motebit 1.8.0 → 1.8.1

package/dist/index.js

@@ -1091,6 +1091,7 @@ var init_audience = __esm({
       "account:withdraw",
       "account:withdrawals",
       "account:checkout",
+      "proxy:token",
       "browser-sandbox-grant",
       "browser-sandbox",
       "runtime:attach"
@@ -20907,7 +20908,7 @@ var init_config2 = __esm({
   "src/config.ts"() {
     "use strict";
     init_esm_shims();
-    VERSION = true ? "1.8.0" : "0.0.0-dev";
+    VERSION = true ? "1.8.1" : "0.0.0-dev";
     CONFIG_DIR = process.env["MOTEBIT_CONFIG_DIR"] ?? path2.join(os.homedir(), ".motebit");
     CONFIG_PATH = path2.join(CONFIG_DIR, "config.json");
     RELAY_DIR = path2.join(CONFIG_DIR, "relay");
@@ -25247,11 +25248,14 @@ var init_migration_client = __esm({
 });
 
 // ../../packages/runtime/dist/proxy-session.js
-async function fetchProxyToken(syncUrl, motebitId) {
+async function fetchProxyToken(syncUrl, motebitId, authToken) {
   try {
     const res = await fetch(`${syncUrl}/api/v1/agents/${motebitId}/proxy-token`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" }
+      headers: {
+        "Content-Type": "application/json",
+        ...authToken != null && authToken !== "" ? { Authorization: `Bearer ${authToken}` } : {}
+      }
     });
     if (!res.ok)
       return null;
@@ -25301,7 +25305,8 @@ var init_proxy_session = __esm({
           return false;
         let token = this.adapter.loadToken();
         if (!token || token.expiresAt < Date.now() + 6e4) {
-          const fresh = await fetchProxyToken(syncUrl, motebitId);
+          const authToken = this.adapter.mintAuthToken ? await this.adapter.mintAuthToken() : null;
+          const fresh = await fetchProxyToken(syncUrl, motebitId, authToken);
           if (fresh) {
             token = fresh;
             this.adapter.saveToken(token);
@@ -25328,7 +25333,8 @@ var init_proxy_session = __esm({
         const motebitId = this.adapter.getMotebitId();
         if (!syncUrl || !motebitId)
           return;
-        const token = await fetchProxyToken(syncUrl, motebitId);
+        const authToken = this.adapter.mintAuthToken ? await this.adapter.mintAuthToken() : null;
+        const token = await fetchProxyToken(syncUrl, motebitId, authToken);
         if (!token)
           return;
         this.adapter.saveToken(token);
@@ -78849,6 +78855,52 @@ function enrichWithLatencyStats(agents, db) {
     return { ...a3, latency_stats: projection };
   });
 }
+function registerAgentAuthMiddleware(deps) {
+  const { app, apiToken, identityManager, parseTokenPayloadUnsafe: parseTokenPayloadUnsafe2, verifySignedTokenForDevice: verifySignedTokenForDevice2, isTokenBlacklisted, isAgentRevoked } = deps;
+  app.use("/api/v1/agents/*", async (c3, next) => {
+    const path19 = c3.req.path;
+    const method = c3.req.method;
+    if (PUBLIC_AGENT_ROUTES.some((r2) => r2.match(path19, method))) {
+      await next();
+      return;
+    }
+    const authHeader = c3.req.header("authorization");
+    if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+      throw new HTTPException5(401, { message: "Missing auth token" });
+    }
+    const token = authHeader.slice(7);
+    if (apiToken != null && apiToken !== "" && token === apiToken) {
+      await next();
+      return;
+    }
+    const claims = parseTokenPayloadUnsafe2(token);
+    if (!claims?.mid) {
+      throw new HTTPException5(401, { message: "Invalid token" });
+    }
+    let agentAudience;
+    if (path19.includes("/p2p-eligibility")) {
+      agentAudience = "market:listing";
+    } else if (path19.includes("/listing")) {
+      agentAudience = "market:listing";
+    } else if (path19.includes("/credentials")) {
+      agentAudience = "credentials";
+    } else if (path19.includes("/presentation")) {
+      agentAudience = "credentials:present";
+    } else if (path19.includes("/proxy-token")) {
+      agentAudience = "proxy:token";
+    } else if (path19.includes("/receipts")) {
+      agentAudience = "receipts:read";
+    } else {
+      agentAudience = "admin:query";
+    }
+    const valid = await verifySignedTokenForDevice2(token, claims.mid, identityManager, agentAudience, isTokenBlacklisted, isAgentRevoked);
+    if (!valid) {
+      throw new HTTPException5(401, { message: "Token verification failed" });
+    }
+    c3.set("callerMotebitId", claims.mid);
+    await next();
+  });
+}
 function registerAgentRoutes(deps) {
   const { app, moteDb, identityManager, relayIdentity, connections, taskRouter, apiToken, federationConfig, federationQueryCache, parseTokenPayloadUnsafe: parseTokenPayloadUnsafe2, verifySignedTokenForDevice: verifySignedTokenForDevice2, isTokenBlacklisted, isAgentRevoked } = deps;
   app.get("/agent/:motebitId/settlements", (c3) => {
@@ -79025,58 +79077,6 @@ function registerAgentRoutes(deps) {
     }
     return c3.json(JSON.parse(row.manifest_json));
   });
-  app.use("/api/v1/agents/*", async (c3, next) => {
-    if (c3.req.path === "/api/v1/agents/bootstrap") {
-      await next();
-      return;
-    }
-    if (c3.req.path.endsWith("/succession") && c3.req.method === "GET") {
-      await next();
-      return;
-    }
-    if (c3.req.path === "/api/v1/agents/discover" && c3.req.method === "GET") {
-      await next();
-      return;
-    }
-    if (c3.req.path === "/api/v1/agents/revocations" && c3.req.method === "GET") {
-      await next();
-      return;
-    }
-    const authHeader = c3.req.header("authorization");
-    if (authHeader == null || !authHeader.startsWith("Bearer ")) {
-      throw new HTTPException5(401, { message: "Missing auth token" });
-    }
-    const token = authHeader.slice(7);
-    if (apiToken != null && apiToken !== "" && token === apiToken) {
-      await next();
-      return;
-    }
-    const claims = parseTokenPayloadUnsafe2(token);
-    if (!claims?.mid) {
-      throw new HTTPException5(401, { message: "Invalid token" });
-    }
-    const path19 = c3.req.path;
-    let agentAudience;
-    if (path19.includes("/p2p-eligibility")) {
-      agentAudience = "market:listing";
-    } else if (path19.includes("/listing")) {
-      agentAudience = "market:listing";
-    } else if (path19.includes("/credentials")) {
-      agentAudience = "credentials";
-    } else if (path19.includes("/presentation")) {
-      agentAudience = "credentials:present";
-    } else if (path19.includes("/receipts")) {
-      agentAudience = "receipts:read";
-    } else {
-      agentAudience = "admin:query";
-    }
-    const valid = await verifySignedTokenForDevice2(token, claims.mid, identityManager, agentAudience, isTokenBlacklisted, isAgentRevoked);
-    if (!valid) {
-      throw new HTTPException5(401, { message: "Token verification failed" });
-    }
-    c3.set("callerMotebitId", claims.mid);
-    await next();
-  });
   app.get("/api/v1/agents/:motebitId/receipts", (c3) => {
     const motebitId = c3.req.param("motebitId");
     const caller = c3.get("callerMotebitId");
@@ -79648,7 +79648,7 @@ function registerAgentRoutes(deps) {
     return c3.json({ ok: true });
   });
 }
-var logger17, SOLVENCY_TTL_MS;
+var logger17, SOLVENCY_TTL_MS, PUBLIC_AGENT_ROUTES;
 var init_agents = __esm({
   "../../services/relay/dist/agents.js"() {
     "use strict";
@@ -79668,6 +79668,44 @@ var init_agents = __esm({
     init_logger();
     logger17 = createLogger({ service: "agents" });
     SOLVENCY_TTL_MS = 5 * 60 * 1e3;
+    PUBLIC_AGENT_ROUTES = [
+      {
+        match: (p5) => p5 === "/api/v1/agents/bootstrap",
+        reason: "bootstrap: fresh-identity registration, own rate limiter"
+      },
+      {
+        match: (p5, m3) => p5.endsWith("/succession") && m3 === "GET",
+        reason: "succession: public key-lineage verification (CLAUDE.md rule 6)"
+      },
+      {
+        match: (p5, m3) => p5 === "/api/v1/agents/discover" && m3 === "GET",
+        reason: "discover: agents must find each other without pre-existing auth"
+      },
+      {
+        match: (p5, m3) => p5 === "/api/v1/agents/revocations" && m3 === "GET",
+        reason: "revocations: operator's signed, verifiable moderation history"
+      },
+      {
+        match: (p5) => p5.endsWith("/credentials/submit"),
+        reason: "credentials/submit: permissive-by-signature \u2014 the self-verifying envelope IS the auth (spec/credential-v1.md); no bearer token by design"
+      },
+      {
+        match: (p5, m3) => /\/devices\/[^/]+\/hardware-attestation$/.test(p5) && m3 === "POST",
+        reason: "hardware-attestation: self-authenticating \u2014 the request is signed under the device's identity key and verified in-handler (sibling of credentials/submit + register-self); no bearer token by design"
+      },
+      {
+        match: (p5, m3) => p5.endsWith("/debit") && m3 === "POST",
+        reason: "debit: internal service-to-service auth via the x-relay-secret header (subscriptions.ts), verified in-handler \u2014 not a user bearer token. Correct permanent carve-out."
+      },
+      {
+        match: (p5, m3) => p5.endsWith("/solvency-proof") && m3 === "GET",
+        reason: "solvency-proof: public verification primitive by design \u2014 a counterparty checks an agent can cover an amount BEFORE transacting, which requires no pre-existing auth (sibling of succession)."
+      },
+      {
+        match: (p5, m3) => p5.endsWith("/settlements") && m3 === "GET",
+        reason: "settlements (GET): owner-private financial history, but enforced by its OWN dedicated dualAuth(account:balance) in middleware.ts (same class as /balance) + the handler's first-person own-id check. This agent-middleware carve-out DEFERS to that dualAuth \u2014 removing it would double-wrap the route (admin:query here vs account:balance there) and conflict. Not public: account:balance-authed, caller===:motebitId."
