@themoltnet/pi-extension 0.15.1 → 0.16.0

package/dist/index.js

@@ -4,9 +4,9 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } fr
 import path, { join } from "node:path";
 import { DefaultResourceLoader, SessionManager, createAgentSession, createBashTool, createBashToolDefinition, createEditTool, createEditToolDefinition, createReadTool, createReadToolDefinition, createSyntheticSourceInfo, createWriteTool, createWriteToolDefinition, defineTool, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { createHash } from "node:crypto";
-import crypto, { createHash as createHash$1 } from "crypto";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
+import crypto, { createHash as createHash$1 } from "crypto";
 import { Type, getModel } from "@earendil-works/pi-ai";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, loadGuestAssets } from "@earendil-works/gondolin";
 import { parseEnv } from "node:util";
@@ -2609,7 +2609,6 @@ function createDiaryGrantsNamespace(context) {
 		}
 	};
 }
-new TextEncoder();
 //#endregion
 //#region ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
 /** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
@@ -4333,941 +4332,1323 @@ var wNAF = (n) => {
 	};
 };
 //#endregion
-//#region ../crypto-service/src/crypto.service.ts
-etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
-//#region ../crypto-service/src/executor-attestation.ts
-etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
-//#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/codecs/json.js
-var textEncoder$1 = new TextEncoder();
-new TextDecoder();
-function encode(node) {
-	return textEncoder$1.encode(JSON.stringify(node));
-}
-//#endregion
-//#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/hashes/hasher.js
-var DEFAULT_MIN_DIGEST_LENGTH = 20;
-function from({ name, code, encode, minDigestLength, maxDigestLength }) {
-	return new Hasher(name, code, encode, minDigestLength, maxDigestLength);
-}
-/**
-* Hasher represents a hashing algorithm implementation that produces as
-* `MultihashDigest`.
-*/
-var Hasher = class {
-	name;
-	code;
-	encode;
-	minDigestLength;
-	maxDigestLength;
-	constructor(name, code, encode, minDigestLength, maxDigestLength) {
-		this.name = name;
-		this.code = code;
-		this.encode = encode;
-		this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH;
-		this.maxDigestLength = maxDigestLength;
-	}
-	digest(input, options) {
-		if (options?.truncate != null) {
-			if (options.truncate < this.minDigestLength) throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`);
-			if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`);
+//#region ../sdk/src/namespaces/entries.ts
+function createEntriesNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async create(diaryId, body) {
+			return unwrapResult(await createDiaryEntry({
+				client,
+				auth,
+				body,
+				path: { diaryId }
+			}));
+		},
+		async list(diaryId, query) {
+			return unwrapResult(await listDiaryEntries({
+				client,
+				auth,
+				query,
+				path: { diaryId }
+			}));
+		},
+		async get(entryId) {
+			return unwrapResult(await getDiaryEntryById({
+				client,
+				auth,
+				path: { entryId }
+			}));
+		},
+		async update(entryId, body) {
+			return unwrapResult(await updateDiaryEntryById({
+				client,
+				auth,
+				path: { entryId },
+				body
+			}));
+		},
+		async delete(entryId) {
+			return unwrapResult(await deleteDiaryEntryById({
+				client,
+				auth,
+				path: { entryId }
+			}));
+		},
+		async search(body) {
+			return unwrapResult(await searchDiary({
+				client,
+				auth,
+				body
+			}));
+		},
+		async reflect(query) {
+			return unwrapResult(await reflectDiary({
+				client,
+				auth,
+				query
+			}));
+		},
+		async verify(entryId) {
+			return unwrapResult(await verifyDiaryEntryById({
+				client,
+				auth,
+				path: { entryId }
+			}));
+		},
+		async createSigned(diaryId, body, privateKey) {
+			const signingRequest = unwrapResult(await createSigningRequest({
+				client,
+				auth,
+				body: { message: computeContentCid(body.entryType ?? "semantic", body.title ?? null, body.content, body.tags ?? null) }
+			}));
+			const privateKeyBytes = new Uint8Array(Buffer.from(privateKey, "base64"));
+			const signature = await signAsync(new Uint8Array(Buffer.from(signingRequest.signingInput, "base64")), privateKeyBytes);
+			const signatureB64 = Buffer.from(signature).toString("base64");
+			unwrapResult(await submitSignature({
+				client,
+				auth,
+				path: { id: signingRequest.id },
+				body: { signature: signatureB64 }
+			}));
+			return unwrapResult(await createDiaryEntry({
+				client,
+				auth,
+				path: { diaryId },
+				body: {
+					...body,
+					signingRequestId: signingRequest.id
+				}
+			}));
 		}
-		if (input instanceof Uint8Array) {
-			const result = this.encode(input);
-			if (result instanceof Uint8Array) return createDigest(result, this.code, options?.truncate);
-			return result.then((digest) => createDigest(digest, this.code, options?.truncate));
-		} else throw Error("Unknown type, must be binary type");
-	}
-};
-/**
-* Create a Digest from the passed uint8array and code, optionally truncating it
-* first.
-*/
-function createDigest(digest, code, truncate) {
-	if (truncate != null && truncate !== digest.byteLength) {
-		if (truncate > digest.byteLength) throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`);
-		digest = digest.subarray(0, truncate);
-	}
-	return create(code, digest);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/hashes/sha2.js
-var sha256 = from({
-	name: "sha2-256",
-	code: 18,
-	encode: (input) => coerce(crypto.createHash("sha256").update(input).digest())
-});
-from({
-	name: "sha2-512",
-	code: 19,
-	encode: (input) => coerce(crypto.createHash("sha512").update(input).digest())
-});
-//#endregion
-//#region ../crypto-service/src/json-cid.ts
-/**
-* Generic JSON CID — CIDv1 for arbitrary JSON-serialisable values.
-*
-* Uses the dag-json codec and sha2-256, producing a base32lower CIDv1.
-* Suitable for content-addressing task inputs, schema objects, and other
-* JSON payloads that don't need diary-entry canonical normalisation.
-*/
-async function computeJsonCid(value) {
-	const bytes = encode(value);
-	const hash = await sha256.digest(bytes);
-	return CID.create(1, 512, hash).toString();
+	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/is.js
-var objectTypeNames = [
-	"Object",
-	"RegExp",
-	"Date",
-	"Error",
-	"Map",
-	"Set",
-	"WeakMap",
-	"WeakSet",
-	"ArrayBuffer",
-	"SharedArrayBuffer",
-	"DataView",
-	"Promise",
-	"URL",
-	"HTMLElement",
-	"Int8Array",
-	"Uint8ClampedArray",
-	"Int16Array",
-	"Uint16Array",
-	"Int32Array",
-	"Uint32Array",
-	"Float32Array",
-	"Float64Array",
-	"BigInt64Array",
-	"BigUint64Array"
-];
-/**
-* @param {any} value
-* @returns {string}
-*/
-function is(value) {
-	if (value === null) return "null";
-	if (value === void 0) return "undefined";
-	if (value === true || value === false) return "boolean";
-	const typeOf = typeof value;
-	if (typeOf === "string" || typeOf === "number" || typeOf === "bigint" || typeOf === "symbol") return typeOf;
-	/* c8 ignore next 3 */
-	if (typeOf === "function") return "Function";
-	if (Array.isArray(value)) return "Array";
-	if (value instanceof Uint8Array) return "Uint8Array";
-	if (value.constructor === Object) return "Object";
-	const objectType = getObjectType(value);
-	if (objectType) return objectType;
-	/* c8 ignore next */
-	return "Object";
-}
-/**
-* @param {any} value
-* @returns {string|undefined}
-*/
-function getObjectType(value) {
-	const objectTypeName = Object.prototype.toString.call(value).slice(8, -1);
-	if (objectTypeNames.includes(objectTypeName)) return objectTypeName;
+//#region ../sdk/src/namespaces/legreffier.ts
+function createLegreffierNamespace(context) {
+	const { client } = context;
+	return {
+		async startOnboarding(body) {
+			return unwrapResult(await startLegreffierOnboarding({
+				client,
+				body
+			}));
+		},
+		async getOnboardingStatus(workflowId) {
+			return unwrapResult(await getLegreffierOnboardingStatus({
+				client,
+				path: { workflowId }
+			}));
+		}
+	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/token.js
-var Type$2 = class {
-	/**
-	* @param {number} major
-	* @param {string} name
-	* @param {boolean} terminal
-	*/
-	constructor(major, name, terminal) {
-		this.major = major;
-		this.majorEncoded = major << 5;
-		this.name = name;
-		this.terminal = terminal;
-	}
-	/* c8 ignore next 3 */
-	toString() {
-		return `Type[${this.major}].${this.name}`;
-	}
-	/**
-	* @param {Type} typ
-	* @returns {number}
-	*/
-	compare(typ) {
-		/* c8 ignore next 1 */
-		return this.major < typ.major ? -1 : this.major > typ.major ? 1 : 0;
-	}
-	/**
-	* Check equality between two Type instances. Safe to use across different
-	* copies of the Type class (e.g., when bundlers duplicate the module).
-	* (major, name) uniquely identifies a Type; terminal is implied by these.
-	* @param {Type} a
-	* @param {Type} b
-	* @returns {boolean}
-	*/
-	static equals(a, b) {
-		return a === b || a.major === b.major && a.name === b.name;
-	}
-};
-Type$2.uint = new Type$2(0, "uint", true);
-Type$2.negint = new Type$2(1, "negint", true);
-Type$2.bytes = new Type$2(2, "bytes", true);
-Type$2.string = new Type$2(3, "string", true);
-Type$2.array = new Type$2(4, "array", false);
-Type$2.map = new Type$2(5, "map", false);
-Type$2.tag = new Type$2(6, "tag", false);
-Type$2.float = new Type$2(7, "float", true);
-Type$2.false = new Type$2(7, "false", true);
-Type$2.true = new Type$2(7, "true", true);
-Type$2.null = new Type$2(7, "null", true);
-Type$2.undefined = new Type$2(7, "undefined", true);
-Type$2.break = new Type$2(7, "break", true);
-var Token = class {
-	/**
-	* @param {Type} type
-	* @param {any} [value]
-	* @param {number} [encodedLength]
-	*/
-	constructor(type, value, encodedLength) {
-		this.type = type;
-		this.value = value;
-		this.encodedLength = encodedLength;
-		/** @type {Uint8Array|undefined} */
-		this.encodedBytes = void 0;
-		/** @type {Uint8Array|undefined} */
-		this.byteValue = void 0;
-	}
-	/* c8 ignore next 3 */
-	toString() {
-		return `Token[${this.type}].${this.value}`;
-	}
-};
+//#region ../sdk/src/namespaces/packs.ts
+function createPacksNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async get(id, query) {
+			return unwrapResult(await getContextPackById({
+				client,
+				auth,
+				path: { id },
+				query
+			}));
+		},
+		async list(selector) {
+			if ("diaryId" in selector) {
+				const { diaryId, ...query } = selector;
+				return unwrapResult(await listDiaryPacks({
+					client,
+					auth,
+					path: { id: diaryId },
+					query
+				}));
+			}
+			const { containsEntry, ...query } = selector;
+			return unwrapResult(await listContextPacks({
+				client,
+				auth,
+				query: {
+					...query,
+					containsEntry
+				}
+			}));
+		},
+		async getProvenance(id, query) {
+			return unwrapResult(await getContextPackProvenanceById({
+				client,
+				auth,
+				path: { id },
+				query
+			}));
+		},
+		async getProvenanceByCid(cid, query) {
+			return unwrapResult(await getContextPackProvenanceByCid({
+				client,
+				auth,
+				path: { cid },
+				query
+			}));
+		},
+		async previewRendered(id, body) {
+			return unwrapResult(await previewRenderedPack({
+				client,
+				auth,
+				path: { id },
+				body
+			}));
+		},
+		async render(id, body) {
+			return unwrapResult(await renderContextPack({
+				client,
+				auth,
+				path: { id },
+				body
+			}));
+		},
+		async getLatestRendered(id, query) {
+			return unwrapResult(await getLatestRenderedPack({
+				client,
+				auth,
+				path: { id },
+				query
+			}));
+		},
+		async listRendered(diaryId, query) {
+			return unwrapResult(await listDiaryRenderedPacks({
+				client,
+				auth,
+				path: { id: diaryId },
+				query
+			}));
+		},
+		async getRendered(id, query) {
+			return unwrapResult(await getRenderedPackById({
+				client,
+				auth,
+				path: { id },
+				query
+			}));
+		},
+		async update(id, body) {
+			return unwrapResult(await updateContextPack({
+				client,
+				auth,
+				path: { id },
+				body
+			}));
+		},
+		async updateRendered(id, body) {
+			return unwrapResult(await updateRenderedPack({
+				client,
+				auth,
+				path: { id },
+				body
+			}));
+		},
+		async create(diaryId, body) {
+			return unwrapResult(await createDiaryCustomPack({
+				client,
+				auth,
+				path: { id: diaryId },
+				body
+			}));
+		},
+		async preview(diaryId, body) {
+			return unwrapResult(await previewDiaryCustomPack({
+				client,
+				auth,
+				path: { id: diaryId },
+				body
+			}));
+		}
+	};
+}
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/byte-utils.js
-var useBuffer = globalThis.process && !globalThis.process.browser && globalThis.Buffer && typeof globalThis.Buffer.isBuffer === "function";
-var textEncoder = new TextEncoder();
-/**
-* @param {Uint8Array} buf
-* @returns {boolean}
-*/
-function isBuffer(buf) {
-	return useBuffer && globalThis.Buffer.isBuffer(buf);
+//#region ../sdk/src/namespaces/problems.ts
+function createProblemsNamespace(context) {
+	const { client } = context;
+	return {
+		async list() {
+			return unwrapRequired(await listProblemTypes({ client }), "Failed to list problem types", "PROBLEMS_FAILED");
+		},
+		async get(type) {
+			return unwrapRequired(await getProblemType({
+				client,
+				path: { type }
+			}), `Failed to get problem type: ${type}`, "PROBLEM_TYPE_FAILED");
+		}
+	};
 }
-/**
-* @param {Uint8Array|number[]} buf
-* @returns {Uint8Array}
-*/
-function asU8A(buf) {
-	/* c8 ignore next */
-	if (!(buf instanceof Uint8Array)) return Uint8Array.from(buf);
-	return isBuffer(buf) ? new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength) : buf;
+//#endregion
+//#region ../sdk/src/namespaces/public.ts
+function createPublicNamespace(context) {
+	const { client } = context;
+	return {
+		async feed(query) {
+			return unwrapResult(await getPublicFeed({
+				client,
+				query
+			}));
+		},
+		async searchFeed(query) {
+			return unwrapResult(await searchPublicFeed({
+				client,
+				query
+			}));
+		},
+		async entry(id) {
+			return unwrapResult(await getPublicEntry({
+				client,
+				path: { id }
+			}));
+		},
+		async networkInfo() {
+			return unwrapRequired(await getNetworkInfo({ client }), "Failed to fetch network info", "NETWORK_INFO_FAILED");
+		},
+		async llmsTxt() {
+			return unwrapRequired(await getLlmsTxt({ client }), "Failed to fetch llms.txt", "LLMS_TXT_FAILED");
+		},
+		async health() {
+			return unwrapRequired(await getHealth({ client }), "Failed to fetch health", "HEALTH_FAILED");
+		}
+	};
 }
-var FROM_STRING_THRESHOLD_BUFFER = 24;
-var FROM_STRING_THRESHOLD_TEXTENCODER = 200;
-var fromString = useBuffer ? (string) => {
-	return string.length >= FROM_STRING_THRESHOLD_BUFFER ? globalThis.Buffer.from(string) : utf8ToBytes(string);
-} : (string) => {
-	return string.length >= FROM_STRING_THRESHOLD_TEXTENCODER ? textEncoder.encode(string) : utf8ToBytes(string);
-};
-/**
-* Buffer variant not fast enough for what we need
-* @param {number[]} arr
-* @returns {Uint8Array}
-*/
-var fromArray = (arr) => {
-	return Uint8Array.from(arr);
-};
-var slice = useBuffer ? (bytes, start, end) => {
-	if (isBuffer(bytes)) return new Uint8Array(bytes.subarray(start, end));
-	return bytes.slice(start, end);
-} : (bytes, start, end) => {
-	return bytes.slice(start, end);
-};
-var concat = useBuffer ? (chunks, length) => {
-	/* c8 ignore next 1 */
-	chunks = chunks.map((c) => c instanceof Uint8Array ? c : globalThis.Buffer.from(c));
-	return asU8A(globalThis.Buffer.concat(chunks, length));
-} : (chunks, length) => {
-	const out = new Uint8Array(length);
-	let off = 0;
-	for (let b of chunks) {
-		if (off + b.length > out.length) b = b.subarray(0, out.length - off);
-		out.set(b, off);
-		off += b.length;
-	}
-	return out;
-};
-var alloc = useBuffer ? (size) => {
-	return globalThis.Buffer.allocUnsafe(size);
-} : (size) => {
-	return new Uint8Array(size);
-};
-/**
-* @param {Uint8Array} b1
-* @param {Uint8Array} b2
-* @returns {number}
-*/
-function compare(b1, b2) {
-	/* c8 ignore next 5 */
-	if (isBuffer(b1) && isBuffer(b2)) return b1.compare(b2);
-	for (let i = 0; i < b1.length; i++) {
-		if (b1[i] === b2[i]) continue;
-		return b1[i] < b2[i] ? -1 : 1;
-	}
-	return 0;
-}
-/**
-* @param {string} str
-* @returns {number[]}
-*/
-function utf8ToBytes(str) {
-	const out = [];
-	let p = 0;
-	for (let i = 0; i < str.length; i++) {
-		let c = str.charCodeAt(i);
-		if (c < 128) out[p++] = c;
-		else if (c < 2048) {
-			out[p++] = c >> 6 | 192;
-			out[p++] = c & 63 | 128;
-		} else if ((c & 64512) === 55296 && i + 1 < str.length && (str.charCodeAt(i + 1) & 64512) === 56320) {
-			c = 65536 + ((c & 1023) << 10) + (str.charCodeAt(++i) & 1023);
-			out[p++] = c >> 18 | 240;
-			out[p++] = c >> 12 & 63 | 128;
-			out[p++] = c >> 6 & 63 | 128;
-			out[p++] = c & 63 | 128;
-		} else {
-			if (c >= 55296 && c <= 57343) c = 65533;
-			out[p++] = c >> 12 | 224;
-			out[p++] = c >> 6 & 63 | 128;
-			out[p++] = c & 63 | 128;
+//#endregion
+//#region ../sdk/src/namespaces/recovery.ts
+function createRecoveryNamespace(context) {
+	const { client } = context;
+	return {
+		async requestChallenge(body) {
+			return unwrapResult(await requestRecoveryChallenge({
+				client,
+				body
+			}));
+		},
+		async verifyChallenge(body) {
+			return unwrapResult(await verifyRecoveryChallenge({
+				client,
+				body
+			}));
 		}
-	}
-	return out;
+	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/bl.js
-/**
-* Bl is a list of byte chunks, similar to https://github.com/rvagg/bl but for
-* writing rather than reading.
