@wrongstack/core 0.313.0 → 0.316.1

package/dist/coordination/mailbox-project-server.js

@@ -1,3276 +1,48 @@
 #!/usr/bin/env node
-
-// src/coordination/mailbox-project-server.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import * as fsPromises from "node:fs/promises";
-import * as net from "node:net";
-import * as path7 from "node:path";
-import { bindProjectEndpoint } from "@wrongstack/persistence";
-
-// src/kernel/events.ts
-var MAX_WILDCARDS = 500;
-var MAX_NAMED_LISTENERS = 2e3;
-var EventBus = class {
-  listeners = /* @__PURE__ */ new Map();
-  wildcards = [];
-  logger;
-  /**
-   * Dispatch arrays cached per event name, rebuilt lazily after a
-   * subscription change. See {@link namedSnapshot}. Every mutation of
-   * `listeners` must invalidate the matching entry, and every mutation of
-   * `wildcards` must null `wildcardSnapshotCache` — a missed invalidation
-   * means an emit dispatches to a stale listener set.
-   */
-  listenerSnapshots = /* @__PURE__ */ new Map();
-  wildcardSnapshotCache = null;
-  setLogger(logger) {
-    this.logger = logger;
-  }
-  on(event, fn) {
-    if (this.listenerCount() >= MAX_NAMED_LISTENERS) {
-      this.logger?.error(
-        `EventBus named listener limit (~${MAX_NAMED_LISTENERS}) reached \u2014 rejecting on("${event}"). Callers must dispose their named listeners to prevent unbounded memory growth.`
-      );
-      return () => {
-      };
-    }
-    let set = this.listeners.get(event);
-    if (!set) {
-      set = /* @__PURE__ */ new Set();
-      this.listeners.set(event, set);
-    }
-    set.add(fn);
-    this.listenerSnapshots.delete(event);
-    return () => this.off(event, fn);
-  }
-  off(event, fn) {
-    const set = this.listeners.get(event);
-    if (!set) return;
-    set.delete(fn);
-    this.listenerSnapshots.delete(event);
-    if (set.size === 0) this.listeners.delete(event);
-  }
-  once(event, fn) {
-    const wrapper = (payload) => {
-      this.off(event, wrapper);
-      fn(payload);
-    };
-    this.on(event, wrapper);
-    return () => {
-      this.off(event, wrapper);
-    };
-  }
-  /**
-   * Subscribe to all events, regardless of name. Short-hand for
-   * `onPattern('*')`. Use for logging, debugging, or forwarding every
-   * event to another bus (as FleetBus does).
-   *
-   * Returns an unsubscribe function.
-   */
-  onAny(fn, owner) {
-    return this.onPattern("*", fn, owner);
-  }
-  /**
-   * Subscribe to all events whose name matches a glob-style prefix.
-   * `'tool.*'` matches `tool.started`, `tool.executed`, `tool.progress`, etc.
-   * `'*'` matches every event.
-   *
-   * The handler receives `(eventName, payload)` with the event name as a
-   * string and the payload as `unknown`. Use for logging, debugging, or
-   * metrics collection across a family of events.
-   *
-   * Returns an unsubscribe function.
-   */
-  onPattern(pattern, fn, owner) {
-    if (this.wildcards.length >= MAX_WILDCARDS) {
-      this.logger?.error(
-        `EventBus wildcard limit (${MAX_WILDCARDS}) reached \u2014 rejecting onPattern("${pattern}")` + (owner ? ` (owner: ${owner})` : "") + ". Callers must dispose their wildcard listeners to prevent unbounded growth."
-      );
-      return () => {
-      };
-    }
-    const match = makePatternMatcher(pattern);
-    const entry = { match, fn, owner };
-    this.wildcards.push(entry);
-    this.wildcardSnapshotCache = null;
-    return () => {
-      const idx = this.wildcards.indexOf(entry);
-      if (idx >= 0) {
-        this.wildcards.splice(idx, 1);
-        this.wildcardSnapshotCache = null;
-      }
-    };
-  }
-  /**
-   * Subscribe to all events whose name matches a RegExp.
-   * More flexible than `onPattern` — use when you need regex features
-   * (alternation, character classes, capture groups).
-   *
-   * Returns an unsubscribe function.
-   */
-  onRegex(regex, fn, owner) {
-    if (this.wildcards.length >= MAX_WILDCARDS) {
-      this.logger?.error(
-        `EventBus wildcard limit (${MAX_WILDCARDS}) reached \u2014 rejecting onRegex(${regex})` + (owner ? ` (owner: ${owner})` : "") + ". Callers must dispose their wildcard listeners to prevent unbounded growth."
-      );
-      return () => {
-      };
-    }
-    const entry = { match: (e) => regex.test(e), fn, owner };
-    this.wildcards.push(entry);
-    this.wildcardSnapshotCache = null;
-    return () => {
-      const idx = this.wildcards.indexOf(entry);
-      if (idx >= 0) {
-        this.wildcards.splice(idx, 1);
-        this.wildcardSnapshotCache = null;
-      }
-    };
-  }
-  emit(event, payload) {
-    const snapshot = this.namedSnapshot(event);
-    if (snapshot !== void 0) {
-      for (const fn of snapshot) {
-        try {
-          fn(payload);
-        } catch (err) {
-          this.logger?.error(`EventBus listener for "${event}" threw`, err);
-        }
-      }
-    }
-    if (this.wildcards.length > 0) {
-      const name = event;
-      for (const { match, fn } of this.wildcardSnapshot()) {
-        if (!match(name)) continue;
-        try {
-          fn(name, payload);
-        } catch (err) {
-          this.logger?.error(`EventBus wildcard listener for "${name}" threw`, err);
-        }
-      }
-    }
-  }
-  /**
-   * Dispatch array for one event name, or `undefined` when nothing is
-   * subscribed.
-   *
-   * Dispatch iterates a stable array rather than the live Set so a listener
-   * that subscribes or unsubscribes mid-emit cannot change what this round
-   * delivers: an addition fires from the next emit, a removal may still fire
-   * this round. That is the contract callers rely on, and it is unchanged.
-   *
-   * What changed is who pays for it. Building the array per emit did O(number
-   * of listeners) copying on every event, including `tool.progress` and
-   * streaming deltas — the highest-frequency paths in the process. The array
-   * is now cached and rebuilt only when the subscription set actually changes,
-   * which is wiring time and essentially never during a run. Measured at 2M
-   * emits with 12 named + 6 wildcard listeners: 207 ms → 141 ms.
-   *
-   * This is a throughput win, not a footprint one: the per-emit arrays died in
-   * the nursery and never showed up as retained heap (measured heap growth was
-   * the same either way). Do not cite this as a memory fix.
-   *
-   * A mutation during dispatch invalidates the cache for the *next* emit while
-   * the in-flight loop keeps walking the array it started with — which is
-   * exactly the snapshot semantics described above.
-   */
-  namedSnapshot(event) {
-    const cached = this.listenerSnapshots.get(event);
-    if (cached !== void 0) return cached;
-    const set = this.listeners.get(event);
-    if (!set || set.size === 0) return void 0;
-    const snapshot = [...set];
-    this.listenerSnapshots.set(event, snapshot);
-    return snapshot;
-  }
-  /** Wildcard counterpart to {@link namedSnapshot}; same caching rationale. */
-  wildcardSnapshot() {
-    this.wildcardSnapshotCache ??= this.wildcards.slice();
-    return this.wildcardSnapshotCache;
-  }
-  /**
-   * Emit a plugin-defined event that is intentionally outside EventMap.
-   * Custom events are delivered to wildcard/pattern listeners only; typed
-   * listeners remain reserved for core EventMap keys.
-   */
-  emitCustom(event, payload) {
-    if (this.wildcards.length === 0) return;
-    for (const { match, fn } of this.wildcardSnapshot()) {
-      if (!match(event)) continue;
-      try {
-        fn(event, payload);
-      } catch (err) {
-        this.logger?.error(`EventBus wildcard listener for "${event}" threw`, err);
-      }
-    }
-  }
-  clear() {
-    this.listeners.clear();
-    this.wildcards.length = 0;
-    this.listenerSnapshots.clear();
-    this.wildcardSnapshotCache = null;
-  }
-  /**
-   * V2-D: introspection helper. Pass an `event` to count handlers for a
-   * single key, or omit to get the total across every event. Used by the
-   * leak-detection smoke test to flag handler accumulation across runs.
-   * Does NOT include wildcard listeners.
-   */
-  listenerCount(event) {
-    if (event !== void 0) return this.listeners.get(event)?.size ?? 0;
-    let total = 0;
-    for (const set of this.listeners.values()) total += set.size;
-    return total;
-  }
-  /**
-   * Number of wildcard listeners currently registered.
-   */
-  wildcardCount() {
-    return this.wildcards.length;
-  }
-  /**
-   * True if anything would receive an emit for `event` — a named listener
-   * OR a wildcard/regex pattern that matches the event name. Unlike
-   * `listenerCount`, this DOES account for wildcards, so callers that gate
-   * behavior on "is anyone listening?" (e.g. SubagentBudget deciding whether
-   * to negotiate a soft limit vs hard-stop) don't misfire when the only
-   * subscriber is a pattern listener like the FleetBus's `onPattern('*')`.
-   */
-  hasListenerFor(event) {
-    if ((this.listeners.get(event)?.size ?? 0) > 0) return true;
-    return this.wildcards.some((w) => w.match(event));
-  }
-};
-var MATCH_ALL = () => true;
-function makePatternMatcher(pattern) {
-  if (pattern === "*") return MATCH_ALL;
-  if (pattern.endsWith(".*")) {
-    const prefix = pattern.slice(0, -2);
-    return (e) => e.startsWith(`${prefix}.`);
-  }
-  return (e) => e === pattern;
-}
-
-// src/security/file-permissions.ts
 import {
-  restrictDirPermissions,
-  restrictFilePermissions,
-  SECRET_DIR_MODE,
-  SECRET_FILE_MODE
-} from "@wrongstack/persistence";
-
-// src/utils/atomic-write.ts
+  MailboxEventEmitter
+} from "../chunk-JX7VBZDK.js";
 import {
-  createPersistencePrimitives
-} from "@wrongstack/persistence";
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-
-// src/utils/atomic-write.ts
-var primitives = createPersistencePrimitives({
-  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
-    message: `Timed out waiting for file lock: ${targetPath}`,
-    code: "FS_ATOMIC_WRITE_FAILED",
-    path: targetPath,
-    context: { timeoutMs }
-  })
-});
-var atomicWrite = primitives.atomicWrite;
-var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
-var ensureDir = primitives.ensureDir;
-var withFileLock = primitives.withFileLock;
-
-// src/utils/heap-watchdog.ts
-import * as fs from "node:fs";
-import * as fsp2 from "node:fs/promises";
-import * as path3 from "node:path";
+  useDaemonPerfDefaults
+} from "../chunk-FNXVT7HF.js";
 import {
-  PerformanceObserver,
-  constants as performanceConstants
-} from "node:perf_hooks";
-import * as v8 from "node:v8";
-
-// src/utils/memory-flight-recorder.ts
-import * as fsp from "node:fs/promises";
-import * as path2 from "node:path";
-
-// src/utils/continuous-memory-profiler.ts
-import { Session } from "node:inspector/promises";
-var DEFAULT_SAMPLE_INTERVAL_BYTES = 512 * 1024;
-var DEFAULT_STACK_DEPTH = 64;
-var MAX_SUMMARY_STACKS = 20;
-var MAX_FRAMES_PER_STACK = 12;
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function numeric(value) {
-  if (typeof value === "bigint") return Number(value);
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-function summarizePprof(profile) {
-  const strings = profile.stringTable.strings;
-  const functions = new Map(profile.function.map((entry) => [numeric(entry.id), entry]));
-  const locations = new Map(profile.location.map((entry) => [numeric(entry.id), entry]));
-  const stacks = /* @__PURE__ */ new Map();
-  let sampledBytes = 0;
-  let sampledObjects = 0;
-  for (const sample of profile.sample) {
-    const objects = numeric(sample.value[0]);
-    const bytes = numeric(sample.value[1]);
-    sampledObjects += objects;
-    sampledBytes += bytes;
-    const frames = sample.locationId.slice(0, MAX_FRAMES_PER_STACK).flatMap((locationId) => {
-      const location = locations.get(numeric(locationId));
-      const line = location?.line[0];
-      const fn = line ? functions.get(numeric(line.functionId)) : void 0;
-      if (!fn) return [];
-      const name = strings[numeric(fn.name)] || "(anonymous)";
-      const filename = strings[numeric(fn.filename)] || "";
-      const lineNumber = numeric(line?.line);
-      return [filename ? `${name} (${filename}${lineNumber > 0 ? `:${lineNumber}` : ""})` : name];
-    });
-    if (frames.length === 0) frames.push("(unknown)");
-    const key = frames.join("\n");
-    const existing = stacks.get(key);
-    if (existing) {
-      existing.bytes += bytes;
-      existing.objects += objects;
-    } else {
-      stacks.set(key, { bytes, objects, frames });
-    }
-  }
-  return {
-    sampledBytes,
-    sampledObjects,
-    sampleCount: profile.sample.length,
-    topStacks: [...stacks.values()].sort((left, right) => right.bytes - left.bytes).slice(0, MAX_SUMMARY_STACKS)
-  };
-}
-async function startDatadogProfiler() {
-  const pprof = await import("@datadog/pprof");
-  pprof.heap.start(DEFAULT_SAMPLE_INTERVAL_BYTES, DEFAULT_STACK_DEPTH);
-  let stopped = false;
-  return {
-    backend: "datadog-pprof",
-    capture: async () => {
-      if (stopped) throw new Error("Continuous memory profiler is stopped");
-      const profile = pprof.heap.profile();
-      return {
-        backend: "datadog-pprof",
-        data: await pprof.encode(profile),
-        extension: ".pb.gz",
-        summary: summarizePprof(profile)
-      };
-    },
-    stop: async () => {
-      if (stopped) return;
-      stopped = true;
-      pprof.heap.stop();
-    }
-  };
-}
-async function startInspectorProfiler() {
-  const session = new Session();
-  session.connect();
-  try {
-    await session.post("HeapProfiler.enable");
-    await session.post("HeapProfiler.startSampling", {
-      samplingInterval: DEFAULT_SAMPLE_INTERVAL_BYTES,
-      includeObjectsCollectedByMajorGC: false,
-      includeObjectsCollectedByMinorGC: false
-    });
-  } catch (error) {
-    try {
-      session.disconnect();
-    } catch {
-    }
-    throw error;
-  }
-  let stopped = false;
-  return {
-    backend: "node-inspector",
-    capture: async () => {
-      if (stopped) throw new Error("Continuous memory profiler is stopped");
-      const result = await session.post("HeapProfiler.stopSampling");
-      await session.post("HeapProfiler.startSampling", {
-        samplingInterval: DEFAULT_SAMPLE_INTERVAL_BYTES,
-        includeObjectsCollectedByMajorGC: false,
-        includeObjectsCollectedByMinorGC: false
-      });
-      return {
-        backend: "node-inspector",
-        data: JSON.stringify(result.profile),
-        extension: ".heapprofile"
-      };
-    },
-    stop: async () => {
-      if (stopped) return;
-      stopped = true;
-      try {
-        await session.post("HeapProfiler.disable");
-      } catch {
-      }
-      try {
-        session.disconnect();
-      } catch {
-      }
-    }
-  };
-}
-async function startContinuousMemoryProfiler() {
-  try {
-    return { profiler: await startDatadogProfiler() };
-  } catch (error) {
