@securecoms/agent-bridge 0.1.0 → 0.3.0

package/dist/index.js.pre-p0-20260708-102415

@@ -0,0 +1,4879 @@
+// ../connect-core/dist/envelope/types.js
+var MESSAGE_TYPES = [
+  "text",
+  "decision_request",
+  "decision_response",
+  "status_alert",
+  "artifact_share",
+  "action_confirmation",
+  "heartbeat",
+  "system_event",
+  "a2a"
+];
+var AV_ENVELOPE_VERSION = "1.0";
+
+// ../connect-core/dist/envelope/validate.js
+import _Ajv2020 from "ajv/dist/2020.js";
+import _addFormats from "ajv-formats";
+
+// ../connect-core/dist/envelope/schemas.generated.js
+var envelopeSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentvault.dev/connect/schemas/envelope-1.0.json",
+  "title": "AgentVaultEnvelope",
+  "description": "Canonical client-signed Connect envelope (spec 02 \xA73.2, post-Blocker-1+5). Single source of truth shared by the TypeScript codec (ajv) and the Python edge (jsonschema).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "av_version",
+    "message_id",
+    "channel_id",
+    "enclave_id",
+    "message_type",
+    "sender_id",
+    "sender_type",
+    "identity_proof",
+    "trace_context",
+    "policy_binding",
+    "mls_group_epoch",
+    "replay_nonce",
+    "payload_encrypted",
+    "references"
+  ],
+  "properties": {
+    "av_version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+$",
+      "description": "Envelope wire version (major.minor). Compatibility is enforced in code, not by this pattern."
+    },
+    "message_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "channel_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "enclave_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "message_type": {
+      "type": "string",
+      "enum": [
+        "text",
+        "decision_request",
+        "decision_response",
+        "status_alert",
+        "artifact_share",
+        "action_confirmation",
+        "heartbeat",
+        "system_event",
+        "a2a"
+      ]
+    },
+    "sender_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "sender_type": {
+      "type": "string",
+      "enum": [
+        "human",
+        "agent",
+        "guest"
+      ]
+    },
+    "identity_proof": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signature",
+        "algo",
+        "attested",
+        "canonicalization"
+      ],
+      "properties": {
+        "signature": {
+          "$ref": "#/$defs/base64_nonempty"
+        },
+        "algo": {
+          "type": "string",
+          "enum": [
+            "ed25519",
+            "ecdsa_p384"
+          ]
+        },
+        "attested": {
+          "type": "boolean"
+        },
+        "canonicalization": {
+          "type": "string",
+          "const": "RFC8785"
+        }
+      }
+    },
+    "trace_context": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "traceparent"
+      ],
+      "properties": {
+        "traceparent": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$",
+          "description": "W3C TraceContext traceparent: version-traceid-spanid-flags."
+        },
+        "tracestate": {
+          "type": "string",
+          "maxLength": 512
+        }
+      }
+    },
+    "policy_binding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "binding_id",
+        "version",
+        "agent_skill_id",
+        "delegation_id",
+        "client_stage5_outcome",
+        "client_stage5_evaluators"
+      ],
+      "properties": {
+        "binding_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+          "description": "Policy binding semver."
+        },
+        "agent_skill_id": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "delegation_id": {
+          "oneOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "client_stage5_outcome": {
+          "type": "string",
+          "enum": [
+            "allow",
+            "flag"
+          ]
+        },
+        "client_stage5_evaluators": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 64
+        }
+      }
+    },
+    "mls_group_epoch": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Public DS-tracked epoch counter; the server rejects messages where this is below the channel's current epoch (mls.stale_epoch)."
+    },
+    "replay_nonce": {
+      "$ref": "#/$defs/base64_nonempty"
+    },
+    "payload_encrypted": {
+      "$ref": "#/$defs/base64"
+    },
+    "references": {
+      "type": "array",
+      "maxItems": 64,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "type",
+          "message_id"
+        ],
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "reply_to",
+              "recall",
+              "quote",
+              "reaction"
+            ]
+          },
+          "message_id": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      }
+    },
+    "mentions": {
+      "type": "array",
+      "maxItems": 256,
+      "items": {
+        "type": "string",
+        "format": "uuid"
+      },
+      "description": "Optional plaintext mention-target identity ids for notification routing (FR-MSG-010). The @name display text lives in the encrypted payload; only the target ids are exposed as metadata so the server can fire mention notifications without seeing plaintext."
+    }
+  },
+  "$defs": {
+    "base64": {
+      "type": "string",
+      "pattern": "^$|^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$",
+      "description": "Standard base64 (RFC 4648 \xA74) with mod-4 block structure enforced (rejects lone '=', '==', and malformed padding like 'A='). Empty string permitted because payload_encrypted is opaque at this codec layer. Security-critical fields use base64_nonempty."
+    },
+    "base64_nonempty": {
+      "type": "string",
+      "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$",
+      "description": "Standard base64 (RFC 4648 \xA74), non-empty + mod-4 block structure. Used for replay_nonce and identity_proof.signature, which must always be present on a received (wire) envelope \u2014 an empty nonce defeats replay protection and an empty signature is an unsigned envelope."
+    }
+  }
+};
+var payloadsSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentvault.dev/connect/schemas/payloads-1.0.json",
+  "title": "ConnectPayloads",
+  "description": "Plaintext payload schemas per message_type, validated client-side BEFORE encryption and AFTER decryption (the edge never sees plaintext). v1.0 BASELINE: each schema requires its core field(s); additionalProperties is permitted because exact payload shapes firm up in Phase 1D/1E client + SDK work. The envelope schema (envelope.schema.json) is the strict, spec-pinned contract; these payloads are the evolving inner shapes.",
+  "$defs": {
+    "text": {
+      "type": "object",
+      "required": [
+        "body"
+      ],
+      "properties": {
+        "body": {
+          "type": "string",
+          "maxLength": 1048576
+        },
+        "format": {
+          "type": "string",
+          "enum": [
+            "plain",
+            "markdown"
+          ]
+        },
+        "mentions": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      }
+    },
+    "decision_request": {
+      "type": "object",
+      "required": [
+        "decision_id",
+        "prompt",
+        "options"
+      ],
+      "properties": {
+        "decision_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "prompt": {
+          "type": "string"
+        },
+        "options": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 1
+        },
+        "deadline": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "decision_response": {
+      "type": "object",
+      "required": [
+        "decision_id",
+        "choice"
+      ],
+      "properties": {
+        "decision_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "choice": {
+          "type": "string"
+        }
+      }
+    },
+    "status_alert": {
+      "type": "object",
+      "required": [
+        "severity",
+        "message"
+      ],
+      "properties": {
+        "severity": {
+          "type": "string",
+          "enum": [
+            "info",
+            "warning",
+            "critical"
+          ]
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
+    "artifact_share": {
+      "type": "object",
+      "required": [
+        "artifact_type",
+        "file_id"
+      ],
+      "properties": {
+        "artifact_type": {
+          "type": "string"
+        },
+        "file_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "filename": {
+          "type": "string"
+        }
+      }
+    },
+    "action_confirmation": {
+      "type": "object",
+      "required": [
+        "action"
+      ],
+      "properties": {
+        "action": {
+          "type": "string"
+        },
+        "target_identity": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "outcome": {
+          "type": "string",
+          "enum": [
+            "approved",
+            "denied",
+            "pending"
+          ]
+        }
+      }
+    },
+    "heartbeat": {
+      "type": "object",
+      "properties": {
+        "client_time": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "system_event": {
+      "type": "object",
+      "required": [
+        "event"
+      ],
+      "properties": {
+        "event": {
+          "type": "string"
+        },
+        "detail": {
+          "type": "object"
+        }
+      }
+    },
+    "a2a": {
+      "type": "object",
+      "required": [
+        "a2a_version",
+        "kind",
+        "object"
+      ],
+      "properties": {
+        "a2a_version": {
+          "type": "string"
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "message",
+            "task",
+            "artifact"
+          ]
+        },
+        "object": {
+          "type": "object"
+        }
+      }
+    },
+    "agent_action": {
+      "description": 'The agent_action E2E message body (agent action tree). NOT a message_type \u2014 it rides envelope message_type "system_event"; this "type":"agent_action" field is a body-level discriminator. Two phases: partial (throttled, incremental upsert-by-id while an agent works) and settled (one authoritative full-tree frame, terminal for its runId). Note: this def is compiled standalone (see validate.ts validateAgentActionPayload), so its node sub-schema is nested under a LOCAL $defs (resolved relative to this def, not the sibling top-level $defs) rather than cross-referenced.',
+      "$defs": {
+        "node": {
+          "type": "object",
+          "required": [
+            "id",
+            "type",
+            "title",
+            "status",
+            "ts"
+          ],
+          "properties": {
+            "id": {
+              "type": "string"
+            },
+            "parentId": {
+              "type": "string"
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "step",
+                "tool_call",
+                "sub_task",
+                "result"
+              ]
+            },
+            "title": {
+              "type": "string"
+            },
+            "status": {
+              "type": "string",
+              "enum": [
+                "pending",
+                "running",
+                "done",
+                "error"
+              ]
+            },
+            "detail": {
+              "type": "object",
+              "properties": {
+                "args": {},
+                "output": {},
+                "error": {
+                  "type": "string"
+                }
+              }
+            },
+            "ts": {
+              "type": "number"
+            }
+          }
+        }
+      },
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "v",
+            "type",
+            "phase",
+            "agentActionVersion",
+            "runId",
+            "nodes"
+          ],
+          "properties": {
+            "v": {
+              "const": 1
+            },
+            "type": {
+              "const": "agent_action"
+            },
+            "phase": {
+              "const": "partial"
+            },
+            "agentActionVersion": {
+              "const": "1"
+            },
+            "runId": {
+              "type": "string"
+            },
+            "nodes": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/node"
+              }
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "v",
+            "type",
+            "phase",
+            "agentActionVersion",
+            "runId",
+            "startedAt",
+            "endedAt",
+            "nodes"
+          ],
+          "properties": {
+            "v": {
+              "const": 1
+            },
+            "type": {
+              "const": "agent_action"
+            },
+            "phase": {
+              "const": "settled"
+            },
+            "agentActionVersion": {
+              "const": "1"
+            },
+            "runId": {
+              "type": "string"
+            },
+            "startedAt": {
+              "type": "number"
+            },
+            "endedAt": {
+              "type": "number"
+            },
+            "resultMessageId": {
+              "type": "string"
+            },
+            "nodes": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/node"
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+};
+
+// ../connect-core/dist/envelope/validate.js
+var Ajv2020 = _Ajv2020.default ?? _Ajv2020;
+var addFormats = _addFormats.default ?? _addFormats;
+var ajv = new Ajv2020({ allErrors: true, strict: true });
+addFormats(ajv);
+var envelopeValidator = ajv.compile(envelopeSchema);
+var payloadDefs = payloadsSchema.$defs;
+var payloadValidators = /* @__PURE__ */ new Map();
+for (const t of MESSAGE_TYPES) {
+  const def = payloadDefs[t];
+  if (!def) {
+    throw new Error(`payloads.schema.json is missing a $defs schema for message_type "${t}"`);
+  }
+  payloadValidators.set(t, ajv.compile(def));
+}
+var agentActionDef = payloadDefs["agent_action"];
+if (!agentActionDef) {
+  throw new Error(`payloads.schema.json is missing the "agent_action" $defs schema`);
+}
+var agentActionValidator = ajv.compile(agentActionDef);
+
+// ../connect-core/dist/envelope/sign.js
+import { canonicalize } from "@agentvault/crypto/canonical";
+import { ed25519 } from "@noble/curves/ed25519";
+import { p384 } from "@noble/curves/p384";
+
+// ../connect-core/dist/base64.js
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var LOOKUP = (() => {
+  const t = new Int16Array(256).fill(-1);
+  for (let i = 0; i < ALPHABET.length; i++)
+    t[ALPHABET.charCodeAt(i)] = i;
+  return t;
+})();
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    out += ALPHABET[b0 >> 2];
+    out += ALPHABET[(b0 & 3) << 4 | b1 >> 4];
+    out += i + 1 < bytes.length ? ALPHABET[(b1 & 15) << 2 | b2 >> 6] : "=";
+    out += i + 2 < bytes.length ? ALPHABET[b2 & 63] : "=";
+  }
+  return out;
+}
+function base64ToBytes(s) {
+  const clean = s.replace(/=+$/, "");
+  const len = clean.length;
+  const outLen = Math.floor(len * 6 / 8);
+  const out = new Uint8Array(outLen);
+  let bits = 0;
+  let acc = 0;
+  let o = 0;
+  for (let i = 0; i < len; i++) {
+    const v = LOOKUP[clean.charCodeAt(i)];
+    if (v < 0)
+      throw new Error("base64ToBytes: invalid character");
+    acc = acc << 6 | v;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = acc >> bits & 255;
+    }
+  }
+  return out;
+}
+
+// ../connect-core/dist/envelope/sign.js
+async function canonicalEnvelopeBytes(envelope) {
+  const { signature: _signature, ...proofWithoutSignature } = envelope.identity_proof;
+  const toSign = { ...envelope, identity_proof: proofWithoutSignature };
+  return canonicalize(toSign);
+}
+
+// ../connect-core/dist/envelope/aead.js
+import { gcm } from "@noble/ciphers/aes";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha";
+import { randomBytes } from "@noble/hashes/utils";
+import { canonicalize as canonicalize2 } from "@agentvault/crypto/canonical";
+var APPLICATION_KEY_BYTES = 32;
+var REPLAY_NONCE_BYTES = 24;
+var NONCE_BYTES = {
+  xchacha20poly1305: 24,
+  aes256gcm: 12
+};
+function concatBytes(...parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+function epochToBytes(epoch) {
+  const b = new Uint8Array(8);
+  new DataView(b.buffer).setBigUint64(0, BigInt(epoch), false);
+  return b;
+}
+function buildExporterContext(enclaveId, channelId, epoch) {
+  const enc = new TextEncoder();
+  return concatBytes(enc.encode(enclaveId), enc.encode(channelId), epochToBytes(epoch));
+}
+function cipherFor(suite, key, nonce, aad) {
+  return suite === "aes256gcm" ? gcm(key, nonce, aad) : xchacha20poly1305(key, nonce, aad);
+}
+function assertKey(key) {
+  if (key.length !== APPLICATION_KEY_BYTES) {
+    throw new Error(`application key must be ${APPLICATION_KEY_BYTES} bytes (the MLS exporter output); got ${key.length}`);
+  }
+}
+function sealPayload(p) {
+  assertKey(p.key);
+  const nonce = p.nonce ?? randomBytes(NONCE_BYTES[p.suite]);
+  const ciphertext = cipherFor(p.suite, p.key, nonce, p.associatedData).encrypt(p.plaintext);
+  return concatBytes(nonce, ciphertext);
+}
+function openPayload(p) {
+  assertKey(p.key);
+  const nlen = NONCE_BYTES[p.suite];
+  if (p.ciphertext.length < nlen) {
+    throw new Error("openPayload: ciphertext shorter than the AEAD nonce");
+  }
+  const nonce = p.ciphertext.subarray(0, nlen);
+  const body = p.ciphertext.subarray(nlen);
+  return cipherFor(p.suite, p.key, nonce, p.associatedData).decrypt(body);
+}
+async function buildAssociatedData(fields) {
+  return canonicalize2({
+    message_id: fields.message_id,
+    channel_id: fields.channel_id,
+    sender_id: fields.sender_id,
+    mls_group_epoch: fields.mls_group_epoch,
+    replay_nonce: fields.replay_nonce,
+    policy_binding: fields.policy_binding
+  });
+}
+function generateReplayNonce() {
+  return bytesToBase64(randomBytes(REPLAY_NONCE_BYTES));
+}
+
+// ../connect-core/dist/sdk-dto/validate.js
+import _Ajv20202 from "ajv/dist/2020.js";
+import _addFormats2 from "ajv-formats";
+
+// ../connect-core/dist/sdk-dto/schemas.generated.js
+var modelDescriptorSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentvault.connect.sdk.model_descriptor",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "provider",
+    "name"
+  ],
+  "properties": {
+    "provider": {
+      "type": "string",
+      "minLength": 1
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "version": {
+      "type": "string"
+    }
+  }
+};
+var registerSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentvault.connect.sdk.register_request",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "skill_id",
+    "public_key",
+    "algo",
+    "model"
+  ],
+  "properties": {
+    "skill_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "public_key": {
+      "type": "string",
+      "minLength": 1
+    },
+    "algo": {
+      "type": "string",
+      "enum": [
+        "ed25519",
+        "ecdsa_p384"
+      ]
+    },
+    "attested": {
+      "type": "boolean"
+    },
+    "model": {
+      "$ref": "agentvault.connect.sdk.model_descriptor"
+    }
+  }
+};
+var auditQuerySchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentvault.connect.sdk.audit_query",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "agent_id"
+  ],
+  "properties": {
+    "agent_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "from": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "to": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "channel_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "message_type": {
+      "type": "string"
+    }
+  }
+};
+
+// ../connect-core/dist/sdk-dto/validate.js
+var Ajv20202 = _Ajv20202.default ?? _Ajv20202;
+var addFormats2 = _addFormats2.default ?? _addFormats2;
+var ajv2 = new Ajv20202({ allErrors: true, strict: true });
+addFormats2(ajv2);
+ajv2.addSchema(modelDescriptorSchema, "agentvault.connect.sdk.model_descriptor");
+var modelValidator = ajv2.getSchema("agentvault.connect.sdk.model_descriptor");
+var registerValidator = ajv2.compile(registerSchema);
+var auditQueryValidator = ajv2.compile(auditQuerySchema);
+
+// ../connect-clients-core/dist/stage5/evaluators.js
+var ALLOW = { outcome: "allow" };
+var PHI_PATTERNS = [/\b\d{3}-\d{2}-\d{4}\b/, /\bMRN[:#]?\s*\d{6,}\b/i];
+var IP_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bconfidential\b/i
+];
+var RELEASABILITY_PATTERNS = [/\bNOFORN\b/, /\bdo not (?:forward|share)\b/i];
+function patternEvaluator(id, patterns, reason) {
+  return {
+    id,
+    async evaluate(plaintext) {
+      return patterns.some((p) => p.test(plaintext)) ? { outcome: "flag", reason } : ALLOW;
+    }
+  };
+}
+var phiEvaluator = patternEvaluator("phi", PHI_PATTERNS, "phi.detected");
+var ipEvaluator = patternEvaluator("ip", IP_PATTERNS, "ip.detected");
+var releasabilityEvaluator = patternEvaluator("releasability", RELEASABILITY_PATTERNS, "releasability.hint");
+
+// ../connect-sdk-ts/dist/custody/software.js
+import { ed25519 as ed255192 } from "@noble/curves/ed25519";
+import { p384 as p3842 } from "@noble/curves/p384";
+var SoftwareKeyCustody = class _SoftwareKeyCustody {
+  algo;
+  priv;
+  pub;
+  attested = false;
+  constructor(algo, priv, pub, quiet = false) {
+    this.algo = algo;
+    this.priv = priv;
+    this.pub = pub;
+    if (!quiet) {
+      console.warn("[AgentVault] using a software key (dev/CI only) -- envelopes are not attested. Use kms-hosted or byok custody in production.");
+    }
+  }
+  static generate(algo) {
+    if (algo === "ed25519") {
+      const priv2 = ed255192.utils.randomPrivateKey();
+      return new _SoftwareKeyCustody(algo, priv2, ed255192.getPublicKey(priv2));
+    }
+    const priv = p3842.utils.randomPrivateKey();
+    return new _SoftwareKeyCustody(algo, priv, p3842.getPublicKey(priv));
+  }
+  /** Construct from an existing private key (e.g. a CI fixture).