+      }
+    ];
   }
 });
 
@@ -83450,7 +83488,7 @@ __export(migration_exports, {
   createMigrationTables: () => createMigrationTables,
   registerMigrationRoutes: () => registerMigrationRoutes
 });
-import { HTTPException as HTTPException22 } from "hono/http-exception";
+import { HTTPException as HTTPException23 } from "hono/http-exception";
 function createMigrationTables(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS relay_migrations (
@@ -83513,15 +83551,15 @@ function registerMigrationRoutes(deps) {
     }
     const request = parsed.data;
     if (request.motebit_id !== motebitId) {
-      throw new HTTPException22(400, { message: "MigrationRequest motebit_id does not match path" });
+      throw new HTTPException23(400, { message: "MigrationRequest motebit_id does not match path" });
     }
     const agent = db.prepare("SELECT motebit_id, public_key, revoked FROM agent_registry WHERE motebit_id = ?").get(motebitId);
     if (!agent)
-      throw new HTTPException22(404, { message: "Agent not found" });
+      throw new HTTPException23(404, { message: "Agent not found" });
     if (agent.revoked)
-      throw new HTTPException22(403, { message: "Agent is revoked" });
+      throw new HTTPException23(403, { message: "Agent is revoked" });
     if (!agent.public_key || !await verifyMigrationRequest(request, hexToBytes5(agent.public_key))) {
-      throw new HTTPException22(401, { message: "MigrationRequest signature invalid" });
+      throw new HTTPException23(401, { message: "MigrationRequest signature invalid" });
     }
     const existing = getActiveMigration(db, motebitId);
     if (existing) {
@@ -83553,7 +83591,7 @@ function registerMigrationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const migration = getActiveMigration(db, motebitId);
     if (!migration) {
-      throw new HTTPException22(404, { message: "No active migration token" });
+      throw new HTTPException23(404, { message: "No active migration token" });
     }
     updateMigrationState(db, migration.token_id, "attesting");
     const agent = db.prepare("SELECT public_key, registered_at, last_heartbeat FROM agent_registry WHERE motebit_id = ?").get(motebitId);
@@ -83605,7 +83643,7 @@ function registerMigrationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const migration = getActiveMigration(db, motebitId);
     if (!migration) {
-      throw new HTTPException22(404, { message: "No active migration token" });
+      throw new HTTPException23(404, { message: "No active migration token" });
     }
     updateMigrationState(db, migration.token_id, "exporting");
     const credentials = db.prepare("SELECT credential_id, credential_json FROM relay_credentials WHERE subject_motebit_id = ? ORDER BY issued_at ASC").all(motebitId);
@@ -83656,10 +83694,10 @@ function registerMigrationRoutes(deps) {
     }
     const { migration_token, departure_attestation, credential_bundle } = body;
     if (migration_token.expires_at < Date.now()) {
-      throw new HTTPException22(400, { message: "Migration token has expired" });
+      throw new HTTPException23(400, { message: "Migration token has expired" });
     }
     if (migration_token.motebit_id !== body.motebit_id) {
-      throw new HTTPException22(400, { message: "Token motebit_id does not match" });
+      throw new HTTPException23(400, { message: "Token motebit_id does not match" });
     }
     let sourcePk = null;
     const pinnedPeer = db.prepare("SELECT public_key FROM relay_peers WHERE peer_relay_id = ? AND state IN ('active', 'suspended')").get(migration_token.source_relay_id);
@@ -83678,30 +83716,30 @@ function registerMigrationRoutes(deps) {
       }
     }
     if (!sourcePk) {
-      throw new HTTPException22(400, {
+      throw new HTTPException23(400, {
         message: "Cannot establish source relay identity \u2014 migration rejected"
       });
     }
     if (!await verifyMigrationToken(migration_token, sourcePk)) {
-      throw new HTTPException22(400, { message: "Migration token signature invalid" });
+      throw new HTTPException23(400, { message: "Migration token signature invalid" });
     }
     if (!await verifyDepartureAttestation(departure_attestation, sourcePk)) {
-      throw new HTTPException22(400, { message: "Departure attestation signature invalid" });
+      throw new HTTPException23(400, { message: "Departure attestation signature invalid" });
     }
     if (credential_bundle.motebit_id !== body.motebit_id) {
-      throw new HTTPException22(400, { message: "Credential bundle motebit_id does not match" });
+      throw new HTTPException23(400, { message: "Credential bundle motebit_id does not match" });
     }
     if (!await verifyMigratingKeyBinding(body.motebit_id, body.public_key, body.identity_file)) {
-      throw new HTTPException22(400, {
+      throw new HTTPException23(400, {
         message: "Migrating identity is not bound to the presented key"
       });
     }
     if (!await verifyCredentialBundle(credential_bundle, hexToBytes5(body.public_key))) {
-      throw new HTTPException22(400, { message: "Credential bundle signature invalid" });
+      throw new HTTPException23(400, { message: "Credential bundle signature invalid" });
     }
     const existing = db.prepare("SELECT token_id FROM relay_accepted_migrations WHERE token_id = ?").get(migration_token.token_id);
     if (existing) {
-      throw new HTTPException22(409, { message: "Migration token already accepted" });
+      throw new HTTPException23(409, { message: "Migration token already accepted" });
     }
     const now = Date.now();
     db.prepare(`INSERT OR REPLACE INTO agent_registry
@@ -83731,7 +83769,7 @@ function registerMigrationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const migration = getActiveMigration(db, motebitId);
     if (!migration) {
-      throw new HTTPException22(404, { message: "No active migration" });
+      throw new HTTPException23(404, { message: "No active migration" });
     }
     updateMigrationState(db, migration.token_id, "cancelled");
     logger36.info("migration.cancelled", { motebitId, tokenId: migration.token_id });
@@ -83741,17 +83779,17 @@ function registerMigrationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const migration = getActiveMigration(db, motebitId);
     if (!migration) {
-      throw new HTTPException22(404, { message: "No active migration" });
+      throw new HTTPException23(404, { message: "No active migration" });
     }
     try {
       const activeTasks = db.prepare("SELECT COUNT(*) as cnt FROM task_results WHERE (worker_id = ? OR submitted_by = ?) AND status IN ('pending', 'running')").get(motebitId, motebitId);
       if (activeTasks && activeTasks.cnt > 0) {
-        throw new HTTPException22(409, {
+        throw new HTTPException23(409, {
           message: `Cannot depart: ${activeTasks.cnt} active task(s) must complete first`
         });
       }
     } catch (err2) {
-      if (err2 instanceof HTTPException22)
+      if (err2 instanceof HTTPException23)
         throw err2;
     }
     let balanceWaiver;
@@ -83760,7 +83798,7 @@ function registerMigrationRoutes(deps) {
     if (candidate !== void 0) {
       const parsed = BalanceWaiverSchema.safeParse(candidate);
       if (!parsed.success) {
-        throw new HTTPException22(400, {
+        throw new HTTPException23(400, {
           message: `Invalid balance_waiver: ${parsed.error.issues.map((i3) => i3.message).join("; ")}`
         });
       }
@@ -83776,17 +83814,17 @@ function registerMigrationRoutes(deps) {
     let persistedWaiverJson = null;
     if (currentBalance > 0) {
       if (!balanceWaiver) {
-        throw new HTTPException22(409, {
+        throw new HTTPException23(409, {
           message: "Cannot depart: balance must be withdrawn or waived first (POST { balance_waiver } per spec/migration-v1.md \xA77.2)"
         });
       }
       if (balanceWaiver.motebit_id !== motebitId) {
-        throw new HTTPException22(400, {
+        throw new HTTPException23(400, {
           message: "Balance waiver motebit_id does not match path parameter"
         });
       }
       if (balanceWaiver.waived_amount < currentBalance) {
-        throw new HTTPException22(409, {
+        throw new HTTPException23(409, {
           message: `Balance waiver covers ${balanceWaiver.waived_amount} but current balance is ${currentBalance} \u2014 re-sign and retry`
         });
       }
@@ -83799,18 +83837,18 @@ function registerMigrationRoutes(deps) {
         pubKeyHex = device?.public_key;
       }
       if (!pubKeyHex) {
-        throw new HTTPException22(400, {
+        throw new HTTPException23(400, {
           message: "No public key on file for this agent \u2014 cannot verify balance waiver"
         });
       }
       const waiverValid = await verifyBalanceWaiver(balanceWaiver, hexToBytes5(pubKeyHex));
       if (!waiverValid) {
-        throw new HTTPException22(400, { message: "Balance waiver signature invalid" });
+        throw new HTTPException23(400, { message: "Balance waiver signature invalid" });
       }
       const store = sqliteAccountStoreFor(db);
       const debitResult = store.debit(motebitId, currentBalance, "waiver", migration.token_id, `migration waiver: ${migration.token_id}`);
       if (debitResult === null) {
-        throw new HTTPException22(409, {
+        throw new HTTPException23(409, {
           message: "Balance changed during depart; re-check balance and retry"
         });
       }
@@ -83964,7 +84002,7 @@ __export(disputes_exports, {
   runDeferredOrchestrationCycle: () => runDeferredOrchestrationCycle,
   startDeferredOrchestrationWorker: () => startDeferredOrchestrationWorker
 });
-import { HTTPException as HTTPException23 } from "hono/http-exception";
+import { HTTPException as HTTPException24 } from "hono/http-exception";
 function createDisputeTables(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS relay_disputes (
@@ -84249,7 +84287,7 @@ async function orchestrateFederationResolution(dispute, round, deps) {
     return aggregateVotes(persistedVotes, peers.length, dispute.filer_role);
   }
   if (peers.length < FEDERATION_QUORUM_MIN) {
-    throw new HTTPException23(503, {
+    throw new HTTPException24(503, {
       message: JSON.stringify({
         error_code: "insufficient_federation_peers",
         message: `Federation adjudication requires \u2265${FEDERATION_QUORUM_MIN} OTHER active peers (spec/dispute-v1.md \xA76.2 + \xA76.5 + \xA76.6). Active peer count: ${peers.length}.`
@@ -84257,7 +84295,7 @@ async function orchestrateFederationResolution(dispute, round, deps) {
     });
   }
   if (!dispute.body_json) {
-    throw new HTTPException23(503, {
+    throw new HTTPException24(503, {
       message: JSON.stringify({
         error_code: "legacy_dispute_no_signed_body",
         message: "Dispute predates the \xA76.2 body_json migration; federation adjudication unavailable for this dispute."
