negotium 0.1.13 → 0.1.14

package/dist/main.js

@@ -3324,7 +3324,7 @@ var init_claude_provider = __esm(async () => {
 });
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.1.13";
+var NEGOTIUM_VERSION = "0.1.14";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn2 } from "child_process";
@@ -14799,6 +14799,10 @@ function getRuntimeProcessLease(role, now = Date.now(), staleMs = PROCESS_LEASE_
   const lease = rowToLease2(row);
   return now - lease.heartbeatAt <= staleMs ? lease : null;
 }
+function listRuntimeProcessLeases(rolePrefix = "", now = Date.now(), staleMs = PROCESS_LEASE_STALE_MS) {
+  const rows = rolePrefix ? db.query("SELECT * FROM runtime_process_leases WHERE role LIKE ? ORDER BY role").all(`${rolePrefix}%`) : db.query("SELECT * FROM runtime_process_leases ORDER BY role").all();
+  return rows.map(rowToLease2).filter((lease) => now - lease.heartbeatAt <= staleMs);
+}
 function heartbeatRuntimeProcessLease(role, ownerId, now = Date.now()) {
   const result = db.query(`UPDATE runtime_process_leases
        SET heartbeat_at = ?
@@ -16016,6 +16020,7 @@ __export(exports_src, {
   listVaultEntries: () => listVaultEntries,
   listTopics: () => listTopics,
   listRuntimeTurnLeases: () => listRuntimeTurnLeases,
+  listRuntimeProcessLeases: () => listRuntimeProcessLeases,
   listRuntimeEventsAfter: () => listRuntimeEventsAfter,
   listRunningTopicQueries: () => listRunningTopicQueries,
   listRunningTopicIds: () => listRunningTopicIds,
@@ -17852,14 +17857,17 @@ function createNodeControlHandler(options) {
         const topic = topicForUser(topicId, userId);
         if (!topic)
           return jsonError(404, "Topic not found");
-        const { message } = submitUserMessage({
+        const sourceAdapter = body.sourceAdapter === "telegram" || body.sourceAdapter === "otium" ? body.sourceAdapter : "terminal";
+        const { message, queryId } = submitUserMessage({
           topic,
           userId,
           text: text2,
-          sourceAdapter: "terminal",
+          sourceAdapter,
+          visualTools: body.visualTools === true,
+          fileDeliveryTools: body.fileDeliveryTools === true,
           startTurn: options.startTurn
         });
-        return Response.json({ ok: true, message }, { status: 201 });
+        return Response.json({ ok: true, message, queryId }, { status: 201 });
       }
       const recentMatch = path.match(/^\/topics\/([^/]+)\/recent-events$/);
       if (recentMatch && req.method === "GET") {
@@ -20013,6 +20021,7 @@ async function startDefaultNode(opts = {}) {
 async function runNodeDaemon(opts = {}) {
   const node = await startDefaultNode({
     port: opts.port ?? 0,
+    ...opts.maxRequestBodySize ? { maxRequestBodySize: opts.maxRequestBodySize } : {},
     advertise: true,
     singleton: true
   });
@@ -20629,7 +20638,7 @@ var MAX_CLIPBOARD_BYTES = 1e5;
 
 // ../../adapters/terminal/src/clock.ts
 function terminalNowMs() {
-  return performance.timeOrigin + performance.now();
+  return Date.now();
 }
 
 // ../../adapters/terminal/src/commands.ts
@@ -25688,13 +25697,25 @@ Warning: enable the bot administrator permission "Manage Topics" before creating
     const rememberTarget = (queryId2) => {
       targetByQueryId.set(queryId2, target);
     };
-    const { queryId } = submitUserMessage({
+    const input = {
       topic,
       userId,
       text: prompt,
       sourceAdapter: "telegram",
       visualTools: false,
-      fileDeliveryTools: true,
+      fileDeliveryTools: true
+    };
+    if (opts.submitTurn) {
+      opts.submitTurn(input).then(({ queryId: queryId2 }) => {
+        if (queryId2)
+          rememberTarget(queryId2);
+      }).catch((error) => {
+        logger.error({ err: error, topicId: topic.id }, "telegram adapter: remote turn failed");
+      });
+      return;
+    }
+    const { queryId } = submitUserMessage({
+      ...input,
       onDispatched: rememberTarget,
       startTurn: dispatchTurn
     });
@@ -25883,7 +25904,8 @@ ${caption}` : voiceText : caption;
       }
       case "/abort": {
         const mapping = byKey.get(mappingKey(chatId, threadId));