+   * `quiet` suppresses the dev banner for browser flows (start-fresh) where
+   * the software key IS the production custody and the warning is noise. */
+  static fromPrivateKey(algo, priv, opts) {
+    const pub = algo === "ed25519" ? ed255192.getPublicKey(priv) : p3842.getPublicKey(priv);
+    return new _SoftwareKeyCustody(algo, priv, pub, opts?.quiet === true);
+  }
+  async sign(canonicalBytes) {
+    if (this.algo === "ed25519")
+      return ed255192.sign(canonicalBytes, this.priv);
+    return p3842.sign(canonicalBytes, this.priv, { prehash: true }).toCompactRawBytes();
+  }
+  publicKey() {
+    return this.pub;
+  }
+};
+
+// ../connect-sdk-ts/dist/errors.js
+var ConnectSdkError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var RegistrationError = class extends ConnectSdkError {
+};
+var RateLimitError = class extends ConnectSdkError {
+  retryAfterSec;
+  constructor(message, retryAfterSec) {
+    super(message);
+    this.retryAfterSec = retryAfterSec;
+  }
+};
+var AuditAccessDenied = class extends ConnectSdkError {
+};
+var StaleEpochError = class extends ConnectSdkError {
+  clientEpoch;
+  serverEpoch;
+  constructor(clientEpoch, serverEpoch) {
+    super(`mls.stale_epoch: client_epoch=${clientEpoch} server_epoch=${serverEpoch}`);
+    this.clientEpoch = clientEpoch;
+    this.serverEpoch = serverEpoch;
+  }
+};
+async function staleEpochErrorFromResponse(res) {
+  if (res.status !== 400)
+    return null;
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return null;
+  }
+  const detail = body?.detail;
+  const d = detail;
+  if (!d || d.error !== "mls.stale_epoch")
+    return null;
+  return new StaleEpochError(Number(d.client_epoch ?? 0), Number(d.server_epoch ?? 0));
+}
+
+// ../connect-sdk-ts/dist/envelope-builder.js
+async function buildOutboundEnvelope(p) {
+  const suite = p.suite ?? p.groupKey.suite;
+  const key = await p.groupKey.exporterKey(p.enclaveId, p.channelId, p.epoch);
+  const replayNonce = p.replayNonce ?? generateReplayNonce();
+  const policyBinding = {
+    binding_id: p.bindingId,
+    version: p.bindingVersion,
+    agent_skill_id: p.agentSkillId,
+    delegation_id: null,
+    client_stage5_outcome: p.stage5Outcome,
+    client_stage5_evaluators: p.stage5Evaluators
+  };
+  const aad = await buildAssociatedData({
+    message_id: p.messageId,
+    channel_id: p.channelId,
+    sender_id: p.senderId,
+    mls_group_epoch: p.epoch,
+    replay_nonce: replayNonce,
+    policy_binding: policyBinding
+  });
+  const sealed = sealPayload({
+    plaintext: new TextEncoder().encode(p.bodyPlaintext),
+    key,
+    associatedData: aad,
+    suite,
+    nonce: p.aeadNonce
+  });
+  const envelope = {
+    av_version: AV_ENVELOPE_VERSION,
+    message_id: p.messageId,
+    channel_id: p.channelId,
+    enclave_id: p.enclaveId,
+    message_type: p.type,
+    sender_id: p.senderId,
+    sender_type: p.senderType,
+    identity_proof: {
+      signature: "",
+      algo: p.custody.algo,
+      attested: p.custody.attested,
+      canonicalization: "RFC8785"
+    },
+    trace_context: { traceparent: p.traceparent },
+    policy_binding: policyBinding,
+    mls_group_epoch: p.epoch,
+    replay_nonce: replayNonce,
+    payload_encrypted: bytesToBase64(sealed),
+    references: p.references
+  };
+  if (p.mentions && p.mentions.length > 0)
+    envelope.mentions = p.mentions;
+  const canonical = await canonicalEnvelopeBytes(envelope);
+  envelope.identity_proof.signature = bytesToBase64(await p.custody.sign(canonical));
+  return envelope;
+}
+
+// ../connect-sdk-ts/dist/groupkey/send-self-heal.js
+async function sendWithSelfHeal(session, channelId, build, publish) {
+  await session.reconcileForSend(channelId);
+  const epoch = await session.currentEpoch(channelId);
+  const envelope = await build(epoch);
+  try {
+    return await publish(envelope);
+  } catch (err) {
+    if (!(err instanceof StaleEpochError))
+      throw err;
+    await session.reconcileForSend(channelId);
+    const retryEpoch = await session.currentEpoch(channelId);
+    const retryEnvelope = await build(retryEpoch);
+    return await publish(retryEnvelope);
+  }
+}
+
+// ../connect-sdk-ts/dist/groupkey/stub.js
+import { sha256 } from "@noble/hashes/sha2";
+
+// ../connect-sdk-ts/dist/spans/names.js
+var SPAN = {
+  MESSAGE_SENT: "agentvault.connect.message.sent",
+  MESSAGE_QUEUED_OFFLINE: "agentvault.connect.message.queued_offline",
+  POLICY_RESCAN: "agentvault.connect.policy.rescan",
+  POLICY_EVAL_DELAYED_FLAG: "agentvault.connect.policy.eval.delayed_flag",
+  AUDIT_QUERY: "agentvault.connect.audit.query",
+  AGENT_REGISTERED: "agentvault.connect.agent.registered",
+  AGENT_JOINED: "agentvault.connect.agent.joined",
+  AGENT_CAPABILITIES_DECLARED: "agentvault.connect.agent.capabilities_declared",
+  AGENT_CAPABILITY_INVOKED: "agentvault.connect.agent.capability_invoked",
+  AGENT_TOOL_CALLED: "agentvault.connect.agent.tool_called",
+  ACTION_CONFIRMATION_REQUESTED: "agentvault.connect.action_confirmation.requested",
+  ACTION_CONFIRMATION_RECEIVED: "agentvault.connect.action_confirmation.received",
+  MODEL_DESCRIPTOR_CHANGED: "agentvault.connect.model.descriptor_changed",
+  AGENT_STATUS_REPORTED: "agentvault.connect.agent.status_reported"
+};
+var ALWAYS_SAMPLE = /* @__PURE__ */ new Set([
+  SPAN.AGENT_REGISTERED,
+  SPAN.ACTION_CONFIRMATION_REQUESTED,
+  SPAN.ACTION_CONFIRMATION_RECEIVED
+]);
+
+// ../connect-sdk-ts/dist/spans/emitter.js
+var KNOWN = new Set(Object.values(SPAN));
+
+// ../connect-sdk-ts/dist/groupkey/mls.js
+import { MLSGroupManager, bytesToHex, hexToBytes, verifyApprovalArtifact } from "@agentvault/crypto";
+
+// ../connect-sdk-ts/dist/groupkey/operation-queue.js
+var MlsOperationQueue = class {
+  chains = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  async run(channelId, op) {
+    const prev = this.chains.get(channelId) ?? Promise.resolve();
+    const next = prev.then(op, op);
+    this.chains.set(channelId, next);
+    this.inFlight.set(channelId, (this.inFlight.get(channelId) ?? 0) + 1);
+    try {
+      return await next;
+    } finally {
+      const remaining = (this.inFlight.get(channelId) ?? 1) - 1;
+      if (remaining === 0) {
+        this.inFlight.delete(channelId);
+        if (this.chains.get(channelId) === next) {
+          this.chains.delete(channelId);
+        }
+      } else {
+        this.inFlight.set(channelId, remaining);
+      }
+    }
+  }
+  /** Test / diagnostic only. Number of in-flight + pending ops for a channel. */
+  chainSize(channelId) {
+    return this.inFlight.get(channelId) ?? 0;
+  }
+};
+
+// ../connect-sdk-ts/dist/groupkey/mls.js
+var LABEL = "agentvault-connect-v1";
+var DEFAULT_STUCK_THRESHOLD = 2;
+var BootstrapRaceLostError = class extends Error {
+  constructor() {
+    super("bootstrap race lost: another device created the group; join instead");
+    this.name = "BootstrapRaceLostError";
+  }
+};
+var LeafRosterMismatchError = class extends Error {
+  constructor() {
+    super("removeDeviceFromLiveGroup: leaf/roster length mismatch (stale roster \u2014 re-fetch and retry)");
+    this.name = "LeafRosterMismatchError";
+  }
+};
+var HealAddAfterRemoveError = class extends Error {
+  constructor(cause) {
+    super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
+    this.name = "HealAddAfterRemoveError";
+    this.cause = cause;
+  }
+};
+var GuestHealStaleKpError = class extends Error {
+  constructor(kpId) {
+    super(`healDivergedGuest: fresh key package ${kpId} is gone/consumed \u2014 refusing to seal an un-openable Welcome`);
+    this.name = "GuestHealStaleKpError";
+  }
+};
+var ForgedCredentialError = class extends Error {
+  constructor(expected, actual) {
+    super(`heal: KeyPackage credential identity ${actual} != intended ${expected} \u2014 refusing to Add a forged leaf`);
+    this.name = "ForgedCredentialError";
+  }
+};
+var MlsGroupKeyProvider = class {
+  o;
+  suite;
+  managers = /* @__PURE__ */ new Map();
+  /**
+   * Per-CHANNEL Promise-chain mutex (gen2's MlsOperationQueue, ported). Every
+   * manager-mutating operation on a channel takes this lock keyed by channelId,
+   * so at most one runs per channel at a time; different channels still run in
+   * parallel. This is the fix for the manager-mutation interleave Sigil's review
+   * of the self-heal-on-send fix surfaced: the device-wide receive pump, the
+   * committer ops, and reconcileForSend could all mutate one channel's cached
+   * MLSGroupManager concurrently.
+   *
+   * Granularity (load-bearing): receiveOnce is DEVICE-wide — it pulls one queue
+   * and routes commit/application rows to MANY channels' managers. It therefore
+   * takes the lock PER ROW, keyed by that row's channel, rather than one
+   * provider-wide lock — so a commit on channel A never serializes against a
+   * decrypt on channel B. The committer ops take the lock for their WHOLE
+   * resolve→commit→distribute→persist window. Because the lock is not reentrant,
+   * the committers' own conflict-recovery drain runs the UNLOCKED core
+   * (receiveOnceUnlocked, scoped to the committer's own channel — it already
+   * holds that channel's lock).
+   */
+  locks = new MlsOperationQueue();
+  /** Per-DEVICE publish mutex (B1). Serializes publishKeyPackage's check-then-act
+   *  guard so two callers (ingestOnce divergence branch vs selfHealSweep) cannot
+   *  both pass "no pending bundle", both POST, and orphan the first bundle when the
+   *  server delete-and-replaces. Keyed by deviceId (a provider has one), SEPARATE
+   *  from `locks` (channel-keyed) so it never deadlocks against a held channel lock. */
+  publishLock = new MlsOperationQueue();
+  /**
+   * Per-channel decrypt-error / stuck tracker (ADR-0002). Bounded by the number
+   * of channels this device touches (channels are bounded; an entry is created
+   * only on a real decrypt error), so it cannot grow without limit. Read via
+   * {@link errorStats}; mutated only through {@link recordDecryptError} /
+   * {@link recordDecryptSuccess}.
+   */
+  errors = /* @__PURE__ */ new Map();
+  stuckThreshold;
+  /** Cumulative count of past-epoch application rows permanently skipped (acked
+   *  and drained) because forward-secrecy has deleted their epoch's secrets. Read
+   *  via {@link permanentlySkippedCount}. */
+  permanentlySkipped = 0;
+  constructor(o) {
+    this.o = o;
+    this.suite = o.suite ?? "xchacha20poly1305";
+    this.stuckThreshold = Math.max(1, o.stuckThreshold ?? DEFAULT_STUCK_THRESHOLD);
+  }
+  get deviceId() {
+    return this.o.deviceId;
+  }
+  /**
+   * Count a decrypt/parse failure against a channel and fire the optional
+   * onDecryptError hook. Increments BOTH the cumulative total and the
+   * consecutive-since-last-success counter (the latter drives `stuck`). A row
+   * with no channel mapping is still surfaced via the hook but not counted
+   * against any channel (we cannot attribute it). Always called from inside the
+   * row's catch — never changes decrypt/convergence behavior.
+   */
+  recordDecryptError(row, error) {
+    this.o.onDecryptError?.(row, error);
+    const cid = row.connect_channel_id;
+    if (!cid)
+      return;
+    const e = this.errors.get(cid) ?? { decryptErrors: 0, consecutiveErrors: 0, lastErrorAt: null };
+    e.decryptErrors += 1;
+    e.consecutiveErrors += 1;
+    e.lastErrorAt = Date.now();
+    this.errors.set(cid, e);
+  }
+  /**
+   * A commit/application row for the channel decrypted cleanly: the channel is
+   * advancing, so clear the consecutive-error run (un-sticks it). Leaves the
+   * cumulative `decryptErrors` total intact for diagnostics. No-op for a channel
+   * that never errored.
+   */
+  recordDecryptSuccess(channelId) {
+    const e = this.errors.get(channelId);
+    if (e && e.consecutiveErrors !== 0)
+      e.consecutiveErrors = 0;
+  }
+  /**
+   * Snapshot of per-channel decrypt-error / stuck state (ADR-0002 observability).
+   * Surfaces a wedged channel that would otherwise "look idle": the daemon serves
+   * it on GET /v1/metrics and the web shell reads it via a selector. A channel is
+   * `stuck` once it has had `stuckThreshold` consecutive decrypt failures with no
+   * intervening successful decrypt. Returns a plain object keyed by channelId;
+   * absence of a key means zero errors observed for that channel.
+   */
+  errorStats() {
+    const out = {};
+    for (const [cid, e] of this.errors) {
+      out[cid] = {
+        decryptErrors: e.decryptErrors,
+        consecutiveErrors: e.consecutiveErrors,
+        lastErrorAt: e.lastErrorAt,
+        stuck: e.consecutiveErrors >= this.stuckThreshold
+      };
+    }
+    return out;
+  }
+  /** Total past-epoch rows permanently skipped (acked without decrypting) since
+   *  this provider was instantiated. A permanently-undecryptable row is one whose
+   *  `row.epoch` is strictly less than the channel's live epoch: forward-secrecy
+   *  has deleted its epoch secrets so it can never decrypt on any retry. */
+  permanentlySkippedCount() {
+    return this.permanentlySkipped;
+  }
+  /** Evict the live in-memory MLS group manager for a channel. Used when the
+   *  device leaves or deletes a channel: dropping the persisted store record is
+   *  not enough on its own, because a warm manager keeps decrypting until the
+   *  page reloads. The persisted store record is removed separately by the
+   *  caller; this clears the matching in-memory cache. `managers` is the only
+   *  per-channel in-memory cache the provider holds. */
+  evictChannelState(channelId) {
+    this.managers.delete(channelId);
+  }
+  /**
+   * Warm a channel's group manager so a commit can run even when the room isn't
+   * currently open. Used by the guest reconcile sweep (and slice-3 bell-approve):
+   * the sweep may fire for a channel the host hasn't opened this session, so the
+   * in-memory manager is cold even though the store holds usable state.
+   *
+   * If the store has persisted state, load it into the warm in-memory cache (via
+   * the private manager() loader). Otherwise fall through to the join path
+   * (ensureSession bootstrap:false), which consumes a queued Welcome. Idempotent:
+   * a second call on an already-warm channel is a cheap no-op (manager() returns
+   * the cached manager and ensureSession early-returns on existing store state).
+   */
+  async ensureWarm(channelId, enclaveId) {
+    if (await this.o.store.load(channelId)) {
+      await this.locks.run(channelId, async () => {
+        await this.manager(channelId);
+      });
+      return;
+    }
+    await this.ensureSession(channelId, { enclaveId, bootstrap: false });
+  }
+  /**
+   * Admit a guest's (possibly new) device into a live group, evicting any prior
+   * device leaf for that SAME guest identity so a returning guest holds exactly
+   * ONE active leaf. Used by the guest reconcile sweep when an approved guest
+   * sits in `joining`.
+   *
+   * Add then evict: we commit the Add first so the new leaf exists before the
+   * old one is dropped (the guest is never momentarily leaf-less in the group).
+   * The eviction uses the per-DEVICE removal path (removeDeviceFromLiveGroup),
+   * which resolves the target leaf POSITIONALLY by add-order. At the moment of
+   * eviction the identity owns TWO leaves (prior + new), so the ordered-device
+   * list MUST name both in add-order — the prior device was added first, the new
+   * one just now — or the SDK's leaf/roster guard throws LeafRosterMismatchError.
+   * Callers that hold the real channel roster may override `orderedDeviceIds`;
+   * the default `[priorDeviceId, newDeviceId]` is the natural add-order for the
+   * common single-prior-device return.
+   *
+   * No-op eviction when there is no priorDeviceId (first-time guest) or when it
+   * equals newDeviceId (the same device re-admitted).
+   */
+  async admitGuestDevice(channelId, g) {
+    await this.addMemberToLiveGroup(channelId, g.newDeviceId);
+    if (g.priorDeviceId && g.priorDeviceId !== g.newDeviceId) {
+      const orderedDeviceIds = g.orderedDeviceIds ?? [g.priorDeviceId, g.newDeviceId];
+      await this.removeDeviceFromLiveGroup(channelId, g.priorDeviceId, {
+        identity: g.identityId,
+        orderedDeviceIds
+      });
+    }
+  }
+  /** Load (or reuse) the per-channel manager from the store. Throws if no state. */
+  async manager(channelId) {
+    const cached = this.managers.get(channelId);
+    if (cached)
+      return cached;
+    const saved = await this.o.store.load(channelId);
+    if (!saved)
+      throw new Error(`MlsGroupKeyProvider: no MLS state for channel ${channelId} (call ensureSession first)`);
+    const mgr = new MLSGroupManager(saved.ciphersuite);
+    mgr.importState(saved);
+    this.managers.set(channelId, mgr);
+    return mgr;
+  }
+  async currentEpoch(channelId) {
+    return Number((await this.manager(channelId)).epoch);
+  }
+  /**
+   * Run a committer op and, on ANY throw that escapes it, evict the channel's
+   * cached MLSGroupManager.
+   *
+   * The committer ops mutate the CACHED manager (mgr.addMembers / removeMembers
+   * advance it) and persist the advanced state only AFTER a successful
+   * distribute. The distribute-catch already evicts on a 409. But if the
+   * mutation itself throws — or the B11 epoch-drift guard throws after the
+   * mutation advanced the manager — the cached manager is left partially/fully
+   * mutated and never persisted. The per-channel queue would then run the next
+   * serialized op against that SAME poisoned cache entry (manager() returns the
+   * cache before touching the store). Dropping the cache entry forces the next
+   * manager() to reload a clean instance from the committed store state.
+   *
+   * Always called from INSIDE the channel lock, so the eviction can't race a
+   * concurrent op on the same channel. Idempotent with the distribute-catch's own
+   * delete (a re-delete is a no-op). On success the manager stays cached as
+   * before — no eviction.
+   */
+  async evictOnThrow(channelId, op) {
+    try {
+      return await op();
+    } catch (e) {
+      this.managers.delete(channelId);
+      throw e;
+    }
+  }
+  async exporterKey(enclaveId, channelId, epoch) {
+    const mgr = await this.manager(channelId);
+    return mgr.exportSecret(LABEL, buildExporterContext(enclaveId, channelId, epoch), 32);
+  }
+  /**
+   * Join a channel from the host-committed Welcome, then drain any commits that
+   * landed after the Welcome so we converge on the true current epoch. Without
+   * this, confirm-join 409s `member_epoch_stale` whenever the committer advanced
+   * the epoch between Welcome generation and our join.
+   */
+  async joinAndReconcile(channelId, enclaveId) {
+    await this.ensureSession(channelId, { enclaveId, bootstrap: false });
+    try {
+      await this.receiveOnce(this.o.deviceId);
+    } catch {
+    }
+    return this.currentEpoch(channelId);
+  }
+  /**
+   * Self-heal-on-send (Phase 1.1). Converge the sender to the live group epoch
+   * BEFORE it seals an application message: drain any pending commits (via
+   * {@link receiveOnce}) so {@link currentEpoch} reflects the live group. A
+   * sender one epoch behind would otherwise seal at a stale epoch — the backend
+   * rejects that with an epoch-stale 400 (the "owner-send-stuck / shows queued,
+   * never posts" symptom), and even a blind relay would deliver ciphertext no
+   * live-epoch peer can decrypt (forward secrecy deleted the old secret).
+   *
+   * Best-effort and idempotent: if there is nothing pending it is a cheap no-op
+   * (one pullDelivery), and a drain failure is swallowed so it never breaks the
+   * send path — the caller publishes at whatever epoch we reach and the
+   * defensive reconcile-then-retry-once on a publish 400 covers a commit that
+   * lands between this drain and publish.
+   *
+   * COMMITTER SAFETY (B11): this MUST only be called from a normal application-
+   * send entry point, never inside a committer's resolve→distribute window
+   * (addMemberToLiveGroup / removeMemberFromLiveGroup / removeDeviceFromLiveGroup
+   * stage their own commit and explicitly must NOT receiveOnce between resolving
+   * members and distributing — doing so would race their in-flight commit). A
+   * text/a2a/status send is never mid-distribute, so scoping reconcileForSend to
+   * those entry points keeps the receiveOnce drain out of any committer window.
+   * If the channel has no local MLS state yet (nothing to drain/seal), this is a
+   * no-op rather than an error.
+   */
+  async reconcileForSend(channelId) {
+    if (!await this.o.store.load(channelId))
+      return;
+    try {
+      await this.receiveOnce(this.o.deviceId);
+    } catch {
+    }
+  }
+  /**
+   * Peek the device's delivery queue for a pending Welcome WITHOUT acking it.
+   *
+   * Returns the `connect_channel_id` of the first welcome row, or null when none
+   * is queued yet. Used by the external-guest join to detect host approval over
+   * the guest bearer (the guest can't call the Clerk-gated /me or channel-list).
+   * The row is deliberately NOT acked here — the subsequent ensureSession(join) /
+   * joinAndReconcile consumes the same Welcome and acks it after joining.
+   */
+  async peekWelcomeChannel(deviceId) {
+    const rows = await this.o.backend.pullDelivery(deviceId);
+    const w = rows.find((r) => r.message_type === "welcome" && r.connect_channel_id != null);
+    return w?.connect_channel_id ?? null;
+  }
+  async publishKeyPackage() {
+    return this.publishLock.run(this.o.deviceId, () => this.publishKeyPackageUnlocked());
+  }
+  async publishKeyPackageUnlocked() {
+    if (await this.o.store.loadPendingBundle(this.o.deviceId)) {
+      console.warn("publishKeyPackage: pending bundle exists; skipping republish");
+      return await this.o.store.loadLastKpId(this.o.deviceId) ?? "";
+    }
+    const mgr = new MLSGroupManager();
+    const bundle = await mgr.generateKeyPackage(this.o.identity);
+    const hex = bytesToHex(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+    const id = await this.o.backend.publishKeyPackage(this.o.deviceId, hex);
+    await this.o.store.saveLastKpAndBundle(this.o.deviceId, id, bundle);
+    return id;
+  }
+  /** The server-assigned id of the last KeyPackage this device published,
+   * or null if none has been published yet. Lets a diverged guest's self-heal
+   * signal name its outstanding KP (P2-A). */
+  async getLastPublishedKpId() {
+    return this.o.store.loadLastKpId(this.o.deviceId);
+  }
+  async ensureSession(channelId, opts) {
+    return this.locks.run(channelId, () => this.ensureSessionUnlocked(channelId, opts));
+  }
+  async ensureSessionUnlocked(channelId, opts) {
+    if (!opts.forceReinit && await this.o.store.load(channelId))
+      return;
+    let bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+    if (!bundle && (opts.bootstrap || opts.forceReinit)) {
+      await this.publishKeyPackage();
+      bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+    }
+    if (!bundle)
+      throw new Error("ensureSession: call publishKeyPackage() first");
+    if (opts.forceReinit) {
+      const others = opts.otherDeviceIds ?? [];
+      const reinit = await this.o.backend.reinitConnectChannelGroup(channelId, [this.o.deviceId, ...others]);
+      const mgr = new MLSGroupManager();
+      await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
+      const kps = await this.o.backend.fetchKeyPackages(others);
+      const pkgs = others.map((d) => {
+        const hex = kps[d];
+        if (!hex)
+          throw new Error(`ensureSession(forceReinit): no published KeyPackage for device ${d}`);
+        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+      });
+      const { commit, welcome } = await mgr.addMembers(pkgs);
+      await this.o.backend.distribute(reinit.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: reinit.current_epoch,
+        member_device_ids: [this.o.deviceId, ...others],
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+      });
+      await this.o.store.save(channelId, mgr.exportState());
+      this.managers.set(channelId, mgr);
+      await this.o.store.deletePendingBundle(this.o.deviceId);
+      return;
+    }
+    if (opts.bootstrap) {
+      const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+      if (init.created === false)
+        throw new BootstrapRaceLostError();
+      const mgr = new MLSGroupManager();
+      await mgr.createGroup(new TextEncoder().encode(init.group_id), bundle);
+      const others = opts.otherDeviceIds ?? [];
+      const kps = await this.o.backend.fetchKeyPackages(others);
+      const pkgs = others.map((d) => {
+        const hex = kps[d];
+        if (!hex)
+          throw new Error(`ensureSession: no published KeyPackage for device ${d}`);
+        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+      });
+      const { commit, welcome } = await mgr.addMembers(pkgs);
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: init.current_epoch,
+        member_device_ids: [this.o.deviceId, ...others],
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+      });
+      this.managers.set(channelId, mgr);
+      await this.o.store.save(channelId, mgr.exportState());
+      await this.o.store.deletePendingBundle(this.o.deviceId);
+    } else {
+      const rows = await this.o.backend.pullDelivery(this.o.deviceId);
+      const w = rows.find((r) => r.message_type === "welcome" && (r.connect_channel_id === channelId || r.connect_channel_id == null));
+      if (!w)
+        throw new Error("ensureSession(join): no Welcome available yet for this channel");
+      const mgr = new MLSGroupManager();
+      try {
+        await mgr.joinFromWelcome(hexToBytes(w.payload), bundle);
+      } catch (err) {
+        this.recordDecryptError(w, err);
+        console.warn(`ensureSession(join): discarding un-openable Welcome for channel ${channelId} (queue_id=${w.queue_id}); private KeyPackage key no longer held`);
+        await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
+        return;
+      }
+      this.managers.set(channelId, mgr);
+      await this.o.store.save(channelId, mgr.exportState());
+      await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
+      const remaining = await this.o.backend.pullDelivery(this.o.deviceId);
+      let burstPending = false;
+      for (const r of remaining) {
+        if (r.message_type !== "welcome")
+          continue;
+        const cid = r.connect_channel_id;
+        if (!cid || cid === channelId || !await this.o.store.load(cid)) {
+          burstPending = true;
+          break;
+        }
+      }
+      if (!burstPending)
+        await this.o.store.deletePendingBundle(this.o.deviceId);
+    }
+  }
+  /**
+   * Committer-side: add a member to an ALREADY-bootstrapped (live) group.