@@ -84268,7 +84306,7 @@ async function orchestrateFederationResolution(dispute, round, deps) {
   try {
     parsedDisputeRequest = JSON.parse(dispute.body_json);
   } catch (err2) {
-    throw new HTTPException23(500, {
+    throw new HTTPException24(500, {
       message: `Failed to parse dispute body_json: ${err2 instanceof Error ? err2.message : String(err2)}`
     });
   }
@@ -84443,26 +84481,26 @@ function registerDisputeRoutes(deps) {
     }
     const req = parsed.data;
     if (req.allocation_id !== allocationId) {
-      throw new HTTPException23(400, {
+      throw new HTTPException24(400, {
         message: "DisputeRequest.allocation_id does not match path parameter"
       });
     }
     const filerRow = db.prepare("SELECT public_key FROM agent_registry WHERE motebit_id = ?").get(req.filed_by);
     if (!filerRow?.public_key) {
-      throw new HTTPException23(401, {
+      throw new HTTPException24(401, {
         message: "Filing party is not registered; cannot verify DisputeRequest signature"
       });
     }
     const filerPubKey = hexToBytes5(filerRow.public_key);
     const sigValid = await verifyDisputeRequest(req, filerPubKey);
     if (!sigValid) {
-      throw new HTTPException23(401, {
+      throw new HTTPException24(401, {
         message: "DisputeRequest signature verification failed"
       });
     }
     const existing = getDispute(db, req.dispute_id);
     if (existing) {
-      throw new HTTPException23(409, { message: "Dispute with this dispute_id already exists" });
+      throw new HTTPException24(409, { message: "Dispute with this dispute_id already exists" });
     }
     const allocation = db.prepare("SELECT allocation_id, task_id, motebit_id, amount_locked, status FROM relay_allocations WHERE allocation_id = ?").get(allocationId);
     let isP2pDispute = false;
@@ -84472,7 +84510,7 @@ function registerDisputeRoutes(deps) {
     } else {
       const p2pSettlement = db.prepare("SELECT settlement_id, task_id, motebit_id FROM relay_settlements WHERE task_id = ? AND settlement_mode = 'p2p'").get(req.task_id);
       if (!p2pSettlement) {
-        throw new HTTPException23(404, { message: "Allocation not found" });
+        throw new HTTPException24(404, { message: "Allocation not found" });
       }
       isP2pDispute = true;
       workerId = p2pSettlement.motebit_id;
@@ -84480,7 +84518,7 @@ function registerDisputeRoutes(deps) {
     const filerRole = req.filed_by === workerId ? "worker" : "delegator";
     const activeCount = db.prepare("SELECT COUNT(*) as cnt FROM relay_disputes WHERE filed_by = ? AND state NOT IN ('final', 'expired')").get(req.filed_by);
     if (activeCount.cnt >= MAX_ACTIVE_DISPUTES_PER_AGENT) {
-      throw new HTTPException23(429, {
+      throw new HTTPException24(429, {
         message: `Maximum ${MAX_ACTIVE_DISPUTES_PER_AGENT} active disputes per agent`
       });
     }
@@ -84540,15 +84578,15 @@ function registerDisputeRoutes(deps) {
     }
     const ev = parsed.data;
     if (ev.dispute_id !== disputeId) {
-      throw new HTTPException23(400, {
+      throw new HTTPException24(400, {
         message: "DisputeEvidence.dispute_id does not match path parameter"
       });
     }
     const dispute = getDispute(db, disputeId);
     if (!dispute)
-      throw new HTTPException23(404, { message: "Dispute not found" });
+      throw new HTTPException24(404, { message: "Dispute not found" });
     if (dispute.state !== "evidence" && dispute.state !== "opened" && dispute.state !== "resolved") {
-      throw new HTTPException23(400, {
+      throw new HTTPException24(400, {
         message: `Cannot submit evidence in state: ${String(dispute.state)}`
       });
     }
@@ -84556,36 +84594,36 @@ function registerDisputeRoutes(deps) {
     if (dispute.state === "resolved") {
       const resolvedAt = dispute.resolved_at;
       if (resolvedAt == null) {
-        throw new HTTPException23(500, {
+        throw new HTTPException24(500, {
           message: "Dispute in resolved state without resolved_at \u2014 schema invariant violated"
         });
       }
       if (now > resolvedAt + APPEAL_WINDOW_MS) {
-        throw new HTTPException23(400, {
+        throw new HTTPException24(400, {
           message: "Appeal window has closed; no further evidence"
         });
       }
     } else if (now > dispute.evidence_deadline) {
-      throw new HTTPException23(400, { message: "Evidence window has closed" });
+      throw new HTTPException24(400, { message: "Evidence window has closed" });
     }
     if (ev.submitted_by !== dispute.filed_by && ev.submitted_by !== dispute.respondent) {
-      throw new HTTPException23(403, { message: "Only dispute parties can submit evidence" });
+      throw new HTTPException24(403, { message: "Only dispute parties can submit evidence" });
     }
     const submitterRow = db.prepare("SELECT public_key FROM agent_registry WHERE motebit_id = ?").get(ev.submitted_by);
     if (!submitterRow?.public_key) {
-      throw new HTTPException23(401, {
+      throw new HTTPException24(401, {
         message: "Submitting party is not registered; cannot verify DisputeEvidence signature"
       });
     }
     const sigValid = await verifyDisputeEvidence(ev, hexToBytes5(submitterRow.public_key));
     if (!sigValid) {
-      throw new HTTPException23(401, {
+      throw new HTTPException24(401, {
         message: "DisputeEvidence signature verification failed"
       });
     }
     const evidenceCount = db.prepare("SELECT COUNT(*) as cnt FROM relay_dispute_evidence WHERE dispute_id = ? AND submitted_by = ?").get(disputeId, ev.submitted_by);
     if (evidenceCount.cnt >= MAX_EVIDENCE_PER_PARTY) {
-      throw new HTTPException23(429, {
+      throw new HTTPException24(429, {
         message: `Maximum ${MAX_EVIDENCE_PER_PARTY} evidence submissions per party`
       });
     }
@@ -84604,7 +84642,7 @@ function registerDisputeRoutes(deps) {
     const body = await c3.req.json();
     let dispute = getDispute(db, disputeId);
     if (!dispute)
-      throw new HTTPException23(404, { message: "Dispute not found" });
+      throw new HTTPException24(404, { message: "Dispute not found" });
     dispute = tryFinalizeIfWindowExpired(db, dispute);
     const existing = db.prepare(
       // ORDER BY round DESC LIMIT 1: if round 2 exists (post-appeal),
@@ -84625,7 +84663,7 @@ function registerDisputeRoutes(deps) {
       });
     }
     if (dispute.state !== "evidence" && dispute.state !== "arbitration") {
-      throw new HTTPException23(400, {
+      throw new HTTPException24(400, {
         message: `Cannot resolve in state: ${String(dispute.state)}`
       });
     }
@@ -84661,7 +84699,7 @@ function registerDisputeRoutes(deps) {
         adjudicatorVotes = attempt.result.adjudicator_votes;
       } else {
         if (!body.rationale) {
-          throw new HTTPException23(400, { message: "Rationale is required" });
+          throw new HTTPException24(400, { message: "Rationale is required" });
         }
         resolutionOutcome = body.resolution;
         resolutionRationale = body.rationale;
@@ -84682,7 +84720,7 @@ function registerDisputeRoutes(deps) {
           resolvedAt
         }, { db, relayIdentity });
       } catch (err2) {
-        throw new HTTPException23(500, {
+        throw new HTTPException24(500, {
           message: `Dispute resolution persistence failed: ${err2 instanceof Error ? err2.message : String(err2)}`
         });
       }
@@ -84723,36 +84761,36 @@ function registerDisputeRoutes(deps) {
     }
     const ap = parsed.data;
     if (ap.dispute_id !== disputeId) {
-      throw new HTTPException23(400, {
+      throw new HTTPException24(400, {
         message: "DisputeAppeal.dispute_id does not match path parameter"
       });
     }
     let dispute = getDispute(db, disputeId);
     if (!dispute)
-      throw new HTTPException23(404, { message: "Dispute not found" });
+      throw new HTTPException24(404, { message: "Dispute not found" });
     dispute = tryFinalizeIfWindowExpired(db, dispute);
     if (dispute.state !== "resolved") {
-      throw new HTTPException23(400, { message: "Can only appeal a resolved dispute" });
+      throw new HTTPException24(400, { message: "Can only appeal a resolved dispute" });
     }
     const resolvedAt = dispute.resolved_at;
     if (Date.now() > resolvedAt + APPEAL_WINDOW_MS) {
-      throw new HTTPException23(400, { message: "Appeal window has expired" });
+      throw new HTTPException24(400, { message: "Appeal window has expired" });
     }
     if (ap.appealed_by !== dispute.filed_by && ap.appealed_by !== dispute.respondent) {
-      throw new HTTPException23(403, { message: "Only dispute parties can appeal" });
+      throw new HTTPException24(403, { message: "Only dispute parties can appeal" });
     }
     if (dispute.appealed_at != null) {
-      throw new HTTPException23(409, { message: "Dispute has already been appealed" });
+      throw new HTTPException24(409, { message: "Dispute has already been appealed" });
     }
     const appealerRow = db.prepare("SELECT public_key FROM agent_registry WHERE motebit_id = ?").get(ap.appealed_by);
     if (!appealerRow?.public_key) {
-      throw new HTTPException23(401, {
+      throw new HTTPException24(401, {
         message: "Appealing party is not registered; cannot verify DisputeAppeal signature"
       });
     }
     const sigValid = await verifyDisputeAppeal(ap, hexToBytes5(appealerRow.public_key));
     if (!sigValid) {
-      throw new HTTPException23(401, {
+      throw new HTTPException24(401, {
         message: "DisputeAppeal signature verification failed"
       });
     }
@@ -84799,7 +84837,7 @@ function registerDisputeRoutes(deps) {
       db.exec("COMMIT");
     } catch (err2) {
       db.exec("ROLLBACK");
-      throw new HTTPException23(500, {
+      throw new HTTPException24(500, {
         message: `Round-2 finalization failed: ${err2 instanceof Error ? err2.message : String(err2)}`
       });
     }
@@ -84827,7 +84865,7 @@ function registerDisputeRoutes(deps) {
     const disputeId = c3.req.param("disputeId");
     let dispute = getDispute(db, disputeId);
     if (!dispute)
-      throw new HTTPException23(404, { message: "Dispute not found" });
+      throw new HTTPException24(404, { message: "Dispute not found" });
     if (dispute.state === "opened" && Date.now() > dispute.filed_at + OPENED_EXPIRE_MS) {
       db.prepare("UPDATE relay_disputes SET state = 'expired', expired_at = ? WHERE dispute_id = ?").run(Date.now(), disputeId);
       dispute.state = "expired";
@@ -84846,7 +84884,7 @@ function registerDisputeRoutes(deps) {
     const disputeId = c3.req.param("disputeId");
     const dispute = getDispute(db, disputeId);
     if (!dispute)
-      throw new HTTPException23(404, { message: "Dispute not found" });
+      throw new HTTPException24(404, { message: "Dispute not found" });
     const resolutions = db.prepare("SELECT * FROM relay_dispute_resolutions WHERE dispute_id = ? ORDER BY round ASC").all(disputeId);
     return c3.json({ dispute_id: disputeId, resolutions });
   });
@@ -85673,7 +85711,7 @@ __export(skill_registry_exports, {
   parseFeaturedSubmitters: () => parseFeaturedSubmitters,
   registerSkillRegistryRoutes: () => registerSkillRegistryRoutes
 });
-import { HTTPException as HTTPException24 } from "hono/http-exception";
+import { HTTPException as HTTPException25 } from "hono/http-exception";
 function createSkillRegistryTables(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS relay_skill_registry (
@@ -85737,17 +85775,17 @@ function registerSkillRegistryRoutes(deps) {
     try {
       raw = await c3.req.json();
     } catch {
-      throw new HTTPException24(400, { message: "bad_request: malformed JSON body" });
+      throw new HTTPException25(400, { message: "bad_request: malformed JSON body" });
     }
     const approxSize = JSON.stringify(raw).length;
     if (approxSize > MAX_PAYLOAD_BYTES) {
-      throw new HTTPException24(413, {
+      throw new HTTPException25(413, {
         message: `payload_too_large: ${approxSize} bytes exceeds ${MAX_PAYLOAD_BYTES}`
       });
     }
     const parsed = SkillRegistrySubmitRequestSchema.safeParse(raw);
     if (!parsed.success) {
-      throw new HTTPException24(400, {
+      throw new HTTPException25(400, {
         message: `bad_request: ${parsed.error.issues.map((i3) => `${i3.path.join(".")}: ${i3.message}`).join("; ")}`
       });
     }
@@ -85756,14 +85794,14 @@ function registerSkillRegistryRoutes(deps) {
     const publicKey = decodeSkillSignaturePublicKey(envelope.signature);
     const verifyDetail = await verifySkillEnvelopeDetailed(envelope, publicKey);
     if (!verifyDetail.valid) {
-      throw new HTTPException24(400, {
+      throw new HTTPException25(400, {
