
-
-// src/daemon/index.ts
-import { writeFile as writeFile3, rm as rm2 } from "fs/promises";
-import { join as join4 } from "path";
-
-// src/daemon/store.ts
-import { readFile, writeFile, rename, mkdir } from "fs/promises";
-import { dirname } from "path";
-var MAX_RECENTS = 12;
-var ARCHIVE_MAX = 200;
-var Store = class {
-  sessions = /* @__PURE__ */ new Map();
-  recentList = [];
-  listeners = /* @__PURE__ */ new Set();
-  eventListeners = /* @__PURE__ */ new Set();
-  applyListeners = /* @__PURE__ */ new Set();
-  timer = null;
-  saving = Promise.resolve();
-  journalPath;
-  /** Set by an unclean load and saved with the journal: a later clean-looking load must not be trusted for cleanups. */
-  incomplete = false;
-  constructor(opts = {}) {
-    this.journalPath = opts.journalPath ?? paths().journal;
-  }
-  /**
-   * Reads the journal. `clean` is false when it was missing, unreadable, or an entry was dropped by the schema, or when
-   * an earlier load was so (the mark is saved with the journal): what the store holds may then not be every session,
-   * and nothing may be cleaned up on the strength of it (the threads of the sessions it misses).
-   */
-  async load() {
-    let raw;
-    try {
-      raw = await readFile(this.journalPath, "utf8");
-    } catch {
-      return { clean: false, reason: "no journal" };
-    }
-    const bad = async (reason) => {
-      this.incomplete = true;
-      await writeFile(`${this.journalPath}.incomplete`, raw, { flag: "wx" }).catch(() => void 0);
-      return { clean: false, reason };
-    };
-    if (!raw.trim()) return bad("empty journal");
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (e) {
-      log(`journal unreadable, starting empty: ${e.message}`);
-      return bad("unreadable journal");
-    }
-    const list = parsed?.sessions;
-    if (!Array.isArray(list)) {
-      log("journal unreadable, starting empty: no sessions array");
-      return bad("no sessions array");
-    }
-    let dropped = 0;
-    for (const item of list) {
-      const r = SessionSchema.safeParse(item);
-      if (r.success) this.sessions.set(r.data.id, r.data);
-      else {
-        dropped++;
-        log(`journal entry dropped: ${r.error.issues[0]?.message ?? "invalid"}`);
-      }
-    }
-    const recents = parsed?.recents;
-    if (Array.isArray(recents)) {
-      for (const item of recents) {
-        const r = RecentSchema.safeParse(item);
-        if (r.success) this.recentList.push(r.data);
-      }
-      this.recentList = this.recentList.slice(0, MAX_RECENTS);
-    }
-    if (dropped) return bad(`${dropped} journal ${dropped === 1 ? "entry" : "entries"} dropped`);
-    if (parsed.incomplete === true) {
-      this.incomplete = true;
-      return { clean: false, reason: "an earlier load was incomplete" };
-    }
-    return { clean: true };
-  }
-  all() {
-    return [...this.sessions.values()];
-  }
-  get(id) {
-    return this.sessions.get(id);
-  }
-  /** The folders of past sessions, most recent first. */
-  recents() {
-    return [...this.recentList];
-  }
-  upsert(session) {
-    this.sessions.set(session.id, session);
-    this.emit({ type: "updated", session });
-  }
-  /** Records a session's folder as the most recent one (one entry per folder, `MAX_RECENTS` kept). */
-  touchRecent(cwd, project, at) {
-    this.recentList = [{ cwd, project, lastAt: at }, ...this.recentList.filter((r) => r.cwd !== cwd)].slice(0, MAX_RECENTS);
-    this.emit({ type: "recents", recents: this.recents() });
-  }
-  /** Facts no event carries (the session's repository): the changed fields only, nothing emitted when they are equal. */
-  patch(id, fields) {
-    const cur = this.sessions.get(id);
-    if (!cur) return;
-    if (Object.keys(fields).every((k) => cur[k] === fields[k])) return;
-    this.upsert({ ...cur, ...fields });
-  }
-  /** Sets the archive date (kept if already set), then drops the oldest archives past `ARCHIVE_MAX`. */
-  archive(id, at) {
-    const cur = this.sessions.get(id);
-    if (!cur) return void 0;
-    const next = cur.archivedAt === void 0 ? { ...cur, archivedAt: at } : cur;
-    if (next !== cur) this.upsert(next);
-    const archived = this.all().filter((s) => s.archivedAt !== void 0).sort((a, b) => a.archivedAt.localeCompare(b.archivedAt));
-    for (const old of archived.slice(0, Math.max(0, archived.length - ARCHIVE_MAX))) this.remove(old.id);
-    return this.sessions.get(id);
-  }
-  /** Takes the session out of the archive; `at` (a restore by the user) restarts the retirement clock from then. */
-  unarchive(id, at) {
-    const cur = this.sessions.get(id);
-    if (!cur) return void 0;
-    if (cur.archivedAt === void 0) return cur;
-    const { archivedAt: _gone, ...rest } = cur;
-    const next = at !== void 0 ? { ...rest, restoredAt: at } : rest;
-    this.upsert(next);
-    return next;
-  }
-  /** Every event applied to a known session, before the reducer decides whether it changes anything. */
-  onEvent(listener) {
-    this.eventListeners.add(listener);
-    return () => this.eventListeners.delete(listener);
-  }
-  /** Every `apply` that changed a session, with the session as it was and as it is. A throwing listener cannot break `apply`. */
-  onApply(listener) {
-    this.applyListeners.add(listener);
-    return () => this.applyListeners.delete(listener);
-  }
-  apply(id, event) {
-    if (!this.sessions.has(id)) return void 0;
-    for (const l of this.eventListeners) {
-      try {
-        l(id, event);
-      } catch (e) {
-        log(`event listener failed: ${e.message}`);
-      }
-    }
-    const cur = this.sessions.get(id);
-    if (!cur) return void 0;
-    const next = reduce(cur, event);
-    if (next === cur) return cur;
-    this.sessions.set(id, next);
-    this.emit({ type: "updated", session: next });
-    for (const l of this.applyListeners) {
-      try {
-        l(cur, next);
-      } catch (e) {
-        log(`apply listener failed: ${e.message}`);
-      }
-    }
-    return next;
-  }
-  remove(id) {
-    if (!this.sessions.delete(id)) return;
-    this.emit({ type: "removed", id });
-  }
-  onChange(listener) {
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
-  }
-  save() {
-    if (this.timer) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-    const run = this.saving.then(() => this.write());
-    this.saving = run.catch(() => void 0);
-    return run;
-  }
-  async write() {
-    await mkdir(dirname(this.journalPath), { recursive: true });
-    const tmp = `${this.journalPath}.tmp`;
-    await writeFile(tmp, JSON.stringify({ savedAt: (/* @__PURE__ */ new Date()).toISOString(), ...this.incomplete ? { incomplete: true } : {}, sessions: this.all(), recents: this.recentList }, null, 2));
-    await rename(tmp, this.journalPath);
-  }
-  emit(c) {
-    for (const l of this.listeners) {
-      try {
-        l(c);
-      } catch (e) {
-        log(`listener failed: ${e.message}`);
-      }
-    }
-    if (this.timer) clearTimeout(this.timer);
-    this.timer = setTimeout(() => {
-      this.save().catch((e) => log(`journal save failed: ${e.message}`));
-    }, 200);
-  }
-};
-
-// src/daemon/history.ts
-import { appendFile, mkdir as mkdir2, readdir, readFile as readFile2, rename as rename2, rm, writeFile as writeFile2 } from "fs/promises";
-import { join } from "path";
-
-// src/daemon/files.ts
-var DIFF_LINES = 80;
-var str = (v) => typeof v === "string" ? v : void 0;
-var cap = (lines) => lines.length > DIFF_LINES ? [...lines.slice(0, DIFF_LINES), "\u2026"].join("\n") : lines.join("\n");
-var edit = (oldS, newS) => [...oldS.split("\n").map((l) => `- ${l}`), ...newS.split("\n").map((l) => `+ ${l}`)];
-function fromPatch(patch) {
-  const out = [];
-  let cur = null;
-  const flush = () => {
-    if (cur) {
-      if (cur.lines.length) cur.file.diff = cap(cur.lines);
-      out.push(cur.file);
-      cur = null;
-    }
-  };
-  for (const line of patch.split("\n")) {
-    const m = /^\*\*\* (Add|Update|Delete) File: (.+)$/.exec(line);
-    if (m) {
-      flush();
-      cur = { file: { path: m[2].trim(), change: m[1] === "Add" ? "add" : m[1] === "Update" ? "edit" : "delete" }, lines: [] };
-      continue;
-    }
-    const mv = /^\*\*\* Move to: (.+)$/.exec(line);
-    if (mv) {
-      if (cur && cur.file.change === "edit") {
-        cur.file.from = cur.file.path;
-        cur.file.path = mv[1].trim();
-      }
-      continue;
-    }
-    if (/^\*\*\* (Begin|End) Patch/.test(line)) continue;
-    if (cur && cur.file.change !== "delete") cur.lines.push(line);
-  }
-  flush();
-  return out;
-}
-function filesOf(tool, input) {
-  if (!tool || !input) return [];
-  const path = str(input.file_path) ?? str(input.notebook_path);
-  switch (tool) {
-    case "Write":
-      return path ? [{ path, change: "write", ...str(input.content) !== void 0 ? { diff: cap(str(input.content).split("\n").map((l) => `+ ${l}`)) } : {} }] : [];
-    case "Edit":
-      return path ? [{ path, change: "edit", diff: cap(edit(str(input.old_string) ?? "", str(input.new_string) ?? "")) }] : [];
-    case "MultiEdit": {
-      const edits = Array.isArray(input.edits) ? input.edits : [];
-      return path ? [{ path, change: "edit", diff: cap(edits.flatMap((e) => edit(str(e.old_string) ?? "", str(e.new_string) ?? ""))) }] : [];
-    }
-    case "NotebookEdit":
-      return path ? [{ path, change: "edit" }] : [];
-    // OMP (lower case): `write` names the path and the content; a finished `edit` names the path and the diff OMP reports (`- old` / `+ new`, its line numbers dropped).