-    const fallbackReason = errorMessage(error);
-    return {
-      profiler: await startInspectorProfiler(),
-      fallbackReason
-    };
-  }
-}
+  startSharedHeapWatchdog
+} from "../chunk-DYLPMV4Q.js";
+import {
+  EventBus
+} from "../chunk-FHZVFYSL.js";
+import {
+  MAILBOX_PROJECT_SERVER_MAX_FRAME_CHARS,
+  MAILBOX_PROJECT_SERVER_PROTOCOL_VERSION,
+  SQLITE_MAILBOX_FILE,
+  SqliteMailbox,
+  encodeMailboxProjectServerMessage,
+  isMailboxProjectServerClientMessage,
+  mailboxProjectServerEndpoint,
+  mailboxProjectServerMetadataPath
+} from "../chunk-PQNS3U7Z.js";
+import {
+  redactMailboxCredential
+} from "../chunk-IRUTEHCE.js";
+import "../chunk-FWNLEZYG.js";
+import {
+  restrictFilePermissions
+} from "../chunk-6FHWXLPT.js";
+import "../chunk-LX5QWLBL.js";
+import "../chunk-POOOIWE5.js";
+import {
+  atomicWrite
+} from "../chunk-OSGLYW5J.js";
+import "../chunk-SAFHACFA.js";
+import "../chunk-25LSLC3G.js";
+import "../chunk-TBRL2RCC.js";
 
-// src/utils/wstack-paths.ts
-import * as os from "node:os";
+// src/coordination/mailbox-project-server.ts
+import { randomBytes } from "node:crypto";
+import * as fsPromises from "node:fs/promises";
+import * as net from "node:net";
 import * as path from "node:path";
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path.resolve(fromEnv);
-  return path.join(os.homedir(), ".wrongstack");
-}
-
-// src/utils/memory-flight-recorder.ts
-var MB = 1024 * 1024;
-var HOUR_MS = 60 * 60 * 1e3;
-var DEFAULT_WINDOW_MS = 5 * 60 * 1e3;
-var DEFAULT_MINIMUM_WINDOW_MS = 2 * 60 * 1e3;
-var DEFAULT_COOLDOWN_MS = 15 * 60 * 1e3;
-var DEFAULT_CONTINUOUS_CAPTURE_MS = 5 * 60 * 1e3;
-var MAX_OBSERVATIONS = 24;
-var MAX_CAPTURE_SESSIONS = 12;
-var MAX_CAPTURES_PER_SESSION = 6;
-var SESSION_MAX_AGE_MS = 7 * 24 * HOUR_MS;
-function timestampSlug(date = /* @__PURE__ */ new Date()) {
-  return date.toISOString().replaceAll(":", "").replaceAll(".", "-");
-}
-async function pruneCaptureFiles(artifactDir) {
-  const entries = await fsp.readdir(artifactDir, { withFileTypes: true });
-  const captures = entries.filter(
-    (entry) => entry.isFile() && entry.name.startsWith("event-") && entry.name.endsWith(".json")
-  ).map((entry) => entry.name).sort();
-  const remove = captures.slice(0, Math.max(0, captures.length - MAX_CAPTURES_PER_SESSION));
-  await Promise.all(
-    remove.flatMap((eventName) => {
-      const stem = eventName.slice("event-".length, -".json".length);
-      return [
-        fsp.rm(path2.join(artifactDir, eventName), { force: true }),
-        fsp.rm(path2.join(artifactDir, `allocations-${stem}.heapprofile`), { force: true }),
-        fsp.rm(path2.join(artifactDir, `allocations-${stem}.pb.gz`), { force: true })
-      ];
-    })
-  );
-}
-async function pruneOldSessions(root, currentDir) {
-  const entries = await fsp.readdir(root, { withFileTypes: true });
-  const sessions = await Promise.all(
-    entries.filter((entry) => entry.isDirectory() && entry.name !== path2.basename(currentDir)).map(async (entry) => {
-      const fullPath = path2.join(root, entry.name);
-      const stat2 = await fsp.stat(fullPath);
-      return { fullPath, mtimeMs: stat2.mtimeMs };
-    })
-  );
-  sessions.sort((a, b) => b.mtimeMs - a.mtimeMs);
-  const now = Date.now();
-  await Promise.all(
-    sessions.filter(
-      (session, index) => now - session.mtimeMs > SESSION_MAX_AGE_MS || index >= MAX_CAPTURE_SESSIONS && now - session.mtimeMs > 24 * HOUR_MS
-    ).map((session) => fsp.rm(session.fullPath, { recursive: true, force: true }))
-  );
-}
-var ContinuousMemoryCaptureWriter = class {
-  artifactDir;
-  root;
-  ready;
-  profiler;
-  profilerBackend = "initializing";
-  fallbackReason;
-  startError;
-  lastSummary;
-  stopped = false;
-  constructor(root) {
-    this.root = root;
-    this.artifactDir = path2.join(root, `${timestampSlug()}-pid-${process.pid}`);
-    this.ready = this.start().catch((error) => {
-      this.startError = error instanceof Error ? error.message : String(error);
-      this.profilerBackend = "unavailable";
-    });
-  }
-  async start() {
-    const started = await startContinuousMemoryProfiler();
-    this.profiler = started.profiler;
-    this.profilerBackend = started.profiler.backend;
-    this.fallbackReason = started.fallbackReason;
-  }
-  diagnostics() {
-    return {
-      memoryProfilerBackend: this.profilerBackend,
-      ...this.fallbackReason ? { memoryProfilerFallbackReason: this.fallbackReason } : {},
-      ...this.startError ? { memoryProfilerStartError: this.startError } : {},
-      ...this.lastSummary ? {
-        memoryProfileSampledBytes: this.lastSummary.sampledBytes,
-        memoryProfileSampledObjects: this.lastSummary.sampledObjects,
-        memoryProfileSampleCount: this.lastSummary.sampleCount,
-        memoryProfileTopStack: this.lastSummary.topStack,
-        memoryProfileTopStackBytes: this.lastSummary.topStackBytes
-      } : {}
-    };
-  }
-  async capture(event) {
-    await this.ready;
-    if (this.stopped) return;
-    let profile;
-    let captureError = this.startError;
-    if (!captureError && this.profiler) {
-      try {
-        profile = await this.profiler.capture();
-        const top = profile.summary?.topStacks[0];
-        if (profile.summary) {
-          this.lastSummary = {
-            sampledBytes: profile.summary.sampledBytes,
-            sampledObjects: profile.summary.sampledObjects,
-            sampleCount: profile.summary.sampleCount,
-            topStack: top?.frames.join(" <- "),
-            topStackBytes: top?.bytes
-          };
-        }
-      } catch (error) {
-        captureError = error instanceof Error ? error.message : String(error);
-      }
-    }
-    await fsp.mkdir(this.artifactDir, { recursive: true });
-    const stem = `${timestampSlug(new Date(event.capturedAt))}-${event.reason}`;
-    await fsp.writeFile(
-      path2.join(this.artifactDir, `event-${stem}.json`),
-      `${JSON.stringify(
-        {
-          ...event,
-          profilerBackend: profile?.backend ?? this.profilerBackend,
-          ...profile?.summary ? { allocationSummary: profile.summary } : {},
-          ...this.fallbackReason ? { profilerFallbackReason: this.fallbackReason } : {},
-          ...captureError ? { captureError } : {}
-        },
-        null,
-        2
-      )}
-`,
-      "utf8"
-    );
-    if (profile) {
-      await fsp.writeFile(
-        path2.join(this.artifactDir, `allocations-${stem}${profile.extension}`),
-        profile.data
-      );
-    }
-    await Promise.all([
-      pruneCaptureFiles(this.artifactDir),
-      fsp.mkdir(this.root, { recursive: true }).then(() => pruneOldSessions(this.root, this.artifactDir))
-    ]);
-  }
-  async stop() {
-    if (this.stopped) return;
-    this.stopped = true;
-    await this.ready;
-    await this.profiler?.stop();
-  }
-};
-function disabledWriter(artifactDir) {
-  return {
-    artifactDir,
-    capture: async () => void 0,
-    stop: async () => void 0
-  };
-}
-function createMemoryFlightRecorder(options = {}) {
-  const now = options.now ?? Date.now;
-  const startedAt2 = now();
-  const root = options.diagnosticsRoot ?? path2.join(wstackGlobalRoot(), "diagnostics", "memory");
-  const isBunRuntime = typeof globalThis.Bun !== "undefined";
-  const enabled = options.enabled ?? (!isBunRuntime && process.env["WRONGSTACK_MEMORY_FLIGHT_RECORDER"] !== "0" && process.env["NODE_ENV"] !== "test");
-  const writer = options.captureWriter ?? (enabled ? new ContinuousMemoryCaptureWriter(root) : disabledWriter(path2.join(root, `${timestampSlug()}-pid-${process.pid}`)));
-  const observations = [];
-  const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
-  const minimumWindowMs = options.minimumWindowMs ?? DEFAULT_MINIMUM_WINDOW_MS;
-  const cooldownMs = options.cooldownMs ?? DEFAULT_COOLDOWN_MS;
-  const continuousCaptureMs = options.continuousCaptureMs ?? DEFAULT_CONTINUOUS_CAPTURE_MS;
-  const warmupMs = options.warmupMs ?? 6e4;
-  let lastSignalCaptureAt = Number.NEGATIVE_INFINITY;
-  let lastContinuousCaptureAt = startedAt2;
-  let captureInFlight = false;
-  let capturePromise;
-  const observe = (sample, stats) => {
-    const at = now();
-    const postGcHeapUsed = typeof stats["postGcHeapUsed"] === "number" ? stats["postGcHeapUsed"] : 0;
-    const postMajorGcHeapUsed = typeof stats["postMajorGcHeapUsed"] === "number" ? stats["postMajorGcHeapUsed"] : 0;
-    const lastGcAgoMs = typeof stats["lastGcAgoMs"] === "number" ? stats["lastGcAgoMs"] : -1;
-    const lastMajorGcAgoMs = typeof stats["lastMajorGcAgoMs"] === "number" ? stats["lastMajorGcAgoMs"] : -1;
-    const retainedHeapUsed = postMajorGcHeapUsed > 0 && lastMajorGcAgoMs >= 0 && lastMajorGcAgoMs <= windowMs ? postMajorGcHeapUsed : postGcHeapUsed > 0 && lastGcAgoMs >= 0 && lastGcAgoMs <= minimumWindowMs ? postGcHeapUsed : sample.heapUsed;
-    observations.push({
-      at,
-      heapUsed: retainedHeapUsed,
-      rss: sample.rss,
-      nativeResidual: sample.nativeResidual ?? 0
-    });
-    while (observations.length > MAX_OBSERVATIONS || observations.length > 1 && at - (observations[0]?.at ?? at) > windowMs) {
-      observations.shift();
-    }
-    const first = observations[0] ?? observations.at(-1);
-    const elapsedMs = first ? Math.max(0, at - first.at) : 0;
-    const heapGrowthBytes = first ? retainedHeapUsed - first.heapUsed : 0;
-    const rssGrowthBytes = first ? sample.rss - first.rss : 0;
-    const nativeGrowthBytes = first ? (sample.nativeResidual ?? 0) - first.nativeResidual : 0;
-    const heapGrowthBytesPerHour = elapsedMs > 0 ? Math.round(heapGrowthBytes / elapsedMs * HOUR_MS) : 0;
-    const rssGrowthBytesPerHour = elapsedMs > 0 ? Math.round(rssGrowthBytes / elapsedMs * HOUR_MS) : 0;
-    const nativeGrowthBytesPerHour = elapsedMs > 0 ? Math.round(nativeGrowthBytes / elapsedMs * HOUR_MS) : 0;
-    let signal = "stable";
-    if ((sample.detachedContexts ?? 0) > 0) signal = "detached-contexts";
-    else if (heapGrowthBytes >= 32 * MB && heapGrowthBytesPerHour > 0) signal = "js-retention";
-    else if (nativeGrowthBytes >= 64 * MB && nativeGrowthBytesPerHour > 0) signal = "native-rss";
-    const diagnosis = {
-      memorySignal: signal,
-      memoryWindowMs: elapsedMs,
-      retainedHeapUsed,
-      transientHeapBytes: Math.max(0, sample.heapUsed - retainedHeapUsed),
-      heapGrowthBytes,
-      rssGrowthBytes,
-      nativeGrowthBytes,
-      heapGrowthBytesPerHour,
-      rssGrowthBytesPerHour,
-      nativeGrowthBytesPerHour,
-      memoryArtifactDir: writer.artifactDir,
-      ...writer.diagnostics?.() ?? {}
-    };
-    let reason;
-    if (at - startedAt2 >= warmupMs) {
-      if ((sample.detachedContexts ?? 0) > 0) reason = "detached-contexts";
-      else if (sample.load >= 0.45) reason = "heap-load";
-      else if (sample.heapUsed >= (options.absoluteHeapBytes ?? 768 * MB)) {
-        reason = "absolute-heap";
-      } else if (elapsedMs >= minimumWindowMs && heapGrowthBytes >= (options.heapGrowthBytes ?? 32 * MB) && heapGrowthBytesPerHour >= (options.heapGrowthBytesPerHour ?? 192 * MB)) {
-        reason = "heap-growth";
-      } else if (elapsedMs >= minimumWindowMs && nativeGrowthBytes >= (options.nativeGrowthBytes ?? 128 * MB) && nativeGrowthBytesPerHour >= (options.nativeGrowthBytesPerHour ?? 256 * MB)) {
-        reason = "native-rss-growth";
-      }
-    }
-    const signalCaptureDue = reason !== void 0 && at - lastSignalCaptureAt >= cooldownMs;
-    const intervalCaptureDue = at - lastContinuousCaptureAt >= continuousCaptureMs;
-    const captureReason = signalCaptureDue ? reason : intervalCaptureDue ? "interval" : void 0;
-    if (enabled && captureReason && !captureInFlight) {
-      if (captureReason !== "interval") lastSignalCaptureAt = at;
-      lastContinuousCaptureAt = at;
-      captureInFlight = true;
-      diagnosis["memoryCaptureReason"] = captureReason;
-      capturePromise = writer.capture({
-        reason: captureReason,
-        capturedAt: new Date(at).toISOString(),
-        pid: process.pid,
-        sample,
-        stats,
-        diagnosis: { ...diagnosis },
-        observations: observations.map((observation) => ({ ...observation }))
-      }).catch(() => {
-      }).finally(() => {
-        captureInFlight = false;
-        capturePromise = void 0;
-      });
-    }
-    return diagnosis;
-  };
-  return {
-    artifactDir: writer.artifactDir,
-    observe,
-    stop: async () => {
-      await capturePromise;
-      await writer.stop();
-    }
-  };
-}
-
-// src/utils/heap-watchdog.ts
-var MB2 = 1024 * 1024;
-function defaultHeapLogPath() {
-  const override = process.env["WRONGSTACK_HEAP_LOG_PATH"]?.trim();
-  if (override) return path3.resolve(override);
-  return path3.join(wstackGlobalRoot(), "logs", "heap.jsonl");
-}
-function takeHeapSample() {
-  const m = process.memoryUsage();
-  const heap = v8.getHeapStatistics();
-  let spaces = [];
-  try {
-    spaces = v8.getHeapSpaceStatistics();
-  } catch {
-  }
-  const spaceUsed = (name) => spaces.find((space) => space.space_name === name)?.space_used_size ?? 0;
-  const limit = heap.heap_size_limit || 0;
-  let activeResources = 0;
-  let activeResourceTypes = "";
-  try {
-    const resources = process.getActiveResourcesInfo?.() ?? [];
-    activeResources = resources.length;
-    const counts = /* @__PURE__ */ new Map();
-    for (const resource of resources) counts.set(resource, (counts.get(resource) ?? 0) + 1);
-    activeResourceTypes = [...counts].sort(([left], [right]) => left.localeCompare(right)).map(([resource, count]) => `${resource}=${count}`).join(",");
-  } catch {
-  }
-  return {
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    rss: m.rss,
-    heapUsed: m.heapUsed,
-    heapTotal: m.heapTotal,
-    external: m.external,
-    arrayBuffers: m.arrayBuffers,
-    nativeResidual: Math.max(0, m.rss - m.heapTotal - m.external),
-    oldSpaceUsed: spaceUsed("old_space"),
-    newSpaceUsed: spaceUsed("new_space"),
-    largeObjectSpaceUsed: spaceUsed("large_object_space"),
-    codeSpaceUsed: spaceUsed("code_space"),
-    mallocedMemory: heap.malloced_memory,
-    peakMallocedMemory: heap.peak_malloced_memory,
-    nativeContexts: heap.number_of_native_contexts,
-    detachedContexts: heap.number_of_detached_contexts,
-    activeResources,
-    activeResourceTypes,
-    heapLimit: limit,
-    load: limit > 0 ? m.heapUsed / limit : 0
-  };
-}
-function startHeapWatchdog(opts = {}) {
-  const profileMode = process.env["WRONGSTACK_MEMORY_PROFILE"] === "1";
-  const sampleEveryMs = opts.sampleEveryMs ?? (profileMode ? 5e3 : 3e4);
-  const logEveryMs = opts.logEveryMs ?? (profileMode ? 5e3 : 6e4);
-  const logPath = opts.logPath ?? defaultHeapLogPath();
-  const warnAt = opts.warnAt ?? 0.6;
-  const criticalAt = opts.criticalAt ?? 0.85;
-  const REARM_MARGIN = 0.05;
-  let warnArmed = true;
-  let criticalArmed = true;