         message: `verification_failed: ${verifyDetail.reason}`
       });
     }
     const bodyBytes = base64Decode(submission.body);
     const bodyDigest = bytesToHex4(await sha2562(bodyBytes));
     if (bodyDigest !== envelope.body_hash) {
-      throw new HTTPException24(400, {
+      throw new HTTPException25(400, {
         message: `body_hash_mismatch: submitted body hashes to ${bodyDigest}, envelope pins ${envelope.body_hash}`
       });
     }
@@ -85771,14 +85809,14 @@ function registerSkillRegistryRoutes(deps) {
     for (const fileSpec of envelope.files) {
       const b64 = fileBytes[fileSpec.path];
       if (b64 === void 0) {
-        throw new HTTPException24(400, {
+        throw new HTTPException25(400, {
           message: `file_hash_mismatch: envelope pins ${fileSpec.path} but submission omits it`
         });
       }
       const decoded = base64Decode(b64);
       const digest = bytesToHex4(await sha2562(decoded));
       if (digest !== fileSpec.hash) {
-        throw new HTTPException24(400, {
+        throw new HTTPException25(400, {
           message: `file_hash_mismatch: ${fileSpec.path} hashes to ${digest}, envelope pins ${fileSpec.hash}`
         });
       }
@@ -85786,7 +85824,7 @@ function registerSkillRegistryRoutes(deps) {
     const submitterMotebitId = publicKeyToDidKey(hexToBytes5(envelope.signature.public_key));
     const existing = db.prepare("SELECT content_hash, submitted_at FROM relay_skill_registry WHERE submitter_motebit_id = ? AND name = ? AND version = ?").get(submitterMotebitId, envelope.skill.name, envelope.skill.version);
     if (existing && existing.content_hash !== envelope.skill.content_hash) {
-      throw new HTTPException24(409, {
+      throw new HTTPException25(409, {
         message: `version_immutable: ${submitterMotebitId}/${envelope.skill.name}@${envelope.skill.version} already exists with content_hash ${existing.content_hash}`
       });
     }
@@ -85869,7 +85907,7 @@ function registerSkillRegistryRoutes(deps) {
     const version = c3.req.param("version");
     const row = db.prepare("SELECT bundle_json FROM relay_skill_registry WHERE submitter_motebit_id = ? AND name = ? AND version = ?").get(submitter, name, version);
     if (!row) {
-      throw new HTTPException24(404, {
+      throw new HTTPException25(404, {
         message: `not_found: ${submitter}/${name}@${version}`
       });
     }
@@ -85881,7 +85919,7 @@ function registerSkillRegistryRoutes(deps) {
         version,
         issues: parsed.error.issues
       });
-      throw new HTTPException24(500, { message: "internal_error: stored bundle invalid" });
+      throw new HTTPException25(500, { message: "internal_error: stored bundle invalid" });
     }
     return c3.json(parsed.data);
   });
@@ -92879,7 +92917,9 @@ init_runtime_factory();
 async function handleCredentials(config) {
   const motebitId = requireMotebitId(loadFullConfig());
   const syncUrl = config.syncUrl ?? process.env["MOTEBIT_SYNC_URL"];
-  const headers = await getRelayAuthHeaders(config);
+  const headers = await getRelayAuthHeaders(config, {
+    aud: config.presentation ? "credentials:present" : "credentials"
+  });
   let localCreds = [];
   try {
     const dbPath = getDbPath(config.dbPath);
@@ -93878,6 +93918,8 @@ async function handleExport(config) {
   }
   moteDb.close();
   const syncUrl = config.syncUrl ?? process.env["MOTEBIT_SYNC_URL"];
+  const credHeaders = await getRelayAuthHeaders(config, { aud: "credentials" });
+  const vpHeaders = await getRelayAuthHeaders(config, { aud: "credentials:present" });
   const headers = await getRelayAuthHeaders(config);
   const baseUrl = syncUrl ? syncUrl.replace(/\/$/, "") : null;
   if (!baseUrl) {
@@ -93887,7 +93929,7 @@ async function handleExport(config) {
   } else {
     const credResult = await fetchRelayJson(
       `${baseUrl}/api/v1/agents/${motebitId}/credentials`,
-      headers
+      credHeaders
     );
     if (credResult.ok) {
       const credBody = credResult.data;
@@ -93900,7 +93942,7 @@ async function handleExport(config) {
     }
     const vpResult = await fetchRelayJson(
       `${baseUrl}/api/v1/agents/${motebitId}/presentation`,
-      headers,
+      vpHeaders,
       "POST"
     );
     if (vpResult.ok) {
@@ -99456,6 +99498,10 @@ function registerCredentialRoutes(deps) {
   });
   app.get("/api/v1/agents/:motebitId/credentials", (c3) => {
     const mid = asMotebitId(c3.req.param("motebitId"));
+    const callerMotebitId = c3.get("callerMotebitId");
+    if (callerMotebitId !== void 0 && callerMotebitId !== mid) {
+      throw new HTTPException7(403, { message: "Cannot read another agent's credentials" });
+    }
     const typeFilter = c3.req.query("type");
     const limit = Math.min(parseInt(c3.req.query("limit") ?? "50", 10) || 50, 200);
     let rows;
@@ -99474,6 +99520,10 @@ function registerCredentialRoutes(deps) {
   });
   app.post("/api/v1/agents/:motebitId/presentation", async (c3) => {
     const mid = asMotebitId(c3.req.param("motebitId"));
+    const callerMotebitId = c3.get("callerMotebitId");
+    if (callerMotebitId !== void 0 && callerMotebitId !== mid) {
+      throw new HTTPException7(403, { message: "Cannot present another agent's credentials" });
+    }
     const typeFilter = c3.req.query("type");
     const limit = Math.min(parseInt(c3.req.query("limit") ?? "100", 10) || 100, 500);
     let rows;
@@ -99554,6 +99604,7 @@ function registerCredentialRoutes(deps) {
 init_esm_shims();
 init_dist6();
 init_logger();
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 import Stripe from "stripe";
 
 // ../../services/relay/dist/free-credit.js
@@ -99697,6 +99748,10 @@ async function issueProxyToken(motebitId, balanceMicro, relayIdentity) {
 function registerProxyTokenRoutes(app, db, relayIdentity, subscriptionEventAdapter = null) {
   app.post("/api/v1/agents/:motebitId/proxy-token", async (c3) => {
     const motebitId = c3.req.param("motebitId");
+    const callerMotebitId = c3.get("callerMotebitId");
+    if (callerMotebitId !== void 0 && callerMotebitId !== motebitId) {
+      throw new HTTPException8(403, { message: "Cannot mint another agent's proxy token" });
+    }
     grantFreeCreditIfEligible(db, motebitId, getClientIp(c3));
     const account = getAccountBalance(db, motebitId);
     const balance = account?.balance ?? 0;
@@ -100434,7 +100489,7 @@ init_receipts_store();
 
 // ../../services/relay/dist/onramp.js
 init_esm_shims();
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 
 // ../../services/relay/dist/onramp/stripe-crypto-adapter.js
 init_esm_shims();
@@ -100543,7 +100598,7 @@ async function hasGas(address, rpcUrl = DEFAULT_RPC) {
 function registerOnrampRoutes(app, adapter, solanaRpcUrl) {
   app.post("/api/v1/onramp/session", async (c3) => {
     if (!adapter) {
-      throw new HTTPException8(503, {
+      throw new HTTPException9(503, {
         message: "On-ramp is not configured on this relay"
       });
     }
@@ -100551,13 +100606,13 @@ function registerOnrampRoutes(app, adapter, solanaRpcUrl) {
     try {
       body = await c3.req.json();
     } catch {
-      throw new HTTPException8(400, { message: "Invalid JSON body" });
+      throw new HTTPException9(400, { message: "Invalid JSON body" });
     }
     if (typeof body.motebit_id !== "string" || body.motebit_id === "") {
-      throw new HTTPException8(400, { message: "motebit_id is required" });
+      throw new HTTPException9(400, { message: "motebit_id is required" });
     }
     if (typeof body.destination_address !== "string" || body.destination_address === "") {
-      throw new HTTPException8(400, {
+      throw new HTTPException9(400, {
         message: "destination_address is required"
       });
     }
@@ -100582,7 +100637,7 @@ function registerOnrampRoutes(app, adapter, solanaRpcUrl) {
       });
     } catch (err2) {
       const message2 = err2 instanceof Error ? err2.message : String(err2);
-      throw new HTTPException8(502, {
+      throw new HTTPException9(502, {
         message: `Onramp provider error: ${message2}`
       });
     }
@@ -100591,7 +100646,7 @@ function registerOnrampRoutes(app, adapter, solanaRpcUrl) {
 
 // ../../services/relay/dist/offramp.js
 init_esm_shims();
-import { HTTPException as HTTPException9 } from "hono/http-exception";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
 var BridgeOfframpAdapter = class {
   provider = "bridge";
   apiKey;
@@ -100651,7 +100706,7 @@ var BridgeOfframpAdapter = class {
 function registerOfframpRoutes(app, adapter) {
   app.post("/api/v1/offramp/session", async (c3) => {
     if (!adapter) {
-      throw new HTTPException9(503, {
+      throw new HTTPException10(503, {
         message: "Off-ramp is not configured on this relay"
       });
     }
@@ -100659,26 +100714,26 @@ function registerOfframpRoutes(app, adapter) {
     try {
       body = await c3.req.json();
     } catch {
-      throw new HTTPException9(400, { message: "Invalid JSON body" });
+      throw new HTTPException10(400, { message: "Invalid JSON body" });
     }
     if (typeof body.motebit_id !== "string" || body.motebit_id === "") {
-      throw new HTTPException9(400, { message: "motebit_id is required" });
+      throw new HTTPException10(400, { message: "motebit_id is required" });
     }
     if (typeof body.source_address !== "string" || body.source_address === "") {
-      throw new HTTPException9(400, { message: "source_address is required" });
+      throw new HTTPException10(400, { message: "source_address is required" });
     }
     if (typeof body.amount_usd !== "number" || body.amount_usd <= 0) {
-      throw new HTTPException9(400, {
+      throw new HTTPException10(400, {
         message: "amount_usd must be a positive number"
       });
     }
     if (typeof body.bridge_customer_id !== "string" || body.bridge_customer_id === "") {
-      throw new HTTPException9(400, {
+      throw new HTTPException10(400, {
         message: "bridge_customer_id is required"
       });
     }
     if (typeof body.external_account_id !== "string" || body.external_account_id === "") {
-      throw new HTTPException9(400, {
+      throw new HTTPException10(400, {
         message: "external_account_id is required"
       });
     }
@@ -100700,7 +100755,7 @@ function registerOfframpRoutes(app, adapter) {
       });
     } catch (err2) {
       const message2 = err2 instanceof Error ? err2.message : String(err2);
-      throw new HTTPException9(502, {
+      throw new HTTPException10(502, {
         message: `Offramp provider error: ${message2}`
       });
     }
@@ -100713,7 +100768,7 @@ init_accounts();
 
 // ../../services/relay/dist/pairing.js
 init_esm_shims();
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
 var PAIRING_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
 var PAIRING_CODE_LENGTH = 6;
 var PAIRING_TTL_MS = 5 * 60 * 1e3;
@@ -100763,7 +100818,7 @@ function registerPairingRoutes(deps) {
   app.post("/pairing/initiate", async (c3) => {
     const device = await verifyPairingAuth(c3.req.header("authorization"));
     if (!device) {
-      throw new HTTPException10(401, { message: "Signed device token required for pairing" });
+      throw new HTTPException11(401, { message: "Signed device token required for pairing" });
     }
     const pairingId = crypto.randomUUID();
     const pairingCode = generatePairingCode();
@@ -100779,16 +100834,16 @@ function registerPairingRoutes(deps) {
     const body = await c3.req.json();
     const { pairing_code, device_name, public_key, x25519_pubkey } = body;
     if (!pairing_code || typeof pairing_code !== "string" || !/^[A-Z2-9]{6}$/.test(pairing_code)) {
-      throw new HTTPException10(400, { message: "Invalid pairing code format" });
+      throw new HTTPException11(400, { message: "Invalid pairing code format" });
     }
     if (!device_name || typeof device_name !== "string") {
-      throw new HTTPException10(400, { message: "Missing device_name" });
+      throw new HTTPException11(400, { message: "Missing device_name" });
     }
     if (!public_key || typeof public_key !== "string" || !/^[0-9a-f]{64}$/i.test(public_key)) {
-      throw new HTTPException10(400, { message: "Invalid public_key \u2014 must be 64-char hex string" });
+      throw new HTTPException11(400, { message: "Invalid public_key \u2014 must be 64-char hex string" });
     }
     if (x25519_pubkey != null && (typeof x25519_pubkey !== "string" || !/^[0-9a-f]{64}$/i.test(x25519_pubkey))) {
-      throw new HTTPException10(400, {
+      throw new HTTPException11(400, {
         message: "Invalid x25519_pubkey \u2014 must be 64-char hex string"
       });
     }
@@ -100796,13 +100851,13 @@ function registerPairingRoutes(deps) {
       SELECT * FROM pairing_sessions WHERE pairing_code = ?
