@sentropic/h2a-cli 0.26.3 → 0.28.0

package/dist/index.d.ts

@@ -1,11 +1,11 @@
 import { H2A_CLAUDE_HOST } from "./hosts/claude.js";
-import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe } from "./cli.js";
+import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush } from "./cli.js";
 import { H2A_CODEX_HOST } from "./hosts/codex.js";
 import { H2A_GEMINI_HOST } from "./hosts/gemini.js";
 import { H2A_AGY_HOST } from "./hosts/agy.js";
 import { H2A_CLI_MCP_TOOL_NAMES } from "./mcp.js";
 export type { H2AConfigurableHostDescriptor, H2AHostDescriptor, H2AHostWave, McpHostConfigSnippet, RenderMcpConfigOptions } from "./hosts/codex.js";
-export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe };
+export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush };
 export { H2A_CLI_VERB_CONTRACTS, H2A_CLI_VERB_CONTRACT_BY_VERB, type H2ACliExitCode, type H2ACliOutputShape, type H2ACliVerbContract } from "./cli-contract.js";
 export { H2A_STORE_SCHEMA_FILE, H2A_STORE_SCHEMA_VERSION, LockTimeoutError, StoreSchemaMismatchError, createLocalStore, deletePresence, inboxDir, listPresence, localStorePaths, negotiationDir, negotiationJournalFile, outboxDir, presenceFile, readPresence, safePathSegment, sanitizeStorePaths, updatePresence, withLease, withLeaseSync, withLock, withLockSync, writePresence, type CreateLocalStoreOptions, type H2AKeyEvent, type H2ASubagentAuditEvent, type H2ASubagentStatus, type H2AStoreSchemaSentinel, type LeaseHandle, type LeaseRecord, type ListPresenceOptions, type LocalStore, type LocalStorePaths, type LockOwner, type PresenceWriteResult, type SanitizePathsResult, type SanitizeRenameEntry, type WithLeaseOptions, type WithLockOptions } from "./runtime/local-files/index.js";
 export { H2A_CLI_MCP_TOOL_DESCRIPTORS, NotificationDispatcher, SessionRegistry, createMcpServer, runMcpStdio, type CreateMcpServerOptions, type McpErrorResult, type McpPushNotification, type McpServer, type McpToolDescriptor, type McpToolName, type McpToolResult, type NotificationSink, type OpenSessionRequest, type RunMcpStdioOptions, type SessionRegistryOptions } from "./runtime/mcp/index.js";
@@ -21,6 +21,7 @@ export { cmdUpgrade, cmdOrg, cmdCoach } from "./cli.js";
 export { resolveSysmlElement, hashSysmlElement, verifyEnvelopeSysmlRef, extractSysmlRef, sysmlQueryScope, type SysmlFetchImpl, type SysmlFetchResponse, type ResolveSysmlOptions, type VerifyEnvelopeSysmlOptions, type VerifyEnvelopeSysmlResult, type H2ASysmlQueryScope, type H2ASysmlQueryDetail } from "./runtime/sysml/index.js";
 export { acceptRemoteEnvelope, createRemoteServer, rejectionStatus, remoteServerForStore, sendRemoteEnvelope, type AcceptRemoteOptions, type H2AAcceptRejection, type H2AAcceptResult, type RemoteServerForStoreOptions, type RemoteServerOptions, type SendRemoteOptions, type SendRemoteResult } from "./runtime/remote/index.js";
 export * from "./runtime/mcp-http/index.js";
+export * from "./runtime/mirror/index.js";
 export declare const H2A_CLI_HOSTS: readonly [import("./hosts/codex.js").H2AConfigurableHostDescriptor, import("./hosts/codex.js").H2AConfigurableHostDescriptor, import("./hosts/codex.js").H2AConfigurableHostDescriptor, import("./hosts/codex.js").H2AConfigurableHostDescriptor];
 export declare const H2A_CLI_ADAPTER: {
     readonly packageName: "@sentropic/h2a-cli";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD,YAAY,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACf,CAAC;AAEF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EACf,eAAe,EACf,aAAa,IAAI,qBAAqB,EACtC,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,WAAW,EACX,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACxC,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,mCAAmC,EACzC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,cAAc,6BAA6B,CAAC;AAE5C,eAAO,MAAM,aAAa,mPAKhB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD,YAAY,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,CAAC;AAEF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EACf,eAAe,EACf,aAAa,IAAI,qBAAqB,EACtC,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,WAAW,EACX,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACxC,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,mCAAmC,EACzC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,cAAc,6BAA6B,CAAC;AAE5C,cAAc,2BAA2B,CAAC;AAE1C,eAAO,MAAM,aAAa,mPAKhB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC"}