-* A Bl object accepts set() operations for individual bytes and copyTo() for
-* inserting byte arrays. These write operations don't automatically increment
-* the internal cursor so its "length" won't be changed. Instead, increment()
-* must be called to extend its length to cover the inserted data.
-* The toBytes() call will convert all internal memory to a single Uint8Array of
-* the correct length, truncating any data that is stored but hasn't been
-* included by an increment().
-* get() can retrieve a single byte.
-* All operations (except toBytes()) take an "offset" argument that will perform
-* the write at the offset _from the current cursor_. For most operations this
-* will be `0` to write at the current cursor position but it can be ahead of
-* the current cursor. Negative offsets probably work but are untested.
-*/
-var defaultChunkSize = 256;
-var Bl = class {
-	/**
-	* @param {number} [chunkSize]
-	*/
-	constructor(chunkSize = defaultChunkSize) {
-		this.chunkSize = chunkSize;
-		/** @type {number} */
-		this.cursor = 0;
-		/** @type {number} */
-		this.maxCursor = -1;
-		/** @type {(Uint8Array|number[])[]} */
-		this.chunks = [];
-		/** @type {Uint8Array|number[]|null} */
-		this._initReuseChunk = null;
-	}
-	reset() {
-		this.cursor = 0;
-		this.maxCursor = -1;
-		if (this.chunks.length) this.chunks = [];
-		if (this._initReuseChunk !== null) {
-			this.chunks.push(this._initReuseChunk);
-			this.maxCursor = this._initReuseChunk.length - 1;
-		}
-	}
-	/**
-	* @param {Uint8Array|number[]} bytes
-	*/
-	push(bytes) {
-		let topChunk = this.chunks[this.chunks.length - 1];
-		if (this.cursor + bytes.length <= this.maxCursor + 1) {
-			const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
-			topChunk.set(bytes, chunkPos);
-		} else {
-			if (topChunk) {
-				const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
-				if (chunkPos < topChunk.length) {
-					this.chunks[this.chunks.length - 1] = topChunk.subarray(0, chunkPos);
-					this.maxCursor = this.cursor - 1;
-				}
-			}
-			if (bytes.length < 64 && bytes.length < this.chunkSize) {
-				topChunk = alloc(this.chunkSize);
-				this.chunks.push(topChunk);
-				this.maxCursor += topChunk.length;
-				if (this._initReuseChunk === null) this._initReuseChunk = topChunk;
-				topChunk.set(bytes, 0);
-			} else {
-				this.chunks.push(bytes);
-				this.maxCursor += bytes.length;
-			}
+//#region ../sdk/src/namespaces/signing-requests.ts
+function createSigningRequestsNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async list(query) {
+			return unwrapResult(await listSigningRequests({
+				client,
+				auth,
+				query
+			}));
+		},
+		async create(body) {
+			return unwrapResult(await createSigningRequest({
+				client,
+				auth,
+				body
+			}));
+		},
+		async get(id) {
+			return unwrapResult(await getSigningRequest({
+				client,
+				auth,
+				path: { id }
+			}));
+		},
+		async submit(id, body) {
+			return unwrapResult(await submitSignature({
+				client,
+				auth,
+				path: { id },
+				body
+			}));
 		}
-		this.cursor += bytes.length;
-	}
-	/**
-	* @param {boolean} [reset]
-	* @returns {Uint8Array}
-	*/
-	toBytes(reset = false) {
-		let byts;
-		if (this.chunks.length === 1) {
-			const chunk = this.chunks[0];
-			if (reset && this.cursor > chunk.length / 2) {
-				/* c8 ignore next 2 */
-				byts = this.cursor === chunk.length ? chunk : chunk.subarray(0, this.cursor);
-				this._initReuseChunk = null;
-				this.chunks = [];
-			} else byts = slice(chunk, 0, this.cursor);
-		} else byts = concat(this.chunks, this.cursor);
-		if (reset) this.reset();
-		return byts;
-	}
-};
-/**
-* U8Bl is a buffer list that writes directly to a user-provided Uint8Array.
-* It provides the same interface as Bl but writes to a fixed destination.
-*/
-var U8Bl = class {
-	/**
-	* @param {Uint8Array} dest
-	*/
-	constructor(dest) {
-		this.dest = dest;
-		/** @type {number} */
-		this.cursor = 0;
-		/** @type {Uint8Array[]} */
-		this.chunks = [dest];
-	}
-	reset() {
-		this.cursor = 0;
-	}
-	/**
-	* @param {Uint8Array|number[]} bytes
-	*/
-	push(bytes) {
-		if (this.cursor + bytes.length > this.dest.length) throw new Error("write out of bounds, destination buffer is too small");
-		this.dest.set(bytes, this.cursor);
-		this.cursor += bytes.length;
-	}
-	/**
-	* @param {boolean} [reset]
-	* @returns {Uint8Array}
-	*/
-	toBytes(reset = false) {
-		const byts = this.dest.subarray(0, this.cursor);
-		if (reset) this.reset();
-		return byts;
-	}
-};
+	};
+}
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/common.js
-var decodeErrPrefix = "CBOR decode error:";
-var encodeErrPrefix = "CBOR encode error:";
-var uintMinorPrefixBytes = [];
-uintMinorPrefixBytes[23] = 1;
-uintMinorPrefixBytes[24] = 2;
-uintMinorPrefixBytes[25] = 3;
-uintMinorPrefixBytes[26] = 5;
-uintMinorPrefixBytes[27] = 9;
-/**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} need
-*/
-function assertEnoughData(data, pos, need) {
-	if (data.length - pos < need) throw new Error(`${decodeErrPrefix} not enough data for type`);
+//#region ../sdk/src/namespaces/tasks.ts
+function createTasksNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async schemas() {
+			return unwrapResult(await listTaskSchemas({
+				client,
+				auth
+			}));
+		},
+		async list(query) {
+			return unwrapResult(await listTasks({
+				client,
+				auth,
+				query
+			}));
+		},
+		async create(body) {
+			return unwrapResult(await createTask({
+				client,
+				auth,
+				body
+			}));
+		},
+		async get(id) {
+			return unwrapResult(await getTask({
+				client,
+				auth,
+				path: { id }
+			}));
+		},
+		async claim(id, body) {
+			const result = await claimTask({
+				client,
+				auth,
+				path: { id },
+				body
+			});
+			const data = unwrapResult(result);
+			const traceHeaders = {};
+			const traceparent = result.response.headers.get("traceparent");
+			if (traceparent) {
+				traceHeaders["traceparent"] = traceparent;
+				const tracestate = result.response.headers.get("tracestate");
+				if (tracestate) traceHeaders["tracestate"] = tracestate;
+			}
+			return {
+				...data,
+				traceHeaders
+			};
+		},
+		async heartbeat(id, n, body) {
+			return unwrapResult(await taskHeartbeat({
+				client,
+				auth,
+				path: {
+					id,
+					n
+				},
+				body
+			}));
+		},
+		async complete(id, n, body) {
+			return unwrapResult(await completeTask({
+				client,
+				auth,
+				path: {
+					id,
+					n
+				},
+				body
+			}));
+		},
+		async fail(id, n, body) {
+			return unwrapResult(await failTask({
+				client,
+				auth,
+				path: {
+					id,
+					n
+				},
+				body
+			}));
+		},
+		async cancel(id, body) {
+			return unwrapResult(await cancelTask({
+				client,
+				auth,
+				path: { id },
+				body
+			}));
+		},
+		async listAttempts(id) {
+			return unwrapResult(await listTaskAttempts({
+				client,
+				auth,
+				path: { id }
+			}));
+		},
+		async listMessages(id, n, query) {
+			return unwrapResult(await listTaskMessages({
+				client,
+				auth,
+				path: {
+					id,
+					n
+				},
+				query
+			}));
+		},
+		async appendMessages(id, n, body) {
+			return unwrapResult(await appendTaskMessages({
+				client,
+				auth,
+				path: {
+					id,
+					n
+				},
+				body
+			}));
+		}
+	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/0uint.js
-var uintBoundaries = [
-	24,
-	256,
-	65536,
-	4294967296,
-	BigInt("18446744073709551616")
-];
-/**
-* @typedef {import('../interface').ByteWriter} ByteWriter
-* @typedef {import('../interface').DecodeOptions} DecodeOptions
-*/
-/**
-* @param {Uint8Array} data
-* @param {number} offset
-* @param {DecodeOptions} options
-* @returns {number}
-*/
-function readUint8(data, offset, options) {
-	assertEnoughData(data, offset, 1);
-	const value = data[offset];
-	if (options.strict === true && value < uintBoundaries[0]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
-	return value;
-}
-/**
-* @param {Uint8Array} data
-* @param {number} offset
-* @param {DecodeOptions} options
-* @returns {number}
-*/
-function readUint16(data, offset, options) {
-	assertEnoughData(data, offset, 2);
-	const value = data[offset] << 8 | data[offset + 1];
-	if (options.strict === true && value < uintBoundaries[1]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
-	return value;
+//#region ../sdk/src/namespaces/teams.ts
+function createTeamsNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async list() {
+			return unwrapResult(await listTeams({
+				client,
+				auth
+			}));
+		},
+		async get(id) {
+			return unwrapResult(await getTeam({
+				client,
+				auth,
+				path: { id }
+			}));
+		},
+		async listMembers(id) {
+			return unwrapResult(await listTeamMembers({
+				client,
+				auth,
+				path: { id }
+			}));
+		},
+		async create(body) {
+			return unwrapResult(await createTeam({
+				client,
+				auth,
+				body
+			}));
+		},
+		async join(code) {
+			return unwrapResult(await joinTeam({
+				client,
+				auth,
+				body: { code }
+			}));
+		},
+		async delete(id) {
+			return unwrapResult(await deleteTeam({
+				client,
+				auth,
+				path: { id }
+			}));
+		},
+		async removeMember(teamId, subjectId) {
+			return unwrapResult(await removeTeamMember({
+				client,
+				auth,
+				path: {
+					id: teamId,
+					subjectId
+				}
+			}));
+		},
+		invites: {
+			async create(teamId, body) {
+				return unwrapResult(await createTeamInvite({
+					client,
+					auth,
+					path: { id: teamId },
+					body
+				}));
+			},
+			async list(teamId) {
+				return unwrapResult(await listTeamInvites({
+					client,
+					auth,
+					path: { id: teamId }
+				}));
+			},
+			async delete(teamId, inviteId) {
+				return unwrapResult(await deleteTeamInvite({
+					client,
+					auth,
+					path: {
+						id: teamId,
+						inviteId
+					}
+				}));
+			}
+		}
+	};
 }
-/**
-* @param {Uint8Array} data
-* @param {number} offset
-* @param {DecodeOptions} options
-* @returns {number}
-*/
-function readUint32(data, offset, options) {
-	assertEnoughData(data, offset, 4);
-	const value = data[offset] * 16777216 + (data[offset + 1] << 16) + (data[offset + 2] << 8) + data[offset + 3];
-	if (options.strict === true && value < uintBoundaries[2]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
-	return value;
+//#endregion
+//#region ../sdk/src/namespaces/vouch.ts
+function createVouchNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async issue() {
+			return unwrapResult(await issueVoucher({
+				client,
+				auth
+			}));
+		},
+		async listActive() {
+			return unwrapResult(await listActiveVouchers({
+				client,
+				auth
+			}));
+		},
+		async trustGraph(query) {
+			return unwrapResult(await getTrustGraph({
+				client,
+				query
+			}));
+		}
+	};
 }
-/**
-* @param {Uint8Array} data
-* @param {number} offset
-* @param {DecodeOptions} options
-* @returns {number|bigint}
-*/
-function readUint64(data, offset, options) {
-	assertEnoughData(data, offset, 8);
-	const hi = data[offset] * 16777216 + (data[offset + 1] << 16) + (data[offset + 2] << 8) + data[offset + 3];
-	const lo = data[offset + 4] * 16777216 + (data[offset + 5] << 16) + (data[offset + 6] << 8) + data[offset + 7];
-	const value = (BigInt(hi) << BigInt(32)) + BigInt(lo);
-	if (options.strict === true && value < uintBoundaries[3]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
-	if (value <= Number.MAX_SAFE_INTEGER) return Number(value);
-	if (options.allowBigInt === true) return value;
-	throw new Error(`${decodeErrPrefix} integers outside of the safe integer range are not supported`);
+//#endregion
+//#region ../sdk/src/agent.ts
+function createAgent(options) {
+	const { client, tokenManager, auth } = options;
+	const context = {
+		client,
+		auth
+	};
+	return {
+		diaries: createDiariesNamespace(context),
+		diaryGrants: createDiaryGrantsNamespace(context),
+		packs: createPacksNamespace(context),
+		entries: createEntriesNamespace(context),
+		agents: createAgentsNamespace(context),
+		crypto: createCryptoNamespace(context, createSigningRequestsNamespace(context)),
+		vouch: createVouchNamespace(context),
+		auth: createAuthNamespace(context),
+		recovery: createRecoveryNamespace(context),
+		public: createPublicNamespace(context),
+		legreffier: createLegreffierNamespace(context),
+		problems: createProblemsNamespace(context),
+		teams: createTeamsNamespace(context),
+		tasks: createTasksNamespace(context),
+		client,
+		getToken: () => tokenManager.getToken()
+	};
 }
+//#endregion
+//#region ../sdk/src/config.ts
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* Read MoltNet credentials from environment variables.
+* Reads MOLTNET_CLIENT_ID, MOLTNET_CLIENT_SECRET, and MOLTNET_API_URL.
 */
-function decodeUint8(data, pos, _minor, options) {
-	return new Token(Type$2.uint, readUint8(data, pos + 1, options), 2);
+function readEnvCredentials() {
+	return {
+		clientId: process.env.MOLTNET_CLIENT_ID,
+		clientSecret: process.env.MOLTNET_CLIENT_SECRET,
+		apiUrl: process.env.MOLTNET_API_URL
+	};
 }
-/**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
-*/
-function decodeUint16(data, pos, _minor, options) {
-	return new Token(Type$2.uint, readUint16(data, pos + 1, options), 3);
+//#endregion
+//#region ../sdk/src/credentials.ts
+function getConfigDir() {
+	return join(homedir(), ".config", "moltnet");
 }
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* Read the MoltNet config file.
+* Tries `moltnet.json` first; falls back to `credentials.json` with a
+* deprecation warning printed to stderr.
 */
-function decodeUint32(data, pos, _minor, options) {
-	return new Token(Type$2.uint, readUint32(data, pos + 1, options), 5);
+async function readConfig(configDir) {
+	const dir = configDir ?? getConfigDir();
+	try {
+		const content = await readFile(join(dir, "moltnet.json"), "utf-8");
+		return JSON.parse(content);
+	} catch {}
+	try {
+		const content = await readFile(join(dir, "credentials.json"), "utf-8");
+		console.warn("Warning: credentials.json is deprecated. New writes use moltnet.json. Support will be removed in 3 minor versions.");
+		return JSON.parse(content);
+	} catch {
+		return null;
+	}
 }
+//#endregion
+//#region ../sdk/src/retry.ts
+var AUTH_RETRY_DEFAULT = 1;
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* Create a fetch wrapper that retries on 401 and 429.
+*
+* - **401**: Invalidates the cached token, re-authenticates, replays once.
+* - **429**: Delegates to `createRateLimitFetch` from `@moltnet/api-client/retry`.
+*
+* 5xx and network errors are not retried — non-idempotent methods (POST, PATCH)
+* could cause duplicate side effects.
 */
-function decodeUint64(data, pos, _minor, options) {
-	return new Token(Type$2.uint, readUint64(data, pos + 1, options), 9);
+function createRetryFetch(tokenManager, options) {
+	const maxAuthRetries = options?.maxAuthRetries ?? AUTH_RETRY_DEFAULT;
+	const rateLimitFetch = createRateLimitFetch({
+		maxRetries: options?.maxRateLimitRetries,
+		baseDelayMs: options?.baseDelayMs,
+		maxDelayMs: options?.maxDelayMs
+	});
+	return async (input, init) => {
+		let authRetries = 0;
+		const doFetch = async (fetchInit) => {
+			const response = await rateLimitFetch(input, fetchInit);
+			if (response.status === 401 && authRetries < maxAuthRetries) {
+				authRetries++;
+				tokenManager.invalidate();
+				const freshToken = await tokenManager.authenticate();
+				const headers = new Headers(fetchInit?.headers);
+				headers.set("Authorization", `Bearer ${freshToken}`);
+				return doFetch({
+					...fetchInit,
+					headers
+				});
+			}
+			return response;
+		};
+		return doFetch(init);
+	};
 }
-/**
-* @param {ByteWriter} writer
-* @param {Token} token
-*/
-function encodeUint(writer, token) {
-	return encodeUintValue(writer, 0, token.value);
+//#endregion
+//#region ../sdk/src/token.ts
+var TokenManager = class {
+	clientId;
+	clientSecret;
+	tokenUrl;
+	expiryBufferMs;
+	cached = null;
+	constructor(options) {
+		const apiUrl = options.apiUrl.replace(/\/$/, "");
+		this.clientId = options.clientId;
+		this.clientSecret = options.clientSecret;
+		this.tokenUrl = `${apiUrl}/oauth2/token`;
+		this.expiryBufferMs = options.expiryBufferMs ?? 3e4;
+	}
+	/** Return a valid access token, obtaining or refreshing as needed. */
+	async getToken() {
+		if (this.cached && Date.now() < this.cached.expiresAt) return this.cached.accessToken;
+		return this.authenticate();
+	}
+	/** Force-obtain a new token, replacing any cached value. */
+	async authenticate() {
+		const body = new URLSearchParams({
+			grant_type: "client_credentials",
+			client_id: this.clientId,
+			client_secret: this.clientSecret
+		});
+		let response;
+		try {
+			response = await fetch(this.tokenUrl, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body: body.toString()
+			});
+		} catch (error) {
+			throw new NetworkError(error instanceof Error ? error.message : "Token request failed", { detail: error instanceof Error ? error.cause?.toString() : String(error) });
+		}
+		const json = await response.json();
+		if (!response.ok || "error" in json) {
+			const errBody = json;
+			throw new AuthenticationError(errBody.error_description ?? errBody.error, {
+				statusCode: response.status,
+				detail: errBody.error
+			});
+		}
+		const tokenBody = json;
+		this.cached = {
+			accessToken: tokenBody.access_token,
+			expiresAt: Date.now() + tokenBody.expires_in * 1e3 - this.expiryBufferMs
+		};
+		return this.cached.accessToken;
+	}
+	/** Clear the cached token. Next getToken() call will re-authenticate. */
+	invalidate() {
+		this.cached = null;
+	}
+};
+//#endregion
+//#region ../sdk/src/connect.ts
+var DEFAULT_API_URL = "https://api.themolt.net";
+async function resolveCredentials(options) {
+	if (options.clientId && options.clientSecret) return {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		apiUrl: (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
+	};
+	const env = readEnvCredentials();
+	if (env.clientId && env.clientSecret) return {
+		clientId: env.clientId,
+		clientSecret: env.clientSecret,
+		apiUrl: (env.apiUrl ?? options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
+	};
+	const config = await readConfig(options.configDir);
+	if (config?.oauth2?.client_id && config?.oauth2?.client_secret) return {
+		clientId: config.oauth2.client_id,
+		clientSecret: config.oauth2.client_secret,
+		apiUrl: (options.apiUrl ?? config.endpoints?.api ?? DEFAULT_API_URL).replace(/\/$/, "")
+	};
+	throw new MoltNetError("No credentials found. Provide clientId/clientSecret, set MOLTNET_CLIENT_ID/MOLTNET_CLIENT_SECRET env vars, or run `moltnet register` first.", { code: "NO_CREDENTIALS" });
 }
 /**
-* @param {ByteWriter} writer
-* @param {number} major
-* @param {number|bigint} uint
+* Connect to MoltNet and return an authenticated Agent facade.