-        reply(chatId, threadId, mapping && topicService.abortTurn(mapping.topicId, userId) ? "aborted" : "nothing running");
+        const aborted = mapping ? await (opts.abortTurn?.(mapping.topicId, userId) ?? topicService.abortTurn(mapping.topicId, userId)) : false;
+        reply(chatId, threadId, aborted ? "aborted" : "nothing running");
         return;
       }
       case "/agent": {
@@ -26260,7 +26282,7 @@ __export(exports_cli2, {
   runTelegramCli: () => runTelegramCli
 });
 import TelegramBot from "node-telegram-bot-api";
-function startTelegramFromEnv() {
+function startTelegramFromEnv(options = {}) {
   const token = process.env.TELEGRAM_BOT_TOKEN?.trim();
   if (!token)
     throw new Error("TELEGRAM_BOT_TOKEN is required");
@@ -26268,6 +26290,7 @@ function startTelegramFromEnv() {
   const requestedAgent = process.env.TELEGRAM_DEFAULT_AGENT?.trim();
   const forumChatId = Number.parseInt(process.env.TELEGRAM_FORUM_CHAT_ID ?? "", 10);
   const adapter = startTelegramAdapter({
+    ...options,
     client: bot,
     allowedUsers: (process.env.TELEGRAM_ALLOWED_USERS ?? "").split(",").map((value) => value.trim()).filter(Boolean),
     ...process.env.TELEGRAM_VAULT_OWNER_USER_ID?.trim() ? { vaultOwnerTelegramUserId: process.env.TELEGRAM_VAULT_OWNER_USER_ID.trim() } : {},
@@ -26288,38 +26311,101 @@ function startTelegramFromEnv() {
     }
   };
 }
-async function runTelegramCli() {
+async function spawnCanonicalNode() {
+  const entry = process.argv[1];
+  if (!entry)
+    throw new Error("cannot locate the Negotium CLI entrypoint");
+  const child = Bun.spawn({
+    cmd: [process.execPath, entry, "__node-daemon", "--port=0"],
+    detached: true,
+    env: { ...process.env, LOG_LEVEL: process.env.NEGOTIUM_NODE_LOG_LEVEL?.trim() || "info" },
+    stdin: "ignore",
+    stdout: "ignore",
+    stderr: Bun.file(`${LOG_DIR}/node-daemon.log`)
+  });
+  child.unref();
+}
+async function ensureCanonicalNode() {
+  const status = await inspectNodeDaemon();
+  if (!status.running)
+    await spawnCanonicalNode();
+  return waitForNodeDaemon(15000);
+}
+async function runCanonicalNodeChild() {
+  const { runNodeDaemon: runNodeDaemon2 } = await init_src5().then(() => exports_src3);
+  await runNodeDaemon2({ port: 0 });
+}
+async function runTelegramCli(args = process.argv.slice(2)) {
+  if (args[0] === "__node-daemon") {
+    await runCanonicalNodeChild();
+    return;
+  }
   if (!process.env.TELEGRAM_BOT_TOKEN?.trim()) {
     throw new Error("TELEGRAM_BOT_TOKEN is required");
   }
-  let node;
+  const initialNode = await ensureCanonicalNode();
   const singleton = await waitForRequiredRuntimeProcessLease("adapter:telegram", {
     workloadName: "Telegram adapter",
     onLost: () => {
       process.stderr.write(`negotium-telegram: singleton lease lost; shutting down
 `);
-      node?.stop();
+      runShutdown("test");
     }
   });
-  try {
-    node = await startDefaultNode({ port: 0 });
-  } catch (error) {
-    singleton.stop();
-    throw error;
-  }
   let channel;
   try {
-    channel = startTelegramFromEnv();
+    channel = startTelegramFromEnv({
+      abortTurn: async (topicId, userId) => {
+        const node = await waitForNodeDaemon(1500);
+        const response = await fetch(`${node.baseUrl}${NODE_CONTROL_BASE_PATH}/topics/${encodeURIComponent(topicId)}/abort`, {
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${NODE_CONTROL_TOKEN}`,
+            "content-type": "application/json"
+          },
+          body: JSON.stringify({ userId })
+        });
+        const body = await response.json();
+        if (!response.ok)
+          throw new Error(body.error ?? `node returned HTTP ${response.status}`);
+        return body.aborted === true;
+      },
+      submitTurn: async (input) => {
+        const node = await waitForNodeDaemon(1500);
+        const response = await fetch(`${node.baseUrl}${NODE_CONTROL_BASE_PATH}/topics/${encodeURIComponent(input.topic.id)}/messages`, {
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${NODE_CONTROL_TOKEN}`,
+            "content-type": "application/json"
+          },
+          body: JSON.stringify({
+            userId: input.userId,