-    case "write": {
-      const p = str(input.path);
-      return p && path === void 0 ? [{ path: p, change: "write", ...str(input.content) !== void 0 ? { diff: cap(str(input.content).split("\n").map((l) => `+ ${l}`)) } : {} }] : [];
-    }
-    case "edit": {
-      const p = str(input.path);
-      const diff = str(input.diff);
-      if (!p || path !== void 0) return [];
-      const lines = (diff ?? "").split("\n").filter((l) => l[0] === "+" || l[0] === "-").map((l) => `${l[0]} ${l.slice(1).replace(/^\d+\|/, "")}`);
-      return [{ path: p, change: "edit", ...lines.length ? { diff: cap(lines) } : {} }];
-    }
-    case "apply_patch":
-      return fromPatch(str(input.patch) ?? str(input.input) ?? "");
-    case "shell":
-    case "Bash": {
-      const cmd = Array.isArray(input.command) ? input.command.map(String) : [];
-      return cmd[0] === "apply_patch" && cmd[1] ? fromPatch(cmd[1]) : [];
-    }
-    default:
-      return [];
-  }
-}
-
-// src/daemon/history.ts
-var MAX_ITEMS = 400;
-var SYNC_MS = 1e3;
-function inputText(input) {
-  if (!input) return void 0;
-  const cmd = input.command;
-  if (typeof cmd === "string") return cmd;
-  if (Array.isArray(cmd)) return cmd.map(String).join(" ");
-  const text = JSON.stringify(input, null, 2);
-  return text === "{}" ? void 0 : text;
-}
-var HANDBACK = /^<agent-message from="([^"]+)">\n?([\s\S]*?)(?:<\/agent-message>\s*)?$/;
-function handBack(text) {
-  const m = HANDBACK.exec(text.trimStart());
-  if (!m) return void 0;
-  const lines = m[2].split("\n");
-  while (lines.length && (!lines[0].trim() || /^\[[^\]]*\]/.test(lines[0]))) lines.shift();
-  const indent = Math.min(...lines.filter((l) => l.trim()).map((l) => l.length - l.trimStart().length));
-  return { helperId: m[1], report: lines.map((l) => l.slice(Number.isFinite(indent) ? indent : 0)).join("\n").trim() };
-}
-var History = class {
-  threads = /* @__PURE__ */ new Map();
-  turns = /* @__PURE__ */ new Map();
-  synced = /* @__PURE__ */ new Map();
-  listeners = /* @__PURE__ */ new Set();
-  writes = Promise.resolve();
-  /** The rids of the cards Ledge's mailbox recorded: their result is the mailbox's, not the tool call's (their `via`, read back at load). */
-  mailed = /* @__PURE__ */ new Set();
-  dir;
-  /** The Ledge session a SendMessage address or a sender's name is, when it is one (peers.ts). */
-  peerOf;
-  /** The stored image an attachment id is, when the store still holds it. */
-  refOf;
-  constructor(opts = {}) {
-    this.dir = opts.dir ?? paths().history;
-    this.peerOf = opts.peerOf ?? (() => void 0);
-    this.refOf = opts.refOf ?? (() => null);
-  }
-  items(id) {
-    return this.threads.get(id) ?? [];
-  }
-  onItem(l) {
-    this.listeners.add(l);
-    return () => this.listeners.delete(l);
-  }
-  /** Waits for the journal writes issued so far (tests, shutdown). */
-  flush() {
-    return this.writes;
-  }
-  /** Reads every `<id>.jsonl`: one item per line, the last line of an id wins, a bad line is skipped. A file that cannot
-   *  be read is logged and left alone: the thread is a display, it must not keep the daemon from starting. A journal
-   *  holding more lines than items (updates, evicted items) is rewritten with the items kept, through the write chain.
-   *  The mailbox's queue did not survive the restart: its cards still sending failed. */
-  async load() {
-    await mkdir2(this.dir, { recursive: true });
-    for (const entry of await readdir(this.dir, { withFileTypes: true })) {
-      const name = entry.name;
-      if (!entry.isFile() || !name.endsWith(".jsonl")) continue;
-      const id = name.slice(0, -".jsonl".length);
-      let text;
-      try {
-        text = await readFile2(join(this.dir, name), "utf8");
-      } catch (e) {
-        log(`history not read for ${id}: ${e.message}`);
-        continue;
-      }
-      const byId = /* @__PURE__ */ new Map();
-      let lines = 0;
-      for (const line of text.split("\n")) {
-        if (!line.trim()) continue;
-        lines++;
-        try {
-          const it = JSON.parse(line);
-          if (typeof it?.id === "string") byId.set(it.id, it);
-        } catch {
-        }
-      }
-      const items = [...byId.values()].slice(-MAX_ITEMS);
-      let lost = false;
-      items.forEach((it, i) => {
-        if (it.kind !== "sent" || it.via !== "ledge") return;
-        this.mailed.add(it.id);
-        if (it.status === "sending") {
-          items[i] = { ...it, status: "failed" };
-          lost = true;
-        }
-      });
-      this.threads.set(id, items);
-      this.turns.set(id, items.reduce((n, it) => typeof it.turn === "number" ? Math.max(n, it.turn) : n, 0));
-      if (lines > items.length || lost) this.compact(id, items);
-    }
-  }
-  /** The ids of the images the journaled prompts refer to, read from every `<dir>/*.jsonl` once the pending writes landed. */
-  async attachmentIds() {
-    await this.writes;
-    const ids = /* @__PURE__ */ new Set();
-    let names;
-    try {
-      names = await readdir(this.dir);
-    } catch {
-      return ids;
-    }
-    for (const name of names) {
-      if (!name.endsWith(".jsonl")) continue;
-      let text;
-      try {
-        text = await readFile2(join(this.dir, name), "utf8");
-      } catch (e) {
-        log(`history not read for ${name}: ${e.message}`);
-        continue;
-      }
-      for (const line of text.split("\n")) {
-        if (!line.includes('"images"')) continue;
-        try {
-          for (const img of JSON.parse(line).images ?? []) if (typeof img?.id === "string") ids.add(img.id);
-        } catch {
-        }
-      }
-    }
-    return ids;
-  }
-  /** The ids of the threads held, loaded or recorded. */
-  ids() {
-    return [...this.threads.keys()];
-  }
-  forget(id) {
-    this.threads.delete(id);
-    this.turns.delete(id);
-    this.writes = this.writes.then(() => rm(join(this.dir, `${id}.jsonl`), { force: true })).catch((e) => log(`history not removed for ${id}: ${e.message}`));
-  }
-  record(id, ev) {
-    const turn = this.turns.get(id) ?? 0;
-    const common = { at: ev.at, turn, ...ev.helperId ? { helperId: ev.helperId } : {} };
-    if (ev.helperId && ev.task) {
-      const helper = this.items(id).find((i) => i.id === ev.helperId);
-      if (helper?.kind === "helper" && !helper.task) this.put(id, { ...helper, task: ev.task });
-    }
-    switch (ev.name) {
-      case "UserPromptSubmit": {
-        const images = (ev.attachments ?? []).flatMap((a) => this.refOf(a) ?? []);
-        if (!ev.text && images.length === 0) return void 0;
-        const text = ev.text ?? "";
-        const back = handBack(text);
-        if (back) {
-          const helper = this.items(id).find((i) => i.id === back.helperId);
-          if (helper?.kind === "helper" && helper.state !== "exited") this.put(id, { ...helper, state: "exited" });
-          if (helper?.kind === "helper") this.settle(id, (i) => i.helperId === back.helperId);
-          return back.report ? this.put(id, { kind: "reply", id: `report-${back.helperId}`, at: ev.at, turn: helper?.turn ?? turn, helperId: back.helperId, text: back.report }) : void 0;
-        }
-        const messages = crossSession(text);
-        if (messages) {
-          this.turns.set(id, turn + 1);
-          let last;
-          messages.forEach((m, i) => {
-            const { sender, text: text2 } = stripNote(m.text);
-            last = this.receive(id, { kind: "received", id: `recv-${turn + 1}-${i}`, at: ev.at, turn: turn + 1, from: sender ?? m.name ?? m.from, text: text2 }, { ...m, ...sender ? { sender } : {} });
-          });
-          return last;
-        }
-        const ledge = ledgeMessages(text);
-        if (ledge) {
-          this.turns.set(id, turn + 1);
-          let last;
-          ledge.forEach((m, i) => {
-            last = this.receive(id, { kind: "received", id: `recv-${turn + 1}-${i}`, at: ev.at, turn: turn + 1, from: m.from, text: m.text }, m);
-          });
-          return last;
-        }
-        const notices = crossSessionNotices(text);
-        if (notices) {
-          this.turns.set(id, turn + 1);
-          let last;
-          notices.forEach((n, i) => {
-            last = this.put(id, this.noticeOf(n, { id: `notice-${turn + 1}-${i}`, at: ev.at, turn: turn + 1 }));
-          });
-          return last;
-        }
-        const failed = ledgeNotice(text);
-        if (failed) {
-          this.turns.set(id, turn + 1);
-          const peer = this.peerOf(failed.to);
-          return this.put(id, {
-            kind: "notice",
-            id: `notice-${turn + 1}-0`,
-            at: ev.at,
-            turn: turn + 1,
-            notice: "delivery",
-            status: "refused",
-            count: 1,
-            recipients: [failed.to],
-            name: failed.to,
-            ...peer ? { peer } : {},
-            ...failed.reason ? { reason: failed.reason } : {},
-            text: failed.text
-          });
-        }
-        const task = ledgeTask(text);
-        if (task) {
-          this.turns.set(id, turn + 1);
-          const peer = task.from ? this.peerOf(task.from) : void 0;
-          return this.put(id, {
-            kind: "notice",
-            id: `notice-${turn + 1}-0`,
-            at: ev.at,
-            turn: turn + 1,
-            notice: "other",
-            task: task.id,
-            ...task.from ? { name: task.from } : {},
-            ...peer ? { peer } : {},
-            summary: task.text.replaceAll(" \u23CE ", "\n"),
-            text: task.text
-          });
-        }
-        const joined = ledgeTeamNotice(text);
-        if (joined) {
-          this.turns.set(id, turn + 1);
-          return this.put(id, { kind: "notice", id: `notice-${turn + 1}-0`, at: ev.at, turn: turn + 1, notice: "other", team: joined.team, summary: joined.text.replaceAll(" \u23CE ", "\n"), text: joined.text });
-        }
-        this.turns.set(id, turn + 1);
-        return this.put(id, { kind: "prompt", id: `prompt-${turn + 1}`, at: ev.at, turn: turn + 1, text, ...images.length ? { images } : {} });
-      }
-      case "PreToolUse": {
-        if (!ev.tool) return void 0;
-        const existing = ev.toolUseId && this.items(id).find((i) => i.id === ev.toolUseId);
-        if (existing) return existing;
-        if (ev.tool === "SendMessage") return this.put(id, this.sentOf(ev, common, "sending"));
-        const input = inputText(ev.toolInput);
-        return this.put(id, { kind: "tool", id: ev.toolUseId ?? `tool-${ev.at}-${this.items(id).length}`, ...common, tool: ev.tool, label: ev.text ?? ev.tool, ...input ? { input } : {}, status: "running", files: filesOf(ev.tool, ev.toolInput) });
-      }
-      case "PostToolUse":
-      case "PostToolUseFailure": {
-        if (!ev.tool) return void 0;
-        const failed = ev.name === "PostToolUseFailure";
-        if (ev.tool === "SendMessage" && ev.toolUseId && this.mailed.has(ev.toolUseId)) return this.items(id).find((i) => i.id === ev.toolUseId);
-        if (ev.tool === "SendMessage") {
-          const sent = this.items(id).find((i) => i.kind === "sent" && i.id === ev.toolUseId);
-          if (sent?.status === "read") return sent;