-  let lastLogAt = 0;
-  let writeInFlight = false;
-  let pendingLine;
-  let drainPromise;
-  let stopped = false;
-  let dirReady = false;
-  const flightRecorder = createMemoryFlightRecorder();
-  let gcMajorCount = 0;
-  let gcMinorCount = 0;
-  let gcIncrementalCount = 0;
-  let gcWeakCallbackCount = 0;
-  let gcDurationMs = 0;
-  let postGcHeapUsed = 0;
-  let postMajorGcHeapUsed = 0;
-  let lastGcAt = 0;
-  let lastMajorGcAt = 0;
-  const gcObserver = new PerformanceObserver((list) => {
-    for (const entry of list.getEntries()) {
-      const kind = entry.detail?.kind ?? 0;
-      if ((kind & performanceConstants.NODE_PERFORMANCE_GC_MAJOR) !== 0) gcMajorCount++;
-      if ((kind & performanceConstants.NODE_PERFORMANCE_GC_MINOR) !== 0) gcMinorCount++;
-      if ((kind & performanceConstants.NODE_PERFORMANCE_GC_INCREMENTAL) !== 0) {
-        gcIncrementalCount++;
-      }
-      if ((kind & performanceConstants.NODE_PERFORMANCE_GC_WEAKCB) !== 0) gcWeakCallbackCount++;
-      gcDurationMs += entry.duration;
-      postGcHeapUsed = process.memoryUsage().heapUsed;
-      if ((kind & performanceConstants.NODE_PERFORMANCE_GC_MAJOR) !== 0) {
-        postMajorGcHeapUsed = postGcHeapUsed;
-        lastMajorGcAt = Date.now();
-      }
-      lastGcAt = Date.now();
-    }
-  });
-  try {
-    gcObserver.observe({ entryTypes: ["gc"] });
-  } catch {
-  }
-  const collectRuntimeStats = () => ({
-    gcMajorCount,
-    gcMinorCount,
-    gcIncrementalCount,
-    gcWeakCallbackCount,
-    gcDurationMs: Math.round(gcDurationMs),
-    postGcHeapUsed,
-    postMajorGcHeapUsed,
-    lastGcAgoMs: lastGcAt > 0 ? Date.now() - lastGcAt : -1,
-    lastMajorGcAgoMs: lastMajorGcAt > 0 ? Date.now() - lastMajorGcAt : -1
-  });
-  const writeDiagnosticLine = opts.writeDiagnosticLine ?? (async (targetPath, line) => {
-    if (!dirReady) {
-      await fsp2.mkdir(path3.dirname(targetPath), { recursive: true });
-      dirReady = true;
-    }
-    await fsp2.appendFile(targetPath, `${line}
-`, { encoding: "utf8", mode: 384 });
-  });
-  const drainWrites = async (firstLine) => {
-    let line = firstLine;
-    while (line !== void 0) {
-      try {
-        await writeDiagnosticLine(logPath, line);
-      } catch {
-      }
-      line = pendingLine;
-      pendingLine = void 0;
-    }
-    writeInFlight = false;
-  };
-  const append = (line) => {
-    if (stopped) return;
-    if (writeInFlight) {
-      pendingLine = line;
-      return;
-    }
-    writeInFlight = true;
-    drainPromise = drainWrites(line);
-  };
-  const appendTerminalSample = (event, error, origin) => {
-    if (stopped) return;
-    let extras = {};
-    try {
-      extras = opts.collectStats?.() ?? {};
-    } catch {
-    }
-    try {
-      const sample = takeHeapSample();
-      const runtimeStats = collectRuntimeStats();
-      fs.mkdirSync(path3.dirname(logPath), { recursive: true });
-      fs.appendFileSync(
-        logPath,
-        `${JSON.stringify({
-          ...extras,
-          ...runtimeStats,
-          event,
-          ...origin ? { crashOrigin: origin } : {},
-          ...error instanceof Error ? { errorName: error.name, errorMessage: error.message.slice(0, 1e3) } : {},
-          pid: process.pid,
-          ...sample,
-          exitCode: process.exitCode
-        })}
-`,
-        "utf8"
-      );
-    } catch {
-    }
-  };
-  const onUncaughtException = (error, origin) => {
-    appendTerminalSample("memory.flight_recorder.crash", error, origin);
-  };
-  const onProcessExit = () => {
-    appendTerminalSample("memory.flight_recorder.exit");
-  };
-  process.on("uncaughtExceptionMonitor", onUncaughtException);
-  process.on("exit", onProcessExit);
-  const tick = () => {
-    let userTimings = 0;
-    try {
-      userTimings = performance.getEntriesByType("mark").length + performance.getEntriesByType("measure").length;
-      if (userTimings > 0) {
-        performance.clearMarks();
-        performance.clearMeasures();
-      }
-    } catch {
-    }
-    const s = takeHeapSample();
-    let extras = {};
-    try {
-      extras = opts.collectStats?.() ?? {};
-    } catch {
-    }
-    const runtimeStats = collectRuntimeStats();
-    const diagnosticStats = { ...extras, ...runtimeStats };
-    const memoryDiagnosis = flightRecorder.observe(s, diagnosticStats);
-    if (s.load >= criticalAt && criticalArmed) {
-      criticalArmed = false;
-      warnArmed = false;
-      opts.onWarn?.(
-        "critical",
-        `Heap critical: ${Math.round(s.heapUsed / MB2)} MB of ~${Math.round(s.heapLimit / MB2)} MB V8 limit (${Math.round(s.load * 100)}%). An out-of-memory crash is likely soon \u2014 finish/checkpoint work and restart the session. Diagnostics: ${logPath}`,
-        s
-      );
-    } else if (s.load >= warnAt && warnArmed) {
-      warnArmed = false;
-      opts.onWarn?.(
-        "warn",
-        `Heap high: ${Math.round(s.heapUsed / MB2)} MB of ~${Math.round(s.heapLimit / MB2)} MB V8 limit (${Math.round(s.load * 100)}%). Memory diagnostics are being recorded to ${logPath}`,
-        s
-      );
-    }
-    if (!warnArmed && s.load < warnAt - REARM_MARGIN) warnArmed = true;
-    if (!criticalArmed && s.load < criticalAt - REARM_MARGIN) criticalArmed = true;
-    const due = Date.now() - lastLogAt >= logEveryMs;
-    const crossed = s.load >= warnAt;
-    const captured = typeof memoryDiagnosis["memoryCaptureReason"] === "string";
-    if (due || crossed || captured) {
-      lastLogAt = Date.now();
-      append(
-        JSON.stringify({
-          ...extras,
-          ...runtimeStats,
-          ...memoryDiagnosis,
-          pid: process.pid,
-          ...s,
-          userTimings
-        })
-      );
-    }
-  };
-  const timer = setInterval(tick, sampleEveryMs);
-  timer.unref?.();
-  tick();
-  return async () => {
-    stopped = true;
-    clearInterval(timer);
-    gcObserver.disconnect();
-    process.removeListener("uncaughtExceptionMonitor", onUncaughtException);
-    process.removeListener("exit", onProcessExit);
-    await drainPromise;
-    await flightRecorder.stop();
-  };
-}
-var sharedContributors = /* @__PURE__ */ new Map();
-var nextSharedContributorId = 1;
-var sharedSamplerActive = false;
-var stopSharedSampler;
-function collectSharedStats() {
-  const merged = {};
-  for (const contributor of sharedContributors.values()) {
-    try {
-      Object.assign(merged, contributor.collectStats?.() ?? {});
-    } catch {
-    }
-  }
-  return merged;
-}
-function warnSharedContributors(level, message, sample) {
-  for (const contributor of sharedContributors.values()) {
-    try {
-      contributor.onWarn?.(level, message, sample);
-    } catch {
-    }
-  }
-}
-function startSharedHeapWatchdog(opts = {}) {
-  if (process.env["NODE_ENV"] === "test" && !sharedSamplerActive && opts.logPath === void 0 && opts.writeDiagnosticLine === void 0) {
-    return async () => void 0;
-  }
-  const id = nextSharedContributorId++;
-  sharedContributors.set(id, {
-    collectStats: opts.collectStats,
-    onWarn: opts.onWarn
-  });
-  if (!sharedSamplerActive) {
-    sharedSamplerActive = true;
-    stopSharedSampler = startHeapWatchdog({
-      ...opts,
-      collectStats: collectSharedStats,
-      onWarn: warnSharedContributors
-    });
-  }
-  let stopped = false;
-  return async () => {
-    if (stopped) return;
-    stopped = true;
-    sharedContributors.delete(id);
-    if (sharedContributors.size > 0 || !sharedSamplerActive) return;
-    const stop2 = stopSharedSampler;
-    if (!stop2) return;
-    sharedSamplerActive = false;
-    stopSharedSampler = void 0;
-    await stop2();
-  };
-}
-
-// src/utils/perf-profile.ts
-var daemonDefaults = false;
-function useDaemonPerfDefaults() {
-  daemonDefaults = true;
-}
-
-// src/coordination/mailbox-credential-store.ts
-import * as crypto from "node:crypto";
-var CREDENTIAL_STORE_FILE = "_mailbox_credentials.json";
-var MAX_CREDENTIAL_TTL = {
-  agent: 7 * 24 * 60 * 60 * 1e3,
-  // 7 days
-  operator: 24 * 60 * 60 * 1e3,
-  // 24 hours
-  service: 30 * 24 * 60 * 60 * 1e3
-  // 30 days
-};
-var ROTATION_OVERLAP_MS = 60 * 60 * 1e3;
-function createMailboxCredential(opts, now = Date.now()) {
-  const ttlMs = Math.min(opts.ttlMs, MAX_CREDENTIAL_TTL[opts.kind]);
-  const credentialId = crypto.randomUUID();
-  const secret = crypto.randomBytes(32).toString("hex");
-  const verifierKey = crypto.createHash("sha256").update(secret).digest();
-  const verifier = crypto.createHmac("sha256", verifierKey).update(credentialId).digest("hex");
-  return {
-    credential: {
-      credentialId,
-      verifier,
-      verifierAlgorithm: "hmac-sha256",
-      principalId: opts.principalId,
-      projectId: opts.projectId,
-      capabilities: opts.capabilities,
-      kind: opts.kind,
-      issuedAt: new Date(now).toISOString(),
-      expiresAt: new Date(now + ttlMs).toISOString(),
-      notBefore: opts.notBefore?.toISOString(),
-      status: "active",
-      statusChangedAt: new Date(now).toISOString(),
-      supersedes: opts.supersedes,
-      lastModifiedBy: opts.issuedBy
-    },
-    secret
-  };
-}
-function redactMailboxCredential(credential) {
-  const { verifier: _verifier, verifierAlgorithm: _algorithm, ...rest } = credential;
-  return rest;
-}
-function verifyMailboxCredential(credential, secret, now = Date.now()) {
-  if (credential === void 0) {
-    return { valid: false, reason: "credential not found" };
-  }
-  const rotationStillValid = credential.status === "rotated_out" && credential.rotationValidUntil !== void 0 && new Date(credential.rotationValidUntil).getTime() >= now;
-  if (credential.status !== "active" && !rotationStillValid) {
-    return { valid: false, reason: `credential is ${credential.status}`, credential };
-  }
-  if (new Date(credential.expiresAt).getTime() <= now) {
-    return { valid: false, reason: "credential expired", credential };
-  }
-  if (credential.notBefore !== void 0 && new Date(credential.notBefore).getTime() > now) {
-    return { valid: false, reason: "credential not yet valid", credential };
-  }
-  const verifierKey = crypto.createHash("sha256").update(secret).digest();
-  const expected = crypto.createHmac("sha256", verifierKey).update(credential.credentialId).digest("hex");
-  const actualBytes = Buffer.from(credential.verifier, "hex");
-  const expectedBytes = Buffer.from(expected, "hex");
-  if (actualBytes.length !== expectedBytes.length || !crypto.timingSafeEqual(actualBytes, expectedBytes)) {
-    return { valid: false, reason: "invalid secret" };
-  }
-  return { valid: true, credential };
-}
-
-// src/coordination/mailbox-events.ts
-var MailboxEventEmitter = class {
-  listeners = /* @__PURE__ */ new Set();
-  subscribe(fn) {
-    this.listeners.add(fn);
-    return () => {
-      this.listeners.delete(fn);
-    };
-  }
-  emit(event) {
-    const snapshot = [...this.listeners];
-    for (const fn of snapshot) {
-      try {
-        fn(event);
-      } catch {
-      }
-    }
-  }
-  /** Number of active subscribers (for observability / metrics). */
-  get subscriberCount() {
-    return this.listeners.size;
-  }
-  clear() {
-    this.listeners.clear();
-  }
-};
-
-// src/coordination/mailbox-project-server-endpoint.ts
-import { createHash as createHash2 } from "node:crypto";
-import * as os2 from "node:os";
-import * as path4 from "node:path";
-
-// src/coordination/mailbox-project-server-protocol.ts
-var MAILBOX_PROJECT_SERVER_PROTOCOL_VERSION = 4;
-var MAILBOX_PROJECT_SERVER_MAX_FRAME_CHARS = 16 * 1024 * 1024;
-var MAILBOX_SERVER_OPERATION_NAMES = {
-  ping: true,
-  send: true,
-  sendRuntimeControl: true,
-  query: true,
-  ack: true,
-  ackMany: true,
-  unreadCount: true,
-  softDelete: true,
-  restore: true,
-  registerAgent: true,
-  deregisterAgent: true,
-  heartbeat: true,
-  getAgentStatuses: true,
-  getOnlineAgents: true,
-  purgeAgents: true,
-  registerClient: true,
-  deregisterClient: true,
-  clientHeartbeat: true,
-  getClientStatuses: true,
-  purgeClients: true,
-  clearAll: true,
-  purgeStale: true,
-  autoCompact: true,
-  credentialIssue: true,
-  credentialVerify: true,
-  credentialRevoke: true,
-  credentialRotate: true,
-  credentialGet: true,
-  credentialList: true,
-  credentialStatusCounts: true
-};
-function isRequestId(value) {
-  return Number.isSafeInteger(value) && value >= 0;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasString(record, key) {
-  return typeof record[key] === "string" && record[key].length > 0;
-}
-function hasRecord(record, key) {
-  return isRecord(record[key]);
-}
-function isMailboxServerOperationArgs(op, value) {
-  if (!isRecord(value)) return false;
-  switch (op) {
-    case "ping":
-    case "getAgentStatuses":
-    case "getOnlineAgents":
-    case "getClientStatuses":
-    case "purgeClients":
-    case "clearAll":
-    case "credentialList":
-    case "credentialStatusCounts":
-      return true;
-    case "send":
-    case "sendRuntimeControl":
-    case "ack":
-    case "ackMany":
-    case "registerAgent":
-    case "heartbeat":
-    case "registerClient":
-    case "clientHeartbeat":
-      return hasRecord(value, "input");
-    case "query":
-      return hasRecord(value, "query");
-    case "unreadCount":
-      return hasString(value, "forAgentId");
-    case "softDelete":
-      return hasString(value, "mailId") && hasString(value, "by");
-    case "restore":
-      return hasString(value, "mailId");
-    case "deregisterAgent":
-      return hasString(value, "agentId");
-    case "purgeAgents":
-    case "purgeStale":
-    case "autoCompact":
-      return true;
-    case "deregisterClient":
-      return hasString(value, "clientId");
-    case "credentialIssue":
-      return hasRecord(value, "options");
-    case "credentialVerify":
-      return hasString(value, "credentialId") && hasString(value, "secret");
-    case "credentialRevoke":
-    case "credentialRotate":
-    case "credentialGet":
-      return hasString(value, "credentialId");
-  }
-}
-function isMailboxProjectServerClientMessage(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const message = value;
-  if (message["type"] === "heartbeat") return true;
-  if (message["type"] === "shutdown") {
-    return isRequestId(message["id"]) && (message["reason"] === void 0 || typeof message["reason"] === "string");
-  }
-  if (message["type"] !== "request" || !isRequestId(message["id"])) return false;
-  const op = message["op"];
-  return typeof op === "string" && Object.hasOwn(MAILBOX_SERVER_OPERATION_NAMES, op) && isMailboxServerOperationArgs(op, message["args"]);
-}
-function encodeMailboxProjectServerMessage(message) {
-  return `${JSON.stringify(message)}
-`;
-}
-
-// src/coordination/mailbox-project-server-endpoint.ts
-var MAILBOX_PROJECT_SERVER_METADATA_FILE = ".mailbox-server.json";
-function normalizeLocalPath(value) {
-  const resolved = path4.resolve(value);