+            text: input.text,
+            sourceAdapter: input.sourceAdapter,
+            visualTools: input.visualTools,
+            fileDeliveryTools: input.fileDeliveryTools
+          })
+        });
+        const body = await response.json();
+        if (!response.ok)
+          throw new Error(body.error ?? `node returned HTTP ${response.status}`);
+        return { queryId: body.queryId };
+      }
+    });
   } catch (error) {
-    await node.stop();
     singleton.stop();
     throw error;
   }
   onShutdown("telegram-channel", 100, () => channel.stop());
   onShutdown("telegram-singleton", 90, () => singleton.stop());
-  process.stdout.write(`negotium Telegram adapter listening through node :${node.port}
+  let resolveCompleted;
+  const completed = new Promise((resolve13) => {
+    resolveCompleted = resolve13;
+  });
+  onShutdown("telegram-completed", -100, resolveCompleted);
+  process.stdout.write(`negotium Telegram adapter connected to canonical node pid ${initialNode.info?.pid ?? "unknown"}
 `);
-  await node.completed;
+  await completed;
 }
 var init_cli2 = __esm(async () => {
   await init_src();
@@ -26328,37 +26414,6 @@ var init_cli2 = __esm(async () => {
   if (false) {}
 });
 
-// ../../adapters/otium/src/protocol.ts
-function str(body, field) {
-  const value = body[field];
-  return typeof value === "string" && value.trim() ? value : null;
-}
-function parseExecutionSpec(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const raw = value;
-  const agent = str(raw, "agent");
-  const model = str(raw, "model");
-  const effort = str(raw, "effort");
-  const rawMcp = raw.mcp;
-  if (!agent || !model || !effort || !Array.isArray(rawMcp) || !rawMcp.every((entry) => typeof entry === "string" && entry.trim().length > 0) || typeof raw.canSpawnSubagents !== "boolean") {
-    return null;
-  }
-  return {
-    agent,
-    model,
-    effort,
-    ...str(raw, "description") ? { description: str(raw, "description") } : {},
-    mcp: [...new Set(rawMcp.map((entry) => entry.trim()))],
-    canSpawnSubagents: raw.canSpawnSubagents
-  };
-}
-var PEER_PROTOCOL_VERSION = 1, MAX_PEER_MESSAGE_LENGTH = 1e4, MAX_PEER_INPUT_FILE_BYTES, MAX_PEER_INPUT_REQUEST_BYTES;
-var init_protocol = __esm(() => {
-  MAX_PEER_INPUT_FILE_BYTES = 2 * 1024 * 1024 * 1024;
-  MAX_PEER_INPUT_REQUEST_BYTES = MAX_PEER_INPUT_FILE_BYTES + 8 * 1024 * 1024;
-});
-
 // ../../adapters/otium/src/central.ts
 var exports_central = {};
 __export(exports_central, {
@@ -26812,403 +26867,96 @@ var init_join = __esm(async () => {
   await init_src();
 });
 
-// ../../adapters/otium/src/enrollment.ts
-import {
-  createDecipheriv as createDecipheriv2,
-  createPrivateKey,
-  createPublicKey,
-  diffieHellman,
-  generateKeyPairSync,
-  hkdfSync,
-  randomUUID as randomUUID24
-} from "crypto";
-import {
-  chmodSync as chmodSync6,
-  closeSync as closeSync4,
-  existsSync as existsSync26,
-  fsyncSync as fsyncSync3,
-  linkSync as linkSync2,
-  mkdirSync as mkdirSync29,
-  openSync as openSync4,
-  readFileSync as readFileSync21,
-  renameSync as renameSync14,
-  unlinkSync as unlinkSync19,
-  writeFileSync as writeFileSync19
-} from "fs";
-import { dirname as dirname18, resolve as resolve14 } from "path";
-function parseEnrollmentInvite(code) {
-  let parsed;
-  try {
-    parsed = JSON.parse(Buffer.from(code.trim(), "base64url").toString("utf8"));
-  } catch {
-    throw new Error("production invite must be base64url JSON");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("production invite must decode to an object");
-  }
-  const raw = parsed;
-  const central = typeof raw.central === "string" ? raw.central.trim().replace(/\/+$/, "") : "";
-  const token = typeof raw.token === "string" ? raw.token.trim() : "";
-  if (raw.v !== 2 || !central || !token.startsWith("nei_")) {
-    throw new Error("production invite requires {v:2, central:http(s), token:nei_\u2026}");
+// ../../adapters/otium/src/control-protocol.ts
+var OTIUM_ADAPTER_CONTROL_PREFIX = "/api/v1/adapter/otium", OTIUM_ADAPTER_CONTROL_HEADER = "x-negotium-adapter-token";
+
+// ../../adapters/otium/src/protocol.ts
+function str(body, field) {