+*
+* Credential resolution order:
+* 1. Explicit `clientId` / `clientSecret` in options
+* 2. `MOLTNET_CLIENT_ID` / `MOLTNET_CLIENT_SECRET` environment variables
+* 3. Config file (`~/.config/moltnet/moltnet.json`)
 */
-function encodeUintValue(writer, major, uint) {
-	if (uint < uintBoundaries[0]) {
-		const nuint = Number(uint);
-		writer.push([major | nuint]);
-	} else if (uint < uintBoundaries[1]) {
-		const nuint = Number(uint);
-		writer.push([major | 24, nuint]);
-	} else if (uint < uintBoundaries[2]) {
-		const nuint = Number(uint);
-		writer.push([
-			major | 25,
-			nuint >>> 8,
-			nuint & 255
-		]);
-	} else if (uint < uintBoundaries[3]) {
-		const nuint = Number(uint);
-		writer.push([
-			major | 26,
-			nuint >>> 24 & 255,
-			nuint >>> 16 & 255,
-			nuint >>> 8 & 255,
-			nuint & 255
-		]);
-	} else {
-		const buint = BigInt(uint);
-		if (buint < uintBoundaries[4]) {
-			const set = [
-				major | 27,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0,
-				0
-			];
-			let lo = Number(buint & BigInt(4294967295));
-			let hi = Number(buint >> BigInt(32) & BigInt(4294967295));
-			set[8] = lo & 255;
-			lo = lo >> 8;
-			set[7] = lo & 255;
-			lo = lo >> 8;
-			set[6] = lo & 255;
-			lo = lo >> 8;
-			set[5] = lo & 255;
-			set[4] = hi & 255;
-			hi = hi >> 8;
-			set[3] = hi & 255;
-			hi = hi >> 8;
-			set[2] = hi & 255;
-			hi = hi >> 8;
-			set[1] = hi & 255;
-			writer.push(set);
-		} else throw new Error(`${decodeErrPrefix} encountered BigInt larger than allowable range`);
-	}
+async function connect(options = {}) {
+	const creds = await resolveCredentials(options);
+	const autoToken = options.autoToken ?? true;
+	const tokenManager = new TokenManager({
+		clientId: creds.clientId,
+		clientSecret: creds.clientSecret,
+		apiUrl: creds.apiUrl
+	});
+	const retryFetch = autoToken && options.retry !== false ? createRetryFetch(tokenManager, options.retry === void 0 ? void 0 : options.retry) : void 0;
+	const customFetch = retryFetch ?? (autoToken && !retryFetch ? async (input, init) => {
+		const response = await fetch(input, init);
+		if (response.status === 401) tokenManager.invalidate();
+		return response;
+	} : void 0);
+	return createAgent({
+		client: createClient({
+			baseUrl: creds.apiUrl,
+			...customFetch && { fetch: customFetch }
+		}),
+		tokenManager,
+		auth: autoToken ? () => tokenManager.getToken() : void 0
+	});
 }
-/**
-* @param {Token} token
-* @returns {number}
-*/
-encodeUint.encodedSize = function encodedSize(token) {
-	return encodeUintValue.encodedSize(token.value);
+new TextEncoder();
+//#endregion
+//#region ../crypto-service/src/crypto.service.ts
+etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
 };
+//#endregion
+//#region ../crypto-service/src/executor-attestation.ts
+etc.sha512Sync = (...m) => {
+	const hash = createHash("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
+//#endregion
+//#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/codecs/json.js
+var textEncoder$1 = new TextEncoder();
+new TextDecoder();
+function encode(node) {
+	return textEncoder$1.encode(JSON.stringify(node));
+}
+//#endregion
+//#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/hashes/hasher.js
+var DEFAULT_MIN_DIGEST_LENGTH = 20;
+function from({ name, code, encode, minDigestLength, maxDigestLength }) {
+	return new Hasher(name, code, encode, minDigestLength, maxDigestLength);
+}
 /**
-* @param {number} uint
-* @returns {number}
+* Hasher represents a hashing algorithm implementation that produces as
+* `MultihashDigest`.
 */
-encodeUintValue.encodedSize = function encodedSize(uint) {
-	if (uint < uintBoundaries[0]) return 1;
-	if (uint < uintBoundaries[1]) return 2;
-	if (uint < uintBoundaries[2]) return 3;
-	if (uint < uintBoundaries[3]) return 5;
-	return 9;
+var Hasher = class {
+	name;
+	code;
+	encode;
+	minDigestLength;
+	maxDigestLength;
+	constructor(name, code, encode, minDigestLength, maxDigestLength) {
+		this.name = name;
+		this.code = code;
+		this.encode = encode;
+		this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH;
+		this.maxDigestLength = maxDigestLength;
+	}
+	digest(input, options) {
+		if (options?.truncate != null) {
+			if (options.truncate < this.minDigestLength) throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`);
+			if (this.maxDigestLength != null && options.truncate > this.maxDigestLength) throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`);
+		}
+		if (input instanceof Uint8Array) {
+			const result = this.encode(input);
+			if (result instanceof Uint8Array) return createDigest(result, this.code, options?.truncate);
+			return result.then((digest) => createDigest(digest, this.code, options?.truncate));
+		} else throw Error("Unknown type, must be binary type");
+	}
 };
 /**
-* @param {Token} tok1
-* @param {Token} tok2
-* @returns {number}
+* Create a Digest from the passed uint8array and code, optionally truncating it
+* first.
 */
-encodeUint.compareTokens = function compareTokens(tok1, tok2) {
-	return tok1.value < tok2.value ? -1 : tok1.value > tok2.value ? 1 : 0;
-};
+function createDigest(digest, code, truncate) {
+	if (truncate != null && truncate !== digest.byteLength) {
+		if (truncate > digest.byteLength) throw new Error(`Invalid truncate option, must be less than or equal to ${digest.byteLength}`);
+		digest = digest.subarray(0, truncate);
+	}
+	return create(code, digest);
+}
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/1negint.js
+//#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/hashes/sha2.js
+var sha256 = from({
+	name: "sha2-256",
+	code: 18,
+	encode: (input) => coerce(crypto.createHash("sha256").update(input).digest())
+});
+from({
+	name: "sha2-512",
+	code: 19,
+	encode: (input) => coerce(crypto.createHash("sha512").update(input).digest())
+});
+//#endregion
+//#region ../crypto-service/src/json-cid.ts
 /**
-* @typedef {import('../interface').ByteWriter} ByteWriter
-* @typedef {import('../interface').DecodeOptions} DecodeOptions
+* Generic JSON CID — CIDv1 for arbitrary JSON-serialisable values.
+*
+* Uses the dag-json codec and sha2-256, producing a base32lower CIDv1.
+* Suitable for content-addressing task inputs, schema objects, and other
+* JSON payloads that don't need diary-entry canonical normalisation.
 */
+async function computeJsonCid(value) {
+	const bytes = encode(value);
+	const hash = await sha256.digest(bytes);
+	return CID.create(1, 512, hash).toString();
+}
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/is.js
+var objectTypeNames = [
+	"Object",
+	"RegExp",
+	"Date",
+	"Error",
+	"Map",
+	"Set",
+	"WeakMap",
+	"WeakSet",
+	"ArrayBuffer",
+	"SharedArrayBuffer",
+	"DataView",
+	"Promise",
+	"URL",
+	"HTMLElement",
+	"Int8Array",
+	"Uint8ClampedArray",
+	"Int16Array",
+	"Uint16Array",
+	"Int32Array",
+	"Uint32Array",
+	"Float32Array",
+	"Float64Array",
+	"BigInt64Array",
+	"BigUint64Array"
+];
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* @param {any} value
+* @returns {string}
 */
-function decodeNegint8(data, pos, _minor, options) {
-	return new Token(Type$2.negint, -1 - readUint8(data, pos + 1, options), 2);
+function is(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "undefined";
+	if (value === true || value === false) return "boolean";
+	const typeOf = typeof value;
+	if (typeOf === "string" || typeOf === "number" || typeOf === "bigint" || typeOf === "symbol") return typeOf;
+	/* c8 ignore next 3 */
+	if (typeOf === "function") return "Function";
+	if (Array.isArray(value)) return "Array";
+	if (value instanceof Uint8Array) return "Uint8Array";
+	if (value.constructor === Object) return "Object";
+	const objectType = getObjectType(value);
+	if (objectType) return objectType;
+	/* c8 ignore next */
+	return "Object";
 }
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* @param {any} value
+* @returns {string|undefined}
 */
-function decodeNegint16(data, pos, _minor, options) {
-	return new Token(Type$2.negint, -1 - readUint16(data, pos + 1, options), 3);
+function getObjectType(value) {
+	const objectTypeName = Object.prototype.toString.call(value).slice(8, -1);
+	if (objectTypeNames.includes(objectTypeName)) return objectTypeName;
 }
-/**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
-*/
-function decodeNegint32(data, pos, _minor, options) {
-	return new Token(Type$2.negint, -1 - readUint32(data, pos + 1, options), 5);
-}
-var neg1b = BigInt(-1);
-var pos1b = BigInt(1);
-/**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
-*/
-function decodeNegint64(data, pos, _minor, options) {
-	const int = readUint64(data, pos + 1, options);
-	if (typeof int !== "bigint") {
-		const value = -1 - int;
-		if (value >= Number.MIN_SAFE_INTEGER) return new Token(Type$2.negint, value, 9);
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/token.js
+var Type$2 = class {
+	/**
+	* @param {number} major
+	* @param {string} name
+	* @param {boolean} terminal
+	*/
+	constructor(major, name, terminal) {
+		this.major = major;
+		this.majorEncoded = major << 5;
+		this.name = name;
+		this.terminal = terminal;
+	}
+	/* c8 ignore next 3 */
+	toString() {
+		return `Type[${this.major}].${this.name}`;
+	}
+	/**
+	* @param {Type} typ
+	* @returns {number}
+	*/
+	compare(typ) {
+		/* c8 ignore next 1 */
+		return this.major < typ.major ? -1 : this.major > typ.major ? 1 : 0;
+	}
+	/**
+	* Check equality between two Type instances. Safe to use across different
+	* copies of the Type class (e.g., when bundlers duplicate the module).
+	* (major, name) uniquely identifies a Type; terminal is implied by these.
+	* @param {Type} a
+	* @param {Type} b
+	* @returns {boolean}
+	*/
+	static equals(a, b) {
+		return a === b || a.major === b.major && a.name === b.name;
 	}
-	if (options.allowBigInt !== true) throw new Error(`${decodeErrPrefix} integers outside of the safe integer range are not supported`);
-	return new Token(Type$2.negint, neg1b - BigInt(int), 9);
-}
-/**
-* @param {ByteWriter} writer
-* @param {Token} token
-*/
-function encodeNegint(writer, token) {
-	const negint = token.value;
-	const unsigned = typeof negint === "bigint" ? negint * neg1b - pos1b : negint * -1 - 1;
-	encodeUintValue(writer, token.type.majorEncoded, unsigned);
-}
-/**
-* @param {Token} token
-* @returns {number}
-*/
-encodeNegint.encodedSize = function encodedSize(token) {
-	const negint = token.value;
-	const unsigned = typeof negint === "bigint" ? negint * neg1b - pos1b : negint * -1 - 1;
-	/* c8 ignore next 4 */
-	if (unsigned < uintBoundaries[0]) return 1;
-	if (unsigned < uintBoundaries[1]) return 2;
-	if (unsigned < uintBoundaries[2]) return 3;
-	if (unsigned < uintBoundaries[3]) return 5;
-	return 9;
 };
-/**
-* @param {Token} tok1
-* @param {Token} tok2
-* @returns {number}
-*/
-encodeNegint.compareTokens = function compareTokens(tok1, tok2) {
-	return tok1.value < tok2.value ? 1 : tok1.value > tok2.value ? -1 : 0;
+Type$2.uint = new Type$2(0, "uint", true);
+Type$2.negint = new Type$2(1, "negint", true);
+Type$2.bytes = new Type$2(2, "bytes", true);
+Type$2.string = new Type$2(3, "string", true);
+Type$2.array = new Type$2(4, "array", false);
+Type$2.map = new Type$2(5, "map", false);
+Type$2.tag = new Type$2(6, "tag", false);
+Type$2.float = new Type$2(7, "float", true);
+Type$2.false = new Type$2(7, "false", true);
+Type$2.true = new Type$2(7, "true", true);
+Type$2.null = new Type$2(7, "null", true);
+Type$2.undefined = new Type$2(7, "undefined", true);
+Type$2.break = new Type$2(7, "break", true);
+var Token = class {
+	/**
+	* @param {Type} type
+	* @param {any} [value]
+	* @param {number} [encodedLength]
+	*/
+	constructor(type, value, encodedLength) {
+		this.type = type;
+		this.value = value;
+		this.encodedLength = encodedLength;
+		/** @type {Uint8Array|undefined} */
+		this.encodedBytes = void 0;
+		/** @type {Uint8Array|undefined} */
+		this.byteValue = void 0;
+	}
+	/* c8 ignore next 3 */
+	toString() {
+		return `Token[${this.type}].${this.value}`;
+	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/2bytes.js
-/**
-* @typedef {import('../interface').ByteWriter} ByteWriter
-* @typedef {import('../interface').DecodeOptions} DecodeOptions
-*/
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/byte-utils.js
+var useBuffer = globalThis.process && !globalThis.process.browser && globalThis.Buffer && typeof globalThis.Buffer.isBuffer === "function";
+var textEncoder = new TextEncoder();
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} prefix
-* @param {number} length
-* @returns {Token}
+* @param {Uint8Array} buf
+* @returns {boolean}
 */
-function toToken$3(data, pos, prefix, length) {
-	assertEnoughData(data, pos, prefix + length);
-	const buf = data.slice(pos + prefix, pos + prefix + length);
-	return new Token(Type$2.bytes, buf, prefix + length);
+function isBuffer(buf) {
+	return useBuffer && globalThis.Buffer.isBuffer(buf);
 }
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} minor
-* @param {DecodeOptions} _options
-* @returns {Token}
+* @param {Uint8Array|number[]} buf
+* @returns {Uint8Array}
 */
-function decodeBytesCompact(data, pos, minor, _options) {
-	return toToken$3(data, pos, 1, minor);
+function asU8A(buf) {
+	/* c8 ignore next */
+	if (!(buf instanceof Uint8Array)) return Uint8Array.from(buf);
+	return isBuffer(buf) ? new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength) : buf;
 }
+var FROM_STRING_THRESHOLD_BUFFER = 24;
+var FROM_STRING_THRESHOLD_TEXTENCODER = 200;
+var fromString = useBuffer ? (string) => {
+	return string.length >= FROM_STRING_THRESHOLD_BUFFER ? globalThis.Buffer.from(string) : utf8ToBytes(string);
+} : (string) => {
+	return string.length >= FROM_STRING_THRESHOLD_TEXTENCODER ? textEncoder.encode(string) : utf8ToBytes(string);
+};
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* Buffer variant not fast enough for what we need
+* @param {number[]} arr
+* @returns {Uint8Array}
 */
-function decodeBytes8(data, pos, _minor, options) {
-	return toToken$3(data, pos, 2, readUint8(data, pos + 1, options));
-}
+var fromArray = (arr) => {
+	return Uint8Array.from(arr);
+};
+var slice = useBuffer ? (bytes, start, end) => {
+	if (isBuffer(bytes)) return new Uint8Array(bytes.subarray(start, end));
+	return bytes.slice(start, end);
+} : (bytes, start, end) => {
+	return bytes.slice(start, end);
+};
+var concat = useBuffer ? (chunks, length) => {
+	/* c8 ignore next 1 */
+	chunks = chunks.map((c) => c instanceof Uint8Array ? c : globalThis.Buffer.from(c));
+	return asU8A(globalThis.Buffer.concat(chunks, length));
+} : (chunks, length) => {
+	const out = new Uint8Array(length);
+	let off = 0;
+	for (let b of chunks) {
+		if (off + b.length > out.length) b = b.subarray(0, out.length - off);
+		out.set(b, off);
+		off += b.length;
+	}
+	return out;
+};
+var alloc = useBuffer ? (size) => {
+	return globalThis.Buffer.allocUnsafe(size);
+} : (size) => {
+	return new Uint8Array(size);
+};
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* @param {Uint8Array} b1
+* @param {Uint8Array} b2
+* @returns {number}
 */
-function decodeBytes16(data, pos, _minor, options) {
-	return toToken$3(data, pos, 3, readUint16(data, pos + 1, options));
+function compare(b1, b2) {
+	/* c8 ignore next 5 */
+	if (isBuffer(b1) && isBuffer(b2)) return b1.compare(b2);
+	for (let i = 0; i < b1.length; i++) {
+		if (b1[i] === b2[i]) continue;
+		return b1[i] < b2[i] ? -1 : 1;
+	}
+	return 0;
 }
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* @param {string} str
+* @returns {number[]}
 */
-function decodeBytes32(data, pos, _minor, options) {
-	return toToken$3(data, pos, 5, readUint32(data, pos + 1, options));
+function utf8ToBytes(str) {
+	const out = [];
+	let p = 0;
+	for (let i = 0; i < str.length; i++) {
+		let c = str.charCodeAt(i);
+		if (c < 128) out[p++] = c;
+		else if (c < 2048) {
+			out[p++] = c >> 6 | 192;
+			out[p++] = c & 63 | 128;
+		} else if ((c & 64512) === 55296 && i + 1 < str.length && (str.charCodeAt(i + 1) & 64512) === 56320) {
+			c = 65536 + ((c & 1023) << 10) + (str.charCodeAt(++i) & 1023);
+			out[p++] = c >> 18 | 240;
+			out[p++] = c >> 12 & 63 | 128;
+			out[p++] = c >> 6 & 63 | 128;
+			out[p++] = c & 63 | 128;
+		} else {
+			if (c >= 55296 && c <= 57343) c = 65533;
+			out[p++] = c >> 12 | 224;
+			out[p++] = c >> 6 & 63 | 128;
+			out[p++] = c & 63 | 128;
+		}
+	}
+	return out;
 }
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/bl.js
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
-*/
-function decodeBytes64(data, pos, _minor, options) {
-	const l = readUint64(data, pos + 1, options);
-	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer bytes lengths not supported`);
-	return toToken$3(data, pos, 9, l);
-}
-/**
-* `encodedBytes` allows for caching when we do a byte version of a string
-* for key sorting purposes
-* @param {Token} token
-* @returns {Uint8Array}
-*/
-function tokenBytes(token) {
-	if (token.encodedBytes === void 0) token.encodedBytes = Type$2.equals(token.type, Type$2.string) ? fromString(token.value) : token.value;
-	return token.encodedBytes;
-}
-/**
-* @param {ByteWriter} writer
-* @param {Token} token
-*/
-function encodeBytes(writer, token) {
-	const bytes = tokenBytes(token);
-	encodeUintValue(writer, token.type.majorEncoded, bytes.length);
-	writer.push(bytes);
-}
-/**
-* @param {Token} token
-* @returns {number}
+* Bl is a list of byte chunks, similar to https://github.com/rvagg/bl but for
+* writing rather than reading.