+   *
+   * The bootstrap path (ensureSession bootstrap:true) only adds members at group
+   * creation. The admission flow admits a member AFTER the group is live, so the
+   * committer commits the Add against its saved state and distributes the commit
+   * plus a Welcome targeting the new device.
+   *
+   * group_id resolution reuses the same idempotent init endpoint bootstrap uses:
+   * for an existing channel it returns the live group's id, current epoch, and
+   * full member roster (unioning in any device ids we pass). That avoids a
+   * parallel group_id-by-channel resolver.
+   */
+  async addMemberToLiveGroup(channelId, newDeviceId) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, 0)));
+  }
+  async addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt, opts) {
+    const mgr = await this.manager(channelId);
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId, newDeviceId]);
+    const kps = await this.o.backend.fetchKeyPackages([newDeviceId]);
+    const hex = kps[newDeviceId];
+    if (!hex)
+      throw new Error(`addMemberToLiveGroup: no published KeyPackage for device ${newDeviceId}`);
+    const pkg = MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+    if (opts?.expectedIdentityId) {
+      const cred = pkg.leafNode.credential;
+      const claimed = cred.credentialType === "basic" ? new TextDecoder().decode(cred.identity) : "";
+      if (claimed !== opts.expectedIdentityId) {
+        throw new ForgedCredentialError(opts.expectedIdentityId, claimed);
+      }
+    }
+    const priorEpoch = Number(mgr.epoch);
+    const { commit, welcome } = await mgr.addMembers([pkg]);
+    const members = [.../* @__PURE__ */ new Set([...init.member_device_ids ?? [this.o.deviceId], newDeviceId])];
+    try {
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: priorEpoch,
+        member_device_ids: members,
+        op: "add",
+        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex(welcome) }] : []
+      });
+    } catch (e) {
+      this.managers.delete(channelId);
+      if (_attempt >= 2)
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch {
+      }
+      try {
+        const work = await this.o.backend.getCommitterWork(channelId);
+        if (!work.adds.includes(newDeviceId))
+          return;
+      } catch {
+      }
+      return this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt + 1, opts);
+    }
+    await this.o.store.save(channelId, mgr.exportState());
+  }
+  /**
+   * Committer-side: REMOVE a member from a live group (Phase C eviction).
+   *
+   * Mirrors {@link addMemberToLiveGroup}, but commits a Remove (no Welcome) and
+   * uses the store's two-slot staging for crash/conflict safety: the advanced
+   * (post-removal) state is written to STAGING before the removal-Commit is
+   * distributed, promoted to MAIN only on a 2xx, and discarded on a 409 so a
+   * reload from MAIN yields the pre-commit state. The removed member's leaf is
+   * identified by its credential identity (a member's devices share one identity,
+   * so this evicts ALL of that member's device leaves). The ts-mls forced
+   * UpdatePath (patches/ts-mls+1.6.2.patch) rotates the new epoch's key schedule
+   * away from every evicted leaf, so the removed member cannot derive the new
+   * exporter secret.
+   *
+   * The server resolves removed_identity_id → the device(s) to drop from the
+   * roster + purge from delivery; member_device_ids here is the SDK's roster view
+   * for relays that don't do that resolution. No-op if the identity isn't a member
+   * of this group.
+   */
+  async removeMemberFromLiveGroup(channelId, identityId) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeMemberFromLiveGroupUnlocked(channelId, identityId, 0)));
+  }
+  async removeMemberFromLiveGroupUnlocked(channelId, identityId, _attempt) {
+    const mgr = await this.manager(channelId);
+    const indices = mgr.leafIndicesForIdentity(identityId);
+    if (indices.length === 0)
+      return;
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    const priorEpoch = Number(mgr.epoch);
+    const { commit } = await mgr.removeMembers(indices);
+    if (Number(mgr.epoch) !== priorEpoch + 1) {
+      throw new Error("removeMemberFromLiveGroup: unexpected epoch drift before distribute");
+    }
+    await this.o.store.saveStaging(channelId, mgr.exportState());
+    const members = init.member_device_ids ?? [this.o.deviceId];
+    try {
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: priorEpoch,
+        member_device_ids: members,
+        op: "remove",
+        removed_identity_id: identityId,
+        welcomes: []
+      });
+    } catch (e) {
+      this.managers.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      if (_attempt >= 2)
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch {
+      }
+      return this.removeMemberFromLiveGroupUnlocked(channelId, identityId, _attempt + 1);
+    }
+    await this.o.store.promoteStaging(channelId);
+  }
+  /**
+   * Committer-side: REMOVE a SINGLE device (one leaf) from a live group (MD-3
+   * per-device eviction).
+   *
+   * The identity-level {@link removeMemberFromLiveGroup} evicts EVERY leaf of a
+   * credential identity. This evicts ONE — the counterpart to revoking a single
+   * device while the owner keeps their other devices in the channel.
+   *
+   * Leaf resolution (LOCKED): MLS leaves carry only the member's credential
+   * identity, never a device id, so same-identity devices are indistinguishable
+   * at the crypto layer. The ONLY correct mapping is POSITIONAL BY ADD-ORDER:
+   * leaves are appended in the order devices were added, so the i-th add-ordered
+   * device of an identity occupies the i-th ascending leaf index for that
+   * identity. The caller (which holds the channel roster with identities) passes
+   * the target's identity AND the add-ordered device-id list; we resolve the leaf
+   * by `orderedDeviceIds.indexOf(deviceId)`. If the tree's leaf count for that
+   * identity disagrees with the roster's device count, we REFUSE rather than guess
+   * (a wrong leaf would evict the wrong device).
+   *
+   * Everything else mirrors {@link removeMemberFromLiveGroup}: resolve leaf BEFORE
+   * the commit, capture priorEpoch, single-leaf removeMembers, the B11 epoch-drift
+   * guard, and two-slot staging (save→distribute→promote on 2xx / discard + evict
+   * + receiveOnce + retry on 409). The distribute carries op:"remove" +
+   * `removed_device_id` (instead of removed_identity_id); the server resolves the
+   * device's identity, asserts it matches, and purges that ONE device.
+   */
+  async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
+  }
+  async removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt) {
+    const mgr = await this.manager(channelId);
+    const pos = opts.orderedDeviceIds.indexOf(deviceId);
+    if (pos < 0)
+      return;
+    const leaves = mgr.leafIndicesForIdentity(opts.identity);
+    if (leaves.length !== opts.orderedDeviceIds.length) {
+      throw new LeafRosterMismatchError();
+    }
+    const leafIndex = leaves[pos];
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    const priorEpoch = Number(mgr.epoch);
+    const { commit } = await mgr.removeMembers([leafIndex]);
+    if (Number(mgr.epoch) !== priorEpoch + 1) {
+      throw new Error("removeDeviceFromLiveGroup: unexpected epoch drift before distribute");
+    }
+    await this.o.store.saveStaging(channelId, mgr.exportState());
+    const members = init.member_device_ids ?? [this.o.deviceId];
+    const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex(opts.identity);
+    try {
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: priorEpoch,
+        member_device_ids: members,
+        op: "remove",
+        removed_identity_id: removedIdentity,
+        removed_device_id: deviceId,
+        welcomes: []
+      });
+    } catch (e) {
+      this.managers.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      if (_attempt >= 2)
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch {
+      }
+      return this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt + 1);
+    }
+    await this.o.store.promoteStaging(channelId);
+  }
+  /**
+   * Committer-side: HEAL a permanently-diverged member by Remove(stale leaf) then
+   * Add(device), re-keying it with a fresh Welcome at the live epoch (Phase 1
+   * member self-heal).
+   *
+   * ATOMICITY (S1, honest framing): this is atomic against CONCURRENCY — the
+   * per-channel lock is taken ONCE and held continuously across both mutations, so
+   * no peer commit or receive-pump row can interleave between the Remove and the
+   * Add. It is NOT TRANSACTIONAL across the two server distributes: there is no
+   * rollback of a landed Remove. If the Add throws AFTER the Remove's distribute
+   * already succeeded, the member is left REMOVED-but-not-readded (detached —
+   * strictly worse than the original wedge). That specific failure is surfaced as a
+   * {@link HealAddAfterRemoveError} so a caller can recover by RE-RUNNING the heal:
+   * the retry finds zero leaves for the identity and takes the Add-only branch,
+   * completing the re-key. An Add failure BEFORE any Remove landed (e.g. the
+   * zero-leaf branch, or a fetchKeyPackages failure) is not detaching and rethrows
+   * as-is.
+   *
+   * The wedge this clears: a member fell behind, can't catch up (forward secrecy
+   * deleted the key it needs), still HOLDS a leaf (so the admission watcher won't
+   * re-add it), and its saved MLS state is diverged. There is no MLS-correct
+   * "re-welcome in place" for a member that still occupies a leaf — handing a
+   * Welcome to an identity that already holds a leaf is a two-leaf bug. The only
+   * correct heal is to drop its stale leaf and re-Add the device, which seals a
+   * fresh Welcome to it at the post-Remove live epoch. (reinit is the WRONG tool —
+   * that is the committer-loss hammer, guarded to zero-other-devices, and
+   * Welcome-storms every healthy member.)
+   *
+   * ONE acquisition (load-bearing): we take the per-channel lock ONCE and run BOTH
+   * mutations inside it via the Unlocked variants, so the lock is never released
+   * between Remove and Add — that gap would open a fork window (a peer commit or
+   * the device-wide receive pump could advance the manager between the two). Do
+   * NOT call the public (self-locking) variants in sequence. Remove FIRST, then
+   * Add, so the identity is never momentarily double-leafed.
+   *
+   * Device-level removal (not identity-level): we resolve the member's credential
+   * identity from its freshly-published KeyPackage (which the Add needs anyway)
+   * and evict only the single stale leaf, so the member identity's OTHER healthy
+   * devices are not collaterally evicted. Leaf resolution reads the LIVE
+   * (post-lock) tree:
+   *   - exactly ONE leaf → device-level Remove (orderedDeviceIds=[deviceId]) then Add;
+   *   - ZERO leaves → no stale leaf (e.g. a heal retry whose Remove already
+   *     landed) → Add-only re-key;
+   *   - MORE THAN ONE leaf → ambiguous (no add-order roster to disambiguate which
+   *     leaf is the stale one) → REFUSE rather than risk evicting a healthy device.
+   *
+   * The Add fetches the device's freshly published KeyPackage from the backend,
+   * exactly like a normal add — the CALLER is responsible for the member having
+   * re-published one first (mirrors addMemberToLiveGroup's "no published
+   * KeyPackage" error). After the call the committer's group has the member
+   * re-added at the live epoch.
+   *
+   * Authorization / single-committer guards are inherited unchanged from the
+   * Unlocked committer ops this composes (removeDeviceFromLiveGroupUnlocked /
+   * addMemberToLiveGroupUnlocked) — no weaker path is introduced.
+   */
+  async healDivergedMember(channelId, memberDeviceId, opts) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      const kps = await this.o.backend.fetchKeyPackages([memberDeviceId]);
+      const hex = kps[memberDeviceId];
+      if (!hex)
+        throw new Error(`healDivergedMember: no published KeyPackage for device ${memberDeviceId}`);
+      const cred = MLSGroupManager.deserializeKeyPackage(hexToBytes(hex)).leafNode.credential;
+      if (cred.credentialType !== "basic") {
+        throw new Error(`healDivergedMember: unexpected credential type ${cred.credentialType} (expected basic)`);
+      }
+      const identity = new TextDecoder().decode(cred.identity);
+      if (opts?.expectedIdentityId && identity !== opts.expectedIdentityId) {
+        throw new ForgedCredentialError(opts.expectedIdentityId, identity);
+      }
+      const mgr = await this.manager(channelId);
+      const leaves = mgr.leafIndicesForIdentity(identity);
+      if (leaves.length > 1) {
+        throw new Error(`healDivergedMember: identity owns ${leaves.length} leaves; ambiguous stale-leaf resolution (refusing to guess)`);
+      }
+      let removeLanded = false;
+      if (leaves.length === 1) {
+        await this.removeDeviceFromLiveGroupUnlocked(channelId, memberDeviceId, { identity, orderedDeviceIds: [memberDeviceId] }, 0);
+        removeLanded = true;
+      } else {
+        const stillZero = (await this.manager(channelId)).leafIndicesForIdentity(identity);
+        if (stillZero.length !== 0) {
+          throw new Error(`healDivergedMember: expected 0 leaves for the Add-only branch but found ${stillZero.length} (a leaf reappeared under the held lock \u2014 refusing to create a duplicate leaf)`);
+        }
+      }
+      try {
+        await this.addMemberToLiveGroupUnlocked(channelId, memberDeviceId, 0, opts);
+      } catch (e) {
+        if (removeLanded)
+          throw new HealAddAfterRemoveError(e);
+        throw e;
+      }
+    }));
+  }
+  /** Re-Welcome a fallen-behind GUEST (same device, stale leaf) back to the live
+   *  epoch. Identical crypto to healDivergedMember (Remove-first same-device, then
+   *  re-Add at the live epoch); named separately for the Phase 2 guest dispatch/
+   *  sweep call sites and for the cross-tenant authz that differs only server-side.
+   *  Caller contract (like the member path): the guest republishes a fresh
+   *  KeyPackage first, then resetChannelForRejoin + joinAndReconcile after.
+   *
+   *  Phase 2 fail-closed gate: `expectedKpId` is the id of the guest's fresh,
+   *  retained KeyPackage (the one the caller confirmed the guest republished).
+   *  Before doing anything else we fetch it BY ID and refuse
+   *  ({@link GuestHealStaleKpError}) if it's gone — never Remove+re-Add on the
+   *  strength of "some KeyPackage is published for this device", because that
+   *  could be stale, consumed, or absent and would seal an un-openable Welcome,
+   *  bricking the guest instead of healing it. Once the gate passes we delegate to
+   *  the proven {@link healDivergedMember}: given `publish_key_package`'s
+   *  delete-and-replace semantics and the guest's pending-bundle republish guard,
+   *  the by-device fetch inside healDivergedMember resolves to exactly this same
+   *  KeyPackage — the id-fetch here is the fail-closed contract, the member heal
+   *  is the mechanism. */
+  async healDivergedGuest(channelId, guestDeviceId, expectedKpId) {
+    const hex = await this.o.backend.fetchKeyPackageById(expectedKpId);
+    if (!hex)
+      throw new GuestHealStaleKpError(expectedKpId);
+    return this.healDivergedMember(channelId, guestDeviceId);
+  }
+  /** Re-Welcome a diverged agent/member with BOTH the fail-closed fresh-KP gate
+   *  AND the TOCTOU-safe anti-forgery check. Mirrors {@link healDivergedGuest}'s
+   *  id-by-value gate (refuse if `expectedKpId` is gone/consumed →
+   *  {@link GuestHealStaleKpError}, never sealing an un-openable Welcome), then
+   *  delegates to {@link healDivergedMember} with `expectedIdentityId` so the
+   *  committed-bytes assertion binds the re-Added leaf to the intended identity
+   *  (throws {@link ForgedCredentialError} on a credential-identity mismatch,
+   *  including on the 409-retry path). This is the entry point the owner's
+   *  agent-diverged heal sweep uses: `expectedKpId`/`expectedIdentityId` come from
+   *  the welcome-request row the agent published, so a compromised agent cannot
+   *  substitute a KeyPackage that forges a different identity. */
+  async healDivergedMemberFresh(channelId, memberDeviceId, expectedKpId, expectedIdentityId) {
+    const hex = await this.o.backend.fetchKeyPackageById(expectedKpId);
+    if (!hex)
+      throw new GuestHealStaleKpError(expectedKpId);
+    return this.healDivergedMember(channelId, memberDeviceId, { expectedIdentityId });
+  }
+  /**
+   * Member-side: drop the diverged local state for a channel so a subsequent
+   * {@link joinAndReconcile} consumes the committer's fresh Welcome (from
+   * {@link healDivergedMember}) instead of early-returning on the stale saved
+   * state (Phase 1 member self-heal). This does NOT rejoin — the caller invokes
+   * joinAndReconcile afterward.
+   *
+   * BOTH the in-memory manager AND the persisted store row must go: evict alone is
+   * insufficient because ensureSession(join) early-returns whenever
+   * `store.load(channelId)` returns existing state, so the member would reload the
+   * diverged row and never rejoin. Also clear this channel's decrypt-error tracker
+   * entry so a healed channel doesn't read as permanently `stuck` in errorStats.
+   *
+   * CHANNEL LOCK (M1): the whole reset runs under the per-channel lock, serialized
+   * against receiveOnce / committer ops / ensureSession on the SAME channel. Without
+   * it a concurrent receiveOnce processing a commit row for this channel could
+   * re-persist the diverged state immediately after our `store.delete`, re-wedging
+   * the rejoin (the join would then early-return on the resurrected row). The
+   * in-memory evict and `errors.delete` are cheap synchronous map mutations but are
+   * kept inside the lock so the reset is one coherent, atomic state clear.
+   *
+   * STAGING (M2): also discard any persisted staging row for the channel. A removal
+   * op interrupted between saveStaging and promote/discard can leave a stale staged
+   * advanced state; if that survives the reset it can re-diverge the rejoin. The
+   * in-memory store's discardStaging is a no-op when no staging row exists.
+   */
+  async resetChannelForRejoin(channelId) {
+    await this.locks.run(channelId, async () => {
+      this.evictChannelState(channelId);
+      await this.o.store.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      this.errors.delete(channelId);
+    });
+  }
+  /** Owner-attested reset supersede (owner/web side, Task 9). Mirrors the
+   * ensureSession forceReinit branch but posts a client-chosen new_group_id +
+   * signed attestation to the reset-mode endpoint, then builds + distributes
+   * the new group. Runs under the channel lock (serialized against
+   * receiveOnce / committer ops).
+   *
+   * `opts.otherDeviceIds` MUST be the CHANNEL-WIDE union of every active
+   * member device holding an unconsumed KeyPackage (H2) -- the caller (the web
+   * client's members-endpoint enumeration) is responsible for that union;
+   * this method only handles the mechanical THIS-device exclusion: this
+   * device is the committer that creates the group, so it must not be in the
+   * MLS addMembers set (adding your own new leaf via addMembers is
+   * nonsensical / unsupported). The wire member_device_ids below re-includes
+   * it as [deviceId, ...others] (deduped), so the Task-2 completeness guard
+   * (required subset of supplied) is still satisfied even though it never
+   * goes through addMembers. */
+  async resetSessionSupersede(channelId, opts) {
+    return this.locks.run(channelId, async () => {
+      let bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+      if (!bundle) {
+        await this.publishKeyPackage();
+        bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+      }
+      if (!bundle)
+        throw new Error("resetSessionSupersede: call publishKeyPackage() first");
+      const others = [...new Set(opts.otherDeviceIds)].filter((d) => d !== this.o.deviceId);
+      const reinit = await this.o.backend.resetReinitConnectChannelGroup(channelId, [this.o.deviceId, ...others], { newGroupId: opts.newGroupId, signatureHex: opts.signatureHex, nonceHex: opts.nonceHex, signedContentHex: opts.signedContentHex });
+      const mgr = new MLSGroupManager();
+      await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
+      const kps = await this.o.backend.fetchKeyPackages(others);
+      const pkgs = others.map((d) => {
+        const hex = kps[d];
+        if (!hex)
+          throw new Error(`resetSessionSupersede: no published KeyPackage for device ${d}`);
+        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+      });
+      const { commit, welcome } = await mgr.addMembers(pkgs);
+      await this.o.backend.distribute(reinit.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: reinit.current_epoch,
+        member_device_ids: [this.o.deviceId, ...others],
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+      });
+      await this.o.store.save(channelId, mgr.exportState());
+      this.managers.set(channelId, mgr);
+      await this.o.store.deletePendingBundle(this.o.deviceId);
+    });
+  }
+  /** Returns true when an in-memory MLS manager is live for the channel.
+   * Cheap synchronous check; does NOT consult the store. */
+  hasChannelState(channelId) {
+    return this.managers.has(channelId);
+  }
+  /** Returns true when the channel has either a live in-memory manager OR
+   * persisted state in the store. Use this to decide whether to call
+   * ensureSession(bootstrap:false) or ensureSession(bootstrap:true). */
+  async hasPersistedChannelState(channelId) {
+    if (this.managers.has(channelId))
+      return true;
+    return await this.o.store.load(channelId) !== null;
+  }
+  /**
+   * Return the number of leaves the given identity holds in the live tree for
+   * `channelId`. Loads the manager from the store if not already cached.
