@securecoms/agent-bridge 0.1.0

package/dist/bin.js

@@ -0,0 +1,3963 @@
+#!/usr/bin/env node
+
+// src/config.ts
+import { readFileSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
+function loadConfig(opts) {
+  const raw = readFileSync(opts.credentialPath, "utf8");
+  try {
+    const mode = statSync(opts.credentialPath).mode & 511;
+    if (mode & 63) process.stderr.write(`[bridge] WARNING: credential file ${opts.credentialPath} permission ${mode.toString(8)} is not 0600 \u2014 tighten it (chmod 600).
+`);
+  } catch {
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new Error("credential file is not valid JSON");
+  }
+  for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new Error(`credential file missing required field: ${k}`);
+  const storePath = opts.storePath ?? join(dirname(opts.credentialPath), "bridge-state.db");
+  const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
+  const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
+  const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
+  return {
+    apiKey: json2.api_key,
+    identityId: json2.identity_id,
+    deviceId: json2.device_id,
+    signingPrivateKey: json2.signing_private_key,
+    enclaveId: json2.enclave_id,
+    apiBase: json2.api_base,
+    storePath,
+    agentName,
+    rateLimitCapacity,
+    rateLimitRefillPerMinute
+  };
+}
+function arg(argv, flag) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+function args(argv, flag) {
+  const out = [];
+  for (let i = 0; i < argv.length; i++) if (argv[i] === flag && argv[i + 1]) out.push(argv[i + 1]);
+  return out;
+}
+function parseDaemonArgs(argv, env) {
+  const tlsCert = arg(argv, "--tls-cert") ?? env.SECURECOMS_TLS_CERT;
+  const tlsKey = arg(argv, "--tls-key") ?? env.SECURECOMS_TLS_KEY;
+  return {
+    port: Number(arg(argv, "--port") ?? env.SECURECOMS_PORT ?? 7077),
+    bind: arg(argv, "--bind") ?? env.SECURECOMS_BIND ?? "127.0.0.1",
+    tokenFile: arg(argv, "--token-file") ?? env.SECURECOMS_TOKEN_FILE,
+    token: arg(argv, "--token") ?? env.SECURECOMS_LOCAL_TOKEN,
+    tls: Boolean(tlsCert && tlsKey),
+    tlsCert,
+    tlsKey,
+    allowOrigins: args(argv, "--allow-origin")
+  };
+}
+function isLoopback(host) {
+  return host === "localhost" || host === "::1" || host === "[::1]" || /^127\./.test(host);
+}
+function validateBind(bind, tls) {
+  if (!isLoopback(bind) && !tls) {
+    throw new Error(
+      `refusing non-loopback bind '${bind}' without TLS \u2014 supply --tls-cert and --tls-key for cross-host, or bind a loopback address`
+    );
+  }
+}
+
+// ../connect-core/dist/envelope/types.js
+var MESSAGE_TYPES = [
+  "text",
+  "decision_request",
+  "decision_response",
+  "status_alert",
+  "artifact_share",
+  "action_confirmation",
+  "heartbeat",
+  "system_event",
+  "a2a"
+];
+var AV_ENVELOPE_VERSION = "1.0";
+
+// ../connect-core/dist/envelope/validate.js
+import _Ajv2020 from "ajv/dist/2020.js";
+import _addFormats from "ajv-formats";
+
+// ../connect-core/dist/envelope/schemas.generated.js
+var envelopeSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentvault.dev/connect/schemas/envelope-1.0.json",
+  "title": "AgentVaultEnvelope",
+  "description": "Canonical client-signed Connect envelope (spec 02 \xA73.2, post-Blocker-1+5). Single source of truth shared by the TypeScript codec (ajv) and the Python edge (jsonschema).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "av_version",
+    "message_id",
+    "channel_id",
+    "enclave_id",
+    "message_type",
+    "sender_id",
+    "sender_type",
+    "identity_proof",
+    "trace_context",
+    "policy_binding",
+    "mls_group_epoch",
+    "replay_nonce",
+    "payload_encrypted",
+    "references"
+  ],
+  "properties": {
+    "av_version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+$",
+      "description": "Envelope wire version (major.minor). Compatibility is enforced in code, not by this pattern."
+    },
+    "message_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "channel_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "enclave_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "message_type": {
+      "type": "string",
+      "enum": [
+        "text",
+        "decision_request",
+        "decision_response",
+        "status_alert",
+        "artifact_share",
+        "action_confirmation",
+        "heartbeat",
+        "system_event",
+        "a2a"
+      ]
+    },
+    "sender_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "sender_type": {
+      "type": "string",
+      "enum": [
+        "human",
+        "agent",
+        "guest"
+      ]
+    },
+    "identity_proof": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signature",
+        "algo",
+        "attested",
+        "canonicalization"
+      ],
+      "properties": {
+        "signature": {
+          "$ref": "#/$defs/base64_nonempty"
+        },
+        "algo": {
+          "type": "string",
+          "enum": [
+            "ed25519",
+            "ecdsa_p384"
+          ]
+        },
+        "attested": {
+          "type": "boolean"
+        },
+        "canonicalization": {
+          "type": "string",
+          "const": "RFC8785"
+        }
+      }
+    },
+    "trace_context": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "traceparent"
+      ],
+      "properties": {
+        "traceparent": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$",
+          "description": "W3C TraceContext traceparent: version-traceid-spanid-flags."
+        },
+        "tracestate": {
+          "type": "string",
+          "maxLength": 512
+        }
+      }
+    },
+    "policy_binding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "binding_id",
+        "version",
+        "agent_skill_id",
+        "delegation_id",
+        "client_stage5_outcome",
+        "client_stage5_evaluators"
+      ],
+      "properties": {
+        "binding_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+          "description": "Policy binding semver."
+        },
+        "agent_skill_id": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "delegation_id": {
+          "oneOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "client_stage5_outcome": {
+          "type": "string",
+          "enum": [
+            "allow",
+            "flag"
+          ]
+        },
+        "client_stage5_evaluators": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 64
+        }
+      }
+    },
+    "mls_group_epoch": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Public DS-tracked epoch counter; the server rejects messages where this is below the channel's current epoch (mls.stale_epoch)."
+    },
+    "replay_nonce": {
+      "$ref": "#/$defs/base64_nonempty"
+    },
+    "payload_encrypted": {
+      "$ref": "#/$defs/base64"
+    },
+    "references": {
+      "type": "array",
+      "maxItems": 64,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "type",
+          "message_id"
+        ],
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "reply_to",
+              "recall",
+              "quote",
+              "reaction"
+            ]
+          },
+          "message_id": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      }
+    },
+    "mentions": {
+      "type": "array",
+      "maxItems": 256,
+      "items": {
+        "type": "string",
+        "format": "uuid"
+      },
+      "description": "Optional plaintext mention-target identity ids for notification routing (FR-MSG-010). The @name display text lives in the encrypted payload; only the target ids are exposed as metadata so the server can fire mention notifications without seeing plaintext."
+    }
+  },
+  "$defs": {
+    "base64": {
+      "type": "string",
+      "pattern": "^$|^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$",
+      "description": "Standard base64 (RFC 4648 \xA74) with mod-4 block structure enforced (rejects lone '=', '==', and malformed padding like 'A='). Empty string permitted because payload_encrypted is opaque at this codec layer. Security-critical fields use base64_nonempty."
+    },
+    "base64_nonempty": {
+      "type": "string",
+      "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$",
+      "description": "Standard base64 (RFC 4648 \xA74), non-empty + mod-4 block structure. Used for replay_nonce and identity_proof.signature, which must always be present on a received (wire) envelope \u2014 an empty nonce defeats replay protection and an empty signature is an unsigned envelope."
+    }
+  }
+};
+var payloadsSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentvault.dev/connect/schemas/payloads-1.0.json",
+  "title": "ConnectPayloads",
+  "description": "Plaintext payload schemas per message_type, validated client-side BEFORE encryption and AFTER decryption (the edge never sees plaintext). v1.0 BASELINE: each schema requires its core field(s); additionalProperties is permitted because exact payload shapes firm up in Phase 1D/1E client + SDK work. The envelope schema (envelope.schema.json) is the strict, spec-pinned contract; these payloads are the evolving inner shapes.",
+  "$defs": {
+    "text": {
+      "type": "object",
+      "required": [
+        "body"
+      ],
+      "properties": {
+        "body": {
+          "type": "string",
+          "maxLength": 1048576
+        },
+        "format": {
+          "type": "string",
+          "enum": [
+            "plain",
+            "markdown"
+          ]
+        },
+        "mentions": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uuid"
+          }
+        }
+      }
+    },
+    "decision_request": {
+      "type": "object",
+      "required": [
+        "decision_id",
+        "prompt",
+        "options"
+      ],
+      "properties": {
+        "decision_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "prompt": {
+          "type": "string"
+        },
+        "options": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 1
+        },
+        "deadline": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "decision_response": {
+      "type": "object",
+      "required": [
+        "decision_id",
+        "choice"
+      ],
+      "properties": {
+        "decision_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "choice": {
+          "type": "string"
+        }
+      }
+    },
+    "status_alert": {
+      "type": "object",
+      "required": [
+        "severity",
+        "message"
+      ],
+      "properties": {
+        "severity": {
+          "type": "string",
+          "enum": [
+            "info",
+            "warning",
+            "critical"
+          ]
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
+    "artifact_share": {
+      "type": "object",
+      "required": [
+        "artifact_type",
+        "file_id"
+      ],
+      "properties": {
+        "artifact_type": {
+          "type": "string"
+        },
+        "file_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "filename": {
+          "type": "string"
+        }
+      }
+    },
+    "action_confirmation": {
+      "type": "object",
+      "required": [
+        "action"
+      ],
+      "properties": {
+        "action": {
+          "type": "string"
+        },
+        "target_identity": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "outcome": {
+          "type": "string",
+          "enum": [
+            "approved",
+            "denied",
+            "pending"
+          ]
+        }
+      }
+    },
+    "heartbeat": {
+      "type": "object",
+      "properties": {
+        "client_time": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "system_event": {
+      "type": "object",
+      "required": [
+        "event"
+      ],
+      "properties": {
+        "event": {
+          "type": "string"
+        },
+        "detail": {
+          "type": "object"
+        }
+      }
+    },
+    "a2a": {
+      "type": "object",
+      "required": [
+        "a2a_version",
+        "kind",
+        "object"
+      ],
+      "properties": {
+        "a2a_version": {
+          "type": "string"
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "message",
+            "task",
+            "artifact"
+          ]
+        },
+        "object": {
+          "type": "object"
+        }
+      }
+    }
+  }
+};
+
+// ../connect-core/dist/envelope/validate.js
+var Ajv2020 = _Ajv2020.default ?? _Ajv2020;
+var addFormats = _addFormats.default ?? _addFormats;
+var ajv = new Ajv2020({ allErrors: true, strict: true });
+addFormats(ajv);
+var envelopeValidator = ajv.compile(envelopeSchema);
+var payloadDefs = payloadsSchema.$defs;
+var payloadValidators = /* @__PURE__ */ new Map();
+for (const t of MESSAGE_TYPES) {
+  const def = payloadDefs[t];
+  if (!def) {
+    throw new Error(`payloads.schema.json is missing a $defs schema for message_type "${t}"`);
+  }
+  payloadValidators.set(t, ajv.compile(def));
+}
+
+// ../connect-core/dist/envelope/sign.js
+import { canonicalize } from "@agentvault/crypto/canonical";
+import { ed25519 } from "@noble/curves/ed25519";
+import { p384 } from "@noble/curves/p384";
+
+// ../connect-core/dist/base64.js
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var LOOKUP = (() => {
+  const t = new Int16Array(256).fill(-1);
+  for (let i = 0; i < ALPHABET.length; i++)
+    t[ALPHABET.charCodeAt(i)] = i;
+  return t;
+})();
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    out += ALPHABET[b0 >> 2];
+    out += ALPHABET[(b0 & 3) << 4 | b1 >> 4];
+    out += i + 1 < bytes.length ? ALPHABET[(b1 & 15) << 2 | b2 >> 6] : "=";
+    out += i + 2 < bytes.length ? ALPHABET[b2 & 63] : "=";
+  }
+  return out;
+}
+function base64ToBytes(s) {
+  const clean = s.replace(/=+$/, "");
+  const len = clean.length;
+  const outLen = Math.floor(len * 6 / 8);
+  const out = new Uint8Array(outLen);
+  let bits = 0;
+  let acc = 0;
+  let o = 0;
+  for (let i = 0; i < len; i++) {
+    const v = LOOKUP[clean.charCodeAt(i)];
+    if (v < 0)
+      throw new Error("base64ToBytes: invalid character");
+    acc = acc << 6 | v;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = acc >> bits & 255;
+    }
+  }
+  return out;
+}
+
+// ../connect-core/dist/envelope/sign.js
+async function canonicalEnvelopeBytes(envelope) {
+  const { signature: _signature, ...proofWithoutSignature } = envelope.identity_proof;
+  const toSign = { ...envelope, identity_proof: proofWithoutSignature };
+  return canonicalize(toSign);
+}
+
+// ../connect-core/dist/envelope/aead.js
+import { gcm } from "@noble/ciphers/aes";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha";
+import { randomBytes } from "@noble/hashes/utils";
+import { canonicalize as canonicalize2 } from "@agentvault/crypto/canonical";
+var APPLICATION_KEY_BYTES = 32;
+var REPLAY_NONCE_BYTES = 24;
+var NONCE_BYTES = {
+  xchacha20poly1305: 24,
+  aes256gcm: 12
+};
+function concatBytes(...parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+function epochToBytes(epoch) {
+  const b = new Uint8Array(8);
+  new DataView(b.buffer).setBigUint64(0, BigInt(epoch), false);
+  return b;
+}
+function buildExporterContext(enclaveId, channelId, epoch) {
+  const enc = new TextEncoder();
+  return concatBytes(enc.encode(enclaveId), enc.encode(channelId), epochToBytes(epoch));
+}
+function cipherFor(suite, key, nonce, aad) {
+  return suite === "aes256gcm" ? gcm(key, nonce, aad) : xchacha20poly1305(key, nonce, aad);
+}
+function assertKey(key) {
+  if (key.length !== APPLICATION_KEY_BYTES) {
+    throw new Error(`application key must be ${APPLICATION_KEY_BYTES} bytes (the MLS exporter output); got ${key.length}`);
+  }
+}
+function sealPayload(p) {
+  assertKey(p.key);
+  const nonce = p.nonce ?? randomBytes(NONCE_BYTES[p.suite]);
+  const ciphertext = cipherFor(p.suite, p.key, nonce, p.associatedData).encrypt(p.plaintext);
+  return concatBytes(nonce, ciphertext);
+}
+function openPayload(p) {
+  assertKey(p.key);
+  const nlen = NONCE_BYTES[p.suite];
+  if (p.ciphertext.length < nlen) {
+    throw new Error("openPayload: ciphertext shorter than the AEAD nonce");
+  }
+  const nonce = p.ciphertext.subarray(0, nlen);
+  const body = p.ciphertext.subarray(nlen);
+  return cipherFor(p.suite, p.key, nonce, p.associatedData).decrypt(body);
+}
+async function buildAssociatedData(fields) {
+  return canonicalize2({
+    message_id: fields.message_id,
+    channel_id: fields.channel_id,
+    sender_id: fields.sender_id,
+    mls_group_epoch: fields.mls_group_epoch,
+    replay_nonce: fields.replay_nonce,
+    policy_binding: fields.policy_binding
+  });
+}
+function generateReplayNonce() {
+  return bytesToBase64(randomBytes(REPLAY_NONCE_BYTES));
+}
+
+// ../connect-core/dist/sdk-dto/validate.js
+import _Ajv20202 from "ajv/dist/2020.js";
+import _addFormats2 from "ajv-formats";
+
+// ../connect-core/dist/sdk-dto/schemas.generated.js
+var modelDescriptorSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentvault.connect.sdk.model_descriptor",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "provider",
+    "name"
+  ],
+  "properties": {
+    "provider": {
+      "type": "string",
+      "minLength": 1
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "version": {
+      "type": "string"
+    }
+  }
+};
+var registerSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentvault.connect.sdk.register_request",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "skill_id",
+    "public_key",
+    "algo",
+    "model"
+  ],
+  "properties": {
+    "skill_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "public_key": {
+      "type": "string",
+      "minLength": 1
+    },
+    "algo": {
+      "type": "string",
+      "enum": [
+        "ed25519",
+        "ecdsa_p384"
+      ]
+    },
+    "attested": {
+      "type": "boolean"
+    },
+    "model": {
+      "$ref": "agentvault.connect.sdk.model_descriptor"
+    }
+  }
+};
+var auditQuerySchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentvault.connect.sdk.audit_query",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "agent_id"
+  ],
+  "properties": {
+    "agent_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "from": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "to": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "channel_id": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "message_type": {
+      "type": "string"
+    }
+  }
+};
+
+// ../connect-core/dist/sdk-dto/validate.js
+var Ajv20202 = _Ajv20202.default ?? _Ajv20202;
+var addFormats2 = _addFormats2.default ?? _addFormats2;
+var ajv2 = new Ajv20202({ allErrors: true, strict: true });
+addFormats2(ajv2);
+ajv2.addSchema(modelDescriptorSchema, "agentvault.connect.sdk.model_descriptor");
+var modelValidator = ajv2.getSchema("agentvault.connect.sdk.model_descriptor");
+var registerValidator = ajv2.compile(registerSchema);
+var auditQueryValidator = ajv2.compile(auditQuerySchema);
+
+// ../connect-clients-core/dist/stage5/evaluators.js
+var ALLOW = { outcome: "allow" };
+var PHI_PATTERNS = [/\b\d{3}-\d{2}-\d{4}\b/, /\bMRN[:#]?\s*\d{6,}\b/i];
+var IP_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bconfidential\b/i
+];
+var RELEASABILITY_PATTERNS = [/\bNOFORN\b/, /\bdo not (?:forward|share)\b/i];
+function patternEvaluator(id, patterns, reason) {
+  return {
+    id,
+    async evaluate(plaintext) {
+      return patterns.some((p) => p.test(plaintext)) ? { outcome: "flag", reason } : ALLOW;
+    }
+  };
+}
+var phiEvaluator = patternEvaluator("phi", PHI_PATTERNS, "phi.detected");
+var ipEvaluator = patternEvaluator("ip", IP_PATTERNS, "ip.detected");
+var releasabilityEvaluator = patternEvaluator("releasability", RELEASABILITY_PATTERNS, "releasability.hint");
+
+// ../connect-sdk-ts/dist/custody/software.js
+import { ed25519 as ed255192 } from "@noble/curves/ed25519";
+import { p384 as p3842 } from "@noble/curves/p384";
+var SoftwareKeyCustody = class _SoftwareKeyCustody {
+  algo;
+  priv;
+  pub;
+  attested = false;
+  constructor(algo, priv, pub, quiet = false) {
+    this.algo = algo;
+    this.priv = priv;
+    this.pub = pub;
+    if (!quiet) {
+      console.warn("[AgentVault] using a software key (dev/CI only) -- envelopes are not attested. Use kms-hosted or byok custody in production.");
+    }
+  }
+  static generate(algo) {
+    if (algo === "ed25519") {
+      const priv2 = ed255192.utils.randomPrivateKey();
+      return new _SoftwareKeyCustody(algo, priv2, ed255192.getPublicKey(priv2));
+    }
+    const priv = p3842.utils.randomPrivateKey();
+    return new _SoftwareKeyCustody(algo, priv, p3842.getPublicKey(priv));
+  }
+  /** Construct from an existing private key (e.g. a CI fixture).