     `).get(pairing_code);
     if (!session) {
-      throw new HTTPException10(404, { message: "Invalid pairing code" });
+      throw new HTTPException11(404, { message: "Invalid pairing code" });
     }
     if (session.expires_at < Date.now()) {
-      throw new HTTPException10(410, { message: "Pairing code expired" });
+      throw new HTTPException11(410, { message: "Pairing code expired" });
     }
     if (session.status !== "pending") {
-      throw new HTTPException10(409, { message: "Pairing code already used" });
+      throw new HTTPException11(409, { message: "Pairing code already used" });
     }
     db.prepare(`
       UPDATE pairing_sessions SET status = 'claimed', claiming_device_name = ?, claiming_public_key = ?, claiming_x25519_pubkey = ? WHERE pairing_id = ?
@@ -100812,17 +100867,17 @@ function registerPairingRoutes(deps) {
   app.get("/pairing/:pairingId", async (c3) => {
     const device = await verifyPairingAuth(c3.req.header("authorization"));
     if (!device) {
-      throw new HTTPException10(401, { message: "Signed device token required" });
+      throw new HTTPException11(401, { message: "Signed device token required" });
     }
     const pairingId = c3.req.param("pairingId");
     const session = db.prepare(`
       SELECT * FROM pairing_sessions WHERE pairing_id = ?
     `).get(pairingId);
     if (!session) {
-      throw new HTTPException10(404, { message: "Pairing session not found" });
+      throw new HTTPException11(404, { message: "Pairing session not found" });
     }
     if (session.motebit_id !== device.motebitId) {
-      throw new HTTPException10(403, { message: "Not authorized for this pairing session" });
+      throw new HTTPException11(403, { message: "Not authorized for this pairing session" });
     }
     const result = {
       pairing_id: session.pairing_id,
@@ -100842,20 +100897,20 @@ function registerPairingRoutes(deps) {
   app.post("/pairing/:pairingId/approve", async (c3) => {
     const device = await verifyPairingAuth(c3.req.header("authorization"));
     if (!device) {
-      throw new HTTPException10(401, { message: "Signed device token required" });
+      throw new HTTPException11(401, { message: "Signed device token required" });
     }
     const pairingId = c3.req.param("pairingId");
     const session = db.prepare(`
       SELECT * FROM pairing_sessions WHERE pairing_id = ?
     `).get(pairingId);
     if (!session) {
-      throw new HTTPException10(404, { message: "Pairing session not found" });
+      throw new HTTPException11(404, { message: "Pairing session not found" });
     }
     if (session.motebit_id !== device.motebitId) {
-      throw new HTTPException10(403, { message: "Not authorized for this pairing session" });
+      throw new HTTPException11(403, { message: "Not authorized for this pairing session" });
     }
     if (session.status !== "claimed") {
-      throw new HTTPException10(409, {
+      throw new HTTPException11(409, {
         message: `Cannot approve \u2014 status is '${String(session.status)}'`
       });
     }
@@ -100885,17 +100940,17 @@ function registerPairingRoutes(deps) {
   app.post("/pairing/:pairingId/deny", async (c3) => {
     const device = await verifyPairingAuth(c3.req.header("authorization"));
     if (!device) {
-      throw new HTTPException10(401, { message: "Signed device token required" });
+      throw new HTTPException11(401, { message: "Signed device token required" });
     }
     const pairingId = c3.req.param("pairingId");
     const session = db.prepare(`
       SELECT * FROM pairing_sessions WHERE pairing_id = ?
     `).get(pairingId);
     if (!session) {
-      throw new HTTPException10(404, { message: "Pairing session not found" });
+      throw new HTTPException11(404, { message: "Pairing session not found" });
     }
     if (session.motebit_id !== device.motebitId) {
-      throw new HTTPException10(403, { message: "Not authorized for this pairing session" });
+      throw new HTTPException11(403, { message: "Not authorized for this pairing session" });
     }
     db.prepare(`
       UPDATE pairing_sessions SET status = 'denied' WHERE pairing_id = ?
@@ -100908,7 +100963,7 @@ function registerPairingRoutes(deps) {
       SELECT status, motebit_id, approved_device_id, key_transfer_payload FROM pairing_sessions WHERE pairing_id = ?
     `).get(pairingId);
     if (!session) {
-      throw new HTTPException10(404, { message: "Pairing session not found" });
+      throw new HTTPException11(404, { message: "Pairing session not found" });
     }
     const result = { status: session.status };
     if (session.status === "approved") {
@@ -100927,24 +100982,24 @@ function registerPairingRoutes(deps) {
     const pairingId = c3.req.param("pairingId");
     const body = await c3.req.json();
     if (!body.public_key || typeof body.public_key !== "string" || !/^[0-9a-f]{64}$/i.test(body.public_key)) {
-      throw new HTTPException10(400, { message: "Invalid public_key \u2014 must be 64-char hex string" });
+      throw new HTTPException11(400, { message: "Invalid public_key \u2014 must be 64-char hex string" });
     }
     const session = db.prepare(`
       SELECT pairing_id, status, approved_device_id, motebit_id FROM pairing_sessions WHERE pairing_id = ?
     `).get(pairingId);
     if (!session) {
-      throw new HTTPException10(404, { message: "Pairing session not found" });
+      throw new HTTPException11(404, { message: "Pairing session not found" });
     }
     if (session.status !== "approved") {
-      throw new HTTPException10(409, { message: "Pairing session not approved" });
+      throw new HTTPException11(409, { message: "Pairing session not approved" });
     }
     if (session.approved_device_id == null) {
-      throw new HTTPException10(409, { message: "No approved device" });
+      throw new HTTPException11(409, { message: "No approved device" });
     }
     const deviceId = session.approved_device_id;
     const device = await identityManager.getDevice(deviceId);
     if (!device) {
-      throw new HTTPException10(404, { message: "Approved device not found in identity store" });
+      throw new HTTPException11(404, { message: "Approved device not found in identity store" });
     }
     await identityManager.updateDevicePublicKey(deviceId, body.public_key);
     return c3.json({ ok: true });
@@ -100956,7 +101011,7 @@ init_esm_shims();
 init_dist2();
 init_dist6();
 init_dist5();
-import { HTTPException as HTTPException11 } from "hono/http-exception";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 init_receipts_store();
 var MOTEBIT_RELAY_CLAIM_GENERATOR = "motebit-relay/0.5.2";
 function registerStateExportRoutes(deps) {
@@ -101074,7 +101129,7 @@ function registerStateExportRoutes(deps) {
     const planId = asPlanId(c3.req.param("planId"));
     const plan = moteDb.planStore.getPlan(planId);
     if (!plan || plan.motebit_id !== motebitId) {
-      throw new HTTPException11(404, { message: "Plan not found" });
+      throw new HTTPException12(404, { message: "Plan not found" });
     }
     const steps = moteDb.planStore.getStepsForPlan(planId);
     return emitSignedExport(c3, "plan-detail", {
@@ -101100,7 +101155,7 @@ function registerStateExportRoutes(deps) {
     const motebitId = asMotebitId(c3.req.param("motebitId"));
     const callerMotebitId = c3.get("callerMotebitId");
     if (callerMotebitId != null && callerMotebitId !== "" && callerMotebitId !== motebitId) {
-      throw new HTTPException11(403, {
+      throw new HTTPException12(403, {
         message: "settlement history is first-person: a device token may read only its own motebit's history"
       });
     }
@@ -101186,7 +101241,7 @@ function registerStateExportRoutes(deps) {
     const goalId = c3.req.param("goalId");
     const plan = moteDb.planStore.getPlanForGoal(goalId);
     if (!plan || plan.motebit_id !== motebitId) {
-      throw new HTTPException11(404, { message: "No plan found for goal" });
+      throw new HTTPException12(404, { message: "No plan found for goal" });
     }
     const steps = moteDb.planStore.getStepsForPlan(plan.plan_id);
     const planEventTypes = [
@@ -101384,7 +101439,7 @@ function registerStateExportRoutes(deps) {
 init_esm_shims();
 init_dist2();
 init_dist35();
-import { HTTPException as HTTPException12 } from "hono/http-exception";
+import { HTTPException as HTTPException13 } from "hono/http-exception";
 function registerTrustGraphRoutes(deps) {
   const { app, moteDb, taskRouter } = deps;
   app.get("/api/v1/agent-trust/:motebitId", async (c3) => {
@@ -101405,7 +101460,7 @@ function registerTrustGraphRoutes(deps) {
     const { profiles } = taskRouter.buildCandidateProfiles(void 0, void 0, 100, motebitId);
     const route = findTrustedRoute(asMotebitId(motebitId), asMotebitId(targetId), profiles);
     if (!route) {
-      throw new HTTPException12(404, { message: "No trusted path found" });
+      throw new HTTPException13(404, { message: "No trusted path found" });
     }
     return c3.json({ source: motebitId, target: targetId, trust: route.trust, path: route.path });
   });
@@ -101444,14 +101499,14 @@ init_esm_shims();
 init_dist2();
 init_dist35();
 init_accounts();
-import { HTTPException as HTTPException13 } from "hono/http-exception";
+import { HTTPException as HTTPException14 } from "hono/http-exception";
 function registerListingsRoutes(deps) {
   const { app, moteDb, taskRouter } = deps;
   app.post("/api/v1/agents/:motebitId/listing", async (c3) => {
     const motebitId = asMotebitId(c3.req.param("motebitId"));
     const callerMotebitId = c3.get("callerMotebitId");
     if (callerMotebitId && callerMotebitId !== motebitId) {
-      throw new HTTPException13(403, { message: "Cannot modify another agent's listing" });
+      throw new HTTPException14(403, { message: "Cannot modify another agent's listing" });
     }
     const body = await c3.req.json();
     const now = Date.now();
@@ -101466,7 +101521,7 @@ function registerListingsRoutes(deps) {
     const motebitId = asMotebitId(c3.req.param("motebitId"));
     const row = moteDb.db.prepare(`SELECT * FROM relay_service_listings WHERE motebit_id = ?`).get(motebitId);
     if (!row) {
-      throw new HTTPException13(404, { message: "No service listing found" });
+      throw new HTTPException14(404, { message: "No service listing found" });
     }
     return c3.json({
       listing_id: row.listing_id,
@@ -101552,7 +101607,7 @@ function registerListingsRoutes(deps) {
 
 // ../../services/relay/dist/proposals.js
 init_esm_shims();
-import { HTTPException as HTTPException14 } from "hono/http-exception";
+import { HTTPException as HTTPException15 } from "hono/http-exception";
 function registerProposalRoutes(deps) {
   const { app, moteDb, connections } = deps;
   app.post("/api/v1/proposals", async (c3) => {
@@ -101560,10 +101615,10 @@ function registerProposalRoutes(deps) {
     const body = await c3.req.json();
     const initiatorId = callerMotebitId ?? body.initiator_motebit_id;
     if (!initiatorId) {
-      throw new HTTPException14(400, { message: "Missing initiator_motebit_id" });
+      throw new HTTPException15(400, { message: "Missing initiator_motebit_id" });
     }
     if (!body.proposal_id || !body.plan_id || !Array.isArray(body.participants)) {
-      throw new HTTPException14(400, { message: "Missing required fields" });
+      throw new HTTPException15(400, { message: "Missing required fields" });
     }
     const now = Date.now();
     const expiresAt = now + (body.expires_in_ms ?? 10 * 60 * 1e3);
@@ -101593,7 +101648,7 @@ function registerProposalRoutes(deps) {
     const proposalId = c3.req.param("proposalId");