+* A Bl object accepts set() operations for individual bytes and copyTo() for
+* inserting byte arrays. These write operations don't automatically increment
+* the internal cursor so its "length" won't be changed. Instead, increment()
+* must be called to extend its length to cover the inserted data.
+* The toBytes() call will convert all internal memory to a single Uint8Array of
+* the correct length, truncating any data that is stored but hasn't been
+* included by an increment().
+* get() can retrieve a single byte.
+* All operations (except toBytes()) take an "offset" argument that will perform
+* the write at the offset _from the current cursor_. For most operations this
+* will be `0` to write at the current cursor position but it can be ahead of
+* the current cursor. Negative offsets probably work but are untested.
 */
-encodeBytes.encodedSize = function encodedSize(token) {
-	const bytes = tokenBytes(token);
-	return encodeUintValue.encodedSize(bytes.length) + bytes.length;
+var defaultChunkSize = 256;
+var Bl = class {
+	/**
+	* @param {number} [chunkSize]
+	*/
+	constructor(chunkSize = defaultChunkSize) {
+		this.chunkSize = chunkSize;
+		/** @type {number} */
+		this.cursor = 0;
+		/** @type {number} */
+		this.maxCursor = -1;
+		/** @type {(Uint8Array|number[])[]} */
+		this.chunks = [];
+		/** @type {Uint8Array|number[]|null} */
+		this._initReuseChunk = null;
+	}
+	reset() {
+		this.cursor = 0;
+		this.maxCursor = -1;
+		if (this.chunks.length) this.chunks = [];
+		if (this._initReuseChunk !== null) {
+			this.chunks.push(this._initReuseChunk);
+			this.maxCursor = this._initReuseChunk.length - 1;
+		}
+	}
+	/**
+	* @param {Uint8Array|number[]} bytes
+	*/
+	push(bytes) {
+		let topChunk = this.chunks[this.chunks.length - 1];
+		if (this.cursor + bytes.length <= this.maxCursor + 1) {
+			const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
+			topChunk.set(bytes, chunkPos);
+		} else {
+			if (topChunk) {
+				const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
+				if (chunkPos < topChunk.length) {
+					this.chunks[this.chunks.length - 1] = topChunk.subarray(0, chunkPos);
+					this.maxCursor = this.cursor - 1;
+				}
+			}
+			if (bytes.length < 64 && bytes.length < this.chunkSize) {
+				topChunk = alloc(this.chunkSize);
+				this.chunks.push(topChunk);
+				this.maxCursor += topChunk.length;
+				if (this._initReuseChunk === null) this._initReuseChunk = topChunk;
+				topChunk.set(bytes, 0);
+			} else {
+				this.chunks.push(bytes);
+				this.maxCursor += bytes.length;
+			}
+		}
+		this.cursor += bytes.length;
+	}
+	/**
+	* @param {boolean} [reset]
+	* @returns {Uint8Array}
+	*/
+	toBytes(reset = false) {
+		let byts;
+		if (this.chunks.length === 1) {
+			const chunk = this.chunks[0];
+			if (reset && this.cursor > chunk.length / 2) {
+				/* c8 ignore next 2 */
+				byts = this.cursor === chunk.length ? chunk : chunk.subarray(0, this.cursor);
+				this._initReuseChunk = null;
+				this.chunks = [];
+			} else byts = slice(chunk, 0, this.cursor);
+		} else byts = concat(this.chunks, this.cursor);
+		if (reset) this.reset();
+		return byts;
+	}
 };
 /**
-* @param {Token} tok1
-* @param {Token} tok2
-* @returns {number}
+* U8Bl is a buffer list that writes directly to a user-provided Uint8Array.
+* It provides the same interface as Bl but writes to a fixed destination.
 */
-encodeBytes.compareTokens = function compareTokens(tok1, tok2) {
-	return compareBytes(tokenBytes(tok1), tokenBytes(tok2));
+var U8Bl = class {
+	/**
+	* @param {Uint8Array} dest
+	*/
+	constructor(dest) {
+		this.dest = dest;
+		/** @type {number} */
+		this.cursor = 0;
+		/** @type {Uint8Array[]} */
+		this.chunks = [dest];
+	}
+	reset() {
+		this.cursor = 0;
+	}
+	/**
+	* @param {Uint8Array|number[]} bytes
+	*/
+	push(bytes) {
+		if (this.cursor + bytes.length > this.dest.length) throw new Error("write out of bounds, destination buffer is too small");
+		this.dest.set(bytes, this.cursor);
+		this.cursor += bytes.length;
+	}
+	/**
+	* @param {boolean} [reset]
+	* @returns {Uint8Array}
+	*/
+	toBytes(reset = false) {
+		const byts = this.dest.subarray(0, this.cursor);
+		if (reset) this.reset();
+		return byts;
+	}
 };
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/common.js
+var decodeErrPrefix = "CBOR decode error:";
+var encodeErrPrefix = "CBOR encode error:";
+var uintMinorPrefixBytes = [];
+uintMinorPrefixBytes[23] = 1;
+uintMinorPrefixBytes[24] = 2;
+uintMinorPrefixBytes[25] = 3;
+uintMinorPrefixBytes[26] = 5;
+uintMinorPrefixBytes[27] = 9;
 /**
-* @param {Uint8Array} b1
-* @param {Uint8Array} b2
-* @returns {number}
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} need
 */
-function compareBytes(b1, b2) {
-	return b1.length < b2.length ? -1 : b1.length > b2.length ? 1 : compare(b1, b2);
+function assertEnoughData(data, pos, need) {
+	if (data.length - pos < need) throw new Error(`${decodeErrPrefix} not enough data for type`);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/3string.js
-var textDecoder = new TextDecoder();
-var ASCII_THRESHOLD = 32;
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/0uint.js
+var uintBoundaries = [
+	24,
+	256,
+	65536,
+	4294967296,
+	BigInt("18446744073709551616")
+];
 /**
 * @typedef {import('../interface').ByteWriter} ByteWriter
 * @typedef {import('../interface').DecodeOptions} DecodeOptions
 */
 /**
-* Decode UTF-8 bytes to string. For short ASCII strings (common case for map keys),
-* a simple loop is faster than TextDecoder.
-* @param {Uint8Array} bytes
-* @param {number} start
-* @param {number} end
-* @returns {string}
-*/
-function toStr(bytes, start, end) {
-	if (end - start < ASCII_THRESHOLD) {
-		let str = "";
-		for (let i = start; i < end; i++) {
-			const c = bytes[i];
-			if (c & 128) return textDecoder.decode(bytes.subarray(start, end));
-			str += String.fromCharCode(c);
-		}
-		return str;
-	}
-	return textDecoder.decode(bytes.subarray(start, end));
-}
-/**
 * @param {Uint8Array} data
-* @param {number} pos
-* @param {number} prefix
-* @param {number} length
+* @param {number} offset
 * @param {DecodeOptions} options
-* @returns {Token}
+* @returns {number}
 */
-function toToken$2(data, pos, prefix, length, options) {
-	const totLength = prefix + length;
-	assertEnoughData(data, pos, totLength);
-	const tok = new Token(Type$2.string, toStr(data, pos + prefix, pos + totLength), totLength);
-	if (options.retainStringBytes === true) tok.byteValue = data.slice(pos + prefix, pos + totLength);
-	return tok;
+function readUint8(data, offset, options) {
+	assertEnoughData(data, offset, 1);
+	const value = data[offset];
+	if (options.strict === true && value < uintBoundaries[0]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+	return value;
 }
 /**
 * @param {Uint8Array} data
-* @param {number} pos
-* @param {number} minor
+* @param {number} offset
 * @param {DecodeOptions} options
-* @returns {Token}
+* @returns {number}
 */
-function decodeStringCompact(data, pos, minor, options) {
-	return toToken$2(data, pos, 1, minor, options);
+function readUint16(data, offset, options) {
+	assertEnoughData(data, offset, 2);
+	const value = data[offset] << 8 | data[offset + 1];
+	if (options.strict === true && value < uintBoundaries[1]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+	return value;
 }
 /**
 * @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
+* @param {number} offset
 * @param {DecodeOptions} options
-* @returns {Token}
+* @returns {number}
 */
-function decodeString8(data, pos, _minor, options) {
-	return toToken$2(data, pos, 2, readUint8(data, pos + 1, options), options);
+function readUint32(data, offset, options) {
+	assertEnoughData(data, offset, 4);
+	const value = data[offset] * 16777216 + (data[offset + 1] << 16) + (data[offset + 2] << 8) + data[offset + 3];
+	if (options.strict === true && value < uintBoundaries[2]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+	return value;
 }
 /**
 * @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
+* @param {number} offset
 * @param {DecodeOptions} options
-* @returns {Token}
+* @returns {number|bigint}
 */
-function decodeString16(data, pos, _minor, options) {
-	return toToken$2(data, pos, 3, readUint16(data, pos + 1, options), options);
+function readUint64(data, offset, options) {
+	assertEnoughData(data, offset, 8);
+	const hi = data[offset] * 16777216 + (data[offset + 1] << 16) + (data[offset + 2] << 8) + data[offset + 3];
+	const lo = data[offset + 4] * 16777216 + (data[offset + 5] << 16) + (data[offset + 6] << 8) + data[offset + 7];
+	const value = (BigInt(hi) << BigInt(32)) + BigInt(lo);
+	if (options.strict === true && value < uintBoundaries[3]) throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+	if (value <= Number.MAX_SAFE_INTEGER) return Number(value);
+	if (options.allowBigInt === true) return value;
+	throw new Error(`${decodeErrPrefix} integers outside of the safe integer range are not supported`);
 }
 /**
 * @param {Uint8Array} data
@@ -5276,8 +5657,8 @@ function decodeString16(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeString32(data, pos, _minor, options) {
-	return toToken$2(data, pos, 5, readUint32(data, pos + 1, options), options);
+function decodeUint8(data, pos, _minor, options) {
+	return new Token(Type$2.uint, readUint8(data, pos + 1, options), 2);
 }
 /**
 * @param {Uint8Array} data
@@ -5286,37 +5667,18 @@ function decodeString32(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeString64(data, pos, _minor, options) {
-	const l = readUint64(data, pos + 1, options);
-	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer string lengths not supported`);
-	return toToken$2(data, pos, 9, l, options);
-}
-var encodeString = encodeBytes;
-//#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/4array.js
-/**
-* @typedef {import('../interface').ByteWriter} ByteWriter
-* @typedef {import('../interface').DecodeOptions} DecodeOptions
-*/
-/**
-* @param {Uint8Array} _data
-* @param {number} _pos
-* @param {number} prefix
-* @param {number} length
-* @returns {Token}
-*/
-function toToken$1(_data, _pos, prefix, length) {
-	return new Token(Type$2.array, length, prefix);
+function decodeUint16(data, pos, _minor, options) {
+	return new Token(Type$2.uint, readUint16(data, pos + 1, options), 3);
 }
 /**
 * @param {Uint8Array} data
 * @param {number} pos
-* @param {number} minor
-* @param {DecodeOptions} _options
+* @param {number} _minor
+* @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeArrayCompact(data, pos, minor, _options) {
-	return toToken$1(data, pos, 1, minor);
+function decodeUint32(data, pos, _minor, options) {
+	return new Token(Type$2.uint, readUint32(data, pos + 1, options), 5);
 }
 /**
 * @param {Uint8Array} data
@@ -5325,18 +5687,118 @@ function decodeArrayCompact(data, pos, minor, _options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeArray8(data, pos, _minor, options) {
-	return toToken$1(data, pos, 2, readUint8(data, pos + 1, options));
+function decodeUint64(data, pos, _minor, options) {
+	return new Token(Type$2.uint, readUint64(data, pos + 1, options), 9);
+}
+/**
+* @param {ByteWriter} writer
+* @param {Token} token
+*/
+function encodeUint(writer, token) {
+	return encodeUintValue(writer, 0, token.value);
+}
+/**
+* @param {ByteWriter} writer
+* @param {number} major
+* @param {number|bigint} uint
+*/
+function encodeUintValue(writer, major, uint) {
+	if (uint < uintBoundaries[0]) {
+		const nuint = Number(uint);
+		writer.push([major | nuint]);
+	} else if (uint < uintBoundaries[1]) {
+		const nuint = Number(uint);
+		writer.push([major | 24, nuint]);
+	} else if (uint < uintBoundaries[2]) {
+		const nuint = Number(uint);
+		writer.push([
+			major | 25,
+			nuint >>> 8,
+			nuint & 255
+		]);
+	} else if (uint < uintBoundaries[3]) {
+		const nuint = Number(uint);
+		writer.push([
+			major | 26,
+			nuint >>> 24 & 255,
+			nuint >>> 16 & 255,
+			nuint >>> 8 & 255,
+			nuint & 255
+		]);
+	} else {
+		const buint = BigInt(uint);
+		if (buint < uintBoundaries[4]) {
+			const set = [
+				major | 27,
+				0,
+				0,
+				0,
+				0,
+				0,
+				0,
+				0
+			];
+			let lo = Number(buint & BigInt(4294967295));
+			let hi = Number(buint >> BigInt(32) & BigInt(4294967295));
+			set[8] = lo & 255;
+			lo = lo >> 8;
+			set[7] = lo & 255;
+			lo = lo >> 8;
+			set[6] = lo & 255;
+			lo = lo >> 8;
+			set[5] = lo & 255;
+			set[4] = hi & 255;
+			hi = hi >> 8;
+			set[3] = hi & 255;
+			hi = hi >> 8;
+			set[2] = hi & 255;
+			hi = hi >> 8;
+			set[1] = hi & 255;
+			writer.push(set);
+		} else throw new Error(`${decodeErrPrefix} encountered BigInt larger than allowable range`);
+	}
 }
 /**
+* @param {Token} token
+* @returns {number}
+*/
+encodeUint.encodedSize = function encodedSize(token) {
+	return encodeUintValue.encodedSize(token.value);
+};
+/**
+* @param {number} uint
+* @returns {number}
+*/
+encodeUintValue.encodedSize = function encodedSize(uint) {
+	if (uint < uintBoundaries[0]) return 1;
+	if (uint < uintBoundaries[1]) return 2;
+	if (uint < uintBoundaries[2]) return 3;
+	if (uint < uintBoundaries[3]) return 5;
+	return 9;
+};
+/**
+* @param {Token} tok1
+* @param {Token} tok2
+* @returns {number}
+*/
+encodeUint.compareTokens = function compareTokens(tok1, tok2) {
+	return tok1.value < tok2.value ? -1 : tok1.value > tok2.value ? 1 : 0;
+};
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/1negint.js
+/**
+* @typedef {import('../interface').ByteWriter} ByteWriter
+* @typedef {import('../interface').DecodeOptions} DecodeOptions
+*/
+/**
 * @param {Uint8Array} data
 * @param {number} pos
 * @param {number} _minor
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeArray16(data, pos, _minor, options) {
-	return toToken$1(data, pos, 3, readUint16(data, pos + 1, options));
+function decodeNegint8(data, pos, _minor, options) {
+	return new Token(Type$2.negint, -1 - readUint8(data, pos + 1, options), 2);
 }
 /**
 * @param {Uint8Array} data
@@ -5345,8 +5807,8 @@ function decodeArray16(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeArray32(data, pos, _minor, options) {
-	return toToken$1(data, pos, 5, readUint32(data, pos + 1, options));
+function decodeNegint16(data, pos, _minor, options) {
+	return new Token(Type$2.negint, -1 - readUint16(data, pos + 1, options), 3);
 }
 /**
 * @param {Uint8Array} data
@@ -5355,11 +5817,11 @@ function decodeArray32(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeArray64(data, pos, _minor, options) {
-	const l = readUint64(data, pos + 1, options);
-	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer array lengths not supported`);
-	return toToken$1(data, pos, 9, l);
+function decodeNegint32(data, pos, _minor, options) {
+	return new Token(Type$2.negint, -1 - readUint32(data, pos + 1, options), 5);
 }
+var neg1b = BigInt(-1);
+var pos1b = BigInt(1);
 /**
 * @param {Uint8Array} data
 * @param {number} pos
@@ -5367,40 +5829,63 @@ function decodeArray64(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeArrayIndefinite(data, pos, _minor, options) {
-	if (options.allowIndefinite === false) throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
-	return toToken$1(data, pos, 1, Infinity);
+function decodeNegint64(data, pos, _minor, options) {
+	const int = readUint64(data, pos + 1, options);
+	if (typeof int !== "bigint") {
+		const value = -1 - int;
+		if (value >= Number.MIN_SAFE_INTEGER) return new Token(Type$2.negint, value, 9);
+	}
+	if (options.allowBigInt !== true) throw new Error(`${decodeErrPrefix} integers outside of the safe integer range are not supported`);
+	return new Token(Type$2.negint, neg1b - BigInt(int), 9);
 }
 /**
 * @param {ByteWriter} writer
 * @param {Token} token
 */
-function encodeArray(writer, token) {
-	encodeUintValue(writer, Type$2.array.majorEncoded, token.value);
+function encodeNegint(writer, token) {
+	const negint = token.value;
+	const unsigned = typeof negint === "bigint" ? negint * neg1b - pos1b : negint * -1 - 1;
+	encodeUintValue(writer, token.type.majorEncoded, unsigned);
 }
-encodeArray.compareTokens = encodeUint.compareTokens;
 /**
 * @param {Token} token
 * @returns {number}
 */
-encodeArray.encodedSize = function encodedSize(token) {
-	return encodeUintValue.encodedSize(token.value);
+encodeNegint.encodedSize = function encodedSize(token) {
+	const negint = token.value;
+	const unsigned = typeof negint === "bigint" ? negint * neg1b - pos1b : negint * -1 - 1;
+	/* c8 ignore next 4 */
+	if (unsigned < uintBoundaries[0]) return 1;
+	if (unsigned < uintBoundaries[1]) return 2;
+	if (unsigned < uintBoundaries[2]) return 3;
+	if (unsigned < uintBoundaries[3]) return 5;
+	return 9;
+};
+/**
+* @param {Token} tok1
+* @param {Token} tok2
+* @returns {number}
+*/