-  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-function mailboxProjectServerKey(projectDir2) {
-  return createHash2("sha256").update(normalizeLocalPath(projectDir2)).digest("hex").slice(0, 24);
-}
-function mailboxProjectServerEndpoint(projectDir2) {
-  const key = mailboxProjectServerKey(projectDir2);
-  if (process.platform === "win32") {
-    return `\\\\.\\pipe\\wrongstack-mailbox-v${MAILBOX_PROJECT_SERVER_PROTOCOL_VERSION}-${key}`;
-  }
-  return path4.join(
-    os2.tmpdir(),
-    `wsmb-v${MAILBOX_PROJECT_SERVER_PROTOCOL_VERSION}`,
-    `${key}.sock`
-  );
-}
-function mailboxProjectServerMetadataPath(projectDir2) {
-  return path4.join(path4.resolve(projectDir2), MAILBOX_PROJECT_SERVER_METADATA_FILE);
-}
-
-// src/coordination/sqlite-mailbox.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import * as fs3 from "node:fs";
-import * as path6 from "node:path";
-
-// src/coordination/global-mailbox-completion.ts
-function isMailboxMessageProjection(msg) {
-  if (!("recipientState" in msg)) return false;
-  const recipientState = msg.recipientState;
-  return typeof recipientState === "object" && recipientState !== null && !Array.isArray(recipientState);
-}
-function isMessageCompletedForActor(msg, actorId) {
-  if (!isMailboxMessageProjection(msg)) return msg.completed === true;
-  if (msg.legacyGlobalCompletion) return true;
-  if (actorId !== void 0) {
-    const state = msg.recipientState[actorId];
-    if (state !== void 0) return state.completedAt !== void 0;
-    if (Object.keys(msg.recipientState).length > 0) return false;
-  }
-  return msg.completed === true;
-}
-
-// src/coordination/mailbox-constants.ts
-var AGENT_STALE_MS = 6e4;
-var CLIENT_STALE_MS = 6e4;
-var HEARTBEAT_THROTTLE_MS = 5e3;
-var LINE_SEPARATOR = "\n";
-var AUTO_COMPACT_INTERVAL_MS = 3e5;
-var AUTO_COMPACT_READ_MAX_AGE_MS = 6e5;
-var AUTO_COMPACT_DEFAULT_TTL_MS = 864e5;
-var AUTO_COMPACT_TYPE_TTL_MS = {
-  status: 18e5
-  // 30 min
-};
-
-// src/coordination/mailbox-predicates.ts
-function mailboxIdentityBase(agentId) {
-  return agentId.split(/[@#]/, 1)[0].trim().toLowerCase();
-}
-function isMailboxLeader(agentId, role) {
-  return mailboxIdentityBase(agentId) === "leader" || role?.trim().toLowerCase() === "leader";
-}
-function isMailboxMessageVisibleTo(message, agentId, role) {
-  return message.audience !== "leaders" || isMailboxLeader(agentId, role);
-}
-function validateSendType(type, to) {
-  if (type === "control") {
-    throw new TypeError('Type "control" is reserved for runtime use and cannot be set by agents');
-  }
-  const isMultiRecipient = to === "*" || to.startsWith("@session:");
-  if (type === "assign" && isMultiRecipient) {
-    throw new TypeError(
-      `Type "assign" requires a specific recipient \u2014 multi-recipient target "${to}" is ambiguous`
-    );
-  }
-  if (type === "steer" && isMultiRecipient) {
-    throw new TypeError(
-      `Type "steer" requires a specific recipient \u2014 multi-recipient target "${to}" is ambiguous`
-    );
-  }
-}
-var SESSION_RECIPIENT_PREFIX = "@session:";
-function sessionRecipient(sessionId) {
-  const normalizedSessionId = sessionId.trim();
-  if (!normalizedSessionId) {
-    throw new TypeError('sessionId is required for the "@session" recipient');
-  }
-  return `${SESSION_RECIPIENT_PREFIX}${normalizedSessionId}`;
-}
-function normalizeRecipient(to, sessionId) {
-  const trimmed = to.trim();
-  const normalized = trimmed.toLowerCase();
-  if (normalized === "all") return "*";
-  if (normalized === "@session") return sessionRecipient(sessionId ?? "");
-  return trimmed;
-}
-function isMailboxReceiptRecordV2(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const v = value;
-  if (v["__mailboxReceipt"] !== 2) return false;
-  if (typeof v["messageId"] !== "string" || v["messageId"].length === 0) return false;
-  if (typeof v["actorId"] !== "string" || v["actorId"].length === 0) return false;
-  if (typeof v["timestamp"] !== "string" || v["timestamp"].length === 0) return false;
-  if ("read" in v && typeof v["read"] !== "boolean") return false;
-  if ("completed" in v && typeof v["completed"] !== "boolean") return false;
-  if ("outcome" in v && v["outcome"] !== void 0 && typeof v["outcome"] !== "string")
-    return false;
-  return true;
-}
-
-// src/coordination/mailbox-session-sync.ts
-function isAffectedBySessionAffinity(message) {
-  return message.sessionAffinity !== void 0;
-}
-async function acceptMailboxMessageForSession(message, currentSessionId, ctx) {
-  if (!isAffectedBySessionAffinity(message)) return true;
-  const affinity = message.sessionAffinity;
-  if (affinity === null || typeof affinity !== "object" || Array.isArray(affinity)) {
-    return false;
-  }
-  if (affinity.sessionId !== void 0 && typeof affinity.sessionId !== "string" || affinity.reportId !== void 0 && typeof affinity.reportId !== "string") {
-    return false;
-  }
-  if (!currentSessionId) {
-    return ctx?.allowUnscoped === true;
-  }
-  if (typeof affinity.sessionId === "string" && affinity.sessionId.length > 0) {
-    if (affinity.sessionId !== currentSessionId) return false;
-    return true;
-  }
-  if (affinity.reportId && ctx?.resolveChimeraReportSessionId) {
-    try {
-      const resolved = await ctx.resolveChimeraReportSessionId(affinity.reportId);
-      if (resolved === currentSessionId) return true;
-      if (resolved !== void 0) return false;
-    } catch {
-    }
-  }
-  if (ctx?.allowUnscoped === true) return true;
-  return false;
-}
-
-// src/coordination/mailbox-message-codec.ts
-var MESSAGE_TYPES = /* @__PURE__ */ new Set([
-  "note",
-  "ask",
-  "assign",
-  "steer",
-  "btw",
-  "broadcast",
-  "status",
-  "result",
-  "review",
-  "control"
-]);
-var PRIORITIES = /* @__PURE__ */ new Set(["low", "normal", "high"]);
-var AUDIENCES = /* @__PURE__ */ new Set(["all", "leaders"]);
-var TASK_STATUSES = /* @__PURE__ */ new Set([
-  "pending",
-  "in_progress",
-  "completed",
-  "failed",
-  "idle",
-  "running",
-  "streaming",
-  "waiting_user",
-  "error",
-  "offline",
-  "busy"
-]);
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function requiredString(record, key) {
-  const value = record[key];
-  if (typeof value !== "string") {
-    throw new TypeError(`mailbox message field "${key}" must be a string`);
-  }
-  return value;
-}
-function optionalString(record, key) {
-  const value = record[key];
-  if (value === void 0) return {};
-  if (typeof value !== "string") {
-    throw new TypeError(`mailbox message field "${key}" must be a string when present`);
-  }
-  return { [key]: value };
-}
-function parseMessageType(value) {
-  if (value === "info") return "note";
-  if (value === "task") return "assign";
-  if (typeof value === "string" && MESSAGE_TYPES.has(value)) {
-    return value;
-  }
-  throw new TypeError('mailbox message field "type" is invalid');
-}
-function normalizeMailboxMessageType(value) {
-  return parseMessageType(value);
-}
-function parsePriority(value) {
-  if (typeof value === "string" && PRIORITIES.has(value)) {
-    return value;
-  }
-  if (typeof value === "string") return "normal";
-  throw new TypeError('mailbox message field "priority" must be a string');
-}
-function parseAudience(value) {
-  if (value === void 0 || value === "all") return void 0;
-  if (typeof value === "string" && AUDIENCES.has(value)) {
-    return value;
-  }
-  throw new TypeError('mailbox message field "audience" is invalid');
-}
-function parseReadReceipts(record, to) {
-  const value = record["readBy"];
-  if (value === void 0) {
-    const legacyReadAt = record["readAt"];
-    return record["read"] === true && typeof legacyReadAt === "string" ? { [to || "unknown"]: legacyReadAt } : {};
-  }
-  if (!isRecord2(value)) {
-    throw new TypeError('mailbox message field "readBy" must be an object');
-  }
-  const receipts = {};
-  for (const [agentId, timestamp] of Object.entries(value)) {
-    if (typeof timestamp !== "string") {
-      throw new TypeError("mailbox message read receipt timestamps must be strings");
-    }
-    receipts[agentId] = timestamp;
-  }
-  return receipts;
-}
-function parseTaskContext(value) {
-  if (value === void 0) return void 0;
-  if (!isRecord2(value)) {
-    throw new TypeError('mailbox message field "taskContext" must be an object');
-  }
-  const status = value["status"];
-  if (status !== void 0 && (typeof status !== "string" || !TASK_STATUSES.has(status))) {
-    throw new TypeError("mailbox message taskContext status is invalid");
-  }
-  return {
-    ...optionalString(value, "agentRole"),
-    ...optionalString(value, "agentName"),
-    ...optionalString(value, "taskId"),
-    ...status === void 0 ? {} : { status }
-  };
-}
-function parseSessionAffinity(value) {
-  if (value === void 0) return void 0;
-  if (!isRecord2(value)) {
-    throw new TypeError('mailbox message field "sessionAffinity" must be an object');
-  }
-  const sessionId = value["sessionId"];
-  const reportId = value["reportId"];
-  const kind = optionalString(value, "kind");
-  if (sessionId !== void 0) {
-    if (typeof sessionId !== "string" || sessionId.length === 0) {
-      throw new TypeError("mailbox message sessionAffinity.sessionId must be a non-empty string");
-    }
-    return {
-      sessionId,
-      ...optionalString(value, "reportId"),
-      ...kind
-    };
-  }
-  if (typeof reportId !== "string" || reportId.length === 0) {
-    throw new TypeError(
-      "mailbox message sessionAffinity.reportId must be a non-empty string when sessionId is absent"
-    );
-  }
-  return {
-    reportId,
-    ...kind
-  };
-}
-function parseMailboxMessage(value) {
-  if (!isRecord2(value)) throw new TypeError("mailbox message must be an object");
-  const to = value["to"] === void 0 ? "" : requiredString(value, "to");
-  const completed = value["completed"];
-  if (typeof completed !== "boolean") {
-    throw new TypeError('mailbox message field "completed" must be a boolean');
-  }
-  const taskContext = parseTaskContext(value["taskContext"]);
-  const audience = parseAudience(value["audience"]);
-  const sessionAffinity = parseSessionAffinity(value["sessionAffinity"]);
-  return {
-    id: requiredString(value, "id"),
-    from: requiredString(value, "from"),
-    to,
-    type: parseMessageType(value["type"]),
-    ...audience === void 0 ? {} : { audience },
-    subject: requiredString(value, "subject"),
-    body: requiredString(value, "body"),
-    priority: parsePriority(value["priority"]),
-    readBy: parseReadReceipts(value, to),
-    completed,
-    timestamp: requiredString(value, "timestamp"),
-    ...optionalString(value, "completedBy"),
-    ...optionalString(value, "outcome"),
-    ...optionalString(value, "completedAt"),
-    ...optionalString(value, "deletedAt"),
-    ...optionalString(value, "deletedBy"),
-    ...optionalString(value, "replyTo"),
-    ...optionalString(value, "senderSessionId"),
-    ...optionalString(value, "expiresAt"),
-    ...taskContext === void 0 ? {} : { taskContext },
-    ...sessionAffinity === void 0 ? {} : { sessionAffinity }
-  };
-}
-function isAckRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && value["__ack"] === true;
-}
-function applyAckToMessage(msg, ack) {
-  if (ack.read && !(ack.readerId in msg.readBy)) {
-    msg.readBy[ack.readerId] = ack.timestamp;
-  }
-  if (ack.completed && !msg.completed) {
-    msg.completed = true;
-    msg.completedBy = ack.completedBy ?? ack.readerId;
-    msg.completedAt = ack.timestamp;
-  }
-  if (ack.outcome !== void 0 && msg.outcome !== ack.outcome) {
-    msg.outcome = ack.outcome;
-  }
-  if (ack.deleted === true) {
-    msg.deletedAt = ack.timestamp;
-    msg.deletedBy = ack.deletedBy ?? ack.readerId;
-  }
-  if (ack.deleted === false) {
-    delete msg.deletedAt;
-    delete msg.deletedBy;
-  }
-}
-
-// src/coordination/mailbox-receipt-folding.ts
-function isFanOutRecipient(to) {
-  if (to === "*") return true;
-  if (to.startsWith("@session:")) return true;
-  return !to.includes("@") && !to.includes("#");
-}
-function materializeMessage(msg, msgReceipts) {
-  const recipientState = foldRecipientState(msg, msgReceipts);
-  const legacyGlobalCompletion = classifyLegacyCompletion(msg, msgReceipts);
-  return {
-    ...msg,
-    recipientState,
-    ...legacyGlobalCompletion ? { legacyGlobalCompletion: true } : {}
-  };
-}
-function foldRecipientState(msg, v2Receipts) {
-  const state = {};
-  for (const [actorId, readAt] of Object.entries(msg.readBy)) {
-    state[actorId] = { actorId, readAt };
-  }
-  if (msg.completed && msg.completedBy && !isFanOutRecipient(msg.to)) {
-    const existing = state[msg.completedBy] ?? { actorId: msg.completedBy };
-    state[msg.completedBy] = {
-      ...existing,
-      completedAt: msg.completedAt ?? msg.timestamp,
-      completedBy: msg.completedBy,
-      ...msg.outcome !== void 0 ? { outcome: msg.outcome } : {}
-    };
-  }
-  const sorted = [...v2Receipts].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-  for (const receipt of sorted) {
-    const actorId = receipt.actorId;
-    const existing = state[actorId] ?? { actorId };
-    const readAt = existing.readAt ?? (receipt.read === true ? receipt.timestamp : void 0);
-    let completedAt = existing.completedAt;
-    let completedBy = existing.completedBy;
-    if (receipt.completed === true) {
-      completedAt = receipt.timestamp;
-      completedBy = actorId;
-    } else if (receipt.completed === false) {
-      completedAt = void 0;
-      completedBy = void 0;
-    }
-    const outcome = receipt.outcome !== void 0 ? receipt.outcome : existing.outcome;
-    state[actorId] = { actorId, readAt, completedAt, completedBy, outcome };
-  }
-  return state;
-}
-function classifyLegacyCompletion(msg, v2Receipts) {
-  if (!msg.completed) return false;
-  if (v2Receipts.some((r) => r.completed === true)) return false;
-  return isFanOutRecipient(msg.to);
-}
-
-// src/coordination/mailbox-retention-state.ts
-function resolveMailboxRetentionState(message, agentStatuses) {
-  const projection = message;
-  if (projection.legacyGlobalCompletion) {
-    return { completed: true, completedAt: message.completedAt ?? message.timestamp };
-  }
-  const recipientState = projection.recipientState;
-  if (recipientState === void 0) {
-    return message.completed ? { completed: true, completedAt: message.completedAt ?? message.timestamp } : { completed: false };
-  }
-  const relevantRecipients = resolveRelevantRecipients(message, recipientState, agentStatuses);
-  if (relevantRecipients.length === 0) return { completed: false };
-  const completionTimes = [];
-  for (const actorId of relevantRecipients) {
-    const completedAt = recipientState[actorId]?.completedAt;
-    if (completedAt === void 0) return { completed: false };
-    completionTimes.push(completedAt);
-  }
-  return {
-    completed: true,
-    // Retention starts only after the last intended recipient completed.