+   *
+   * Primarily used by the gate (S20) to assert that a peer-committer 409-retry
+   * does NOT create a duplicate leaf for an already-added device. A return value
+   * of 1 is the expected healthy state; 0 means not yet a member; > 1 means a
+   * duplicate-leaf bug fired (the S3 guard failed to suppress the re-Add).
+   */
+  async leafCountForIdentity(channelId, identityId) {
+    const mgr = await this.manager(channelId);
+    return mgr.leafIndicesForIdentity(identityId).length;
+  }
+  /** Returns true when the live in-memory MLS tree for `channelId` contains at
+   * least one leaf bearing `identityId` as its credential. Used by the agent
+   * admission watcher (liveness §4.3) to decide whether an Add+Welcome is still
+   * needed — if the agent already has a leaf the sweep skips it. Returns false
+   * when there is no in-memory manager for the channel (i.e. the group is not
+   * yet loaded), which causes the sweep to attempt the Add (idempotent on the
+   * server side). */
+  hasLeafForIdentity(channelId, identityId) {
+    const mgr = this.managers.get(channelId);
+    if (!mgr)
+      return false;
+    return mgr.leafIndicesForIdentity(identityId).length > 0;
+  }
+  /** Probe the server for the channel's MLS group without modifying any local
+   * state. Maps the ChannelGroupResp field names to SDK-friendly camelCase. */
+  async probeChannelGroup(channelId) {
+    const r = await this.o.backend.getConnectChannelGroup(channelId);
+    return { exists: r.exists, groupId: r.group_id, epoch: r.current_epoch };
+  }
+  /**
+   * Verified group supersede for the agent's receive pump (owner-attested reset).
+   * Returns true when the channel's state was swapped to the new group and the
+   * Welcome row acked; false when the supersede was REFUSED (row left un-acked).
+   *
+   * FAIL-CLOSED order (spec §3): step-0 pin-presence guard FIRST (no pinned owner
+   * ⇒ refuse, never call verify), then structural signer check, then attestation
+   * verify against the NON-EMPTY pinned key, then post-join group-id assertion.
+   */
+  async trySupersede(channelId, row, heldGroupId) {
+    const owner = this.o.onResolvePinnedOwner ? await this.o.onResolvePinnedOwner(channelId) : null;
+    if (!owner || !owner.publicKeyHex) {
+      this.recordDecryptError(row, new Error("supersede refused: no pinned owner key (step-0 guard)"));
+      return false;
+    }
+    const retired = await this.o.store.loadRetiredGroupIds(channelId);
+    if (retired.includes(row.group_id)) {
+      this.recordDecryptError(row, new Error(`supersede refused: group ${row.group_id} is retired (rollback/replay)`));
+      return false;
+    }
+    const att = await this.o.backend.fetchResetAttestation(row.group_id);
+    if (!att) {
+      this.recordDecryptError(row, new Error(`supersede refused: no attestation for group ${row.group_id}`));
+      return false;
+    }
+    if (att.signerIdentityId !== owner.identityId) {
+      this.recordDecryptError(row, new Error("supersede refused: signer is not the pinned owner"));
+      return false;
+    }
+    let content;
+    try {
+      content = JSON.parse(att.signedContent);
+    } catch {
+      this.recordDecryptError(row, new Error("supersede refused: unparseable signed_content"));
+      return false;
+    }
+    if (content.channel_id !== row.connect_channel_id || content.new_group_id !== row.group_id) {
+      this.recordDecryptError(row, new Error("supersede refused: attestation channel/group mismatch"));
+      return false;
+    }
+    const ok = await verifyApprovalArtifact({ content, signature: att.signatureHex, signerPublicKey: owner.publicKeyHex, createdAt: "", version: 1 }, owner.publicKeyHex);
+    if (!ok) {
+      this.recordDecryptError(row, new Error("supersede refused: signature does not verify against pinned owner key"));
+      return false;
+    }
+    const bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+    if (!bundle) {
+      this.recordDecryptError(row, new Error("supersede refused: no pending KeyPackage bundle to open the new Welcome"));
+      return false;
+    }
+    return await this.locks.run(channelId, async () => {
+      const mgr = new MLSGroupManager();
+      try {
+        await mgr.joinFromWelcome(hexToBytes(row.payload), bundle);
+      } catch (err) {
+        this.recordDecryptError(row, err);
+        return false;
+      }
+      if (new TextDecoder().decode(mgr.groupId) !== row.group_id) {
+        this.recordDecryptError(row, new Error("supersede refused: post-join group id != attested new_group_id"));
+        return false;
+      }
+      this.evictChannelState(channelId);
+      await this.o.store.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      await this.o.store.addRetiredGroupId(channelId, heldGroupId);
+      this.errors.delete(channelId);
+      this.managers.set(channelId, mgr);
+      await this.o.store.save(channelId, mgr.exportState());
+      await this.o.backend.ackDelivery(this.o.deviceId, [row.queue_id]);
+      return true;
+    });
+  }
+  async receiveOnce(deviceId) {
+    const rows = await this.o.backend.pullDelivery(deviceId);
+    const appEntries = [];
+    const handshakeAcked = [];
+    const supersededChannelIds = [];
+    const order = { welcome: 0, commit: 1, application: 2 };
+    rows.sort((a, b) => order[a.message_type] - order[b.message_type]);
+    for (const row of rows) {
+      try {
+        if (row.message_type === "welcome") {
+          const wcid = row.connect_channel_id;
+          if (wcid) {
+            const existing = await this.o.store.load(wcid);
+            if (existing) {
+              let heldGroupId = null;
+              try {
+                const mgr = await this.manager(wcid);
+                heldGroupId = new TextDecoder().decode(mgr.groupId);
+              } catch {
+                heldGroupId = null;
+              }
+              if (heldGroupId !== null && heldGroupId === row.group_id) {
+                handshakeAcked.push(row.queue_id);
+              } else if (heldGroupId !== null && heldGroupId !== row.group_id) {
+                const ok = await this.trySupersede(wcid, row, heldGroupId);
+                if (ok)
+                  supersededChannelIds.push(wcid);
+              }
+            }
+          }
+        } else if (row.message_type === "commit") {
+          const cid = row.connect_channel_id;
+          if (!cid)
+            continue;
+          await this.locks.run(cid, async () => {
+            const mgr = await this.manager(cid);
+            await mgr.decrypt(hexToBytes(row.payload));
+            await this.o.store.save(cid, mgr.exportState());
+          });
+          this.recordDecryptSuccess(cid);
+          handshakeAcked.push(row.queue_id);
+        } else {
+          const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+          const key = await this.locks.run(envelope.channel_id, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
+          const aad = await buildAssociatedData({
+            message_id: envelope.message_id,
+            channel_id: envelope.channel_id,
+            sender_id: envelope.sender_id,
+            mls_group_epoch: envelope.mls_group_epoch,
+            replay_nonce: envelope.replay_nonce,
+            policy_binding: envelope.policy_binding
+          });
+          const plaintext = openPayload({ ciphertext: base64ToBytes(envelope.payload_encrypted), key, associatedData: aad, suite: this.suite });
+          const appChannelId = row.connect_channel_id ?? envelope.channel_id;
+          this.recordDecryptSuccess(appChannelId);
+          appEntries.push({
+            queueId: row.queue_id,
+            messageId: envelope.message_id,
+            channelId: appChannelId,
+            plaintext,
+            envelope,
+            receivedAt: Date.now(),
+            retryCount: 0,
+            expires_at: row.expires_at
+          });
+        }
+      } catch (err) {
+        this.recordDecryptError(row, err);
+        const cid = row.connect_channel_id;
+        if (cid && typeof row.epoch === "number") {
+          let liveEpoch;
+          try {
+            liveEpoch = await this.currentEpoch(cid);
+          } catch {
+            liveEpoch = void 0;
+          }
+          const permanentlyDead = liveEpoch !== void 0 && (row.message_type === "commit" ? row.epoch <= liveEpoch : row.message_type === "application" ? row.epoch < liveEpoch : false);
+          if (permanentlyDead) {
+            handshakeAcked.push(row.queue_id);
+            this.permanentlySkipped++;
+          }
+        }
+      }
+    }
+    if (handshakeAcked.length)
+      await this.o.backend.ackDelivery(deviceId, handshakeAcked);
+    if (supersededChannelIds.length) {
+      Object.defineProperty(appEntries, "supersededChannelIds", { value: supersededChannelIds, enumerable: false });
+    }
+    return appEntries;
+  }
+  /**
+   * Channel-scoped, UNLOCKED commit drain for committer conflict-recovery.
+   *
+   * A committer that loses an epoch race (409) must process the peer's winning
+   * commit to advance to the true current epoch before it retries. It does this
+   * from INSIDE its own channel lock, so it must NOT call the public receiveOnce
+   * (which would re-acquire the same channel lock for that channel's commit rows
+   * and self-deadlock — the queue is not reentrant). This helper does the commit
+   * half of receiveOnce for ONLY the committer's own channel, without taking the
+   * lock (the caller already holds it). Application rows are left untouched — the
+   * committer only needs to converge its handshake epoch — and welcome rows are
+   * left for the join path, exactly as receiveOnce leaves them.
+   */
+  async drainChannelCommitsUnlocked(deviceId, channelId) {
+    const rows = await this.o.backend.pullDelivery(deviceId);
+    const acked = [];
+    for (const row of rows) {
+      if (row.message_type !== "commit")
+        continue;
+      if (row.connect_channel_id !== channelId)
+        continue;
+      try {
+        const mgr = await this.manager(channelId);
+        await mgr.decrypt(hexToBytes(row.payload));
+        await this.o.store.save(channelId, mgr.exportState());
+        this.recordDecryptSuccess(channelId);
+        acked.push(row.queue_id);
+      } catch (err) {
+        this.recordDecryptError(row, err);
+      }
+    }
+    if (acked.length)
+      await this.o.backend.ackDelivery(deviceId, acked);
+  }
+  /** Delegate so the receive pump can ack without reaching the private backend. */
+  async ackDelivery(deviceId, queueIds) {
+    await this.o.backend.ackDelivery(deviceId, queueIds);
+  }
+};
+
+// ../connect-sdk-ts/dist/transport/frame-registry.js
+var str = (v) => String(v ?? "");
+var FRAME_PARSERS = {
+  mls_delivery: (d) => ({ count: typeof d?.count === "number" ? d.count : void 0 }),
+  delivery_receipt: (d) => ({
+    receipts: [{ messageId: str(d?.message_id), channelId: str(d?.channel_id), status: "delivered" }]
+  }),
+  read_receipt: (d) => ({
+    receipts: [{ messageId: str(d?.message_id), channelId: str(d?.channel_id), status: "read" }]
+  }),
+  agent_status_change: (d) => ({
+    presence: [
+      {
+        identityId: str(d?.identity_id),
+        status: d?.status === "offline" ? "offline" : "online",
+        lastSeen: d?.last_seen
+      }
+    ]
+  }),
+  presence_snapshot: (d) => ({
+    presence: (Array.isArray(d?.online) ? d.online : []).map((id) => ({
+      identityId: str(id),
+      status: "online"
+    }))
+  }),
+  typing: (d) => ({ typing: { channelId: str(d?.channel_id), identityId: str(d?.identity_id) } }),
+  agent_status_keepalive: (d) => ({
+    statusKeepalive: { channelId: str(d?.channel_id), identityId: str(d?.identity_id) }
+  }),
+  // MD-3: a device asked to be Welcomed into a group. A surviving committer
+  // device acts on this for own-identity (PoP-proven) requesters; the durable
+  // state is the welcome_request row, this frame just wakes the handler.
+  mls_welcome_requested: (d) => ({
+    welcomeRequest: {
+      groupId: str(d?.group_id),
+      roomId: d?.room_id ? str(d.room_id) : void 0,
+      requestingDeviceId: str(d?.requesting_device_id),
+      requestingIdentityId: d?.requesting_identity_id ? str(d.requesting_identity_id) : void 0,
+      freshKpId: d?.fresh_kp_id ? String(d.fresh_kp_id) : void 0,
+      requestId: d?.request_id ? str(d.request_id) : void 0
+    }
+  }),
+  // Diverged-guest heal Phase 2 (P2-A): the server wakes surviving devices to
+  // heal a guest whose ratchet tree diverged. Durable state is the
+  // mls_guest_heal_request row; this frame is just the wakeup hint.
+  mls_guest_heal_requested: (d) => ({
+    guestHealRequest: {
+      groupId: str(d?.group_id),
+      channelId: str(d?.channel_id),
+      enclaveId: str(d?.enclave_id),
+      guestIdentityId: str(d?.guest_identity_id),
+      guestDeviceId: str(d?.guest_device_id),
+      freshKpId: str(d?.fresh_kp_id),
+      requestId: str(d?.request_id)
+    }
+  })
+};
+var S2C_FRAME_NAMES = new Set(Object.keys(FRAME_PARSERS));
+function parseServerFrame(frame) {
+  if (!frame || typeof frame !== "object")
+    return void 0;
+  const f = frame;
+  const parser = typeof f.event === "string" ? FRAME_PARSERS[f.event] : void 0;
+  return parser ? parser(f.data) : void 0;
+}
+
+// ../connect-sdk-ts/dist/transport/ws-pings.js
+function openDeliveryPings(o) {
+  const base = o.backoffBaseMs ?? 500;
+  const cap = o.backoffCapMs ?? 8e3;
+  const rng = o.rng ?? Math.random;
+  const maxQueue = o.maxQueue ?? 8;
+  const stableResetMs = o.stableResetMs ?? 1e4;
+  let closed = false;
+  let attempt = 0;
+  let sock;
+  let backoffTimer;
+  let stableTimer;
+  const PRESENCE_PONG_MS = 3e4;
+  let pongTimer;
+  const stopPong = () => {
+    if (pongTimer) {
+      clearInterval(pongTimer);
+      pongTimer = void 0;
+    }
+  };
+  const queue = [];
+  let waiter;
+  let iterStarted = false;
+  const push = (p) => {
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w({ value: p, done: false });
+    } else if (queue.length < maxQueue) {
+      queue.push(p);
+    }
+  };
+  const end = () => {
+    closed = true;
+    if (backoffTimer)
+      clearTimeout(backoffTimer);
+    if (stableTimer)
+      clearTimeout(stableTimer);
+    stopPong();
+    try {
+      sock?.close();
+    } catch {
+    }
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w({ value: void 0, done: true });
+    }
+  };
+  const scheduleReconnect = () => {
+    if (closed)
+      return;
+    attempt += 1;
+    const ceil = Math.min(cap, base * 2 ** (attempt - 1));
+    backoffTimer = setTimeout(connect, Math.floor(rng() * ceil));
+  };
+  async function connect() {
+    if (closed)
+      return;
+    let token;
+    try {
+      token = await o.tokenProvider();
+    } catch {
+      scheduleReconnect();
+      return;
+    }
+    if (closed)
+      return;
+    const sep = o.url.includes("?") ? "&" : "?";
+    const ws = new o.wsImpl(`${o.url}${sep}token=${encodeURIComponent(token)}`);
+    sock = ws;
+    ws.onopen = () => {
+      push({ reconnected: true });
+      stableTimer = setTimeout(() => {
+        attempt = 0;
+      }, stableResetMs);
+      stopPong();
+      pongTimer = setInterval(() => {
+        try {
+          if (ws.readyState === 1)
+            ws.send(JSON.stringify({ event: "pong" }));
+        } catch {
+        }
+      }, PRESENCE_PONG_MS);
+    };
+    ws.onmessage = (e) => {
+      try {
+        const f = JSON.parse(String(e.data));
+        const ping = parseServerFrame(f);
+        if (ping)
+          push(ping);
+      } catch {
+      }
+    };
+    ws.onerror = () => {
+    };
+    ws.onclose = (e) => {
+      sock = void 0;
+      if (stableTimer)
+        clearTimeout(stableTimer);
+      stopPong();
+      if (closed)
+        return;
+      if (e.code === 4001) {
+        end();
+        return;
+      }
+      scheduleReconnect();
+    };
+  }
+  void connect();
+  const pings = {
+    [Symbol.asyncIterator]() {
+      if (iterStarted)
+        throw new Error("openDeliveryPings: single-use async iterable");
+      iterStarted = true;
+      return {
+        next() {
+          if (closed)
+            return Promise.resolve({ value: void 0, done: true });
+          if (queue.length)
+            return Promise.resolve({ value: queue.shift(), done: false });
+          return new Promise((resolve) => {
+            waiter = resolve;
+          });
+        }
+      };
+    }
+  };
+  const send = (frame) => {
+    try {
+      if (sock && sock.readyState === 1)
+        sock.send(JSON.stringify(frame));
+    } catch {
+    }
+  };
+  return { pings, close: end, send };
+}
+
+// ../connect-sdk-ts/dist/transport/rest.js
+var PATHS = {
+  register: "/api/v1/connect/agents/register",
+  // VERIFY against MOT-136
+  channelMembers: (id) => `/api/v1/connect/channels/${id}/members`,
+  // VERIFY against MOT-139
+  messages: "/api/v1/messages",
+  // live (MOT-194)
+  stream: "/api/v1/messages/stream",
+  // MLS-gated (MOT-144)
+  auditRecords: "/api/v1/audit/records"
+  // MOT-151
+};
+var RestTransport = class {
+  opts;
+  f;
+  ws;
+  tokenProvider;
+  /** The most recent device-wide WS send handle, captured on subscribe and
+   * cleared on its close. Control frames (status keepalive) route through it;
+   * a no-op when no subscription is active. */
+  _controlSend = null;
+  constructor(opts) {
+    this.opts = opts;
+    this.f = opts.fetchImpl ?? fetch;
+    this.ws = opts.wsImpl ?? globalThis.WebSocket;
+    this.tokenProvider = opts.tokenProvider ?? (async () => opts.bearerToken);
+  }
+  headers() {
+    return { "content-type": "application/json", authorization: `Bearer ${this.opts.bearerToken}` };
+  }
+  async register(req) {
+    const res = await this.f(this.opts.baseUrl + PATHS.register, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({
+        skill_forge_token: req.skillForgeToken,
+        skill_id: req.skillId,
+        public_key: req.publicKey,
+        algo: req.algo,
+        attested: req.attested,
+        model: req.model
+      })
+    });
+    if (!res.ok)
+      throw new RegistrationError(`register failed: ${res.status}`);
+    const j = await res.json();
+    return {
+      agentId: j.agent_id,
+      tenantId: j.tenant_id,
+      enclaveId: j.enclave_id,
+      bindingId: j.binding_id,
+      bindingVersion: j.binding_version,
+      owningOrg: j.owning_org
+    };
+  }
+  async joinChannel(channelId, types, caps) {
+    const res = await this.f(this.opts.baseUrl + PATHS.channelMembers(channelId), {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ declared_message_types: types, declared_capabilities: caps })
+    });
+    if (!res.ok)
+      throw new Error(`joinChannel failed: ${res.status}`);
+  }
+  async leaveChannel(channelId) {
+    await this.f(this.opts.baseUrl + PATHS.channelMembers(channelId), {
+      method: "DELETE",
+      headers: this.headers()
+    });
+  }
+  async publish(envelope) {
+    const res = await this.f(this.opts.baseUrl + PATHS.messages, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(envelope)
+    });
+    if (res.status === 429) {
+      const retry = Number(res.headers.get("retry-after") ?? "1");
+      throw new RateLimitError("server rate limit", Number.isFinite(retry) ? retry : 1);
+    }
+    if (res.status === 400) {
+      const stale = await staleEpochErrorFromResponse(res);
+      if (stale)
+        throw stale;
+    }
+    if (!res.ok)
+      throw new Error(`publish failed: ${res.status}`);
+    const j = await res.json();
+    return {
+      messageId: String(j.message_id),
+      auditRecordId: String(j.audit_record_id),
+      thisHash: String(j.this_hash),
+      sequenceNumber: Number(j.sequence_number)
+    };
+  }
+  subscribeDeliveryPings(_channelId) {
+    let wsUrl = this.opts.baseUrl.replace(/^http/, "ws").replace(/\/$/, "") + "/api/v1/ws";
+    if (this.opts.connectIdentityId) {
+      wsUrl += `?connect_identity_id=${encodeURIComponent(this.opts.connectIdentityId)}`;
+    }
+    const handle = openDeliveryPings({ url: wsUrl, tokenProvider: this.tokenProvider, wsImpl: this.ws });
+    this._controlSend = handle.send;
+    const close = () => {
+      if (this._controlSend === handle.send)
+        this._controlSend = null;
+      handle.close();
+    };
+    return { pings: handle.pings, close, send: handle.send };
+  }
+  sendControlFrame(_channelId, frame) {
+    try {
+      this._controlSend?.(frame);
+    } catch {
+    }
+  }
+  async queryAudit(query) {
+    const qs = new URLSearchParams(query).toString();
+    const res = await this.f(`${this.opts.baseUrl}${PATHS.auditRecords}?${qs}`, {
+      method: "GET",
+      headers: this.headers()
+    });
+    if (res.status === 403)
+      throw new AuditAccessDenied("audit query exceeded caller rights");
+    if (!res.ok)
+      throw new Error(`queryAudit failed: ${res.status}`);
+    const j = await res.json();
+    return (j.records ?? []).map((r) => ({
+      recordId: String(r.record_id),
+      sequenceNumber: Number(r.sequence_number),
+      occurredAt: String(r.occurred_at),
+      messageType: r.message_type ? String(r.message_type) : void 0,
+      channelId: r.channel_id ? String(r.channel_id) : void 0
+    }));
+  }
+};
+
+// ../connect-sdk-ts/dist/mls/rest-backend.js
+var RestMlsBackend = class {
+  opts;
+  f;
+  constructor(opts) {
+    this.opts = opts;
+    this.f = opts.fetchImpl ?? fetch;
+  }
+  headers() {
+    return {
+      "content-type": "application/json",
+      authorization: `Bearer ${this.opts.bearerToken}`
+    };
+  }
+  async post(path, body) {
+    const res = await this.f(this.opts.baseUrl + path, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(body)
+    });
+    if (!res.ok)
+      throw new Error(`${path} failed: ${res.status} ${await res.text()}`);
+    return res.status === 204 ? {} : await res.json();
+  }
+  async get(path) {
+    const res = await this.f(this.opts.baseUrl + path, { headers: this.headers() });
+    if (!res.ok)
+      throw new Error(`${path} failed: ${res.status}`);
+    return await res.json();
+  }
+  async getRegisterChallenge() {
+    const j = await this.post("/api/v1/connect/devices/register-challenge", {});
+    return String(j.challenge);
+  }
+  async registerDevice(req) {
+    const j = await this.post("/api/v1/connect/devices/register", req);
+    return { device_id: String(j.device_id) };
+  }
+  async publishKeyPackage(deviceId, keyPackageHex) {
+    const j = await this.post("/api/v1/mls/key-packages", {
+      key_package: keyPackageHex,
+      device_id: deviceId
+    });
+    return String(j.id);
+  }
+  async getConnectChannelGroup(channelId) {
+    const j = await this.get(`/api/v1/mls/connect-channels/${channelId}/group`);
+    return {
+      exists: Boolean(j.exists),
+      group_id: j.group_id != null ? String(j.group_id) : null,
+      current_epoch: j.current_epoch != null ? Number(j.current_epoch) : null
+    };
+  }
+  async initConnectChannelGroup(channelId, memberDeviceIds) {
+    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/init`, {
+      member_device_ids: memberDeviceIds
+    });
+    return {
+      group_id: String(j.group_id),
+      current_epoch: Number(j.current_epoch),
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // Back-compat: servers that predate the created field return nothing;
+      // treat absence as true (they always created a fresh group).