+encodeNegint.compareTokens = function compareTokens(tok1, tok2) {
+	return tok1.value < tok2.value ? 1 : tok1.value > tok2.value ? -1 : 0;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/5map.js
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/2bytes.js
 /**
 * @typedef {import('../interface').ByteWriter} ByteWriter
 * @typedef {import('../interface').DecodeOptions} DecodeOptions
 */
 /**
-* @param {Uint8Array} _data
-* @param {number} _pos
+* @param {Uint8Array} data
+* @param {number} pos
 * @param {number} prefix
 * @param {number} length
 * @returns {Token}
 */
-function toToken(_data, _pos, prefix, length) {
-	return new Token(Type$2.map, length, prefix);
+function toToken$3(data, pos, prefix, length) {
+	assertEnoughData(data, pos, prefix + length);
+	const buf = data.slice(pos + prefix, pos + prefix + length);
+	return new Token(Type$2.bytes, buf, prefix + length);
 }
 /**
 * @param {Uint8Array} data
@@ -5409,8 +5894,8 @@ function toToken(_data, _pos, prefix, length) {
 * @param {DecodeOptions} _options
 * @returns {Token}
 */
-function decodeMapCompact(data, pos, minor, _options) {
-	return toToken(data, pos, 1, minor);
+function decodeBytesCompact(data, pos, minor, _options) {
+	return toToken$3(data, pos, 1, minor);
 }
 /**
 * @param {Uint8Array} data
@@ -5419,8 +5904,8 @@ function decodeMapCompact(data, pos, minor, _options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeMap8(data, pos, _minor, options) {
-	return toToken(data, pos, 2, readUint8(data, pos + 1, options));
+function decodeBytes8(data, pos, _minor, options) {
+	return toToken$3(data, pos, 2, readUint8(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5429,8 +5914,8 @@ function decodeMap8(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeMap16(data, pos, _minor, options) {
-	return toToken(data, pos, 3, readUint16(data, pos + 1, options));
+function decodeBytes16(data, pos, _minor, options) {
+	return toToken$3(data, pos, 3, readUint16(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5439,8 +5924,8 @@ function decodeMap16(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeMap32(data, pos, _minor, options) {
-	return toToken(data, pos, 5, readUint32(data, pos + 1, options));
+function decodeBytes32(data, pos, _minor, options) {
+	return toToken$3(data, pos, 5, readUint32(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5449,39 +5934,152 @@ function decodeMap32(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeMap64(data, pos, _minor, options) {
+function decodeBytes64(data, pos, _minor, options) {
 	const l = readUint64(data, pos + 1, options);
-	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer map lengths not supported`);
-	return toToken(data, pos, 9, l);
+	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer bytes lengths not supported`);
+	return toToken$3(data, pos, 9, l);
 }
 /**
-* @param {Uint8Array} data
-* @param {number} pos
-* @param {number} _minor
-* @param {DecodeOptions} options
-* @returns {Token}
+* `encodedBytes` allows for caching when we do a byte version of a string
+* for key sorting purposes
+* @param {Token} token
+* @returns {Uint8Array}
 */
-function decodeMapIndefinite(data, pos, _minor, options) {
-	if (options.allowIndefinite === false) throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
-	return toToken(data, pos, 1, Infinity);
+function tokenBytes(token) {
+	if (token.encodedBytes === void 0) token.encodedBytes = Type$2.equals(token.type, Type$2.string) ? fromString(token.value) : token.value;
+	return token.encodedBytes;
 }
 /**
 * @param {ByteWriter} writer
 * @param {Token} token
 */
-function encodeMap(writer, token) {
-	encodeUintValue(writer, Type$2.map.majorEncoded, token.value);
-}
-encodeMap.compareTokens = encodeUint.compareTokens;
+function encodeBytes(writer, token) {
+	const bytes = tokenBytes(token);
+	encodeUintValue(writer, token.type.majorEncoded, bytes.length);
+	writer.push(bytes);
+}
 /**
 * @param {Token} token
 * @returns {number}
 */
-encodeMap.encodedSize = function encodedSize(token) {
-	return encodeUintValue.encodedSize(token.value);
+encodeBytes.encodedSize = function encodedSize(token) {
+	const bytes = tokenBytes(token);
+	return encodeUintValue.encodedSize(bytes.length) + bytes.length;
+};
+/**
+* @param {Token} tok1
+* @param {Token} tok2
+* @returns {number}
+*/
+encodeBytes.compareTokens = function compareTokens(tok1, tok2) {
+	return compareBytes(tokenBytes(tok1), tokenBytes(tok2));
 };
+/**
+* @param {Uint8Array} b1
+* @param {Uint8Array} b2
+* @returns {number}
+*/
+function compareBytes(b1, b2) {
+	return b1.length < b2.length ? -1 : b1.length > b2.length ? 1 : compare(b1, b2);
+}
 //#endregion
-//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/6tag.js
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/3string.js
+var textDecoder = new TextDecoder();
+var ASCII_THRESHOLD = 32;
+/**
+* @typedef {import('../interface').ByteWriter} ByteWriter
+* @typedef {import('../interface').DecodeOptions} DecodeOptions
+*/
+/**
+* Decode UTF-8 bytes to string. For short ASCII strings (common case for map keys),
+* a simple loop is faster than TextDecoder.
+* @param {Uint8Array} bytes
+* @param {number} start
+* @param {number} end
+* @returns {string}
+*/
+function toStr(bytes, start, end) {
+	if (end - start < ASCII_THRESHOLD) {
+		let str = "";
+		for (let i = start; i < end; i++) {
+			const c = bytes[i];
+			if (c & 128) return textDecoder.decode(bytes.subarray(start, end));
+			str += String.fromCharCode(c);
+		}
+		return str;
+	}
+	return textDecoder.decode(bytes.subarray(start, end));
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} prefix
+* @param {number} length
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function toToken$2(data, pos, prefix, length, options) {
+	const totLength = prefix + length;
+	assertEnoughData(data, pos, totLength);
+	const tok = new Token(Type$2.string, toStr(data, pos + prefix, pos + totLength), totLength);
+	if (options.retainStringBytes === true) tok.byteValue = data.slice(pos + prefix, pos + totLength);
+	return tok;
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeStringCompact(data, pos, minor, options) {
+	return toToken$2(data, pos, 1, minor, options);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeString8(data, pos, _minor, options) {
+	return toToken$2(data, pos, 2, readUint8(data, pos + 1, options), options);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeString16(data, pos, _minor, options) {
+	return toToken$2(data, pos, 3, readUint16(data, pos + 1, options), options);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeString32(data, pos, _minor, options) {
+	return toToken$2(data, pos, 5, readUint32(data, pos + 1, options), options);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeString64(data, pos, _minor, options) {
+	const l = readUint64(data, pos + 1, options);
+	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer string lengths not supported`);
+	return toToken$2(data, pos, 9, l, options);
+}
+var encodeString = encodeBytes;
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/4array.js
 /**
 * @typedef {import('../interface').ByteWriter} ByteWriter
 * @typedef {import('../interface').DecodeOptions} DecodeOptions
@@ -5489,12 +6087,22 @@ encodeMap.encodedSize = function encodedSize(token) {
 /**
 * @param {Uint8Array} _data
 * @param {number} _pos
+* @param {number} prefix
+* @param {number} length
+* @returns {Token}
+*/
+function toToken$1(_data, _pos, prefix, length) {
+	return new Token(Type$2.array, length, prefix);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
 * @param {number} minor
 * @param {DecodeOptions} _options
 * @returns {Token}
 */
-function decodeTagCompact(_data, _pos, minor, _options) {
-	return new Token(Type$2.tag, minor, 1);
+function decodeArrayCompact(data, pos, minor, _options) {
+	return toToken$1(data, pos, 1, minor);
 }
 /**
 * @param {Uint8Array} data
@@ -5503,8 +6111,8 @@ function decodeTagCompact(_data, _pos, minor, _options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeTag8(data, pos, _minor, options) {
-	return new Token(Type$2.tag, readUint8(data, pos + 1, options), 2);
+function decodeArray8(data, pos, _minor, options) {
+	return toToken$1(data, pos, 2, readUint8(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5513,8 +6121,8 @@ function decodeTag8(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeTag16(data, pos, _minor, options) {
-	return new Token(Type$2.tag, readUint16(data, pos + 1, options), 3);
+function decodeArray16(data, pos, _minor, options) {
+	return toToken$1(data, pos, 3, readUint16(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5523,8 +6131,8 @@ function decodeTag16(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeTag32(data, pos, _minor, options) {
-	return new Token(Type$2.tag, readUint32(data, pos + 1, options), 5);
+function decodeArray32(data, pos, _minor, options) {
+	return toToken$1(data, pos, 5, readUint32(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5533,59 +6141,82 @@ function decodeTag32(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeTag64(data, pos, _minor, options) {
-	return new Token(Type$2.tag, readUint64(data, pos + 1, options), 9);
+function decodeArray64(data, pos, _minor, options) {
+	const l = readUint64(data, pos + 1, options);
+	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer array lengths not supported`);
+	return toToken$1(data, pos, 9, l);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeArrayIndefinite(data, pos, _minor, options) {
+	if (options.allowIndefinite === false) throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
+	return toToken$1(data, pos, 1, Infinity);
 }
 /**
 * @param {ByteWriter} writer
 * @param {Token} token
 */
-function encodeTag(writer, token) {
-	encodeUintValue(writer, Type$2.tag.majorEncoded, token.value);
+function encodeArray(writer, token) {
+	encodeUintValue(writer, Type$2.array.majorEncoded, token.value);
 }
-encodeTag.compareTokens = encodeUint.compareTokens;
+encodeArray.compareTokens = encodeUint.compareTokens;
 /**
 * @param {Token} token
 * @returns {number}
 */
-encodeTag.encodedSize = function encodedSize(token) {
+encodeArray.encodedSize = function encodedSize(token) {
 	return encodeUintValue.encodedSize(token.value);
 };
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/5map.js
+/**
+* @typedef {import('../interface').ByteWriter} ByteWriter
+* @typedef {import('../interface').DecodeOptions} DecodeOptions
+*/
 /**
 * @param {Uint8Array} _data
 * @param {number} _pos
-* @param {number} _minor
-* @param {DecodeOptions} options
+* @param {number} prefix
+* @param {number} length
 * @returns {Token}
 */
-function decodeUndefined(_data, _pos, _minor, options) {
-	if (options.allowUndefined === false) throw new Error(`${decodeErrPrefix} undefined values are not supported`);
-	else if (options.coerceUndefinedToNull === true) return new Token(Type$2.null, null, 1);
-	return new Token(Type$2.undefined, void 0, 1);
+function toToken(_data, _pos, prefix, length) {
+	return new Token(Type$2.map, length, prefix);
 }
 /**
-* @param {Uint8Array} _data
-* @param {number} _pos
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} minor
+* @param {DecodeOptions} _options
+* @returns {Token}
+*/
+function decodeMapCompact(data, pos, minor, _options) {
+	return toToken(data, pos, 1, minor);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
 * @param {number} _minor
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeBreak(_data, _pos, _minor, options) {
-	if (options.allowIndefinite === false) throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
-	return new Token(Type$2.break, void 0, 1);
+function decodeMap8(data, pos, _minor, options) {
+	return toToken(data, pos, 2, readUint8(data, pos + 1, options));
 }
 /**
-* @param {number} value
-* @param {number} bytes
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function createToken(value, bytes, options) {
-	if (options) {
-		if (options.allowNaN === false && Number.isNaN(value)) throw new Error(`${decodeErrPrefix} NaN values are not supported`);
-		if (options.allowInfinity === false && (value === Infinity || value === -Infinity)) throw new Error(`${decodeErrPrefix} Infinity values are not supported`);
-	}
-	return new Token(Type$2.float, value, bytes);
+function decodeMap16(data, pos, _minor, options) {
+	return toToken(data, pos, 3, readUint16(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5594,8 +6225,8 @@ function createToken(value, bytes, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeFloat16(data, pos, _minor, options) {
-	return createToken(readFloat16(data, pos + 1), 3, options);
+function decodeMap32(data, pos, _minor, options) {
+	return toToken(data, pos, 5, readUint32(data, pos + 1, options));
 }
 /**
 * @param {Uint8Array} data
@@ -5604,8 +6235,10 @@ function decodeFloat16(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeFloat32(data, pos, _minor, options) {
-	return createToken(readFloat32(data, pos + 1), 5, options);
+function decodeMap64(data, pos, _minor, options) {
+	const l = readUint64(data, pos + 1, options);
+	if (typeof l === "bigint") throw new Error(`${decodeErrPrefix} 64-bit integer map lengths not supported`);
+	return toToken(data, pos, 9, l);
 }
 /**
 * @param {Uint8Array} data
@@ -5614,31 +6247,184 @@ function decodeFloat32(data, pos, _minor, options) {
 * @param {DecodeOptions} options
 * @returns {Token}
 */
-function decodeFloat64(data, pos, _minor, options) {
-	return createToken(readFloat64(data, pos + 1), 9, options);
+function decodeMapIndefinite(data, pos, _minor, options) {
+	if (options.allowIndefinite === false) throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
+	return toToken(data, pos, 1, Infinity);
 }
 /**
 * @param {ByteWriter} writer
 * @param {Token} token
-* @param {EncodeOptions} options
 */
-function encodeFloat(writer, token, options) {
-	const float = token.value;
-	if (float === false) writer.push([Type$2.float.majorEncoded | 20]);
-	else if (float === true) writer.push([Type$2.float.majorEncoded | 21]);
-	else if (float === null) writer.push([Type$2.float.majorEncoded | 22]);
-	else if (float === void 0) writer.push([Type$2.float.majorEncoded | 23]);
-	else {
-		let decoded;
-		let success = false;
-		if (!options || options.float64 !== true) {
-			encodeFloat16(float);
-			decoded = readFloat16(ui8a, 1);
-			if (float === decoded || Number.isNaN(float)) {
-				ui8a[0] = 249;
-				writer.push(ui8a.slice(0, 3));
-				success = true;
-			} else {
+function encodeMap(writer, token) {
+	encodeUintValue(writer, Type$2.map.majorEncoded, token.value);
+}
+encodeMap.compareTokens = encodeUint.compareTokens;
+/**
+* @param {Token} token
+* @returns {number}
+*/
+encodeMap.encodedSize = function encodedSize(token) {
+	return encodeUintValue.encodedSize(token.value);
+};
+//#endregion
+//#region ../../node_modules/.pnpm/cborg@4.5.8/node_modules/cborg/lib/6tag.js
+/**
+* @typedef {import('../interface').ByteWriter} ByteWriter
+* @typedef {import('../interface').DecodeOptions} DecodeOptions
+*/
+/**
+* @param {Uint8Array} _data
+* @param {number} _pos
+* @param {number} minor
+* @param {DecodeOptions} _options
+* @returns {Token}
+*/
+function decodeTagCompact(_data, _pos, minor, _options) {
+	return new Token(Type$2.tag, minor, 1);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeTag8(data, pos, _minor, options) {
+	return new Token(Type$2.tag, readUint8(data, pos + 1, options), 2);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeTag16(data, pos, _minor, options) {
+	return new Token(Type$2.tag, readUint16(data, pos + 1, options), 3);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeTag32(data, pos, _minor, options) {
+	return new Token(Type$2.tag, readUint32(data, pos + 1, options), 5);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeTag64(data, pos, _minor, options) {
+	return new Token(Type$2.tag, readUint64(data, pos + 1, options), 9);
+}
+/**
+* @param {ByteWriter} writer
+* @param {Token} token
+*/
+function encodeTag(writer, token) {
+	encodeUintValue(writer, Type$2.tag.majorEncoded, token.value);
+}
+encodeTag.compareTokens = encodeUint.compareTokens;
+/**
+* @param {Token} token
+* @returns {number}
+*/
+encodeTag.encodedSize = function encodedSize(token) {
+	return encodeUintValue.encodedSize(token.value);
+};
+/**
+* @param {Uint8Array} _data
+* @param {number} _pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeUndefined(_data, _pos, _minor, options) {
+	if (options.allowUndefined === false) throw new Error(`${decodeErrPrefix} undefined values are not supported`);
+	else if (options.coerceUndefinedToNull === true) return new Token(Type$2.null, null, 1);
+	return new Token(Type$2.undefined, void 0, 1);
+}
+/**