+  const value = body[field];
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function parseExecutionSpec(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const raw = value;
+  const agent = str(raw, "agent");
+  const model = str(raw, "model");
+  const effort = str(raw, "effort");
+  const rawMcp = raw.mcp;
+  if (!agent || !model || !effort || !Array.isArray(rawMcp) || !rawMcp.every((entry) => typeof entry === "string" && entry.trim().length > 0) || typeof raw.canSpawnSubagents !== "boolean") {
+    return null;
   }
-  assertSecureCentralUrl(central);
-  return { v: 2, central, token };
+  return {
+    agent,
+    model,
+    effort,
+    ...str(raw, "description") ? { description: str(raw, "description") } : {},
+    mcp: [...new Set(rawMcp.map((entry) => entry.trim()))],
+    canSpawnSubagents: raw.canSpawnSubagents
+  };
 }
-function pendingEnrollmentPath() {
-  return resolve14(DATA_DIR, "otium-enrollment-pending.json");
+var PEER_PROTOCOL_VERSION = 1, MAX_PEER_MESSAGE_LENGTH = 1e4, MAX_PEER_INPUT_FILE_BYTES, MAX_PEER_INPUT_REQUEST_BYTES;
+var init_protocol = __esm(() => {
+  MAX_PEER_INPUT_FILE_BYTES = 2 * 1024 * 1024 * 1024;
+  MAX_PEER_INPUT_REQUEST_BYTES = MAX_PEER_INPUT_FILE_BYTES + 8 * 1024 * 1024;
+});
+
+// ../../adapters/otium/src/canonical-mcp-bridge.ts
+import { randomUUID as randomUUID24 } from "crypto";
+function readAuthorization(request) {
+  const value = request.headers.get("authorization");
+  return value?.startsWith("Bearer ") ? value.slice(7) : null;
 }
-function isEnrollmentPending(invite) {
-  const path = pendingEnrollmentPath();
-  if (!existsSync26(path))
-    return false;
+async function readLimitedJson(request) {
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES)
+    return null;
+  const reader = request.body?.getReader();
+  if (!reader)
+    return null;
+  const chunks = [];
+  let size = 0;
+  const deadline = Date.now() + BODY_READ_TIMEOUT_MS;
   try {
-    const saved = JSON.parse(readFileSync21(path, "utf8"));
-    return saved.central === invite.central && saved.token === invite.token;
+    while (true) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        throw new Error("body read timeout");
+      let timer;
+      const { done, value } = await Promise.race([
+        reader.read(),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error("body read timeout")), remaining);
+        })
+      ]).finally(() => {
+        if (timer)
+          clearTimeout(timer);
+      });
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > MAX_BODY_BYTES)
+        throw new Error("body too large");
+      chunks.push(value);
+    }
   } catch {
-    return false;
-  }
-}
-function loadOrCreatePending(invite, nodeName) {
-  const path = pendingEnrollmentPath();
-  if (existsSync26(path)) {
-    const saved = JSON.parse(readFileSync21(path, "utf8"));
-    if (saved.central === invite.central && saved.token === invite.token)
-      return saved;
-    throw new Error(`another Otium enrollment is pending at ${path}`);
+    await reader.cancel().catch(() => {
+      return;
+    });
+    return null;
   }
-  const pair = generateKeyPairSync("x25519");
-  const pending2 = {
-    ...invite,
-    idempotencyKey: randomUUID24(),
-    privateKey: pair.privateKey.export({ format: "der", type: "pkcs8" }).toString("base64url"),
-    publicKey: pair.publicKey.export({ format: "der", type: "spki" }).toString("base64url"),
-    ...nodeName ? { nodeName } : {}
-  };
-  mkdirSync29(dirname18(path), { recursive: true });
-  const temporaryPath = resolve14(dirname18(path), `.otium-enrollment-pending.json.${process.pid}.${randomUUID24()}.tmp`);
-  let fd;
   try {
-    fd = openSync4(temporaryPath, "wx", 384);
-    writeFileSync19(fd, `${JSON.stringify(pending2, null, 2)}
-`, "utf8");
-    fsyncSync3(fd);
-    closeSync4(fd);
-    fd = undefined;
-    linkSync2(temporaryPath, path);
-    unlinkSync19(temporaryPath);
-    chmodSync6(path, 384);
-    const directoryFd = openSync4(dirname18(path), "r");
-    try {
-      fsyncSync3(directoryFd);
-    } finally {
-      closeSync4(directoryFd);
-    }
-  } catch (error) {
-    if (fd !== undefined)