+   * `quiet` suppresses the dev banner for browser flows (start-fresh) where
+   * the software key IS the production custody and the warning is noise. */
+  static fromPrivateKey(algo, priv, opts) {
+    const pub = algo === "ed25519" ? ed255192.getPublicKey(priv) : p3842.getPublicKey(priv);
+    return new _SoftwareKeyCustody(algo, priv, pub, opts?.quiet === true);
+  }
+  async sign(canonicalBytes) {
+    if (this.algo === "ed25519")
+      return ed255192.sign(canonicalBytes, this.priv);
+    return p3842.sign(canonicalBytes, this.priv, { prehash: true }).toCompactRawBytes();
+  }
+  publicKey() {
+    return this.pub;
+  }
+};
+
+// ../connect-sdk-ts/dist/errors.js
+var ConnectSdkError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var RegistrationError = class extends ConnectSdkError {
+};
+var RateLimitError = class extends ConnectSdkError {
+  retryAfterSec;
+  constructor(message, retryAfterSec) {
+    super(message);
+    this.retryAfterSec = retryAfterSec;
+  }
+};
+var AuditAccessDenied = class extends ConnectSdkError {
+};
+var StaleEpochError = class extends ConnectSdkError {
+  clientEpoch;
+  serverEpoch;
+  constructor(clientEpoch, serverEpoch) {
+    super(`mls.stale_epoch: client_epoch=${clientEpoch} server_epoch=${serverEpoch}`);
+    this.clientEpoch = clientEpoch;
+    this.serverEpoch = serverEpoch;
+  }
+};
+async function staleEpochErrorFromResponse(res) {
+  if (res.status !== 400)
+    return null;
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return null;
+  }
+  const detail = body?.detail;
+  const d = detail;
+  if (!d || d.error !== "mls.stale_epoch")
+    return null;
+  return new StaleEpochError(Number(d.client_epoch ?? 0), Number(d.server_epoch ?? 0));
+}
+
+// ../connect-sdk-ts/dist/envelope-builder.js
+async function buildOutboundEnvelope(p) {
+  const suite = p.suite ?? p.groupKey.suite;
+  const key = await p.groupKey.exporterKey(p.enclaveId, p.channelId, p.epoch);
+  const replayNonce = p.replayNonce ?? generateReplayNonce();
+  const policyBinding = {
+    binding_id: p.bindingId,
+    version: p.bindingVersion,
+    agent_skill_id: p.agentSkillId,
+    delegation_id: null,
+    client_stage5_outcome: p.stage5Outcome,
+    client_stage5_evaluators: p.stage5Evaluators
+  };
+  const aad = await buildAssociatedData({
+    message_id: p.messageId,
+    channel_id: p.channelId,
+    sender_id: p.senderId,
+    mls_group_epoch: p.epoch,
+    replay_nonce: replayNonce,
+    policy_binding: policyBinding
+  });
+  const sealed = sealPayload({
+    plaintext: new TextEncoder().encode(p.bodyPlaintext),
+    key,
+    associatedData: aad,
+    suite,
+    nonce: p.aeadNonce
+  });
+  const envelope = {
+    av_version: AV_ENVELOPE_VERSION,
+    message_id: p.messageId,
+    channel_id: p.channelId,
+    enclave_id: p.enclaveId,
+    message_type: p.type,
+    sender_id: p.senderId,
+    sender_type: p.senderType,
+    identity_proof: {
+      signature: "",
+      algo: p.custody.algo,
+      attested: p.custody.attested,
+      canonicalization: "RFC8785"
+    },
+    trace_context: { traceparent: p.traceparent },
+    policy_binding: policyBinding,
+    mls_group_epoch: p.epoch,
+    replay_nonce: replayNonce,
+    payload_encrypted: bytesToBase64(sealed),
+    references: p.references
+  };
+  if (p.mentions && p.mentions.length > 0)
+    envelope.mentions = p.mentions;
+  const canonical = await canonicalEnvelopeBytes(envelope);
+  envelope.identity_proof.signature = bytesToBase64(await p.custody.sign(canonical));
+  return envelope;
+}
+
+// ../connect-sdk-ts/dist/groupkey/send-self-heal.js
+async function sendWithSelfHeal(session, channelId, build, publish) {
+  await session.reconcileForSend(channelId);
+  const epoch = await session.currentEpoch(channelId);
+  const envelope = await build(epoch);
+  try {
+    return await publish(envelope);
+  } catch (err) {
+    if (!(err instanceof StaleEpochError))
+      throw err;
+    await session.reconcileForSend(channelId);
+    const retryEpoch = await session.currentEpoch(channelId);
+    const retryEnvelope = await build(retryEpoch);
+    return await publish(retryEnvelope);
+  }
+}
+
+// ../connect-sdk-ts/dist/groupkey/stub.js
+import { sha256 } from "@noble/hashes/sha2";
+
+// ../connect-sdk-ts/dist/spans/names.js
+var SPAN = {
+  MESSAGE_SENT: "agentvault.connect.message.sent",
+  MESSAGE_QUEUED_OFFLINE: "agentvault.connect.message.queued_offline",
+  POLICY_RESCAN: "agentvault.connect.policy.rescan",
+  POLICY_EVAL_DELAYED_FLAG: "agentvault.connect.policy.eval.delayed_flag",
+  AUDIT_QUERY: "agentvault.connect.audit.query",
+  AGENT_REGISTERED: "agentvault.connect.agent.registered",
+  AGENT_JOINED: "agentvault.connect.agent.joined",
+  AGENT_CAPABILITIES_DECLARED: "agentvault.connect.agent.capabilities_declared",
+  AGENT_CAPABILITY_INVOKED: "agentvault.connect.agent.capability_invoked",
+  AGENT_TOOL_CALLED: "agentvault.connect.agent.tool_called",
+  ACTION_CONFIRMATION_REQUESTED: "agentvault.connect.action_confirmation.requested",
+  ACTION_CONFIRMATION_RECEIVED: "agentvault.connect.action_confirmation.received",
+  MODEL_DESCRIPTOR_CHANGED: "agentvault.connect.model.descriptor_changed",
+  AGENT_STATUS_REPORTED: "agentvault.connect.agent.status_reported"
+};
+var ALWAYS_SAMPLE = /* @__PURE__ */ new Set([
+  SPAN.AGENT_REGISTERED,
+  SPAN.ACTION_CONFIRMATION_REQUESTED,
+  SPAN.ACTION_CONFIRMATION_RECEIVED
+]);
+
+// ../connect-sdk-ts/dist/spans/emitter.js
+var KNOWN = new Set(Object.values(SPAN));
+
+// ../connect-sdk-ts/dist/groupkey/mls.js
+import { MLSGroupManager, bytesToHex, hexToBytes } from "@agentvault/crypto";
+
+// ../connect-sdk-ts/dist/groupkey/operation-queue.js
+var MlsOperationQueue = class {
+  chains = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  async run(channelId, op) {
+    const prev = this.chains.get(channelId) ?? Promise.resolve();
+    const next = prev.then(op, op);
+    this.chains.set(channelId, next);
+    this.inFlight.set(channelId, (this.inFlight.get(channelId) ?? 0) + 1);
+    try {
+      return await next;
+    } finally {
+      const remaining = (this.inFlight.get(channelId) ?? 1) - 1;
+      if (remaining === 0) {
+        this.inFlight.delete(channelId);
+        if (this.chains.get(channelId) === next) {
+          this.chains.delete(channelId);
+        }
+      } else {
+        this.inFlight.set(channelId, remaining);
+      }
+    }
+  }
+  /** Test / diagnostic only. Number of in-flight + pending ops for a channel. */
+  chainSize(channelId) {
+    return this.inFlight.get(channelId) ?? 0;
+  }
+};
+
+// ../connect-sdk-ts/dist/groupkey/mls.js
+var LABEL = "agentvault-connect-v1";
+var DEFAULT_STUCK_THRESHOLD = 2;
+var BootstrapRaceLostError = class extends Error {
+  constructor() {
+    super("bootstrap race lost: another device created the group; join instead");
+    this.name = "BootstrapRaceLostError";
+  }
+};
+var LeafRosterMismatchError = class extends Error {
+  constructor() {
+    super("removeDeviceFromLiveGroup: leaf/roster length mismatch (stale roster \u2014 re-fetch and retry)");
+    this.name = "LeafRosterMismatchError";
+  }
+};
+var HealAddAfterRemoveError = class extends Error {
+  constructor(cause) {
+    super("healDivergedMember: Add failed after Remove already landed \u2014 member detached, re-run heal to recover");
+    this.name = "HealAddAfterRemoveError";
+    this.cause = cause;
+  }
+};
+var MlsGroupKeyProvider = class {
+  o;
+  suite;
+  managers = /* @__PURE__ */ new Map();
+  /**
+   * Per-CHANNEL Promise-chain mutex (gen2's MlsOperationQueue, ported). Every
+   * manager-mutating operation on a channel takes this lock keyed by channelId,
+   * so at most one runs per channel at a time; different channels still run in
+   * parallel. This is the fix for the manager-mutation interleave Sigil's review
+   * of the self-heal-on-send fix surfaced: the device-wide receive pump, the
+   * committer ops, and reconcileForSend could all mutate one channel's cached
+   * MLSGroupManager concurrently.
+   *
+   * Granularity (load-bearing): receiveOnce is DEVICE-wide — it pulls one queue
+   * and routes commit/application rows to MANY channels' managers. It therefore
+   * takes the lock PER ROW, keyed by that row's channel, rather than one
+   * provider-wide lock — so a commit on channel A never serializes against a
+   * decrypt on channel B. The committer ops take the lock for their WHOLE
+   * resolve→commit→distribute→persist window. Because the lock is not reentrant,
+   * the committers' own conflict-recovery drain runs the UNLOCKED core
+   * (receiveOnceUnlocked, scoped to the committer's own channel — it already
+   * holds that channel's lock).
+   */
+  locks = new MlsOperationQueue();
+  /**
+   * Per-channel decrypt-error / stuck tracker (ADR-0002). Bounded by the number
+   * of channels this device touches (channels are bounded; an entry is created
+   * only on a real decrypt error), so it cannot grow without limit. Read via
+   * {@link errorStats}; mutated only through {@link recordDecryptError} /
+   * {@link recordDecryptSuccess}.
+   */
+  errors = /* @__PURE__ */ new Map();
+  stuckThreshold;
+  /** Cumulative count of past-epoch application rows permanently skipped (acked
+   *  and drained) because forward-secrecy has deleted their epoch's secrets. Read
+   *  via {@link permanentlySkippedCount}. */
+  permanentlySkipped = 0;
+  constructor(o) {
+    this.o = o;
+    this.suite = o.suite ?? "xchacha20poly1305";
+    this.stuckThreshold = Math.max(1, o.stuckThreshold ?? DEFAULT_STUCK_THRESHOLD);
+  }
+  get deviceId() {
+    return this.o.deviceId;
+  }
+  /**
+   * Count a decrypt/parse failure against a channel and fire the optional
+   * onDecryptError hook. Increments BOTH the cumulative total and the
+   * consecutive-since-last-success counter (the latter drives `stuck`). A row
+   * with no channel mapping is still surfaced via the hook but not counted
+   * against any channel (we cannot attribute it). Always called from inside the
+   * row's catch — never changes decrypt/convergence behavior.
+   */
+  recordDecryptError(row, error) {
+    this.o.onDecryptError?.(row, error);
+    const cid = row.connect_channel_id;
+    if (!cid)
+      return;
+    const e = this.errors.get(cid) ?? { decryptErrors: 0, consecutiveErrors: 0, lastErrorAt: null };
+    e.decryptErrors += 1;
+    e.consecutiveErrors += 1;
+    e.lastErrorAt = Date.now();
+    this.errors.set(cid, e);
+  }
+  /**
+   * A commit/application row for the channel decrypted cleanly: the channel is
+   * advancing, so clear the consecutive-error run (un-sticks it). Leaves the
+   * cumulative `decryptErrors` total intact for diagnostics. No-op for a channel
+   * that never errored.
+   */
+  recordDecryptSuccess(channelId) {
+    const e = this.errors.get(channelId);
+    if (e && e.consecutiveErrors !== 0)
+      e.consecutiveErrors = 0;
+  }
+  /**
+   * Snapshot of per-channel decrypt-error / stuck state (ADR-0002 observability).
+   * Surfaces a wedged channel that would otherwise "look idle": the daemon serves
+   * it on GET /v1/metrics and the web shell reads it via a selector. A channel is
+   * `stuck` once it has had `stuckThreshold` consecutive decrypt failures with no
+   * intervening successful decrypt. Returns a plain object keyed by channelId;
+   * absence of a key means zero errors observed for that channel.
+   */
+  errorStats() {
+    const out = {};
+    for (const [cid, e] of this.errors) {
+      out[cid] = {
+        decryptErrors: e.decryptErrors,
+        consecutiveErrors: e.consecutiveErrors,
+        lastErrorAt: e.lastErrorAt,
+        stuck: e.consecutiveErrors >= this.stuckThreshold
+      };
+    }
+    return out;
+  }
+  /** Total past-epoch rows permanently skipped (acked without decrypting) since
+   *  this provider was instantiated. A permanently-undecryptable row is one whose
+   *  `row.epoch` is strictly less than the channel's live epoch: forward-secrecy
+   *  has deleted its epoch secrets so it can never decrypt on any retry. */
+  permanentlySkippedCount() {
+    return this.permanentlySkipped;
+  }
+  /** Evict the live in-memory MLS group manager for a channel. Used when the
+   *  device leaves or deletes a channel: dropping the persisted store record is
+   *  not enough on its own, because a warm manager keeps decrypting until the
+   *  page reloads. The persisted store record is removed separately by the
+   *  caller; this clears the matching in-memory cache. `managers` is the only
+   *  per-channel in-memory cache the provider holds. */
+  evictChannelState(channelId) {
+    this.managers.delete(channelId);
+  }
+  /**
+   * Warm a channel's group manager so a commit can run even when the room isn't
+   * currently open. Used by the guest reconcile sweep (and slice-3 bell-approve):
+   * the sweep may fire for a channel the host hasn't opened this session, so the
+   * in-memory manager is cold even though the store holds usable state.
+   *
+   * If the store has persisted state, load it into the warm in-memory cache (via
+   * the private manager() loader). Otherwise fall through to the join path
+   * (ensureSession bootstrap:false), which consumes a queued Welcome. Idempotent:
+   * a second call on an already-warm channel is a cheap no-op (manager() returns
+   * the cached manager and ensureSession early-returns on existing store state).
+   */
+  async ensureWarm(channelId, enclaveId) {
+    if (await this.o.store.load(channelId)) {
+      await this.locks.run(channelId, async () => {
+        await this.manager(channelId);
+      });
+      return;
+    }
+    await this.ensureSession(channelId, { enclaveId, bootstrap: false });
+  }
+  /**
+   * Admit a guest's (possibly new) device into a live group, evicting any prior
+   * device leaf for that SAME guest identity so a returning guest holds exactly
+   * ONE active leaf. Used by the guest reconcile sweep when an approved guest
+   * sits in `joining`.
+   *
+   * Add then evict: we commit the Add first so the new leaf exists before the
+   * old one is dropped (the guest is never momentarily leaf-less in the group).
+   * The eviction uses the per-DEVICE removal path (removeDeviceFromLiveGroup),
+   * which resolves the target leaf POSITIONALLY by add-order. At the moment of
+   * eviction the identity owns TWO leaves (prior + new), so the ordered-device
+   * list MUST name both in add-order — the prior device was added first, the new
+   * one just now — or the SDK's leaf/roster guard throws LeafRosterMismatchError.
+   * Callers that hold the real channel roster may override `orderedDeviceIds`;
+   * the default `[priorDeviceId, newDeviceId]` is the natural add-order for the
+   * common single-prior-device return.
+   *
+   * No-op eviction when there is no priorDeviceId (first-time guest) or when it
+   * equals newDeviceId (the same device re-admitted).