-          return this.put(id, sent ? { ...sent, status: failed ? "failed" : "delivered" } : this.sentOf(ev, common, failed ? "failed" : "delivered"));
-        }
-        const row = this.callFor(id, ev);
-        const late = row && row.files.length === 0 && ev.toolInput ? filesOf(ev.tool, ev.toolInput) : [];
-        const plan = row && ev.tool === "todo" && ev.toolInput ? inputText(ev.toolInput) : void 0;
-        const base = row ? { ...row, ...late.length ? { files: late } : {}, ...plan ? { input: plan } : {} } : { kind: "tool", id: ev.toolUseId ?? `tool-${ev.at}-${this.items(id).length}`, ...common, tool: ev.tool, label: ev.text ?? ev.tool, status: "running", files: filesOf(ev.tool, ev.toolInput) };
-        const error = failed ? ev.error ?? (ev.interrupt ? "interrupted" : "failed") : void 0;
-        return this.put(id, { ...base, status: failed ? "failed" : "success", ...ev.output !== void 0 ? { output: ev.output } : {}, ...error ? { error } : {}, ...ev.durationMs !== void 0 ? { durationMs: ev.durationMs } : {} });
-      }
-      case "PermissionRequest": {
-        if (!ev.tool || !ev.text) return void 0;
-        if (QUESTION_TOOLS.has(ev.tool)) return void 0;
-        const last = [...this.items(id)].reverse().find((i) => i.kind === "permission");
-        if (last && last.kind === "permission" && last.decision === void 0 && last.text === ev.text) return last;
-        return this.put(id, { kind: "permission", id: `perm-${ev.at}-${this.items(id).length}`, ...common, tool: ev.tool, text: ev.text });
-      }
-      case "Decided": {
-        if (!ev.decision) {
-          if (!ev.byClose) return void 0;
-          const q = [...this.items(id)].reverse().find((i) => i.kind === "tool" && QUESTION_TOOLS.has(i.tool) && i.status === "running" && !i.helperId);
-          return q ? this.put(id, { ...q, status: "unknown", byClose: true }) : void 0;
-        }
-        const perm = [...this.items(id)].reverse().find((i) => i.kind === "permission" && i.decision === void 0);
-        return perm && perm.kind === "permission" ? this.put(id, { ...perm, decision: ev.decision, ...ev.byClose ? { byClose: true } : {} }) : void 0;
-      }
-      case "AgentMessage": {
-        if (!ev.messageId || !ev.text) return void 0;
-        const itemId = `msg-${ev.messageId}`;
-        const prev = this.items(id).find((i) => i.id === itemId);
-        return this.put(id, { kind: "reply", id: itemId, at: prev?.at ?? ev.at, turn: prev?.turn ?? turn, text: ev.text, ...ev.helperId ? { helperId: ev.helperId } : {} });
-      }
-      case "Stop": {
-        if (!ev.helperId) this.settle(id, (i) => i.turn === turn && !i.helperId);
-        if (ev.streamed) return void 0;
-        return ev.text ? this.put(id, { kind: "reply", id: `reply-${turn}`, at: ev.at, turn, text: ev.text }) : void 0;
-      }
-      case "SubagentStart": {
-        if (!ev.helperId) return void 0;
-        const task = ev.text ?? ev.task ?? "";
-        const prev = this.items(id).find((i) => i.id === ev.helperId);
-        if (prev) return prev;
-        return this.put(id, { kind: "helper", id: ev.helperId, at: ev.at, turn, task, ...ev.tool ? { agentType: ev.tool } : {}, state: "working" });
-      }
-      case "SubagentStop": {
-        if (!ev.helperId) return void 0;
-        const prev = this.items(id).find((i) => i.id === ev.helperId);
-        if (!prev && !ev.transcriptPath) return void 0;
-        const row = prev && prev.kind === "helper" ? prev : { kind: "helper", id: ev.helperId, at: ev.at, turn, task: ev.task ?? "", ...ev.tool ? { agentType: ev.tool } : {}, state: "working" };
-        this.put(id, { ...row, state: "exited" });
-        this.settle(id, (i) => i.helperId === ev.helperId);
-        return ev.text ? this.put(id, { kind: "reply", id: `report-${ev.helperId}`, at: ev.at, turn, helperId: ev.helperId, text: ev.text }) : void 0;
-      }
-      default:
-        return void 0;
-    }
-  }
-  /** The row a result belongs to: by id, else the last running call of that tool in the same thread (Cursor gives no id). */
-  /** Inserts the agent's messages the transcript holds and the thread lacks, from the current turn's prompt on (or the
-   *  helper's start). At most once a second per thread unless forced (end of a turn). */
-  sync(id, path, opts = {}) {
-    const key = `${id}/${opts.helperId ?? ""}`;
-    const now = opts.now ?? Date.now();
-    if (!opts.force && now - (this.synced.get(key) ?? 0) < SYNC_MS) return [];
-    this.synced.set(key, now);
-    const items = this.items(id);
-    const since = opts.helperId ? items.find((i) => i.id === opts.helperId)?.at : [...items].reverse().find((i) => i.kind === "prompt" || i.kind === "received" || i.kind === "notice" && !i.outgoing)?.at;
-    if (!since) return [];
-    const have = new Set(items.map((i) => i.id));
-    const turn = this.turns.get(id) ?? 0;
-    const added = [];
-    for (const m of agentMessages(path, { sidechain: !!opts.helperId })) {
-      if (m.at < since || have.has(`msg-${m.id}`)) continue;
-      added.push(this.put(id, { kind: "message", id: `msg-${m.id}`, at: m.at, turn, text: m.text, ...opts.helperId ? { helperId: opts.helperId } : {} }));
-    }
-    return added;
-  }
-  /** The mailbox has a message to send: its card, `sending`. A card of that id already (Claude's own PreToolUse) stays, marked as the mailbox's. */
-  recordSent(senderId, m) {
-    this.mailed.add(m.rid);
-    const existing = this.items(senderId).find((i) => i.kind === "sent" && i.id === m.rid);
-    if (existing) return this.put(senderId, { ...existing, ...m.peer ? { peer: m.peer } : {}, via: "ledge" });
-    return this.put(senderId, { kind: "sent", id: m.rid, at: m.at, turn: this.turns.get(senderId) ?? 0, to: m.to, ...m.peer ? { peer: m.peer } : {}, ...m.summary ? { summary: m.summary } : {}, text: m.text, status: "sending", via: "ledge" });
-  }
-  /**
-   * A task the session handed over (issue #92): its card in the sender's thread, in the turn it is in (not a prompt).
-   * One card per transmission: the same one again replaces it.
-   */
-  recordTask(senderId, n) {
-    const { task, tr } = n;
-    const what = { give: "confi\xE9e \xE0", pass: "pass\xE9e \xE0", done: "rendue \xE0", refuse: "refus\xE9e, rendue \xE0", cancel: "annul\xE9e pour" }[tr.op];
-    const said = tr.op === "pass" ? tr.note : task.result;
-    return this.put(senderId, {
-      kind: "notice",
-      id: `task-${task.id}-${tr.index}`,
-      at: tr.at,
-      turn: this.turns.get(senderId) ?? 0,
-      notice: "other",
-      task: task.id,
-      taskOp: tr.op,
-      outgoing: true,
-      name: tr.toName,
-      ...n.peer ? { peer: n.peer } : {},
-      summary: said ? `${task.title}
-${quote(said)}` : task.title,
-      text: `T\xE2che \xAB ${task.title} \xBB ${what} ${tr.toName}${tr.op === "done" ? " (termin\xE9e)" : ""}`
-    });
-  }
-  /** The mailbox's outcome for a card; a `read` card stays read. */
-  markSent(senderId, rid, status) {
-    const sent = this.items(senderId).find((i) => i.kind === "sent" && i.id === rid);
-    if (sent && sent.status !== "read") this.put(senderId, { ...sent, status });
-  }
-  /** A SendMessage's card, from its input: `to` the address used, `peer` the Ledge session that address is. */
-  sentOf(ev, common, status) {
-    const input = ev.toolInput ?? {};
-    const to = typeof input.to === "string" ? input.to : "";
-    const peer = to ? this.peerOf(to) : void 0;
-    return { kind: "sent", id: ev.toolUseId ?? `sent-${ev.at}`, ...common, to, ...peer ? { peer } : {}, ...typeof input.summary === "string" && input.summary ? { summary: input.summary } : {}, text: typeof input.message === "string" ? stripNote(input.message).text : "", status };
-  }
-  /** A notice as a thread item: the session it is about named, and its Ledge session when it is one. */
-  noticeOf(n, common) {
-    const base = { kind: "notice", ...common, notice: n.kind, text: n.text };
-    if (n.kind === "other") return base;
-    if (n.kind === "delivery") return { ...base, status: n.status, count: n.count, recipients: n.recipients, ...n.reason ? { reason: n.reason } : {} };
-    const peer = n.peer ? this.peerOf(n.peer) : void 0;
-    return {
-      ...base,
-      name: n.peer,
-      ...peer ? { peer } : {},
-      ..."time" in n && n.time ? { time: n.time } : {},
-      ..."summary" in n && n.summary ? { summary: n.summary } : {},
-      ..."reason" in n && n.reason ? { reason: n.reason } : {}
-    };
-  }
-  /** Puts a received card, paired with the sender's sent one when the sender is a Ledge session: the last of its
-   *  messages to this session not read yet, the one whose text starts like the body if any (the hook may have cut
-   *  either), both read as Ledge types a body (a multi-line one arrives on one line). A message the mailbox typed names
-   *  its id: the sent card of that id is the one, and its text replaces a pointer's. That sent one becomes read, in the sender's thread. */
-  receive(id, recv, m) {
-    const peer = (m.sender ? this.peerOf(m.sender) : void 0) ?? this.peerOf(m.from) ?? (m.name ? this.peerOf(m.name) : void 0);
-    if (!peer) return this.put(id, recv);
-    const head = (t) => ledgeBody(t).trim().slice(0, 200);
-    const open = this.items(peer).filter((i) => i.kind === "sent" && i.peer === id && i.status !== "read");
-    const byId = m.id ? open.find((i) => mailId(i.id) === m.id) : void 0;
-    const sent = byId ?? [...open].reverse().find((i) => head(i.text) === head(recv.text)) ?? open.at(-1);
-    if (sent) this.put(peer, { ...sent, status: "read", received: recv.id });
-    return this.put(id, { ...recv, ...byId ? { text: byId.text } : {}, peer, ...sent ? { sent: sent.id } : {} });
-  }
-  /** The turn (or the helper) is over: an action still running will not get its result from this side. It shows as
-   *  unknown, not as waiting forever; a result that arrives later still settles it (callFor finds it by id). */
-  settle(id, mine) {
-    for (const i of this.items(id)) if (i.kind === "tool" && i.status === "running" && mine(i)) this.put(id, { ...i, status: "unknown" });
-  }
-  callFor(id, ev) {
-    const items = this.items(id);
-    if (ev.toolUseId) {
-      const hit = items.find((i) => i.id === ev.toolUseId);
-      if (hit?.kind === "tool") return hit;
-    }
-    return [...items].reverse().find((i) => i.kind === "tool" && i.tool === ev.tool && i.status === "running" && i.helperId === ev.helperId);
-  }
-  /** Rewrites a journal with one line per item, via a temporary file so a crash leaves the old journal whole. */
-  compact(id, items) {
-    const file = join(this.dir, `${id}.jsonl`);
-    const tmp = `${file}.tmp`;
-    const text = items.map((it) => JSON.stringify(it) + "\n").join("");
-    this.writes = this.writes.then(() => writeFile2(tmp, text)).then(() => rename2(tmp, file)).catch((e) => log(`history not compacted for ${id}: ${e.message}`));
-  }
-  put(id, item) {
-    const items = [...this.items(id)];
-    const at = items.findIndex((i) => i.id === item.id);
-    if (at >= 0) items[at] = item;
-    else items.push(item);
-    this.threads.set(id, items.length > MAX_ITEMS ? items.slice(items.length - MAX_ITEMS) : items);
-    for (const l of this.listeners) {
-      try {
-        l(id, item);