+* @param {Uint8Array} _data
+* @param {number} _pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeBreak(_data, _pos, _minor, options) {
+	if (options.allowIndefinite === false) throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
+	return new Token(Type$2.break, void 0, 1);
+}
+/**
+* @param {number} value
+* @param {number} bytes
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function createToken(value, bytes, options) {
+	if (options) {
+		if (options.allowNaN === false && Number.isNaN(value)) throw new Error(`${decodeErrPrefix} NaN values are not supported`);
+		if (options.allowInfinity === false && (value === Infinity || value === -Infinity)) throw new Error(`${decodeErrPrefix} Infinity values are not supported`);
+	}
+	return new Token(Type$2.float, value, bytes);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeFloat16(data, pos, _minor, options) {
+	return createToken(readFloat16(data, pos + 1), 3, options);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeFloat32(data, pos, _minor, options) {
+	return createToken(readFloat32(data, pos + 1), 5, options);
+}
+/**
+* @param {Uint8Array} data
+* @param {number} pos
+* @param {number} _minor
+* @param {DecodeOptions} options
+* @returns {Token}
+*/
+function decodeFloat64(data, pos, _minor, options) {
+	return createToken(readFloat64(data, pos + 1), 9, options);
+}
+/**
+* @param {ByteWriter} writer
+* @param {Token} token
+* @param {EncodeOptions} options
+*/
+function encodeFloat(writer, token, options) {
+	const float = token.value;
+	if (float === false) writer.push([Type$2.float.majorEncoded | 20]);
+	else if (float === true) writer.push([Type$2.float.majorEncoded | 21]);
+	else if (float === null) writer.push([Type$2.float.majorEncoded | 22]);
+	else if (float === void 0) writer.push([Type$2.float.majorEncoded | 23]);
+	else {
+		let decoded;
+		let success = false;
+		if (!options || options.float64 !== true) {
+			encodeFloat16(float);
+			decoded = readFloat16(ui8a, 1);
+			if (float === decoded || Number.isNaN(float)) {
+				ui8a[0] = 249;
+				writer.push(ui8a.slice(0, 3));
+				success = true;
+			} else {
 				encodeFloat32(float);
 				decoded = readFloat32(ui8a, 1);
 				if (float === decoded) {
@@ -5959,1071 +6745,285 @@ var simpleTokens = {
 	true: new Token(Type$2.true, true),
 	false: new Token(Type$2.false, false),
 	emptyArray: new Token(Type$2.array, 0),
-	emptyMap: new Token(Type$2.map, 0)
-};
-/** @type {{[typeName: string]: StrictTypeEncoder}} */
-var typeEncoders = {
-	number(obj, _typ, _options, _refStack) {
-		if (!Number.isInteger(obj) || !Number.isSafeInteger(obj)) return new Token(Type$2.float, obj);
-		else if (obj >= 0) return new Token(Type$2.uint, obj);
-		else return new Token(Type$2.negint, obj);
-	},
-	bigint(obj, _typ, _options, _refStack) {
-		if (obj >= BigInt(0)) return new Token(Type$2.uint, obj);
-		else return new Token(Type$2.negint, obj);
-	},
-	Uint8Array(obj, _typ, _options, _refStack) {
-		return new Token(Type$2.bytes, obj);
-	},
-	string(obj, _typ, _options, _refStack) {
-		return new Token(Type$2.string, obj);
-	},
-	boolean(obj, _typ, _options, _refStack) {
-		return obj ? simpleTokens.true : simpleTokens.false;
-	},
-	null(_obj, _typ, _options, _refStack) {
-		return simpleTokens.null;
-	},
-	undefined(_obj, _typ, _options, _refStack) {
-		return simpleTokens.undefined;
-	},
-	ArrayBuffer(obj, _typ, _options, _refStack) {
-		return new Token(Type$2.bytes, new Uint8Array(obj));
-	},
-	DataView(obj, _typ, _options, _refStack) {
-		return new Token(Type$2.bytes, new Uint8Array(obj.buffer, obj.byteOffset, obj.byteLength));
-	},
-	Array(obj, _typ, options, refStack) {
-		if (!obj.length) {
-			if (options.addBreakTokens === true) return [simpleTokens.emptyArray, new Token(Type$2.break)];
-			return simpleTokens.emptyArray;
-		}
-		refStack = Ref.createCheck(refStack, obj);
-		const entries = [];
-		let i = 0;
-		for (const e of obj) entries[i++] = objectToTokens(e, options, refStack);
-		if (options.addBreakTokens) return [
-			new Token(Type$2.array, obj.length),
-			entries,
-			new Token(Type$2.break)
-		];
-		return [new Token(Type$2.array, obj.length), entries];
-	},
-	Object(obj, typ, options, refStack) {
-		const isMap = typ !== "Object";
-		const keys = isMap ? obj.keys() : Object.keys(obj);
-		const maxLength = isMap ? obj.size : keys.length;
-		/** @type {undefined | [TokenOrNestedTokens, TokenOrNestedTokens][]} */
-		let entries;
-		if (maxLength) {
-			entries = new Array(maxLength);
-			refStack = Ref.createCheck(refStack, obj);
-			const skipUndefined = !isMap && options.ignoreUndefinedProperties;
-			let i = 0;
-			for (const key of keys) {
-				const value = isMap ? obj.get(key) : obj[key];
-				if (skipUndefined && value === void 0) continue;
-				entries[i++] = [objectToTokens(key, options, refStack), objectToTokens(value, options, refStack)];
-			}
-			if (i < maxLength) entries.length = i;
-		}
-		if (!entries?.length) {
-			if (options.addBreakTokens === true) return [simpleTokens.emptyMap, new Token(Type$2.break)];
-			return simpleTokens.emptyMap;
-		}
-		sortMapEntries(entries, options);
-		if (options.addBreakTokens) return [
-			new Token(Type$2.map, entries.length),
-			entries,
-			new Token(Type$2.break)
-		];
-		return [new Token(Type$2.map, entries.length), entries];
-	}
-};
-typeEncoders.Map = typeEncoders.Object;
-typeEncoders.Buffer = typeEncoders.Uint8Array;
-for (const typ of "Uint8Clamped Uint16 Uint32 Int8 Int16 Int32 BigUint64 BigInt64 Float32 Float64".split(" ")) typeEncoders[`${typ}Array`] = typeEncoders.DataView;
-/**
-* @param {any} obj
-* @param {EncodeOptions} [options]
-* @param {Reference} [refStack]
-* @returns {TokenOrNestedTokens}
-*/
-function objectToTokens(obj, options = {}, refStack) {
-	const typ = is(obj);
-	const customTypeEncoder = options && options.typeEncoders && options.typeEncoders[typ] || typeEncoders[typ];
-	if (typeof customTypeEncoder === "function") {
-		const tokens = customTypeEncoder(obj, typ, options, refStack);
-		if (tokens != null) return tokens;
-	}
-	const typeEncoder = typeEncoders[typ];
-	if (!typeEncoder) throw new Error(`${encodeErrPrefix} unsupported type: ${typ}`);
-	return typeEncoder(obj, typ, options, refStack);
-}
-/**
-* @param {TokenOrNestedTokens[]} entries
-* @param {EncodeOptions} options
-*/
-function sortMapEntries(entries, options) {
-	if (options.mapSorter) entries.sort(options.mapSorter);
-}
-/**
-* @typedef {Token & { _keyBytes?: Uint8Array }} TokenEx
-*
-* @param {(Token|Token[])[]} e1
-* @param {(Token|Token[])[]} e2
-* @returns {number}
-*/
-function rfc8949MapSorter(e1, e2) {
-	if (e1[0] instanceof Token && e2[0] instanceof Token) {
-		const t1 = e1[0];
-		const t2 = e2[0];
-		if (!t1._keyBytes) t1._keyBytes = encodeRfc8949(t1.value);
-		if (!t2._keyBytes) t2._keyBytes = encodeRfc8949(t2.value);
-		return compare(t1._keyBytes, t2._keyBytes);
-	}
-	throw new Error("rfc8949MapSorter: complex key types are not supported yet");
-}
-/**
-* @param {any} data
-* @returns {Uint8Array}
-*/
-function encodeRfc8949(data) {
-	return encodeCustom(data, cborEncoders, rfc8949EncodeOptions);
-}
-/**
-* @param {ByteWriter} writer
-* @param {TokenOrNestedTokens} tokens
-* @param {TokenTypeEncoder[]} encoders
-* @param {EncodeOptions} options
-*/
-function tokensToEncoded(writer, tokens, encoders, options) {
-	if (Array.isArray(tokens)) for (const token of tokens) tokensToEncoded(writer, token, encoders, options);
-	else encoders[tokens.type.major](writer, tokens, options);
-}
-Type$2.uint.majorEncoded;
-Type$2.negint.majorEncoded;
-Type$2.bytes.majorEncoded;
-Type$2.string.majorEncoded;
-Type$2.array.majorEncoded;
-Type$2.float.majorEncoded | 20;
-Type$2.float.majorEncoded | 21;
-Type$2.float.majorEncoded | 22;
-Type$2.float.majorEncoded | 23;
-/**
-* @param {any} data
-* @param {TokenTypeEncoder[]} encoders
-* @param {EncodeOptions} options
-* @param {Uint8Array} [destination]
-* @returns {Uint8Array}
-*/
-function encodeCustom(data, encoders, options, destination) {
-	const hasDest = destination instanceof Uint8Array;
-	let writeTo = hasDest ? new U8Bl(destination) : defaultWriter;
-	const tokens = objectToTokens(data, options);
-	if (!Array.isArray(tokens) && options.quickEncodeToken) {
-		const quickBytes = options.quickEncodeToken(tokens);
-		if (quickBytes) {
-			if (hasDest) {
-				writeTo.push(quickBytes);
-				return writeTo.toBytes();
-			}
-			return quickBytes;
-		}
-		const encoder = encoders[tokens.type.major];
-		if (encoder.encodedSize) {
-			const size = encoder.encodedSize(tokens, options);
-			if (!hasDest) writeTo = new Bl(size);
-			encoder(writeTo, tokens, options);
-			/* c8 ignore next 4 */
-			if (writeTo.chunks.length !== 1) throw new Error(`Unexpected error: pre-calculated length for ${tokens} was wrong`);
-			return hasDest ? writeTo.toBytes() : asU8A(writeTo.chunks[0]);
-		}
-	}
-	writeTo.reset();
-	tokensToEncoded(writeTo, tokens, encoders, options);
-	return writeTo.toBytes(true);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@ipld+dag-cbor@9.2.5/node_modules/@ipld/dag-cbor/src/index.js
-var CID_CBOR_TAG = 42;
-/**
-* cidEncoder will receive all Objects during encode, it needs to filter out
-* anything that's not a CID and return `null` for that so it's encoded as
-* normal.
-*
-* @param {any} obj
-* @returns {cborg.Token[]|null}
-*/
-function cidEncoder(obj) {
-	if (obj.asCID !== obj && obj["/"] !== obj.bytes) return null;
-	const cid = CID.asCID(obj);
-	/* c8 ignore next 4 */
-	if (!cid) return null;
-	const bytes = new Uint8Array(cid.bytes.byteLength + 1);
-	bytes.set(cid.bytes, 1);
-	return [new Token(Type$2.tag, CID_CBOR_TAG), new Token(Type$2.bytes, bytes)];
-}
-/**
-* Intercept all `undefined` values from an object walk and reject the entire
-* object if we find one.
-*
-* @returns {null}
-*/
-function undefinedEncoder() {
-	throw new Error("`undefined` is not supported by the IPLD Data Model and cannot be encoded");
-}
-/**
-* Intercept all `number` values from an object walk and reject the entire
-* object if we find something that doesn't fit the IPLD data model (NaN &
-* Infinity).
-*
-* @param {number} num
-* @returns {null}
-*/
-function numberEncoder(num) {
-	if (Number.isNaN(num)) throw new Error("`NaN` is not supported by the IPLD Data Model and cannot be encoded");
-	if (num === Infinity || num === -Infinity) throw new Error("`Infinity` and `-Infinity` is not supported by the IPLD Data Model and cannot be encoded");
-	return null;
-}
-/**
-* @param {Map<any, any>} map
-* @returns {null}
-*/
-function mapEncoder(map) {
-	for (const key of map.keys()) if (typeof key !== "string" || key.length === 0) throw new Error("Non-string Map keys are not supported by the IPLD Data Model and cannot be encoded");
-	return null;
-}
-var _encodeOptions = {
-	float64: true,
-	typeEncoders: {
-		Map: mapEncoder,
-		Object: cidEncoder,
-		undefined: undefinedEncoder,
-		number: numberEncoder
-	}
-};
-({ ..._encodeOptions }), { ..._encodeOptions.typeEncoders };
-/**
-* @param {Uint8Array} bytes
-* @returns {CID}
-*/
-function cidDecoder(bytes) {
-	if (bytes[0] !== 0) throw new Error("Invalid CID for CBOR tag 42; expected leading 0x00");
-	return CID.decode(bytes.subarray(1));
-}
-var _decodeOptions = {
-	allowIndefinite: false,
-	coerceUndefinedToNull: true,
-	allowNaN: false,
-	allowInfinity: false,
-	allowBigInt: true,
-	strict: true,
-	useMaps: false,
-	rejectDuplicateMapKeys: true,
-	tags: []
-};
-_decodeOptions.tags[CID_CBOR_TAG] = cidDecoder;
-({ ..._decodeOptions }), _decodeOptions.tags.slice();
-//#endregion
-//#region ../crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!etc.sha512Sync) etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
-//#region ../sdk/src/namespaces/entries.ts
-function createEntriesNamespace(context) {
-	const { client, auth } = context;
-	return {
-		async create(diaryId, body) {
-			return unwrapResult(await createDiaryEntry({
-				client,
-				auth,
-				body,
-				path: { diaryId }
-			}));
-		},
-		async list(diaryId, query) {
-			return unwrapResult(await listDiaryEntries({
-				client,
-				auth,
-				query,
-				path: { diaryId }
-			}));
-		},
-		async get(entryId) {
-			return unwrapResult(await getDiaryEntryById({
-				client,
-				auth,
-				path: { entryId }
-			}));
-		},
-		async update(entryId, body) {
-			return unwrapResult(await updateDiaryEntryById({
-				client,
-				auth,
-				path: { entryId },
-				body
-			}));
-		},
-		async delete(entryId) {
-			return unwrapResult(await deleteDiaryEntryById({
-				client,
-				auth,
-				path: { entryId }
-			}));
-		},
-		async search(body) {
-			return unwrapResult(await searchDiary({
-				client,
-				auth,
-				body
-			}));
-		},
-		async reflect(query) {
-			return unwrapResult(await reflectDiary({
-				client,
-				auth,
-				query
-			}));
-		},
-		async verify(entryId) {
-			return unwrapResult(await verifyDiaryEntryById({
-				client,
-				auth,
-				path: { entryId }
-			}));
-		},
-		async createSigned(diaryId, body, privateKey) {
-			const signingRequest = unwrapResult(await createSigningRequest({
-				client,
-				auth,
-				body: { message: computeContentCid(body.entryType ?? "semantic", body.title ?? null, body.content, body.tags ?? null) }
-			}));
-			const privateKeyBytes = new Uint8Array(Buffer.from(privateKey, "base64"));
-			const signature = await signAsync(new Uint8Array(Buffer.from(signingRequest.signingInput, "base64")), privateKeyBytes);
-			const signatureB64 = Buffer.from(signature).toString("base64");
-			unwrapResult(await submitSignature({
-				client,
-				auth,
-				path: { id: signingRequest.id },
-				body: { signature: signatureB64 }
-			}));
-			return unwrapResult(await createDiaryEntry({
-				client,
-				auth,
-				path: { diaryId },
-				body: {
-					...body,
-					signingRequestId: signingRequest.id
-				}
-			}));
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/legreffier.ts
-function createLegreffierNamespace(context) {
-	const { client } = context;
-	return {
-		async startOnboarding(body) {
-			return unwrapResult(await startLegreffierOnboarding({
-				client,
-				body
-			}));
-		},
-		async getOnboardingStatus(workflowId) {
-			return unwrapResult(await getLegreffierOnboardingStatus({
-				client,
-				path: { workflowId }
-			}));
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/packs.ts
-function createPacksNamespace(context) {
-	const { client, auth } = context;
-	return {
-		async get(id, query) {
-			return unwrapResult(await getContextPackById({
-				client,
-				auth,
-				path: { id },
-				query
-			}));
-		},
-		async list(selector) {
-			if ("diaryId" in selector) {
-				const { diaryId, ...query } = selector;
-				return unwrapResult(await listDiaryPacks({
-					client,
-					auth,
-					path: { id: diaryId },
-					query
-				}));
-			}
-			const { containsEntry, ...query } = selector;
-			return unwrapResult(await listContextPacks({
-				client,
-				auth,
-				query: {
-					...query,
-					containsEntry
-				}
-			}));
-		},
-		async getProvenance(id, query) {
-			return unwrapResult(await getContextPackProvenanceById({
-				client,
-				auth,
-				path: { id },
-				query
-			}));
-		},
-		async getProvenanceByCid(cid, query) {
-			return unwrapResult(await getContextPackProvenanceByCid({
-				client,
-				auth,
-				path: { cid },
-				query
-			}));
-		},
-		async previewRendered(id, body) {
-			return unwrapResult(await previewRenderedPack({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async render(id, body) {
-			return unwrapResult(await renderContextPack({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async getLatestRendered(id, query) {
-			return unwrapResult(await getLatestRenderedPack({
-				client,
-				auth,
-				path: { id },
-				query
-			}));
-		},
-		async listRendered(diaryId, query) {
-			return unwrapResult(await listDiaryRenderedPacks({
-				client,
-				auth,
-				path: { id: diaryId },
-				query
-			}));
-		},
-		async getRendered(id, query) {
-			return unwrapResult(await getRenderedPackById({
-				client,
-				auth,
-				path: { id },
-				query
-			}));
-		},
-		async update(id, body) {
-			return unwrapResult(await updateContextPack({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async updateRendered(id, body) {
-			return unwrapResult(await updateRenderedPack({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async create(diaryId, body) {
-			return unwrapResult(await createDiaryCustomPack({
-				client,
-				auth,
-				path: { id: diaryId },
-				body
-			}));
-		},
-		async preview(diaryId, body) {
-			return unwrapResult(await previewDiaryCustomPack({
-				client,
-				auth,
-				path: { id: diaryId },
-				body
-			}));