+   */
+  async admitGuestDevice(channelId, g) {
+    await this.addMemberToLiveGroup(channelId, g.newDeviceId);
+    if (g.priorDeviceId && g.priorDeviceId !== g.newDeviceId) {
+      const orderedDeviceIds = g.orderedDeviceIds ?? [g.priorDeviceId, g.newDeviceId];
+      await this.removeDeviceFromLiveGroup(channelId, g.priorDeviceId, {
+        identity: g.identityId,
+        orderedDeviceIds
+      });
+    }
+  }
+  /** Load (or reuse) the per-channel manager from the store. Throws if no state. */
+  async manager(channelId) {
+    const cached = this.managers.get(channelId);
+    if (cached)
+      return cached;
+    const saved = await this.o.store.load(channelId);
+    if (!saved)
+      throw new Error(`MlsGroupKeyProvider: no MLS state for channel ${channelId} (call ensureSession first)`);
+    const mgr = new MLSGroupManager(saved.ciphersuite);
+    mgr.importState(saved);
+    this.managers.set(channelId, mgr);
+    return mgr;
+  }
+  async currentEpoch(channelId) {
+    return Number((await this.manager(channelId)).epoch);
+  }
+  /**
+   * Run a committer op and, on ANY throw that escapes it, evict the channel's
+   * cached MLSGroupManager.
+   *
+   * The committer ops mutate the CACHED manager (mgr.addMembers / removeMembers
+   * advance it) and persist the advanced state only AFTER a successful
+   * distribute. The distribute-catch already evicts on a 409. But if the
+   * mutation itself throws — or the B11 epoch-drift guard throws after the
+   * mutation advanced the manager — the cached manager is left partially/fully
+   * mutated and never persisted. The per-channel queue would then run the next
+   * serialized op against that SAME poisoned cache entry (manager() returns the
+   * cache before touching the store). Dropping the cache entry forces the next
+   * manager() to reload a clean instance from the committed store state.
+   *
+   * Always called from INSIDE the channel lock, so the eviction can't race a
+   * concurrent op on the same channel. Idempotent with the distribute-catch's own
+   * delete (a re-delete is a no-op). On success the manager stays cached as
+   * before — no eviction.
+   */
+  async evictOnThrow(channelId, op) {
+    try {
+      return await op();
+    } catch (e) {
+      this.managers.delete(channelId);
+      throw e;
+    }
+  }
+  async exporterKey(enclaveId, channelId, epoch) {
+    const mgr = await this.manager(channelId);
+    return mgr.exportSecret(LABEL, buildExporterContext(enclaveId, channelId, epoch), 32);
+  }
+  /**
+   * Join a channel from the host-committed Welcome, then drain any commits that
+   * landed after the Welcome so we converge on the true current epoch. Without
+   * this, confirm-join 409s `member_epoch_stale` whenever the committer advanced
+   * the epoch between Welcome generation and our join.
+   */
+  async joinAndReconcile(channelId, enclaveId) {
+    await this.ensureSession(channelId, { enclaveId, bootstrap: false });
+    try {
+      await this.receiveOnce(this.o.deviceId);
+    } catch {
+    }
+    return this.currentEpoch(channelId);
+  }
+  /**
+   * Self-heal-on-send (Phase 1.1). Converge the sender to the live group epoch
+   * BEFORE it seals an application message: drain any pending commits (via
+   * {@link receiveOnce}) so {@link currentEpoch} reflects the live group. A
+   * sender one epoch behind would otherwise seal at a stale epoch — the backend
+   * rejects that with an epoch-stale 400 (the "owner-send-stuck / shows queued,
+   * never posts" symptom), and even a blind relay would deliver ciphertext no
+   * live-epoch peer can decrypt (forward secrecy deleted the old secret).
+   *
+   * Best-effort and idempotent: if there is nothing pending it is a cheap no-op
+   * (one pullDelivery), and a drain failure is swallowed so it never breaks the
+   * send path — the caller publishes at whatever epoch we reach and the
+   * defensive reconcile-then-retry-once on a publish 400 covers a commit that
+   * lands between this drain and publish.
+   *
+   * COMMITTER SAFETY (B11): this MUST only be called from a normal application-
+   * send entry point, never inside a committer's resolve→distribute window
+   * (addMemberToLiveGroup / removeMemberFromLiveGroup / removeDeviceFromLiveGroup
+   * stage their own commit and explicitly must NOT receiveOnce between resolving
+   * members and distributing — doing so would race their in-flight commit). A
+   * text/a2a/status send is never mid-distribute, so scoping reconcileForSend to
+   * those entry points keeps the receiveOnce drain out of any committer window.
+   * If the channel has no local MLS state yet (nothing to drain/seal), this is a
+   * no-op rather than an error.
+   */
+  async reconcileForSend(channelId) {
+    if (!await this.o.store.load(channelId))
+      return;
+    try {
+      await this.receiveOnce(this.o.deviceId);
+    } catch {
+    }
+  }
+  /**
+   * Peek the device's delivery queue for a pending Welcome WITHOUT acking it.
+   *
+   * Returns the `connect_channel_id` of the first welcome row, or null when none
+   * is queued yet. Used by the external-guest join to detect host approval over
+   * the guest bearer (the guest can't call the Clerk-gated /me or channel-list).
+   * The row is deliberately NOT acked here — the subsequent ensureSession(join) /
+   * joinAndReconcile consumes the same Welcome and acks it after joining.
+   */
+  async peekWelcomeChannel(deviceId) {
+    const rows = await this.o.backend.pullDelivery(deviceId);
+    const w = rows.find((r) => r.message_type === "welcome" && r.connect_channel_id != null);
+    return w?.connect_channel_id ?? null;
+  }
+  async publishKeyPackage() {
+    if (await this.o.store.loadPendingBundle(this.o.deviceId)) {
+      console.warn("publishKeyPackage: pending bundle exists; skipping republish");
+      return;
+    }
+    const mgr = new MLSGroupManager();
+    const bundle = await mgr.generateKeyPackage(this.o.identity);
+    const hex = bytesToHex(MLSGroupManager.serializeKeyPackage(bundle.publicPackage));
+    await this.o.backend.publishKeyPackage(this.o.deviceId, hex);
+    await this.o.store.savePendingBundle(this.o.deviceId, bundle);
+  }
+  async ensureSession(channelId, opts) {
+    return this.locks.run(channelId, () => this.ensureSessionUnlocked(channelId, opts));
+  }
+  async ensureSessionUnlocked(channelId, opts) {
+    if (!opts.forceReinit && await this.o.store.load(channelId))
+      return;
+    let bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+    if (!bundle && (opts.bootstrap || opts.forceReinit)) {
+      await this.publishKeyPackage();
+      bundle = await this.o.store.loadPendingBundle(this.o.deviceId);
+    }
+    if (!bundle)
+      throw new Error("ensureSession: call publishKeyPackage() first");
+    if (opts.forceReinit) {
+      const others = opts.otherDeviceIds ?? [];
+      const reinit = await this.o.backend.reinitConnectChannelGroup(channelId, [this.o.deviceId, ...others]);
+      const mgr = new MLSGroupManager();
+      await mgr.createGroup(new TextEncoder().encode(reinit.group_id), bundle);
+      const kps = await this.o.backend.fetchKeyPackages(others);
+      const pkgs = others.map((d) => {
+        const hex = kps[d];
+        if (!hex)
+          throw new Error(`ensureSession(forceReinit): no published KeyPackage for device ${d}`);
+        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+      });
+      const { commit, welcome } = await mgr.addMembers(pkgs);
+      await this.o.backend.distribute(reinit.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: reinit.current_epoch,
+        member_device_ids: [this.o.deviceId, ...others],
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+      });
+      await this.o.store.save(channelId, mgr.exportState());
+      this.managers.set(channelId, mgr);
+      await this.o.store.deletePendingBundle(this.o.deviceId);
+      return;
+    }
+    if (opts.bootstrap) {
+      const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+      if (init.created === false)
+        throw new BootstrapRaceLostError();
+      const mgr = new MLSGroupManager();
+      await mgr.createGroup(new TextEncoder().encode(init.group_id), bundle);
+      const others = opts.otherDeviceIds ?? [];
+      const kps = await this.o.backend.fetchKeyPackages(others);
+      const pkgs = others.map((d) => {
+        const hex = kps[d];
+        if (!hex)
+          throw new Error(`ensureSession: no published KeyPackage for device ${d}`);
+        return MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+      });
+      const { commit, welcome } = await mgr.addMembers(pkgs);
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: init.current_epoch,
+        member_device_ids: [this.o.deviceId, ...others],
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex(welcome) })) : []
+      });
+      this.managers.set(channelId, mgr);
+      await this.o.store.save(channelId, mgr.exportState());
+      await this.o.store.deletePendingBundle(this.o.deviceId);
+    } else {
+      const rows = await this.o.backend.pullDelivery(this.o.deviceId);
+      const w = rows.find((r) => r.message_type === "welcome" && (r.connect_channel_id === channelId || r.connect_channel_id == null));
+      if (!w)
+        throw new Error("ensureSession(join): no Welcome available yet for this channel");
+      const mgr = new MLSGroupManager();
+      await mgr.joinFromWelcome(hexToBytes(w.payload), bundle);
+      this.managers.set(channelId, mgr);
+      await this.o.store.save(channelId, mgr.exportState());
+      await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
+      const remaining = await this.o.backend.pullDelivery(this.o.deviceId);
+      let burstPending = false;
+      for (const r of remaining) {
+        if (r.message_type !== "welcome")
+          continue;
+        const cid = r.connect_channel_id;
+        if (!cid || !await this.o.store.load(cid)) {
+          burstPending = true;
+          break;
+        }
+      }
+      if (!burstPending)
+        await this.o.store.deletePendingBundle(this.o.deviceId);
+    }
+  }
+  /**
+   * Committer-side: add a member to an ALREADY-bootstrapped (live) group.
+   *
+   * The bootstrap path (ensureSession bootstrap:true) only adds members at group
+   * creation. The admission flow admits a member AFTER the group is live, so the
+   * committer commits the Add against its saved state and distributes the commit
+   * plus a Welcome targeting the new device.
+   *
+   * group_id resolution reuses the same idempotent init endpoint bootstrap uses:
+   * for an existing channel it returns the live group's id, current epoch, and
+   * full member roster (unioning in any device ids we pass). That avoids a
+   * parallel group_id-by-channel resolver.
+   */
+  async addMemberToLiveGroup(channelId, newDeviceId) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, 0)));
+  }
+  async addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt) {
+    const mgr = await this.manager(channelId);
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId, newDeviceId]);
+    const kps = await this.o.backend.fetchKeyPackages([newDeviceId]);
+    const hex = kps[newDeviceId];
+    if (!hex)
+      throw new Error(`addMemberToLiveGroup: no published KeyPackage for device ${newDeviceId}`);
+    const pkg = MLSGroupManager.deserializeKeyPackage(hexToBytes(hex));
+    const priorEpoch = Number(mgr.epoch);
+    const { commit, welcome } = await mgr.addMembers([pkg]);
+    const members = [.../* @__PURE__ */ new Set([...init.member_device_ids ?? [this.o.deviceId], newDeviceId])];
+    try {
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: priorEpoch,
+        member_device_ids: members,
+        op: "add",
+        welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex(welcome) }] : []
+      });
+    } catch (e) {
+      this.managers.delete(channelId);
+      if (_attempt >= 2)
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch {
+      }
+      return this.addMemberToLiveGroupUnlocked(channelId, newDeviceId, _attempt + 1);
+    }
+    await this.o.store.save(channelId, mgr.exportState());
+  }
+  /**
+   * Committer-side: REMOVE a member from a live group (Phase C eviction).
+   *
+   * Mirrors {@link addMemberToLiveGroup}, but commits a Remove (no Welcome) and
+   * uses the store's two-slot staging for crash/conflict safety: the advanced
+   * (post-removal) state is written to STAGING before the removal-Commit is
+   * distributed, promoted to MAIN only on a 2xx, and discarded on a 409 so a
+   * reload from MAIN yields the pre-commit state. The removed member's leaf is
+   * identified by its credential identity (a member's devices share one identity,
+   * so this evicts ALL of that member's device leaves). The ts-mls forced
+   * UpdatePath (patches/ts-mls+1.6.2.patch) rotates the new epoch's key schedule
+   * away from every evicted leaf, so the removed member cannot derive the new
+   * exporter secret.
+   *
+   * The server resolves removed_identity_id → the device(s) to drop from the
+   * roster + purge from delivery; member_device_ids here is the SDK's roster view
+   * for relays that don't do that resolution. No-op if the identity isn't a member
+   * of this group.
+   */
+  async removeMemberFromLiveGroup(channelId, identityId) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeMemberFromLiveGroupUnlocked(channelId, identityId, 0)));
+  }
+  async removeMemberFromLiveGroupUnlocked(channelId, identityId, _attempt) {
+    const mgr = await this.manager(channelId);
+    const indices = mgr.leafIndicesForIdentity(identityId);
+    if (indices.length === 0)
+      return;
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    const priorEpoch = Number(mgr.epoch);
+    const { commit } = await mgr.removeMembers(indices);
+    if (Number(mgr.epoch) !== priorEpoch + 1) {
+      throw new Error("removeMemberFromLiveGroup: unexpected epoch drift before distribute");
+    }
+    await this.o.store.saveStaging(channelId, mgr.exportState());
+    const members = init.member_device_ids ?? [this.o.deviceId];
+    try {
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: priorEpoch,
+        member_device_ids: members,
+        op: "remove",
+        removed_identity_id: identityId,
+        welcomes: []
+      });
+    } catch (e) {
+      this.managers.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      if (_attempt >= 2)
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch {
+      }
+      return this.removeMemberFromLiveGroupUnlocked(channelId, identityId, _attempt + 1);
+    }
+    await this.o.store.promoteStaging(channelId);
+  }
+  /**
+   * Committer-side: REMOVE a SINGLE device (one leaf) from a live group (MD-3
+   * per-device eviction).
+   *
+   * The identity-level {@link removeMemberFromLiveGroup} evicts EVERY leaf of a
+   * credential identity. This evicts ONE — the counterpart to revoking a single
+   * device while the owner keeps their other devices in the channel.
+   *
+   * Leaf resolution (LOCKED): MLS leaves carry only the member's credential
+   * identity, never a device id, so same-identity devices are indistinguishable
+   * at the crypto layer. The ONLY correct mapping is POSITIONAL BY ADD-ORDER:
+   * leaves are appended in the order devices were added, so the i-th add-ordered
+   * device of an identity occupies the i-th ascending leaf index for that
+   * identity. The caller (which holds the channel roster with identities) passes
+   * the target's identity AND the add-ordered device-id list; we resolve the leaf
+   * by `orderedDeviceIds.indexOf(deviceId)`. If the tree's leaf count for that
+   * identity disagrees with the roster's device count, we REFUSE rather than guess
+   * (a wrong leaf would evict the wrong device).
+   *
+   * Everything else mirrors {@link removeMemberFromLiveGroup}: resolve leaf BEFORE
+   * the commit, capture priorEpoch, single-leaf removeMembers, the B11 epoch-drift
+   * guard, and two-slot staging (save→distribute→promote on 2xx / discard + evict
+   * + receiveOnce + retry on 409). The distribute carries op:"remove" +
+   * `removed_device_id` (instead of removed_identity_id); the server resolves the
+   * device's identity, asserts it matches, and purges that ONE device.
+   */
+  async removeDeviceFromLiveGroup(channelId, deviceId, opts) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, () => this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, 0)));
+  }
+  async removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt) {
+    const mgr = await this.manager(channelId);
+    const pos = opts.orderedDeviceIds.indexOf(deviceId);
+    if (pos < 0)
+      return;
+    const leaves = mgr.leafIndicesForIdentity(opts.identity);
+    if (leaves.length !== opts.orderedDeviceIds.length) {
+      throw new LeafRosterMismatchError();
+    }
+    const leafIndex = leaves[pos];
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    const priorEpoch = Number(mgr.epoch);
+    const { commit } = await mgr.removeMembers([leafIndex]);
+    if (Number(mgr.epoch) !== priorEpoch + 1) {
+      throw new Error("removeDeviceFromLiveGroup: unexpected epoch drift before distribute");
+    }
+    await this.o.store.saveStaging(channelId, mgr.exportState());
+    const members = init.member_device_ids ?? [this.o.deviceId];
+    const removedIdentity = typeof opts.identity === "string" ? opts.identity : bytesToHex(opts.identity);
+    try {
+      await this.o.backend.distribute(init.group_id, {
+        device_id: this.o.deviceId,
+        commit: bytesToHex(commit),
+        commit_epoch: Number(mgr.epoch),
+        expected_epoch: priorEpoch,
+        member_device_ids: members,
+        op: "remove",
+        removed_identity_id: removedIdentity,
+        removed_device_id: deviceId,
+        welcomes: []
+      });
+    } catch (e) {
+      this.managers.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      if (_attempt >= 2)
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch {
+      }
+      return this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt + 1);
+    }
+    await this.o.store.promoteStaging(channelId);
+  }
+  /**
+   * Committer-side: HEAL a permanently-diverged member by Remove(stale leaf) then
+   * Add(device), re-keying it with a fresh Welcome at the live epoch (Phase 1
+   * member self-heal).
+   *
+   * ATOMICITY (S1, honest framing): this is atomic against CONCURRENCY — the
+   * per-channel lock is taken ONCE and held continuously across both mutations, so
+   * no peer commit or receive-pump row can interleave between the Remove and the
+   * Add. It is NOT TRANSACTIONAL across the two server distributes: there is no
+   * rollback of a landed Remove. If the Add throws AFTER the Remove's distribute
+   * already succeeded, the member is left REMOVED-but-not-readded (detached —
+   * strictly worse than the original wedge). That specific failure is surfaced as a
+   * {@link HealAddAfterRemoveError} so a caller can recover by RE-RUNNING the heal:
+   * the retry finds zero leaves for the identity and takes the Add-only branch,
+   * completing the re-key. An Add failure BEFORE any Remove landed (e.g. the
+   * zero-leaf branch, or a fetchKeyPackages failure) is not detaching and rethrows
+   * as-is.