-      } catch (e) {
-        log(`history listener failed: ${e.message}`);
-      }
-    }
-    const line = JSON.stringify(item) + "\n";
-    this.writes = this.writes.then(() => mkdir2(this.dir, { recursive: true })).then(() => appendFile(join(this.dir, `${id}.jsonl`), line)).catch((e) => log(`history not written for ${id}: ${e.message}`));
-    return item;
-  }
-};
-
-// src/update/self.ts
-import { existsSync } from "fs";
-import { readFile as readFile3, realpath } from "fs/promises";
-import { homedir } from "os";
-import { dirname as dirname2, join as join2 } from "path";
-function gitRoot(script, exists = existsSync) {
-  for (let dir = dirname2(script); ; dir = dirname2(dir)) {
-    if (exists(join2(dir, ".git"))) return dir;
-    if (dirname2(dir) === dir) return null;
-  }
-}
-function installKind(script, exists = existsSync) {
-  if (script.includes("/node_modules/@paradow/ledge/")) return "npm";
-  return gitRoot(script, exists) ? "git" : "unknown";
-}
-var underSystemd = (env, cgroup) => !!env.INVOCATION_ID && inDaemonService(cgroup);
-var manualCommand = (root) => `cd ${root} && git pull && pnpm install && pnpm --filter @paradow/ledge build && systemctl --user restart ${SERVICE.replace(/\.service$/, "")}`;
-async function daemonInfo() {
-  const script = await realpath(process.argv[1] ?? "").catch(() => process.argv[1] ?? "");
-  const cgroup = await readFile3("/proc/self/cgroup", "utf8").catch(() => "");
-  const install = installKind(script);
-  const root = install === "git" ? gitRoot(script) : null;
-  return { version: LEDGE_VERSION, install, systemd: underSystemd(process.env, cgroup), home: homedir(), ...root ? { manual: manualCommand(root) } : {} };
-}
-
-// src/update/run-update.ts
-import { dirname as dirname3, join as join3 } from "path";
-var PACKAGE = "@paradow/ledge";
-var NPM_TIMEOUT_MS = 3 * 6e4;
-var RESTART_COMMAND = "systemctl --user restart ledge-daemon";
-var npmCommand = (execPath, version) => ({ file: join3(dirname3(execPath), "npm"), args: ["i", "-g", `${PACKAGE}@${version}`] });
-var lastLines = (output, n = 3) => output.split("\n").map((l) => l.trimEnd()).filter(Boolean).slice(-n).join("\n");
-var npmEnv = (execPath, env) => ({ ...env, PATH: `${dirname3(execPath)}:${env.PATH ?? ""}` });
-function createDaemonUpdater(deps) {
-  let busy = false;
-  let restarting = false;
-  const restartService = async (version, send) => {
-    send({ type: "update.progress", version, step: "restarting" });
-    await deps.save();
-    const code = await deps.restart();
-    if (code !== 0) {
-      log(`update: systemctl restart failed (${code})`);
-      return send({ type: "update.failed", version, reason: "no-systemd", command: RESTART_COMMAND });
-    }
-    restarting = true;
-  };
-  return {
-    running: () => busy,
-    /** `reply` reaches only the asking client: a busy refusal must not fail the flow other overlays are following. */
-    async update(version, send, reply = send) {
-      if (busy) return reply({ type: "update.failed", version, reason: "busy" });
-      const info = deps.info();
-      const cmd = npmCommand(deps.execPath ?? process.execPath, version);
-      const shown = `${cmd.file} ${cmd.args.join(" ")}`;
-      if (info.install !== "npm") return send({ type: "update.failed", version, reason: "git-install", ...info.manual ? { command: info.manual } : {} });
-      if (!info.systemd) return send({ type: "update.failed", version, reason: "no-systemd", command: shown });
-      busy = true;
-      try {
-        if (await deps.atRisk()) return send({ type: "update.failed", version, reason: "sessions-at-risk" });
-        send({ type: "update.progress", version, step: "installing" });
-        log(`update: ${shown}`);
-        const r = await deps.npm(cmd);
-        if (r.code !== 0) {
-          log(`update: npm failed (${r.code})
-${r.output}`);
-          return send({ type: "update.failed", version, reason: "npm-failed", detail: lastLines(r.output), command: shown });
-        }
-        await restartService(version, send);
-      } catch (e) {
-        log(`update: ${e.stack ?? String(e)}`);
-        send({ type: "update.failed", version, reason: "npm-failed", detail: e instanceof Error ? e.message : String(e) });
-      } finally {
-        if (!restarting) busy = false;
-      }
-    },
-    /** The restart alone, for the phone (spec 2026-10-28 mobile daemon update): the update's guards but npm, then the same restart. */
-    async restart(send, reply = send) {
-      const version = deps.info().version;
-      if (busy) return reply({ type: "update.failed", version, reason: "busy" });
-      if (!deps.info().systemd) return send({ type: "update.failed", version, reason: "no-systemd", command: RESTART_COMMAND });
-      busy = true;
-      try {
-        if (await deps.atRisk()) return send({ type: "update.failed", version, reason: "sessions-at-risk" });
-        await restartService(version, send);
-      } catch (e) {
-        log(`restart: ${e.stack ?? String(e)}`);
-        send({ type: "update.failed", version, reason: "no-systemd", command: RESTART_COMMAND });
-      } finally {
-        if (!restarting) busy = false;
-      }
-    }
-  };
-}
-function realUpdaterDeps(opts) {
-  return {
-    info: () => opts.info,
-    atRisk: async () => (opts.ownedLive?.() ?? 0) > 0 || await tmuxServerAtRisk(),
-    npm: async (cmd) => {
-      const env = npmEnv(process.execPath, { ...process.env, ...await loginShellEnv() });
-      const r = await runFile(cmd.file, cmd.args, env, { timeoutMs: NPM_TIMEOUT_MS });
-      const output = `${r.stdout}
-${r.stderr}`;
-      return r.code === 124 ? { code: 124, output: `npm timed out after 3 minutes
-${output}` } : { code: r.code, output };
-    },
-    // --no-block: this systemctl runs inside the cgroup being stopped; the job must not depend on it staying alive.
-    restart: async () => (await runFile("systemctl", ["--user", "restart", "--no-block", SERVICE])).code,
-    save: opts.save
-  };
-}
-
-// src/mobile/files.ts
-import { readFileSync, writeFileSync, renameSync, chmodSync, unlinkSync } from "fs";
-import { z } from "zod";
-
-// ../seal/src/errors.ts
-var SealError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message ?? code);
-    this.name = "SealError";
-    this.code = code;
-  }
-};
-
-// ../seal/src/encoding.ts
-var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-function b64u(bytes) {
-  let out = "";
-  for (let i = 0; i < bytes.length; i += 3) {
-    const n = bytes[i] << 16 | (bytes[i + 1] ?? 0) << 8 | (bytes[i + 2] ?? 0);
-    out += ALPHABET[n >> 18 & 63] + ALPHABET[n >> 12 & 63];
-    if (i + 1 < bytes.length) out += ALPHABET[n >> 6 & 63];
-    if (i + 2 < bytes.length) out += ALPHABET[n & 63];
-  }
-  return out;
-}
-function fromB64u(text) {
-  if (text.length % 4 === 1) throw new SealError("bad_encoding", "invalid base64url length");
-  const out = new Uint8Array(Math.floor(text.length * 3 / 4));
-  let acc = 0;
-  let bits = 0;
-  let o = 0;
-  for (const ch of text) {
-    const v = ALPHABET.indexOf(ch);
-    if (v < 0) throw new SealError("bad_encoding", "invalid base64url character");
-    acc = acc << 6 | v;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      out[o++] = acc >> bits & 255;
-    }
-  }
-  if (acc & (1 << bits) - 1) throw new SealError("bad_encoding", "non-zero trailing bits");
-  return out;
-}
-
-// ../seal/src/bytes.ts
-function concat(...parts) {
-  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
-  let o = 0;
-  for (const p of parts) {
-    out.set(p, o);
-    o += p.length;
-  }
-  return out;
-}
-
-// ../seal/src/identity.ts
-var subtle = globalThis.crypto.subtle;
-var ALGO = { name: "ECDH", namedCurve: "P-256" };
-async function generateIdentity(opts = {}) {
-  const extractable = opts.extractable ?? false;
-  const pair = await subtle.generateKey(ALGO, extractable, ["deriveBits"]);
-  const raw = new Uint8Array(await subtle.exportKey("raw", pair.publicKey));
-  const privateKey = pair.privateKey;
-  return { publicKey: b64u(raw), privateKey };
-}
-async function exportIdentity(id) {
-  return b64u(new Uint8Array(await subtle.exportKey("pkcs8", id.privateKey)));
-}
-async function importIdentity(pkcs8) {
-  const privateKey = await subtle.importKey("pkcs8", fromB64u(pkcs8), ALGO, true, ["deriveBits"]);
-  const jwk = await subtle.exportKey("jwk", privateKey);
-  if (!jwk.x || !jwk.y) throw new SealError("bad_key", "private key has no public coordinates");
-  const point = concat(new Uint8Array([4]), fromB64u(jwk.x), fromB64u(jwk.y));
-  const publicKey = b64u(point);
-  await importPublicKey(publicKey);
-  return { publicKey, privateKey };
-}
-async function importPublicKey(publicKey) {
-  const raw = fromB64u(publicKey);
-  if (raw.length !== 65 || raw[0] !== 4) throw new SealError("bad_key", "not an uncompressed P-256 point");
-  try {
-    return await subtle.importKey("raw", raw, ALGO, true, []);
-  } catch {
-    throw new SealError("bad_key", "point rejected by WebCrypto");
-  }
-}
-
-// ../seal/src/channel.ts
-var subtle2 = globalThis.crypto.subtle;
-var enc = new TextEncoder();
-var dec = new TextDecoder("utf-8", { fatal: true });
-var ECDH = { name: "ECDH", namedCurve: "P-256" };
-var VERSION = "ledge-seal/1";
-var SEQ_BYTES = 8;
-var TAG_BYTES = 16;
-function seqBytes(seq) {
-  const out = new Uint8Array(SEQ_BYTES);
-  new DataView(out.buffer).setBigUint64(0, BigInt(seq));
-  return out;
-}
-async function ecdh(priv, pub) {
-  return new Uint8Array(await subtle2.deriveBits({ name: "ECDH", public: pub }, priv, 256));
-}
-async function ephemeralKeys(pkcs8) {
-  if (pkcs8 === void 0) {
-    const eph = await subtle2.generateKey(ECDH, false, ["deriveBits"]);
-    return { privateKey: eph.privateKey, raw: new Uint8Array(await subtle2.exportKey("raw", eph.publicKey)) };
-  }
-  const der = fromB64u(pkcs8);
-  const probe = await subtle2.importKey("pkcs8", der, ECDH, true, ["deriveBits"]);
-  const jwk = await subtle2.exportKey("jwk", probe);
-  if (!jwk.x || !jwk.y) throw new SealError("bad_key", "ephemeral key has no public coordinates");
-  const raw = concat(new Uint8Array([4]), fromB64u(jwk.x), fromB64u(jwk.y));
-  return { privateKey: await subtle2.importKey("pkcs8", der, ECDH, false, ["deriveBits"]), raw };
-}
-async function startHandshake(self, role, peerPublicKey, opts = {}) {
-  const peerStatic = await importPublicKey(peerPublicKey);
-  const ss = await ecdh(self.privateKey, peerStatic);
-  const eph = await ephemeralKeys(opts.ephemeralPkcs8);
-  const ephRaw = eph.raw;
-  let ephPrivate = eph.privateKey;
-  return {
-    hello: b64u(ephRaw),
-    async finish(peerHello) {
-      const priv = ephPrivate;
-      ephPrivate = null;
-      if (!priv) throw new SealError("bad_key", "handshake already finished");
-      const peerEph = await importPublicKey(peerHello);
-      const peerEphRaw = fromB64u(peerHello);
-      const ee = await ecdh(priv, peerEph);
-      const selfStaticRaw = fromB64u(self.publicKey);
-      const peerStaticRaw = fromB64u(peerPublicKey);
-      const [pcStatic, deviceStatic, pcEph, deviceEph] = role === "pc" ? [selfStaticRaw, peerStaticRaw, ephRaw, peerEphRaw] : [peerStaticRaw, selfStaticRaw, peerEphRaw, ephRaw];