+      created: j.created === void 0 ? true : Boolean(j.created)
+    };
+  }
+  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
+    const committer = memberDeviceIds[0];
+    if (!committer)
+      throw new Error("reinitConnectChannelGroup: empty member set");
+    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
+      member_device_ids: memberDeviceIds,
+      committer_device_id: committer
+    });
+    return {
+      group_id: String(j.group_id),
+      current_epoch: Number(j.current_epoch),
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+    };
+  }
+  async resetReinitConnectChannelGroup(channelId, memberDeviceIds, att) {
+    const committer = memberDeviceIds[0];
+    if (!committer)
+      throw new Error("resetReinitConnectChannelGroup: empty member set");
+    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
+      member_device_ids: memberDeviceIds,
+      committer_device_id: committer,
+      mode: "reset",
+      new_group_id: att.newGroupId,
+      reset_attestation_signature: att.signatureHex,
+      reset_attestation_nonce: att.nonceHex,
+      reset_attestation_content: att.signedContentHex
+    });
+    return {
+      group_id: String(j.group_id),
+      current_epoch: Number(j.current_epoch),
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+    };
+  }
+  async fetchKeyPackages(deviceIds) {
+    const j = await this.get(`/api/v1/mls/key-packages/batch?device_ids=${deviceIds.join(",")}`);
+    return Object.fromEntries(Object.entries(j).map(([k, v]) => [k, String(v)]));
+  }
+  async fetchKeyPackageById(kpId) {
+    try {
+      const j = await this.get(`/api/v1/mls/key-packages/by-id/${kpId}`);
+      return String(j.key_package);
+    } catch {
+      return null;
+    }
+  }
+  async distribute(groupId, req) {
+    await this.post(`/api/v1/mls/groups/${groupId}/distribute`, {
+      ...req,
+      group_id: groupId
+    });
+  }
+  async pullDelivery(deviceId) {
+    const j = await this.get(`/api/v1/mls/delivery?device_id=${deviceId}`);
+    return j.messages ?? [];
+  }
+  async ackDelivery(deviceId, queueIds) {
+    await this.post("/api/v1/mls/delivery/ack", {
+      device_id: deviceId,
+      queue_ids: queueIds
+    });
+  }
+  async requestWelcome(groupId, deviceId, freshKpId) {
+    const body = { device_id: deviceId };
+    if (freshKpId)
+      body.fresh_kp_id = freshKpId;
+    await this.post(`/api/v1/mls/groups/${groupId}/request-welcome`, body);
+  }
+  async getCommitterWork(channelId) {
+    const j = await this.get(`/api/v1/mls/connect-channels/${channelId}/committer-work`);
+    return {
+      adds: Array.isArray(j.adds) ? j.adds.map(String) : [],
+      removes: Array.isArray(j.removes) ? j.removes.map(String) : []
+    };
+  }
+  async acquireCommitLease(channelId) {
+    const res = await this.f(this.opts.baseUrl + `/api/v1/mls/connect-channels/${channelId}/commit-lease`, { method: "POST", headers: this.headers(), body: JSON.stringify({}) });
+    if (res.status === 409 || res.status === 503)
+      return null;
+    if (!res.ok)
+      throw new Error(`commit-lease ${res.status}`);
+    const j = await res.json();
+    return String(j.token);
+  }
+  async releaseCommitLease(channelId, token) {
+    await this.f(this.opts.baseUrl + `/api/v1/mls/connect-channels/${channelId}/commit-lease/release`, { method: "POST", headers: this.headers(), body: JSON.stringify({ token }) }).catch(() => {
+    });
+  }
+  async fetchResetAttestation(groupId) {
+    try {
+      const j = await this.get(`/api/v1/mls/groups/${groupId}/reset-attestation`);
+      return {
+        signedContent: String(j.signed_content),
+        signatureHex: String(j.signature_hex),
+        signerIdentityId: String(j.signer_identity_id)
+      };
+    } catch {
+      return null;
+    }
+  }
+};
+
+// ../connect-sdk-ts/dist/mls/fake-backend.js
+import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2 } from "@agentvault/crypto";
+
+// ../connect-sdk-ts/dist/receive/inbox-cipher.js
+import { hkdf } from "@noble/hashes/hkdf";
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+var SUITE = "xchacha20poly1305";
+var INFO = new TextEncoder().encode("agentvault-connect-inbox-v1");
+var EMPTY_AAD = new Uint8Array(0);
+var KeyedInboxCipher = class {
+  key;
+  constructor(key) {
+    this.key = key;
+  }
+  async seal(plaintext) {
+    return sealPayload({
+      plaintext,
+      key: this.key,
+      associatedData: EMPTY_AAD,
+      suite: SUITE
+    });
+  }
+  async open(sealed) {
+    return openPayload({
+      ciphertext: sealed,
+      key: this.key,
+      associatedData: EMPTY_AAD,
+      suite: SUITE
+    });
+  }
+};
+var MLS_STORE_INFO = new TextEncoder().encode("agentvault-connect-mls-store-v1");
+function deriveMlsStoreKey(identityKeyMaterial) {
+  return hkdf(sha2562, identityKeyMaterial, void 0, MLS_STORE_INFO, 32);
+}
+
+// ../connect-sdk-ts/dist/recovery/backup-crypto.js
+import { hkdf as hkdf2 } from "@noble/hashes/hkdf";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { randomBytes as randomBytes2 } from "@noble/hashes/utils";
+var BACKUP_INFO = new TextEncoder().encode("connect-backup-v1");
+var RECOVERY_INFO = new TextEncoder().encode("connect-recovery-v1");
+
+// ../connect-sdk-ts/dist/recovery/guest-recovery-crypto.js
+import { argon2idAsync } from "@noble/hashes/argon2";
+import { hkdf as hkdf3 } from "@noble/hashes/hkdf";
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
+var HKDF_INFO = new TextEncoder().encode("connect-guest-recovery-wrap-v1");
+
+// ../connect-mls-store/dist/sqlite-store.js
+import { DatabaseSync } from "node:sqlite";
+
+// ../connect-mls-store/dist/schema.js
+var SCHEMA_VERSION = 3;
+function openSchema(db) {
+  db.exec("PRAGMA journal_mode=WAL");
+  const row = db.prepare("PRAGMA user_version").get();
+  if (row.user_version === 0) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mls_group_state (
+        identity_id   TEXT NOT NULL,
+        channel_id    TEXT NOT NULL,
+        sealed_main   BLOB NOT NULL,
+        sealed_staging BLOB,
+        updated_at    INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, channel_id)
+      );
+    `);
+  }
+  if (row.user_version < 2) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mls_identity_pin (
+        owner_identity_id TEXT PRIMARY KEY,
+        public_key_hex    TEXT NOT NULL,
+        key_algo          TEXT NOT NULL,
+        pinned_at         INTEGER NOT NULL
+      );
+    `);
+  }
+  if (row.user_version < 3) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mls_retired_group (
+        channel_id TEXT NOT NULL,
+        group_id   TEXT NOT NULL,
+        PRIMARY KEY (channel_id, group_id)
+      );
+    `);
+  }
+  db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+}
+
+// ../connect-mls-store/dist/errors.js
+var MlsStoreCorruptError = class extends Error {
+  constructor(detail) {
+    super(`MLS store corrupt: ${detail}`);
+    this.name = "MlsStoreCorruptError";
+  }
+};
+var MlsStoreSealError = class extends Error {
+  constructor(detail) {
+    super(`MLS store seal/open failed: ${detail}`);
+    this.name = "MlsStoreSealError";
+  }
+};
+
+// ../connect-mls-store/dist/sqlite-store.js
+var SqliteMlsStateStore = class {
+  db;
+  id;
+  cipher;
+  // Bundles stay in-memory (spec §4): private half not durably serializable.
+  // Per-instance map → per-identity store instances are naturally isolated (§6.1).
+  bundles = /* @__PURE__ */ new Map();
+  // Last-published-KP-id: same in-memory-only treatment as bundles above (§4) —
+  // a non-secret pointer, but this store's durability layer only covers group
+  // state today; durable persistence is a future follow-up, not this task's scope.
+  lastKpIds = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.id = opts.identityId;
+    this.cipher = opts.cipherFor(opts.identityId);
+    try {
+      this.db = new DatabaseSync(opts.dbPath);
+    } catch (e) {
+      throw new MlsStoreCorruptError(String(e?.message ?? e));
+    }
+    try {
+      openSchema(this.db);
+    } catch (e) {
+      this.db.close();
+      throw new MlsStoreCorruptError(String(e?.message ?? e));
+    }
+    if (opts.dbPath !== ":memory:") {
+      let r;
+      try {
+        r = this.db.prepare("PRAGMA integrity_check").get();
+      } catch (e) {
+        this.db.close();
+        throw new MlsStoreCorruptError(String(e?.message ?? e));
+      }
+      if (r.integrity_check !== "ok") {
+        this.db.close();
+        throw new MlsStoreCorruptError(r.integrity_check);
+      }
+    }
+  }
+  async seal(state) {
+    return this.cipher.seal(new TextEncoder().encode(JSON.stringify(state)));
+  }
+  async unseal(blob) {
+    let bytes;
+    try {
+      bytes = await this.cipher.open(blob);
+    } catch (e) {
+      throw new MlsStoreSealError(String(e?.message ?? e));
+    }
+    return JSON.parse(new TextDecoder().decode(bytes));
+  }
+  async load(channelId) {
+    const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+    if (!row)
+      return null;
+    return this.unseal(row.sealed_main);
+  }
+  async save(channelId, state) {
+    const sealed = await this.seal(state);
+    this.db.prepare(`INSERT INTO mls_group_state (identity_id, channel_id, sealed_main, updated_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET sealed_main=excluded.sealed_main, updated_at=excluded.updated_at`).run(this.id, channelId, sealed, Date.now());
+  }
+  async delete(channelId) {
+    this.db.prepare("DELETE FROM mls_group_state WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+  }
+  async saveStaging(channelId, state) {
+    const sealed = await this.seal(state);
+    this.db.prepare("UPDATE mls_group_state SET sealed_staging=?, updated_at=? WHERE identity_id=? AND channel_id=?").run(sealed, Date.now(), this.id, channelId);
+  }
+  async promoteStaging(channelId) {
+    this.db.prepare(`UPDATE mls_group_state SET sealed_main=sealed_staging, sealed_staging=NULL, updated_at=?
+       WHERE identity_id=? AND channel_id=? AND sealed_staging IS NOT NULL`).run(Date.now(), this.id, channelId);
+  }
+  async discardStaging(channelId) {
+    this.db.prepare("UPDATE mls_group_state SET sealed_staging=NULL WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+  }
+  async savePendingBundle(ref, bundle) {
+    this.bundles.set(ref, bundle);
+  }
+  async loadPendingBundle(ref) {
+    return this.bundles.get(ref) ?? null;
+  }
+  async deletePendingBundle(ref) {
+    this.bundles.delete(ref);
+  }
+  async saveLastKpId(deviceId, id) {
+    this.lastKpIds.set(deviceId, id);
+  }
+  async loadLastKpId(deviceId) {
+    return this.lastKpIds.get(deviceId) ?? null;
+  }
+  async saveLastKpAndBundle(deviceId, id, bundle) {
+    this.lastKpIds.set(deviceId, id);
+    this.bundles.set(deviceId, bundle);
+  }
+  async savePinnedIdentityKey(identityId, key) {
+    this.db.prepare(`INSERT INTO mls_identity_pin (owner_identity_id, public_key_hex, key_algo, pinned_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(owner_identity_id) DO UPDATE SET
+         public_key_hex=excluded.public_key_hex, key_algo=excluded.key_algo, pinned_at=excluded.pinned_at`).run(identityId, key.publicKeyHex, key.keyAlgo, Date.now());
+  }
+  async loadPinnedIdentityKey(identityId) {
+    const row = this.db.prepare("SELECT public_key_hex, key_algo FROM mls_identity_pin WHERE owner_identity_id=?").get(identityId);
+    return row ? { publicKeyHex: row.public_key_hex, keyAlgo: row.key_algo } : null;
+  }
+  async addRetiredGroupId(channelId, groupId) {
+    this.db.prepare("INSERT OR IGNORE INTO mls_retired_group (channel_id, group_id) VALUES (?,?)").run(channelId, groupId);
+  }
+  async loadRetiredGroupIds(channelId) {
+    const rows = this.db.prepare("SELECT group_id FROM mls_retired_group WHERE channel_id=?").all(channelId);
+    return rows.map((r) => r.group_id);
+  }
+  /** @internal test-only */
+  _rawMainForTest(identityId, channelId) {
+    const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(identityId, channelId);
+    return row?.sealed_main;
+  }
+  close() {
+    this.db.close();
+  }
+};
+
+// src/bridge-agent.ts
+import { decryptFile, encryptFile, computeFileDigest, base64ToBytes as base64ToBytes2, bytesToBase64 as bytesToBase642 } from "@agentvault/crypto";
+import { promises as fsp } from "node:fs";
+import { join, dirname } from "node:path";
+
+// src/latency.ts
+var DEFAULT_CAPACITY = 1024;
+function round(n) {
+  return Math.round(n * 100) / 100;
+}
+function percentile(sorted, p) {
+  if (sorted.length === 0) return 0;
+  const rank = Math.ceil(p / 100 * sorted.length);
+  const idx = Math.min(Math.max(rank, 1), sorted.length) - 1;
+  return sorted[idx];
+}
+var LatencyRecorder = class {
+  capacity;
+  // Per-stage ring buffer of recent samples (ms).
+  buffers = /* @__PURE__ */ new Map();
+  // Write cursor per stage (for the ring buffer wrap).
+  cursors = /* @__PURE__ */ new Map();
+  constructor(opts = {}) {
+    this.capacity = opts.capacity ?? DEFAULT_CAPACITY;
+  }
+  /** Record a single sample (ms) for a stage. O(1). */
+  record(stage, ms) {
+    let buf = this.buffers.get(stage);
+    if (!buf) {
+      buf = [];
+      this.buffers.set(stage, buf);
+      this.cursors.set(stage, 0);
+    }
+    if (buf.length < this.capacity) {
+      buf.push(ms);
+    } else {
+      const cur = this.cursors.get(stage) ?? 0;
+      buf[cur] = ms;
+      this.cursors.set(stage, (cur + 1) % this.capacity);
+    }
+  }
+  /**
+   * Time an async fn, record its elapsed wall time under `stage`, return its
+   * value. Records even when the fn throws (the failure still consumed time),
+   * then re-throws — so a thrown error never loses the timing sample.
+   */
+  async time(stage, fn) {
+    const start = performance.now();
+    try {
+      return await fn();
+    } finally {
+      this.record(stage, performance.now() - start);
+    }
+  }
+  /** Percentile snapshot per stage. Rounded to 2 decimals (ms). */
+  snapshot() {
+    const out = {};
+    for (const [stage, buf] of this.buffers) {
+      if (buf.length === 0) continue;
+      const sorted = [...buf].sort((a, b) => a - b);
+      const sum = sorted.reduce((acc, n) => acc + n, 0);
+      out[stage] = {
+        count: sorted.length,
+        p50: round(percentile(sorted, 50)),
+        p95: round(percentile(sorted, 95)),
+        p99: round(percentile(sorted, 99)),
+        max: round(sorted[sorted.length - 1]),
+        mean: round(sum / sorted.length)
+      };
+    }
+    return out;
+  }
+};
+
+// src/coordination.ts
+function parseMentions(text) {
+  const mentions = [];
+  const re = /@(\w[\w]*)/gi;
+  let match;
+  while ((match = re.exec(text)) !== null) {
+    mentions.push(match[1].toLowerCase());
+  }
+  return mentions;
+}
+function ownRoomNames(agentName, accountId, roomDisplayName) {
+  const names = /* @__PURE__ */ new Set();
+  const add = (n) => {
+    if (!n) return;
+    const lower = n.toLowerCase();
+    names.add(lower);
+    names.add(lower.split(/[\s(]/)[0]);
+  };
+  add(agentName);
+  add(accountId);
+  add(roomDisplayName);
+  return names;
+}
+function shouldProcessRoomMessage(plaintext, agentName, accountId, opts) {
+  const mentions = parseMentions(plaintext);
+  if (mentions.length === 0) return true;
+  if (mentions.includes("all") || mentions.includes("everyone")) return true;
+  const ownNames = ownRoomNames(agentName, accountId, opts?.roomDisplayName);
+  if (mentions.some((m) => ownNames.has(m))) return true;
+  return false;
+}
+
+// src/rate-limit.ts
+var TokenBucketFloor = class {
+  capacity;
+  refillPerMs;
+  now;
+  buckets = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.capacity = opts.capacity;
+    this.refillPerMs = opts.refillPerMinute / 6e4;
+    this.now = opts.now ?? Date.now;
+  }
+  refill(key) {
+    const t = this.now();
+    let b = this.buckets.get(key);
+    if (!b) {
+      b = { tokens: this.capacity, lastRefill: t };
+      this.buckets.set(key, b);
+      return b;
+    }
+    const elapsed = t - b.lastRefill;
+    if (elapsed > 0) {
+      b.tokens = Math.min(this.capacity, b.tokens + elapsed * this.refillPerMs);
+      b.lastRefill = t;
+    }
+    return b;
+  }
+  /** Consume one token. Returns true if allowed, false if the bucket is empty. */
+  tryConsume(key) {
+    if (this.capacity <= 0) return true;
+    const b = this.refill(key);
+    if (b.tokens >= 1) {
+      b.tokens -= 1;
+      return true;
+    }
+    return false;
+  }
+  /** Milliseconds until one token is available (0 if already available). */
+  msUntilNextToken(key) {
+    if (this.capacity <= 0) return 0;
+    const b = this.refill(key);
+    if (b.tokens >= 1) return 0;
+    if (this.refillPerMs <= 0) return Infinity;
+    return Math.ceil((1 - b.tokens) / this.refillPerMs);
+  }
+};
+
+// src/attachments.ts
+import { basename } from "node:path";
+function sanitizeFilename(name, fallback) {
+  const base = basename(name ?? "");
+  const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+var MIME_BY_EXT = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  md: "text/markdown",
+  json: "application/json",
+  csv: "text/csv",
+  html: "text/html",
+  mp4: "video/mp4",
+  mp3: "audio/mpeg",
+  zip: "application/zip",
+  wav: "audio/wav"
+};
+function mimeForName(name) {
+  const dot = name.lastIndexOf(".");
+  if (dot < 0 || dot === name.length - 1) return "application/octet-stream";
+  return MIME_BY_EXT[name.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
+}
+async function prepareAttachment(filePath, caption, channelId, deps) {
+  const bytes = await deps.readFile(filePath);
+  const name = basename(filePath);
+  const { encryptedData, fileKey, fileNonce, digest } = deps.encryptFile(bytes);
+  const blobId = await deps.uploadBlob(encryptedData, channelId);
+  const body = {
+    v: 1,
+    type: "artifact_share",
+    name,
+    mime: mimeForName(name),
+    size: bytes.length,
+    blobId,
+    fileKey: deps.bytesToBase64(fileKey),
+    fileNonce: deps.bytesToBase64(fileNonce),
+    digest
+  };
+  if (caption) body.text = caption;
+  return body;
+}
+async function materializeAttachment(body, ctx, deps) {
+  const ciphertext = await deps.downloadBlob(body.blobId);
+  const sha2565 = deps.computeFileDigest(ciphertext);
+  if (sha2565 !== body.digest) {
+    throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
+  }
+  const plain = deps.decryptFile(
+    ciphertext,
+    deps.base64ToBytes(body.fileKey),
+    deps.base64ToBytes(body.fileNonce)
+  );
+  const safeName = sanitizeFilename(body.name, ctx.messageId);
+  const dir = `${ctx.attachmentsDir}/${ctx.channelId}`;
+  const path = `${dir}/${ctx.messageId}-${safeName}`;
+  await deps.mkdirp(dir);
+  await deps.writeFile(path, plain);
+  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha2565 };
+}
+
+// src/bridge-agent.ts
+var DEFAULT_MAX_BUFFER = 1e3;
+var CHANNEL_META_TTL_MS = 5 * 6e4;
+var CHANNEL_ROSTER_TTL_MS = 5 * 6e4;
+var ZERO_TRACEPARENT = "00-" + "0".repeat(32) + "-" + "0".repeat(16) + "-01";
+var ChannelPendingError = class extends Error {
+  constructor(channelId) {
+    super(`channel ${channelId} is not yet admitted (awaiting Welcome)`);
+    this.channelId = channelId;
+    this.name = "ChannelPendingError";
+  }
+};
+var RateLimitedError = class extends Error {
+  constructor(channelId, retryAfterMs) {
+    super(`channel ${channelId} send rate limit exceeded (retry in ${retryAfterMs}ms)`);
+    this.channelId = channelId;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "RateLimitedError";
+  }
+};
+var InvalidPathError = class extends Error {
+  constructor(filePath, cause) {
+    super(`cannot read attachment file: ${filePath}`);
+    this.filePath = filePath;
+    this.name = "InvalidPathError";
+    if (cause !== void 0) this.cause = cause;
+  }
+};
+var UnknownActionRunError = class extends Error {
+  constructor(runId) {
+    super(`unknown or already-settled agent action run: ${runId}`);
+    this.runId = runId;
+    this.name = "UnknownActionRunError";
+  }
+};
+var BRIDGE_VERSION = "0.0.0";
+function hexToBytes3(h) {
+  return new Uint8Array(Buffer.from(h, "hex"));
+}
+var BridgeAgent = class _BridgeAgent {
+  constructor(cfg, deps = {}) {
+    this.cfg = cfg;
+    const seed = hexToBytes3(cfg.signingPrivateKey);
+    this.custody = SoftwareKeyCustody.fromPrivateKey("ed25519", seed);
+    this.transport = deps.transport ?? new RestTransport({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey, connectIdentityId: cfg.identityId });
+    this.backend = deps.backend ?? new RestMlsBackend({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey });
+    this.store = new SqliteMlsStateStore({
+      dbPath: cfg.storePath,
+      identityId: cfg.identityId,
+      cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
+    });
+    this.provider = new MlsGroupKeyProvider({
+      store: this.store,
+      backend: this.backend,
+      deviceId: cfg.deviceId,
+      identity: new TextEncoder().encode(cfg.identityId),
+      // ADR-0002: count + log agent-side decrypt failures. Without this hook the
+      // daemon was 100% blind to a wedged channel (it "looked idle"); the
+      // provider's errorStats() snapshot is surfaced on GET /v1/metrics below.