-      closeSync4(fd);
-    if (existsSync26(temporaryPath))
-      unlinkSync19(temporaryPath);
-    if (error.code === "EEXIST" && existsSync26(path)) {
-      const saved = JSON.parse(readFileSync21(path, "utf8"));
-      if (saved.central === invite.central && saved.token === invite.token)
-        return saved;
-    }
-    throw error;
-  }
-  return pending2;
-}
-function replacePendingEnrollment(pending2) {
-  const path = pendingEnrollmentPath();
-  const directory = dirname18(path);
-  const temporaryPath = resolve14(directory, `.otium-enrollment-pending.json.${process.pid}.${randomUUID24()}.tmp`);
-  let fd;
-  try {
-    fd = openSync4(temporaryPath, "wx", 384);
-    writeFileSync19(fd, `${JSON.stringify(pending2, null, 2)}
-`, "utf8");
-    fsyncSync3(fd);
-    closeSync4(fd);
-    fd = undefined;
-    renameSync14(temporaryPath, path);
-    const directoryFd = openSync4(directory, "r");
-    try {
-      fsyncSync3(directoryFd);
-    } finally {
-      closeSync4(directoryFd);
-    }
-  } catch (error) {
-    if (fd !== undefined)
-      closeSync4(fd);
-    if (existsSync26(temporaryPath))
-      unlinkSync19(temporaryPath);
-    throw error;
-  }
-}
-function recordClaimedCredential(pending2, join31) {
-  withJoinCredentialLock(() => {
-    const current3 = JSON.parse(readFileSync21(pendingEnrollmentPath(), "utf8"));
-    if (current3.central !== pending2.central || current3.token !== pending2.token || current3.idempotencyKey !== pending2.idempotencyKey || current3.publicKey !== pending2.publicKey) {
-      throw new Error("pending Otium enrollment changed while its claim was in flight");
-    }
-    const claimed = { digest: joinCredentialDigest(join31), cellId: join31.cellId };
-    if (current3.claimed && (current3.claimed.digest !== claimed.digest || current3.claimed.cellId !== claimed.cellId)) {
-      throw new Error("central returned different credentials for an idempotent enrollment claim");
-    }
-    replacePendingEnrollment({ ...current3, claimed });
-  });
-}
-function openCredential(envelope, privateKeyDer) {
-  if (envelope.v !== 1 || envelope.algorithm !== "X25519-HKDF-SHA256-AES-256-GCM") {
-    throw new Error("unsupported enrollment credential envelope");
-  }
-  const privateKey = createPrivateKey({
-    key: Buffer.from(privateKeyDer, "base64url"),
-    format: "der",
-    type: "pkcs8"
-  });
-  const ephemeral = createPublicKey({
-    key: Buffer.from(envelope.ephemeralPublicKey, "base64url"),
-    format: "der",
-    type: "spki"
-  });
-  const shared = diffieHellman({ privateKey, publicKey: ephemeral });
-  const key = Buffer.from(hkdfSync("sha256", shared, Buffer.from(envelope.salt, "base64url"), INFO, 32));
-  const decipher = createDecipheriv2("aes-256-gcm", key, Buffer.from(envelope.nonce, "base64url"));
-  decipher.setAAD(INFO);
-  decipher.setAuthTag(Buffer.from(envelope.tag, "base64url"));
-  return Buffer.concat([
-    decipher.update(Buffer.from(envelope.ciphertext, "base64url")),
-    decipher.final()
-  ]).toString("utf8");
-}
-async function postJson(url, body, headers) {
-  const response = await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json", ...headers },
-    body: JSON.stringify(body)
-  });
-  const result = await response.json();
-  if (!response.ok)
-    throw new Error(String(result.error || `request failed (${response.status})`));
-  return result;
-}
-async function previewEnrollment(invite) {
-  return postJson(`${invite.central}/api/v1/node-enrollments/preview`, {
-    token: invite.token
-  });
-}
-async function claimEnrollment(invite, nodeName) {
-  const pending2 = loadOrCreatePending(invite, nodeName);
-  const response = await postJson(`${invite.central}/api/v1/node-enrollments/claim`, {
-    token: invite.token,
-    credentialPublicKey: pending2.publicKey,
-    ...pending2.nodeName ? { nodeName: pending2.nodeName } : {}
-  }, { "idempotency-key": pending2.idempotencyKey });
-  const credential = response.credential;
-  const secret = openCredential(credential, pending2.privateKey);
-  if (!secret.startsWith("rcs_"))
-    throw new Error("central returned an invalid runtime credential");
-  const join31 = {