package/dist/index.js

@@ -1,10 +1,10 @@
 import { H2A_CLAUDE_HOST } from "./hosts/claude.js";
-import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe } from "./cli.js";
+import { renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush } from "./cli.js";
 import { H2A_CODEX_HOST } from "./hosts/codex.js";
 import { H2A_GEMINI_HOST } from "./hosts/gemini.js";
 import { H2A_AGY_HOST } from "./hosts/agy.js";
 import { H2A_CLI_MCP_TOOL_NAMES } from "./mcp.js";
-export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe };
+export { H2A_CLAUDE_HOST, H2A_CODEX_HOST, H2A_GEMINI_HOST, H2A_AGY_HOST, H2A_CLI_MCP_TOOL_NAMES, renderCliHelp, resolveAutoOpen, runCli, runDriveServe, runDrumbeatRelanceInbox, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush };
 export { H2A_CLI_VERB_CONTRACTS, H2A_CLI_VERB_CONTRACT_BY_VERB } from "./cli-contract.js";
 export { H2A_STORE_SCHEMA_FILE, H2A_STORE_SCHEMA_VERSION, LockTimeoutError, StoreSchemaMismatchError, createLocalStore, deletePresence, inboxDir, listPresence, localStorePaths, negotiationDir, negotiationJournalFile, outboxDir, presenceFile, readPresence, safePathSegment, sanitizeStorePaths, updatePresence, withLease, withLeaseSync, withLock, withLockSync, writePresence } from "./runtime/local-files/index.js";
 export { H2A_CLI_MCP_TOOL_DESCRIPTORS, NotificationDispatcher, SessionRegistry, createMcpServer, runMcpStdio } from "./runtime/mcp/index.js";
@@ -20,6 +20,7 @@ export { cmdUpgrade, cmdOrg, cmdCoach } from "./cli.js";
 export { resolveSysmlElement, hashSysmlElement, verifyEnvelopeSysmlRef, extractSysmlRef, sysmlQueryScope } from "./runtime/sysml/index.js";
 export { acceptRemoteEnvelope, createRemoteServer, rejectionStatus, remoteServerForStore, sendRemoteEnvelope } from "./runtime/remote/index.js";
 export * from "./runtime/mcp-http/index.js";
+export * from "./runtime/mirror/index.js";
 export const H2A_CLI_HOSTS = [
     H2A_CODEX_HOST,
     H2A_CLAUDE_HOST,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAUlD,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACf,CAAC;AAEF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAI9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,aAAa,EAiBd,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,WAAW,EAYZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAGjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EAqBzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EACf,eAAe,EACf,aAAa,IAAI,qBAAqB,EACtC,sBAAsB,EAKvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,WAAW,EACX,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,EA0B7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EAIhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,oBAAoB,EAWrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EAKrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EAQhB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAQnB,MAAM,2BAA2B,CAAC;AAEnC,cAAc,6BAA6B,CAAC;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,eAAe;IACf,eAAe;IACf,YAAY;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,oBAAoB;IACjC,eAAe,EAAE,gBAAgB;IACjC,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,aAAa;IACpB,YAAY,EAAE,sBAAsB;CAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAUlD,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,MAAM,EACN,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACd,CAAC;AAEF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAI9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,aAAa,EAiBd,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,WAAW,EAYZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAGjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EAqBzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EACf,eAAe,EACf,aAAa,IAAI,qBAAqB,EACtC,sBAAsB,EAKvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,WAAW,EACX,uBAAuB,EACvB,4BAA4B,EAC5B,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,EA0B7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EAIhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,oBAAoB,EAWrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EAKrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EAQhB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAQnB,MAAM,2BAA2B,CAAC;AAEnC,cAAc,6BAA6B,CAAC;AAE5C,cAAc,2BAA2B,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,eAAe;IACf,eAAe;IACf,YAAY;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,oBAAoB;IACjC,eAAe,EAAE,gBAAgB;IACjC,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,aAAa;IACpB,YAAY,EAAE,sBAAsB;CAC5B,CAAC"}