+   *
+   * The wedge this clears: a member fell behind, can't catch up (forward secrecy
+   * deleted the key it needs), still HOLDS a leaf (so the admission watcher won't
+   * re-add it), and its saved MLS state is diverged. There is no MLS-correct
+   * "re-welcome in place" for a member that still occupies a leaf — handing a
+   * Welcome to an identity that already holds a leaf is a two-leaf bug. The only
+   * correct heal is to drop its stale leaf and re-Add the device, which seals a
+   * fresh Welcome to it at the post-Remove live epoch. (reinit is the WRONG tool —
+   * that is the committer-loss hammer, guarded to zero-other-devices, and
+   * Welcome-storms every healthy member.)
+   *
+   * ONE acquisition (load-bearing): we take the per-channel lock ONCE and run BOTH
+   * mutations inside it via the Unlocked variants, so the lock is never released
+   * between Remove and Add — that gap would open a fork window (a peer commit or
+   * the device-wide receive pump could advance the manager between the two). Do
+   * NOT call the public (self-locking) variants in sequence. Remove FIRST, then
+   * Add, so the identity is never momentarily double-leafed.
+   *
+   * Device-level removal (not identity-level): we resolve the member's credential
+   * identity from its freshly-published KeyPackage (which the Add needs anyway)
+   * and evict only the single stale leaf, so the member identity's OTHER healthy
+   * devices are not collaterally evicted. Leaf resolution reads the LIVE
+   * (post-lock) tree:
+   *   - exactly ONE leaf → device-level Remove (orderedDeviceIds=[deviceId]) then Add;
+   *   - ZERO leaves → no stale leaf (e.g. a heal retry whose Remove already
+   *     landed) → Add-only re-key;
+   *   - MORE THAN ONE leaf → ambiguous (no add-order roster to disambiguate which
+   *     leaf is the stale one) → REFUSE rather than risk evicting a healthy device.
+   *
+   * The Add fetches the device's freshly published KeyPackage from the backend,
+   * exactly like a normal add — the CALLER is responsible for the member having
+   * re-published one first (mirrors addMemberToLiveGroup's "no published
+   * KeyPackage" error). After the call the committer's group has the member
+   * re-added at the live epoch.
+   *
+   * Authorization / single-committer guards are inherited unchanged from the
+   * Unlocked committer ops this composes (removeDeviceFromLiveGroupUnlocked /
+   * addMemberToLiveGroupUnlocked) — no weaker path is introduced.
+   */
+  async healDivergedMember(channelId, memberDeviceId) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      const kps = await this.o.backend.fetchKeyPackages([memberDeviceId]);
+      const hex = kps[memberDeviceId];
+      if (!hex)
+        throw new Error(`healDivergedMember: no published KeyPackage for device ${memberDeviceId}`);
+      const cred = MLSGroupManager.deserializeKeyPackage(hexToBytes(hex)).leafNode.credential;
+      if (cred.credentialType !== "basic") {
+        throw new Error(`healDivergedMember: unexpected credential type ${cred.credentialType} (expected basic)`);
+      }
+      const identity = new TextDecoder().decode(cred.identity);
+      const mgr = await this.manager(channelId);
+      const leaves = mgr.leafIndicesForIdentity(identity);
+      if (leaves.length > 1) {
+        throw new Error(`healDivergedMember: identity owns ${leaves.length} leaves; ambiguous stale-leaf resolution (refusing to guess)`);
+      }
+      let removeLanded = false;
+      if (leaves.length === 1) {
+        await this.removeDeviceFromLiveGroupUnlocked(channelId, memberDeviceId, { identity, orderedDeviceIds: [memberDeviceId] }, 0);
+        removeLanded = true;
+      } else {
+        const stillZero = (await this.manager(channelId)).leafIndicesForIdentity(identity);
+        if (stillZero.length !== 0) {
+          throw new Error(`healDivergedMember: expected 0 leaves for the Add-only branch but found ${stillZero.length} (a leaf reappeared under the held lock \u2014 refusing to create a duplicate leaf)`);
+        }
+      }
+      try {
+        await this.addMemberToLiveGroupUnlocked(channelId, memberDeviceId, 0);
+      } catch (e) {
+        if (removeLanded)
+          throw new HealAddAfterRemoveError(e);
+        throw e;
+      }
+    }));
+  }
+  /**
+   * Member-side: drop the diverged local state for a channel so a subsequent
+   * {@link joinAndReconcile} consumes the committer's fresh Welcome (from
+   * {@link healDivergedMember}) instead of early-returning on the stale saved
+   * state (Phase 1 member self-heal). This does NOT rejoin — the caller invokes
+   * joinAndReconcile afterward.
+   *
+   * BOTH the in-memory manager AND the persisted store row must go: evict alone is
+   * insufficient because ensureSession(join) early-returns whenever
+   * `store.load(channelId)` returns existing state, so the member would reload the
+   * diverged row and never rejoin. Also clear this channel's decrypt-error tracker
+   * entry so a healed channel doesn't read as permanently `stuck` in errorStats.
+   *
+   * CHANNEL LOCK (M1): the whole reset runs under the per-channel lock, serialized
+   * against receiveOnce / committer ops / ensureSession on the SAME channel. Without
+   * it a concurrent receiveOnce processing a commit row for this channel could
+   * re-persist the diverged state immediately after our `store.delete`, re-wedging
+   * the rejoin (the join would then early-return on the resurrected row). The
+   * in-memory evict and `errors.delete` are cheap synchronous map mutations but are
+   * kept inside the lock so the reset is one coherent, atomic state clear.
+   *
+   * STAGING (M2): also discard any persisted staging row for the channel. A removal
+   * op interrupted between saveStaging and promote/discard can leave a stale staged
+   * advanced state; if that survives the reset it can re-diverge the rejoin. The
+   * in-memory store's discardStaging is a no-op when no staging row exists.
+   */
+  async resetChannelForRejoin(channelId) {
+    await this.locks.run(channelId, async () => {
+      this.evictChannelState(channelId);
+      await this.o.store.delete(channelId);
+      await this.o.store.discardStaging(channelId);
+      this.errors.delete(channelId);
+    });
+  }
+  /** Returns true when an in-memory MLS manager is live for the channel.
+   * Cheap synchronous check; does NOT consult the store. */
+  hasChannelState(channelId) {
+    return this.managers.has(channelId);
+  }
+  /** Returns true when the channel has either a live in-memory manager OR
+   * persisted state in the store. Use this to decide whether to call
+   * ensureSession(bootstrap:false) or ensureSession(bootstrap:true). */
+  async hasPersistedChannelState(channelId) {
+    if (this.managers.has(channelId))
+      return true;
+    return await this.o.store.load(channelId) !== null;
+  }
+  /** Returns true when the live in-memory MLS tree for `channelId` contains at
+   * least one leaf bearing `identityId` as its credential. Used by the agent
+   * admission watcher (liveness §4.3) to decide whether an Add+Welcome is still
+   * needed — if the agent already has a leaf the sweep skips it. Returns false
+   * when there is no in-memory manager for the channel (i.e. the group is not
+   * yet loaded), which causes the sweep to attempt the Add (idempotent on the
+   * server side). */
+  hasLeafForIdentity(channelId, identityId) {
+    const mgr = this.managers.get(channelId);
+    if (!mgr)
+      return false;
+    return mgr.leafIndicesForIdentity(identityId).length > 0;
+  }
+  /** Probe the server for the channel's MLS group without modifying any local
+   * state. Maps the ChannelGroupResp field names to SDK-friendly camelCase. */
+  async probeChannelGroup(channelId) {
+    const r = await this.o.backend.getConnectChannelGroup(channelId);
+    return { exists: r.exists, groupId: r.group_id, epoch: r.current_epoch };
+  }
+  async receiveOnce(deviceId) {
+    const rows = await this.o.backend.pullDelivery(deviceId);
+    const appEntries = [];
+    const handshakeAcked = [];
+    const order = { welcome: 0, commit: 1, application: 2 };
+    rows.sort((a, b) => order[a.message_type] - order[b.message_type]);
+    for (const row of rows) {
+      try {
+        if (row.message_type === "welcome") {
+          const wcid = row.connect_channel_id;
+          if (wcid && await this.o.store.load(wcid)) {
+            handshakeAcked.push(row.queue_id);
+          }
+        } else if (row.message_type === "commit") {
+          const cid = row.connect_channel_id;
+          if (!cid)
+            continue;
+          await this.locks.run(cid, async () => {
+            const mgr = await this.manager(cid);
+            await mgr.decrypt(hexToBytes(row.payload));
+            await this.o.store.save(cid, mgr.exportState());
+          });
+          this.recordDecryptSuccess(cid);
+          handshakeAcked.push(row.queue_id);
+        } else {
+          const envelope = JSON.parse(new TextDecoder().decode(hexToBytes(row.payload)));
+          const key = await this.locks.run(envelope.channel_id, () => this.exporterKey(envelope.enclave_id, envelope.channel_id, envelope.mls_group_epoch));
+          const aad = await buildAssociatedData({
+            message_id: envelope.message_id,
+            channel_id: envelope.channel_id,
+            sender_id: envelope.sender_id,
+            mls_group_epoch: envelope.mls_group_epoch,
+            replay_nonce: envelope.replay_nonce,
+            policy_binding: envelope.policy_binding
+          });
+          const plaintext = openPayload({ ciphertext: base64ToBytes(envelope.payload_encrypted), key, associatedData: aad, suite: this.suite });
+          const appChannelId = row.connect_channel_id ?? envelope.channel_id;
+          this.recordDecryptSuccess(appChannelId);
+          appEntries.push({
+            queueId: row.queue_id,
+            messageId: envelope.message_id,
+            channelId: appChannelId,
+            plaintext,
+            envelope,
+            receivedAt: Date.now(),
+            retryCount: 0
+          });
+        }
+      } catch (err) {
+        this.recordDecryptError(row, err);
+        const cid = row.connect_channel_id;
+        if (cid && typeof row.epoch === "number") {
+          let liveEpoch;
+          try {
+            liveEpoch = await this.currentEpoch(cid);
+          } catch {
+            liveEpoch = void 0;
+          }
+          const permanentlyDead = liveEpoch !== void 0 && (row.message_type === "commit" ? row.epoch <= liveEpoch : row.message_type === "application" ? row.epoch < liveEpoch : false);
+          if (permanentlyDead) {
+            handshakeAcked.push(row.queue_id);
+            this.permanentlySkipped++;
+          }
+        }
+      }
+    }
+    if (handshakeAcked.length)
+      await this.o.backend.ackDelivery(deviceId, handshakeAcked);
+    return appEntries;
+  }
+  /**
+   * Channel-scoped, UNLOCKED commit drain for committer conflict-recovery.
+   *
+   * A committer that loses an epoch race (409) must process the peer's winning
+   * commit to advance to the true current epoch before it retries. It does this
+   * from INSIDE its own channel lock, so it must NOT call the public receiveOnce
+   * (which would re-acquire the same channel lock for that channel's commit rows
+   * and self-deadlock — the queue is not reentrant). This helper does the commit
+   * half of receiveOnce for ONLY the committer's own channel, without taking the
+   * lock (the caller already holds it). Application rows are left untouched — the
+   * committer only needs to converge its handshake epoch — and welcome rows are
+   * left for the join path, exactly as receiveOnce leaves them.
+   */
+  async drainChannelCommitsUnlocked(deviceId, channelId) {
+    const rows = await this.o.backend.pullDelivery(deviceId);
+    const acked = [];
+    for (const row of rows) {
+      if (row.message_type !== "commit")
+        continue;
+      if (row.connect_channel_id !== channelId)
+        continue;
+      try {
+        const mgr = await this.manager(channelId);
+        await mgr.decrypt(hexToBytes(row.payload));
+        await this.o.store.save(channelId, mgr.exportState());
+        this.recordDecryptSuccess(channelId);
+        acked.push(row.queue_id);
+      } catch (err) {
+        this.recordDecryptError(row, err);
+      }
+    }
+    if (acked.length)
+      await this.o.backend.ackDelivery(deviceId, acked);
+  }
+  /** Delegate so the receive pump can ack without reaching the private backend. */
+  async ackDelivery(deviceId, queueIds) {
+    await this.o.backend.ackDelivery(deviceId, queueIds);
+  }
+};
+
+// ../connect-sdk-ts/dist/transport/frame-registry.js
+var str = (v) => String(v ?? "");
+var FRAME_PARSERS = {
+  mls_delivery: (d) => ({ count: typeof d?.count === "number" ? d.count : void 0 }),
+  delivery_receipt: (d) => ({
+    receipts: [{ messageId: str(d?.message_id), channelId: str(d?.channel_id), status: "delivered" }]
+  }),
+  read_receipt: (d) => ({
+    receipts: [{ messageId: str(d?.message_id), channelId: str(d?.channel_id), status: "read" }]
+  }),
+  agent_status_change: (d) => ({
+    presence: [
+      {
+        identityId: str(d?.identity_id),
+        status: d?.status === "offline" ? "offline" : "online",
+        lastSeen: d?.last_seen
+      }
+    ]
+  }),
+  presence_snapshot: (d) => ({
+    presence: (Array.isArray(d?.online) ? d.online : []).map((id) => ({
+      identityId: str(id),
+      status: "online"
+    }))
+  }),
+  typing: (d) => ({ typing: { channelId: str(d?.channel_id), identityId: str(d?.identity_id) } }),
+  agent_status_keepalive: (d) => ({
+    statusKeepalive: { channelId: str(d?.channel_id), identityId: str(d?.identity_id) }
+  }),
+  // MD-3: a device asked to be Welcomed into a group. A surviving committer
+  // device acts on this for own-identity (PoP-proven) requesters; the durable
+  // state is the welcome_request row, this frame just wakes the handler.