+      onDecryptError: (row, err) => {
+        const cid = row.connect_channel_id ?? "(unmapped)";
+        console.warn(
+          `[bridge] decrypt error on channel ${cid} (queue ${row.queue_id}, epoch ${row.epoch}): ${err instanceof Error ? err.message : String(err)}`
+        );
+      },
+      // Owner-attested Reset Secure Session (Task 8): the SDK's step-0 guard
+      // calls this before honoring an owner-authored supersede. It must return
+      // a value ONLY when the structural owner is unambiguous AND a pin exists
+      // for it — never trust a bare in-memory cache without reconfirming
+      // against the persisted pin (see resolvePinnedOwnerHook below).
+      onResolvePinnedOwner: (channelId) => this.resolvePinnedOwnerHook(channelId)
+    });
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.latency = deps.latency ?? new LatencyRecorder();
+    this.maxBuffer = deps.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    this.rateFloor = new TokenBucketFloor({
+      capacity: cfg.rateLimitCapacity ?? 20,
+      refillPerMinute: cfg.rateLimitRefillPerMinute ?? 20
+    });
+    this.actionClock = deps.actionThrottleNow ?? Date.now;
+    this.actionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
+    this.globalActionRateFloor = new TokenBucketFloor({ capacity: 1, refillPerMinute: 30, now: this.actionClock });
+    const self = this;
+    this.downloadBlobImpl = deps.downloadBlob ?? async function(blobId) {
+      const url = `${cfg.apiBase}/api/v1/attachments/${encodeURIComponent(blobId)}?caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
+      const res = await self.fetchImpl(url, { headers: { authorization: `Bearer ${cfg.apiKey}` } });
+      if (!res.ok) throw new Error(`download blob failed: ${res.status}`);
+      return new Uint8Array(await res.arrayBuffer());
+    };
+    this.uploadBlobImpl = deps.uploadBlob ?? async function(ciphertext, channelId) {
+      const url = `${cfg.apiBase}/api/v1/attachments?channel_id=${encodeURIComponent(channelId)}&caller_identity_id=${encodeURIComponent(cfg.identityId)}`;
+      const res = await self.fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/octet-stream", authorization: `Bearer ${cfg.apiKey}` },
+        body: ciphertext
+      });
+      if (!res.ok) throw new Error(`upload blob failed: ${res.status}`);
+      const j = await res.json();
+      return String(j.attachment_id);
+    };
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join(dirname(cfg.storePath), "attachments");
+    this.action = {
+      begin: (channelId) => this.actionBegin(channelId),
+      start: (opts) => this.actionStart(opts),
+      update: (runId, nodeId, patch) => this.actionUpdate(runId, nodeId, patch),
+      finish: (runId, nodeId, patch) => this.actionFinish(runId, nodeId, patch),
+      settle: (runId, opts) => this.actionSettle(runId, opts),
+      wrap: (runId, fn, opts) => this.actionWrap(runId, fn, opts)
+    };
+  }
+  transport;
+  provider;
+  backend;
+  // stored for peek-then-join in ingestOnce
+  custody;
+  fetchImpl;
+  joinState = /* @__PURE__ */ new Map();
+  /**
+   * Phase 2: lazy channel-metadata cache (channel_id → { is_dm, name, at }) used
+   * by the multi-agent room @mention filter at ingest. Populated/refreshed from a
+   * SINGLE listChannels() per ingest cycle on a cache miss. A channel that cannot
+   * be resolved (network error, or not present in the listing) stays UNKNOWN → the
+   * filter fails OPEN.
+   *
+   * `is_dm` is immutable for a given channel_id (no misclassification risk), so the
+   * TTL exists only to keep `name` fresh after a channel rename — an entry older
+   * than CHANNEL_META_TTL_MS is treated as a miss and re-resolved on the next cycle.
+   */
+  channelMeta = /* @__PURE__ */ new Map();
+  /**
+   * Phase 2 (sender attribution): per-channel roster cache
+   * (channel_id → identity_id → { name, is_agent }) resolved from the GET
+   * members endpoint. Same lazy/TTL/fail-soft discipline as channelMeta: an
+   * unresolved channel (network error, or no entry) leaves sender_name
+   * undefined and never blocks ingest. Resolved AT MOST ONCE per ingest cycle
+   * per channel on a miss.
+   */
+  channelRoster = /* @__PURE__ */ new Map();
+  /**
+   * Task 8 (owner-attested Reset Secure Session): per-channel STRUCTURAL owner
+   * cache, fed by resolveAndPinOwner() on every roster refresh and consumed by
+   * the onResolvePinnedOwner hook passed to MlsGroupKeyProvider. "anomalous"
+   * means the DM roster shape was not exactly one non-self, non-agent
+   * counterpart, OR the freshly-fetched key no longer matches an existing pin —
+   * either way the hook must fail closed (return null) for that channel.
+   */
+  channelOwner = /* @__PURE__ */ new Map();
+  buffer = [];
+  maxBuffer;
+  /** Cumulative count of messages shed by the buffer cap (surfaced on health()/metrics()). */
+  droppedMessages = 0;
+  /**
+   * Cumulative count of ROOM messages dropped by the @mention filter (item 3 /
+   * ADR-0002 ethos). Surfaced on health()/metrics() so an agent correctly filtering
+   * most room traffic is distinguishable from an idle/wedged one.
+   */
+  filteredRoomMessages = 0;
+  /** Cumulative count of sends shed by the per-channel rate-limit floor (surfaced on health()/metrics()). */
+  rateLimitedSends = 0;
+  /** Cumulative count of requestWelcome calls fired for no-local-state deliveries (self-heal signal). */
+  welcomeRequestsSent = 0;
+  /** 2026-07-03 latency triage: cumulative delivery pings received on the WS
+   *  stream. 0 while messages still flow = the stream is dead and inbound is
+   *  riding the 25s safety floor (surfaced on health()/metrics). */
+  pingsReceived = 0;
+  /** True once close() begins — gates the ping-stream-death stderr warning so
+   *  a normal shutdown doesn't cry wolf. */
+  closingDown = false;
+  /**
+   * Track 5: cumulative count of artifact_share messages where download/decrypt/digest
+   * failed. Fail-soft — failures are acked (no redelivery), logged to stderr, and this
+   * counter is incremented. Surfaced on health()/metrics().
+   */
+  failedAttachments = 0;
+  /** Per-channel timestamp of last requestWelcome call, for cooldown enforcement. */
+  lastWelcomeRequest = /* @__PURE__ */ new Map();
+  /** Minimum gap between requestWelcome calls for the same channel (2 minutes). */
+  static REQUEST_WELCOME_COOLDOWN_MS = 12e4;
+  /**
+   * Task 12: proactive self-heal sweep kill-switch. Task 11's held-KP signal
+   * only fires reactively, from ingestOnce's Phase-0 pass over PULLED delivery
+   * rows — an idle-but-wiped channel therefore loses its NEXT message (the
+   * very message that would have proven it diverged). selfHealSweep() closes
+   * that gap by proactively walking every non-DM member channel at boot and
+   * on an interval. `SECURECOMS_SELF_HEAL_SWEEP=false` disables it, falling
+   * back to the delivery-row-driven Task 11 behaviour only.
+   */
+  selfHealSweepEnabled = process.env.SECURECOMS_SELF_HEAL_SWEEP !== "false";
+  /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
+  static SELF_HEAL_SWEEP_INTERVAL_MS = 9e4;
+  selfHealTimer;
+  rateFloor;
+  /**
+   * agent.action.* run state, keyed by runId.
+   *
+   * Review M3 (bug fix): the ORIGINAL comment here said "deliberately
+   * unbounded" — but nothing ever bounded it either. Only actionSettle()
+   * deleted an entry; a begun-but-never-settled run (agent crash, bug,
+   * dropped/never-sent reply) leaked for the daemon's entire lifetime. Now
+   * bounded by MAX_UNSETTLED_ACTION_RUNS (LRU eviction by startedAt) plus a
+   * lazy ACTION_RUN_STALE_MS sweep, both applied on every actionBegin() —
+   * mirrors the send-side inbound-buffer bound (capBuffer/maxBuffer).
+   */
+  actionRuns = /* @__PURE__ */ new Map();
+  /** Review M3: hard cap on concurrently-tracked UNSETTLED runs. Exceeding it
+   *  evicts the oldest (LRU by startedAt) to make room — never grows past
+   *  this regardless of how many runs are begun and abandoned. */
+  static MAX_UNSETTLED_ACTION_RUNS = 50;
+  /** Review M3: an unsettled run older than this (by startedAt, relative to
+   *  actionClock()) is swept away on the next actionBegin(), independent of
+   *  the count-based cap — bounds memory even when begin() calls are rare. */
+  static ACTION_RUN_STALE_MS = 60 * 6e4;
+  // 60 minutes
+  /** Review I3/M3: injected clock (defaults Date.now) for the action-partial
+   *  token buckets AND the stale-run sweep — a single seam so tests can
+   *  simulate elapsed time deterministically. */
+  actionClock;
+  /**
+   * Per-run token bucket for `agent_action` PARTIAL frames (Global
+   * Constraint: do NOT model on the unthrottled reportStatus; do NOT reuse
+   * `rateFloor`/`enforceRateFloor`, whose semantics are "throw past
+   * capacity" — partials instead COALESCE: a throttled call just leaves its
+   * change in `dirty` for the next allowed send to pick up).
+   *
+   * Review I3 (bug fix): capacity 1 / refill 60-per-minute was EXACTLY the
+   * backend's MESSAGING_LIMIT (60/60s per sender) — no headroom. Partials +
+   * the settled frame + the agent's real reply + reportStatus all compete
+   * for that one shared per-sender budget, so a long run's settled frame or
+   * reply could 429 right at the end. Lowered to 30/min (~1 per 2s) so
+   * partials alone use at most ~half the identity's send budget, leaving
+   * headroom for the settled frame / reply / status traffic riding the SAME
+   * cap. Independent of `cfg.rateLimitCapacity` (room/a2a/attachment floor).
+   * `settled` frames bypass this bucket entirely — they always send, exactly
+   * once, per run.
+   */
+  actionRateFloor;
+  /**
+   * Review I3 (bug fix): a GLOBAL bucket shared across every run, on top of
+   * the per-run bucket above. Without this, N concurrent runs each get their
+   * OWN ~30/min budget, so the partial send rate multiplies with agent
+   * concurrency and can still blow past the shared 60/min identity edge cap
+   * (each run individually "has headroom" but the SUM doesn't). Same
+   * capacity/refill as the per-run bucket — it caps the aggregate, not any
+   * single run.
+   */
+  globalActionRateFloor;
+  /** Public `agent.action.*` surface — assigned once at the end of the constructor. */
+  action;
+  waiters = [];
+  pingHandle;
+  safetyTimer;
+  listeners = /* @__PURE__ */ new Set();
+  startedAt = 0;
+  store;
+  latency;
+  /** Track 5: injectable blob download fn (default: fetch-based). */
+  downloadBlobImpl;
+  /** Track 5: injectable blob upload fn (default: fetch-based). */
+  uploadBlobImpl;
+  /** Track 5: directory where received attachments are saved. */
+  attachmentsDirImpl;
+  /**
+   * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
+   *
+   * The buffer is uniformly ordered oldest→newest: ingestOnce() appends freshly
+   * decrypted inbound at the BACK (newest), and requeueFront() unshifts un-acked
+   * messages at the FRONT — those re-buffered messages were consumed earlier, so
+   * they are by definition OLDER than whatever already sits in the buffer. In
+   * every push path the newest messages therefore live at the back. To honour
+   * "the most-recent survive" we always shed from the FRONT, then record the
+   * shed so a silently-dropping daemon stays observable (item 3 / ADR-0002).
+   */
+  capBuffer() {
+    if (this.maxBuffer <= 0) return;
+    const overflow = this.buffer.length - this.maxBuffer;
+    if (overflow > 0) {
+      this.buffer.splice(0, overflow);
+      this.droppedMessages += overflow;
+    }
+  }
+  async start() {
+    this.startedAt = Date.now();
+    await this.provider.publishKeyPackage();
+    this.startReceivePump();
+    if (this.selfHealSweepEnabled) void this.selfHealSweep();
+  }
+  async reconcileJoin(channelId) {
+    if (this.joinState.get(channelId) === "JOINED") return true;
+    try {
+      await this.provider.joinAndReconcile(channelId, this.cfg.enclaveId);
+      this.joinState.set(channelId, "JOINED");
+      return true;
+    } catch {
+      this.joinState.set(channelId, "PENDING");
+      return false;
+    }
+  }
+  /**
+   * The held-KP re-Welcome signal (Task 11), shared by both the reactive
+   * divergence branch in ingestOnce() and the proactive selfHealSweep()
+   * (Task 12). Guarantees a HELD bundle backs the signalled KP:
+   * getLastPublishedKpId returns an id even after the pending bundle was
+   * consumed/lost, which would make the owner seal an un-openable Welcome.
+   * publishKeyPackage is a no-op (returns the same id) while a bundle IS
+   * held, and mints a fresh held KP (delete-and-replace) when none is held.
+   * Callers are responsible for their own cooldown/rate-limit gate and
+   * try/catch — this method does neither.
+   */
+  async signalHeldKpWelcome(groupId) {
+    await this.provider.publishKeyPackage();
+    const freshKpId = await this.provider.getLastPublishedKpId() ?? void 0;
+    await this.backend.requestWelcome(groupId, this.cfg.deviceId, freshKpId);
+    this.welcomeRequestsSent++;
+  }
+  /**
+   * Task 12: proactive self-heal sweep. ingestOnce's Task-11 divergence
+   * branch only fires reactively — off a delivery ROW that already arrived
+   * for a diverged channel. A wiped-but-IDLE channel (no traffic since the
+   * wipe) never produces that row, so its next real message would be the
+   * first thing lost. This sweep walks every non-DM member channel (fired
+   * once at boot + on SELF_HEAL_SWEEP_INTERVAL_MS) and, for any with no
+   * persisted state even after a reconcile attempt, resolves group_id via
+   * the READ-ONLY getConnectChannelGroup probe (never initConnectChannelGroup,
+   * which would side-effect a member_device_ids union + commit) and applies
+   * the same held-KP signal — respecting the existing per-channel cooldown.
+   *
+   * Each channel is wrapped in its own try/catch: `listChannels` filters at
+   * the identity level while `requestWelcome` (via request_welcome) gates at
+   * the device level, so a channel where this identity is a member but this
+   * DEVICE never held a leaf can 403 on the signal call. That's harmless and
+   * must not abort the sweep for every other channel.
+   */
+  async selfHealSweep() {
+    let chans;
+    try {
+      chans = await this.listChannels();
+    } catch {
+      return;
+    }
+    for (const c of chans) {
+      if (c.is_dm) continue;
+      try {
+        if (await this.provider.hasPersistedChannelState(c.channel_id)) continue;
+        await this.reconcileJoin(c.channel_id);
+        if (await this.provider.hasPersistedChannelState(c.channel_id)) continue;
+        const g = await this.backend.getConnectChannelGroup(c.channel_id);
+        if (!g?.group_id) continue;
+        const now = performance.now();
+        const last = this.lastWelcomeRequest.get(c.channel_id) ?? -Infinity;
+        if (now - last < _BridgeAgent.REQUEST_WELCOME_COOLDOWN_MS) continue;
+        this.lastWelcomeRequest.set(c.channel_id, now);
+        await this.signalHeldKpWelcome(g.group_id);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Per-channel send-floor check. No-op on allow; throws RateLimitedError on a
+   * trip (incrementing the observable counter). `kind` namespaces the bucket so
+   * room and a2a traffic on the same channel are tracked separately.
+   */
+  enforceRateFloor(kind, channelId) {
+    const key = `${kind}:${channelId}`;
+    if (!this.rateFloor.tryConsume(key)) {
+      this.rateLimitedSends++;
+      throw new RateLimitedError(channelId, this.rateFloor.msUntilNextToken(key));
+    }
+  }
+  async send(channelId, text, messageId) {
+    const meta = this.freshMeta(channelId);
+    if (meta && !meta.is_dm) this.enforceRateFloor("room", channelId);
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    const id = messageId ?? crypto.randomUUID();
+    const sendStart = performance.now();
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => this.latency.time(
+        "send.encrypt",
+        () => buildOutboundEnvelope({
+          custody: this.custody,
+          groupKey: this.provider,
+          messageId: id,
+          channelId,
+          enclaveId: this.cfg.enclaveId,
+          senderId: this.cfg.identityId,
+          senderType: "agent",
+          type: "text",
+          bodyPlaintext: JSON.stringify({ text }),
+          bindingId: "",
+          bindingVersion: "0.0.0",
+          agentSkillId: null,
+          epoch,
+          traceparent: ZERO_TRACEPARENT,
+          references: [],
+          stage5Outcome: "allow",
+          stage5Evaluators: []
+        })
+      ),
+      (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
+    );
+    this.latency.record("send.total", performance.now() - sendStart);
+    return { message_id: id, status: "sent" };
+  }
+  async sendA2A(channelId, a2a, messageId) {
+    this.enforceRateFloor("a2a", channelId);
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    const id = messageId ?? crypto.randomUUID();
+    const sendStart = performance.now();
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => this.latency.time(
+        "send.encrypt",
+        () => buildOutboundEnvelope({
+          custody: this.custody,
+          groupKey: this.provider,
+          messageId: id,
+          channelId,
+          enclaveId: this.cfg.enclaveId,
+          senderId: this.cfg.identityId,
+          senderType: "agent",
+          type: "a2a",
+          bodyPlaintext: JSON.stringify({ type: "a2a", a2a_version: a2a.a2a_version, kind: a2a.kind, object: a2a.object }),
+          bindingId: "",
+          bindingVersion: "0.0.0",
+          agentSkillId: null,
+          epoch,
+          traceparent: ZERO_TRACEPARENT,
+          references: [],
+          stage5Outcome: "allow",
+          stage5Evaluators: []
+        })
+      ),
+      (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
+    );
+    this.latency.record("send.total", performance.now() - sendStart);
+    return { message_id: id, status: "sent" };
+  }
+  sendDeps() {
+    return {
+      uploadBlob: (ciphertext, channelId) => this.uploadBlobImpl(ciphertext, channelId),
+      encryptFile,
+      bytesToBase64: bytesToBase642,
+      readFile: (p) => fsp.readFile(p).then((b) => new Uint8Array(b))
+    };
+  }
+  async sendAttachment(channelId, filePath, caption) {
+    this.enforceRateFloor("attachment", channelId);
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    let body;
+    try {
+      body = await prepareAttachment(filePath, caption, channelId, this.sendDeps());
+    } catch (e) {
+      if (e.code === "ENOENT" || e.code === "EACCES" || e.code === "ENOTDIR" || e.code === "EISDIR") {
+        throw new InvalidPathError(filePath, e);
+      }
+      throw e;
+    }
+    const id = crypto.randomUUID();
+    const sendStart = performance.now();
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => this.latency.time(
+        "send.encrypt",
+        () => buildOutboundEnvelope({
+          custody: this.custody,
+          groupKey: this.provider,
+          messageId: id,
+          channelId,
+          enclaveId: this.cfg.enclaveId,
+          senderId: this.cfg.identityId,
+          senderType: "agent",
+          type: "artifact_share",
+          bodyPlaintext: JSON.stringify(body),
+          bindingId: "",
+          bindingVersion: "0.0.0",
+          agentSkillId: null,
+          epoch,
+          traceparent: ZERO_TRACEPARENT,
+          references: [],
+          stage5Outcome: "allow",
+          stage5Evaluators: []
+        })
+      ),
+      (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
+    );
+    this.latency.record("send.total", performance.now() - sendStart);
+    return { message_id: id, status: "sent" };
+  }
+  async listChannels() {
+    const url = `${this.cfg.apiBase}/api/v1/enclaves/${this.cfg.enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+    const res = await this.fetchImpl(url, {
+      headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+    });
+    if (!res.ok) throw new Error(`list_channels failed: ${res.status}`);
+    const rows = await res.json();
+    return rows.map((r) => ({
+      channel_id: r.channel_id,
+      name: r.name ?? null,
+      is_dm: r.is_dm,
+      joined: true
+    }));
+  }
+  /** A live channelMeta entry, or undefined if missing OR expired past the TTL. */
+  freshMeta(channelId) {
+    const hit = this.channelMeta.get(channelId);
+    if (!hit) return void 0;
+    if (Date.now() - hit.at >= CHANNEL_META_TTL_MS) return void 0;
+    return { is_dm: hit.is_dm, name: hit.name };
+  }
+  /**
+   * One-shot, whole-listing refresh of channelMeta. Called AT MOST ONCE per
+   * ingest cycle (the caller guards with a cycle-local "refreshed" flag), so a
+   * burst of K unknown channels fires a single listChannels() instead of K. Any
+   * listChannels failure is swallowed (UNKNOWN → fail open) so ingest never
+   * blocks on the network.