-    v: 2,
-    central: invite.central,
-    relay: String(response.relayUrl),
-    cellId: String(response.cell?.id),
-    secret
-  };
-  if (!join31.relay || !join31.cellId || join31.cellId === "undefined") {
-    throw new Error("central returned an incomplete enrollment response");
-  }
-  assertSecureRelayUrl(join31.relay);
-  recordClaimedCredential(pending2, join31);
-  return join31;
-}
-function commitEnrollment(join31, options = {}) {
-  return withJoinCredentialLock(() => {
-    const pendingPath = pendingEnrollmentPath();
-    const pending2 = existsSync26(pendingPath) ? JSON.parse(readFileSync21(pendingPath, "utf8")) : null;
-    const digest = joinCredentialDigest(join31);
-    if (pending2 && (!pending2.claimed || pending2.claimed.digest !== digest || pending2.claimed.cellId !== join31.cellId)) {
-      throw new Error(`pending Otium enrollment at ${pendingPath} does not match these credentials`);
-    }
-    const path = saveJoinWhileLocked(join31, options);
-    if (!isJoinPersisted(join31)) {
-      throw new Error("Otium join credentials were not durably persisted");
-    }
-    if (!pending2)
-      return path;
-    unlinkSync19(pendingPath);
-    const directoryFd = openSync4(dirname18(pendingPath), "r");
-    try {
-      fsyncSync3(directoryFd);
-    } finally {
-      closeSync4(directoryFd);
-    }
-    return path;
-  });
-}
-var INFO;
-var init_enrollment = __esm(async () => {
-  await init_src();
-  await init_join();
-  INFO = Buffer.from("otium-node-enrollment-v1", "utf8");
-});
-
-// ../../adapters/otium/src/join-cli.ts
-var exports_join_cli = {};
-__export(exports_join_cli, {
-  joinCommand: () => joinCommand
-});
-function option2(args, name) {
-  const index = args.indexOf(`--${name}`);
-  return index >= 0 ? args[index + 1]?.trim() : undefined;
-}
-async function confirmEnrollment(message) {
-  if (!process.stdin.isTTY)
-    return false;
-  const { createInterface } = await import("readline/promises");
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    return /^(?:y|yes)$/i.test((await prompt.question(`${message} [y/N] `)).trim());
-  } finally {
-    prompt.close();
-  }
-}
-async function joinCommand(args) {
-  const code = args[0]?.trim();
-  if (!code) {
-    console.error("usage: negotium-otium join <invite-code> [--yes] [--name <node-name>] [--legacy] [--replace]");
-    process.exitCode = 1;
-    return;
-  }
-  let join31;
-  let productionEnrollment = false;
-  if (args.includes("--legacy")) {
-    try {
-      join31 = parseInviteCode(code);
-    } catch (err2) {
-      console.error(`invalid legacy invite code: ${err2 instanceof Error ? err2.message : err2}`);
-      process.exitCode = 1;
-      return;
-    }
-  } else {
-    try {
-      const invite = parseEnrollmentInvite(code);
-      const resuming = isEnrollmentPending(invite);
-      let nodeName = option2(args, "name");
-      if (resuming) {
-        console.log(`Resuming interrupted Otium enrollment with ${invite.central}`);
-      } else {
-        const preview = await previewEnrollment(invite);
-        const workspace = preview.preview?.workspace;
-        nodeName ||= preview.preview?.suggestedNodeName || undefined;
-        console.log(`Otium workspace: ${workspace?.name ?? workspace?.slug ?? workspace?.id}`);
-        console.log(`  central:   ${invite.central}`);
-        console.log(`  transport: ${preview.preview?.transport ?? "relay"}`);
-        console.log(`  access:    ${preview.preview?.topics ?? "explicitly shared topics only"}`);
-        const accepted = args.includes("--yes") || await confirmEnrollment("Join this workspace?");
-        if (!accepted) {
-          console.log("enrollment cancelled");
-          return;
-        }
-      }
-      join31 = await claimEnrollment(invite, nodeName);
-      productionEnrollment = true;
-    } catch (err2) {
-      console.error(`enrollment failed: ${err2 instanceof Error ? err2.message : err2}`);
-      process.exitCode = 1;
-      return;
-    }
-  }
-  let path;
-  try {
-    const saveOptions = { replaceExisting: args.includes("--replace") };
-    path = productionEnrollment ? commitEnrollment(join31, saveOptions) : saveJoin(join31, saveOptions);