+  mls_welcome_requested: (d) => ({
+    welcomeRequest: {
+      groupId: str(d?.group_id),
+      roomId: d?.room_id ? str(d.room_id) : void 0,
+      requestingDeviceId: str(d?.requesting_device_id),
+      requestingIdentityId: d?.requesting_identity_id ? str(d.requesting_identity_id) : void 0,
+      requestId: d?.request_id ? str(d.request_id) : void 0
+    }
+  })
+};
+var S2C_FRAME_NAMES = new Set(Object.keys(FRAME_PARSERS));
+function parseServerFrame(frame) {
+  if (!frame || typeof frame !== "object")
+    return void 0;
+  const f = frame;
+  const parser = typeof f.event === "string" ? FRAME_PARSERS[f.event] : void 0;
+  return parser ? parser(f.data) : void 0;
+}
+
+// ../connect-sdk-ts/dist/transport/ws-pings.js
+function openDeliveryPings(o) {
+  const base = o.backoffBaseMs ?? 500;
+  const cap = o.backoffCapMs ?? 8e3;
+  const rng = o.rng ?? Math.random;
+  const maxQueue = o.maxQueue ?? 8;
+  const stableResetMs = o.stableResetMs ?? 1e4;
+  let closed = false;
+  let attempt = 0;
+  let sock;
+  let backoffTimer;
+  let stableTimer;
+  const PRESENCE_PONG_MS = 3e4;
+  let pongTimer;
+  const stopPong = () => {
+    if (pongTimer) {
+      clearInterval(pongTimer);
+      pongTimer = void 0;
+    }
+  };
+  const queue = [];
+  let waiter;
+  let iterStarted = false;
+  const push = (p) => {
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w({ value: p, done: false });
+    } else if (queue.length < maxQueue) {
+      queue.push(p);
+    }
+  };
+  const end = () => {
+    closed = true;
+    if (backoffTimer)
+      clearTimeout(backoffTimer);
+    if (stableTimer)
+      clearTimeout(stableTimer);
+    stopPong();
+    try {
+      sock?.close();
+    } catch {
+    }
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w({ value: void 0, done: true });
+    }
+  };
+  const scheduleReconnect = () => {
+    if (closed)
+      return;
+    attempt += 1;
+    const ceil = Math.min(cap, base * 2 ** (attempt - 1));
+    backoffTimer = setTimeout(connect, Math.floor(rng() * ceil));
+  };
+  async function connect() {
+    if (closed)
+      return;
+    let token;
+    try {
+      token = await o.tokenProvider();
+    } catch {
+      scheduleReconnect();
+      return;
+    }
+    if (closed)
+      return;
+    const sep = o.url.includes("?") ? "&" : "?";
+    const ws = new o.wsImpl(`${o.url}${sep}token=${encodeURIComponent(token)}`);
+    sock = ws;
+    ws.onopen = () => {
+      push({ reconnected: true });
+      stableTimer = setTimeout(() => {
+        attempt = 0;
+      }, stableResetMs);
+      stopPong();
+      pongTimer = setInterval(() => {
+        try {
+          if (ws.readyState === 1)
+            ws.send(JSON.stringify({ event: "pong" }));
+        } catch {
+        }
+      }, PRESENCE_PONG_MS);
+    };
+    ws.onmessage = (e) => {
+      try {
+        const f = JSON.parse(String(e.data));
+        const ping = parseServerFrame(f);
+        if (ping)
+          push(ping);
+      } catch {
+      }
+    };
+    ws.onerror = () => {
+    };
+    ws.onclose = (e) => {
+      sock = void 0;
+      if (stableTimer)
+        clearTimeout(stableTimer);
+      stopPong();
+      if (closed)
+        return;
+      if (e.code === 4001) {
+        end();
+        return;
+      }
+      scheduleReconnect();
+    };
+  }
+  void connect();
+  const pings = {
+    [Symbol.asyncIterator]() {
+      if (iterStarted)
+        throw new Error("openDeliveryPings: single-use async iterable");
+      iterStarted = true;
+      return {
+        next() {
+          if (closed)
+            return Promise.resolve({ value: void 0, done: true });
+          if (queue.length)
+            return Promise.resolve({ value: queue.shift(), done: false });
+          return new Promise((resolve2) => {
+            waiter = resolve2;
+          });
+        }
+      };
+    }
+  };
+  const send = (frame) => {
+    try {
+      if (sock && sock.readyState === 1)
+        sock.send(JSON.stringify(frame));
+    } catch {
+    }
+  };
+  return { pings, close: end, send };
+}
+
+// ../connect-sdk-ts/dist/transport/rest.js
+var PATHS = {
+  register: "/api/v1/connect/agents/register",
+  // VERIFY against MOT-136
+  channelMembers: (id) => `/api/v1/connect/channels/${id}/members`,
+  // VERIFY against MOT-139
+  messages: "/api/v1/messages",
+  // live (MOT-194)
+  stream: "/api/v1/messages/stream",
+  // MLS-gated (MOT-144)
+  auditRecords: "/api/v1/audit/records"
+  // MOT-151
+};
+var RestTransport = class {
+  opts;
+  f;
+  ws;
+  tokenProvider;
+  /** The most recent device-wide WS send handle, captured on subscribe and
+   * cleared on its close. Control frames (status keepalive) route through it;
+   * a no-op when no subscription is active. */
+  _controlSend = null;
+  constructor(opts) {
+    this.opts = opts;
+    this.f = opts.fetchImpl ?? fetch;
+    this.ws = opts.wsImpl ?? globalThis.WebSocket;
+    this.tokenProvider = opts.tokenProvider ?? (async () => opts.bearerToken);
+  }
+  headers() {
+    return { "content-type": "application/json", authorization: `Bearer ${this.opts.bearerToken}` };
+  }
+  async register(req) {
+    const res = await this.f(this.opts.baseUrl + PATHS.register, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({
+        skill_forge_token: req.skillForgeToken,
+        skill_id: req.skillId,
+        public_key: req.publicKey,
+        algo: req.algo,
+        attested: req.attested,
+        model: req.model
+      })
+    });
+    if (!res.ok)
+      throw new RegistrationError(`register failed: ${res.status}`);
+    const j = await res.json();
+    return {
+      agentId: j.agent_id,
+      tenantId: j.tenant_id,
+      enclaveId: j.enclave_id,
+      bindingId: j.binding_id,
+      bindingVersion: j.binding_version,
+      owningOrg: j.owning_org
+    };
+  }
+  async joinChannel(channelId, types, caps) {
+    const res = await this.f(this.opts.baseUrl + PATHS.channelMembers(channelId), {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ declared_message_types: types, declared_capabilities: caps })
+    });
+    if (!res.ok)
+      throw new Error(`joinChannel failed: ${res.status}`);
+  }
+  async leaveChannel(channelId) {
+    await this.f(this.opts.baseUrl + PATHS.channelMembers(channelId), {
+      method: "DELETE",
+      headers: this.headers()
+    });
+  }
+  async publish(envelope) {
+    const res = await this.f(this.opts.baseUrl + PATHS.messages, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(envelope)
+    });
+    if (res.status === 429) {
+      const retry = Number(res.headers.get("retry-after") ?? "1");
+      throw new RateLimitError("server rate limit", Number.isFinite(retry) ? retry : 1);
+    }
+    if (res.status === 400) {
+      const stale = await staleEpochErrorFromResponse(res);
+      if (stale)
+        throw stale;
+    }
+    if (!res.ok)
+      throw new Error(`publish failed: ${res.status}`);
+    const j = await res.json();
+    return {
+      messageId: String(j.message_id),
+      auditRecordId: String(j.audit_record_id),
+      thisHash: String(j.this_hash),
+      sequenceNumber: Number(j.sequence_number)
+    };
+  }
+  subscribeDeliveryPings(_channelId) {
+    let wsUrl = this.opts.baseUrl.replace(/^http/, "ws").replace(/\/$/, "") + "/api/v1/ws";
+    if (this.opts.connectIdentityId) {
+      wsUrl += `?connect_identity_id=${encodeURIComponent(this.opts.connectIdentityId)}`;
+    }
+    const handle = openDeliveryPings({ url: wsUrl, tokenProvider: this.tokenProvider, wsImpl: this.ws });
+    this._controlSend = handle.send;
+    const close = () => {
+      if (this._controlSend === handle.send)
+        this._controlSend = null;
+      handle.close();
+    };
+    return { pings: handle.pings, close, send: handle.send };
+  }
+  sendControlFrame(_channelId, frame) {
+    try {
+      this._controlSend?.(frame);
+    } catch {
+    }
+  }
+  async queryAudit(query) {
+    const qs = new URLSearchParams(query).toString();
+    const res = await this.f(`${this.opts.baseUrl}${PATHS.auditRecords}?${qs}`, {
+      method: "GET",
+      headers: this.headers()
+    });
+    if (res.status === 403)
+      throw new AuditAccessDenied("audit query exceeded caller rights");
+    if (!res.ok)
+      throw new Error(`queryAudit failed: ${res.status}`);
+    const j = await res.json();
+    return (j.records ?? []).map((r) => ({
+      recordId: String(r.record_id),
+      sequenceNumber: Number(r.sequence_number),
+      occurredAt: String(r.occurred_at),
+      messageType: r.message_type ? String(r.message_type) : void 0,
+      channelId: r.channel_id ? String(r.channel_id) : void 0
+    }));
+  }
+};
+
+// ../connect-sdk-ts/dist/mls/rest-backend.js
+var RestMlsBackend = class {
+  opts;
+  f;
+  constructor(opts) {
+    this.opts = opts;
+    this.f = opts.fetchImpl ?? fetch;
+  }
+  headers() {
+    return {
+      "content-type": "application/json",
+      authorization: `Bearer ${this.opts.bearerToken}`
+    };
+  }
+  async post(path, body) {
+    const res = await this.f(this.opts.baseUrl + path, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(body)
+    });
+    if (!res.ok)
+      throw new Error(`${path} failed: ${res.status} ${await res.text()}`);
+    return res.status === 204 ? {} : await res.json();
+  }
+  async get(path) {
+    const res = await this.f(this.opts.baseUrl + path, { headers: this.headers() });
+    if (!res.ok)
+      throw new Error(`${path} failed: ${res.status}`);
+    return await res.json();
+  }
+  async getRegisterChallenge() {
+    const j = await this.post("/api/v1/connect/devices/register-challenge", {});
+    return String(j.challenge);
+  }
+  async registerDevice(req) {
+    const j = await this.post("/api/v1/connect/devices/register", req);
+    return { device_id: String(j.device_id) };
+  }
+  async publishKeyPackage(deviceId, keyPackageHex) {
+    await this.post("/api/v1/mls/key-packages", {
+      key_package: keyPackageHex,
+      device_id: deviceId
+    });
+  }
+  async getConnectChannelGroup(channelId) {
+    const j = await this.get(`/api/v1/mls/connect-channels/${channelId}/group`);
+    return {
+      exists: Boolean(j.exists),
+      group_id: j.group_id != null ? String(j.group_id) : null,
+      current_epoch: j.current_epoch != null ? Number(j.current_epoch) : null
+    };
+  }
+  async initConnectChannelGroup(channelId, memberDeviceIds) {
+    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/init`, {
+      member_device_ids: memberDeviceIds
+    });
+    return {
+      group_id: String(j.group_id),
+      current_epoch: Number(j.current_epoch),
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : [],
+      // Back-compat: servers that predate the created field return nothing;
+      // treat absence as true (they always created a fresh group).
+      created: j.created === void 0 ? true : Boolean(j.created)
+    };
+  }
+  async reinitConnectChannelGroup(channelId, memberDeviceIds) {
+    const committer = memberDeviceIds[0];
+    if (!committer)
+      throw new Error("reinitConnectChannelGroup: empty member set");
+    const j = await this.post(`/api/v1/mls/connect-channels/${channelId}/reinit`, {
+      member_device_ids: memberDeviceIds,
+      committer_device_id: committer
+    });
+    return {
+      group_id: String(j.group_id),
+      current_epoch: Number(j.current_epoch),
+      member_device_ids: Array.isArray(j.member_device_ids) ? j.member_device_ids.map(String) : []
+    };
+  }
+  async fetchKeyPackages(deviceIds) {
+    const j = await this.get(`/api/v1/mls/key-packages/batch?device_ids=${deviceIds.join(",")}`);
+    return Object.fromEntries(Object.entries(j).map(([k, v]) => [k, String(v)]));
+  }
+  async distribute(groupId, req) {
+    await this.post(`/api/v1/mls/groups/${groupId}/distribute`, {
+      ...req,
+      group_id: groupId
+    });
+  }
+  async pullDelivery(deviceId) {
+    const j = await this.get(`/api/v1/mls/delivery?device_id=${deviceId}`);
+    return j.messages ?? [];
+  }
+  async ackDelivery(deviceId, queueIds) {
+    await this.post("/api/v1/mls/delivery/ack", {
+      device_id: deviceId,
+      queue_ids: queueIds
+    });
+  }
+  async requestWelcome(groupId, deviceId) {
+    await this.post(`/api/v1/mls/groups/${groupId}/request-welcome`, { device_id: deviceId });
+  }
+};
+
+// ../connect-sdk-ts/dist/mls/fake-backend.js
+import { bytesToHex as bytesToHex2 } from "@agentvault/crypto";
+
+// ../connect-sdk-ts/dist/receive/inbox-cipher.js
+import { hkdf } from "@noble/hashes/hkdf";
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+var SUITE = "xchacha20poly1305";
+var INFO = new TextEncoder().encode("agentvault-connect-inbox-v1");
+var EMPTY_AAD = new Uint8Array(0);
+var KeyedInboxCipher = class {
+  key;
+  constructor(key) {
+    this.key = key;
+  }
+  async seal(plaintext) {
+    return sealPayload({
+      plaintext,
+      key: this.key,
+      associatedData: EMPTY_AAD,
+      suite: SUITE
+    });
+  }
+  async open(sealed) {
+    return openPayload({
+      ciphertext: sealed,
+      key: this.key,
+      associatedData: EMPTY_AAD,
+      suite: SUITE
+    });
+  }
+};
+var MLS_STORE_INFO = new TextEncoder().encode("agentvault-connect-mls-store-v1");
+function deriveMlsStoreKey(identityKeyMaterial) {
+  return hkdf(sha2562, identityKeyMaterial, void 0, MLS_STORE_INFO, 32);
+}
+
+// ../connect-sdk-ts/dist/recovery/backup-crypto.js
+import { hkdf as hkdf2 } from "@noble/hashes/hkdf";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { randomBytes as randomBytes2 } from "@noble/hashes/utils";
+var BACKUP_INFO = new TextEncoder().encode("connect-backup-v1");
+var RECOVERY_INFO = new TextEncoder().encode("connect-recovery-v1");
+
+// ../connect-sdk-ts/dist/recovery/guest-recovery-crypto.js
+import { argon2idAsync } from "@noble/hashes/argon2";
+import { hkdf as hkdf3 } from "@noble/hashes/hkdf";
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
+var HKDF_INFO = new TextEncoder().encode("connect-guest-recovery-wrap-v1");
+
+// ../connect-mls-store/dist/sqlite-store.js
+import { DatabaseSync } from "node:sqlite";
+
+// ../connect-mls-store/dist/schema.js
+var SCHEMA_VERSION = 1;
+function openSchema(db) {
+  db.exec("PRAGMA journal_mode=WAL");
+  const row = db.prepare("PRAGMA user_version").get();
+  if (row.user_version === 0) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mls_group_state (
+        identity_id   TEXT NOT NULL,
+        channel_id    TEXT NOT NULL,
+        sealed_main   BLOB NOT NULL,
+        sealed_staging BLOB,
+        updated_at    INTEGER NOT NULL,
+        PRIMARY KEY (identity_id, channel_id)
+      );
+    `);
+    db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+  }
+}
+
+// ../connect-mls-store/dist/errors.js
+var MlsStoreCorruptError = class extends Error {
+  constructor(detail) {
+    super(`MLS store corrupt: ${detail}`);
+    this.name = "MlsStoreCorruptError";
+  }
+};
+var MlsStoreSealError = class extends Error {
+  constructor(detail) {
+    super(`MLS store seal/open failed: ${detail}`);
+    this.name = "MlsStoreSealError";
+  }
+};
+
+// ../connect-mls-store/dist/sqlite-store.js
+var SqliteMlsStateStore = class {
+  db;
+  id;
+  cipher;
+  // Bundles stay in-memory (spec §4): private half not durably serializable.
+  // Per-instance map → per-identity store instances are naturally isolated (§6.1).
+  bundles = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.id = opts.identityId;
+    this.cipher = opts.cipherFor(opts.identityId);
+    try {
+      this.db = new DatabaseSync(opts.dbPath);
+    } catch (e) {
+      throw new MlsStoreCorruptError(String(e?.message ?? e));
+    }
+    try {
+      openSchema(this.db);
+    } catch (e) {
+      this.db.close();
+      throw new MlsStoreCorruptError(String(e?.message ?? e));
+    }
+    if (opts.dbPath !== ":memory:") {
+      let r;
+      try {
+        r = this.db.prepare("PRAGMA integrity_check").get();
+      } catch (e) {
+        this.db.close();
+        throw new MlsStoreCorruptError(String(e?.message ?? e));
+      }
+      if (r.integrity_check !== "ok") {
+        this.db.close();
+        throw new MlsStoreCorruptError(r.integrity_check);
+      }
+    }
+  }
+  async seal(state) {
+    return this.cipher.seal(new TextEncoder().encode(JSON.stringify(state)));
+  }
+  async unseal(blob) {
+    let bytes;
+    try {
+      bytes = await this.cipher.open(blob);
+    } catch (e) {
+      throw new MlsStoreSealError(String(e?.message ?? e));
+    }
+    return JSON.parse(new TextDecoder().decode(bytes));
+  }
+  async load(channelId) {
+    const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(this.id, channelId);
+    if (!row)
+      return null;
+    return this.unseal(row.sealed_main);
+  }
+  async save(channelId, state) {
+    const sealed = await this.seal(state);
+    this.db.prepare(`INSERT INTO mls_group_state (identity_id, channel_id, sealed_main, updated_at)
+       VALUES (?,?,?,?)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET sealed_main=excluded.sealed_main, updated_at=excluded.updated_at`).run(this.id, channelId, sealed, Date.now());
+  }
+  async delete(channelId) {
+    this.db.prepare("DELETE FROM mls_group_state WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+  }
+  async saveStaging(channelId, state) {
+    const sealed = await this.seal(state);
+    this.db.prepare("UPDATE mls_group_state SET sealed_staging=?, updated_at=? WHERE identity_id=? AND channel_id=?").run(sealed, Date.now(), this.id, channelId);
+  }
+  async promoteStaging(channelId) {
+    this.db.prepare(`UPDATE mls_group_state SET sealed_main=sealed_staging, sealed_staging=NULL, updated_at=?
+       WHERE identity_id=? AND channel_id=? AND sealed_staging IS NOT NULL`).run(Date.now(), this.id, channelId);
+  }
+  async discardStaging(channelId) {
+    this.db.prepare("UPDATE mls_group_state SET sealed_staging=NULL WHERE identity_id=? AND channel_id=?").run(this.id, channelId);
+  }
+  async savePendingBundle(ref, bundle) {
+    this.bundles.set(ref, bundle);
+  }
+  async loadPendingBundle(ref) {
+    return this.bundles.get(ref) ?? null;
+  }
+  async deletePendingBundle(ref) {
+    this.bundles.delete(ref);
+  }
+  /** @internal test-only */
+  _rawMainForTest(identityId, channelId) {
+    const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(identityId, channelId);
+    return row?.sealed_main;
+  }
+  close() {
+    this.db.close();
+  }
+};
+
+// src/latency.ts
+var DEFAULT_CAPACITY = 1024;
+function round(n) {
+  return Math.round(n * 100) / 100;
+}
+function percentile(sorted, p) {
+  if (sorted.length === 0) return 0;
+  const rank = Math.ceil(p / 100 * sorted.length);
+  const idx = Math.min(Math.max(rank, 1), sorted.length) - 1;
+  return sorted[idx];
+}
+var LatencyRecorder = class {
+  capacity;
+  // Per-stage ring buffer of recent samples (ms).
+  buffers = /* @__PURE__ */ new Map();
+  // Write cursor per stage (for the ring buffer wrap).
+  cursors = /* @__PURE__ */ new Map();
+  constructor(opts = {}) {
+    this.capacity = opts.capacity ?? DEFAULT_CAPACITY;
+  }
+  /** Record a single sample (ms) for a stage. O(1). */
+  record(stage, ms) {
+    let buf = this.buffers.get(stage);
+    if (!buf) {
+      buf = [];
+      this.buffers.set(stage, buf);
+      this.cursors.set(stage, 0);
+    }
+    if (buf.length < this.capacity) {
+      buf.push(ms);
+    } else {
+      const cur = this.cursors.get(stage) ?? 0;
+      buf[cur] = ms;
+      this.cursors.set(stage, (cur + 1) % this.capacity);
+    }
+  }
+  /**
+   * Time an async fn, record its elapsed wall time under `stage`, return its
+   * value. Records even when the fn throws (the failure still consumed time),
+   * then re-throws — so a thrown error never loses the timing sample.