-    completedAt: completionTimes.reduce((latest, time) => time > latest ? time : latest)
-  };
-}
-function projectMailboxCompletion(message, actorId, agentStatuses) {
-  const projection = message;
-  let state;
-  if (actorId === void 0) {
-    state = resolveMailboxRetentionState(message, agentStatuses);
-  } else if (projection.legacyGlobalCompletion) {
-    state = { completed: true, completedAt: message.completedAt ?? message.timestamp };
-  } else if (projection.recipientState !== void 0) {
-    const completedAt = projection.recipientState[actorId]?.completedAt;
-    state = completedAt === void 0 ? { completed: false } : { completed: true, completedAt };
-  } else {
-    state = message.completed ? { completed: true, completedAt: message.completedAt ?? message.timestamp } : { completed: false };
-  }
-  const result = {
-    ...projection,
-    completed: state.completed,
-    readBy: { ...message.readBy }
-  };
-  if (state.completedAt === void 0) delete result.completedAt;
-  else result.completedAt = state.completedAt;
-  return result;
-}
-function resolveRelevantRecipients(message, recipientState, agentStatuses) {
-  const statuses = agentStatuses ?? [];
-  const receiptActors = Object.keys(recipientState);
-  if (message.to === "*") {
-    if (statuses.length === 0) return [];
-    const registeredRecipients = statuses.filter((status) => isMailboxMessageVisibleTo(message, status.agentId, status.role)).map((status) => status.agentId);
-    return [.../* @__PURE__ */ new Set([...registeredRecipients, ...receiptActors])];
-  }
-  if (message.to.startsWith("@session:")) {
-    if (statuses.length === 0) return [];
-    const sessionId = message.to.slice("@session:".length);
-    const registeredRecipients = statuses.filter(
-      (status) => status.sessionId === sessionId && isMailboxMessageVisibleTo(message, status.agentId, status.role)
-    ).map((status) => status.agentId);
-    return [.../* @__PURE__ */ new Set([...registeredRecipients, ...receiptActors])];
-  }
-  if (message.to.includes("@")) return [message.to];
-  if (statuses.length === 0) return [];
-  const aliasRecipients = statuses.filter(
-    (status) => (status.role?.toLowerCase() === message.to.toLowerCase() || mailboxIdentityBase(status.agentId) === message.to.toLowerCase()) && isMailboxMessageVisibleTo(message, status.agentId, status.role)
-  ).map((status) => status.agentId);
-  return [.../* @__PURE__ */ new Set([...aliasRecipients, ...receiptActors])];
-}
-
-// src/coordination/mailbox-status-mappers.ts
-function mapRegisteredAgentsToStatuses(registry, now, staleMs) {
-  return Array.from(registry.values()).map((agent) => ({
-    agentId: agent.agentId,
-    name: agent.name,
-    role: agent.role,
-    sessionId: agent.sessionId,
-    status: agent.status,
-    currentTool: agent.currentTool,
-    currentTask: agent.currentTask,
-    iterations: agent.iterations,
-    toolCalls: agent.toolCalls,
-    lastActivityAt: agent.lastSeenAt,
-    lastSeenAt: agent.lastSeenAt,
-    online: now - new Date(agent.lastSeenAt).getTime() < staleMs,
-    pid: agent.pid,
-    source: agent.source
-  })).sort((a, b) => b.lastSeenAt.localeCompare(a.lastSeenAt));
-}
-function mapRegisteredClientsToStatuses(registry, now, staleMs) {
-  return Array.from(registry.values()).map((client) => ({
-    clientId: client.clientId,
-    name: client.name,
-    source: client.source,
-    sessionId: client.sessionId,
-    lastSeenAt: client.lastSeenAt,
-    online: now - new Date(client.lastSeenAt).getTime() < staleMs,
-    pid: client.pid
-  })).sort((a, b) => b.lastSeenAt.localeCompare(a.lastSeenAt));
-}
-
-// src/coordination/sqlite-mailbox-compaction.ts
-async function purgeStale(ctx, options) {
-  const completedMaxAgeMs = options?.completedMaxAgeMs ?? 864e5;
-  const incompleteMaxAgeMs = options?.incompleteMaxAgeMs ?? 6048e5;
-  const statuses = await ctx.getAgentStatuses();
-  const now = Date.now();
-  let completedPurged = 0;
-  let incompletePurged = 0;
-  const ids = [];
-  const messages = ctx.readMessages();
-  for (const message of messages) {
-    const retention = resolveMailboxRetentionState(message, statuses);
-    const messageTime = new Date(message.timestamp).getTime();
-    const completionTime = new Date(retention.completedAt ?? 0).getTime();
-    if (retention.completed && completionTime < now - completedMaxAgeMs) {
-      completedPurged++;
-      ids.push(message.id);
-    } else if (!retention.completed && messageTime < now - incompleteMaxAgeMs) {
-      incompletePurged++;
-      ids.push(message.id);
-    }
-  }
-  ctx.deleteMessages(ids);
-  return {
-    completedPurged,
-    incompletePurged,
-    totalPurged: ids.length,
-    remaining: messages.length - ids.length
-  };
-}
-async function autoCompact(ctx, options) {
-  const readMaxAgeMs = options?.readMaxAgeMs ?? AUTO_COMPACT_READ_MAX_AGE_MS;
-  const defaultTtlMs = options?.defaultTtlMs ?? AUTO_COMPACT_DEFAULT_TTL_MS;
-  const typeTtlMs = options?.typeTtlMs ?? AUTO_COMPACT_TYPE_TTL_MS;
-  const completedMaxAgeMs = options?.completedMaxAgeMs ?? 864e5;
-  const incompleteMaxAgeMs = options?.incompleteMaxAgeMs ?? 6048e5;
-  const statuses = await ctx.getAgentStatuses();
-  const online = statuses.filter((status) => status.online);
-  const now = Date.now();
-  let readByAllRemoved = 0;
-  let expiredRemoved = 0;
-  let stalePurged = 0;
-  const ids = [];
-  const messages = ctx.readMessages();
-  for (const message of messages) {
-    const messageTime = new Date(message.timestamp).getTime();
-    const expiry = message.expiresAt !== void 0 ? new Date(message.expiresAt).getTime() : messageTime + (typeTtlMs[message.type] ?? defaultTtlMs);
-    if (expiry < now) {
-      expiredRemoved++;
-      ids.push(message.id);
-      continue;
-    }
-    const retention = resolveMailboxRetentionState(message, statuses);
-    const eligible = online.filter(
-      (status) => isMailboxMessageVisibleTo(message, status.agentId, status.role)
-    );
-    if (!retention.completed && eligible.length > 0) {
-      const readByAll = eligible.every((status) => status.agentId in message.readBy);
-      const latestRead = Math.max(
-        ...eligible.map((status) => new Date(message.readBy[status.agentId] ?? 0).getTime())
-      );
-      if (readByAll && latestRead < now - readMaxAgeMs) {
-        readByAllRemoved++;
-        ids.push(message.id);
-        continue;
-      }
-    }
-    const completionTime = new Date(retention.completedAt ?? 0).getTime();
-    if (retention.completed && completionTime < now - completedMaxAgeMs || !retention.completed && messageTime < now - incompleteMaxAgeMs) {
-      stalePurged++;
-      ids.push(message.id);
-    }
-  }
-  ctx.deleteMessages(ids);
-  return {
-    readByAllRemoved,
-    expiredRemoved,
-    stalePurged,
-    totalRemoved: ids.length,
-    remaining: messages.length - ids.length
-  };
-}
-
-// src/coordination/mailbox-credential-throttle.ts
-var CREDENTIAL_VERIFY_MAX_FAILURES = 10;
-var CREDENTIAL_VERIFY_WINDOW_MS = 6e4;
-var CREDENTIAL_VERIFY_COOLDOWN_MS = 6e4;
-var MAX_TRACKED_IDS = 4096;
-var CredentialVerifyThrottle = class {
-  constructor(maxFailures = CREDENTIAL_VERIFY_MAX_FAILURES, windowMs = CREDENTIAL_VERIFY_WINDOW_MS, cooldownMs = CREDENTIAL_VERIFY_COOLDOWN_MS) {
-    this.maxFailures = maxFailures;
-    this.windowMs = windowMs;
-    this.cooldownMs = cooldownMs;
-  }
-  maxFailures;
-  windowMs;
-  cooldownMs;
-  records = /* @__PURE__ */ new Map();
-  /** Is this credential id allowed another attempt right now? */
-  check(credentialId, now = Date.now()) {
-    const record = this.records.get(credentialId);
-    if (record === void 0) return { allowed: true, retryAfterMs: 0 };
-    if (record.blockedUntil > now) {
-      return { allowed: false, retryAfterMs: record.blockedUntil - now };
-    }
-    return { allowed: true, retryAfterMs: 0 };
-  }
-  /** Record a failed verification. Starts the cooldown once the limit is hit. */
-  recordFailure(credentialId, now = Date.now()) {
-    const record = this.records.get(credentialId);
-    if (record === void 0 || now - record.windowStartedAt > this.windowMs) {
-      this.evictIfFull();
-      this.records.set(credentialId, { failures: 1, windowStartedAt: now, blockedUntil: 0 });
-      return;
-    }
-    record.failures += 1;
-    if (record.failures >= this.maxFailures) {
-      record.blockedUntil = now + this.cooldownMs;
-      record.failures = 0;
-      record.windowStartedAt = now;
-    }
-  }
-  /**
-   * Clear the counter after a successful verification. A legitimate holder who
-   * fluffed a few attempts is not left in a cooldown they cannot exit.
-   */
-  recordSuccess(credentialId) {
-    this.records.delete(credentialId);
-  }
-  /** Test seam. */
-  reset() {
-    this.records.clear();
-  }
-  evictIfFull() {
-    if (this.records.size < MAX_TRACKED_IDS) return;
-    const oldest = this.records.keys().next();
-    if (!oldest.done) this.records.delete(oldest.value);
-  }
-};
-var credentialVerifyThrottle = new CredentialVerifyThrottle();
-
-// src/coordination/sqlite-mailbox-rows.ts
-var MALFORMED_TIMESTAMP = "last_seen_at NOT GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T*'";
-function withoutAggregateCompletion(message) {
-  const stored = {
-    ...message,
-    completed: message.legacyGlobalCompletion === true
-  };
-  if (!stored.completed) {
-    delete stored.completedBy;
-    delete stored.completedAt;
-  }
-  delete stored.outcome;
-  return stored;
-}
-function persistMessage(db, message, legacyGlobalCompletion = false) {
-  const stored = { ...message, readBy: { ...message.readBy } };
-  delete stored.recipientState;
-  delete stored.legacyGlobalCompletion;
-  db.prepare(`
-      INSERT INTO messages(
-        id, from_id, to_id, type, priority, timestamp, completed, completed_at,
-        deleted_at, sender_session_id, reply_to, expires_at,
-        legacy_global_completion, data
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        from_id = excluded.from_id,
-        to_id = excluded.to_id,
-        type = excluded.type,
-        priority = excluded.priority,
-        timestamp = excluded.timestamp,
-        completed = excluded.completed,
-        completed_at = excluded.completed_at,
-        deleted_at = excluded.deleted_at,
-        sender_session_id = excluded.sender_session_id,
-        reply_to = excluded.reply_to,
-        expires_at = excluded.expires_at,
-        legacy_global_completion = excluded.legacy_global_completion,
-        data = excluded.data
-    `).run(
-    message.id,
-    message.from,
-    message.to,
-    message.type,
-    message.priority,
-    message.timestamp,
-    message.completed ? 1 : 0,
-    message.completedAt ?? null,
-    message.deletedAt ?? null,
-    message.senderSessionId ?? null,
-    message.replyTo ?? null,
-    message.expiresAt ?? null,
-    legacyGlobalCompletion ? 1 : 0,
-    JSON.stringify(stored)
-  );
-}
-function persistReceipt(db, messageId, state) {
-  db.prepare(`
-      INSERT INTO message_receipts(
-        message_id, actor_id, read_at, completed_at, completed_by, outcome
-      ) VALUES (?, ?, ?, ?, ?, ?)