package/dist/runtime/mirror/accept.d.ts

@@ -0,0 +1,51 @@
+/**
+ * EVO-13 P1 — ingestion trust boundary for an instance mirror (DEC-125).
+ *
+ * Reuses the EVO-11 verification primitives (`verifyEnvelopeSignature` +
+ * `H2AReplayGuard`). Authority is **possession of a key the operator enrolled**,
+ * never a self-declared instance id and never a shared bearer token (the Opus
+ * review rejected both). Two safeguards, both keyed on the VERIFIED signing key:
+ *   1. the envelope must verify against a registry key for the signer OR an
+ *      operator-enrolled key (`enrolledKeys`) — an unknown key is refused (no
+ *      trust-on-first-use across the remote boundary);
+ *   2. a registration is applied only if its `publicKeys` contains the verified
+ *      key — an agent can mirror ONLY its own identity (no namespace squatting).
+ *
+ * Never throws on rejection; only the caller-supplied `applyRegistration` may.
+ */
+import { type H2AActorRegistration, type H2AReplayGuard, type H2ASession } from "@sentropic/h2a";
+export type H2AMirrorRejection = "malformed" | "not-mirror" | "no-signature" | "unauthorized-key" | "bad-signature" | "invalid-timestamp" | "expired" | "future" | "replayed" | "stale-sequence" | "instance-key-mismatch";
+export type H2AMirrorResult = {
+    ok: true;
+    applied: string[];
+    signer: string;
+} | {
+    ok: false;
+    reason: H2AMirrorRejection;
+};
+export interface AcceptMirrorOptions {
+    /** Active public-key PEMs already registered for the signer (registry + keyring, minus revoked). */
+    resolvePublicKeys: (signerInstance: string) => string[];
+    /** Operator-enrolled key PEMs allowed to mirror/bootstrap (out-of-band trust, not a wire token). */
+    enrolledKeys: readonly string[];
+    /** Replay guard (DEC-074) — its freshness window also enforces timestamp checks. */
+    guard: H2AReplayGuard;
+    /** Apply an authorized registration to the local (remote-side) store. */
+    applyRegistration: (registration: H2AActorRegistration) => void;
+    /**
+     * P2: apply a presence session (the impl RE-STAMPS heartbeatAt with the remote
+     * clock so freshness derives from the beat). Only called for sessions whose
+     * instance is owned by the verified key. Omit to ignore presence (P1 behavior).
+     */
+    applyPresence?: (session: H2ASession) => void;
+    /**
+     * P2 fencing: return true iff `seq` is strictly newer than the last applied
+     * for `signerInstance` (and record it). Return false to reject a stale/replayed
+     * beat. Omit to skip fencing (P1 behavior).
+     */
+    fenceSequence?: (signerInstance: string, seq: number) => boolean;
+    /** Reference time (ms epoch) for the guard. Defaults to `Date.now()`. */
+    now?: number;
+}
+export declare function acceptMirrorEnvelope(payload: unknown, options: AcceptMirrorOptions): H2AMirrorResult;
+//# sourceMappingURL=accept.d.ts.map