-      const th = new Uint8Array(
-        await subtle2.digest("SHA-256", concat(enc.encode(VERSION), pcStatic, deviceStatic, pcEph, deviceEph))
-      );
-      const ikm = await subtle2.importKey("raw", concat(ss, ee), "HKDF", false, ["deriveBits"]);
-      const okm = new Uint8Array(
-        await subtle2.deriveBits(
-          { name: "HKDF", hash: "SHA-256", salt: th, info: enc.encode(`${VERSION} keys`) },
-          ikm,
-          512
-        )
-      );
-      const aes = (raw, usage) => subtle2.importKey("raw", raw, { name: "AES-GCM" }, false, [usage]);
-      const pcToDevice = okm.slice(0, 32);
-      const deviceToPc = okm.slice(32, 64);
-      const sendKey = await aes(role === "pc" ? pcToDevice : deviceToPc, "encrypt");
-      const recvKey = await aes(role === "pc" ? deviceToPc : pcToDevice, "decrypt");
-      let sendSeq = 0;
-      let recvSeq = 0;
-      const params = (seq) => ({
-        name: "AES-GCM",
-        iv: concat(new Uint8Array(4), seq),
-        additionalData: concat(th, seq)
-      });
-      let sealChain = Promise.resolve();
-      let openChain = Promise.resolve();
-      const serial = (chain, task) => {
-        const run = chain.then(task);
-        return [run, run.catch(() => void 0)];
-      };
-      const sealOne = async (text) => {
-        const seq = seqBytes(sendSeq++);
-        const ct = new Uint8Array(await subtle2.encrypt(params(seq), sendKey, enc.encode(text)));
-        return b64u(concat(seq, ct));
-      };
-      const openOne = async (sealed) => {
-        const frame = fromB64u(sealed);
-        if (frame.length < SEQ_BYTES + TAG_BYTES) throw new SealError("bad_seal", "frame too short");
-        const seq = frame.slice(0, SEQ_BYTES);
-        const got = new DataView(seq.buffer).getBigUint64(0);
-        if (got > BigInt(recvSeq)) throw new SealError("gap", "a frame is missing before this one");
-        if (got < BigInt(recvSeq)) throw new SealError("replay", "frame already seen");
-        let plain;
-        try {
-          plain = await subtle2.decrypt(params(seq), recvKey, frame.slice(SEQ_BYTES));
-        } catch {
-          throw new SealError("bad_seal", "authentication failed");
-        }
-        recvSeq++;
-        try {
-          return dec.decode(plain);
-        } catch {
-          throw new SealError("bad_seal", "payload is not UTF-8");
-        }
-      };
-      return {
-        seal(text) {
-          const [run, next] = serial(sealChain, () => sealOne(text));
-          sealChain = next;
-          return run;
-        },
-        open(sealed) {
-          const [run, next] = serial(openChain, () => openOne(sealed));
-          openChain = next;
-          return run;
-        }
-      };
-    }
-  };
-}
-
-// ../seal/src/pairing.ts
-var subtle3 = globalThis.crypto.subtle;
-var enc2 = new TextEncoder();
-var COMMIT_DOMAIN = "ledge-pair/1 commit";
-var CODE_DOMAIN = "ledge-pair/1 code";
-function randomNonce() {
-  return b64u(globalThis.crypto.getRandomValues(new Uint8Array(32)));
-}
-async function sha256(...parts) {
-  return new Uint8Array(await subtle3.digest("SHA-256", concat(...parts)));
-}
-async function commit(devicePublicKey, deviceNonce) {
-  return b64u(await sha256(enc2.encode(COMMIT_DOMAIN), fromB64u(devicePublicKey), fromB64u(deviceNonce)));
-}
-async function checkCommitment(commitment, devicePublicKey, deviceNonce) {
-  let given;
-  let expected;
-  try {
-    given = fromB64u(commitment);
-    if (fromB64u(deviceNonce).length !== 32) return false;
-    expected = fromB64u(await commit(devicePublicKey, deviceNonce));
-  } catch {
-    return false;
-  }
-  if (given.length !== expected.length) return false;
-  let diff = 0;
-  for (let i = 0; i < expected.length; i++) diff |= given[i] ^ expected[i];
-  return diff === 0;
-}
-async function pairingCode(input) {
-  const hash = await sha256(
-    enc2.encode(CODE_DOMAIN),
-    fromB64u(input.pcPublicKey),
-    fromB64u(input.devicePublicKey),
-    fromB64u(input.deviceNonce),
-    fromB64u(input.pcNonce)
-  );
-  const n = new DataView(hash.buffer, hash.byteOffset, 4).getUint32(0, false) % 1e6;
-  const digits = String(n).padStart(6, "0");
-  return `${digits.slice(0, 3)} ${digits.slice(3)}`;
-}
-
-// ../seal/src/fingerprint.ts
-var subtle4 = globalThis.crypto.subtle;
-var DOMAIN = new TextEncoder().encode("ledge-key/1");
-async function fingerprint(publicKey) {
-  await importPublicKey(publicKey);
-  const digest = await subtle4.digest("SHA-256", concat(DOMAIN, fromB64u(publicKey)));
-  return b64u(new Uint8Array(digest)).slice(0, 22);
-}
-
-// src/mobile/files.ts
-var RelaySessionSchema = z.object({ token: z.string().min(1), accountId: z.string().min(1), login: z.string(), relayUrl: z.string() });
-var DeviceCredentialSchema = z.object({
-  id: z.string().min(1),
-  publicKey: z.string().min(1),
-  alg: z.union([z.literal(-7), z.literal(-257)]),
-  counter: z.number().int().nonnegative(),
-  rpId: z.string().min(1),
-  transports: z.array(z.string()).optional()
-});
-var ApprovedDeviceSchema = z.object({
-  id: z.string().min(1),
-  publicKey: z.string().min(1),
-  label: z.string(),
-  approvedAt: z.string(),
-  lastPeer: z.string().optional(),
-  lastSeenAt: z.string().optional(),
-  credential: DeviceCredentialSchema.optional(),
-  /** The phone's push subscription and the relay's VAPID key it was made with. */
-  push: z.object({ endpoint: z.string().min(1), p256dh: z.string().min(1), auth: z.string().min(1), key: z.string().min(1) }).optional()
-});
-function writePrivate(file, content) {
-  const tmp = `${file}.${process.pid}.tmp`;
-  writeFileSync(tmp, content, { mode: 384 });
-  chmodSync(tmp, 384);
-  renameSync(tmp, file);
-}
-function readText(file, name) {
-  try {
-    return readFileSync(file, "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return null;
-    throw new Error(`${name} cannot be read (${e.code ?? "error"})`);
-  }
-}
-function readJson(file, name, schema) {
-  const raw = readText(file, name);
-  if (raw === null) return null;
-  try {
-    return schema.parse(JSON.parse(raw));
-  } catch {
-    log(`${name} is invalid, ignoring it`);
-    return null;
-  }
-}
-var DEFAULT_CONFIG = () => ({ enabled: false, relayUrl: DEFAULT_RELAY_URL });
-var LEGACY_RELAY_URL = "https://server.ledge.paradow.dev";
-function readMobileConfig() {
-  const c = readJson(paths().mobile, "mobile.json", MobileConfigSchema);
-  if (!c) return DEFAULT_CONFIG();
-  return c.relayUrl === LEGACY_RELAY_URL ? { ...c, relayUrl: DEFAULT_RELAY_URL } : c;
-}
-function writeMobileConfig(c) {
-  writePrivate(paths().mobile, JSON.stringify(MobileConfigSchema.parse(c), null, 2) + "\n");
-}
-function readRelaySession() {
-  const s = readJson(paths().mobileSession, "mobile-session.json", RelaySessionSchema);
-  return s && s.relayUrl === readMobileConfig().relayUrl ? s : null;
-}
-function writeRelaySession(s) {
-  writePrivate(paths().mobileSession, JSON.stringify(RelaySessionSchema.parse(s), null, 2) + "\n");
-}
-function clearRelaySession() {
-  try {
-    unlinkSync(paths().mobileSession);
-  } catch {
-  }
-}
-async function loadPcIdentity() {
-  const file = paths().mobileKey;
-  const stored = readText(file, "mobile-key")?.trim();
-  if (stored) {
-    try {
-      return await importIdentity(stored);
-    } catch {
-      log("mobile-key is invalid, creating a new key");
-    }
-  }
-  const id = await generateIdentity({ extractable: true });
-  writePrivate(file, await exportIdentity(id));
-  return importIdentity(await exportIdentity(id));
-}
-function readDevices() {
-  return readJson(paths().devices, "devices.json", z.array(ApprovedDeviceSchema)) ?? [];
-}
-function writeDevices(list) {
-  writePrivate(paths().devices, JSON.stringify(z.array(ApprovedDeviceSchema).parse(list), null, 2) + "\n");
-}
-var RevocationSchema = z.object({ peer: z.string().min(1), at: z.string() });
-function readRevocations() {
-  return readJson(paths().revocations, "revocations.json", z.array(RevocationSchema)) ?? [];
-}
-function writeRevocations(list) {
-  writePrivate(paths().revocations, JSON.stringify(z.array(RevocationSchema).parse(list), null, 2) + "\n");
-}
-
-// src/mobile/link.ts
-import WebSocket from "ws";
-var BACKOFF_FIRST_MS = 1e3;
-var BACKOFF_MAX_MS = 6e4;
-var PING_EVERY_MS = 25e3;
-var PONG_WITHIN_MS = 1e4;
-var WELCOME_WITHIN_MS = 15e3;
-var ERROR_MAX = 200;
-var realSchedule = (fn, ms) => {
-  const h = setTimeout(fn, ms);
-  return () => clearTimeout(h);
-};
-function wsUrl(relayUrl) {
-  const u = new URL("/ws", relayUrl);
-  u.protocol = u.protocol === "http:" ? "ws:" : "wss:";
-  return u.toString();
-}
-function createRelayLink(opts) {
-  const now = opts.now ?? Date.now;
-  const random = opts.random ?? Math.random;
-  const schedule = opts.schedule ?? realSchedule;
-  const Impl = opts.WebSocketImpl ?? WebSocket;
-  const url = wsUrl(opts.relayUrl);
-  let state = "off";
-  let ws = null;
-  let failures = 0;
-  let cancelRetry = null;
-  let cancelPing = null;
-  let cancelDeadline = null;
-  let finished = false;
-  const setState = (s) => {
-    state = s.state;
-    opts.onState(s);
-  };
-  const stopPing = () => {
-    cancelPing?.();
-    cancelPing = null;
-  };
-  const stopDeadline = () => {
-    cancelDeadline?.();
-    cancelDeadline = null;
-  };
-  const armDeadline = (sock, error) => {
-    stopDeadline();
-    cancelDeadline = schedule(() => {
-      cancelDeadline = null;
-      if (ws === sock) fail(error);
-    }, WELCOME_WITHIN_MS);
-  };
-  const drop = () => {
-    stopPing();
-    stopDeadline();
-    const old = ws;
-    ws = null;
-    if (old) {
-      old.removeAllListeners();
-      old.on("error", () => {
-      });
-      old.terminate();
-    }
-  };
-  const nextDelay = () => {
-    const base = Math.min(BACKOFF_FIRST_MS * 2 ** failures, BACKOFF_MAX_MS);
-    failures++;
-    const jittered = base * (1 + (random() * 2 - 1) * 0.2);
-    return Math.round(Math.min(jittered, BACKOFF_MAX_MS));
-  };
-  const fail = (error) => {
-    drop();
-    if (finished) return;
-    const delay2 = nextDelay();
-    const cut = error.slice(0, ERROR_MAX);
-    log(`mobile link: offline (${cut}), retry in ${delay2} ms`);
-    setState({ state: "offline", retryAt: new Date(now() + delay2).toISOString(), error: cut });
-    cancelRetry = schedule(() => {
-      cancelRetry = null;
-      connect();
-    }, delay2);
-  };
-  const signedOut = (reason) => {
-    drop();
-    finished = true;
-    log(`mobile link: signed out (${reason})`);
-    setState({ state: "signed_out", reason });
-  };
-  const armPing = (sock) => {
-    stopPing();
-    cancelPing = schedule(() => {
-      if (ws !== sock) return;
-      sock.ping();
-      cancelPing = schedule(() => {
-        if (ws === sock) fail("no pong from the relay");
-      }, PONG_WITHIN_MS);
-    }, PING_EVERY_MS);
-  };
-  const connect = () => {
-    if (finished) return;
-    setState({ state: "connecting" });
-    const sock = new Impl(url, { headers: { authorization: `Bearer ${opts.token}` } });
-    ws = sock;
-    armDeadline(sock, "no answer to the upgrade from the relay");
-    let lastError = "";
-    sock.on("error", (e) => {
-      lastError = e.message;
-    });