     const proposal = moteDb.db.prepare("SELECT * FROM relay_proposals WHERE proposal_id = ?").get(proposalId);
     if (!proposal)
-      throw new HTTPException14(404, { message: "Proposal not found" });
+      throw new HTTPException15(404, { message: "Proposal not found" });
     const participants = moteDb.db.prepare("SELECT * FROM relay_proposal_participants WHERE proposal_id = ?").all(proposalId);
     return c3.json({
       proposal_id: proposal.proposal_id,
@@ -101622,12 +101677,12 @@ function registerProposalRoutes(deps) {
     const body = await c3.req.json();
     const responderId = callerMotebitId ?? body.responder_motebit_id;
     if (!responderId || !body.response)
-      throw new HTTPException14(400, { message: "Missing required fields" });
+      throw new HTTPException15(400, { message: "Missing required fields" });
     const proposal = moteDb.db.prepare("SELECT * FROM relay_proposals WHERE proposal_id = ?").get(proposalId);
     if (!proposal)
-      throw new HTTPException14(404, { message: "Proposal not found" });
+      throw new HTTPException15(404, { message: "Proposal not found" });
     if (proposal.status !== "pending")
-      throw new HTTPException14(409, {
+      throw new HTTPException15(409, {
         message: `Proposal is ${proposal.status}, cannot respond`
       });
     const now = Date.now();
@@ -101682,12 +101737,12 @@ function registerProposalRoutes(deps) {
     const proposalId = c3.req.param("proposalId");
     const proposal = moteDb.db.prepare("SELECT * FROM relay_proposals WHERE proposal_id = ?").get(proposalId);
     if (!proposal)
-      throw new HTTPException14(404, { message: "Proposal not found" });
+      throw new HTTPException15(404, { message: "Proposal not found" });
     const callerMotebitId = c3.get("callerMotebitId");
     if (callerMotebitId && callerMotebitId !== proposal.initiator_motebit_id)
-      throw new HTTPException14(403, { message: "Only the initiator can withdraw a proposal" });
+      throw new HTTPException15(403, { message: "Only the initiator can withdraw a proposal" });
     if (proposal.status !== "pending")
-      throw new HTTPException14(409, {
+      throw new HTTPException15(409, {
         message: `Proposal is ${proposal.status}, cannot withdraw`
       });
     moteDb.db.prepare("UPDATE relay_proposals SET status = 'withdrawn', updated_at = ? WHERE proposal_id = ?").run(Date.now(), proposalId);
@@ -101700,7 +101755,7 @@ function registerProposalRoutes(deps) {
     const limit = Math.min(Math.max(parseInt(limitStr ?? "50", 10) || 50, 1), 200);
     const scopeId = callerMotebitId ?? c3.req.query("motebit_id");
     if (!scopeId)
-      throw new HTTPException14(400, { message: "Missing caller identity" });
+      throw new HTTPException15(400, { message: "Missing caller identity" });
     let sql = "SELECT * FROM relay_proposals WHERE (initiator_motebit_id = ? OR proposal_id IN (SELECT proposal_id FROM relay_proposal_participants WHERE motebit_id = ?))";
     const params = [scopeId, scopeId];
     if (status) {
@@ -101728,13 +101783,13 @@ function registerProposalRoutes(deps) {
     const body = await c3.req.json();
     const motebitId = callerMotebitId ?? body.motebit_id;
     if (!motebitId || !body.step_id || !body.status)
-      throw new HTTPException14(400, { message: "Missing required fields" });
+      throw new HTTPException15(400, { message: "Missing required fields" });
     const stepProposal = moteDb.db.prepare("SELECT initiator_motebit_id FROM relay_proposals WHERE proposal_id = ?").get(proposalId);
     if (!stepProposal)
-      throw new HTTPException14(404, { message: "Proposal not found" });
+      throw new HTTPException15(404, { message: "Proposal not found" });
     const isParticipant = moteDb.db.prepare("SELECT 1 FROM relay_proposal_participants WHERE proposal_id = ? AND motebit_id = ?").get(proposalId, motebitId);
     if (!isParticipant && motebitId !== stepProposal.initiator_motebit_id)
-      throw new HTTPException14(403, { message: "Caller is not a participant in this proposal" });
+      throw new HTTPException15(403, { message: "Caller is not a participant in this proposal" });
     const now = Date.now();
     moteDb.db.prepare(`INSERT OR REPLACE INTO relay_collaborative_step_results (proposal_id, step_id, motebit_id, status, result_summary, receipt, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?)`).run(proposalId, body.step_id, motebitId, body.status, body.result_summary ?? null, body.receipt != null ? JSON.stringify(body.receipt) : null, now);
     const participants = moteDb.db.prepare("SELECT motebit_id FROM relay_proposal_participants WHERE proposal_id = ?").all(proposalId);
@@ -101767,7 +101822,7 @@ init_esm_shims();
 init_dist6();
 init_federation();
 init_logger();
-import { HTTPException as HTTPException15 } from "hono/http-exception";
+import { HTTPException as HTTPException16 } from "hono/http-exception";
 var logger25 = createLogger({ service: "key-rotation" });
 function registerKeyRotationRoutes(deps) {
   const { app, moteDb, relayIdentity } = deps;
@@ -101809,43 +101864,43 @@ function registerKeyRotationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const body = await c3.req.json();
     if (!body.old_public_key || !body.new_public_key || !body.timestamp || !body.new_key_signature) {
-      throw new HTTPException15(400, { message: "Missing required fields in key succession record" });
+      throw new HTTPException16(400, { message: "Missing required fields in key succession record" });
     }
     const MAX_ROTATION_AGE_MS = 15 * 60 * 1e3;
     const age = Date.now() - body.timestamp;
     if (age < -6e4) {
-      throw new HTTPException15(400, { message: "Succession record timestamp is in the future" });
+      throw new HTTPException16(400, { message: "Succession record timestamp is in the future" });
     }
     if (age > MAX_ROTATION_AGE_MS) {
-      throw new HTTPException15(400, {
+      throw new HTTPException16(400, {
         message: "Succession record timestamp is too old (>15 minutes)"
       });
     }
     if (body.recovery) {
       if (!body.guardian_signature) {
-        throw new HTTPException15(400, { message: "Guardian recovery requires guardian_signature" });
+        throw new HTTPException16(400, { message: "Guardian recovery requires guardian_signature" });
       }
       const agentGuardian = moteDb.db.prepare("SELECT guardian_public_key FROM agent_registry WHERE motebit_id = ?").get(motebitId);
       const guardianPubKey = agentGuardian?.guardian_public_key;
       if (!guardianPubKey) {
-        throw new HTTPException15(400, {
+        throw new HTTPException16(400, {
           message: "Agent has no guardian registered \u2014 cannot use guardian recovery"
         });
       }
       const valid = await verifyKeySuccession(body, guardianPubKey);
       if (!valid)
-        throw new HTTPException15(400, { message: "Invalid guardian recovery signatures" });
+        throw new HTTPException16(400, { message: "Invalid guardian recovery signatures" });
     } else {
       if (!body.old_key_signature) {
-        throw new HTTPException15(400, { message: "Normal rotation requires old_key_signature" });
+        throw new HTTPException16(400, { message: "Normal rotation requires old_key_signature" });
       }
       const valid = await verifyKeySuccession(body);
       if (!valid)
-        throw new HTTPException15(400, { message: "Invalid key succession signatures" });
+        throw new HTTPException16(400, { message: "Invalid key succession signatures" });
     }
     const storedAgent = moteDb.db.prepare("SELECT public_key FROM agent_registry WHERE motebit_id = ?").get(motebitId);
     if (storedAgent && storedAgent.public_key && storedAgent.public_key !== body.old_public_key) {
-      throw new HTTPException15(400, {
+      throw new HTTPException16(400, {
         message: "Succession old_public_key does not match stored public key"
       });
     }
@@ -101877,10 +101932,10 @@ function registerKeyRotationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const callerMotebitId = c3.get("callerMotebitId");
     if (callerMotebitId && callerMotebitId !== motebitId)
-      throw new HTTPException15(403, { message: "Cannot revoke tokens for another agent" });
+      throw new HTTPException16(403, { message: "Cannot revoke tokens for another agent" });
     const body = await c3.req.json();
     if (!Array.isArray(body.jtis) || body.jtis.length === 0)
-      throw new HTTPException15(400, { message: "jtis must be a non-empty array" });
+      throw new HTTPException16(400, { message: "jtis must be a non-empty array" });
     const expiresAt = Date.now() + 6 * 60 * 1e3;
     const stmt = moteDb.db.prepare("INSERT OR IGNORE INTO relay_token_blacklist (jti, motebit_id, expires_at) VALUES (?, ?, ?)");
     for (const jti of body.jtis) {
@@ -101892,7 +101947,7 @@ function registerKeyRotationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const callerMotebitId = c3.get("callerMotebitId");
     if (callerMotebitId && callerMotebitId !== motebitId)
-      throw new HTTPException15(403, { message: "Cannot revoke another agent" });
+      throw new HTTPException16(403, { message: "Cannot revoke another agent" });
     let compromisedAt;
     const raw = await c3.req.text();
     if (raw.trim().length > 0) {
@@ -101900,12 +101955,12 @@ function registerKeyRotationRoutes(deps) {
       try {
         parsed = JSON.parse(raw);
       } catch {
-        throw new HTTPException15(400, { message: "Invalid JSON body" });
+        throw new HTTPException16(400, { message: "Invalid JSON body" });
       }
       const ca = parsed.compromised_at;
       if (ca !== void 0) {
         if (typeof ca !== "number" || !Number.isFinite(ca) || ca <= 0 || ca > Date.now())
-          throw new HTTPException15(400, {
+          throw new HTTPException16(400, {
             message: "compromised_at must be a positive past epoch-ms timestamp"
           });
         compromisedAt = ca;
@@ -101926,7 +101981,7 @@ function registerKeyRotationRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const body = await c3.req.json();
     if (!body.approval_id || !body.tool_name || !body.args_hash)
-      throw new HTTPException15(400, {
+      throw new HTTPException16(400, {
         message: "approval_id, tool_name, and args_hash are required"
       });
     const quorumRequired = body.quorum_required ?? 1;
@@ -101941,7 +101996,7 @@ function registerKeyRotationRoutes(deps) {
           idempotent: true
         });
       }
-      throw new HTTPException15(409, {
+      throw new HTTPException16(409, {
         message: "Approval already exists with different configuration \u2014 approval metadata is immutable after creation"
       });
     }
@@ -101954,29 +102009,29 @@ function registerKeyRotationRoutes(deps) {
     const approvalId = c3.req.param("approvalId");
     const body = await c3.req.json();
     if (!body.approver_id || body.approved == null || !body.signature)
-      throw new HTTPException15(400, {
+      throw new HTTPException16(400, {
         message: "approver_id, approved, and signature are required"
       });
     const approval = moteDb.db.prepare("SELECT * FROM relay_approval_metadata WHERE approval_id = ?").get(approvalId);
     if (!approval)
-      throw new HTTPException15(404, { message: "Approval not found" });
+      throw new HTTPException16(404, { message: "Approval not found" });
     if (!approval.quorum_hash)
-      throw new HTTPException15(500, {
+      throw new HTTPException16(500, {
         message: "Approval missing quorum_hash \u2014 created before migration. Re-register to fix."