package/dist/runtime/mirror/accept.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAGL,KAAK,oBAAoB,EAGzB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,YAAY,GACZ,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,mBAAmB,GACnB,SAAS,GACT,QAAQ,GACR,UAAU,GACV,gBAAgB,GAChB,uBAAuB,CAAC;AAE5B,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACxD,oGAAoG;IACpG,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,oFAAoF;IACpF,KAAK,EAAE,cAAc,CAAC;IACtB,yEAAyE;IACzE,iBAAiB,EAAE,CAAC,YAAY,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAChE;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9C;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACjE,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,eAAe,CA8CpG"}

package/dist/runtime/mirror/accept.js

@@ -0,0 +1,63 @@
+/**
+ * EVO-13 P1 — ingestion trust boundary for an instance mirror (DEC-125).
+ *
+ * Reuses the EVO-11 verification primitives (`verifyEnvelopeSignature` +
+ * `H2AReplayGuard`). Authority is **possession of a key the operator enrolled**,
+ * never a self-declared instance id and never a shared bearer token (the Opus
+ * review rejected both). Two safeguards, both keyed on the VERIFIED signing key:
+ *   1. the envelope must verify against a registry key for the signer OR an
+ *      operator-enrolled key (`enrolledKeys`) — an unknown key is refused (no
+ *      trust-on-first-use across the remote boundary);
+ *   2. a registration is applied only if its `publicKeys` contains the verified
+ *      key — an agent can mirror ONLY its own identity (no namespace squatting).
+ *
+ * Never throws on rejection; only the caller-supplied `applyRegistration` may.
+ */
+import { isH2AEnvelope, verifyEnvelopeSignature } from "@sentropic/h2a";
+import { H2A_MIRROR_BODY_KIND } from "./build.js";
+export function acceptMirrorEnvelope(payload, options) {
+    if (!isH2AEnvelope(payload))
+        return { ok: false, reason: "malformed" };
+    const envelope = payload;
+    const body = envelope.body;
+    if (!body || body.kind !== H2A_MIRROR_BODY_KIND || !Array.isArray(body.registrations)) {
+        return { ok: false, reason: "not-mirror" };
+    }
+    const signer = envelope.actor.instance;
+    if (!(envelope.signatures ?? []).some((s) => s.by === signer)) {
+        return { ok: false, reason: "no-signature" };
+    }
+    const candidates = Array.from(new Set([...options.resolvePublicKeys(signer), ...options.enrolledKeys]));
+    if (candidates.length === 0)
+        return { ok: false, reason: "unauthorized-key" };
+    const verifiedPem = candidates.find((pem) => verifyEnvelopeSignature(envelope, pem, { by: signer }));
+    if (!verifiedPem)
+        return { ok: false, reason: "bad-signature" };
+    // Namespacing: only registrations whose publicKeys include the verified key —
+    // an agent can publish ONLY its own identity. Checked BEFORE the guard so a
+    // wholly-unauthorized payload does not consume the envelope id.
+    const authorized = body.registrations.filter((reg) => Array.isArray(reg.publicKeys) && reg.publicKeys.includes(verifiedPem));
+    if (authorized.length === 0)
+        return { ok: false, reason: "instance-key-mismatch" };
+    const replay = options.guard.accept(envelope, options.now);
+    if (!replay.ok)
+        return { ok: false, reason: replay.reason };
+    // P2 monotonic fencing — after replay/freshness so a stale beat (new id, fresh
+    // window) still can't regress/resurrect state across a guard reset/restart.
+    if (typeof body.seq === "number" && options.fenceSequence) {
+        if (!options.fenceSequence(signer, body.seq))
+            return { ok: false, reason: "stale-sequence" };
+    }
+    for (const reg of authorized)
+        options.applyRegistration(reg);
+    // P2 presence — only sessions whose instance the verified key owns.
+    if (options.applyPresence && Array.isArray(body.presence)) {
+        const owned = new Set(authorized.map((r) => r.instance ?? r.id));
+        for (const session of body.presence) {
+            if (owned.has(session.instance))
+                options.applyPresence(session);
+        }
+    }
+    return { ok: true, applied: authorized.map((r) => r.instance ?? r.id), signer };
+}
+//# sourceMappingURL=accept.js.map