+   */
+  async time(stage, fn) {
+    const start = performance.now();
+    try {
+      return await fn();
+    } finally {
+      this.record(stage, performance.now() - start);
+    }
+  }
+  /** Percentile snapshot per stage. Rounded to 2 decimals (ms). */
+  snapshot() {
+    const out = {};
+    for (const [stage, buf] of this.buffers) {
+      if (buf.length === 0) continue;
+      const sorted = [...buf].sort((a, b) => a - b);
+      const sum = sorted.reduce((acc, n) => acc + n, 0);
+      out[stage] = {
+        count: sorted.length,
+        p50: round(percentile(sorted, 50)),
+        p95: round(percentile(sorted, 95)),
+        p99: round(percentile(sorted, 99)),
+        max: round(sorted[sorted.length - 1]),
+        mean: round(sum / sorted.length)
+      };
+    }
+    return out;
+  }
+};
+
+// src/coordination.ts
+function parseMentions(text) {
+  const mentions = [];
+  const re = /@(\w[\w]*)/gi;
+  let match;
+  while ((match = re.exec(text)) !== null) {
+    mentions.push(match[1].toLowerCase());
+  }
+  return mentions;
+}
+function ownRoomNames(agentName, accountId, roomDisplayName) {
+  const names = /* @__PURE__ */ new Set();
+  const add = (n) => {
+    if (!n) return;
+    const lower = n.toLowerCase();
+    names.add(lower);
+    names.add(lower.split(/[\s(]/)[0]);
+  };
+  add(agentName);
+  add(accountId);
+  add(roomDisplayName);
+  return names;
+}
+function shouldProcessRoomMessage(plaintext, agentName, accountId, opts) {
+  const mentions = parseMentions(plaintext);
+  if (mentions.length === 0) return true;
+  if (mentions.includes("all") || mentions.includes("everyone")) return true;
+  const ownNames = ownRoomNames(agentName, accountId, opts?.roomDisplayName);
+  if (mentions.some((m) => ownNames.has(m))) return true;
+  return false;
+}
+
+// src/rate-limit.ts
+var TokenBucketFloor = class {
+  capacity;
+  refillPerMs;
+  now;
+  buckets = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.capacity = opts.capacity;
+    this.refillPerMs = opts.refillPerMinute / 6e4;
+    this.now = opts.now ?? Date.now;
+  }
+  refill(key) {
+    const t = this.now();
+    let b = this.buckets.get(key);
+    if (!b) {
+      b = { tokens: this.capacity, lastRefill: t };
+      this.buckets.set(key, b);
+      return b;
+    }
+    const elapsed = t - b.lastRefill;
+    if (elapsed > 0) {
+      b.tokens = Math.min(this.capacity, b.tokens + elapsed * this.refillPerMs);
+      b.lastRefill = t;
+    }
+    return b;
+  }
+  /** Consume one token. Returns true if allowed, false if the bucket is empty. */
+  tryConsume(key) {
+    if (this.capacity <= 0) return true;
+    const b = this.refill(key);
+    if (b.tokens >= 1) {
+      b.tokens -= 1;
+      return true;
+    }
+    return false;
+  }
+  /** Milliseconds until one token is available (0 if already available). */
+  msUntilNextToken(key) {
+    if (this.capacity <= 0) return 0;
+    const b = this.refill(key);
+    if (b.tokens >= 1) return 0;
+    if (this.refillPerMs <= 0) return Infinity;
+    return Math.ceil((1 - b.tokens) / this.refillPerMs);
+  }
+};
+
+// src/bridge-agent.ts
+var DEFAULT_MAX_BUFFER = 1e3;
+var CHANNEL_META_TTL_MS = 5 * 6e4;
+var CHANNEL_ROSTER_TTL_MS = 5 * 6e4;
+var ZERO_TRACEPARENT = "00-" + "0".repeat(32) + "-" + "0".repeat(16) + "-01";
+var ChannelPendingError = class extends Error {
+  constructor(channelId) {
+    super(`channel ${channelId} is not yet admitted (awaiting Welcome)`);
+    this.channelId = channelId;
+    this.name = "ChannelPendingError";
+  }
+};
+var RateLimitedError = class extends Error {
+  constructor(channelId, retryAfterMs) {
+    super(`channel ${channelId} send rate limit exceeded (retry in ${retryAfterMs}ms)`);
+    this.channelId = channelId;
+    this.retryAfterMs = retryAfterMs;
+    this.name = "RateLimitedError";
+  }
+};
+var BRIDGE_VERSION = "0.0.0";
+function hexToBytes2(h) {
+  return new Uint8Array(Buffer.from(h, "hex"));
+}
+var BridgeAgent = class _BridgeAgent {
+  constructor(cfg, deps = {}) {
+    this.cfg = cfg;
+    const seed = hexToBytes2(cfg.signingPrivateKey);
+    this.custody = SoftwareKeyCustody.fromPrivateKey("ed25519", seed);
+    this.transport = deps.transport ?? new RestTransport({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey, connectIdentityId: cfg.identityId });
+    this.backend = deps.backend ?? new RestMlsBackend({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey });
+    this.store = new SqliteMlsStateStore({
+      dbPath: cfg.storePath,
+      identityId: cfg.identityId,
+      cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
+    });
+    this.provider = new MlsGroupKeyProvider({
+      store: this.store,
+      backend: this.backend,
+      deviceId: cfg.deviceId,
+      identity: new TextEncoder().encode(cfg.identityId),
+      // ADR-0002: count + log agent-side decrypt failures. Without this hook the
+      // daemon was 100% blind to a wedged channel (it "looked idle"); the
+      // provider's errorStats() snapshot is surfaced on GET /v1/metrics below.
+      onDecryptError: (row, err) => {
+        const cid = row.connect_channel_id ?? "(unmapped)";
+        console.warn(
+          `[bridge] decrypt error on channel ${cid} (queue ${row.queue_id}, epoch ${row.epoch}): ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    });
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.latency = deps.latency ?? new LatencyRecorder();
+    this.maxBuffer = deps.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    this.rateFloor = new TokenBucketFloor({
+      capacity: cfg.rateLimitCapacity ?? 20,
+      refillPerMinute: cfg.rateLimitRefillPerMinute ?? 20
+    });
+  }
+  transport;
+  provider;
+  backend;
+  // stored for peek-then-join in ingestOnce
+  custody;
+  fetchImpl;
+  joinState = /* @__PURE__ */ new Map();
+  /**
+   * Phase 2: lazy channel-metadata cache (channel_id → { is_dm, name, at }) used
+   * by the multi-agent room @mention filter at ingest. Populated/refreshed from a
+   * SINGLE listChannels() per ingest cycle on a cache miss. A channel that cannot
+   * be resolved (network error, or not present in the listing) stays UNKNOWN → the
+   * filter fails OPEN.
+   *
+   * `is_dm` is immutable for a given channel_id (no misclassification risk), so the
+   * TTL exists only to keep `name` fresh after a channel rename — an entry older
+   * than CHANNEL_META_TTL_MS is treated as a miss and re-resolved on the next cycle.
+   */
+  channelMeta = /* @__PURE__ */ new Map();
+  /**
+   * Phase 2 (sender attribution): per-channel roster cache
+   * (channel_id → identity_id → { name, is_agent }) resolved from the GET
+   * members endpoint. Same lazy/TTL/fail-soft discipline as channelMeta: an
+   * unresolved channel (network error, or no entry) leaves sender_name
+   * undefined and never blocks ingest. Resolved AT MOST ONCE per ingest cycle
+   * per channel on a miss.
+   */
+  channelRoster = /* @__PURE__ */ new Map();
+  buffer = [];
+  maxBuffer;
+  /** Cumulative count of messages shed by the buffer cap (surfaced on health()/metrics()). */
+  droppedMessages = 0;
+  /**
+   * Cumulative count of ROOM messages dropped by the @mention filter (item 3 /
+   * ADR-0002 ethos). Surfaced on health()/metrics() so an agent correctly filtering
+   * most room traffic is distinguishable from an idle/wedged one.
+   */
+  filteredRoomMessages = 0;
+  /** Cumulative count of sends shed by the per-channel rate-limit floor (surfaced on health()/metrics()). */
+  rateLimitedSends = 0;
+  /** Cumulative count of requestWelcome calls fired for no-local-state deliveries (self-heal signal). */
+  welcomeRequestsSent = 0;
+  /** Per-channel timestamp of last requestWelcome call, for cooldown enforcement. */
+  lastWelcomeRequest = /* @__PURE__ */ new Map();
+  /** Minimum gap between requestWelcome calls for the same channel (2 minutes). */
+  static REQUEST_WELCOME_COOLDOWN_MS = 12e4;
+  rateFloor;
+  waiters = [];
+  pingHandle;
+  safetyTimer;
+  listeners = /* @__PURE__ */ new Set();
+  startedAt = 0;
+  store;
+  latency;
+  /**
+   * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
+   *
+   * The buffer is uniformly ordered oldest→newest: ingestOnce() appends freshly
+   * decrypted inbound at the BACK (newest), and requeueFront() unshifts un-acked
+   * messages at the FRONT — those re-buffered messages were consumed earlier, so
+   * they are by definition OLDER than whatever already sits in the buffer. In
+   * every push path the newest messages therefore live at the back. To honour
+   * "the most-recent survive" we always shed from the FRONT, then record the
+   * shed so a silently-dropping daemon stays observable (item 3 / ADR-0002).
+   */
+  capBuffer() {
+    if (this.maxBuffer <= 0) return;
+    const overflow = this.buffer.length - this.maxBuffer;
+    if (overflow > 0) {
+      this.buffer.splice(0, overflow);
+      this.droppedMessages += overflow;
+    }
+  }
+  async start() {
+    this.startedAt = Date.now();
+    await this.provider.publishKeyPackage();
+    this.startReceivePump();
+  }
+  async reconcileJoin(channelId) {
+    if (this.joinState.get(channelId) === "JOINED") return true;
+    try {
+      await this.provider.joinAndReconcile(channelId, this.cfg.enclaveId);
+      this.joinState.set(channelId, "JOINED");
+      return true;
+    } catch {
+      this.joinState.set(channelId, "PENDING");
+      return false;
+    }
+  }
+  /**
+   * Per-channel send-floor check. No-op on allow; throws RateLimitedError on a
+   * trip (incrementing the observable counter). `kind` namespaces the bucket so
+   * room and a2a traffic on the same channel are tracked separately.
+   */
+  enforceRateFloor(kind, channelId) {
+    const key = `${kind}:${channelId}`;
+    if (!this.rateFloor.tryConsume(key)) {
+      this.rateLimitedSends++;
+      throw new RateLimitedError(channelId, this.rateFloor.msUntilNextToken(key));
+    }
+  }
+  async send(channelId, text, messageId) {
+    const meta = this.freshMeta(channelId);
+    if (meta && !meta.is_dm) this.enforceRateFloor("room", channelId);
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    const id = messageId ?? crypto.randomUUID();
+    const sendStart = performance.now();
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => this.latency.time(
+        "send.encrypt",
+        () => buildOutboundEnvelope({
+          custody: this.custody,
+          groupKey: this.provider,
+          messageId: id,
+          channelId,
+          enclaveId: this.cfg.enclaveId,
+          senderId: this.cfg.identityId,
+          senderType: "agent",
+          type: "text",
+          bodyPlaintext: JSON.stringify({ text }),
+          bindingId: "",
+          bindingVersion: "0.0.0",
+          agentSkillId: null,
+          epoch,
+          traceparent: ZERO_TRACEPARENT,
+          references: [],
+          stage5Outcome: "allow",
+          stage5Evaluators: []
+        })
+      ),
+      (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
+    );
+    this.latency.record("send.total", performance.now() - sendStart);
+    return { message_id: id, status: "sent" };
+  }
+  async sendA2A(channelId, a2a, messageId) {
+    this.enforceRateFloor("a2a", channelId);
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    const id = messageId ?? crypto.randomUUID();
+    const sendStart = performance.now();
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => this.latency.time(
+        "send.encrypt",
+        () => buildOutboundEnvelope({
+          custody: this.custody,
+          groupKey: this.provider,
+          messageId: id,
+          channelId,
+          enclaveId: this.cfg.enclaveId,
+          senderId: this.cfg.identityId,
+          senderType: "agent",
+          type: "a2a",
+          bodyPlaintext: JSON.stringify({ type: "a2a", a2a_version: a2a.a2a_version, kind: a2a.kind, object: a2a.object }),
+          bindingId: "",
+          bindingVersion: "0.0.0",
+          agentSkillId: null,
+          epoch,
+          traceparent: ZERO_TRACEPARENT,
+          references: [],
+          stage5Outcome: "allow",
+          stage5Evaluators: []
+        })
+      ),
+      (envelope) => this.latency.time("send.publish", () => this.transport.publish(envelope))
+    );
+    this.latency.record("send.total", performance.now() - sendStart);
+    return { message_id: id, status: "sent" };
+  }
+  async listChannels() {
+    const url = `${this.cfg.apiBase}/api/v1/enclaves/${this.cfg.enclaveId}/channels?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+    const res = await this.fetchImpl(url, {
+      headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+    });
+    if (!res.ok) throw new Error(`list_channels failed: ${res.status}`);
+    const rows = await res.json();
+    return rows.map((r) => ({
+      channel_id: r.channel_id,
+      name: r.name ?? null,
+      is_dm: r.is_dm,
+      joined: true
+    }));
+  }
+  /** A live channelMeta entry, or undefined if missing OR expired past the TTL. */
+  freshMeta(channelId) {
+    const hit = this.channelMeta.get(channelId);
+    if (!hit) return void 0;
+    if (Date.now() - hit.at >= CHANNEL_META_TTL_MS) return void 0;
+    return { is_dm: hit.is_dm, name: hit.name };
+  }
+  /**
+   * One-shot, whole-listing refresh of channelMeta. Called AT MOST ONCE per
+   * ingest cycle (the caller guards with a cycle-local "refreshed" flag), so a
+   * burst of K unknown channels fires a single listChannels() instead of K. Any
+   * listChannels failure is swallowed (UNKNOWN → fail open) so ingest never
+   * blocks on the network.
+   */
+  async refreshChannelMeta() {
+    try {
+      const now = Date.now();
+      const channels = await this.listChannels();
+      for (const c of channels) {
+        this.channelMeta.set(c.channel_id, { is_dm: c.is_dm, name: c.name, at: now });
+      }
+    } catch {
+    }
+  }
+  /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
+  freshRoster(channelId) {
+    const hit = this.channelRoster.get(channelId);
+    if (!hit) return void 0;
+    if (Date.now() - hit.at >= CHANNEL_ROSTER_TTL_MS) return void 0;
+    return hit.members;
+  }
+  /**
+   * Resolve one channel's roster (members + display names + is-agent) from the
+   * GET members endpoint into the roster cache. Called AT MOST ONCE per ingest
+   * cycle per channel on a cache miss. Fail-soft: any error leaves the cache
+   * as-is so the affected senders stay unresolved (sender_name undefined) —
+   * attribution must NEVER block or drop a message.
+   */
+  async refreshChannelRoster(channelId) {
+    try {
+      const url = `${this.cfg.apiBase}/api/v1/channels/${encodeURIComponent(
+        channelId
+      )}/members?caller_identity_id=${encodeURIComponent(this.cfg.identityId)}`;
+      const res = await this.fetchImpl(url, {
+        headers: { authorization: `Bearer ${this.cfg.apiKey}` }
+      });
+      if (!res.ok) return;
+      const rows = await res.json();
+      const members = /* @__PURE__ */ new Map();
+      for (const r of rows) {
+        members.set(r.identity_id, { name: r.display_name, is_agent: r.is_agent });
+      }
+      this.channelRoster.set(channelId, { members, at: Date.now() });
+    } catch {
+    }
+  }
+  async reportStatus(channelId, state, detail) {
+    const joined = await this.reconcileJoin(channelId);
+    if (!joined) throw new ChannelPendingError(channelId);
+    await sendWithSelfHeal(
+      this.provider,
+      channelId,
+      (epoch) => buildOutboundEnvelope({
+        custody: this.custody,
+        groupKey: this.provider,
+        messageId: crypto.randomUUID(),
+        channelId,
+        enclaveId: this.cfg.enclaveId,
+        senderId: this.cfg.identityId,
+        senderType: "agent",
+        type: "system_event",
+        bodyPlaintext: JSON.stringify({
+          v: 1,
+          type: "agent_status",
+          state,
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          ...detail ? { detail } : {}
+        }),
+        bindingId: "",
+        bindingVersion: "0.0.0",
+        agentSkillId: null,
+        epoch,
+        traceparent: ZERO_TRACEPARENT,
+        references: [],
+        stage5Outcome: "allow",
+        stage5Evaluators: []
+      }),
+      (envelope) => this.transport.publish(envelope)
+    );
+  }
+  startReceivePump() {
+    const sub = this.transport.subscribeDeliveryPings("");
+    this.pingHandle = { close: sub.close };
+    void (async () => {
+      try {
+        for await (const _ping of sub.pings) {
+          await this.ingestOnce();
+        }
+      } catch {
+      }
+    })();
+    this.safetyTimer = setInterval(() => {
+      void this.ingestOnce();
+    }, 25e3);
+  }
+  async ingestOnce() {
+    const cycleStart = performance.now();
+    try {
+      const rows = await this.latency.time("recv.pull", () => this.backend.pullDelivery(this.cfg.deviceId));
+      const channelIds = /* @__PURE__ */ new Set();
+      for (const row of rows) {
+        if (row.connect_channel_id) channelIds.add(row.connect_channel_id);
+      }
+      for (const cid of channelIds) {
+        if (this.joinState.get(cid) !== "JOINED") {
+          await this.reconcileJoin(cid);
+        }
+      }
+      for (const row of rows) {
+        const cid = row.connect_channel_id;
+        const gid = row.group_id;
+        if (!cid || !gid) continue;
+        if (await this.provider.hasPersistedChannelState(cid)) continue;
+        const now = performance.now();
+        const last = this.lastWelcomeRequest.get(cid) ?? -Infinity;
+        if (now - last < _BridgeAgent.REQUEST_WELCOME_COOLDOWN_MS) continue;
+        this.lastWelcomeRequest.set(cid, now);
+        try {
+          await this.backend.requestWelcome(gid, this.cfg.deviceId);
+          this.welcomeRequestsSent++;
+        } catch {
+        }
+      }
+    } catch {
+    }
+    let entries;
+    try {
+      entries = await this.latency.time("recv.decrypt", () => this.provider.receiveOnce(this.cfg.deviceId));
+    } catch {
+      return;
+    }
+    if (!entries.length) return;
+    let metaRefreshed = false;
+    if (entries.some((m) => this.freshMeta(m.channelId) === void 0)) {
+      await this.refreshChannelMeta();
+      metaRefreshed = true;
+    }
+    const rosterRefreshed = /* @__PURE__ */ new Set();
+    for (const m of entries) {
+      if (rosterRefreshed.has(m.channelId)) continue;
+      rosterRefreshed.add(m.channelId);
+      if (this.freshRoster(m.channelId) === void 0) {
+        await this.refreshChannelRoster(m.channelId);
+      }
+    }
+    const acked = [];
+    for (const m of entries) {
+      try {
+        const parsed = JSON.parse(
+          new TextDecoder().decode(m.plaintext)
+        );
+        if (parsed.type && parsed.type !== "text") {
+          acked.push(m.queueId);
+          continue;
+        }
+        if (typeof parsed.text === "string") {
+          const meta = this.freshMeta(m.channelId);
+          const senderType = m.envelope.sender_type;
+          const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
+          let shouldBuffer = true;
+          if (meta && meta.is_dm === false) {
+            shouldBuffer = shouldProcessRoomMessage(
+              parsed.text,
+              this.cfg.agentName ?? this.cfg.identityId,
+              this.cfg.identityId,
+              { senderIsAgent, roomDisplayName: meta.name ?? void 0 }
+            );
+            if (!shouldBuffer) this.filteredRoomMessages++;
+          }
+          if (shouldBuffer) {
+            const senderName = this.freshRoster(m.channelId)?.get(
+              m.envelope.sender_id
+            )?.name;
+            this.buffer.push({
+              channel_id: m.channelId,
+              message_id: m.messageId,
+              sender_id: m.envelope.sender_id,
+              text: parsed.text,
+              ts: m.receivedAt,
+              sender_name: senderName,
+              sender_is_agent: senderIsAgent
+            });
+            this.capBuffer();
+          }
+        }
+        acked.push(m.queueId);
+      } catch {
+        acked.push(m.queueId);
+      }
+    }
+    if (acked.length) {
+      try {
+        await this.latency.time("recv.ack", () => this.provider.ackDelivery(this.cfg.deviceId, acked));
+      } catch {
+      }
+    }
+    this.latency.record("recv.cycle", performance.now() - cycleStart);
+    if (this.buffer.length) {
+      for (const l of this.listeners) l();
+      const w = this.waiters.splice(0);
+      for (const r of w) r();
+    }
+  }
+  async drain(channelId, waitSeconds) {
+    let got = this.takeBuffered(channelId);
+    if (got.length || waitSeconds <= 0) return got;
+    const cap = Math.min(waitSeconds, 50) * 1e3;
+    await new Promise((resolve2) => {
+      let fired = false;
+      let timer;
+      const wake = () => {
+        if (fired) return;
+        fired = true;
+        clearTimeout(timer);
+        const i = this.waiters.indexOf(wake);
+        if (i >= 0) this.waiters.splice(i, 1);
+        resolve2();
+      };
+      timer = setTimeout(wake, cap);
+      this.waiters.push(wake);
+    });
+    return this.takeBuffered(channelId);
+  }
+  /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
+  takeBuffered(channelId) {
+    if (channelId === void 0) return this.buffer.splice(0);
+    const keep = [];
+    const out = [];
+    for (const m of this.buffer) (m.channel_id === channelId ? out : keep).push(m);
+    this.buffer.length = 0;
+    this.buffer.push(...keep);
+    return out;
+  }
+  /**
+   * Put messages back at the front (SSE/disconnect write-failure recovery).