       });
     if (approval.status === "denied")
-      throw new HTTPException15(409, {
+      throw new HTTPException16(409, {
         message: "Approval already denied \u2014 no further votes accepted"
       });
     if (approval.status === "approved")
-      throw new HTTPException15(409, {
+      throw new HTTPException16(409, {
         message: "Approval already met quorum \u2014 no further votes needed"
       });
     if (approval.motebit_id !== motebitId)
-      throw new HTTPException15(403, { message: "Approval does not belong to this agent" });
+      throw new HTTPException16(403, { message: "Approval does not belong to this agent" });
     const authorizedApprovers = JSON.parse(approval.quorum_approvers);
     if (authorizedApprovers.length > 0 && !authorizedApprovers.includes(body.approver_id))
-      throw new HTTPException15(403, { message: "Approver is not authorized for this quorum" });
+      throw new HTTPException16(403, { message: "Approver is not authorized for this quorum" });
     const encoder2 = new TextEncoder();
     const votePayload = canonicalJson({
       type: "approval_vote",
@@ -101989,10 +102044,10 @@ function registerKeyRotationRoutes(deps) {
     });
     const approverAgent = moteDb.db.prepare("SELECT public_key FROM agent_registry WHERE motebit_id = ?").get(body.approver_id);
     if (!approverAgent)
-      throw new HTTPException15(404, { message: "Approver agent not found" });
+      throw new HTTPException16(404, { message: "Approver agent not found" });
     const sigValid = await ed25519Verify(hexToBytes5(body.signature), encoder2.encode(votePayload), hexToBytes5(approverAgent.public_key));
     if (!sigValid)
-      throw new HTTPException15(403, { message: "Vote signature verification failed" });
+      throw new HTTPException16(403, { message: "Vote signature verification failed" });
     const existingVote = moteDb.db.prepare("SELECT 1 FROM relay_approval_votes WHERE approval_id = ? AND approver_id = ?").get(approvalId, body.approver_id);
     if (existingVote != null)
       return c3.json({ ok: true, duplicate: true, approval_id: approvalId });
@@ -102047,7 +102102,7 @@ init_esm_shims();
 init_dist6();
 init_dist();
 init_logger();
-import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
 var logger26 = createLogger({ service: "browser-sandbox" });
 var DEFAULT_SANDBOX_TOKEN_TTL_SEC = 300;
 async function mintBrowserSandboxToken(relayIdentity, motebitId, ttlSec = DEFAULT_SANDBOX_TOKEN_TTL_SEC) {
@@ -102069,7 +102124,7 @@ function registerBrowserSandboxRoutes(deps) {
   app.post("/api/v1/browser-sandbox/token", async (c3) => {
     const callerMotebitId = c3.get("callerMotebitId");
     if (!callerMotebitId) {
-      throw new HTTPException16(401, {
+      throw new HTTPException17(401, {
         message: "Authentication required \u2014 dualAuth did not set callerMotebitId"
       });
     }
@@ -102093,7 +102148,7 @@ init_esm_shims();
 init_dist();
 init_dist6();
 init_logger();
-import { HTTPException as HTTPException17 } from "hono/http-exception";
+import { HTTPException as HTTPException18 } from "hono/http-exception";
 init_accounts();
 init_idempotency();
 var logger27 = createLogger({ service: "budget" });
@@ -102183,7 +102238,7 @@ function registerBudgetRoutes(deps) {
     const correlationId = c3.get("correlationId");
     const idempotencyKeyHeader = c3.req.header("Idempotency-Key");
     if (!idempotencyKeyHeader) {
-      throw new HTTPException17(400, {
+      throw new HTTPException18(400, {
         message: "Idempotency-Key header is required for financial operations"
       });
     }
@@ -102192,7 +102247,7 @@ function registerBudgetRoutes(deps) {
       return c3.json(JSON.parse(idempCheck.body), idempCheck.status);
     }
     if (idempCheck.action === "conflict") {
-      throw new HTTPException17(409, {
+      throw new HTTPException18(409, {
         message: "A request with this idempotency key is already being processed"
       });
     }
@@ -102200,7 +102255,7 @@ function registerBudgetRoutes(deps) {
     if (typeof body.amount !== "number" || body.amount <= 0) {
       const errBody = JSON.stringify({ error: "amount must be a positive number", status: 400 });
       completeIdempotency(moteDb.db, idempotencyKeyHeader, motebitId, 400, errBody);
-      throw new HTTPException17(400, { message: "amount must be a positive number" });
+      throw new HTTPException18(400, { message: "amount must be a positive number" });
     }
     const amountMicro = toMicro(body.amount);
     const idempotencyKey = body.idempotency_key ?? idempotencyKeyHeader;
@@ -102208,7 +102263,7 @@ function registerBudgetRoutes(deps) {
     if (result === null) {
       const errBody = JSON.stringify({ error: "Insufficient balance for withdrawal", status: 402 });
       completeIdempotency(moteDb.db, idempotencyKeyHeader, motebitId, 402, errBody);
-      throw new HTTPException17(402, { message: "Insufficient balance for withdrawal" });
+      throw new HTTPException18(402, { message: "Insufficient balance for withdrawal" });
     }
     if ("existing" in result) {
       logger27.info("withdrawal.endpoint.idempotent", {
@@ -102348,10 +102403,10 @@ function registerBudgetRoutes(deps) {
     const correlationId = c3.get("correlationId");
     const body = await c3.req.json();
     if (!body.payout_reference || typeof body.payout_reference !== "string")
-      throw new HTTPException17(400, { message: "payout_reference is required" });
+      throw new HTTPException18(400, { message: "payout_reference is required" });
     const withdrawal = moteDb.db.prepare("SELECT * FROM relay_withdrawals WHERE withdrawal_id = ? AND status IN ('pending', 'processing')").get(withdrawalId);
     if (!withdrawal)
-      throw new HTTPException17(404, { message: "Withdrawal not found or already completed/failed" });
+      throw new HTTPException18(404, { message: "Withdrawal not found or already completed/failed" });
     const completedAt = Date.now();
     const relayPublicKeyHex = bytesToHex4(relayIdentity.publicKey);
     const signature = await signWithdrawalReceipt2({
@@ -102366,7 +102421,7 @@ function registerBudgetRoutes(deps) {
     }, relayIdentity.privateKey);
     const success2 = completeWithdrawal2(moteDb.db, withdrawalId, body.payout_reference, signature, relayPublicKeyHex, completedAt);
     if (!success2)
-      throw new HTTPException17(404, { message: "Withdrawal not found or already completed/failed" });
+      throw new HTTPException18(404, { message: "Withdrawal not found or already completed/failed" });
     if (body.rail && railRegistry) {
       const rail = railRegistry.get(body.rail);
       if (rail) {
@@ -102410,10 +102465,10 @@ function registerBudgetRoutes(deps) {
     const correlationId = c3.get("correlationId");
     const body = await c3.req.json();
     if (!body.reason || typeof body.reason !== "string")
-      throw new HTTPException17(400, { message: "reason is required" });
+      throw new HTTPException18(400, { message: "reason is required" });
     const success2 = failWithdrawal2(moteDb.db, withdrawalId, body.reason);
     if (!success2)
-      throw new HTTPException17(404, { message: "Withdrawal not found or already completed/failed" });
+      throw new HTTPException18(404, { message: "Withdrawal not found or already completed/failed" });
     logger27.info("withdrawal.admin.failed", { correlationId, withdrawalId, reason: body.reason });
     return c3.json({ withdrawal_id: withdrawalId, status: "failed", refunded: true });
   });
@@ -102434,7 +102489,7 @@ function registerBudgetRoutes(deps) {
     const body = await c3.req.json().catch(() => ({}));
     const reason = typeof body.reason === "string" ? body.reason.trim() : "";
     if (!reason)
-      throw new HTTPException17(400, { message: "reason is required" });
+      throw new HTTPException18(400, { message: "reason is required" });
     persistFreeze(moteDb.db, freezeState, true, reason);
     const authHeader = c3.req.header("authorization") ?? "";
     const tokenHash = (await hash(new TextEncoder().encode(authHeader))).slice(0, 12);
@@ -102459,14 +102514,14 @@ function registerBudgetRoutes(deps) {
   });
   app.post("/api/v1/agents/:motebitId/checkout", async (c3) => {
     if (!stripeRail && (!stripeClient || !stripeConfig))
-      throw new HTTPException17(501, { message: "Stripe is not configured on this relay" });
+      throw new HTTPException18(501, { message: "Stripe is not configured on this relay" });
     const motebitId = c3.req.param("motebitId");
     const correlationId = c3.get("correlationId");
     const body = await c3.req.json();
     if (typeof body.amount !== "number" || body.amount <= 0)
-      throw new HTTPException17(400, { message: "amount must be a positive number (in dollars)" });
+      throw new HTTPException18(400, { message: "amount must be a positive number (in dollars)" });
     if (body.amount < 0.5)
-      throw new HTTPException17(400, { message: "Minimum deposit amount is $0.50" });
+      throw new HTTPException18(400, { message: "Minimum deposit amount is $0.50" });
     let returnUrl;
     if (typeof body.return_url === "string" && body.return_url.length > 0) {
       try {
@@ -102527,10 +102582,10 @@ function registerBudgetRoutes(deps) {
   });
   app.post("/api/v1/stripe/webhook", async (c3) => {
     if (!stripeRail && (!stripeClient || !stripeConfig))
-      throw new HTTPException17(501, { message: "Stripe is not configured on this relay" });
+      throw new HTTPException18(501, { message: "Stripe is not configured on this relay" });
     const sig = c3.req.header("stripe-signature");
     if (!sig)
-      throw new HTTPException17(400, { message: "Missing stripe-signature header" });
+      throw new HTTPException18(400, { message: "Missing stripe-signature header" });
     const rawBody = await c3.req.text();
     let event;
     try {
@@ -102543,7 +102598,7 @@ function registerBudgetRoutes(deps) {
       logger27.info("stripe.webhook.signature_failed", {
         error: err2 instanceof Error ? err2.message : String(err2)
       });
-      throw new HTTPException17(400, { message: "Invalid webhook signature" });
+      throw new HTTPException18(400, { message: "Invalid webhook signature" });
     }
     logger27.info("stripe.webhook.received", { type: event.type, id: event.id });
     if (event.type === "checkout.session.completed") {
@@ -102946,7 +103001,7 @@ init_dist2();
 init_dist35();
 init_dist6();
 init_dist5();
-import { HTTPException as HTTPException18 } from "hono/http-exception";
+import { HTTPException as HTTPException19 } from "hono/http-exception";
 init_accounts();
 init_logger();
 var logger30 = createLogger({ service: "federation-callbacks" });
@@ -103013,7 +103068,7 @@ function createFederationCallbacks(deps) {
     async onTaskResultReceived(verified) {
       const entry = taskQueue.get(verified.taskId);
       if (!entry)
-        throw new HTTPException18(404, { message: "Task not found or expired" });
+        throw new HTTPException19(404, { message: "Task not found or expired" });
       if (verified.receipt.signature) {
         let pubKeyHex;
         let keySource;
@@ -103042,7 +103097,7 @@ function createFederationCallbacks(deps) {
               originRelay: verified.originRelay,
               keySource
             });
-            throw new HTTPException18(403, {
+            throw new HTTPException19(403, {
               message: "Federated receipt signature verification failed"
             });
           }
@@ -103279,7 +103334,7 @@ init_dist6();
 init_dist35();
 init_dist();
 init_accounts();
-import { HTTPException as HTTPException20 } from "hono/http-exception";
+import { HTTPException as HTTPException21 } from "hono/http-exception";
 
 // ../../services/relay/dist/push-adapter.js
 init_esm_shims();
@@ -103444,7 +103499,7 @@ init_dist6();
 init_dist5();
 init_dist31();
 init_logger();
-import { HTTPException as HTTPException19 } from "hono/http-exception";
+import { HTTPException as HTTPException20 } from "hono/http-exception";
 var logger32 = createLogger({ service: "delegation-revocations" });