-    sock.on("unexpected-response", (_req, res) => {
-      if (ws !== sock) return;
-      res.resume();
-      if (res.statusCode === 401) signedOut("session_invalid");
-      else fail(`unexpected server response: ${res.statusCode ?? 0}`);
-    });
-    sock.on("open", () => {
-      if (ws !== sock) return;
-      armDeadline(sock, "no welcome from the relay");
-      armPing(sock);
-    });
-    sock.on("pong", () => {
-      if (ws === sock) armPing(sock);
-    });
-    sock.on("message", (data) => {
-      if (ws !== sock) return;
-      let parsed;
-      try {
-        parsed = JSON.parse(data.toString());
-      } catch {
-        parsed = void 0;
-      }
-      const r = RelayServerMessageSchema.safeParse(parsed);
-      if (!r.success) {
-        log("mobile link: ignored an invalid relay frame");
-        return;
-      }
-      if (r.data.type === "welcome") {
-        failures = 0;
-        stopDeadline();
-        if (state !== "online") {
-          log("mobile link: online");
-          setState({ state: "online" });
-        }
-      }
-      opts.onMessage(r.data);
-    });
-    sock.on("close", (code) => {
-      if (ws !== sock) return;
-      if (code === RELAY_CLOSE_SIGNED_OUT) signedOut("other_pc");
-      else fail(lastError || `connection closed (${code})`);
-    });
-  };
-  connect();
-  return {
-    send(m) {
-      if (state !== "online" || !ws || ws.readyState !== WebSocket.OPEN) return false;
-      ws.send(JSON.stringify(m));
-      return true;
-    },
-    retryNow() {
-      if (finished || state !== "offline") return;
-      cancelRetry?.();
-      cancelRetry = null;
-      connect();
-    },
-    close() {
-      if (state === "off" && finished) return;
-      finished = true;
-      cancelRetry?.();
-      cancelRetry = null;
-      const old = ws;
-      stopPing();
-      stopDeadline();
-      ws = null;
-      if (old) {
-        old.removeAllListeners();
-        old.on("error", () => {
-        });
-        if (old.readyState === WebSocket.OPEN) old.close(1e3);
-        else old.terminate();
-      }
-      setState({ state: "off" });
-    }
-  };
-}
-
-// src/mobile/signin.ts
-import { setTimeout as delay } from "timers/promises";
-var CALL_TIMEOUT_MS = 15e3;
-var ERROR_MAX2 = 200;
-var Cancelled = class extends Error {
-};
-function startSignIn(opts) {
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const abort = new AbortController();
-  const sleep = opts.sleep ?? ((ms) => delay(ms, void 0, { signal: abort.signal }));
-  let cancelled = false;
-  let deviceCode = "";
-  const onCancel = new Promise((_resolve, reject) => {
-    abort.signal.addEventListener("abort", () => reject(new Cancelled()), { once: true });
-  });
-  onCancel.catch(() => {
-  });
-  const guard = (p) => Promise.race([p, onCancel]);
-  const post = async (path, body) => {
-    if (cancelled) throw new Cancelled();
-    const res = await guard(fetchImpl(new URL(path, opts.relayUrl).toString(), {
-      method: "POST",
-      headers: body === void 0 ? {} : { "content-type": "application/json" },
-      ...body === void 0 ? {} : { body: JSON.stringify(body) },
-      signal: AbortSignal.any([abort.signal, AbortSignal.timeout(CALL_TIMEOUT_MS)])
-    }));
-    if (!res.ok) throw new Error(`relay answered ${res.status}`);
-    return guard(res.json());
-  };
-  const run = async () => {
-    const start = DeviceStartResponseSchema.parse(await post("/auth/device/start"));
-    deviceCode = start.deviceCode;
-    opts.onCode({
-      userCode: start.userCode,
-      verificationUri: start.verificationUri,
-      expiresAt: new Date(Date.now() + start.expiresIn * 1e3).toISOString()
-    });
-    let interval = start.interval;
-    for (; ; ) {
-      await guard(sleep(interval * 1e3));
-      const poll = DevicePollResponseSchema.parse(await post("/auth/device/poll", { deviceCode }));
-      switch (poll.status) {
-        case "pending":
-          break;
-        case "slow_down":
-          interval = poll.interval;
-          break;
-        case "ok":
-          return { status: "ok", session: { token: poll.token, accountId: poll.accountId, login: poll.login, relayUrl: opts.relayUrl } };
-        default:
-          return { status: poll.status };
-      }
-    }
-  };
-  const result = run().catch((e) => {
-    if (cancelled || e instanceof Cancelled) return { status: "cancelled" };
-    let error = e instanceof Error ? e.name === "ZodError" ? "invalid relay answer" : e.message : "sign-in failed";
-    if (deviceCode) error = error.split(deviceCode).join("[redacted]");
-    return { status: "failed", error: error.slice(0, ERROR_MAX2) };
-  });
-  return {
-    result,
-    cancel() {
-      if (cancelled) return;
-      cancelled = true;
-      abort.abort();
-    }
-  };
-}
-async function signOut(session, fetchImpl = fetch) {
-  try {
-    const res = await fetchImpl(new URL("/auth/logout", session.relayUrl).toString(), {
-      method: "POST",
-      headers: { authorization: `Bearer ${session.token}` },
-      signal: AbortSignal.timeout(CALL_TIMEOUT_MS)
-    });
-    await res.body?.cancel();
-  } catch {
-  }
-}
-
-// src/mobile/pairing.ts
-var PAIRING_TTL_MS = 5 * 6e4;
-var MAX_PAIRINGS = 3;
-var PAIRING_LINGER_MS = 1e4;
-var DEFAULT_LABEL = "Appareil";
-var realSchedule2 = (fn, ms) => {
-  const h = setTimeout(fn, ms);
-  return () => clearTimeout(h);
-};
-function cleanLabel(raw) {
-  let s = raw.replace(new RegExp("\\p{Cc}", "gu"), "").trim();
-  if (s.length > PAIR_LABEL_MAX) {
-    s = s.slice(0, PAIR_LABEL_MAX);
-    if (/[\uD800-\uDBFF]$/.test(s)) s = s.slice(0, -1);
-    s = s.trim();
-  }
-  return s || DEFAULT_LABEL;
-}
-var isPairFrame = (f) => f.k.startsWith("pair_");
-function createPairing(opts) {
-  const now = opts.now ?? Date.now;
-  const ttlMs = opts.ttlMs ?? PAIRING_TTL_MS;
-  const schedule = opts.schedule ?? realSchedule2;
-  const entries = /* @__PURE__ */ new Map();
-  let stopped = false;
-  const active = (e) => e.state === "waiting" || e.state === "confirm" || e.state === "approved";
-  const remove = (e) => {
-    e.cancelTimer();
-    if (entries.get(e.peer) === e) entries.delete(e.peer);
-  };
-  const settle = (e, state) => {
-    e.cancelTimer();
-    e.state = state;
-    e.cancelTimer = schedule(() => {
-      if (entries.get(e.peer) !== e) return;
-      entries.delete(e.peer);
-      opts.onChange();
-    }, PAIRING_LINGER_MS);
-    opts.onChange();
-  };
-  const onTtl = (e) => {
-    if (entries.get(e.peer) !== e) return;
-    if (e.state === "waiting" || e.state === "confirm") {
-      log(`mobile pairing: expired for peer ${e.peer}`);
-      settle(e, "expired");
-    } else if (e.state === "approved") {
-      remove(e);
-      opts.onChange();
-    }
-  };
-  const byId = (id) => [...entries.values()].find((e) => e.id === id);
-  const onCommit = (peer, frame) => {
-    const old = entries.get(peer);
-    if (old) remove(old);
-    const others = [...entries.values()].filter(active).length;
-    if (others >= MAX_PAIRINGS) {
-      log(`mobile pairing: refused peer ${peer}, ${MAX_PAIRINGS} pairings already pending`);
-      opts.send(peer, { k: "pair_no" });
-      if (old) opts.onChange();
-      return;
-    }
-    const e = {
-      id: b64u(globalThis.crypto.getRandomValues(new Uint8Array(16))),
-      peer,
-      label: cleanLabel(frame.label),
-      commitment: frame.c,
-      pcNonce: randomNonce(),
-      expiresAt: now() + ttlMs,
-      state: "waiting",
-      code: null,
-      device: null,
-      revealing: false,
-      cancelTimer: () => {
-      }
-    };
-    entries.set(peer, e);
-    e.cancelTimer = schedule(() => onTtl(e), ttlMs);
-    opts.send(peer, { k: "pair_offer", pc: opts.pc.publicKey, n: e.pcNonce });
-    opts.onChange();
-  };
-  const onReveal = async (peer, frame) => {
-    const e = entries.get(peer);
-    if (!e || e.state !== "waiting" || e.revealing) return;
-    e.revealing = true;
-    let ok = false;
-    let code = "";
-    let id = "";
-    try {
-      await importPublicKey(frame.d);
-      if (fromB64u(frame.n).length === 32 && await checkCommitment(e.commitment, frame.d, frame.n)) {
-        code = await pairingCode({ pcPublicKey: opts.pc.publicKey, devicePublicKey: frame.d, deviceNonce: frame.n, pcNonce: e.pcNonce });
-        id = await fingerprint(frame.d);
-        ok = true;
-      }
-    } catch {
-      ok = false;
-    }
-    if (stopped || entries.get(peer) !== e || e.state !== "waiting") return;
-    e.revealing = false;
-    if (!ok) {
-      log(`mobile pairing: reveal from peer ${peer} does not match its commitment`);
-      remove(e);
-      opts.send(peer, { k: "pair_no" });
-      opts.onChange();
-      return;
-    }
-    e.code = code;
-    e.device = { publicKey: frame.d, fingerprint: id };
-    e.state = "confirm";
-    opts.onChange();
-  };
-  return {
-    async receive(peer, frame) {
-      if (!isPairFrame(frame)) return false;
-      if (stopped) return true;
-      if (frame.k === "pair_commit") onCommit(peer, frame);
-      else if (frame.k === "pair_reveal") await onReveal(peer, frame);
-      return true;
-    },
-    approve(id) {
-      const e = byId(id);
-      if (!e || e.state !== "confirm" || !e.device) return;
-      if (now() > e.expiresAt) {
-        settle(e, "expired");
-        return;
-      }
-      opts.approve({
-        id: e.device.fingerprint,
-        publicKey: e.device.publicKey,
-        label: e.label,
-        approvedAt: new Date(now()).toISOString(),
-        lastPeer: e.peer
-      });
-      log(`mobile pairing: approved device ${e.device.fingerprint}`);
-      opts.send(e.peer, { k: "pair_ok" });
-      e.state = "approved";
-      e.cancelTimer();
-      e.expiresAt = now() + ttlMs;
-      e.cancelTimer = schedule(() => onTtl(e), ttlMs);
-      opts.onChange();
-    },
-    deny(id) {
-      const e = byId(id);
-      if (!e || e.state !== "confirm" && e.state !== "waiting") return;
-      opts.send(e.peer, { k: "pair_no" });
-      settle(e, "refused");
-    },
-    linked(deviceId) {
-      const e = [...entries.values()].find((x) => x.state === "approved" && x.device?.fingerprint === deviceId);
-      if (e) settle(e, "linked");
-    },
-    views() {
-      return [...entries.values()].map((e) => ({
-        id: e.id,
-        label: e.label,
-        code: e.code,
-        expiresAt: new Date(e.expiresAt).toISOString(),
-        state: e.state
-      }));
-    },
-    reset() {
-      const dropped = [...entries.values()].filter((e) => e.state === "waiting" || e.state === "confirm");
-      for (const e of dropped) remove(e);
-      if (dropped.length) opts.onChange();
-    },
-    stop() {
-      stopped = true;
-      for (const e of entries.values()) e.cancelTimer();
-      entries.clear();
-    }
-  };
-}
-
-// src/mobile/channels.ts
-var READY = '{"t":"ready"}';
-var REKEY_INTERVAL_MS = 2e3;
-var REKEY_TABLE_PRUNE_AT = 256;
-var codeOf = (err) => err instanceof SealError ? err.code : err instanceof Error ? err.name : "error";
-function createChannels(opts) {
-  const now = opts.now ?? Date.now;
-  const entries = /* @__PURE__ */ new Map();
-  const lastDevice = /* @__PURE__ */ new Map();
-  const lastRekey = /* @__PURE__ */ new Map();