+   */
+  async refreshChannelMeta() {
+    try {
+      const now = Date.now();
+      const channels = await this.listChannels();
+      for (const c of channels) {
+        this.channelMeta.set(c.channel_id, { is_dm: c.is_dm, name: c.name, at: now });
+      }
+    } catch {
+    }
+  }
+  /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
+  freshRoster(channelId) {
+    const hit = this.channelRoster.get(channelId);
+    if (!hit) return void 0;
+    if (Date.now() - hit.at >= CHANNEL_ROSTER_TTL_MS) return void 0;
+    return hit.members;
+  }
+  /**
+   * Resolve one channel's roster (members + display names + is-agent) from the
+   * GET members endpoint into the roster cache. Called AT MOST ONCE per ingest
+   * cycle per channel on a cache miss. Fail-soft: any error leaves the cache
+   * as-is so the affected senders stay unresolved (sender_name undefined) —
+   * attribution must NEVER block or drop a message.
+   */
+  async refreshChannelRoster(channelId) {
+    try {
+      const url = `${this.cfg.apiBase}/api/v1/channels/${encodeURIComponent(
+        channelId
+      )}/members?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+      const res = await this.fetchImpl(url, {
+        headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+      });
+      if (!res.ok) return;
+      const rows = await res.json();
+      const members = /* @__PURE__ */ new Map();
+      for (const r of rows) {
+        members.set(r.identity_id, { name: r.display_name, is_agent: r.is_agent });
+      }
+      this.channelRoster.set(channelId, { members, at: Date.now() });
+      await this.resolveAndPinOwner(channelId, rows);
+    } catch {
+    }
+  }
+  /**
+   * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
+   * NEVER read the server's `role` field to pick the owner. In a DM the owner
+   * is the SINGLE non-self, non-agent counterpart; any other roster shape
+   * (zero or 2+ non-agent counterparts) is anomalous and REFUSES (no pin, no
+   * supersede eligibility). On the first clean sighting of an unambiguous
+   * owner with no existing pin, TOFU-pin its public key. On a later sighting
+   * where a pin already exists and the freshly-fetched key differs, this is an
+   * anomaly: surface it (log) and refuse — NEVER silently re-pin. Fail-soft:
+   * this must never throw into the roster refresh path.
+   */
+  async resolveAndPinOwner(channelId, rows) {
+    try {
+      const counterparts = rows.filter((r) => r.identity_id !== this.cfg.identityId && !r.is_agent);
+      if (counterparts.length !== 1) {
+        this.channelOwner.set(channelId, "anomalous");
+        return;
+      }
+      const owner = counterparts[0];
+      const publicKeyHex = owner.public_key ?? "";
+      if (!publicKeyHex) {
+        this.channelOwner.set(channelId, "anomalous");
+        return;
+      }
+      this.channelOwner.set(channelId, { identityId: owner.identity_id, publicKeyHex });
+      const existing = await this.store.loadPinnedIdentityKey(owner.identity_id);
+      if (!existing) {
+        await this.store.savePinnedIdentityKey(owner.identity_id, {
+          publicKeyHex,
+          keyAlgo: owner.key_algo ?? "ed25519"
+        });
+      } else if (existing.publicKeyHex !== publicKeyHex) {
+        console.warn(
+          `[bridge] pin mismatch for owner ${owner.identity_id} on channel ${channelId}: pinned != roster`
+        );
+        this.channelOwner.set(channelId, "anomalous");
+      }
+    } catch {
+    }
+  }
+  /**
+   * Task 8: the `onResolvePinnedOwner` hook handed to MlsGroupKeyProvider. The
+   * SDK's step-0 guard calls this before honoring an owner-authored supersede;
+   * returning null makes it fail closed. Returns a value ONLY when (a) the
+   * structural owner cache has an unambiguous entry for this channel AND (b) a
+   * persisted pin still exists and matches it — a bare in-memory cache hit is
+   * never trusted on its own, it is always reconfirmed against the store.
+   */
+  async resolvePinnedOwnerHook(channelId) {
+    const cached = this.channelOwner.get(channelId);
+    if (!cached || cached === "anomalous") return null;
+    const pin = await this.store.loadPinnedIdentityKey(cached.identityId);
+    if (!pin || pin.publicKeyHex !== cached.publicKeyHex) return null;
+    return { identityId: cached.identityId, publicKeyHex: pin.publicKeyHex };
+  }
+  async reportStatus(channelId, state, detail) {
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => buildOutboundEnvelope({
+        custody: this.custody,
+        groupKey: this.provider,
+        messageId: crypto.randomUUID(),
+        channelId,
+        enclaveId: this.cfg.enclaveId,
+        senderId: this.cfg.identityId,
+        senderType: "agent",
+        type: "system_event",
+        bodyPlaintext: JSON.stringify({
+          v: 1,
+          type: "agent_status",
+          state,
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          ...detail ? { detail } : {}
+        }),
+        bindingId: "",
+        bindingVersion: "0.0.0",
+        agentSkillId: null,
+        epoch,
+        traceparent: ZERO_TRACEPARENT,
+        references: [],
+        stage5Outcome: "allow",
+        stage5Evaluators: []
+      }),
+      (envelope) => this.transport.publish(envelope)
+    );
+  }
+  /** `runId` must exist and not have settled yet — settle() is terminal. */
+  requireActionRun(runId) {
+    const run = this.actionRuns.get(runId);
+    if (!run || run.settled) throw new UnknownActionRunError(runId);
+    return run;
+  }
+  /**
+   * Build + send one `agent_action` E2E body over `system_event` (mirrors
+   * sendA2A/reportStatus's envelope construction — same self-heal seam). Used
+   * for BOTH partial and settled frames; the caller decides whether a send is
+   * throttle-gated (partials, via flushActionPartial) or unconditional
+   * (settled, always exactly once).
+   */
+  async sendActionFrame(channelId, body) {
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => buildOutboundEnvelope({
+        custody: this.custody,
+        groupKey: this.provider,
+        messageId: crypto.randomUUID(),
+        channelId,
+        enclaveId: this.cfg.enclaveId,
+        senderId: this.cfg.identityId,
+        senderType: "agent",
+        type: "system_event",
+        bodyPlaintext: JSON.stringify(body),
+        bindingId: "",
+        bindingVersion: "0.0.0",
+        agentSkillId: null,
+        epoch,
+        traceparent: ZERO_TRACEPARENT,
+        references: [],
+        stage5Outcome: "allow",
+        stage5Evaluators: []
+      }),
+      (envelope) => this.transport.publish(envelope)
+    );
+  }
+  /**
+   * The coalescing throttle (review H4 / Global Constraint: ~1/sec per run).
+   * If the run has no dirty nodes, no-op. If the per-run bucket has no token,
+   * no-op too — the change stays in `dirty` and rides along with whatever the
+   * NEXT allowed send captures (a later start/update/finish call, or settle(),
+   * which always flushes regardless of the bucket). This is the coalescing:
+   * a burst of rapid calls collapses into however many sends the ~1/sec floor
+   * actually allows, each carrying every node changed since the last send.
+   */
+  async flushActionPartial(runId, run) {
+    if (run.dirty.size === 0) return;
+    if (!this.actionRateFloor.tryConsume(`action:${runId}`)) return;
+    if (!this.globalActionRateFloor.tryConsume("action:__global__")) return;
+    const nodes = [...run.dirty].map((id) => run.nodes.get(id)).filter((n) => n !== void 0);
+    run.dirty.clear();
+    await this.sendActionFrame(run.channelId, {
+      v: 1,
+      type: "agent_action",
+      agentActionVersion: "1",
+      phase: "partial",
+      runId,
+      nodes
+    });
+  }
+  /** Review M3: drop any unsettled run older than ACTION_RUN_STALE_MS
+   *  (relative to `now`). Lazy — invoked on every actionBegin() rather than
+   *  a background timer, mirroring the client store's orphan-TTL pattern. */
+  sweepStaleActionRuns(now) {
+    for (const [runId, run] of this.actionRuns) {
+      if (now - run.startedAt >= _BridgeAgent.ACTION_RUN_STALE_MS) this.actionRuns.delete(runId);
+    }
+  }
+  actionBegin(channelId) {
+    const now = this.actionClock();
+    this.sweepStaleActionRuns(now);
+    if (this.actionRuns.size >= _BridgeAgent.MAX_UNSETTLED_ACTION_RUNS) {
+      let oldestId;
+      let oldestAt = Infinity;
+      for (const [id, r] of this.actionRuns) {
+        if (r.startedAt < oldestAt) {
+          oldestAt = r.startedAt;
+          oldestId = id;
+        }
+      }
+      if (oldestId !== void 0) this.actionRuns.delete(oldestId);
+    }
+    const runId = crypto.randomUUID();
+    this.actionRuns.set(runId, {
+      channelId,
+      nodes: /* @__PURE__ */ new Map(),
+      dirty: /* @__PURE__ */ new Set(),
+      startedAt: now,
+      settled: false
+    });
+    return runId;
+  }
+  async actionStart(opts) {
+    const run = this.requireActionRun(opts.runId);
+    const nodeId = crypto.randomUUID();
+    const node = {
+      id: nodeId,
+      type: opts.type,
+      title: opts.title,
+      status: "running",
+      ts: Date.now(),
+      ...opts.parentId !== void 0 ? { parentId: opts.parentId } : {}
+    };
+    run.nodes.set(nodeId, node);
+    run.dirty.add(nodeId);
+    await this.flushActionPartial(opts.runId, run);
+    return nodeId;
+  }
+  async actionUpdate(runId, nodeId, patch) {
+    const run = this.requireActionRun(runId);
+    const existing = run.nodes.get(nodeId);
+    if (!existing) throw new UnknownActionRunError(`${runId}/${nodeId}`);
+    const updated = {
+      ...existing,
+      ...patch.status !== void 0 ? { status: patch.status } : {},
+      ...patch.detail !== void 0 ? { detail: patch.detail } : {},
+      ts: Date.now()
+    };
+    run.nodes.set(nodeId, updated);
+    run.dirty.add(nodeId);
+    await this.flushActionPartial(runId, run);
+  }
+  async actionFinish(runId, nodeId, patch) {
+    await this.actionUpdate(runId, nodeId, patch);
+  }
+  async actionSettle(runId, opts = {}) {
+    const run = this.requireActionRun(runId);
+    run.settled = true;
+    run.dirty.clear();
+    const nodes = [...run.nodes.values()];
+    await this.sendActionFrame(run.channelId, {
+      v: 1,
+      type: "agent_action",
+      agentActionVersion: "1",
+      phase: "settled",
+      runId,
+      startedAt: run.startedAt,
+      endedAt: Date.now(),
+      ...opts.resultMessageId !== void 0 ? { resultMessageId: opts.resultMessageId } : {},
+      nodes
+    });
+    this.actionRuns.delete(runId);
+  }
+  /**
+   * Auto-capture seam (Task 4 "auto-capture"): wraps a tool-call / sub-agent
+   * invocation so a bare agent gets a start→finish node pair without hand-
+   * rolling the begin/start/update/finish calls itself. Success → status
+   * "done"; a thrown error → status "error" with the message captured in
+   * `detail.error`, then the original error is rethrown (wrap never swallows).
+   */
+  async actionWrap(runId, fn, opts) {
+    const nodeId = await this.actionStart({
+      runId,
+      type: opts.type,
+      title: opts.title,
+      ...opts.parentId !== void 0 ? { parentId: opts.parentId } : {}
+    });
+    try {
+      const result = await fn();
+      await this.actionFinish(runId, nodeId, { status: "done" });
+      return result;
+    } catch (err) {
+      await this.actionFinish(runId, nodeId, {
+        status: "error",
+        detail: { error: err instanceof Error ? err.message : String(err) }
+      });
+      throw err;
+    }
+  }
+  startReceivePump() {
+    const sub = this.transport.subscribeDeliveryPings("");
+    this.pingHandle = { close: sub.close };
+    void (async () => {
+      try {
+        for await (const ping of sub.pings) {
+          this.pingsReceived++;
+          if (ping?.reconnected) {
+            process.stderr.write("[bridge] delivery-ping WS (re)connected \u2014 push inbound active\n");
+          }
+          await this.ingestOnce();
+        }
+      } catch {
+      }
+      if (!this.closingDown) {
+        process.stderr.write(
+          "[bridge] delivery-ping stream ENDED (terminal WS close, e.g. 4001) \u2014 inbound reduced to the 25s safety-floor drain until the daemon restarts\n"
+        );
+      }
+    })();
+    this.safetyTimer = setInterval(() => {
+      void this.ingestOnce();
+    }, 25e3);
+    if (this.selfHealSweepEnabled) {
+      this.selfHealTimer = setInterval(() => {
+        void this.selfHealSweep();
+      }, _BridgeAgent.SELF_HEAL_SWEEP_INTERVAL_MS);
+    }
+  }
+  async ingestOnce() {
+    const cycleStart = performance.now();
+    try {
+      const rows = await this.latency.time("recv.pull", () => this.backend.pullDelivery(this.cfg.deviceId));
+      const channelIds = /* @__PURE__ */ new Set();
+      for (const row of rows) {
+        if (row.connect_channel_id) channelIds.add(row.connect_channel_id);
+      }
+      for (const cid of channelIds) {
+        if (this.joinState.get(cid) !== "JOINED") {
+          await this.reconcileJoin(cid);
+        }
+      }
+      for (const cid of channelIds) {
+        if (this.freshRoster(cid) === void 0) {
+          await this.refreshChannelRoster(cid);
+        }
+      }
+      for (const row of rows) {
+        const cid = row.connect_channel_id;
+        const gid = row.group_id;
+        if (!cid || !gid) continue;
+        if (await this.provider.hasPersistedChannelState(cid)) continue;
+        const now = performance.now();
+        const last = this.lastWelcomeRequest.get(cid) ?? -Infinity;
+        if (now - last < _BridgeAgent.REQUEST_WELCOME_COOLDOWN_MS) continue;
+        this.lastWelcomeRequest.set(cid, now);
+        try {
+          await this.signalHeldKpWelcome(gid);
+        } catch {
+        }
+      }
+    } catch {
+    }
+    let entries;
+    try {
+      entries = await this.latency.time("recv.decrypt", () => this.provider.receiveOnce(this.cfg.deviceId));
+    } catch {
+      return;
+    }
+    for (const cid of entries.supersededChannelIds ?? []) {
+      this.joinState.set(cid, "JOINED");
+    }
+    if (!entries.length) return;
+    let metaRefreshed = false;
+    if (entries.some((m) => this.freshMeta(m.channelId) === void 0)) {
+      await this.refreshChannelMeta();
+      metaRefreshed = true;
+    }
+    const rosterRefreshed = /* @__PURE__ */ new Set();
+    for (const m of entries) {
+      if (rosterRefreshed.has(m.channelId)) continue;
+      rosterRefreshed.add(m.channelId);
+      if (this.freshRoster(m.channelId) === void 0) {
+        await this.refreshChannelRoster(m.channelId);
+      }
+    }
+    const acked = [];
+    for (const m of entries) {
+      try {
+        const parsed = JSON.parse(
+          new TextDecoder().decode(m.plaintext)
+        );
+        if (parsed.type && parsed.type !== "text") {
+          if (parsed.type === "artifact_share") {
+            try {
+              const senderName = this.freshRoster(m.channelId)?.get(m.envelope.sender_id)?.name;
+              const senderType = m.envelope.sender_type;
+              const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
+              const meta = await materializeAttachment(
+                parsed,
+                { attachmentsDir: this.attachmentsDirImpl, channelId: m.channelId, messageId: m.messageId },
+                {
+                  downloadBlob: this.downloadBlobImpl,
+                  decryptFile,
+                  computeFileDigest,
+                  base64ToBytes: base64ToBytes2,
+                  mkdirp: (d) => fsp.mkdir(d, { recursive: true }).then(() => void 0),
+                  writeFile: (p, data) => fsp.writeFile(p, data)
+                }
+              );
+              this.buffer.push({
+                channel_id: m.channelId,
+                message_id: m.messageId,
+                sender_id: m.envelope.sender_id,
+                text: typeof parsed.text === "string" ? parsed.text : "",
+                ts: m.receivedAt,
+                sender_name: senderName,
+                sender_is_agent: senderIsAgent,
+                attachments: [meta]
+              });
+              this.capBuffer();
+            } catch (e) {
+              this.failedAttachments++;
+              process.stderr.write(
+                `[bridge] attachment failed on ${m.messageId}: ${e.message}
+`
+              );
+            }
+          }
+          acked.push(m.queueId);
+          continue;
+        }
+        if (typeof parsed.text === "string") {
+          const meta = this.freshMeta(m.channelId);
+          const senderType = m.envelope.sender_type;
+          const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
+          let shouldBuffer = true;
+          if (meta && meta.is_dm === false) {
+            shouldBuffer = shouldProcessRoomMessage(
+              parsed.text,
+              this.cfg.agentName ?? this.cfg.identityId,
+              this.cfg.identityId,
+              { senderIsAgent, roomDisplayName: meta.name ?? void 0 }
+            );
+            if (!shouldBuffer) this.filteredRoomMessages++;
+          }
+          if (shouldBuffer) {
+            const senderName = this.freshRoster(m.channelId)?.get(
+              m.envelope.sender_id
+            )?.name;
+            this.buffer.push({
+              channel_id: m.channelId,
+              message_id: m.messageId,
+              sender_id: m.envelope.sender_id,
+              text: parsed.text,
+              ts: m.receivedAt,
+              sender_name: senderName,
+              sender_is_agent: senderIsAgent
+            });
+            this.capBuffer();
+          }
+        }
+        acked.push(m.queueId);
+      } catch {
+        acked.push(m.queueId);
+      }
+    }
+    if (acked.length) {
+      try {
+        await this.latency.time("recv.ack", () => this.provider.ackDelivery(this.cfg.deviceId, acked));
+      } catch {
+      }
+    }
+    this.latency.record("recv.cycle", performance.now() - cycleStart);
+    if (this.buffer.length) {
+      for (const l of this.listeners) l();
+      const w = this.waiters.splice(0);
+      for (const r of w) r();
+    }
+  }
+  async drain(channelId, waitSeconds) {
+    let got = this.takeBuffered(channelId);
+    if (got.length || waitSeconds <= 0) return got;
+    const cap = Math.min(waitSeconds, 50) * 1e3;
+    await new Promise((resolve) => {
+      let fired = false;
+      let timer;
+      const wake = () => {
+        if (fired) return;
+        fired = true;
+        clearTimeout(timer);
+        const i = this.waiters.indexOf(wake);
+        if (i >= 0) this.waiters.splice(i, 1);
+        resolve();
+      };
+      timer = setTimeout(wake, cap);
+      this.waiters.push(wake);
+    });
+    return this.takeBuffered(channelId);
+  }
+  /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
+  takeBuffered(channelId) {
+    if (channelId === void 0) return this.buffer.splice(0);
+    const keep = [];
+    const out = [];
+    for (const m of this.buffer) (m.channel_id === channelId ? out : keep).push(m);
+    this.buffer.length = 0;
+    this.buffer.push(...keep);
+    return out;
+  }
+  /**
+   * Put messages back at the front (SSE/disconnect write-failure recovery).
+   *
+   * The re-buffered messages are older un-acked deliveries, so they go at the
+   * FRONT (oldest). A large un-acked backlog re-buffered on reconnect is exactly
+   * the OOM case Phase 1 item 4 targets, so this path is capped too. capBuffer()
+   * sheds from the front, preserving the newest maxBuffer messages across the
+   * combined [requeued-older..., existing-newer...] buffer.
+   */
+  requeueFront(msgs) {
+    if (msgs.length) {
+      this.buffer.unshift(...msgs);
+      this.capBuffer();
+    }
+  }
+  /**
+   * Poke subscribers + waiters to drain the buffer now. Used after a
+   * disconnect re-buffers un-acked messages so a still-connected consumer
+   * (e.g. a replacement WS) redelivers them without waiting for new inbound.
+   * Mirrors the notify tail of ingestOnce.
+   */
+  wakeListeners() {
+    for (const l of this.listeners) l();
+    const w = this.waiters.splice(0);
+    for (const r of w) r();
+  }
+  health() {
+    let joined = 0;
+    for (const s of this.joinState.values()) if (s === "JOINED") joined++;
+    return {
+      status: "ok",
+      identity_id: this.cfg.identityId,
+      joined_channels: joined,
+      buffered: this.buffer.length,
+      dropped: this.droppedMessages,
+      filtered_room: this.filteredRoomMessages,
+      rate_limited: this.rateLimitedSends,
+      permanently_skipped: this.provider.permanentlySkippedCount(),
+      failed_attachments: this.failedAttachments,
+      delivery_pings: this.pingsReceived,
+      uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
+      version: BRIDGE_VERSION
+    };
+  }
+  /**
+   * Loopback observability snapshot served at GET /v1/metrics.
+   *
+   * `stages`: per-stage SecureComs-envelope latency percentiles (ms), measured
+   * locally and monotonically — send.encrypt / send.publish / send.total (the
+   * sender half) and recv.pull / recv.decrypt / recv.ack / recv.cycle (the
+   * recipient half). Excludes the agent's LLM time entirely.
+   *
+   * `errors` (ADR-0002): per-channel decrypt-error / stuck snapshot from the MLS
+   * provider, so a wedged channel is OBSERVABLE here instead of looking idle. A
+   * channel appears only once it has had a decrypt error; `stuck:true` means
+   * repeated failures with no intervening successful decrypt.
+   *
+   * `dropped` (Phase 1 item 4): cumulative count of inbound messages shed by the
+   * bounded-buffer cap. A daemon silently dropping messages under backpressure is
+   * exactly the blindness ADR-0002 eliminates, so the shed is surfaced here (and
+   * on health()) rather than swallowed.
+   *
+   * `filteredRoomMessages` (item 3 / ADR-0002 ethos): cumulative ROOM messages
+   * dropped by the @mention filter. A silently-filtered room message produces no
+   * other signal, so an agent correctly filtering 95% of room traffic would look
+   * identical to an idle/wedged one without this counter.
+   *
+   * `permanentlySkipped` (ADR-0002 ethos): cumulative count of inbound rows
+   * acked-and-dropped because they were provably past-epoch undecryptable
+   * (forward-secrecy secret gone), so a self-healed poison row is observable
+   * here instead of silently dropped.