package/dist/runtime/mirror/accept.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept.js","sourceRoot":"","sources":["../../../src/runtime/mirror/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,aAAa,EACb,uBAAuB,EAMxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAA8B,MAAM,YAAY,CAAC;AA4C9E,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,OAA4B;IACjF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,OAA6C,CAAC;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEhE,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC/E,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAEnF,MAAM,MAAM,GAAmB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAA4B,EAAE,CAAC;IAElF,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC/F,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE7D,oEAAoE;IACpE,IAAI,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAClF,CAAC"}

package/dist/runtime/mirror/build.d.ts

@@ -0,0 +1,38 @@
+/**
+ * EVO-13 P1 — build an "instance mirror": the local instance's OWN registration,
+ * wrapped in an h2a envelope ready to be signed and pushed to a remote h2a so
+ * its read-only surface (`h2a_discover_instances`) reflects this live agent.
+ *
+ * P1 replicates instances only (registry). Presence (P2) and NHI (P3) extend the
+ * same envelope with more event kinds. The private key never leaves the agent;
+ * `buildInstanceMirror` returns an UNSIGNED envelope — the caller signs it with
+ * `signEnvelope` (DEC-116: possession of the key is the sole authority anchor).
+ */
+import { type H2AActorRegistration, type H2AEnvelope, type H2ASession } from "@sentropic/h2a";
+import { type LocalStore } from "../local-files/index.js";
+export declare const H2A_MIRROR_BODY_KIND: "mirror.instances";
+export interface H2AInstanceMirrorBody {
+    readonly kind: typeof H2A_MIRROR_BODY_KIND;
+    /** Append-only registration events. P1: the sender's own registration only. */
+    readonly registrations: H2AActorRegistration[];
+    /**
+     * P2: the sender's live sessions. The remote RE-STAMPS `heartbeatAt` with its
+     * own clock on arrival (freshness is derived from the mirror beat, not the
+     * local clock — no ghost/skew/resurrection). Omitted in P1-only callers.
+     */
+    readonly presence?: H2ASession[];
+    /**
+     * P2: monotonic per-instance sequence (the CLI uses epoch ms — increases
+     * across restarts). The remote rejects a mirror with `seq <= last applied`
+     * (fencing), so a replayed older beat cannot resurrect stale presence.
+     */
+    readonly seq?: number;
+}
+/**
+ * Build the unsigned mirror envelope for `instance` from the local store.
+ * `nowMs` is injected (epoch ms) so the id + createdAt + seq are deterministic
+ * in tests; the CLI verb passes `Date.now()`. Includes the instance's own live
+ * sessions (P2) so the remote can derive its presence.
+ */
+export declare function buildInstanceMirror(store: LocalStore, instance: string, nowMs: number): H2AEnvelope<H2AInstanceMirrorBody>;
+//# sourceMappingURL=build.d.ts.map

package/dist/runtime/mirror/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAExE,eAAO,MAAM,oBAAoB,EAAG,kBAA2B,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,EAAE,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,WAAW,CAAC,qBAAqB,CAAC,CAgBpC"}