-      ON CONFLICT(message_id, actor_id) DO UPDATE SET
-        read_at = excluded.read_at,
-        completed_at = excluded.completed_at,
-        completed_by = excluded.completed_by,
-        outcome = excluded.outcome
-    `).run(
-    messageId,
-    state.actorId,
-    state.readAt ?? null,
-    state.completedAt ?? null,
-    state.completedBy ?? null,
-    state.outcome ?? null
-  );
-}
-function materializeMessageRows(db, rows) {
-  if (rows.length === 0) return [];
-  const receiptRows = [];
-  for (const ids of chunk(
-    rows.map((row) => row.id),
-    400
-  )) {
-    const receiptSql = `
-        SELECT message_id, actor_id, read_at, completed_at, completed_by, outcome
-        FROM message_receipts
-        WHERE message_id IN (${ids.map(() => "?").join(", ")})
-      `;
-    receiptRows.push(...db.prepare(receiptSql).all(...ids));
-  }
-  const receiptState = /* @__PURE__ */ new Map();
-  for (const row of receiptRows) {
-    const states = receiptState.get(row.message_id) ?? {};
-    states[row.actor_id] = {
-      actorId: row.actor_id,
-      ...row.read_at !== null ? { readAt: row.read_at } : {},
-      ...row.completed_at !== null ? { completedAt: row.completed_at } : {},
-      ...row.completed_by !== null ? { completedBy: row.completed_by } : {},
-      ...row.outcome !== null ? { outcome: row.outcome } : {}
-    };
-    receiptState.set(row.message_id, states);
-  }
-  return rows.map((row) => {
-    const base = JSON.parse(row.data);
-    const recipientState = receiptState.get(row.id) ?? {};
-    const readBy = { ...base.readBy };
-    for (const state of Object.values(recipientState)) {
-      if (state.readAt !== void 0) readBy[state.actorId] = state.readAt;
-    }
-    return {
-      ...base,
-      readBy,
-      recipientState,
-      ...row.legacy_global_completion === 1 ? { legacyGlobalCompletion: true } : {}
-    };
-  });
-}
-function deleteMessages(db, ids) {
-  for (const chunkIds of chunk(ids, 400)) {
-    db.prepare(`DELETE FROM messages WHERE id IN (${chunkIds.map(() => "?").join(", ")})`).run(
-      ...chunkIds
-    );
-  }
-}
-function* chunk(values, size) {
-  for (let start = 0; start < values.length; start += size) {
-    yield values.slice(start, start + size);
-  }
-}
-function persistAgent(db, agent) {
-  db.prepare(`
-      INSERT INTO agents(
-        agent_id, session_id, name, role, status, current_tool, current_task,
-        iterations, tool_calls, registered_at, last_seen_at, pid, source
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(agent_id) DO UPDATE SET
-        session_id = excluded.session_id,
-        name = excluded.name,
-        role = excluded.role,
-        status = excluded.status,
-        current_tool = excluded.current_tool,
-        current_task = excluded.current_task,
-        iterations = excluded.iterations,
-        tool_calls = excluded.tool_calls,
-        registered_at = excluded.registered_at,
-        last_seen_at = excluded.last_seen_at,
-        pid = excluded.pid,
-        source = excluded.source
-    `).run(
-    agent.agentId,
-    agent.sessionId,
-    agent.name,
-    agent.role ?? null,
-    agent.status,
-    agent.currentTool ?? null,
-    agent.currentTask ?? null,
-    agent.iterations,
-    agent.toolCalls,
-    agent.registeredAt,
-    agent.lastSeenAt,
-    agent.pid,
-    agent.source ?? null
-  );
-}
-function readAgents(db) {
-  const rows = db.prepare("SELECT * FROM agents").all();
-  const agents = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    const agent = {
-      agentId: String(row["agent_id"]),
-      sessionId: String(row["session_id"]),
-      name: String(row["name"]),
-      ...row["role"] !== null ? { role: String(row["role"]) } : {},
-      status: row["status"],
-      ...row["current_tool"] !== null ? { currentTool: String(row["current_tool"]) } : {},
-      ...row["current_task"] !== null ? { currentTask: String(row["current_task"]) } : {},
-      iterations: Number(row["iterations"]),
-      toolCalls: Number(row["tool_calls"]),
-      registeredAt: String(row["registered_at"]),
-      lastSeenAt: String(row["last_seen_at"]),
-      pid: Number(row["pid"]),
-      ...row["source"] !== null ? { source: row["source"] } : {}
-    };
-    agents.set(agent.agentId, agent);
-  }
-  return agents;
-}
-function pruneAgents(db, maxAgeMs = AGENT_STALE_MS) {
-  const cutoff = new Date(Date.now() - Math.max(0, maxAgeMs)).toISOString();
-  const result = db.prepare(`DELETE FROM agents WHERE last_seen_at < ? OR ${MALFORMED_TIMESTAMP}`).run(cutoff);
-  return Number(result.changes);
-}
-function persistClient(db, client) {
-  db.prepare(`
-      INSERT INTO clients(
-        client_id, session_id, name, source, registered_at, last_seen_at, pid
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(client_id) DO UPDATE SET
-        session_id = excluded.session_id,
-        name = excluded.name,
-        source = excluded.source,
-        registered_at = excluded.registered_at,
-        last_seen_at = excluded.last_seen_at,
-        pid = excluded.pid
-    `).run(
-    client.clientId,
-    client.sessionId,
-    client.name,
-    client.source,
-    client.registeredAt,
-    client.lastSeenAt,
-    client.pid
-  );
-}
-function readClients(db) {
-  const rows = db.prepare("SELECT * FROM clients").all();
-  const clients2 = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    const client = {
-      clientId: String(row["client_id"]),
-      sessionId: String(row["session_id"]),
-      name: String(row["name"]),
-      source: row["source"],
-      registeredAt: String(row["registered_at"]),
-      lastSeenAt: String(row["last_seen_at"]),
-      pid: Number(row["pid"])
-    };
-    clients2.set(client.clientId, client);
-  }
-  return clients2;
-}
-function pruneClients(db) {
-  const cutoff = new Date(Date.now() - CLIENT_STALE_MS).toISOString();
-  const result = db.prepare(`DELETE FROM clients WHERE last_seen_at < ? OR ${MALFORMED_TIMESTAMP}`).run(cutoff);
-  return Number(result.changes);
-}
-function persistCredential(db, credential) {
-  db.prepare(`
-      INSERT INTO credentials(credential_id, status, principal_id, expires_at, data)
-      VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(credential_id) DO UPDATE SET
-        status = excluded.status,
-        principal_id = excluded.principal_id,
-        expires_at = excluded.expires_at,
-        data = excluded.data
-    `).run(
-    credential.credentialId,
-    credential.status,
-    credential.principalId,
-    credential.expiresAt,
-    JSON.stringify(credential)
-  );
-}
-
-// src/coordination/sqlite-mailbox-credentials.ts
-function credentialGet(db, credentialId) {
-  const row = db.prepare("SELECT data FROM credentials WHERE credential_id = ?").get(credentialId);
-  return row === void 0 ? null : JSON.parse(row.data);
-}
-function credentialList(db) {
-  const rows = db.prepare("SELECT data FROM credentials").all();
-  return rows.map((row) => JSON.parse(row.data)).sort((left, right) => {
-    if (left.status === "active" && right.status !== "active") return -1;
-    if (left.status !== "active" && right.status === "active") return 1;
-    return right.issuedAt.localeCompare(left.issuedAt);
-  });
-}
-function credentialStatusCounts(db) {
-  const rows = db.prepare("SELECT status, COUNT(*) AS count FROM credentials GROUP BY status").all();
-  return Object.fromEntries(rows.map((row) => [row.status, row.count]));
-}
-function credentialIssue(db, transaction, options) {
-  const now = Date.now();
-  const issued = createMailboxCredential(options, now);
-  transaction(() => {
-    if (options.supersedes !== void 0) {
-      const old = credentialGet(db, options.supersedes);
-      if (old?.status === "active") {
-        old.status = "rotated_out";
-        old.statusChangedAt = new Date(now).toISOString();
-        old.statusReason = "superseded by rotation";
-        old.rotationValidUntil = new Date(now + ROTATION_OVERLAP_MS).toISOString();
-        persistCredential(db, old);
-      }
-    }
-    persistCredential(db, issued.credential);
-  });
-  return issued;
-}
-function credentialVerify(db, credentialId, secret) {
-  const decision = credentialVerifyThrottle.check(credentialId);
-  if (!decision.allowed) {
-    return {
-      valid: false,
-      reason: `too many failed verification attempts \u2014 retry in ${Math.ceil(decision.retryAfterMs / 1e3)}s`
-    };
-  }
-  const result = verifyMailboxCredential(credentialGet(db, credentialId) ?? void 0, secret);
-  if (result.valid) credentialVerifyThrottle.recordSuccess(credentialId);
-  else credentialVerifyThrottle.recordFailure(credentialId);
-  return result;
-}
-function credentialRevoke(db, credentialId, reason, by) {
-  const credential = credentialGet(db, credentialId);
-  if (credential === null || credential.status === "revoked") return false;
-  credential.status = "revoked";
-  credential.statusChangedAt = (/* @__PURE__ */ new Date()).toISOString();
-  credential.statusReason = reason ?? "revoked";
-  credential.lastModifiedBy = by;
-  persistCredential(db, credential);
-  return true;
-}
-function credentialRotate(db, transaction, credentialId, options) {
-  const old = credentialGet(db, credentialId);
-  if (old === null) return null;
-  if (old.status === "revoked") return null;
-  return credentialIssue(db, transaction, {
-    principalId: old.principalId,
-    projectId: old.projectId ?? options?.projectId,
-    kind: old.kind,
-    capabilities: options?.capabilities ?? old.capabilities,
-    ttlMs: options?.ttlMs ?? previousCredentialTtlMs(old),
-    notBefore: options?.notBefore,
-    supersedes: credentialId,
-    issuedBy: options?.issuedBy
-  });
-}
-function previousCredentialTtlMs(credential) {
-  const issuedAt = new Date(credential.issuedAt).getTime();
-  const expiresAt = new Date(credential.expiresAt).getTime();
-  const ttlMs = expiresAt - issuedAt;
-  return Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : MAX_CREDENTIAL_TTL[credential.kind];
-}
-
-// src/coordination/sqlite-mailbox-schema.ts
-import * as fs2 from "node:fs";
-import * as path5 from "node:path";
-import { loadRuntimeDatabaseSync } from "@wrongstack/persistence";
-
-// src/utils/sqlite-warning.ts
-var SQLITE_EXPERIMENTAL_WARNING_RE = /sqlite is an experimental feature/i;
-function isSqliteExperimentalWarning(warning, rest) {
-  const message = typeof warning === "string" ? warning : warning instanceof Error ? warning.message : "";
-  const typeOrOptions = rest[0];
-  const warningType = typeof warning === "string" ? typeof typeOrOptions === "string" ? typeOrOptions : typeof typeOrOptions === "object" && typeOrOptions !== null && "type" in typeOrOptions && typeof typeOrOptions.type === "string" ? typeOrOptions.type : "" : warning instanceof Error ? warning.name : "";
-  const warningCode = typeof warning === "string" ? typeof typeOrOptions === "object" && typeOrOptions !== null && "code" in typeOrOptions && typeof typeOrOptions.code === "string" ? typeOrOptions.code : typeof rest[1] === "string" ? rest[1] : "" : warning instanceof Error && "code" in warning && typeof warning.code === "string" ? warning.code : "";
-  return SQLITE_EXPERIMENTAL_WARNING_RE.test(message) && (warningType === "ExperimentalWarning" || warningCode === "ExperimentalWarning");
-}
-function withSqliteExperimentalWarningSuppressed(run) {
-  const originalEmitWarning = process.emitWarning;
-  const forwardWarning = originalEmitWarning.bind(process);
-  process.emitWarning = ((warning, ...rest) => {
-    if (isSqliteExperimentalWarning(warning, rest)) return;
-    forwardWarning(warning, ...rest);
-  });
-  try {
-    return run();
-  } finally {
-    process.emitWarning = originalEmitWarning;
-  }
-}
-
-// src/coordination/global-mailbox-paths.ts
-var GLOBAL_MAILBOX_FILE = "_mailbox.jsonl";
-var GLOBAL_MAILBOX_CLIENT_REGISTRY_FILE = "_mailbox.clients.json";
-
-// src/coordination/mailbox-parse-state.ts
-function parseMailboxFile(raw) {
-  return createMailboxParseState(raw).projections;
-}
-function createMailboxParseState(raw) {
-  const state = {
-    messages: [],
-    projections: [],
-    indexById: /* @__PURE__ */ new Map(),
-    receiptsByMessage: /* @__PURE__ */ new Map()
-  };
-  ingestMailboxChunk(state, raw);
-  return state;
-}
-function ingestMailboxChunk(state, chunk2) {
-  const firstNewIndex = state.messages.length;
-  const ackRecords = [];
-  const staleExisting = /* @__PURE__ */ new Set();
-  for (const line of chunk2.split(LINE_SEPARATOR)) {
-    if (line.trim().length === 0) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (isMailboxReceiptRecordV2(parsed)) {
-      const list = state.receiptsByMessage.get(parsed.messageId);
-      if (list) list.push(parsed);
-      else state.receiptsByMessage.set(parsed.messageId, [parsed]);
-      for (const index2 of state.indexById.get(parsed.messageId) ?? []) {
-        if (index2 < firstNewIndex) staleExisting.add(index2);
-      }
-      continue;
-    }
-    if (isAckRecord(parsed)) {
-      ackRecords.push(parsed);
-      continue;
-    }
-    let message;
-    try {
-      message = parseMailboxMessage(parsed);
-    } catch {
-      continue;
-    }
-    const index = state.messages.length;
-    state.messages.push(message);
-    const indices = state.indexById.get(message.id);
-    if (indices) indices.push(index);
-    else state.indexById.set(message.id, [index]);
-  }
-  for (const ack of ackRecords) {
-    const indices = state.indexById.get(ack.messageId);
-    if (indices === void 0 || indices.length === 0) continue;
-    const index = indices[indices.length - 1];
-    applyAckToMessage(state.messages[index], ack);
-    if (index < firstNewIndex) staleExisting.add(index);
-  }
-  for (const index of staleExisting) {
-    const message = state.messages[index];
-    state.projections[index] = materializeMessage(
-      message,
-      state.receiptsByMessage.get(message.id) ?? []
-    );
-  }
-  for (let index = firstNewIndex; index < state.messages.length; index++) {
-    const message = state.messages[index];
-    state.projections.push(
-      materializeMessage(message, state.receiptsByMessage.get(message.id) ?? [])
-    );
-  }
-}
-
-// src/coordination/mailbox-registry-codec.ts
-function parseAgentRegistryEntry(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const v = value;
-  if (typeof v.agentId !== "string") return null;
-  if (typeof v.sessionId !== "string") return null;
-  const statuses = ["idle", "busy", "running", "streaming", "waiting_user", "error"];
-  const status = typeof v.status === "string" && statuses.includes(v.status) ? v.status : "idle";
-  return {
-    ...v,
-    agentId: v.agentId,
-    sessionId: v.sessionId,
-    name: typeof v.name === "string" ? v.name : v.agentId,
-    registeredAt: typeof v.registeredAt === "string" ? v.registeredAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-    lastSeenAt: typeof v.lastSeenAt === "string" ? v.lastSeenAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-    iterations: typeof v.iterations === "number" && Number.isFinite(v.iterations) ? v.iterations : 0,
-    toolCalls: typeof v.toolCalls === "number" && Number.isFinite(v.toolCalls) ? v.toolCalls : 0,
-    pid: typeof v.pid === "number" && Number.isFinite(v.pid) ? v.pid : 0,
-    status
-  };
-}
-function parseClientRegistryEntry(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const v = value;
-  if (typeof v.clientId !== "string") return null;
-  if (typeof v.sessionId !== "string") return null;
-  const sources = ["repl", "tui", "webui", "http"];
-  const source = typeof v.source === "string" && sources.includes(v.source) ? v.source : "http";
-  return {
-    ...v,
-    clientId: v.clientId,
-    sessionId: v.sessionId,
-    name: typeof v.name === "string" ? v.name : v.clientId,
-    registeredAt: typeof v.registeredAt === "string" ? v.registeredAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-    lastSeenAt: typeof v.lastSeenAt === "string" ? v.lastSeenAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-    pid: typeof v.pid === "number" && Number.isFinite(v.pid) ? v.pid : 0,
-    source
-  };
-}
-
-// src/coordination/sqlite-mailbox-schema.ts
-var SQLITE_MAILBOX_SCHEMA_VERSION = 2;
-var DatabaseSyncCtor;
-function loadDatabaseSync() {
-  if (DatabaseSyncCtor) return DatabaseSyncCtor;
-  return withSqliteExperimentalWarningSuppressed(() => {
-    DatabaseSyncCtor = loadRuntimeDatabaseSync();
-    return DatabaseSyncCtor;
-  });
-}
-function initializeSchema(ctx) {
-  const { db } = ctx;
-  db.exec(`
-      CREATE TABLE IF NOT EXISTS mailbox_meta (
-        key TEXT PRIMARY KEY,
-        value TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS messages (
-        id TEXT PRIMARY KEY,
-        from_id TEXT NOT NULL,
-        to_id TEXT NOT NULL,
-        type TEXT NOT NULL,
-        priority TEXT NOT NULL,
-        timestamp TEXT NOT NULL,
-        completed INTEGER NOT NULL DEFAULT 0,
-        completed_at TEXT,
-        deleted_at TEXT,
-        sender_session_id TEXT,
-        reply_to TEXT,
-        expires_at TEXT,
-        legacy_global_completion INTEGER NOT NULL DEFAULT 0,
-        data TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS message_receipts (
-        message_id TEXT NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
-        actor_id TEXT NOT NULL,
-        read_at TEXT,
-        completed_at TEXT,
-        completed_by TEXT,
-        outcome TEXT,
-        PRIMARY KEY (message_id, actor_id)
-      );
-      CREATE TABLE IF NOT EXISTS agents (
-        agent_id TEXT PRIMARY KEY,
-        session_id TEXT NOT NULL,
-        name TEXT NOT NULL,
-        role TEXT,
-        status TEXT NOT NULL,
-        current_tool TEXT,
-        current_task TEXT,
-        iterations INTEGER NOT NULL,
-        tool_calls INTEGER NOT NULL,
-        registered_at TEXT NOT NULL,
-        last_seen_at TEXT NOT NULL,
-        pid INTEGER NOT NULL,
-        source TEXT
-      );
-      CREATE TABLE IF NOT EXISTS clients (
-        client_id TEXT PRIMARY KEY,
-        session_id TEXT NOT NULL,
-        name TEXT NOT NULL,
-        source TEXT NOT NULL,
-        registered_at TEXT NOT NULL,