-  } catch (err2) {
-    console.error(`could not save join credentials: ${err2 instanceof Error ? err2.message : err2}`);
-    process.exitCode = 1;
-    return;
-  }
-  console.log(`otium join credentials saved to ${path}`);
-  console.log(`  central: ${join31.central}`);
-  console.log(`  cellId:  ${join31.cellId}`);
-  configureOtiumCentral(join31);
-  try {
-    const self = await selfPeerNode();
-    if (self) {
-      console.log(`attached to workspace as "${self.nodeName ?? self.cellId}" (baseUrl ${self.baseUrl})`);
-    } else {
-      console.warn("warning: central answered but this cell has no visible assignment yet \u2014 check the workspace assignment");
-    }
-  } catch (err2) {
-    console.warn(`warning: could not verify against central (${err2 instanceof Error ? err2.message : err2}) \u2014 credentials saved anyway`);
-  } finally {
-    configureOtiumCentral(null);
-  }
-  console.log("\nnext: `negotium-otium serve` (mounts the otium peer routes automatically)");
-}
-var init_join_cli = __esm(async () => {
-  await init_central();
-  await init_enrollment();
-  await init_join();
-});
-
-// ../../adapters/otium/src/canonical-mcp-bridge.ts
-import { randomUUID as randomUUID25 } from "crypto";
-function readAuthorization(request) {
-  const value = request.headers.get("authorization");
-  return value?.startsWith("Bearer ") ? value.slice(7) : null;
-}
-async function readLimitedJson(request) {
-  const declared = Number(request.headers.get("content-length") ?? "0");
-  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES)
-    return null;
-  const reader = request.body?.getReader();
-  if (!reader)
-    return null;
-  const chunks = [];
-  let size = 0;
-  const deadline = Date.now() + BODY_READ_TIMEOUT_MS;
-  try {
-    while (true) {
-      const remaining = deadline - Date.now();
-      if (remaining <= 0)
-        throw new Error("body read timeout");
-      let timer;
-      const { done, value } = await Promise.race([
-        reader.read(),
-        new Promise((_, reject) => {
-          timer = setTimeout(() => reject(new Error("body read timeout")), remaining);
-        })
-      ]).finally(() => {
-        if (timer)
-          clearTimeout(timer);
-      });
-      if (done)
-        break;
-      size += value.byteLength;
-      if (size > MAX_BODY_BYTES)
-        throw new Error("body too large");
-      chunks.push(value);
-    }
-  } catch {
-    await reader.cancel().catch(() => {
-      return;
-    });
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return null;
-    const body = parsed;
-    if (typeof body.tool !== "string" || body.tool.length > 128)
-      return null;
-    if (!body.input || typeof body.input !== "object" || Array.isArray(body.input))
-      return null;
-    return { tool: body.tool, input: body.input };
-  } catch {
-    return null;
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return null;
+    const body = parsed;
+    if (typeof body.tool !== "string" || body.tool.length > 128)
+      return null;
+    if (!body.input || typeof body.input !== "object" || Array.isArray(body.input))
+      return null;
+    return { tool: body.tool, input: body.input };
+  } catch {
+    return null;
   }
 }
 async function forwardCanonicalTool(capability, request) {
@@ -27295,7 +27043,7 @@ function startCanonicalMcpBridge(options = {}) {
   const url = `http://127.0.0.1:${server.port}/`;
   const unregister = registerCanonicalMcpBridgeEnvProvider((scope) => {
     sweep();
-    const token = `${randomUUID25()}${randomUUID25()}`;
+    const token = `${randomUUID24()}${randomUUID24()}`;
     capabilities.set(token, {
       surface: scope.surface,
       userId: scope.userId,
@@ -27844,7 +27592,7 @@ function createTurnForwarder(opts) {
           logger.warn({ requestId, seq, type: event.type, attempt, error: result.error }, "otium: peer event delivery to hub failed");
           if (attempt < PEER_EVENT_MAX_ATTEMPTS) {
             const delayMs = retryBaseMs * 2 ** (attempt - 1);
-            await new Promise((resolve15) => setTimeout(resolve15, delayMs));