-  const queues = /* @__PURE__ */ new Map();
-  let epoch = 0;
-  const peerGen = /* @__PURE__ */ new Map();
-  let confirmations = 0;
-  let pcFingerprint = null;
-  const approved = (deviceId, publicKey) => opts.devices().find((d) => d.id === deviceId && (publicKey === void 0 || d.publicKey === publicKey));
-  const hasConfirmed = (deviceId) => [...entries.values()].some((e) => e.deviceId === deviceId && e.confirmed);
-  const close = (e, why) => {
-    if (entries.get(e.peer) !== e) return;
-    entries.delete(e.peer);
-    log(`mobile channel: closed for device ${e.deviceId} on peer ${e.peer} (${why})`);
-    if (e.confirmed && !hasConfirmed(e.deviceId)) opts.onClosed(e.deviceId);
-  };
-  const denied = (peer) => opts.send(peer, { k: "denied" });
-  const rekey = (peer) => {
-    const t = now();
-    const last = lastRekey.get(peer);
-    if (last !== void 0 && t - last < REKEY_INTERVAL_MS) return;
-    if (lastRekey.size >= REKEY_TABLE_PRUNE_AT) {
-      for (const [p, at] of lastRekey) if (t - at >= REKEY_INTERVAL_MS) lastRekey.delete(p);
-    }
-    lastRekey.set(peer, t);
-    opts.send(peer, { k: "rekey" });
-  };
-  const onHello = async (peer, frame) => {
-    const device = approved(frame.f);
-    if (!device || await fingerprint(device.publicKey).catch(() => null) !== device.id) {
-      log(`mobile channel: denied hello from peer ${peer} for fingerprint ${frame.f}`);
-      denied(peer);
-      return;
-    }
-    const e0 = epoch;
-    const g0 = peerGen.get(peer) ?? 0;
-    let channel;
-    let reply;
-    try {
-      const hs = await startHandshake(opts.pc, "pc", device.publicKey);
-      channel = await hs.finish(frame.e);
-      reply = hs.hello;
-    } catch (err) {
-      log(`mobile channel: handshake failed for device ${device.id} on peer ${peer} (${codeOf(err)})`);
-      const old2 = entries.get(peer);
-      if (old2) close(old2, "new hello");
-      if (epoch === e0 && (peerGen.get(peer) ?? 0) === g0) rekey(peer);
-      return;
-    }
-    pcFingerprint ??= fingerprint(opts.pc.publicKey);
-    const f = await pcFingerprint;
-    if (epoch !== e0 || (peerGen.get(peer) ?? 0) !== g0) return;
-    if (!approved(device.id, device.publicKey)) {
-      log(`mobile channel: denied hello from peer ${peer}, device ${device.id} revoked`);
-      denied(peer);
-      return;
-    }
-    const old = entries.get(peer);
-    if (old) close(old, "new hello");
-    entries.set(peer, { peer, deviceId: device.id, publicKey: device.publicKey, channel, confirmed: false, confirmedSeq: 0 });
-    lastDevice.set(peer, device.id);
-    log(`mobile channel: hello from device ${device.id} on peer ${peer}`);
-    opts.send(peer, { k: "hello", e: reply, f });
-  };
-  const onMsg = async (peer, frame) => {
-    const e = entries.get(peer);
-    if (!e) {
-      const id = lastDevice.get(peer);
-      if (id !== void 0 && !approved(id)) {
-        log(`mobile channel: denied msg from peer ${peer}, device ${id} revoked`);
-        denied(peer);
-      } else {
-        rekey(peer);
-      }
-      return;
-    }
-    if (!approved(e.deviceId, e.publicKey)) {
-      close(e, "revoked");
-      denied(peer);
-      return;
-    }
-    let text;
-    try {
-      text = await e.channel.open(frame.s);
-    } catch (err) {
-      if (err instanceof SealError && err.code === "replay") return;
-      if (entries.get(peer) !== e) return;
-      close(e, codeOf(err));
-      rekey(peer);
-      return;
-    }
-    if (entries.get(peer) !== e) return;
-    if (!approved(e.deviceId, e.publicKey)) {
-      close(e, "revoked");
-      denied(peer);
-      return;
-    }
-    if (e.confirmed) {
-      opts.onMessage(e.deviceId, text);
-      return;
-    }
-    if (text !== READY) {
-      close(e, "no key confirmation");
-      rekey(peer);
-      return;
-    }
-    const sealed = await e.channel.seal(READY);
-    if (entries.get(peer) !== e) return;
-    e.confirmed = true;
-    e.confirmedSeq = ++confirmations;
-    opts.send(peer, { k: "msg", s: sealed });
-    log(`mobile channel: confirmed device ${e.deviceId} on peer ${peer}`);
-    opts.onConfirmed(e.deviceId, peer);
-  };
-  const handle = async (peer, frame) => {
-    if (frame.k === "hello") await onHello(peer, frame);
-    else if (frame.k === "msg") await onMsg(peer, frame);
-  };
-  return {
-    receive(peer, frame) {
-      const run = (queues.get(peer) ?? Promise.resolve()).then(() => handle(peer, frame)).catch((err) => log(`mobile channel: error on peer ${peer} (${codeOf(err)})`));
-      queues.set(peer, run);
-      void run.then(() => {
-        if (queues.get(peer) === run) queues.delete(peer);
-      });
-      return run;
-    },
-    async send(deviceId, text) {
-      let best = null;
-      for (const e2 of entries.values()) {
-        if (e2.deviceId === deviceId && e2.confirmed && (!best || e2.confirmedSeq > best.confirmedSeq)) best = e2;
-      }
-      if (!best || !approved(best.deviceId, best.publicKey)) return false;
-      const e = best;
-      const sealed = await e.channel.seal(text);
-      if (entries.get(e.peer) !== e) return false;
-      opts.send(e.peer, { k: "msg", s: sealed });
-      return true;
-    },
-    drop(peer) {
-      peerGen.set(peer, (peerGen.get(peer) ?? 0) + 1);
-      const e = entries.get(peer);
-      if (e) close(e, "peer gone");
-    },
-    dropDevice(deviceId) {
-      for (const e of [...entries.values()]) if (e.deviceId === deviceId) close(e, "revoked");
-    },
-    reset() {
-      epoch++;
-      peerGen.clear();
-      for (const e of [...entries.values()]) close(e, "relay welcome");
-    },
-    online() {
-      return new Set([...entries.values()].filter((e) => e.confirmed).map((e) => e.deviceId));
-    }
-  };
-}
-
-// src/mobile/service.ts
-var REVOKE_TIMEOUT_MS = 15e3;
-var PUSH_TIMEOUT_MS = 1e4;
-var REVOCATION_MAX_AGE_MS = 30 * 864e5;
-async function createMobileService(opts = {}) {
-  const now = opts.now ?? Date.now;
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const pc = await loadPcIdentity();
-  let config = readMobileConfig();
-  let session = readRelaySession();
-  let devices = readDevices();
-  let revocations = readRevocations();
-  let link = null;
-  let linkState = { state: "off" };
-  let signin = null;
-  let signinError = null;
-  let signinRun = null;
-  let stopped = false;
-  let pushKey;
-  const changeListeners = /* @__PURE__ */ new Set();
-  const messageListeners = /* @__PURE__ */ new Set();
-  const changed = () => {
-    if (stopped) return;
-    for (const fn of changeListeners) {
-      try {
-        fn();
-      } catch (e) {
-        log(`mobile: change listener failed (${e.message})`);
-      }
-    }
-  };
-  const sendFrame = (peer, frame) => {
-    link?.send({ type: "send", to: peer, body: JSON.stringify(frame) });
-  };
-  const saveDevices = (next) => {
-    writeDevices(next);
-    devices = next;
-  };
-  const pairing = createPairing({
-    pc,
-    send: sendFrame,
-    approve(d) {
-      const old = devices.find((x) => x.id === d.id);
-      saveDevices(old ? devices.map((x) => x.id === d.id ? { ...x, label: d.label } : x) : [...devices, d]);
-    },
-    onChange: changed,
-    now,
-    ...opts.schedule ? { schedule: opts.schedule } : {}
-  });
-  const channels = createChannels({
-    pc,
-    devices: () => devices,
-    send: sendFrame,
-    onConfirmed(deviceId, peer) {
-      if (devices.some((d) => d.id === deviceId)) {
-        const at = new Date(now()).toISOString();
-        try {
-          saveDevices(devices.map((d) => d.id === deviceId ? { ...d, lastPeer: peer, lastSeenAt: at } : d));
-        } catch (e) {
-          log(`mobile: devices.json not written (${e.message})`);
-        }
-      }
-      pairing.linked(deviceId);
-      changed();
-    },
-    onMessage(deviceId, text) {
-      for (const fn of messageListeners) {
-        try {
-          fn(deviceId, text);
-        } catch (e) {
-          log(`mobile: message listener failed (${e.message})`);
-        }
-      }
-    },
-    onClosed: () => changed(),
-    now
-  });
-  const onRelayMessage = (m) => {
-    switch (m.type) {
-      case "welcome":
-        channels.reset();
-        pairing.reset();
-        changed();
-        return;
-      case "deliver": {
-        if (m.from === "pc") return;
-        let raw;
-        try {
-          raw = JSON.parse(m.body);
-        } catch {
-          return;
-        }
-        const r = SealedFrameSchema.safeParse(raw);
-        if (!r.success) return;
-        if (r.data.k.startsWith("pair_")) {
-          pairing.receive(m.from, r.data).catch((e) => log(`mobile pairing: error on peer ${m.from} (${e.name})`));
-        } else {
-          void channels.receive(m.from, r.data);
-        }
-        return;
-      }
-      case "presence":
-        if (!m.online) channels.drop(m.peer);
-        return;
-      case "error":
-        if (m.to) channels.drop(m.to);
-        return;
-    }
-  };
-  const closeLink = () => {
-    const old = link;
-    link = null;
-    old?.close();
-    if (old) pairing.reset();
-    linkState = { state: "off" };
-    pushKey = void 0;
-  };
-  const openLink = () => {
-    if (stopped || link || !config.enabled || !session) return;
-    const self = { link: null };
-    const created = createRelayLink({
-      relayUrl: session.relayUrl,
-      token: session.token,
-      onState(s) {
-        if (self.link !== null && link !== self.link) return;
-        linkState = s;
-        changed();
-        if (s.state === "online") {
-          void retryRevocations();
-          void readPushKey();
-        }
-      },
-      onMessage(m) {
-        if (link !== self.link) return;
-        onRelayMessage(m);
-      },
-      now,
-      ...opts.WebSocketImpl ? { WebSocketImpl: opts.WebSocketImpl } : {},
-      ...opts.schedule ? { schedule: opts.schedule } : {}
-    });
-    self.link = created;
-    link = created;
-  };
-  const cancelSignin = () => {
-    signinRun?.cancel();
-    signinRun = null;
-    signin = null;
-  };
-  const startSignin = () => {
-    if (!config.enabled) throw new Error("mobile access is disabled");
-    cancelSignin();
-    signinError = null;
-    const relayUrl = config.relayUrl;
-    const run = startSignIn({
-      relayUrl,
-      onCode(c) {
-        if (signinRun !== run) return;
-        signin = c;
-        changed();
-      },
-      fetchImpl,
-      ...opts.sleep ? { sleep: opts.sleep } : {}
-    });
-    signinRun = run;
-    void run.result.then((r) => {
-      if (signinRun !== run) return;
-      signinRun = null;
-      signin = null;
-      if (r.status === "ok") {
-        writeRelaySession(r.session);
-        session = r.session;
-        log(`mobile: signed in as ${r.session.login}`);
-        closeLink();
-        openLink();
-      } else if (r.status !== "cancelled") {
-        signinError = r.status;
-        log(`mobile: sign-in ended (${r.status === "failed" ? r.error : r.status})`);
-      }
-      changed();
-    }).catch((e) => {
-      log(`mobile: sign-in not saved (${e.message})`);
-      if (signinRun === null) {
-        signinError = "failed";
-        changed();
-      }
-    });
-  };
-  const saveRevocations = (next) => {
-    try {
-      writeRevocations(next);