 function insertDelegationRevocation(db, revocation, receivedAt = Date.now()) {
   const result = db.prepare(`INSERT OR IGNORE INTO relay_delegation_revocations
@@ -103472,17 +103527,17 @@ function registerDelegationRevocationRoutes(deps) {
     try {
       raw = await c3.req.json();
     } catch {
-      throw new HTTPException19(400, { message: "Invalid JSON body" });
+      throw new HTTPException20(400, { message: "Invalid JSON body" });
     }
     const parsed = DelegationRevocationSchema.safeParse(raw);
     if (!parsed.success) {
-      throw new HTTPException19(400, {
+      throw new HTTPException20(400, {
         message: "Body is not a well-formed DelegationRevocation"
       });
     }
     const revocation = parsed.data;
     if (!await verifyDelegationRevocation(revocation)) {
-      throw new HTTPException19(422, { message: "Revocation signature invalid" });
+      throw new HTTPException20(422, { message: "Revocation signature invalid" });
     }
     const recorded = insertDelegationRevocation(db, revocation);
     if (recorded) {
@@ -103501,7 +103556,7 @@ function registerDelegationRevocationRoutes(deps) {
     const sinceRaw = c3.req.query("since");
     const since = sinceRaw !== void 0 ? Number(sinceRaw) : 0;
     if (!Number.isFinite(since) || since < 0) {
-      throw new HTTPException19(400, { message: "Invalid `since` \u2014 expected non-negative ms" });
+      throw new HTTPException20(400, { message: "Invalid `since` \u2014 expected non-negative ms" });
     }
     const { records, nextSince } = listDelegationRevocations(db, since);
     return c3.json({ generated_at: Date.now(), next_since: nextSince, records });
@@ -104604,7 +104659,7 @@ async function registerTaskRoutes(deps) {
           moteDb.db.prepare("INSERT OR IGNORE INTO relay_allocations (allocation_id, task_id, motebit_id, amount_locked, status, created_at) VALUES (?, ?, ?, ?, 'locked', ?)").run(`x402-${taskId}`, taskId, motebitId, priceSnapshot, now);
         }
       } catch (err2) {
-        if (err2 instanceof RelayError || err2 instanceof HTTPException20)
+        if (err2 instanceof RelayError || err2 instanceof HTTPException21)
           throw err2;
         if (requiresPayment) {
           logger33.error("task.budget_hold_failed", {
@@ -104651,7 +104706,7 @@ async function registerTaskRoutes(deps) {
           const targetId = body.target_agent;
           const fc = federatedCandidates.find((c4) => c4.profile.motebit_id === targetId);
           if (fc == null || !remoteAgentRelay.has(targetId)) {
-            throw new HTTPException20(404, {
+            throw new HTTPException21(404, {
               message: "Pinned remote worker not discoverable on any active peer \u2014 cannot place the paid federated task"
             });
           }
@@ -104659,12 +104714,12 @@ async function registerTaskRoutes(deps) {
           const workerAddr = fc._settlement_address;
           const fedPrice = fc.profile.listing?.pricing.find((p5) => requiredCaps.includes(p5.capability));
           if (!workerAddr) {
-            throw new HTTPException20(400, {
+            throw new HTTPException21(400, {
               message: "Discovered remote worker has no settlement_address"
             });
           }
           if (fedPrice == null || fedPrice.unit_cost <= 0) {
-            throw new HTTPException20(400, {
+            throw new HTTPException21(400, {
               message: "Remote worker has no priced listing for the requested capability"
             });
           }
@@ -104674,19 +104729,19 @@ async function registerTaskRoutes(deps) {
           const aTreasury = deriveSolanaAddress2(relayIdentity.publicKey);
           const peerRow = moteDb.db.prepare("SELECT public_key FROM relay_peers WHERE endpoint_url = ? AND state = 'active'").get(peerEndpoint);
           if (!peerRow?.public_key) {
-            throw new HTTPException20(400, {
+            throw new HTTPException21(400, {
               message: "Cannot resolve executor relay treasury (peer public key missing)"
             });
           }
           const bTreasury = deriveSolanaAddress2(hexToBytes5(peerRow.public_key));
           const legErr = proof.to_address !== workerAddr ? "worker leg address" : proof.amount_micro !== workerNetMicro ? `worker leg amount (${proof.amount_micro} \u2260 ${workerNetMicro})` : proof.fee_to_address !== aTreasury ? "origin-fee leg address" : proof.fee_amount_micro !== aFeeMicro ? `origin-fee leg amount (${proof.fee_amount_micro} \u2260 ${aFeeMicro})` : proof.b_fee_to_address !== bTreasury ? "executor-fee leg address" : proof.b_fee_amount_micro !== bFeeMicro ? `executor-fee leg amount (${proof.b_fee_amount_micro} \u2260 ${bFeeMicro})` : null;
           if (legErr) {
-            throw new HTTPException20(400, {
+            throw new HTTPException21(400, {
               message: `Federated P2P payment_proof leg mismatch: ${legErr}`
             });
           }
           if (workerNetMicro + aFeeMicro + bFeeMicro !== budgetMicro) {
-            throw new HTTPException20(500, { message: "Fee split does not conserve budget" });
+            throw new HTTPException21(500, { message: "Fee split does not conserve budget" });
           }
           const p2pEntry = taskQueue.get(taskId);
           if (p2pEntry) {
@@ -104694,7 +104749,7 @@ async function registerTaskRoutes(deps) {
             taskQueue.set(taskId, p2pEntry);
           }
           if (!taskRouter.canForward(peerEndpoint)) {
-            throw new HTTPException20(503, {
+            throw new HTTPException21(503, {
               message: "Executor relay temporarily unavailable (circuit open) \u2014 retry shortly"
             });
           }
@@ -104745,12 +104800,12 @@ async function registerTaskRoutes(deps) {
               });
             } else {
               taskRouter.recordPeerForwardResult(peerEndpoint, false);
-              throw new HTTPException20(502, {
+              throw new HTTPException21(502, {
                 message: `Executor relay rejected the forwarded task (HTTP ${resp.status}) \u2014 retryable: resubmit the same payment_proof`
               });
             }
           } catch (fwdErr) {
-            if (fwdErr instanceof HTTPException20)
+            if (fwdErr instanceof HTTPException21)
               throw fwdErr;
             taskRouter.recordPeerForwardResult(peerEndpoint, false);
             logger33.warn("task.federated_p2p_forward_failed", {
@@ -104759,7 +104814,7 @@ async function registerTaskRoutes(deps) {
               targetAgent: targetId,
               error: fwdErr instanceof Error ? fwdErr.message : String(fwdErr)
             });
-            throw new HTTPException20(502, {
+            throw new HTTPException21(502, {
               message: "Failed to forward federated P2P task to the executor relay \u2014 retryable: resubmit the same payment_proof"
             });
           }
@@ -104821,7 +104876,7 @@ async function registerTaskRoutes(deps) {
                 const fedProfile = federatedCandidates.find((fc) => fc.profile.motebit_id === selId)?.profile;
                 const fedPrice = fedProfile?.listing?.pricing.find((p5) => requiredCaps.includes(p5.capability));
                 if (fedPrice != null && fedPrice.unit_cost > 0) {
-                  throw new HTTPException20(402, {
+                  throw new HTTPException21(402, {
                     message: "Paid federated delegation requires a 3-leg P2P payment_proof (submit with target_agent + payment_proof). Deposit-funded cross-operator settlement is closed. See off-ramp-as-user-action.md."
                   });
                 }
@@ -104894,7 +104949,7 @@ async function registerTaskRoutes(deps) {
           }
         }
       } catch (err2) {
-        if (err2 instanceof HTTPException20)
+        if (err2 instanceof HTTPException21)
           throw err2;
       }
     }
@@ -105273,7 +105328,7 @@ var TaskQueue = class {
 // ../../services/relay/dist/command-route.js
 init_esm_shims();
 init_dist5();
-import { HTTPException as HTTPException21 } from "hono/http-exception";
+import { HTTPException as HTTPException22 } from "hono/http-exception";
 var RELAY_SIDE_COMMANDS = /* @__PURE__ */ new Set(["balance", "deposits", "discover", "proposals"]);
 var RUNTIME_SIDE_COMMANDS = /* @__PURE__ */ new Set([
   "state",
@@ -105303,13 +105358,13 @@ function registerCommandRoutes(deps) {
     const motebitId = c3.req.param("motebitId");
     const body = await c3.req.json();
     if (typeof body.command !== "string" || body.command === "") {
-      throw new HTTPException21(400, { message: "Missing 'command' field" });
+      throw new HTTPException22(400, { message: "Missing 'command' field" });
     }
     const command2 = body.command;
     const args = typeof body.args === "string" ? body.args : void 0;
     const registered = db.prepare("SELECT public_key FROM agent_registry WHERE motebit_id = ?").get(motebitId);
     if (!registered || registered.public_key === "") {
-      throw new HTTPException21(401, {
+      throw new HTTPException22(401, {
         message: "Unknown agent identity \u2014 no registered public key to verify the command against"
       });
     }
@@ -105321,7 +105376,7 @@ function registerCommandRoutes(deps) {
       identityPublicKey: registered.public_key
     });
     if (!verdict.ok) {
-      throw new HTTPException21(401, { message: verdict.reason });
+      throw new HTTPException22(401, { message: verdict.reason });
     }
     if (command2 in INFO_COMMANDS) {
       return c3.json({ summary: INFO_COMMANDS[command2] });
@@ -105332,7 +105387,7 @@ function registerCommandRoutes(deps) {
         return c3.json(result);
       } catch (err2) {
         const msg = err2 instanceof Error ? err2.message : String(err2);
-        throw new HTTPException21(500, { message: `Command failed: ${msg}` });
+        throw new HTTPException22(500, { message: `Command failed: ${msg}` });
       }
     }
     if (RUNTIME_SIDE_COMMANDS.has(command2)) {
@@ -105348,7 +105403,7 @@ function registerCommandRoutes(deps) {
         if (msg === "Command timed out") {
           return c3.json({ summary: "Agent did not respond in time." }, 504);
         }
-        throw new HTTPException21(500, { message: `Command failed: ${msg}` });
+        throw new HTTPException22(500, { message: `Command failed: ${msg}` });
       }
     }
     if (command2 === "mcp") {
@@ -105356,7 +105411,7 @@ function registerCommandRoutes(deps) {
         summary: "MCP server listing is surface-specific and not available remotely."
       });
     }
-    throw new HTTPException21(400, { message: `Unknown command: ${command2}` });
+    throw new HTTPException22(400, { message: `Unknown command: ${command2}` });
   });
   app.get("/__internal/noop", (c3) => c3.text("ok"));
 }
@@ -106066,6 +106121,15 @@ async function createSyncRelay(config) {
     onCommandResponse: handleCommandResponse,
     isDraining: () => draining
   });
+  registerAgentAuthMiddleware({
+    app,
+    apiToken,
+    identityManager,
+    parseTokenPayloadUnsafe,
+    verifySignedTokenForDevice,
+    isTokenBlacklisted,
+    isAgentRevoked
+  });
   registerSyncRoutes({ app, moteDb, eventStore, identityManager, connections });
   registerIntakeRoutes({ app, moteDb, relayIdentity });
   registerAuthMiddleware({
@@ -106299,7 +106363,6 @@ async function createSyncRelay(config) {
     redactSensitiveEvents
   });
   registerTrustGraphRoutes({ app, moteDb, taskRouter });
-  registerListingsRoutes({ app, moteDb, taskRouter });
   registerProposalRoutes({ app, moteDb, connections });
   registerKeyRotationRoutes({ app, moteDb, relayIdentity });
   registerBrowserSandboxRoutes({ app, relayIdentity });
@@ -106355,6 +106418,7 @@ async function createSyncRelay(config) {
     isTokenBlacklisted,
     isAgentRevoked
   });
+  registerListingsRoutes({ app, moteDb, taskRouter });
   registerCommandRoutes({ app, db: moteDb.db, connections, logger: logger43 });
   registerDelegationRevocationRoutes({ app, db: moteDb.db });
   const heartbeatInterval = startHeartbeatLoop(moteDb.db, relayIdentity, 6e4, () => getEmergencyFreeze(), loopSupervisor);