package/dist/runtime/mirror/build.js

@@ -0,0 +1,36 @@
+/**
+ * EVO-13 P1 — build an "instance mirror": the local instance's OWN registration,
+ * wrapped in an h2a envelope ready to be signed and pushed to a remote h2a so
+ * its read-only surface (`h2a_discover_instances`) reflects this live agent.
+ *
+ * P1 replicates instances only (registry). Presence (P2) and NHI (P3) extend the
+ * same envelope with more event kinds. The private key never leaves the agent;
+ * `buildInstanceMirror` returns an UNSIGNED envelope — the caller signs it with
+ * `signEnvelope` (DEC-116: possession of the key is the sole authority anchor).
+ */
+import { H2A_PROTOCOL, H2A_VERSION } from "@sentropic/h2a";
+import { listPresence } from "../local-files/index.js";
+export const H2A_MIRROR_BODY_KIND = "mirror.instances";
+/**
+ * Build the unsigned mirror envelope for `instance` from the local store.
+ * `nowMs` is injected (epoch ms) so the id + createdAt + seq are deterministic
+ * in tests; the CLI verb passes `Date.now()`. Includes the instance's own live
+ * sessions (P2) so the remote can derive its presence.
+ */
+export function buildInstanceMirror(store, instance, nowMs) {
+    const reg = store.findInstance(instance);
+    if (!reg)
+        throw new Error(`mirror: unknown local instance ${instance}`);
+    const presence = listPresence(store.paths.root, { now: nowMs }).filter((s) => s.instance === instance);
+    return {
+        protocol: H2A_PROTOCOL,
+        version: H2A_VERSION,
+        id: `mirror:${instance}:${nowMs}`,
+        type: "event",
+        actor: { instance, role: reg.roles?.[0] ?? "AGENTS", scope: "scope:default" },
+        target: { instance },
+        body: { kind: H2A_MIRROR_BODY_KIND, registrations: [reg], presence, seq: nowMs },
+        createdAt: new Date(nowMs).toISOString()
+    };
+}
+//# sourceMappingURL=build.js.map

package/dist/runtime/mirror/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/runtime/mirror/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,YAAY,EACZ,WAAW,EAIZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAmB,MAAM,yBAAyB,CAAC;AAExE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAA2B,CAAC;AAoBhE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB,EACjB,QAAgB,EAChB,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAC/B,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,WAAW;QACpB,EAAE,EAAE,UAAU,QAAQ,IAAI,KAAK,EAAE;QACjC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE;QAC7E,MAAM,EAAE,EAAE,QAAQ,EAAE;QACpB,IAAI,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;QAChF,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;KACzC,CAAC;AACJ,CAAC"}

package/dist/runtime/mirror/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * EVO-13 — remote presence mirror (DEC-125). Local agents push signed snapshots
+ * of their state to a remote h2a so its read-only surface reflects reality.
+ * P1: instances only. Core stays dep-free; this lives in @sentropic/h2a-cli.
+ */
+export { buildInstanceMirror, H2A_MIRROR_BODY_KIND, type H2AInstanceMirrorBody } from "./build.js";
+export { acceptMirrorEnvelope, type AcceptMirrorOptions, type H2AMirrorRejection, type H2AMirrorResult } from "./accept.js";
+export { mirrorServerForStore, mirrorRejectionStatus, type MirrorServerForStoreOptions } from "./serve.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/mirror/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,2BAA2B,EACjC,MAAM,YAAY,CAAC"}

package/dist/runtime/mirror/index.js

@@ -0,0 +1,9 @@
+/**
+ * EVO-13 — remote presence mirror (DEC-125). Local agents push signed snapshots
+ * of their state to a remote h2a so its read-only surface reflects reality.
+ * P1: instances only. Core stays dep-free; this lives in @sentropic/h2a-cli.
+ */
+export { buildInstanceMirror, H2A_MIRROR_BODY_KIND } from "./build.js";
+export { acceptMirrorEnvelope } from "./accept.js";
+export { mirrorServerForStore, mirrorRejectionStatus } from "./serve.js";
+//# sourceMappingURL=index.js.map

package/dist/runtime/mirror/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/mirror/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EAIrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,YAAY,CAAC"}