+   */
+  metrics() {
+    return {
+      stages: this.latency.snapshot(),
+      errors: this.provider.errorStats(),
+      dropped: this.droppedMessages,
+      filteredRoomMessages: this.filteredRoomMessages,
+      rateLimitedSends: this.rateLimitedSends,
+      permanentlySkipped: this.provider.permanentlySkippedCount(),
+      welcomeRequestsSent: this.welcomeRequestsSent,
+      failedAttachments: this.failedAttachments
+    };
+  }
+  async close() {
+    this.closingDown = true;
+    this.pingHandle?.close();
+    if (this.safetyTimer) clearInterval(this.safetyTimer);
+    if (this.selfHealTimer) clearInterval(this.selfHealTimer);
+    this.store.close();
+  }
+};
+
+// src/config.ts
+import { readFileSync, statSync } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
+function loadConfig(opts) {
+  const raw = readFileSync(opts.credentialPath, "utf8");
+  try {
+    const mode = statSync(opts.credentialPath).mode & 511;
+    if (mode & 63) process.stderr.write(`[bridge] WARNING: credential file ${opts.credentialPath} permission ${mode.toString(8)} is not 0600 \u2014 tighten it (chmod 600).
+`);
+  } catch {
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new Error("credential file is not valid JSON");
+  }
+  for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new Error(`credential file missing required field: ${k}`);
+  const storePath = opts.storePath ?? join2(dirname2(opts.credentialPath), "bridge-state.db");
+  const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
+  const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
+  const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
+  return {
+    apiKey: json2.api_key,
+    identityId: json2.identity_id,
+    deviceId: json2.device_id,
+    signingPrivateKey: json2.signing_private_key,
+    enclaveId: json2.enclave_id,
+    apiBase: json2.api_base,
+    storePath,
+    agentName,
+    rateLimitCapacity,
+    rateLimitRefillPerMinute
+  };
+}
+function arg(argv, flag) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+function args(argv, flag) {
+  const out = [];
+  for (let i = 0; i < argv.length; i++) if (argv[i] === flag && argv[i + 1]) out.push(argv[i + 1]);
+  return out;
+}
+function parseDaemonArgs(argv, env) {
+  const tlsCert = arg(argv, "--tls-cert") ?? env.SECURECOMS_TLS_CERT;
+  const tlsKey = arg(argv, "--tls-key") ?? env.SECURECOMS_TLS_KEY;
+  return {
+    port: Number(arg(argv, "--port") ?? env.SECURECOMS_PORT ?? 7077),
+    bind: arg(argv, "--bind") ?? env.SECURECOMS_BIND ?? "127.0.0.1",
+    tokenFile: arg(argv, "--token-file") ?? env.SECURECOMS_TOKEN_FILE,
+    token: arg(argv, "--token") ?? env.SECURECOMS_LOCAL_TOKEN,
+    tls: Boolean(tlsCert && tlsKey),
+    tlsCert,
+    tlsKey,
+    allowOrigins: args(argv, "--allow-origin")
+  };
+}
+function isLoopback(host) {
+  return host === "localhost" || host === "::1" || host === "[::1]" || /^127\./.test(host);
+}
+function validateBind(bind, tls) {
+  if (!isLoopback(bind) && !tls) {
+    throw new Error(
+      `refusing non-loopback bind '${bind}' without TLS \u2014 supply --tls-cert and --tls-key for cross-host, or bind a loopback address`
+    );
+  }
+}
+
+// src/http-server.ts
+import { createServer as createHttp } from "node:http";
+import { createServer as createHttps } from "node:https";
+import { z } from "zod";
+
+// src/auth.ts
+import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+function resolveToken(opts) {
+  if (opts.token) return opts.token;
+  const f = opts.tokenFile;
+  if (f && existsSync(f)) return readFileSync2(f, "utf8").trim();
+  const tok = randomBytes3(32).toString("base64url");
+  if (f) writeFileSync(f, tok, { mode: 384 });
+  return tok;
+}
+function tokenMatches(provided, expected) {
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function bearerFrom(header) {
+  if (!header) return void 0;
+  const m = /^Bearer (.+)$/i.exec(header.trim());
+  return m ? m[1] : void 0;
+}
+function hostnameOf(hostHeader) {
+  if (!hostHeader) return void 0;
+  if (hostHeader.startsWith("[")) return hostHeader.slice(0, hostHeader.indexOf("]") + 1);
+  const i = hostHeader.lastIndexOf(":");
+  return i > 0 ? hostHeader.slice(0, i) : hostHeader;
+}
+function originHostAllowed(headers, allowOrigins) {
+  const host = hostnameOf(headers.host);
+  if (host && !isLoopback(host) && !isLoopback(`[${host}]`)) return false;
+  const origin = headers.origin;
+  if (!origin) return true;
+  if (allowOrigins.includes(origin)) return true;
+  try {
+    return isLoopback(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+}
+
+// src/errors.ts
+var BRIDGE_ERRORS = {
+  unauthorized: { http: 401, message: "missing or invalid bearer token" },
+  forbidden_origin: { http: 403, message: "origin or host not allowed" },
+  not_found: { http: 404, message: "no such route" },
+  invalid_request: { http: 400, message: "request failed validation" },
+  invalid_json: { http: 400, message: "request body is not valid JSON" },
+  body_too_large: { http: 400, message: "request body exceeds the size limit" },
+  channel_pending: { http: 503, message: "channel not yet admitted; retry shortly" },
+  rate_limited: { http: 429, message: "rate limit exceeded; retry shortly" },
+  unknown_action_run: { http: 404, message: "unknown or already-settled action run" },
+  internal: { http: 500, message: "internal error" }
+};
+function errorBody(code, detail) {
+  const body = { error: code, message: BRIDGE_ERRORS[code].message };
+  if (detail !== void 0) body.detail = detail;
+  return body;
+}
+function httpStatus(code) {
+  return BRIDGE_ERRORS[code].http;
+}
+function wsErrorFrame(code, detail) {
+  return { type: "error", ...errorBody(code, detail) };
+}
+
+// src/http-server.ts
+function writeSse(res, msgs) {
+  for (let i = 0; i < msgs.length; i++) {
+    if (res.destroyed || res.writableEnded) return msgs.slice(i);
+    try {
+      res.write(`event: message
+data: ${JSON.stringify(msgs[i])}
+
+`);
+    } catch {
+      return msgs.slice(i);
+    }
+  }
+  return [];
+}
+function capabilities(opts) {
+  return {
+    api_version: "1",
+    receive_modes: ["longpoll", "sse", ...opts.websocket ? ["websocket"] : []],
+    send_types: ["text", "agent_status", "a2a"],
+    webhook_push: false
+    // B3: A2A-style push-notification config (ciphertext/wake-only)
+  };
+}
+var SEND_CAP = 64 * 1024;
+var OTHER_CAP = 8 * 1024;
+var a2aSchema = z.object({
+  a2a_version: z.string().min(1),
+  kind: z.enum(["message", "task", "artifact"]),
+  object: z.record(z.unknown())
+});
+var sendAttachmentSchema = z.object({
+  channel_id: z.string().min(1),
+  path: z.string().min(1),
+  caption: z.string().optional()
+});
+var sendSchema = z.object({
+  channel_id: z.string().min(1),
+  text: z.string().optional(),
+  idempotency_key: z.string().optional(),
+  a2a: a2aSchema.optional()
+}).refine((d) => typeof d.text === "string" || d.a2a !== void 0, {
+  message: "send requires either text or a2a"
+});
+var statusSchema = z.object({
+  channel_id: z.string().min(1),
+  state: z.enum(["idle", "working", "stalled", "error"]),
+  detail: z.string().optional()
+});
+function json(res, status, body) {
+  const s = JSON.stringify(body);
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(s);
+}
+function jsonError(res, code, detail) {
+  json(res, httpStatus(code), errorBody(code, detail));
+}
+function readBody(req, cap) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    let done = false;
+    const chunks = [];
+    const onData = (c) => {
+      if (done) return;
+      size += c.length;
+      if (size > cap) {
+        done = true;
+        req.removeListener("data", onData);
+        req.pause();
+        reject(new Error("body_too_large"));
+        return;
+      }
+      chunks.push(c);
+    };
+    req.on("data", onData);
+    req.on("end", () => {
+      if (!done) {
+        done = true;
+        resolve(Buffer.concat(chunks).toString("utf8"));
+      }
+    });
+    req.on("error", (e) => {
+      if (!done) {
+        done = true;
+        reject(e);
+      }
+    });
+  });
+}
+function createHttpServer(agent, opts) {
+  let closeSse = () => {
+  };
+  let sse = null;
+  const tearDownSse = () => {
+    if (!sse) return;
+    sse.unsubscribe();
+    clearInterval(sse.keepalive);
+    try {
+      sse.res.end();
+    } catch {
+    }
+    sse = null;
+  };
+  closeSse = tearDownSse;
+  const handler = async (req, res) => {
+    try {
+      const url = new URL(req.url ?? "/", "http://localhost");
+      const path = url.pathname;
+      const method = req.method ?? "GET";
+      if (method === "GET" && path === "/healthz") {
+        return json(res, 200, { ...agent.health(), capabilities: capabilities(opts) });
+      }
+      if (!tokenMatches(bearerFrom(req.headers.authorization), opts.token)) {
+        return jsonError(res, "unauthorized");
+      }
+      if (!originHostAllowed({ origin: req.headers.origin, host: req.headers.host }, opts.allowOrigins)) {
+        return jsonError(res, "forbidden_origin");
+      }
+      if (method === "GET" && path === "/v1/channels") {
+        return json(res, 200, await agent.listChannels());
+      }
+      if (method === "GET" && path === "/v1/metrics") {
+        return json(res, 200, agent.metrics());
+      }
+      if (method === "POST" && path === "/v1/send") {
+        const parsed = sendSchema.safeParse(JSON.parse(await readBody(req, SEND_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        const r = parsed.data.a2a ? await agent.sendA2A(parsed.data.channel_id, parsed.data.a2a, parsed.data.idempotency_key) : await agent.send(parsed.data.channel_id, parsed.data.text, parsed.data.idempotency_key);
+        return json(res, 200, r);
+      }
+      if (method === "POST" && path === "/v1/send-attachment") {
+        const parsed = sendAttachmentSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        const r = await agent.sendAttachment(parsed.data.channel_id, parsed.data.path, parsed.data.caption);
+        return json(res, 200, r);
+      }
+      if (method === "POST" && path === "/v1/status") {
+        const parsed = statusSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        await agent.reportStatus(parsed.data.channel_id, parsed.data.state, parsed.data.detail);
+        return json(res, 200, { ok: true });
+      }
+      if (method === "GET" && path === "/v1/messages") {
+        const channel = url.searchParams.get("channel_id") ?? void 0;
+        const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
+        return json(res, 200, await agent.drain(channel, wait));
+      }
+      if (method === "GET" && path === "/v1/events") {
+        const channel = url.searchParams.get("channel_id") ?? void 0;
+        tearDownSse();
+        res.writeHead(200, {
+          "content-type": "text/event-stream",
+          "cache-control": "no-cache",
+          connection: "keep-alive"
+        });
+        res.write(":connected\n\n");
+        const drainToClient = () => {
+          const left = writeSse(res, agent.takeBuffered(channel));
+          if (left.length) agent.requeueFront(left);
+        };
+        const unsubscribe = agent.subscribe(drainToClient);
+        const keepalive = setInterval(() => {
+          try {
+            res.write(":keepalive\n\n");
+          } catch {
+          }
+        }, 15e3);
+        sse = { res, unsubscribe, keepalive };
+        drainToClient();
+        req.on("close", () => {
+          if (sse?.res === res) tearDownSse();
+        });
+        return;
+      }
+      return jsonError(res, "not_found");
+    } catch (e) {
+      if (e.message === "body_too_large") {
+        if (!res.headersSent) {
+          res.writeHead(httpStatus("body_too_large"), { "content-type": "application/json", connection: "close" });
+        }
+        res.end(JSON.stringify(errorBody("body_too_large")));
+        return;
+      }
+      if (e instanceof ChannelPendingError) return jsonError(res, "channel_pending");
+      if (e instanceof RateLimitedError) return jsonError(res, "rate_limited");
+      if (e instanceof InvalidPathError) return jsonError(res, "invalid_request", e.message);
+      if (e instanceof SyntaxError) return jsonError(res, "invalid_json");
+      process.stderr.write(`[bridge] request error: ${e?.message ?? e}
+`);
+      return jsonError(res, "internal");
+    }
+  };
+  const server = opts.tls ? createHttps({ cert: opts.tls.cert, key: opts.tls.key }, (req, res) => void handler(req, res)) : createHttp((req, res) => void handler(req, res));
+  return { server, closeAllSseStreams: () => closeSse() };
+}
+
+// src/ws-server.ts
+import { WebSocketServer, WebSocket } from "ws";
+var PING_INTERVAL_MS = 3e4;
+function tokenFromUpgrade(req) {
+  try {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const q = url.searchParams.get("token");
+    if (q) return q;
+  } catch {
+  }
+  return bearerFrom(req.headers.authorization);
+}
+function authedUpgrade(req, opts) {
+  if (!tokenMatches(tokenFromUpgrade(req), opts.token)) return false;
+  if (!originHostAllowed({ origin: req.headers.origin, host: req.headers.host }, opts.allowOrigins)) {
+    return false;
+  }
+  return true;
+}
+function attachAgentWebSocket(server, agent, opts) {
+  const wss = new WebSocketServer({ server, path: "/v1/ws" });
+  const keepalive = setInterval(() => {
+    for (const client of wss.clients) {
+      const sock = client;
+      if (sock.isAlive === false) {
+        sock.terminate();
+        continue;
+      }
+      sock.isAlive = false;
+      try {
+        sock.ping();
+      } catch {
+      }
+    }
+  }, PING_INTERVAL_MS);
+  if (typeof keepalive.unref === "function") keepalive.unref();
+  let current = null;
+  wss.on("connection", (sock, req) => {
+    if (!authedUpgrade(req, opts)) {
+      sock.close(1008, "unauthorized");
+      return;
+    }
+    if (current && current.sock !== sock) {
+      const prior = current;
+      if (prior.sock.readyState === WebSocket.OPEN) {
+        prior.sock.close(1e3, "replaced by newer connection");
+      }
+      prior.cleanup();
+    }
+    sock.isAlive = true;
+    sock.on("pong", () => {
+      sock.isAlive = true;
+    });
+    const inflight = /* @__PURE__ */ new Map();
+    const flush = () => {
+      if (sock.readyState !== WebSocket.OPEN) return;
+      const batch = agent.takeBuffered();
+      for (let i = 0; i < batch.length; i++) {
+        if (sock.readyState !== WebSocket.OPEN) {
+          agent.requeueFront(batch.slice(i));
+          return;
+        }
+        const frame = { type: "message", ...batch[i] };
+        try {
+          sock.send(JSON.stringify(frame));
+          inflight.set(batch[i].message_id, batch[i]);
+        } catch {
+          agent.requeueFront(batch.slice(i));
+          return;
+        }
+      }
+    };
+    const unsubscribe = agent.subscribe(flush);
+    let cleaned = false;
+    const cleanup = () => {
+      if (cleaned) return;
+      cleaned = true;
+      unsubscribe();
+      if (inflight.size) {
+        agent.requeueFront([...inflight.values()]);
+        inflight.clear();
+        agent.wakeListeners();
+      }
+      if (current?.sock === sock) current = null;
+    };
+    current = { sock, cleanup };
+    sock.on("close", cleanup);
+    sock.on("error", cleanup);
+    sock.on("message", (data) => {
+      void handleInbound(sock, agent, data, inflight);
+    });
+    flush();
+  });
+  return {
+    close() {
+      clearInterval(keepalive);
+      for (const client of wss.clients) {
+        try {
+          client.terminate();
+        } catch {
+        }
+      }
+      wss.close();
+    }
+  };
+}
+function sendJson(sock, body) {
+  if (sock.readyState !== WebSocket.OPEN) return;
+  try {
+    sock.send(JSON.stringify(body));
+  } catch {
+  }
+}
+async function handleInbound(sock, agent, data, inflight) {
+  let msg;
+  try {
+    msg = JSON.parse(data.toString("utf8"));
+  } catch {
+    sendJson(sock, wsErrorFrame("invalid_request"));
+    return;
+  }
+  if (typeof msg !== "object" || msg === null) {
+    sendJson(sock, wsErrorFrame("invalid_request"));
+    return;
+  }
+  const m = msg;
+  if (m.type === "ack") {
+    if (typeof m.message_id !== "string" || !m.message_id) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    inflight.delete(m.message_id);
+    return;
+  }
+  if (m.type === "send") {
+    if (typeof m.channel_id !== "string" || !m.channel_id) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    if (m.a2a && typeof m.a2a === "object") {
+      const a = m.a2a;
+      if (typeof a.a2a_version !== "string" || !a.a2a_version || a.kind !== "message" && a.kind !== "task" && a.kind !== "artifact" || typeof a.object !== "object" || a.object === null) {
+        sendJson(sock, wsErrorFrame("invalid_request"));
+        return;
+      }
+      try {
+        const r = await agent.sendA2A(m.channel_id, { a2a_version: a.a2a_version, kind: a.kind, object: a.object });
+        sendJson(sock, { type: "sent", message_id: r.message_id });
+      } catch (e) {
+        if (e instanceof ChannelPendingError) {
+          sendJson(sock, wsErrorFrame("channel_pending"));
+        } else if (e instanceof RateLimitedError) {
+          sendJson(sock, wsErrorFrame("rate_limited"));
+        } else {
+          sendJson(sock, wsErrorFrame("invalid_request"));
+        }
+      }
+      return;
+    }
+    if (typeof m.text !== "string" || !m.text) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    const idempotencyKey = typeof m.idempotency_key === "string" ? m.idempotency_key : void 0;
+    try {
+      const r = await agent.send(m.channel_id, m.text, idempotencyKey);
+      sendJson(sock, { type: "sent", message_id: r.message_id });
+    } catch (e) {
+      if (e instanceof ChannelPendingError) {
+        sendJson(sock, wsErrorFrame("channel_pending"));
+      } else if (e instanceof RateLimitedError) {
+        sendJson(sock, wsErrorFrame("rate_limited"));
+      } else {
+        sendJson(sock, wsErrorFrame("invalid_request"));
+      }
+    }
+    return;
+  }
+  if (m.type === "status") {
+    const states = ["idle", "working", "stalled", "error"];
+    if (typeof m.channel_id !== "string" || !m.channel_id || typeof m.state !== "string" || !states.includes(m.state)) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    const detail = typeof m.detail === "string" ? m.detail : void 0;
+    try {
+      await agent.reportStatus(m.channel_id, m.state, detail);
+      sendJson(sock, { type: "ok" });
+    } catch (e) {
+      if (e instanceof ChannelPendingError) {
+        sendJson(sock, wsErrorFrame("channel_pending"));
+      } else if (e instanceof RateLimitedError) {
+        sendJson(sock, wsErrorFrame("rate_limited"));
+      } else {
+        sendJson(sock, wsErrorFrame("invalid_request"));
+      }
+    }
+    return;
+  }
+  const NODE_TYPES = ["step", "tool_call", "sub_task", "result"];
+  const NODE_STATUSES = ["pending", "running", "done", "error"];
+  const actionError = (e) => {
+    sendJson(sock, wsErrorFrame(e instanceof UnknownActionRunError ? "unknown_action_run" : "invalid_request"));
+  };
+  if (m.type === "action_begin") {
+    if (typeof m.channel_id !== "string" || !m.channel_id) {
+      sendJson(sock, wsErrorFrame("invalid_request", "channel_id required"));
+      return;
+    }
+    try {
+      sendJson(sock, { type: "action_begun", run_id: agent.action.begin(m.channel_id) });
+    } catch (e) {
+      actionError(e);
+    }
+    return;
+  }
+  if (m.type === "action_start") {
+    if (typeof m.run_id !== "string" || !m.run_id || typeof m.title !== "string" || !m.title || !NODE_TYPES.includes(m.node_type)) {
+      sendJson(sock, wsErrorFrame("invalid_request", "run_id, node_type, title required"));
+      return;
+    }
+    try {
+      const nodeId = await agent.action.start({
+        runId: m.run_id,
+        type: m.node_type,
+        title: m.title,
+        parentId: typeof m.parent_id === "string" && m.parent_id ? m.parent_id : void 0
+      });
+      sendJson(sock, { type: "action_started", node_id: nodeId });
+    } catch (e) {
+      actionError(e);
+    }
+    return;
+  }
+  if (m.type === "action_update" || m.type === "action_finish") {
+    if (typeof m.run_id !== "string" || !m.run_id || typeof m.node_id !== "string" || !m.node_id) {
+      sendJson(sock, wsErrorFrame("invalid_request", "run_id and node_id required"));
+      return;
+    }
+    try {
+      if (m.type === "action_finish") {
+        if (m.status !== "done" && m.status !== "error") {
+          sendJson(sock, wsErrorFrame("invalid_request", "finish status must be done|error"));
+          return;
+        }
+        await agent.action.finish(m.run_id, m.node_id, { status: m.status, detail: m.detail });
+      } else {
+        if (m.status !== void 0 && !NODE_STATUSES.includes(m.status)) {
+          sendJson(sock, wsErrorFrame("invalid_request", "bad status"));
+          return;
+        }
+        await agent.action.update(m.run_id, m.node_id, { status: m.status, detail: m.detail });
+      }
+      sendJson(sock, { type: "ok" });
+    } catch (e) {
+      actionError(e);
+    }
+    return;
+  }
+  if (m.type === "action_settle") {
+    if (typeof m.run_id !== "string" || !m.run_id) {
+      sendJson(sock, wsErrorFrame("invalid_request", "run_id required"));
+      return;
+    }
+    try {
+      await agent.action.settle(m.run_id, { resultMessageId: typeof m.result_message_id === "string" && m.result_message_id ? m.result_message_id : void 0 });
+      sendJson(sock, { type: "action_settled", run_id: m.run_id });
+    } catch (e) {
+      actionError(e);
+    }
+    return;
+  }
+  sendJson(sock, wsErrorFrame("invalid_request"));
+}
+export {
+  BRIDGE_ERRORS,
+  BRIDGE_VERSION,
+  BridgeAgent,
+  ChannelPendingError,
+  RateLimitedError,
+  attachAgentWebSocket,
+  capabilities,
+  createHttpServer,
+  errorBody,
+  httpStatus,
+  isLoopback,
+  loadConfig,
+  originHostAllowed,
+  parseDaemonArgs,
+  resolveToken,
+  tokenMatches,
+  validateBind,
+  writeSse,
+  wsErrorFrame
+};