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/problems.ts
-function createProblemsNamespace(context) {
-	const { client } = context;
-	return {
-		async list() {
-			return unwrapRequired(await listProblemTypes({ client }), "Failed to list problem types", "PROBLEMS_FAILED");
-		},
-		async get(type) {
-			return unwrapRequired(await getProblemType({
-				client,
-				path: { type }
-			}), `Failed to get problem type: ${type}`, "PROBLEM_TYPE_FAILED");
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/public.ts
-function createPublicNamespace(context) {
-	const { client } = context;
-	return {
-		async feed(query) {
-			return unwrapResult(await getPublicFeed({
-				client,
-				query
-			}));
-		},
-		async searchFeed(query) {
-			return unwrapResult(await searchPublicFeed({
-				client,
-				query
-			}));
-		},
-		async entry(id) {
-			return unwrapResult(await getPublicEntry({
-				client,
-				path: { id }
-			}));
-		},
-		async networkInfo() {
-			return unwrapRequired(await getNetworkInfo({ client }), "Failed to fetch network info", "NETWORK_INFO_FAILED");
-		},
-		async llmsTxt() {
-			return unwrapRequired(await getLlmsTxt({ client }), "Failed to fetch llms.txt", "LLMS_TXT_FAILED");
-		},
-		async health() {
-			return unwrapRequired(await getHealth({ client }), "Failed to fetch health", "HEALTH_FAILED");
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/recovery.ts
-function createRecoveryNamespace(context) {
-	const { client } = context;
-	return {
-		async requestChallenge(body) {
-			return unwrapResult(await requestRecoveryChallenge({
-				client,
-				body
-			}));
-		},
-		async verifyChallenge(body) {
-			return unwrapResult(await verifyRecoveryChallenge({
-				client,
-				body
-			}));
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/signing-requests.ts
-function createSigningRequestsNamespace(context) {
-	const { client, auth } = context;
-	return {
-		async list(query) {
-			return unwrapResult(await listSigningRequests({
-				client,
-				auth,
-				query
-			}));
-		},
-		async create(body) {
-			return unwrapResult(await createSigningRequest({
-				client,
-				auth,
-				body
-			}));
-		},
-		async get(id) {
-			return unwrapResult(await getSigningRequest({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async submit(id, body) {
-			return unwrapResult(await submitSignature({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/tasks.ts
-function createTasksNamespace(context) {
-	const { client, auth } = context;
-	return {
-		async schemas() {
-			return unwrapResult(await listTaskSchemas({
-				client,
-				auth
-			}));
-		},
-		async list(query) {
-			return unwrapResult(await listTasks({
-				client,
-				auth,
-				query
-			}));
-		},
-		async create(body) {
-			return unwrapResult(await createTask({
-				client,
-				auth,
-				body
-			}));
-		},
-		async get(id) {
-			return unwrapResult(await getTask({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async claim(id, body) {
-			const result = await claimTask({
-				client,
-				auth,
-				path: { id },
-				body
-			});
-			const data = unwrapResult(result);
-			const traceHeaders = {};
-			const traceparent = result.response.headers.get("traceparent");
-			if (traceparent) {
-				traceHeaders["traceparent"] = traceparent;
-				const tracestate = result.response.headers.get("tracestate");
-				if (tracestate) traceHeaders["tracestate"] = tracestate;
-			}
-			return {
-				...data,
-				traceHeaders
-			};
-		},
-		async heartbeat(id, n, body) {
-			return unwrapResult(await taskHeartbeat({
-				client,
-				auth,
-				path: {
-					id,
-					n
-				},
-				body
-			}));
-		},
-		async complete(id, n, body) {
-			return unwrapResult(await completeTask({
-				client,
-				auth,
-				path: {
-					id,
-					n
-				},
-				body
-			}));
-		},
-		async fail(id, n, body) {
-			return unwrapResult(await failTask({
-				client,
-				auth,
-				path: {
-					id,
-					n
-				},
-				body
-			}));
-		},
-		async cancel(id, body) {
-			return unwrapResult(await cancelTask({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async listAttempts(id) {
-			return unwrapResult(await listTaskAttempts({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async listMessages(id, n, query) {
-			return unwrapResult(await listTaskMessages({
-				client,
-				auth,
-				path: {
-					id,
-					n
-				},
-				query
-			}));
-		},
-		async appendMessages(id, n, body) {
-			return unwrapResult(await appendTaskMessages({
-				client,
-				auth,
-				path: {
-					id,
-					n
-				},
-				body
-			}));
-		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/teams.ts
-function createTeamsNamespace(context) {
-	const { client, auth } = context;
-	return {
-		async list() {
-			return unwrapResult(await listTeams({
-				client,
-				auth
-			}));
-		},
-		async get(id) {
-			return unwrapResult(await getTeam({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async listMembers(id) {
-			return unwrapResult(await listTeamMembers({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async create(body) {
-			return unwrapResult(await createTeam({
-				client,
-				auth,
-				body
-			}));
-		},
-		async join(code) {
-			return unwrapResult(await joinTeam({
-				client,
-				auth,
-				body: { code }
-			}));
-		},
-		async delete(id) {
-			return unwrapResult(await deleteTeam({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async removeMember(teamId, subjectId) {
-			return unwrapResult(await removeTeamMember({
-				client,
-				auth,
-				path: {
-					id: teamId,
-					subjectId
-				}
-			}));
-		},
-		invites: {
-			async create(teamId, body) {
-				return unwrapResult(await createTeamInvite({
-					client,
-					auth,
-					path: { id: teamId },
-					body
-				}));
-			},
-			async list(teamId) {
-				return unwrapResult(await listTeamInvites({
-					client,
-					auth,
-					path: { id: teamId }
-				}));
-			},
-			async delete(teamId, inviteId) {
-				return unwrapResult(await deleteTeamInvite({
-					client,
-					auth,
-					path: {
-						id: teamId,
-						inviteId
-					}
-				}));
+	emptyMap: new Token(Type$2.map, 0)
+};
+/** @type {{[typeName: string]: StrictTypeEncoder}} */
+var typeEncoders = {
+	number(obj, _typ, _options, _refStack) {
+		if (!Number.isInteger(obj) || !Number.isSafeInteger(obj)) return new Token(Type$2.float, obj);
+		else if (obj >= 0) return new Token(Type$2.uint, obj);
+		else return new Token(Type$2.negint, obj);
+	},
+	bigint(obj, _typ, _options, _refStack) {
+		if (obj >= BigInt(0)) return new Token(Type$2.uint, obj);
+		else return new Token(Type$2.negint, obj);
+	},
+	Uint8Array(obj, _typ, _options, _refStack) {
+		return new Token(Type$2.bytes, obj);
+	},
+	string(obj, _typ, _options, _refStack) {
+		return new Token(Type$2.string, obj);
+	},
+	boolean(obj, _typ, _options, _refStack) {
+		return obj ? simpleTokens.true : simpleTokens.false;
+	},
+	null(_obj, _typ, _options, _refStack) {
+		return simpleTokens.null;
+	},
+	undefined(_obj, _typ, _options, _refStack) {
+		return simpleTokens.undefined;
+	},
+	ArrayBuffer(obj, _typ, _options, _refStack) {
+		return new Token(Type$2.bytes, new Uint8Array(obj));
+	},
+	DataView(obj, _typ, _options, _refStack) {
+		return new Token(Type$2.bytes, new Uint8Array(obj.buffer, obj.byteOffset, obj.byteLength));
+	},
+	Array(obj, _typ, options, refStack) {
+		if (!obj.length) {
+			if (options.addBreakTokens === true) return [simpleTokens.emptyArray, new Token(Type$2.break)];
+			return simpleTokens.emptyArray;
+		}
+		refStack = Ref.createCheck(refStack, obj);
+		const entries = [];
+		let i = 0;
+		for (const e of obj) entries[i++] = objectToTokens(e, options, refStack);
+		if (options.addBreakTokens) return [
+			new Token(Type$2.array, obj.length),
+			entries,
+			new Token(Type$2.break)
+		];
+		return [new Token(Type$2.array, obj.length), entries];
+	},
+	Object(obj, typ, options, refStack) {
+		const isMap = typ !== "Object";
+		const keys = isMap ? obj.keys() : Object.keys(obj);
+		const maxLength = isMap ? obj.size : keys.length;
+		/** @type {undefined | [TokenOrNestedTokens, TokenOrNestedTokens][]} */
+		let entries;
+		if (maxLength) {
+			entries = new Array(maxLength);
+			refStack = Ref.createCheck(refStack, obj);
+			const skipUndefined = !isMap && options.ignoreUndefinedProperties;
+			let i = 0;
+			for (const key of keys) {
+				const value = isMap ? obj.get(key) : obj[key];
+				if (skipUndefined && value === void 0) continue;
+				entries[i++] = [objectToTokens(key, options, refStack), objectToTokens(value, options, refStack)];
 			}
+			if (i < maxLength) entries.length = i;
 		}
-	};
-}
-//#endregion
-//#region ../sdk/src/namespaces/vouch.ts
-function createVouchNamespace(context) {
-	const { client, auth } = context;
-	return {
-		async issue() {
-			return unwrapResult(await issueVoucher({
-				client,
-				auth
-			}));
-		},
-		async listActive() {
-			return unwrapResult(await listActiveVouchers({
-				client,
-				auth
-			}));
-		},
-		async trustGraph(query) {
-			return unwrapResult(await getTrustGraph({
-				client,
-				query
-			}));
+		if (!entries?.length) {
+			if (options.addBreakTokens === true) return [simpleTokens.emptyMap, new Token(Type$2.break)];
+			return simpleTokens.emptyMap;
 		}
-	};
+		sortMapEntries(entries, options);
+		if (options.addBreakTokens) return [
+			new Token(Type$2.map, entries.length),
+			entries,
+			new Token(Type$2.break)
+		];
+		return [new Token(Type$2.map, entries.length), entries];
+	}
+};
+typeEncoders.Map = typeEncoders.Object;
+typeEncoders.Buffer = typeEncoders.Uint8Array;
+for (const typ of "Uint8Clamped Uint16 Uint32 Int8 Int16 Int32 BigUint64 BigInt64 Float32 Float64".split(" ")) typeEncoders[`${typ}Array`] = typeEncoders.DataView;
+/**
+* @param {any} obj
+* @param {EncodeOptions} [options]
+* @param {Reference} [refStack]
+* @returns {TokenOrNestedTokens}
+*/
+function objectToTokens(obj, options = {}, refStack) {
+	const typ = is(obj);
+	const customTypeEncoder = options && options.typeEncoders && options.typeEncoders[typ] || typeEncoders[typ];
+	if (typeof customTypeEncoder === "function") {
+		const tokens = customTypeEncoder(obj, typ, options, refStack);
+		if (tokens != null) return tokens;
+	}
+	const typeEncoder = typeEncoders[typ];
+	if (!typeEncoder) throw new Error(`${encodeErrPrefix} unsupported type: ${typ}`);
+	return typeEncoder(obj, typ, options, refStack);
 }
-//#endregion
-//#region ../sdk/src/agent.ts
-function createAgent(options) {
-	const { client, tokenManager, auth } = options;
-	const context = {
-		client,
-		auth
-	};
-	return {
-		diaries: createDiariesNamespace(context),
-		diaryGrants: createDiaryGrantsNamespace(context),
-		packs: createPacksNamespace(context),
-		entries: createEntriesNamespace(context),
-		agents: createAgentsNamespace(context),
-		crypto: createCryptoNamespace(context, createSigningRequestsNamespace(context)),
-		vouch: createVouchNamespace(context),
-		auth: createAuthNamespace(context),
-		recovery: createRecoveryNamespace(context),
-		public: createPublicNamespace(context),
-		legreffier: createLegreffierNamespace(context),
-		problems: createProblemsNamespace(context),
-		teams: createTeamsNamespace(context),
-		tasks: createTasksNamespace(context),
-		client,
-		getToken: () => tokenManager.getToken()
-	};
+/**
+* @param {TokenOrNestedTokens[]} entries
+* @param {EncodeOptions} options
+*/
+function sortMapEntries(entries, options) {
+	if (options.mapSorter) entries.sort(options.mapSorter);
 }
-//#endregion
-//#region ../sdk/src/config.ts
 /**
-* Read MoltNet credentials from environment variables.
-* Reads MOLTNET_CLIENT_ID, MOLTNET_CLIENT_SECRET, and MOLTNET_API_URL.
+* @typedef {Token & { _keyBytes?: Uint8Array }} TokenEx
+*
+* @param {(Token|Token[])[]} e1
+* @param {(Token|Token[])[]} e2
+* @returns {number}
 */
-function readEnvCredentials() {
-	return {
-		clientId: process.env.MOLTNET_CLIENT_ID,
-		clientSecret: process.env.MOLTNET_CLIENT_SECRET,
-		apiUrl: process.env.MOLTNET_API_URL
-	};
+function rfc8949MapSorter(e1, e2) {
+	if (e1[0] instanceof Token && e2[0] instanceof Token) {
+		const t1 = e1[0];
+		const t2 = e2[0];
+		if (!t1._keyBytes) t1._keyBytes = encodeRfc8949(t1.value);
+		if (!t2._keyBytes) t2._keyBytes = encodeRfc8949(t2.value);
+		return compare(t1._keyBytes, t2._keyBytes);
+	}
+	throw new Error("rfc8949MapSorter: complex key types are not supported yet");
+}
+/**
+* @param {any} data
+* @returns {Uint8Array}
+*/
+function encodeRfc8949(data) {
+	return encodeCustom(data, cborEncoders, rfc8949EncodeOptions);
+}
+/**
+* @param {ByteWriter} writer
+* @param {TokenOrNestedTokens} tokens
+* @param {TokenTypeEncoder[]} encoders
+* @param {EncodeOptions} options
+*/
+function tokensToEncoded(writer, tokens, encoders, options) {
+	if (Array.isArray(tokens)) for (const token of tokens) tokensToEncoded(writer, token, encoders, options);
+	else encoders[tokens.type.major](writer, tokens, options);
+}
+Type$2.uint.majorEncoded;
+Type$2.negint.majorEncoded;
+Type$2.bytes.majorEncoded;
+Type$2.string.majorEncoded;
+Type$2.array.majorEncoded;
+Type$2.float.majorEncoded | 20;
+Type$2.float.majorEncoded | 21;
+Type$2.float.majorEncoded | 22;
+Type$2.float.majorEncoded | 23;
+/**
+* @param {any} data
+* @param {TokenTypeEncoder[]} encoders
+* @param {EncodeOptions} options
+* @param {Uint8Array} [destination]
+* @returns {Uint8Array}
+*/
+function encodeCustom(data, encoders, options, destination) {
+	const hasDest = destination instanceof Uint8Array;
+	let writeTo = hasDest ? new U8Bl(destination) : defaultWriter;
+	const tokens = objectToTokens(data, options);
+	if (!Array.isArray(tokens) && options.quickEncodeToken) {
+		const quickBytes = options.quickEncodeToken(tokens);
+		if (quickBytes) {
+			if (hasDest) {
+				writeTo.push(quickBytes);
+				return writeTo.toBytes();
+			}
+			return quickBytes;
+		}
+		const encoder = encoders[tokens.type.major];
+		if (encoder.encodedSize) {
+			const size = encoder.encodedSize(tokens, options);
+			if (!hasDest) writeTo = new Bl(size);
+			encoder(writeTo, tokens, options);
+			/* c8 ignore next 4 */
+			if (writeTo.chunks.length !== 1) throw new Error(`Unexpected error: pre-calculated length for ${tokens} was wrong`);
+			return hasDest ? writeTo.toBytes() : asU8A(writeTo.chunks[0]);
+		}
+	}
+	writeTo.reset();
+	tokensToEncoded(writeTo, tokens, encoders, options);
+	return writeTo.toBytes(true);
 }
 //#endregion
-//#region ../sdk/src/credentials.ts
-function getConfigDir() {
-	return join(homedir(), ".config", "moltnet");
+//#region ../../node_modules/.pnpm/@ipld+dag-cbor@9.2.5/node_modules/@ipld/dag-cbor/src/index.js
+var CID_CBOR_TAG = 42;
+/**
+* cidEncoder will receive all Objects during encode, it needs to filter out
+* anything that's not a CID and return `null` for that so it's encoded as
+* normal.
+*
+* @param {any} obj
+* @returns {cborg.Token[]|null}
+*/
+function cidEncoder(obj) {
+	if (obj.asCID !== obj && obj["/"] !== obj.bytes) return null;
+	const cid = CID.asCID(obj);
+	/* c8 ignore next 4 */
+	if (!cid) return null;
+	const bytes = new Uint8Array(cid.bytes.byteLength + 1);
+	bytes.set(cid.bytes, 1);
+	return [new Token(Type$2.tag, CID_CBOR_TAG), new Token(Type$2.bytes, bytes)];
 }
 /**
-* Read the MoltNet config file.
-* Tries `moltnet.json` first; falls back to `credentials.json` with a
-* deprecation warning printed to stderr.
+* Intercept all `undefined` values from an object walk and reject the entire
+* object if we find one.
+*
+* @returns {null}
 */
-async function readConfig(configDir) {
-	const dir = configDir ?? getConfigDir();
-	try {
-		const content = await readFile(join(dir, "moltnet.json"), "utf-8");
-		return JSON.parse(content);
-	} catch {}
-	try {
-		const content = await readFile(join(dir, "credentials.json"), "utf-8");
-		console.warn("Warning: credentials.json is deprecated. New writes use moltnet.json. Support will be removed in 3 minor versions.");
-		return JSON.parse(content);
-	} catch {
-		return null;
-	}
+function undefinedEncoder() {
+	throw new Error("`undefined` is not supported by the IPLD Data Model and cannot be encoded");
 }
-//#endregion
-//#region ../sdk/src/retry.ts
-var AUTH_RETRY_DEFAULT = 1;
 /**
-* Create a fetch wrapper that retries on 401 and 429.
-*
-* - **401**: Invalidates the cached token, re-authenticates, replays once.
-* - **429**: Delegates to `createRateLimitFetch` from `@moltnet/api-client/retry`.
+* Intercept all `number` values from an object walk and reject the entire
+* object if we find something that doesn't fit the IPLD data model (NaN &
+* Infinity).
 *
-* 5xx and network errors are not retried — non-idempotent methods (POST, PATCH)
-* could cause duplicate side effects.