package/dist/runtime/mirror/serve.d.ts

@@ -0,0 +1,21 @@
+import { type Server } from "node:http";
+import { type H2AReplayGuard } from "@sentropic/h2a";
+import { type LocalStore } from "../local-files/index.js";
+import { type H2AMirrorRejection } from "./accept.js";
+export interface MirrorServerForStoreOptions {
+    /** Operator-enrolled key PEMs allowed to mirror/bootstrap (out-of-band trust). */
+    enrolledKeys?: readonly string[];
+    /** POST endpoint path. Default `/h2a/mirror`. */
+    path?: string;
+    /** Shared replay guard. Defaults to a fresh in-memory guard. */
+    guard?: H2AReplayGuard;
+    /** Body-size cap (bytes). Default 256 KiB. */
+    maxBodyBytes?: number;
+    /** Clock source handed to the guard. Defaults to `Date.now`. */
+    now?: () => number;
+}
+/** Map a mirror-pipeline rejection to an HTTP status code. */
+export declare function mirrorRejectionStatus(reason: H2AMirrorRejection): number;
+/** Build (unstarted) the mirror ingester bound to `store`. */
+export declare function mirrorServerForStore(store: LocalStore, options?: MirrorServerForStoreOptions): Server;
+//# sourceMappingURL=serve.d.ts.map

package/dist/runtime/mirror/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/serve.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA+B5E,MAAM,WAAW,2BAA2B;IAC1C,kFAAkF;IAClF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAmBxE;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CA2DzG"}

package/dist/runtime/mirror/serve.js

@@ -0,0 +1,130 @@
+/**
+ * EVO-13 P1 — HTTP ingester for instance mirrors. A thin, channel-untrusting
+ * front-end over `acceptMirrorEnvelope`: it reads a POSTed signed mirror and,
+ * on success, applies the registration to the store via `registerInstance`.
+ *
+ * Runs as a SEPARATE deployment from the read-only MCP pod (it writes the store;
+ * the MCP surface only reads it), co-mounting the RWX PVC. Store-agnostic +
+ * unit-testable; the k8s wiring is the deploy kit.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { createReplayGuard } from "@sentropic/h2a";
+import { localStorePaths, withLockSync, writePresence } from "../local-files/index.js";
+import { acceptMirrorEnvelope } from "./accept.js";
+/**
+ * Durable, per-instance monotonic fence (P2). Returns a predicate that accepts
+ * `seq` iff it is strictly greater than the last recorded for `instance`, under
+ * a lock so concurrent beats from one agent can't race. Survives restarts (the
+ * in-memory replay guard does not), so a replayed older beat cannot resurrect
+ * stale presence after the ingester restarts.
+ */
+function makeSequenceFence(root) {
+    const dir = join(localStorePaths(root).root, "identity");
+    const file = join(dir, "mirror-seq.json");
+    const lock = join(dir, ".mirror-seq.lock");
+    return (instance, seq) => {
+        mkdirSync(dir, { recursive: true });
+        return withLockSync(lock, () => {
+            let map = {};
+            try {
+                const parsed = JSON.parse(readFileSync(file, "utf8"));
+                if (parsed && typeof parsed === "object")
+                    map = parsed;
+            }
+            catch {
+                map = {};
+            }
+            if (seq <= (map[instance] ?? 0))
+                return false;
+            map[instance] = seq;
+            writeFileSync(file, `${JSON.stringify(map)}\n`, "utf8");
+            return true;
+        });
+    };
+}
+/** Map a mirror-pipeline rejection to an HTTP status code. */
+export function mirrorRejectionStatus(reason) {
+    switch (reason) {
+        case "malformed":
+        case "not-mirror":
+        case "no-signature":
+        case "instance-key-mismatch":
+        case "invalid-timestamp":
+            return 400;
+        case "unauthorized-key":
+        case "bad-signature":
+            return 401;
+        case "replayed":
+            return 409;
+        case "expired":
+        case "future":
+            return 422;
+        default:
+            return 400;
+    }
+}
+/** Build (unstarted) the mirror ingester bound to `store`. */
+export function mirrorServerForStore(store, options = {}) {
+    const guard = options.guard ?? createReplayGuard();
+    const enrolledKeys = options.enrolledKeys ?? [];
+    const path = options.path ?? "/h2a/mirror";
+    const maxBodyBytes = options.maxBodyBytes ?? 256 * 1024;
+    const root = store.paths.root;
+    const fenceSequence = makeSequenceFence(root);
+    return createServer((req, res) => {
+        const respond = (status, body) => {
+            res.writeHead(status, { "content-type": "application/json" });
+            res.end(JSON.stringify(body));
+        };
+        if ((req.url ?? "").split("?")[0] !== path)
+            return respond(404, { ok: false, error: "not-found" });
+        if (req.method !== "POST") {
+            res.setHeader("allow", "POST");
+            return respond(405, { ok: false, error: "method-not-allowed" });
+        }
+        const chunks = [];
+        let total = 0;
+        let aborted = false;
+        req.on("data", (chunk) => {
+            if (aborted)
+                return;
+            total += chunk.length;
+            if (total > maxBodyBytes) {
+                aborted = true;
+                respond(413, { ok: false, error: "payload-too-large" });
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (aborted)
+                return;
+            let payload;
+            try {
+                payload = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            }
+            catch {
+                return respond(400, { ok: false, error: "malformed" });
+            }
+            const stampMs = options.now ? options.now() : Date.now();
+            const result = acceptMirrorEnvelope(payload, {
+                resolvePublicKeys: (signer) => store.listInstanceKeys(signer),
+                enrolledKeys,
+                guard,
+                applyRegistration: (reg) => store.registerInstance(reg),
+                // Re-stamp heartbeatAt with the REMOTE clock → freshness derives from the
+                // beat (no local-clock skew, no immortal ghost when the agent dies).
+                applyPresence: (session) => writePresence(root, { ...session, heartbeatAt: new Date(stampMs).toISOString(), state: "live" }),
+                fenceSequence,
+                now: stampMs
+            });
+            if (result.ok)
+                return respond(202, { ok: true, applied: result.applied, signer: result.signer });
+            return respond(mirrorRejectionStatus(result.reason), { ok: false, reason: result.reason });
+        });
+    });
+}
+//# sourceMappingURL=serve.js.map