-        last_seen_at TEXT NOT NULL,
-        pid INTEGER NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS credentials (
-        credential_id TEXT PRIMARY KEY,
-        status TEXT NOT NULL,
-        principal_id TEXT NOT NULL,
-        expires_at TEXT NOT NULL,
-        data TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_messages_to_timestamp ON messages(to_id, timestamp DESC);
-      CREATE INDEX IF NOT EXISTS idx_messages_from_timestamp ON messages(from_id, timestamp DESC);
-      CREATE INDEX IF NOT EXISTS idx_messages_type_timestamp ON messages(type, timestamp DESC);
-      CREATE INDEX IF NOT EXISTS idx_messages_deleted_at ON messages(deleted_at);
-      CREATE INDEX IF NOT EXISTS idx_messages_session_timestamp ON messages(sender_session_id, timestamp DESC);
-      CREATE INDEX IF NOT EXISTS idx_messages_reply_timestamp ON messages(reply_to, timestamp DESC);
-      CREATE INDEX IF NOT EXISTS idx_receipts_actor ON message_receipts(actor_id, message_id);
-      CREATE INDEX IF NOT EXISTS idx_agents_last_seen ON agents(last_seen_at);
-      CREATE INDEX IF NOT EXISTS idx_clients_last_seen ON clients(last_seen_at);
-      CREATE INDEX IF NOT EXISTS idx_credentials_status ON credentials(status, expires_at);
-    `);
-  db.prepare("INSERT INTO mailbox_meta(key, value) VALUES (?, ?) ON CONFLICT(key) DO NOTHING").run(
-    "schema_version",
-    String(SQLITE_MAILBOX_SCHEMA_VERSION)
-  );
-  const schema = db.prepare("SELECT value FROM mailbox_meta WHERE key = ?").get("schema_version");
-  const foundVersion = Number(schema?.value);
-  if (!Number.isInteger(foundVersion) || foundVersion < 1 || foundVersion > SQLITE_MAILBOX_SCHEMA_VERSION) {
-    throw new Error(
-      `Unsupported mailbox SQLite schema ${schema?.value ?? "missing"}; this build supports ${SQLITE_MAILBOX_SCHEMA_VERSION}`
-    );
-  }
-  if (foundVersion < SQLITE_MAILBOX_SCHEMA_VERSION) {
-    db.prepare("UPDATE mailbox_meta SET value = ? WHERE key = ?").run(
-      String(SQLITE_MAILBOX_SCHEMA_VERSION),
-      "schema_version"
-    );
-  }
-  migrateLegacyCredentials(ctx);
-}
-function migrateLegacyCredentials(ctx) {
-  const { db } = ctx;
-  const marker = db.prepare("SELECT value FROM mailbox_meta WHERE key = ?").get("legacy_credentials_imported");
-  if (marker !== void 0) return;
-  const legacyPath = path5.join(ctx.projectDir, CREDENTIAL_STORE_FILE);
-  const credentials = [];
-  try {
-    for (const line of fs2.readFileSync(legacyPath, "utf8").split(/\r?\n/u)) {
-      if (!line.trim()) continue;
-      try {
-        const credential = JSON.parse(line);
-        if (typeof credential.credentialId === "string" && typeof credential.verifier === "string" && typeof credential.principalId === "string")
-          credentials.push(credential);
-      } catch {
-      }
-    }
-  } catch (error) {
-    const code = error.code;
-    if (code !== "ENOENT") throw error;
-  }
-  ctx.transaction(() => {
-    for (const credential of credentials) persistCredential(db, credential);
-    db.prepare("INSERT INTO mailbox_meta(key, value) VALUES (?, ?)").run(
-      "legacy_credentials_imported",
-      (/* @__PURE__ */ new Date()).toISOString()
-    );
-  });
-}
-function migrateLegacyFiles(ctx) {
-  const { db } = ctx;
-  const marker = db.prepare("SELECT value FROM mailbox_meta WHERE key = ?").get("legacy_files_imported");
-  if (marker !== void 0) return;
-  const messages = readLegacyMessages(ctx.projectDir);
-  const agents = readLegacyRegistry(
-    path5.join(ctx.projectDir, "_mailbox.registry.json"),
-    parseAgentRegistryEntry
-  );
-  const clients2 = readLegacyRegistry(
-    path5.join(ctx.projectDir, GLOBAL_MAILBOX_CLIENT_REGISTRY_FILE),
-    parseClientRegistryEntry
-  );
-  ctx.transaction(() => {
-    for (const message of messages) {
-      const projection = message;
-      persistMessage(db, message, projection.legacyGlobalCompletion === true);
-      for (const state of Object.values(projection.recipientState ?? {})) {
-        persistReceipt(db, message.id, state);
-      }
-    }
-    for (const agent of agents.values()) persistAgent(db, agent);
-    for (const client of clients2.values()) persistClient(db, client);
-    db.prepare("INSERT INTO mailbox_meta(key, value) VALUES (?, ?)").run(
-      "legacy_files_imported",
-      (/* @__PURE__ */ new Date()).toISOString()
-    );
-  });
-}
-function readLegacyMessages(projectDir2) {
-  try {
-    return parseMailboxFile(fs2.readFileSync(path5.join(projectDir2, GLOBAL_MAILBOX_FILE), "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return [];
-    throw error;
-  }
-}
-function readLegacyRegistry(filePath, parseEntry) {
-  try {
-    const raw = JSON.parse(fs2.readFileSync(filePath, "utf8"));
-    const result = /* @__PURE__ */ new Map();
-    for (const [id, value] of Object.entries(raw)) {
-      const parsed = parseEntry(value);
-      if (parsed !== null) result.set(id, parsed);
-    }
-    return result;
-  } catch (error) {
-    if (error.code === "ENOENT") return /* @__PURE__ */ new Map();
-    throw error;
-  }
-}
-
-// src/coordination/sqlite-mailbox.ts
-var SQLITE_MAILBOX_FILE = "_mailbox.sqlite";
-var HEARTBEAT_TRACKING_MAX_ENTRIES = 512;
-var HEARTBEAT_TRACKING_TTL_MS = 30 * 6e4;
-var SqliteMailbox = class {
-  constructor(projectDir2, events2, eventEmitter2) {
-    this.projectDir = projectDir2;
-    fs3.mkdirSync(projectDir2, { recursive: true });
-    this.databasePath = path6.join(projectDir2, SQLITE_MAILBOX_FILE);
-    this.messagePath = this.databasePath;
-    this.events = events2;
-    this.eventEmitter = eventEmitter2;
-    const Database = loadDatabaseSync();
-    this.db = new Database(this.databasePath);
-    this.db.exec("PRAGMA journal_mode = WAL");
-    this.db.exec("PRAGMA synchronous = NORMAL");
-    this.db.exec("PRAGMA foreign_keys = ON");
-    this.db.exec("PRAGMA busy_timeout = 5000");
-    initializeSchema(this.schemaCtx());
-    migrateLegacyFiles(this.schemaCtx());
-  }
-  projectDir;
-  databasePath;
-  /** Compatibility alias used by project-server health/status consumers. */
-  messagePath;
-  eventEmitter;
-  db;
-  events;
-  lastHeartbeat = /* @__PURE__ */ new Map();
-  lastClientHeartbeat = /* @__PURE__ */ new Map();
-  autoCompactTimer = null;
-  autoCompactInFlight;
-  closed = false;
-  stmt(sql) {
-    return this.db.prepare(sql);
-  }
-  transaction(run) {
-    this.db.exec("BEGIN IMMEDIATE");
-    try {
-      const result = run();
-      this.db.exec("COMMIT");
-      return result;
-    } catch (error) {
-      this.db.exec("ROLLBACK");
-      throw error;
-    }
-  }
-  /** Bundle of store state the schema/migration module operates on. */
-  schemaCtx() {
-    return {
-      db: this.db,
-      projectDir: this.projectDir,
-      transaction: (run) => this.transaction(run)
-    };
-  }
-  persistMessage(message, legacyGlobalCompletion = false) {
-    persistMessage(this.db, message, legacyGlobalCompletion);
-  }
-  persistReceipt(messageId, state) {
-    persistReceipt(this.db, messageId, state);
-  }
-  materializeMessageRows(rows) {
-    return materializeMessageRows(this.db, rows);
-  }
-  readMessages() {
-    const rows = this.stmt(
-      "SELECT id, data, legacy_global_completion FROM messages"
-    ).all();
-    return this.materializeMessageRows(rows);
-  }
-  findMessage(messageId) {
-    const row = this.stmt(
-      "SELECT id, data, legacy_global_completion FROM messages WHERE id = ?"
-    ).get(messageId);
-    return row === void 0 ? void 0 : this.materializeMessageRows([row])[0];
-  }
-  async send(input) {
-    return this.sendMessage(input, false);
-  }
-  async sendRuntimeControl(input) {
-    return this.sendMessage({ ...input, type: "control" }, true);
-  }
-  async sendMessage(input, allowRuntimeControl) {
-    const type = normalizeMailboxMessageType(input.type);
-    const to = normalizeRecipient(input.to, input.senderSessionId);
-    if (!(allowRuntimeControl && type === "control")) validateSendType(type, to);
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const message = {
-      id: randomUUID2(),
-      from: input.from,
-      to,
-      type,
-      ...input.audience !== void 0 && input.audience !== "all" ? { audience: input.audience } : {},
-      subject: input.subject,
-      body: input.body,
-      priority: input.priority ?? "normal",
-      readBy: {},
-      completed: false,
-      timestamp,
-      ...input.replyTo !== void 0 ? { replyTo: input.replyTo } : {},
-      ...input.taskContext !== void 0 ? { taskContext: input.taskContext } : {},
-      ...input.senderSessionId !== void 0 ? { senderSessionId: input.senderSessionId } : {},
-      ...input.sessionAffinity !== void 0 ? { sessionAffinity: input.sessionAffinity } : {},
-      ...input.ttlMs !== void 0 ? { expiresAt: new Date(Date.now() + input.ttlMs).toISOString() } : {}
-    };
-    this.persistMessage(message);
-    this.events?.emitCustom("mailbox.message_sent", {
-      messageId: message.id,
-      from: message.from,
-      to: message.to,
-      type: message.type,
-      subject: message.subject
-    });
-    this.eventEmitter?.emit({
-      type: "message.sent",
-      messageId: message.id,
-      from: message.from,
-      to: message.to,
-      audience: message.audience,
-      timestamp
-    });
-    return message;
-  }
-  async query(query) {
-    const type = query.type === void 0 ? void 0 : normalizeMailboxMessageType(query.type);
-    const priorityRank = { low: 0, normal: 1, high: 2 };
-    const minimumRank = query.minPriority === void 0 ? 0 : priorityRank[query.minPriority];
-    if (query.ids !== void 0 && query.ids.length === 0) return [];
-    const statuses = query.unreadBy === void 0 ? await this.getAgentStatuses() : void 0;
-    const where = [];
-    const params = [];
-    if (query.ids !== void 0) {
-      where.push(`id IN (${query.ids.map(() => "?").join(", ")})`);
-      params.push(...query.ids);
-    }
-    if (query.to !== void 0) {
-      where.push("(to_id = ? OR to_id = ?)");
-      params.push(query.to, "*");
-    }
-    if (query.from !== void 0) {
-      where.push("from_id = ?");
-      params.push(query.from);
-    }
-    if (query.sessionId !== void 0) {
-      where.push("sender_session_id = ?");
-      params.push(query.sessionId);
-    }
-    if (type !== void 0) {
-      where.push("type = ?");
-      params.push(type);
-    }
-    if (query.minPriority !== void 0) {
-      where.push(`CASE priority WHEN 'high' THEN 2 WHEN 'low' THEN 0 ELSE 1 END >= ?`);
-      params.push(minimumRank);
-    }
-    if (query.since !== void 0) {
-      where.push("timestamp > ?");
-      params.push(query.since);
-    }
-    if (!query.includeDeleted) where.push("deleted_at IS NULL");
-    if (query.replyTo !== void 0) {
-      where.push("reply_to = ?");
-      params.push(query.replyTo);
-    }
-    if (query.unreadBy !== void 0) {
-      if (!isMailboxLeader(query.unreadBy, query.readerRole)) {
-        where.push("COALESCE(json_extract(data, '$.audience'), 'all') <> 'leaders'");
-      }
-      if (!query.incompleteOnly) {
-        where.push(`NOT EXISTS (
-          SELECT 1 FROM message_receipts AS unread_receipt
-          WHERE unread_receipt.message_id = messages.id
-            AND unread_receipt.actor_id = ?
-            AND unread_receipt.read_at IS NOT NULL
-        )`);
-        params.push(query.unreadBy);
-        where.push(`NOT EXISTS (
-          SELECT 1 FROM json_each(json_extract(data, '$.readBy')) AS legacy_read
-          WHERE legacy_read.key = ?
-        )`);
-        params.push(query.unreadBy);
-      } else {
-        where.push("legacy_global_completion = 0");
-        where.push(`NOT EXISTS (
-          SELECT 1 FROM message_receipts AS completed_receipt
-          WHERE completed_receipt.message_id = messages.id
-            AND completed_receipt.actor_id = ?
-            AND completed_receipt.completed_at IS NOT NULL
-        )`);
-        params.push(query.unreadBy);
-        where.push(`(
-          completed = 0 OR EXISTS (
-            SELECT 1 FROM message_receipts AS any_receipt
-            WHERE any_receipt.message_id = messages.id
-          )
-        )`);
-      }
-    }
-    const canPreLimit = !query.incompleteOnly || query.unreadBy !== void 0;
-    let sql = "SELECT id, data, legacy_global_completion FROM messages";
-    if (where.length > 0) sql += ` WHERE ${where.join(" AND ")}`;
-    sql += " ORDER BY timestamp DESC, rowid DESC";
-    if (canPreLimit) {
-      sql += " LIMIT ?";
-      params.push(query.limit ?? 50);
-    }
-    const rows = this.stmt(sql).all(...params);
-    const idFilter = query.ids === void 0 ? void 0 : new Set(query.ids);
-    const filtered = this.materializeMessageRows(rows).filter((message) => {
-      if (idFilter !== void 0 && !idFilter.has(message.id)) return false;
-      if (query.to !== void 0 && message.to !== query.to && message.to !== "*") return false;
-      if (query.from !== void 0 && message.from !== query.from) return false;
-      if (query.sessionId !== void 0 && message.senderSessionId !== query.sessionId)
-        return false;
-      if (query.unreadBy !== void 0 && !isMailboxMessageVisibleTo(message, query.unreadBy, query.readerRole))
-        return false;
-      if (!query.incompleteOnly && query.unreadBy !== void 0 && query.unreadBy in message.readBy)
-        return false;
-      if (query.incompleteOnly && (query.unreadBy === void 0 ? projectMailboxCompletion(message, void 0, statuses).completed : isMessageCompletedForActor(message, query.unreadBy)))
-        return false;
-      if (type !== void 0 && message.type !== type) return false;
-      if (priorityRank[message.priority] < minimumRank) return false;
-      if (query.since !== void 0 && message.timestamp <= query.since) return false;
-      if (!query.includeDeleted && message.deletedAt !== void 0) return false;
-      if (query.replyTo !== void 0 && message.replyTo !== query.replyTo) return false;
-      return true;
-    });
-    let messages = filtered;
-    if (query.currentSessionId !== void 0 || query.sessionAffinityCtx !== void 0) {
-      const kept = [];
-      for (const message of filtered) {
-        if (await acceptMailboxMessageForSession(
-          message,
-          query.currentSessionId,
-          query.sessionAffinityCtx
-        )) {
-          kept.push(message);
-        }
-      }
-      messages = kept;
-    }
-    messages.sort((left, right) => right.timestamp.localeCompare(left.timestamp));
-    return messages.slice(0, query.limit ?? 50).map((message) => {
-      const copy = {
-        ...projectMailboxCompletion(message, query.unreadBy, statuses),
-        readBy: { ...message.readBy }
-      };
-      if (!query.includeReceiptState) {
-        delete copy.recipientState;
-        delete copy.legacyGlobalCompletion;
-      }
-      return copy;
-    });
-  }
-  async ack(input) {
-    const results = await this.ackMany({ acks: [input] });
-    return results[0] ?? null;
-  }
-  async ackMany(input) {
-    if (input.acks.length === 0) return [];
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const changed = /* @__PURE__ */ new Set();
-    const updated = this.transaction(() => {
-      const results = [];
-      for (const ack of input.acks) {
-        const message = this.findMessage(ack.messageId);
-        if (message === void 0) continue;
-        const current = message.recipientState[ack.readerId] ?? { actorId: ack.readerId };
-        const state = { ...current };
-        let didChange = false;
-        if (ack.read !== false && state.readAt === void 0) {
-          state.readAt = timestamp;
-          message.readBy[ack.readerId] = timestamp;
-          didChange = true;
-        }
-        if (ack.completed === true && state.completedAt === void 0 && message.legacyGlobalCompletion !== true) {
-          state.completedAt = timestamp;
-          state.completedBy = ack.readerId;
-          didChange = true;
-        }
-        if (ack.read === false && ack.completed === false && state.completedAt !== void 0) {
-          delete state.completedAt;
-          delete state.completedBy;
-          didChange = true;
-        }
-        if (ack.outcome !== void 0 && state.outcome !== ack.outcome) {
-          state.outcome = ack.outcome;
-          didChange = true;
-        }
-        message.recipientState = {
-          ...message.recipientState,
-          [ack.readerId]: state
-        };
-        const actorCompleted = state.completedAt !== void 0;
-        message.completed = message.legacyGlobalCompletion === true || actorCompleted;
-        if (actorCompleted) {
-          message.completedBy = state.completedBy ?? ack.readerId;
-          message.completedAt = state.completedAt;
-        } else if (message.legacyGlobalCompletion !== true) {
-          delete message.completedBy;
-          delete message.completedAt;
-        }
-        message.outcome = state.outcome;
-        if (didChange) {
-          this.persistReceipt(message.id, state);
-          this.persistMessage(
-            isFanOutRecipient(message.to) ? withoutAggregateCompletion(message) : message,
-            message.legacyGlobalCompletion === true
-          );
-          changed.add(message.id);
-        }
-        results.push({ ...message, readBy: { ...message.readBy } });
-      }
-      return results;
-    });
-    for (const message of updated) {
-      if (!changed.has(message.id)) continue;
-      this.eventEmitter?.emit({
-        type: "message.acked",
-        messageId: message.id,
-        from: message.from,
-        to: message.to,
-        audience: message.audience,
-        timestamp
-      });
-    }
-    return updated;
-  }
-  /**
-   * Count the messages this actor has neither read nor completed.
-   *
-   * Pushed into SQL rather than filtering `readMessages()`. The pre-tool hook
-   * asks for this repeatedly — `mailbox-hooks.ts` throttles it to once a
-   * second, which bounds the frequency but not the cost — and the JS form
-   * materialized EVERY row in `messages`, joined the whole `message_receipts`
-   * table, and folded per-actor receipt state across all of them just to
-   * return an integer.