+   *
+   * The re-buffered messages are older un-acked deliveries, so they go at the
+   * FRONT (oldest). A large un-acked backlog re-buffered on reconnect is exactly
+   * the OOM case Phase 1 item 4 targets, so this path is capped too. capBuffer()
+   * sheds from the front, preserving the newest maxBuffer messages across the
+   * combined [requeued-older..., existing-newer...] buffer.
+   */
+  requeueFront(msgs) {
+    if (msgs.length) {
+      this.buffer.unshift(...msgs);
+      this.capBuffer();
+    }
+  }
+  /**
+   * Poke subscribers + waiters to drain the buffer now. Used after a
+   * disconnect re-buffers un-acked messages so a still-connected consumer
+   * (e.g. a replacement WS) redelivers them without waiting for new inbound.
+   * Mirrors the notify tail of ingestOnce.
+   */
+  wakeListeners() {
+    for (const l of this.listeners) l();
+    const w = this.waiters.splice(0);
+    for (const r of w) r();
+  }
+  health() {
+    let joined = 0;
+    for (const s of this.joinState.values()) if (s === "JOINED") joined++;
+    return {
+      status: "ok",
+      identity_id: this.cfg.identityId,
+      joined_channels: joined,
+      buffered: this.buffer.length,
+      dropped: this.droppedMessages,
+      filtered_room: this.filteredRoomMessages,
+      rate_limited: this.rateLimitedSends,
+      permanently_skipped: this.provider.permanentlySkippedCount(),
+      uptime_s: this.startedAt ? Math.floor((Date.now() - this.startedAt) / 1e3) : 0,
+      version: BRIDGE_VERSION
+    };
+  }
+  /**
+   * Loopback observability snapshot served at GET /v1/metrics.
+   *
+   * `stages`: per-stage SecureComs-envelope latency percentiles (ms), measured
+   * locally and monotonically — send.encrypt / send.publish / send.total (the
+   * sender half) and recv.pull / recv.decrypt / recv.ack / recv.cycle (the
+   * recipient half). Excludes the agent's LLM time entirely.
+   *
+   * `errors` (ADR-0002): per-channel decrypt-error / stuck snapshot from the MLS
+   * provider, so a wedged channel is OBSERVABLE here instead of looking idle. A
+   * channel appears only once it has had a decrypt error; `stuck:true` means
+   * repeated failures with no intervening successful decrypt.
+   *
+   * `dropped` (Phase 1 item 4): cumulative count of inbound messages shed by the
+   * bounded-buffer cap. A daemon silently dropping messages under backpressure is
+   * exactly the blindness ADR-0002 eliminates, so the shed is surfaced here (and
+   * on health()) rather than swallowed.
+   *
+   * `filteredRoomMessages` (item 3 / ADR-0002 ethos): cumulative ROOM messages
+   * dropped by the @mention filter. A silently-filtered room message produces no
+   * other signal, so an agent correctly filtering 95% of room traffic would look
+   * identical to an idle/wedged one without this counter.
+   *
+   * `permanentlySkipped` (ADR-0002 ethos): cumulative count of inbound rows
+   * acked-and-dropped because they were provably past-epoch undecryptable
+   * (forward-secrecy secret gone), so a self-healed poison row is observable
+   * here instead of silently dropped.
+   */
+  metrics() {
+    return {
+      stages: this.latency.snapshot(),
+      errors: this.provider.errorStats(),
+      dropped: this.droppedMessages,
+      filteredRoomMessages: this.filteredRoomMessages,
+      rateLimitedSends: this.rateLimitedSends,
+      permanentlySkipped: this.provider.permanentlySkippedCount(),
+      welcomeRequestsSent: this.welcomeRequestsSent
+    };
+  }
+  async close() {
+    this.pingHandle?.close();
+    if (this.safetyTimer) clearInterval(this.safetyTimer);
+    this.store.close();
+  }
+};
+
+// src/auth.ts
+import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+function resolveToken(opts) {
+  if (opts.token) return opts.token;
+  const f = opts.tokenFile;
+  if (f && existsSync(f)) return readFileSync2(f, "utf8").trim();
+  const tok = randomBytes3(32).toString("base64url");
+  if (f) writeFileSync(f, tok, { mode: 384 });
+  return tok;
+}
+function tokenMatches(provided, expected) {
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function bearerFrom(header) {
+  if (!header) return void 0;
+  const m = /^Bearer (.+)$/i.exec(header.trim());
+  return m ? m[1] : void 0;
+}
+function hostnameOf(hostHeader) {
+  if (!hostHeader) return void 0;
+  if (hostHeader.startsWith("[")) return hostHeader.slice(0, hostHeader.indexOf("]") + 1);
+  const i = hostHeader.lastIndexOf(":");
+  return i > 0 ? hostHeader.slice(0, i) : hostHeader;
+}
+function originHostAllowed(headers, allowOrigins) {
+  const host = hostnameOf(headers.host);
+  if (host && !isLoopback(host) && !isLoopback(`[${host}]`)) return false;
+  const origin = headers.origin;
+  if (!origin) return true;
+  if (allowOrigins.includes(origin)) return true;
+  try {
+    return isLoopback(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+}
+
+// src/http-server.ts
+import { createServer as createHttp } from "node:http";
+import { createServer as createHttps } from "node:https";
+import { z } from "zod";
+
+// src/errors.ts
+var BRIDGE_ERRORS = {
+  unauthorized: { http: 401, message: "missing or invalid bearer token" },
+  forbidden_origin: { http: 403, message: "origin or host not allowed" },
+  not_found: { http: 404, message: "no such route" },
+  invalid_request: { http: 400, message: "request failed validation" },
+  invalid_json: { http: 400, message: "request body is not valid JSON" },
+  body_too_large: { http: 400, message: "request body exceeds the size limit" },
+  channel_pending: { http: 503, message: "channel not yet admitted; retry shortly" },
+  rate_limited: { http: 429, message: "rate limit exceeded; retry shortly" },
+  internal: { http: 500, message: "internal error" }
+};
+function errorBody(code, detail) {
+  const body = { error: code, message: BRIDGE_ERRORS[code].message };
+  if (detail !== void 0) body.detail = detail;
+  return body;
+}
+function httpStatus(code) {
+  return BRIDGE_ERRORS[code].http;
+}
+function wsErrorFrame(code, detail) {
+  return { type: "error", ...errorBody(code, detail) };
+}
+
+// src/http-server.ts
+function writeSse(res, msgs) {
+  for (let i = 0; i < msgs.length; i++) {
+    if (res.destroyed || res.writableEnded) return msgs.slice(i);
+    try {
+      res.write(`event: message
+data: ${JSON.stringify(msgs[i])}
+
+`);
+    } catch {
+      return msgs.slice(i);
+    }
+  }
+  return [];
+}
+function capabilities(opts) {
+  return {
+    api_version: "1",
+    receive_modes: ["longpoll", "sse", ...opts.websocket ? ["websocket"] : []],
+    send_types: ["text", "agent_status", "a2a"],
+    webhook_push: false
+    // B3: A2A-style push-notification config (ciphertext/wake-only)
+  };
+}
+var SEND_CAP = 64 * 1024;
+var OTHER_CAP = 8 * 1024;
+var a2aSchema = z.object({
+  a2a_version: z.string().min(1),
+  kind: z.enum(["message", "task", "artifact"]),
+  object: z.record(z.unknown())
+});
+var sendSchema = z.object({
+  channel_id: z.string().min(1),
+  text: z.string().optional(),
+  idempotency_key: z.string().optional(),
+  a2a: a2aSchema.optional()
+}).refine((d) => typeof d.text === "string" || d.a2a !== void 0, {
+  message: "send requires either text or a2a"
+});
+var statusSchema = z.object({
+  channel_id: z.string().min(1),
+  state: z.enum(["idle", "working", "stalled", "error"]),
+  detail: z.string().optional()
+});
+function json(res, status, body) {
+  const s = JSON.stringify(body);
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(s);
+}
+function jsonError(res, code, detail) {
+  json(res, httpStatus(code), errorBody(code, detail));
+}
+function readBody(req, cap) {
+  return new Promise((resolve2, reject) => {
+    let size = 0;
+    let done = false;
+    const chunks = [];
+    const onData = (c) => {
+      if (done) return;
+      size += c.length;
+      if (size > cap) {
+        done = true;
+        req.removeListener("data", onData);
+        req.pause();
+        reject(new Error("body_too_large"));
+        return;
+      }
+      chunks.push(c);
+    };
+    req.on("data", onData);
+    req.on("end", () => {
+      if (!done) {
+        done = true;
+        resolve2(Buffer.concat(chunks).toString("utf8"));
+      }
+    });
+    req.on("error", (e) => {
+      if (!done) {
+        done = true;
+        reject(e);
+      }
+    });
+  });
+}
+function createHttpServer(agent, opts) {
+  let closeSse = () => {
+  };
+  let sse = null;
+  const tearDownSse = () => {
+    if (!sse) return;
+    sse.unsubscribe();
+    clearInterval(sse.keepalive);
+    try {
+      sse.res.end();
+    } catch {
+    }
+    sse = null;
+  };
+  closeSse = tearDownSse;
+  const handler = async (req, res) => {
+    try {
+      const url = new URL(req.url ?? "/", "http://localhost");
+      const path = url.pathname;
+      const method = req.method ?? "GET";
+      if (method === "GET" && path === "/healthz") {
+        return json(res, 200, { ...agent.health(), capabilities: capabilities(opts) });
+      }
+      if (!tokenMatches(bearerFrom(req.headers.authorization), opts.token)) {
+        return jsonError(res, "unauthorized");
+      }
+      if (!originHostAllowed({ origin: req.headers.origin, host: req.headers.host }, opts.allowOrigins)) {
+        return jsonError(res, "forbidden_origin");
+      }
+      if (method === "GET" && path === "/v1/channels") {
+        return json(res, 200, await agent.listChannels());
+      }
+      if (method === "GET" && path === "/v1/metrics") {
+        return json(res, 200, agent.metrics());
+      }
+      if (method === "POST" && path === "/v1/send") {
+        const parsed = sendSchema.safeParse(JSON.parse(await readBody(req, SEND_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        const r = parsed.data.a2a ? await agent.sendA2A(parsed.data.channel_id, parsed.data.a2a, parsed.data.idempotency_key) : await agent.send(parsed.data.channel_id, parsed.data.text, parsed.data.idempotency_key);
+        return json(res, 200, r);
+      }
+      if (method === "POST" && path === "/v1/status") {
+        const parsed = statusSchema.safeParse(JSON.parse(await readBody(req, OTHER_CAP)));
+        if (!parsed.success) return jsonError(res, "invalid_request", parsed.error.issues);
+        await agent.reportStatus(parsed.data.channel_id, parsed.data.state, parsed.data.detail);
+        return json(res, 200, { ok: true });
+      }
+      if (method === "GET" && path === "/v1/messages") {
+        const channel = url.searchParams.get("channel_id") ?? void 0;
+        const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
+        return json(res, 200, await agent.drain(channel, wait));
+      }
+      if (method === "GET" && path === "/v1/events") {
+        const channel = url.searchParams.get("channel_id") ?? void 0;
+        tearDownSse();
+        res.writeHead(200, {
+          "content-type": "text/event-stream",
+          "cache-control": "no-cache",
+          connection: "keep-alive"
+        });
+        res.write(":connected\n\n");
+        const drainToClient = () => {
+          const left = writeSse(res, agent.takeBuffered(channel));
+          if (left.length) agent.requeueFront(left);
+        };
+        const unsubscribe = agent.subscribe(drainToClient);
+        const keepalive = setInterval(() => {
+          try {
+            res.write(":keepalive\n\n");
+          } catch {
+          }
+        }, 15e3);
+        sse = { res, unsubscribe, keepalive };
+        drainToClient();
+        req.on("close", () => {
+          if (sse?.res === res) tearDownSse();
+        });
+        return;
+      }
+      return jsonError(res, "not_found");
+    } catch (e) {
+      if (e.message === "body_too_large") {
+        if (!res.headersSent) {
+          res.writeHead(httpStatus("body_too_large"), { "content-type": "application/json", connection: "close" });
+        }
+        res.end(JSON.stringify(errorBody("body_too_large")));
+        return;
+      }
+      if (e instanceof ChannelPendingError) return jsonError(res, "channel_pending");
+      if (e instanceof RateLimitedError) return jsonError(res, "rate_limited");
+      if (e instanceof SyntaxError) return jsonError(res, "invalid_json");
+      process.stderr.write(`[bridge] request error: ${e?.message ?? e}
+`);
+      return jsonError(res, "internal");
+    }
+  };
+  const server = opts.tls ? createHttps({ cert: opts.tls.cert, key: opts.tls.key }, (req, res) => void handler(req, res)) : createHttp((req, res) => void handler(req, res));
+  return { server, closeAllSseStreams: () => closeSse() };
+}
+
+// src/ws-server.ts
+import { WebSocketServer, WebSocket } from "ws";
+var PING_INTERVAL_MS = 3e4;
+function tokenFromUpgrade(req) {
+  try {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const q = url.searchParams.get("token");
+    if (q) return q;
+  } catch {
+  }
+  return bearerFrom(req.headers.authorization);
+}
+function authedUpgrade(req, opts) {
+  if (!tokenMatches(tokenFromUpgrade(req), opts.token)) return false;
+  if (!originHostAllowed({ origin: req.headers.origin, host: req.headers.host }, opts.allowOrigins)) {
+    return false;
+  }
+  return true;
+}
+function attachAgentWebSocket(server, agent, opts) {
+  const wss = new WebSocketServer({ server, path: "/v1/ws" });
+  const keepalive = setInterval(() => {
+    for (const client of wss.clients) {
+      const sock = client;
+      if (sock.isAlive === false) {
+        sock.terminate();
+        continue;
+      }
+      sock.isAlive = false;
+      try {
+        sock.ping();
+      } catch {
+      }
+    }
+  }, PING_INTERVAL_MS);
+  if (typeof keepalive.unref === "function") keepalive.unref();
+  let current = null;
+  wss.on("connection", (sock, req) => {
+    if (!authedUpgrade(req, opts)) {
+      sock.close(1008, "unauthorized");
+      return;
+    }
+    if (current && current.sock !== sock) {
+      const prior = current;
+      if (prior.sock.readyState === WebSocket.OPEN) {
+        prior.sock.close(1e3, "replaced by newer connection");
+      }
+      prior.cleanup();
+    }
+    sock.isAlive = true;
+    sock.on("pong", () => {
+      sock.isAlive = true;
+    });
+    const inflight = /* @__PURE__ */ new Map();
+    const flush = () => {
+      if (sock.readyState !== WebSocket.OPEN) return;
+      const batch = agent.takeBuffered();
+      for (let i = 0; i < batch.length; i++) {
+        if (sock.readyState !== WebSocket.OPEN) {
+          agent.requeueFront(batch.slice(i));
+          return;
+        }
+        const frame = { type: "message", ...batch[i] };
+        try {
+          sock.send(JSON.stringify(frame));
+          inflight.set(batch[i].message_id, batch[i]);
+        } catch {
+          agent.requeueFront(batch.slice(i));
+          return;
+        }
+      }
+    };
+    const unsubscribe = agent.subscribe(flush);
+    let cleaned = false;
+    const cleanup = () => {
+      if (cleaned) return;
+      cleaned = true;
+      unsubscribe();
+      if (inflight.size) {
+        agent.requeueFront([...inflight.values()]);
+        inflight.clear();
+        agent.wakeListeners();
+      }
+      if (current?.sock === sock) current = null;
+    };
+    current = { sock, cleanup };
+    sock.on("close", cleanup);
+    sock.on("error", cleanup);
+    sock.on("message", (data) => {
+      void handleInbound(sock, agent, data, inflight);
+    });
+    flush();
+  });
+  return {
+    close() {
+      clearInterval(keepalive);
+      for (const client of wss.clients) {
+        try {