package/dist/runtime/mirror/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/runtime/mirror/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAuB,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAmB,MAAM,yBAAyB,CAAC;AACxG,OAAO,EAAE,oBAAoB,EAA2B,MAAM,aAAa,CAAC;AAE5E;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3C,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;QACvB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE;YAC7B,IAAI,GAAG,GAA2B,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;gBACjE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,GAAG,GAAG,MAAgC,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,GAAG,EAAE,CAAC;YACX,CAAC;YACD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9C,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;YACpB,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAeD,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc,CAAC;QACpB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,mBAAmB;YACtB,OAAO,GAAG,CAAC;QACb,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,KAAiB,EAAE,UAAuC,EAAE;IAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,GAAG,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9B,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE9C,OAAO,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAQ,EAAE;YACtD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE;gBAC3C,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC7D,YAAY;gBACZ,KAAK;gBACL,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBACvD,0EAA0E;gBAC1E,qEAAqE;gBACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CACzB,aAAa,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClG,aAAa;gBACb,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,OAAO,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/h2a-cli",
-  "version": "0.26.3",
+  "version": "0.28.0",
   "description": "Unified CLI surface for h2a hosts and MCP-oriented coordination flows.",
   "license": "MIT",
   "type": "module",
@@ -43,7 +43,7 @@
     "@hono/mcp": "^0.3.0",
     "@hono/node-server": "^2.0.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@sentropic/h2a": "^0.26.3",
+    "@sentropic/h2a": "^0.28.0",
     "hono": "^4.12.23"
   },
   "publishConfig": {