-   *
-   * The predicate is deliberately the same one {@link query} builds for
-   * `{ unreadBy, incompleteOnly }`, because it has to agree exactly with
-   * `isMessageCompletedForActor` and `isMailboxMessageVisibleTo`:
-   *
-   * - **unread** — no per-actor receipt carrying `read_at`, and no legacy
-   *   `readBy` key. Both are checked: `ackMany` writes the receipt row AND
-   *   mirrors the timestamp into the message's `readBy` JSON.
-   * - **incomplete** — not `legacy_global_completion`, no per-actor receipt
-   *   carrying `completed_at`, and the aggregate `completed` flag counts only
-   *   when the message has no receipts at all (once any actor has a receipt,
-   *   completion is per-actor and the aggregate flag is not authoritative).
-   * - **audience** — `leaders` mail is invisible unless the actor's base
-   *   identity is `leader`. This call path carries no role, matching the
-   *   `isMailboxMessageVisibleTo(message, forAgentId)` it replaces.
-   */
-  async unreadCount(forAgentId, sessionId, ctx) {
-    const sessionAddress = sessionId === void 0 ? void 0 : sessionRecipient(sessionId);
-    const where = [];
-    const params = [];
-    const recipients = ["to_id = ?", "to_id = '*'"];
-    params.push(forAgentId);
-    if (sessionAddress !== void 0) {
-      recipients.push("to_id = ?");
-      params.push(sessionAddress);
-    }
-    where.push(`(${recipients.join(" OR ")})`);
-    where.push("deleted_at IS NULL");
-    if (!isMailboxLeader(forAgentId)) {
-      where.push("COALESCE(json_extract(data, '$.audience'), 'all') <> 'leaders'");
-    }
-    where.push(`NOT EXISTS (
-      SELECT 1 FROM message_receipts AS read_receipt
-      WHERE read_receipt.message_id = messages.id
-        AND read_receipt.actor_id = ?
-        AND read_receipt.read_at IS NOT NULL
-    )`);
-    params.push(forAgentId);
-    where.push(`NOT EXISTS (
-      SELECT 1 FROM json_each(json_extract(data, '$.readBy')) AS legacy_read
-      WHERE legacy_read.key = ?
-    )`);
-    params.push(forAgentId);
-    where.push("legacy_global_completion = 0");
-    where.push(`NOT EXISTS (
-      SELECT 1 FROM message_receipts AS completed_receipt
-      WHERE completed_receipt.message_id = messages.id
-        AND completed_receipt.actor_id = ?
-        AND completed_receipt.completed_at IS NOT NULL
-    )`);
-    params.push(forAgentId);
-    where.push(`(
-      completed = 0 OR EXISTS (
-        SELECT 1 FROM message_receipts AS any_receipt
-        WHERE any_receipt.message_id = messages.id
-      )
-    )`);
-    if (sessionId === void 0 && ctx === void 0) {
-      const row = this.stmt(
-        `SELECT COUNT(*) AS total FROM messages WHERE ${where.join(" AND ")}`
-      ).get(...params);
-      return Number(row?.total ?? 0);
-    }
-    const rows = this.stmt(
-      `SELECT id, data, legacy_global_completion FROM messages WHERE ${where.join(" AND ")}`
-    ).all(...params);
-    let total = 0;
-    for (const message of this.materializeMessageRows(rows)) {
-      if (await acceptMailboxMessageForSession(message, sessionId, ctx)) total += 1;
-    }
-    return total;
-  }
-  async softDelete(mailId, by) {
-    const message = this.findMessage(mailId);
-    if (message === void 0) return null;
-    if (message.deletedAt !== void 0) return { ...message, readBy: { ...message.readBy } };
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    message.deletedAt = timestamp;
-    message.deletedBy = by;
-    const previousState = message.recipientState[by] ?? { actorId: by };
-    const state = {
-      ...previousState,
-      readAt: previousState.readAt ?? timestamp
-    };
-    message.readBy[by] = state.readAt;
-    message.recipientState = { ...message.recipientState, [by]: state };
-    this.transaction(() => {
-      this.persistReceipt(message.id, state);
-      this.persistMessage(message, message.legacyGlobalCompletion === true);
-    });
-    this.eventEmitter?.emit({
-      type: "message.deleted",
-      messageId: message.id,
-      from: message.from,
-      to: message.to,
-      audience: message.audience,
-      timestamp
-    });
-    return { ...message, readBy: { ...message.readBy } };
-  }
-  async restore(mailId) {
-    const message = this.findMessage(mailId);
-    if (message === void 0) return null;
-    if (message.deletedAt === void 0 && message.deletedBy === void 0) {
-      return { ...message, readBy: { ...message.readBy } };
-    }
-    delete message.deletedAt;
-    delete message.deletedBy;
-    this.persistMessage(message, message.legacyGlobalCompletion === true);
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    this.eventEmitter?.emit({
-      type: "message.restored",
-      messageId: message.id,
-      from: message.from,
-      to: message.to,
-      audience: message.audience,
-      timestamp
-    });
-    return { ...message, readBy: { ...message.readBy } };
-  }
-  persistAgent(agent) {
-    persistAgent(this.db, agent);
-  }
-  readAgents() {
-    return readAgents(this.db);
-  }
-  pruneAgents(maxAgeMs = AGENT_STALE_MS) {
-    return pruneAgents(this.db, maxAgeMs);
-  }
-  async registerAgent(input) {
-    this.pruneAgents();
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.persistAgent({
-      agentId: input.agentId,
-      sessionId: input.sessionId,
-      name: input.name,
-      ...input.role !== void 0 ? { role: input.role } : {},
-      status: "idle",
-      iterations: 0,
-      toolCalls: 0,
-      registeredAt: now,
-      lastSeenAt: now,
-      pid: input.pid ?? process.pid,
-      ...input.source !== void 0 ? { source: input.source } : {}
-    });
-    this.events?.emitCustom("mailbox.agent_registered", {
-      agentId: input.agentId,
-      sessionId: input.sessionId,
-      name: input.name,
-      role: input.role,
-      source: input.source
-    });
-  }
-  /**
-   * Throttle bookkeeping only: `agentId`/`clientId` -> last accepted heartbeat.
-   *
-   * Entries are deleted on a clean deregister, but a crashed or forcibly killed
-   * peer never deregisters, so over a long-lived daemon's life these maps grew
-   * with every distinct id ever seen. Dropping a stale entry is free: the next
-   * heartbeat from that id simply is not throttled and writes once more.
-   */
-  pruneHeartbeats(map, nowMs) {
-    for (const [id, at] of map) {
-      if (nowMs - at > HEARTBEAT_TRACKING_TTL_MS) map.delete(id);
-    }
-    while (map.size > HEARTBEAT_TRACKING_MAX_ENTRIES) {
-      const oldest = map.keys().next().value;
-      if (oldest === void 0) break;
-      map.delete(oldest);
-    }
-  }
-  async deregisterAgent(agentId) {
-    this.stmt("DELETE FROM agents WHERE agent_id = ?").run(agentId);
-    this.lastHeartbeat.delete(agentId);
-    this.events?.emitCustom("mailbox.agent_deregistered", { agentId });
-  }
-  async heartbeat(input) {
-    const nowMs = Date.now();
-    if (nowMs - (this.lastHeartbeat.get(input.agentId) ?? 0) < HEARTBEAT_THROTTLE_MS) return;
-    this.lastHeartbeat.set(input.agentId, nowMs);
-    this.pruneHeartbeats(this.lastHeartbeat, nowMs);
-    this.pruneAgents();
-    const agent = this.readAgents().get(input.agentId);
-    if (agent !== void 0) {
-      agent.lastSeenAt = new Date(nowMs).toISOString();
-      if (input.status !== void 0) agent.status = input.status;
-      if (input.currentTool !== void 0) agent.currentTool = input.currentTool;
-      if (input.currentTask !== void 0) agent.currentTask = input.currentTask;
-      if (input.iterations !== void 0) agent.iterations = input.iterations;
-      if (input.toolCalls !== void 0) agent.toolCalls = input.toolCalls;
-      this.persistAgent(agent);
-    }
-    this.events?.emitCustom("mailbox.agent_heartbeat", {
-      agentId: input.agentId,
-      status: input.status,
-      currentTool: input.currentTool,
-      currentTask: input.currentTask
-    });
-  }
-  async getAgentStatuses() {
-    this.pruneAgents();
-    return mapRegisteredAgentsToStatuses(this.readAgents(), Date.now(), AGENT_STALE_MS);
-  }
-  async purgeAgents(maxAgeMs = AGENT_STALE_MS) {
-    return this.pruneAgents(maxAgeMs);
-  }
-  async getOnlineAgents() {
-    return (await this.getAgentStatuses()).filter((agent) => agent.online);
-  }
-  persistClient(client) {
-    persistClient(this.db, client);
-  }
-  readClients() {
-    return readClients(this.db);
-  }
-  pruneClientsInPlace() {
-    return pruneClients(this.db);
-  }
-  async registerClient(input) {
-    this.pruneClientsInPlace();
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.persistClient({
-      clientId: input.clientId,
-      sessionId: input.sessionId,
-      name: input.name,
-      source: input.source,
-      registeredAt: now,
-      lastSeenAt: now,
-      pid: input.pid ?? process.pid
-    });
-    this.events?.emitCustom("mailbox.client_registered", {
-      clientId: input.clientId,
-      sessionId: input.sessionId,
-      name: input.name,
-      source: input.source
-    });
-  }
-  async deregisterClient(clientId) {
-    this.stmt("DELETE FROM clients WHERE client_id = ?").run(clientId);
-    this.lastClientHeartbeat.delete(clientId);
-    this.events?.emitCustom("mailbox.client_deregistered", { clientId });
-  }
-  async clientHeartbeat(input) {
-    const nowMs = Date.now();
-    if (nowMs - (this.lastClientHeartbeat.get(input.clientId) ?? 0) < HEARTBEAT_THROTTLE_MS) return;
-    this.lastClientHeartbeat.set(input.clientId, nowMs);
-    this.pruneHeartbeats(this.lastClientHeartbeat, nowMs);
-    this.pruneClientsInPlace();
-    const client = this.readClients().get(input.clientId);
-    if (client !== void 0) {
-      client.lastSeenAt = new Date(nowMs).toISOString();
-      if (input.sessionId) client.sessionId = input.sessionId;
-      this.persistClient(client);
-    }
-    this.events?.emitCustom("mailbox.client_heartbeat", {
-      clientId: input.clientId,
-      ...input.sessionId ? { sessionId: input.sessionId } : {}
-    });
-  }
-  async getClientStatuses() {
-    this.pruneClientsInPlace();
-    return mapRegisteredClientsToStatuses(this.readClients(), Date.now(), CLIENT_STALE_MS);
-  }
-  async purgeClients() {
-    return this.pruneClientsInPlace();
-  }
-  async clearAll() {
-    this.stmt("DELETE FROM messages").run();
-  }
-  async purgeStale(options) {
-    return purgeStale(this.compactionCtx(), options);
-  }
-  async autoCompact(options) {
-    if (this.autoCompactInFlight !== void 0) return this.autoCompactInFlight;
-    const inFlight = autoCompact(this.compactionCtx(), options);
-    this.autoCompactInFlight = inFlight;
-    try {
-      return await inFlight;
-    } finally {
-      if (this.autoCompactInFlight === inFlight) this.autoCompactInFlight = void 0;
-    }
-  }
-  /** Bundle of store operations the retention sweeps drive. */
-  compactionCtx() {
-    return {
-      getAgentStatuses: () => this.getAgentStatuses(),
-      readMessages: () => this.readMessages(),
-      deleteMessages: (ids) => this.deleteMessages(ids)
-    };
-  }
-  deleteMessages(ids) {
-    if (ids.length === 0) return;
-    this.transaction(() => deleteMessages(this.db, ids));
-  }
-  credentialGet(credentialId) {
-    return credentialGet(this.db, credentialId);
-  }
-  credentialList() {
-    return credentialList(this.db);
-  }
-  credentialStatusCounts() {
-    return credentialStatusCounts(this.db);
-  }
-  credentialIssue(options) {
-    return credentialIssue(this.db, (run) => this.transaction(run), options);
-  }
-  credentialVerify(credentialId, secret) {
-    return credentialVerify(this.db, credentialId, secret);
-  }
-  credentialRevoke(credentialId, reason, by) {
-    return credentialRevoke(this.db, credentialId, reason, by);
-  }
-  credentialRotate(credentialId, options) {
-    return credentialRotate(this.db, (run) => this.transaction(run), credentialId, options);
-  }
-  startAutoCompactTimer(options) {
-    if (this.autoCompactTimer !== null) clearInterval(this.autoCompactTimer);
-    const timer = setInterval(() => {
-      void this.autoCompact(options).catch(() => {
-      });
-    }, options?.intervalMs ?? AUTO_COMPACT_INTERVAL_MS);
-    timer.unref?.();
-    this.autoCompactTimer = timer;
-    return () => {
-      clearInterval(timer);
-      if (this.autoCompactTimer === timer) this.autoCompactTimer = null;
-    };
-  }
-  async close() {
-    if (this.closed) return;
-    this.closed = true;
-    if (this.autoCompactTimer !== null) clearInterval(this.autoCompactTimer);
-    this.autoCompactTimer = null;
-    this.db.close();
-  }
-};
-
-// src/coordination/mailbox-project-server.ts
+import { bindProjectEndpoint } from "@wrongstack/persistence";
 var DEFAULT_IDLE_MS = 5 * 6e4;
 var DEFAULT_CLIENT_LEASE_MS = 45e3;
 var MAX_CLIENT_WRITE_BUFFER_BYTES = 8 * 1024 * 1024;
@@ -3280,7 +52,7 @@ function parseArgs(argv) {
     if (argv[index] === "--project-dir") projectDir2 = argv[++index];
   }
   if (!projectDir2) throw new Error("mailbox project server requires --project-dir");
-  return { projectDir: path7.resolve(projectDir2) };
+  return { projectDir: path.resolve(projectDir2) };
 }
 useDaemonPerfDefaults();
 var { projectDir } = parseArgs(process.argv.slice(2));
@@ -3307,10 +79,10 @@ var stopMemoryWatchdog = startSharedHeapWatchdog({
     pendingRequests
   })
 });
-var authToken = randomBytes2(16).toString("hex");
+var authToken = randomBytes(16).toString("hex");
 var markMetadataWritten;
-var metadataWritten = new Promise((resolve5) => {
-  markMetadataWritten = resolve5;
+var metadataWritten = new Promise((resolve2) => {
+  markMetadataWritten = resolve2;
 });
 var serverInfo = {
   protocolVersion: MAILBOX_PROJECT_SERVER_PROTOCOL_VERSION,
@@ -3341,7 +113,7 @@ events.onAny((event, payload) => {
 });
 eventEmitter.subscribe((event) => broadcast({ type: "mailbox-event", event }));
 function serverStatus() {
-  const databasePath = mailbox?.databasePath ?? path7.join(projectDir, SQLITE_MAILBOX_FILE);
+  const databasePath = mailbox?.databasePath ?? path.join(projectDir, SQLITE_MAILBOX_FILE);
   return {
     ...serverInfo,
     clients: clients.size,
@@ -3529,9 +301,9 @@ function handleMessage(state, message) {
     scheduleIdleStop();
   });
 }
-function onData(state, chunk2) {
+function onData(state, chunk) {
   state.lastSeenAt = Date.now();
-  state.buffer += chunk2;
+  state.buffer += chunk;
   while (true) {
     const newline = state.buffer.indexOf("\n");
     if (newline < 0) {
@@ -3595,7 +367,7 @@ async function stop(_reason) {
   clearInterval(leaseSweep);
   stopAutoCompact?.();
   await removeOwnedMetadata();
-  const serverClosed = new Promise((resolve5) => server.close(() => resolve5()));
+  const serverClosed = new Promise((resolve2) => server.close(() => resolve2()));
   for (const state of clients) state.socket.end();
   const forceCloseTimer = setTimeout(() => {
     for (const state of clients) state.socket.destroy();
@@ -3627,7 +399,7 @@ var server = net.createServer((socket) => {
   void metadataWritten.then(() => {
     if (!socket.destroyed) send(state, { type: "hello", ...serverInfo });
   });
-  socket.on("data", (chunk2) => onData(state, chunk2));
+  socket.on("data", (chunk) => onData(state, chunk));
   socket.on("error", () => {
   });
   socket.on("close", () => {