+* @param {number} num
+* @returns {null}
 */
-function createRetryFetch(tokenManager, options) {
-	const maxAuthRetries = options?.maxAuthRetries ?? AUTH_RETRY_DEFAULT;
-	const rateLimitFetch = createRateLimitFetch({
-		maxRetries: options?.maxRateLimitRetries,
-		baseDelayMs: options?.baseDelayMs,
-		maxDelayMs: options?.maxDelayMs
-	});
-	return async (input, init) => {
-		let authRetries = 0;
-		const doFetch = async (fetchInit) => {
-			const response = await rateLimitFetch(input, fetchInit);
-			if (response.status === 401 && authRetries < maxAuthRetries) {
-				authRetries++;
-				tokenManager.invalidate();
-				const freshToken = await tokenManager.authenticate();
-				const headers = new Headers(fetchInit?.headers);
-				headers.set("Authorization", `Bearer ${freshToken}`);
-				return doFetch({
-					...fetchInit,
-					headers
-				});
-			}
-			return response;
-		};
-		return doFetch(init);
-	};
+function numberEncoder(num) {
+	if (Number.isNaN(num)) throw new Error("`NaN` is not supported by the IPLD Data Model and cannot be encoded");
+	if (num === Infinity || num === -Infinity) throw new Error("`Infinity` and `-Infinity` is not supported by the IPLD Data Model and cannot be encoded");
+	return null;
 }
-//#endregion
-//#region ../sdk/src/token.ts
-var TokenManager = class {
-	clientId;
-	clientSecret;
-	tokenUrl;
-	expiryBufferMs;
-	cached = null;
-	constructor(options) {
-		const apiUrl = options.apiUrl.replace(/\/$/, "");
-		this.clientId = options.clientId;
-		this.clientSecret = options.clientSecret;
-		this.tokenUrl = `${apiUrl}/oauth2/token`;
-		this.expiryBufferMs = options.expiryBufferMs ?? 3e4;
-	}
-	/** Return a valid access token, obtaining or refreshing as needed. */
-	async getToken() {
-		if (this.cached && Date.now() < this.cached.expiresAt) return this.cached.accessToken;
-		return this.authenticate();
-	}
-	/** Force-obtain a new token, replacing any cached value. */
-	async authenticate() {
-		const body = new URLSearchParams({
-			grant_type: "client_credentials",
-			client_id: this.clientId,
-			client_secret: this.clientSecret
-		});
-		let response;
-		try {
-			response = await fetch(this.tokenUrl, {
-				method: "POST",
-				headers: { "Content-Type": "application/x-www-form-urlencoded" },
-				body: body.toString()
-			});
-		} catch (error) {
-			throw new NetworkError(error instanceof Error ? error.message : "Token request failed", { detail: error instanceof Error ? error.cause?.toString() : String(error) });
-		}
-		const json = await response.json();
-		if (!response.ok || "error" in json) {
-			const errBody = json;
-			throw new AuthenticationError(errBody.error_description ?? errBody.error, {
-				statusCode: response.status,
-				detail: errBody.error
-			});
-		}
-		const tokenBody = json;
-		this.cached = {
-			accessToken: tokenBody.access_token,
-			expiresAt: Date.now() + tokenBody.expires_in * 1e3 - this.expiryBufferMs
-		};
-		return this.cached.accessToken;
-	}
-	/** Clear the cached token. Next getToken() call will re-authenticate. */
-	invalidate() {
-		this.cached = null;
+/**
+* @param {Map<any, any>} map
+* @returns {null}
+*/
+function mapEncoder(map) {
+	for (const key of map.keys()) if (typeof key !== "string" || key.length === 0) throw new Error("Non-string Map keys are not supported by the IPLD Data Model and cannot be encoded");
+	return null;
+}
+var _encodeOptions = {
+	float64: true,
+	typeEncoders: {
+		Map: mapEncoder,
+		Object: cidEncoder,
+		undefined: undefinedEncoder,
+		number: numberEncoder
 	}
 };
-//#endregion
-//#region ../sdk/src/connect.ts
-var DEFAULT_API_URL = "https://api.themolt.net";
-async function resolveCredentials(options) {
-	if (options.clientId && options.clientSecret) return {
-		clientId: options.clientId,
-		clientSecret: options.clientSecret,
-		apiUrl: (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
-	};
-	const env = readEnvCredentials();
-	if (env.clientId && env.clientSecret) return {
-		clientId: env.clientId,
-		clientSecret: env.clientSecret,
-		apiUrl: (env.apiUrl ?? options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
-	};
-	const config = await readConfig(options.configDir);
-	if (config?.oauth2?.client_id && config?.oauth2?.client_secret) return {
-		clientId: config.oauth2.client_id,
-		clientSecret: config.oauth2.client_secret,
-		apiUrl: (options.apiUrl ?? config.endpoints?.api ?? DEFAULT_API_URL).replace(/\/$/, "")
-	};
-	throw new MoltNetError("No credentials found. Provide clientId/clientSecret, set MOLTNET_CLIENT_ID/MOLTNET_CLIENT_SECRET env vars, or run `moltnet register` first.", { code: "NO_CREDENTIALS" });
+({ ..._encodeOptions }), { ..._encodeOptions.typeEncoders };
+/**
+* @param {Uint8Array} bytes
+* @returns {CID}
+*/
+function cidDecoder(bytes) {
+	if (bytes[0] !== 0) throw new Error("Invalid CID for CBOR tag 42; expected leading 0x00");
+	return CID.decode(bytes.subarray(1));
 }
+var _decodeOptions = {
+	allowIndefinite: false,
+	coerceUndefinedToNull: true,
+	allowNaN: false,
+	allowInfinity: false,
+	allowBigInt: true,
+	strict: true,
+	useMaps: false,
+	rejectDuplicateMapKeys: true,
+	tags: []
+};
+_decodeOptions.tags[CID_CBOR_TAG] = cidDecoder;
+({ ..._decodeOptions }), _decodeOptions.tags.slice();
+//#endregion
+//#region ../crypto-service/src/ssh.ts
 /**
-* Connect to MoltNet and return an authenticated Agent facade.
+* SSH key format conversion for MoltNet Ed25519 keys
 *
-* Credential resolution order:
-* 1. Explicit `clientId` / `clientSecret` in options
-* 2. `MOLTNET_CLIENT_ID` / `MOLTNET_CLIENT_SECRET` environment variables
-* 3. Config file (`~/.config/moltnet/moltnet.json`)
+* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
+* for use with git commit signing and SSH authentication.
 */
-async function connect(options = {}) {
-	const creds = await resolveCredentials(options);
-	const autoToken = options.autoToken ?? true;
-	const tokenManager = new TokenManager({
-		clientId: creds.clientId,
-		clientSecret: creds.clientSecret,
-		apiUrl: creds.apiUrl
-	});
-	const retryFetch = autoToken && options.retry !== false ? createRetryFetch(tokenManager, options.retry === void 0 ? void 0 : options.retry) : void 0;
-	const customFetch = retryFetch ?? (autoToken && !retryFetch ? async (input, init) => {
-		const response = await fetch(input, init);
-		if (response.status === 401) tokenManager.invalidate();
-		return response;
-	} : void 0);
-	return createAgent({
-		client: createClient({
-			baseUrl: creds.apiUrl,
-			...customFetch && { fetch: customFetch }
-		}),
-		tokenManager,
-		auth: autoToken ? () => tokenManager.getToken() : void 0
-	});
-}
+if (!etc.sha512Sync) etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
 //#endregion
 //#region src/commands/moltnet-reflect.ts
 var registerMoltnetReflectCommand = (pi, state) => {
@@ -7673,7 +7673,7 @@ function createMoltNetTools(config) {
 	const createEntry = defineTool({
 		name: "moltnet_create_entry",
 		label: "Create MoltNet Diary Entry",
-		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected.",
+		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected. Use this tool — NOT `moltnet entry create` / `moltnet entry create-signed` via bash. The CLI path bypasses task-tag auto-injection and leaves entries invisible to taskFilter queries.",
 		parameters: Type.Object({
 			title: Type.String({ description: "Entry title (concise, descriptive)" }),
 			content: Type.String({ description: "Entry content (markdown)" }),
@@ -8253,38 +8253,48 @@ async function resumeVm(config) {
 			[GUEST_TASK_SKILLS_MOUNT]: new MemoryProvider()
 		} }
 	});
-	await vm.exec(`sh -c '
+	try {
+		await vm.exec(`sh -c '
     cp /etc/gondolin/mitm/ca.crt /usr/local/share/ca-certificates/gondolin-mitm.crt
     update-ca-certificates 2>/dev/null
     cat /etc/gondolin/mitm/ca.crt >> /etc/ssl/certs/ca-certificates.crt
   '`);
-	await vmRun(vm, "DNS resolvers", `printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf`);
-	await vmRun(vm, "git safe.directory", `git config --system --add safe.directory '*'`);
-	for (const [i, cmd] of (config.sandboxConfig?.resumeCommands ?? []).entries()) await vmRun(vm, `resumeCommands[${i}]`, cmd);
-	const vmSshDir = `${vmAgentDir}/ssh`;
-	await vm.exec(`mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent`);
-	if (creds.piAuthJson !== null) await vm.fs.writeFile("/home/agent/.pi/agent/auth.json", creds.piAuthJson, { mode: 384 });
-	const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
-	await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, { mode: 384 });
-	await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, { mode: 384 });
-	if (creds.gitconfig) {
-		const vmSigningKey = `${vmSshDir}/id_ed25519`;
-		let vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
-		vmGitconfig = ensureRelativeWorktreePaths(vmGitconfig);
-		await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, { mode: 420 });
-	}
-	if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, { mode: 384 });
-	if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, { mode: 420 });
-	if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, { mode: 420 });
-	if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, { mode: 384 });
-	await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet");
-	return {
-		vm,
-		credentials: creds,
-		mountPath: config.mountPath,
-		guestWorkspace: GUEST_WORKSPACE$2,
-		agentDir
-	};
+		await vmRun(vm, "DNS resolvers", `printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf`);
+		await vmRun(vm, "git safe.directory", `git config --system --add safe.directory '*'`);
+		for (const [i, cmd] of (config.sandboxConfig?.resumeCommands ?? []).entries()) await vmRun(vm, `resumeCommands[${i}]`, cmd);
+		const vmSshDir = `${vmAgentDir}/ssh`;
+		await vm.exec(`mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent`);
+		if (creds.piAuthJson !== null) await vm.fs.writeFile("/home/agent/.pi/agent/auth.json", creds.piAuthJson, { mode: 384 });
+		const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
+		await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, { mode: 384 });
+		await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, { mode: 384 });
+		if (creds.gitconfig) {
+			const vmSigningKey = `${vmSshDir}/id_ed25519`;
+			let vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
+			vmGitconfig = ensureRelativeWorktreePaths(vmGitconfig);
+			await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, { mode: 420 });
+		}
+		if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, { mode: 384 });
+		if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, { mode: 420 });
+		if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, { mode: 420 });
+		if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, { mode: 384 });
+		await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet");
+		return {
+			vm,
+			credentials: creds,
+			mountPath: config.mountPath,
+			guestWorkspace: GUEST_WORKSPACE$2,
+			agentDir
+		};
+	} catch (err) {
+		try {
+			await vm.close();
+		} catch (closeErr) {
+			const m = closeErr instanceof Error ? closeErr.message : String(closeErr);
+			process.stderr.write(`[vm] post-throw vm.close() failed: ${m}\n`);
+		}
+		throw err;
+	}
 }
 /**
 * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
@@ -14706,8 +14716,8 @@ function buildRuntimeInstructor(ctx) {
 		"## Diary discipline",
 		"",
 		`- During this task, every diary entry MUST land in \`${ctx.diaryId}\``,
-		"  (the task diary). The MCP `moltnet_create_entry` tool enforces this",
-		"  and rejects mismatched explicit `diaryId` parameters.",
+		"  (the task diary). The `moltnet_create_entry` custom tool enforces",
+		"  this and rejects mismatched explicit `diaryId` parameters.",
 		`- Provenance tags \`task:id:${ctx.taskId}\`, \`task:type:${ctx.taskType}\`,`,
 		`  and \`task:attempt:${ctx.attemptN}\`${ctx.correlationId ? `, plus \`task:correlation:${ctx.correlationId}\`` : ""} are auto-injected on every entry.`,
 		"  These share the `task:` namespace so `moltnet_diary_tags` with",
@@ -14715,12 +14725,23 @@ function buildRuntimeInstructor(ctx) {
 		"  `taskFilter` shorthand on `moltnet_list_entries` /",
 		"  `moltnet_search_entries` expands into them. You may add additional",
 		"  tags but you cannot remove the auto-injected ones.",
+		"- **DO NOT shell out to `moltnet entry create` / `moltnet entry",
+		"  create-signed` / any other `moltnet entry` subcommand via bash.**",
+		"  Those CLI paths hit the REST API directly and bypass the",
+		"  custom tool's task-tag auto-injection, leaving you with",
+		"  untagged entries that `moltnet_list_entries` with a",
+		"  `taskFilter: { taskId: ... }` cannot find. The legreffier skill",
+		"  recommends `moltnet entry *` for normal interactive sessions —",
+		"  inside a running task that advice does not apply. Use the",
+		"  `moltnet_create_entry` custom tool only.",
 		"",
 		"## Accountable commits",
 		"",
 		"- Every commit you make during this task MUST be paired with a signed",
-		"  diary entry created via `moltnet_create_entry`. Embed the returned",
-		"  entry id in the commit trailer `MoltNet-Diary: <id>`.",
+		"  diary entry created via the `moltnet_create_entry` custom tool",
+		"  (NOT via `moltnet entry create-signed` from bash — see Diary",
+		"  discipline above). Embed the returned entry id in the commit",
+		"  trailer `MoltNet-Diary: <id>`.",
 		"- Commits must be signed with the agent credentials (gitconfig is",
 		"  pre-configured). Do not bypass signing.",
 		"",
@@ -15417,6 +15438,11 @@ async function executePiTask(claimedTask, reporter, opts) {
 		let assistantText = "";
 		let reporterError = null;
 		const usage = finalUsage;
+		let capAbort = null;
+		let toolUseTurnCount = 0;
+		let bashTimeoutCount = 0;
+		const maxTurns = opts.maxTurns ?? 0;
+		const maxBashTimeouts = opts.maxBashTimeouts ?? 3;
 		cancelListener = wireSessionAbort(reporter.cancelSignal, session);
 		const recordingPromise = [];
 		const track = (p) => {
@@ -15431,6 +15457,23 @@ async function executePiTask(claimedTask, reporter, opts) {
 				}
 			}));
 		};
+		const liveSession = session;
+		const triggerCapAbort = (code, message) => {
+			if (capAbort) return;
+			capAbort = {
+				code,
+				message
+			};
+			liveSession.abort().catch((err) => {
+				const m = err instanceof Error ? err.message : String(err);
+				process.stderr.write(`[cap] session.abort() failed: ${m}\n`);
+			});
+			track(emit("info", {
+				event: "cap_abort",
+				code,
+				message
+			}));
+		};
 		session.subscribe((event) => {
 			if (event.type === "message_update") {
 				const ae = event.assistantMessageEvent;
@@ -15439,12 +15482,17 @@ async function executePiTask(claimedTask, reporter, opts) {
 					track(emit("text_delta", { delta: ae.delta }));
 				}
 			} else if (event.type === "tool_execution_start") track(emit("tool_call_start", { tool_name: event.toolName }));
-			else if (event.type === "tool_execution_end") track(emit("tool_call_end", {
-				tool_name: event.toolName,
-				is_error: event.isError,
-				result: event.isError ? truncateForWire(event.result) : void 0
-			}));
-			else if (event.type === "turn_end") {
+			else if (event.type === "tool_execution_end") {
+				track(emit("tool_call_end", {
+					tool_name: event.toolName,
+					is_error: event.isError,
+					result: event.isError ? truncateForWire(event.result) : void 0
+				}));
+				if (maxBashTimeouts > 0 && event.toolName === "bash" && event.isError && isBashTimeoutResult(event.result)) {
+					bashTimeoutCount += 1;
+					if (bashTimeoutCount >= maxBashTimeouts) triggerCapAbort("max_bash_timeouts_exceeded", `Aborted after ${bashTimeoutCount} bash timeouts in this attempt (cap ${maxBashTimeouts}).`);
+				}
+			} else if (event.type === "turn_end") {
 				const msg = event.message;
 				if (msg?.role === "assistant" && msg.usage) {
 					usage.inputTokens += Math.max(0, msg.usage.input ?? 0);
@@ -15454,7 +15502,12 @@ async function executePiTask(claimedTask, reporter, opts) {
 					if (cr) usage.cacheReadTokens = (usage.cacheReadTokens ?? 0) + cr;
 					if (cw) usage.cacheWriteTokens = (usage.cacheWriteTokens ?? 0) + cw;
 				}
-				track(emit("turn_end", { stop_reason: msg?.stopReason ?? "end_turn" }));
+				const stopReason = msg?.stopReason ?? "end_turn";
+				track(emit("turn_end", { stop_reason: stopReason }));
+				if (maxTurns > 0 && stopReason !== "end_turn" && stopReason !== "aborted" && stopReason !== "error") {
+					toolUseTurnCount += 1;
+					if (toolUseTurnCount >= maxTurns) triggerCapAbort("max_turns_exceeded", `Aborted after ${toolUseTurnCount} tool-use turns (cap ${maxTurns}).`);
+				}
 				llmAbort = msg?.stopReason === "error";
 				if (msg?.stopReason === "error") llmErrorMessage = typeof msg.errorMessage === "string" && msg.errorMessage.length > 0 ? msg.errorMessage : null;
 				else llmErrorMessage = null;
@@ -15483,7 +15536,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		let parsedOutput = null;
 		let parsedOutputCid = null;
 		let parseError = null;
-		if (!runError && !llmAbort && !cancelled) {
+		if (!runError && !llmAbort && !cancelled && !capAbort) {
 			const captured = submitToolHandle?.getCaptured() ?? null;
 			if (captured) try {
 				parsedOutput = captured;
@@ -15536,6 +15589,21 @@ async function executePiTask(claimedTask, reporter, opts) {
 				retryable: false
 			}
 		};
+		const capAbortSnapshot = capAbort;
+		if (capAbortSnapshot) return {
+			taskId: task.id,
+			attemptN,
+			status: "failed",
+			output: null,
+			outputCid: null,
+			usage,
+			durationMs: Date.now() - startTime,
+			error: {
+				code: capAbortSnapshot.code,
+				message: capAbortSnapshot.message,
+				retryable: false
+			}
+		};
 		const status = runError || llmAbort || parseError || reporterError ? "failed" : "completed";
 		const errorCode = runError?.code ?? parseError?.code ?? reporterError?.code ?? (llmAbort ? "llm_api_error" : void 0);
 		const errorMessage = runError?.message ?? parseError?.message ?? reporterError?.message ?? (llmAbort ? llmErrorMessage ?? "LLM API error during turn" : void 0);
@@ -15637,6 +15705,25 @@ function summarizePayloadForLog(kind, payload) {
 		default: return payload;
 	}
 }
+/**
+* Detect pi's bash-timeout error wrapper in a `tool_execution_end`
+* result. The bash tool surfaces a timeout as a structured tool result
+* `{ content: [{ type: 'text', text: '… Command timed out after N
+* seconds' }] }` (see `@earendil-works/pi-coding-agent`'s bash.js).
+* Substring-match against the stable wrapper string is the only
+* mechanism short of patching pi; the string is part of pi's external
+* tool-error API and changing it would break agents that read tool
+* errors.
+*/
+function isBashTimeoutResult(result) {
+	if (result === null || result === void 0) return false;
+	if (typeof result === "string") return result.includes("Command timed out after");
+	if (typeof result !== "object") return false;
+	const content = result.content;
+	if (!Array.isArray(content)) return false;
+	for (const part of content) if (typeof part === "object" && part !== null && typeof part.text === "string" && part.text.includes("Command timed out after")) return true;
+	return false;
+}
 var TRUNCATE_LIMIT = 4 * 1024;
 function truncateForWire(value) {
 	if (value === null || value === void 0) return value;