+          client.terminate();
+        } catch {
+        }
+      }
+      wss.close();
+    }
+  };
+}
+function sendJson(sock, body) {
+  if (sock.readyState !== WebSocket.OPEN) return;
+  try {
+    sock.send(JSON.stringify(body));
+  } catch {
+  }
+}
+async function handleInbound(sock, agent, data, inflight) {
+  let msg;
+  try {
+    msg = JSON.parse(data.toString("utf8"));
+  } catch {
+    sendJson(sock, wsErrorFrame("invalid_request"));
+    return;
+  }
+  if (typeof msg !== "object" || msg === null) {
+    sendJson(sock, wsErrorFrame("invalid_request"));
+    return;
+  }
+  const m = msg;
+  if (m.type === "ack") {
+    if (typeof m.message_id !== "string" || !m.message_id) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    inflight.delete(m.message_id);
+    return;
+  }
+  if (m.type === "send") {
+    if (typeof m.channel_id !== "string" || !m.channel_id) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    if (m.a2a && typeof m.a2a === "object") {
+      const a = m.a2a;
+      if (typeof a.a2a_version !== "string" || !a.a2a_version || a.kind !== "message" && a.kind !== "task" && a.kind !== "artifact" || typeof a.object !== "object" || a.object === null) {
+        sendJson(sock, wsErrorFrame("invalid_request"));
+        return;
+      }
+      try {
+        const r = await agent.sendA2A(m.channel_id, { a2a_version: a.a2a_version, kind: a.kind, object: a.object });
+        sendJson(sock, { type: "sent", message_id: r.message_id });
+      } catch (e) {
+        if (e instanceof ChannelPendingError) {
+          sendJson(sock, wsErrorFrame("channel_pending"));
+        } else if (e instanceof RateLimitedError) {
+          sendJson(sock, wsErrorFrame("rate_limited"));
+        } else {
+          sendJson(sock, wsErrorFrame("invalid_request"));
+        }
+      }
+      return;
+    }
+    if (typeof m.text !== "string" || !m.text) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    const idempotencyKey = typeof m.idempotency_key === "string" ? m.idempotency_key : void 0;
+    try {
+      const r = await agent.send(m.channel_id, m.text, idempotencyKey);
+      sendJson(sock, { type: "sent", message_id: r.message_id });
+    } catch (e) {
+      if (e instanceof ChannelPendingError) {
+        sendJson(sock, wsErrorFrame("channel_pending"));
+      } else if (e instanceof RateLimitedError) {
+        sendJson(sock, wsErrorFrame("rate_limited"));
+      } else {
+        sendJson(sock, wsErrorFrame("invalid_request"));
+      }
+    }
+    return;
+  }
+  if (m.type === "status") {
+    const states = ["idle", "working", "stalled", "error"];
+    if (typeof m.channel_id !== "string" || !m.channel_id || typeof m.state !== "string" || !states.includes(m.state)) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    const detail = typeof m.detail === "string" ? m.detail : void 0;
+    try {
+      await agent.reportStatus(m.channel_id, m.state, detail);
+      sendJson(sock, { type: "ok" });
+    } catch (e) {
+      if (e instanceof ChannelPendingError) {
+        sendJson(sock, wsErrorFrame("channel_pending"));
+      } else if (e instanceof RateLimitedError) {
+        sendJson(sock, wsErrorFrame("rate_limited"));
+      } else {
+        sendJson(sock, wsErrorFrame("invalid_request"));
+      }
+    }
+    return;
+  }
+  sendJson(sock, wsErrorFrame("invalid_request"));
+}
+
+// src/bin.ts
+import { readFileSync as readFileSync3, mkdirSync, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync2, realpathSync } from "node:fs";
+import { join as join3, dirname as dirname4 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir, userInfo } from "node:os";
+import { spawnSync } from "node:child_process";
+
+// src/service/install.ts
+import { dirname as dirname2 } from "node:path";
+
+// src/service/config.ts
+import { basename, extname, isAbsolute, resolve } from "node:path";
+function slugify(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "agent";
+}
+function deriveServiceConfig(input) {
+  const stem = input.label ?? basename(input.credentialPath, extname(input.credentialPath));
+  const slug = slugify(stem);
+  const cred = isAbsolute(input.credentialPath) ? input.credentialPath : resolve(input.credentialPath);
+  const args2 = ["--credential", cred];
+  if (input.storePath) args2.push("--store", isAbsolute(input.storePath) ? input.storePath : resolve(input.storePath));
+  if (input.port != null) args2.push("--port", String(input.port));
+  return {
+    slug,
+    label: `com.securecoms.bridge.${slug}`,
+    unitName: `securecoms-bridge-${slug}`,
+    args: args2,
+    execPath: input.execPath,
+    binScript: input.binScript,
+    uid: input.uid,
+    plistPath: `${input.home}/Library/LaunchAgents/com.securecoms.bridge.${slug}.plist`,
+    unitPath: `${input.home}/.config/systemd/user/securecoms-bridge-${slug}.service`,
+    logPath: `${input.home}/Library/Logs/securecoms-bridge-${slug}.log`
+  };
+}
+
+// src/service/launchd.ts
+function renderLaunchdPlist(cfg) {
+  const argv = [cfg.execPath, cfg.binScript, ...cfg.args];
+  const programArgs = argv.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${cfg.label}</string>
+  <key>ProgramArguments</key>
+  <array>
+${programArgs}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(cfg.logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(cfg.logPath)}</string>
+</dict>
+</plist>
+`;
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+// src/service/systemd.ts
+function sdQuote(s) {
+  return s.includes(" ") || s.includes('"') ? `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : s;
+}
+function renderSystemdUnit(cfg) {
+  const execStart = [cfg.execPath, cfg.binScript, ...cfg.args].map(sdQuote).join(" ");
+  return `[Unit]
+Description=SecureComs agent bridge (${cfg.slug})
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+// src/service/install.ts
+var ServiceUnsupportedError = class extends Error {
+};
+function tokenHint(input) {
+  return `${dirname2(input.credentialPath)}/bridge-token`;
+}
+function requireOk(r, what) {
+  if (r.status !== 0) throw new Error(`${what} failed (exit ${r.status})${r.stderr ? `: ${r.stderr.trim()}` : ""}`);
+}
+function installService(input, deps) {
+  const cfg = deriveServiceConfig(input);
+  if (deps.platform === "darwin") {
+    deps.mkdirp(dirname2(cfg.plistPath));
+    deps.mkdirp(dirname2(cfg.logPath));
+    deps.writeFile(cfg.plistPath, renderLaunchdPlist(cfg));
+    deps.run("launchctl", ["bootout", `gui/${cfg.uid}/${cfg.label}`]);
+    requireOk(deps.run("launchctl", ["bootstrap", `gui/${cfg.uid}`, cfg.plistPath]), "launchctl bootstrap");
+    deps.run("launchctl", ["enable", `gui/${cfg.uid}/${cfg.label}`]);
+    requireOk(deps.run("launchctl", ["kickstart", "-k", `gui/${cfg.uid}/${cfg.label}`]), "launchctl kickstart");
+    return { label: cfg.label, filePath: cfg.plistPath, logHint: cfg.logPath, tokenHint: tokenHint(input) };
+  }
+  if (deps.platform === "linux") {
+    deps.mkdirp(dirname2(cfg.unitPath));
+    deps.writeFile(cfg.unitPath, renderSystemdUnit(cfg));
+    deps.run("systemctl", ["--user", "daemon-reload"]);
+    deps.run("loginctl", ["enable-linger", deps.user]);
+    requireOk(deps.run("systemctl", ["--user", "enable", "--now", cfg.unitName]), "systemctl --user enable --now");
+    return { label: cfg.unitName, filePath: cfg.unitPath, logHint: `journalctl --user -u ${cfg.unitName} -f`, tokenHint: tokenHint(input) };
+  }
+  throw new ServiceUnsupportedError(`Service install isn't supported on ${deps.platform} yet. Run the agent in a terminal, or use a process manager.`);
+}
+function uninstallService(input, deps) {
+  const cfg = deriveServiceConfig(input);
+  if (deps.platform === "darwin") {
+    const existed = deps.fileExists(cfg.plistPath);
+    deps.run("launchctl", ["bootout", `gui/${cfg.uid}/${cfg.label}`]);
+    if (existed) deps.removeFile(cfg.plistPath);
+    return { removed: existed, filePath: cfg.plistPath };
+  }
+  if (deps.platform === "linux") {
+    const existed = deps.fileExists(cfg.unitPath);
+    deps.run("systemctl", ["--user", "disable", "--now", cfg.unitName]);
+    if (existed) deps.removeFile(cfg.unitPath);
+    deps.run("systemctl", ["--user", "daemon-reload"]);
+    return { removed: existed, filePath: cfg.unitPath };
+  }
+  throw new ServiceUnsupportedError(`Service uninstall isn't supported on ${deps.platform} yet.`);
+}
+
+// src/service/resolve-bin.ts
+import { join as join2, dirname as dirname3 } from "node:path";
+import { createRequire } from "node:module";
+var GlobalInstallPermissionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GlobalInstallPermissionError";
+  }
+};
+function isEphemeralPath(p) {
+  return /[\\/]_npx[\\/]/.test(p);
+}
+function refersToSameFile(a, b, realpath) {
+  if (a === b) return true;
+  try {
+    return realpath(a) === realpath(b);
+  } catch {
+    return false;
+  }
+}
+function resolveStableBinScript(input, deps) {
+  const ephemeral = isEphemeralPath(input.binScript);
+  if (!ephemeral) {
+    if (deps.fileExists(input.binScript)) return input.binScript;
+    throw new Error(`bin path does not exist and is not an npx cache path: ${input.binScript}`);
+  }
+  const pkgRoot = dirname3(dirname3(input.binScript));
+  const inst = deps.run("npm", ["i", "-g", pkgRoot, "--install-links"]);
+  if (inst.status !== 0) {
+    if (/EACCES|permission denied/i.test(inst.stderr)) {
+      throw new GlobalInstallPermissionError(
+        `Can't write the global npm prefix. Run this once, then re-run install:
+  npm i -g ${input.packageName}`
+      );
+    }
+    throw new Error(`npm i -g ${pkgRoot} failed (exit ${inst.status})${inst.stderr ? `: ${inst.stderr.trim()}` : ""}`);
+  }
+  const root = deps.run("npm", ["root", "-g"]);
+  if (root.status !== 0) throw new Error(`npm root -g failed (exit ${root.status})`);
+  const stable = join2(root.stdout.trim(), input.packageName, "dist", "bin.js");
+  if (!deps.fileExists(stable)) throw new Error(`global install did not produce ${stable}`);
+  return stable;
+}
+function loadPackageMeta(importMetaUrl) {
+  const require2 = createRequire(importMetaUrl);
+  const pkg = require2("../package.json");
+  return { name: pkg.name, version: pkg.version };
+}
+
+// src/bin.ts
+function nodeMajorOk(version) {
+  return Number(version.split(".")[0]) >= 24;
+}
+function argOrEnv(flag, env) {
+  const i = process.argv.indexOf(flag);
+  if (i >= 0 && process.argv[i + 1]) return process.argv[i + 1];
+  return process.env[env];
+}
+function parseVerb(argv) {
+  const v = argv[2];
+  return v === "install" || v === "uninstall" ? v : null;
+}
+function realServiceDeps() {
+  return {
+    platform: process.platform,
+    run: (cmd, args2) => {
+      const r = spawnSync(cmd, args2, { encoding: "utf8" });
+      return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    },
+    writeFile: (p, data) => writeFileSync2(p, data, { mode: 420 }),
+    removeFile: (p) => rmSync(p, { force: true }),
+    mkdirp: (p) => mkdirSync(p, { recursive: true }),
+    fileExists: (p) => existsSync2(p),
+    user: userInfo().username
+  };
+}
+function realResolveDeps() {
+  return {
+    run: (cmd, args2) => {
+      const r = spawnSync(cmd, args2, { encoding: "utf8" });
+      return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    },
+    fileExists: (p) => existsSync2(p)
+  };
+}
+function runServiceVerb(verb) {
+  const credentialPath = argOrEnv("--credential", "SECURECOMS_CREDENTIAL");
+  const label = argOrEnv("--label", "SECURECOMS_LABEL");
+  if (!credentialPath && !label) {
+    process.stderr.write(`usage: agent-bridge ${verb} --credential <path> [--label <name>] [--store <path>] [--port N]
+`);
+    process.exit(2);
+  }
+  const portStr = argOrEnv("--port", "SECURECOMS_PORT");
+  let binScript = process.argv[1];
+  if (verb === "install") {
+    const meta = loadPackageMeta(import.meta.url);
+    binScript = resolveStableBinScript({ binScript, packageName: meta.name }, realResolveDeps());
+  }
+  const input = {
+    credentialPath: credentialPath ?? "",
+    storePath: argOrEnv("--store", "SECURECOMS_STORE"),
+    port: portStr ? Number(portStr) : void 0,
+    label,
+    execPath: process.execPath,
+    binScript,
+    home: homedir(),
+    uid: userInfo().uid
+  };
+  try {
+    if (verb === "install") {
+      const r = installService(input, realServiceDeps());
+      process.stdout.write(`Installed service ${r.label}
+  file:  ${r.filePath}
+  logs:  ${r.logHint}
+  token: ${r.tokenHint} (the local BRIDGE_TOKEN)
+`);
+    } else {
+      const r = uninstallService(input, realServiceDeps());
+      process.stdout.write(r.removed ? `Removed service (${r.filePath})
+` : `No service installed for this agent
+`);
+    }
+    process.exit(0);
+  } catch (e) {
+    const raw = e instanceof ServiceUnsupportedError || e instanceof GlobalInstallPermissionError;
+    process.stderr.write(`${raw ? e.message : `service ${verb} failed: ${e.message ?? e}`}
+`);
+    process.exit(1);
+  }
+}
+async function main() {
+  if (!nodeMajorOk(process.versions.node)) {
+    process.stderr.write(`[bridge] fatal: Node ${process.versions.node} unsupported \u2014 requires >= 24 (node:sqlite stable API)
+`);
+    process.exit(1);
+  }
+  const verb = parseVerb(process.argv);
+  if (verb) {
+    runServiceVerb(verb);
+    return;
+  }
+  const credentialPath = argOrEnv("--credential", "SECURECOMS_CREDENTIAL");
+  if (!credentialPath) {
+    process.stderr.write("usage: connect-agent-bridge --credential <path> [--store <path>] [--port N] [--bind ADDR]\n   or: agent-bridge install|uninstall --credential <path>\n");
+    process.exit(2);
+  }
+  const storePath = argOrEnv("--store", "SECURECOMS_STORE");
+  let cfg, daemon;
+  try {
+    cfg = loadConfig({ credentialPath, storePath });
+    daemon = parseDaemonArgs(process.argv, process.env);
+    validateBind(daemon.bind, daemon.tls);
+  } catch (e) {
+    process.stderr.write(`[bridge] config error: ${e.message ?? e}
+`);
+    process.exit(1);
+  }
+  const tokenFile = daemon.tokenFile ?? join3(dirname4(credentialPath), "bridge-token");
+  const token = resolveToken({ tokenFile, token: daemon.token });
+  const agent = new BridgeAgent(cfg);
+  await agent.start();
+  const tls = daemon.tls ? { cert: readFileSync3(daemon.tlsCert, "utf8"), key: readFileSync3(daemon.tlsKey, "utf8") } : void 0;
+  const { server, closeAllSseStreams } = createHttpServer(agent, { token, allowOrigins: daemon.allowOrigins, tls, websocket: true });
+  const agentWs = attachAgentWebSocket(server, agent, { token, allowOrigins: daemon.allowOrigins });
+  let down = false;
+  const shutdown = () => {
+    if (down) return;
+    down = true;
+    agentWs.close();
+    server.close();
+    closeAllSseStreams();
+    void agent.close().finally(() => process.exit(0));
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  server.listen(daemon.port, daemon.bind, () => {
+    const scheme = tls ? "https" : "http";
+    const wsScheme = tls ? "wss" : "ws";
+    process.stderr.write(`[bridge] listening on ${scheme}://${daemon.bind}:${daemon.port} (agent WS at ${wsScheme}://${daemon.bind}:${daemon.port}/v1/ws)
+`);
+    process.stderr.write(`BRIDGE_TOKEN=${token}
+`);
+  });
+}
+var here = fileURLToPath(import.meta.url);
+var isMain = !!process.argv[1] && refersToSameFile(here, process.argv[1], realpathSync);
+if (isMain) {
+  main().catch((e) => {
+    process.stderr.write(`[bridge] fatal: ${e?.message ?? String(e)}
+`);
+    process.exit(1);
+  });
+}
+export {
+  nodeMajorOk,
+  parseVerb
+};