-    } catch (e) {
-      log(`mobile: revocations.json not written (${e.message})`);
-    }
-    revocations = next;
-  };
-  const revoking = /* @__PURE__ */ new Set();
-  const tryRevoke = async (peer) => {
-    if (!session || linkState.state !== "online" || revoking.has(peer)) return;
-    revoking.add(peer);
-    try {
-      const res = await fetchImpl(new URL("/auth/devices/revoke", session.relayUrl).toString(), {
-        method: "POST",
-        headers: { authorization: `Bearer ${session.token}`, "content-type": "application/json" },
-        body: JSON.stringify({ peer }),
-        signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
-      });
-      await res.body?.cancel();
-      if (res.ok || res.status === 404) {
-        saveRevocations(revocations.filter((r) => r.peer !== peer));
-        log(`mobile: relay revoked peer ${peer}`);
-      } else log(`mobile: relay did not revoke peer ${peer} (status ${res.status}), kept for a retry`);
-    } catch (e) {
-      log(`mobile: relay did not revoke peer ${peer} (${e.name}), kept for a retry`);
-    } finally {
-      revoking.delete(peer);
-    }
-  };
-  const readPushKey = async () => {
-    const at = session;
-    if (!at) return;
-    try {
-      const res = await fetchImpl(new URL("/push/key", at.relayUrl).toString(), {
-        headers: { authorization: `Bearer ${at.token}` },
-        signal: AbortSignal.timeout(PUSH_TIMEOUT_MS)
-      });
-      let next;
-      if (res.status === 404) {
-        next = null;
-        await res.body?.cancel();
-      } else if (res.ok) {
-        const body = await res.json();
-        next = typeof body.publicKey === "string" && body.publicKey ? body.publicKey : void 0;
-      } else await res.body?.cancel();
-      if (next !== void 0 && session === at && next !== pushKey) {
-        pushKey = next;
-        changed();
-      }
-    } catch (e) {
-      log(`mobile: relay push key not read (${e.name})`);
-    }
-  };
-  const retryRevocations = async () => {
-    const limit = now() - REVOCATION_MAX_AGE_MS;
-    const stale = revocations.filter((r) => !(Date.parse(r.at) >= limit));
-    if (stale.length > 0) {
-      for (const r of stale) log(`mobile: giving up the revocation of peer ${r.peer} (older than 30 days)`);
-      saveRevocations(revocations.filter((r) => !stale.includes(r)));
-    }
-    await Promise.all(revocations.map((r) => tryRevoke(r.peer)));
-  };
-  const revokeOnRelay = async (peer) => {
-    if (!revocations.some((r) => r.peer === peer)) saveRevocations([...revocations, { peer, at: new Date(now()).toISOString() }]);
-    await tryRevoke(peer);
-  };
-  const revoke = async (id) => {
-    const d = devices.find((x) => x.id === id);
-    if (!d) return;
-    saveDevices(devices.filter((x) => x.id !== id));
-    log(`mobile: revoked device ${id}`);
-    channels.dropDevice(id);
-    if (d.lastPeer) sendFrame(d.lastPeer, { k: "denied" });
-    changed();
-    if (d.lastPeer) await revokeOnRelay(d.lastPeer);
-  };
-  const pairingIn = (id, states) => {
-    const p = pairing.views().find((v) => v.id === id);
-    if (!p || !states.includes(p.state)) throw new Error("no such pairing waiting for a decision");
-  };
-  openLink();
-  return {
-    state() {
-      const online = linkState.state === "online" ? channels.online() : /* @__PURE__ */ new Set();
-      return {
-        enabled: config.enabled,
-        relayUrl: config.relayUrl,
-        account: session ? { login: session.login, accountId: session.accountId } : null,
-        signin,
-        signinError,
-        link: linkState,
-        devices: devices.map((d) => ({
-          id: d.id,
-          label: d.label,
-          approvedAt: d.approvedAt,
-          online: online.has(d.id),
-          ...d.lastSeenAt ? { lastSeenAt: d.lastSeenAt } : {}
-        })),
-        pairings: pairing.views()
-      };
-    },
-    revoke,
-    credential(deviceId) {
-      const c = devices.find((d) => d.id === deviceId)?.credential;
-      return c && c.rpId === rpOf(config.relayUrl)?.rpId ? c : null;
-    },
-    setCredential(deviceId, c) {
-      if (!devices.some((d) => d.id === deviceId)) throw new Error("no such device");
-      saveDevices(devices.map((d) => d.id === deviceId ? { ...d, credential: c } : d));
-    },
-    pushOf(deviceId) {
-      return devices.find((d) => d.id === deviceId)?.push ?? null;
-    },
-    setPush(deviceId, p) {
-      if (!devices.some((d) => d.id === deviceId)) throw new Error("no such device");
-      saveDevices(devices.map((d) => {
-        if (d.id !== deviceId) return d;
-        const { push: _old, ...rest } = d;
-        return p ? { ...rest, push: p } : rest;
-      }));
-      changed();
-    },
-    relayPushKey: () => pushKey,
-    async sendPush(msg) {
-      const at = session;
-      if (!at || linkState.state !== "online") return { result: "failed" };
-      try {
-        const res = await fetchImpl(new URL("/push/send", at.relayUrl).toString(), {
-          method: "POST",
-          headers: { authorization: `Bearer ${at.token}`, "content-type": "application/json" },
-          body: JSON.stringify(msg),
-          signal: AbortSignal.timeout(PUSH_TIMEOUT_MS)
-        });
-        if (!res.ok) {
-          await res.body?.cancel();
-          return { result: "failed", status: res.status };
-        }
-        const parsed = PushSendResultSchema.safeParse(await res.json());
-        return parsed.success ? parsed.data : { result: "failed" };
-      } catch (e) {
-        log(`mobile: push not sent (${e.name})`);
-        return { result: "failed" };
-      }
-    },
-    onChange(fn) {
-      changeListeners.add(fn);
-      return () => {
-        changeListeners.delete(fn);
-      };
-    },
-    async handle(msg) {
-      if (stopped) throw new Error("mobile access is stopped");
-      switch (msg.type) {
-        case "mobile.set": {
-          const next = { enabled: msg.enabled, relayUrl: msg.relayUrl };
-          const moved = next.relayUrl !== config.relayUrl;
-          writeMobileConfig(next);
-          config = next;
-          if (moved) {
-            cancelSignin();
-            clearRelaySession();
-            session = null;
-            closeLink();
-          }
-          if (!config.enabled) {
-            cancelSignin();
-            closeLink();
-          } else {
-            openLink();
-          }
-          changed();
-          return;
-        }
-        case "mobile.signin":
-          startSignin();
-          changed();
-          return;
-        case "mobile.signin.cancel":
-          cancelSignin();
-          changed();
-          return;
-        case "mobile.signout": {
-          cancelSignin();
-          const old = session;
-          session = null;
-          clearRelaySession();
-          closeLink();
-          changed();
-          if (old) await signOut(old, fetchImpl);
-          log("mobile: signed out");
-          return;
-        }
-        case "mobile.retry":
-          link?.retryNow();
-          return;
-        case "mobile.pairing.approve":
-          pairingIn(msg.id, ["confirm"]);
-          if (linkState.state !== "online") throw new Error("the relay is offline");
-          pairing.approve(msg.id);
-          return;
-        case "mobile.pairing.deny":
-          pairingIn(msg.id, ["confirm", "waiting"]);
-          pairing.deny(msg.id);
-          return;
-        case "mobile.device.revoke":
-          return revoke(msg.id);
-      }
-    },
-    send: (deviceId, text) => channels.send(deviceId, text),
-    onMessage(fn) {
-      messageListeners.add(fn);
-      return () => {
-        messageListeners.delete(fn);
-      };
-    },
-    async stop() {
-      if (stopped) return;
-      cancelSignin();
-      closeLink();
-      pairing.stop();
-      stopped = true;
-      changeListeners.clear();
-      messageListeners.clear();
-    }
-  };
-}
-
-// src/daemon/index.ts
-async function startDaemon(opts = {}) {
-  await ensureLedgeDir();
-  const store = new Store();
-  const loaded = await store.load();
-  const tmux = opts.tmux ?? realTmux(opts.tmuxSocket ?? "ledge");
-  let live = null;
-  try {
-    live = new Set(await tmux.listSessions());
-  } catch (e) {
-    log(`startup prune skipped, tmux unavailable: ${e.message}`);
-  }
-  if (live) for (const s of store.all()) {
-    if (s.tmuxSession && !live.has(s.tmuxSession)) store.apply(s.id, { name: "PaneGone", at: (/* @__PURE__ */ new Date()).toISOString(), source: "daemon" });
-  }
-  for (const s of store.all()) {
-    if (backendOf(s) !== "omp-rpc") continue;
-    await reapOwner(join4(paths().dir, "omp", s.id)).catch(() => false);
-    if (s.state === "exited") continue;
-    const at = (/* @__PURE__ */ new Date()).toISOString();
-    store.apply(s.id, { name: "StopFailure", at, source: "daemon", text: "Ledge restarted: the OMP process ended with it" });
-    store.apply(s.id, { name: "SessionEnd", at, source: "daemon", exitCode: null });
-  }
-  const daemon = await daemonInfo();
-  let ompLive = () => 0;
-  const updater = createDaemonUpdater(realUpdaterDeps({ info: daemon, save: () => store.save(), ownedLive: () => ompLive() }));
-  const attachments = new AttachmentStore(paths().attachments);
-  await attachments.load().catch((e) => log(`attachments not loaded: ${e.message}`));
-  const history = new History({ peerOf: (t) => ledgePeer(t, readPeers(), store.all())?.id, refOf: (id) => attachments.ref(id) });
-  try {
-    await history.load();
-  } catch (e) {
-    log(`history not loaded: ${e.message}`);
-  }
-  if (loaded.clean) {
-    for (const id of history.ids()) if (!store.get(id)) history.forget(id);
-  } else log(`history cleanup skipped: ${loaded.reason}`);
-  let mobile;
-  let mobileUnavailable;
-  try {
-    mobile = await createMobileService();
-  } catch (e) {
-    log(`mobile access not available: ${e.message}`);
-    mobileUnavailable = e.message.slice(0, 200);
-  }
-  const mail = fileJournal(paths().mail);
-  const taskJournal = tasksJournal(paths().tasks);
-  const teamJournal = teamsJournal(paths().teams);
-  const server = await startServer({ store, tmux, port: opts.port, daemon, updater, history, mobile, mobileUnavailable, mail, tasks: taskJournal, teams: teamJournal, attachments });
-  ompLive = () => server.omp.liveCount();
-  const poller = startPoller({ store, tmux, broadcastPreview: server.preview, labelExited: server.labelExited });
-  await writeFile3(paths().pid, String(process.pid));
-  log(`daemon started on ${server.port} with ${store.all().length} sessions`);
-  let stopping = null;
-  const stop = () => stopping ??= (async () => {
-    process.off("SIGTERM", onSignal);
-    process.off("SIGINT", onSignal);
-    poller.stop();
-    await server.close();
-    await mobile?.stop();
-    await store.save();
-    await history.flush();
-    await mail.flush();
-    await taskJournal.flush();
-    await teamJournal.flush();
-    await rm2(paths().pid, { force: true });
-    log("daemon stopped");
-  })();
-  const onSignal = () => {
-    stop().finally(() => process.exit(0));
-  };
-  process.once("SIGTERM", onSignal);
-  process.once("SIGINT", onSignal);
-  return { stop, port: server.port };
-}
-export {
-  startDaemon
-};