+            await new Promise((resolve14) => setTimeout(resolve14, delayMs));
           }
         }
         forwarder.deliveryBlocked = true;
@@ -27983,8 +27731,8 @@ var init_event_backflow = __esm(async () => {
 });
 
 // ../../adapters/otium/src/peer-files.ts
-import { randomUUID as randomUUID26 } from "crypto";
-import { copyFileSync as copyFileSync3, mkdirSync as mkdirSync30, rmSync as rmSync6, statSync as statSync12 } from "fs";
+import { randomUUID as randomUUID25 } from "crypto";
+import { copyFileSync as copyFileSync3, mkdirSync as mkdirSync29, rmSync as rmSync6, statSync as statSync12 } from "fs";
 import { basename as basename8, extname as extname5, join as join31 } from "path";
 function fileType(mimeType) {
   if (mimeType.startsWith("image/"))
@@ -28053,8 +27801,8 @@ function recordFile(args) {
   });
 }
 function insertLocalFile(args) {
-  const id = randomUUID26();
-  mkdirSync30(PEER_FILES_DIR, { recursive: true });
+  const id = randomUUID25();
+  mkdirSync29(PEER_FILES_DIR, { recursive: true });
   const path = join31(PEER_FILES_DIR, `${id}-${safeFilename(args.filename)}`);
   copyFileSync3(args.sourcePath, path);
   return recordFile({ id, path, sizeBytes: statSync12(path).size, ...args });
@@ -28066,8 +27814,8 @@ function deletePeerFilesForTopic(topicId) {
     rmSync6(row.path, { force: true });
 }
 async function storePeerInputFile(file, access) {
-  const id = randomUUID26();
-  mkdirSync30(PEER_FILES_DIR, { recursive: true });
+  const id = randomUUID25();
+  mkdirSync29(PEER_FILES_DIR, { recursive: true });
   const filename = file.name || "upload";
   const path = join31(PEER_FILES_DIR, `${id}-${safeFilename(filename)}`);
   const sizeBytes = await Bun.write(path, file);
@@ -28132,7 +27880,7 @@ var init_peer_files = __esm(async () => {
 });
 
 // ../../adapters/otium/src/runtime-bridge.ts
-import { randomUUID as randomUUID27 } from "crypto";
+import { randomUUID as randomUUID26 } from "crypto";
 function isMcpToolResult(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return false;
@@ -28202,7 +27950,7 @@ var init_runtime_bridge = __esm(async () => {
       } catch (error) {
         return errorResult(`Error: Failed to open hub question: ${error.message}`);
       }
-      const bridgeRequestId = `bridge-ask-${randomUUID27()}`;
+      const bridgeRequestId = `bridge-ask-${randomUUID26()}`;
       const baseUrl = hubNode.baseUrl.replace(/\/+$/, "");
       const post = async (path, body) => {
         const response = await fetch(`${baseUrl}${path}`, {
@@ -29418,6 +29166,248 @@ var init_bindings = __esm(async () => {
   await init_store2();
 });
 
+// ../../adapters/otium/src/enrollment.ts
+import {
+  createDecipheriv as createDecipheriv2,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  hkdfSync,
+  randomUUID as randomUUID27
+} from "crypto";
+import {
+  chmodSync as chmodSync6,
+  closeSync as closeSync4,
+  existsSync as existsSync26,
+  fsyncSync as fsyncSync3,
+  linkSync as linkSync2,
+  mkdirSync as mkdirSync30,
+  openSync as openSync4,
+  readFileSync as readFileSync21,
+  renameSync as renameSync14,
+  unlinkSync as unlinkSync19,
+  writeFileSync as writeFileSync19
+} from "fs";
+import { dirname as dirname18, resolve as resolve14 } from "path";
+function parseEnrollmentInvite(code) {
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(code.trim(), "base64url").toString("utf8"));
+  } catch {
+    throw new Error("production invite must be base64url JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("production invite must decode to an object");
+  }
+  const raw = parsed;
+  const central = typeof raw.central === "string" ? raw.central.trim().replace(/\/+$/, "") : "";
+  const token = typeof raw.token === "string" ? raw.token.trim() : "";
+  if (raw.v !== 2 || !central || !token.startsWith("nei_")) {
+    throw new Error("production invite requires {v:2, central:http(s), token:nei_\u2026}");
+  }
+  assertSecureCentralUrl(central);
+  return { v: 2, central, token };
+}
+function pendingEnrollmentPath() {
+  return resolve14(DATA_DIR, "otium-enrollment-pending.json");
+}
+function isEnrollmentPending(invite) {
+  const path = pendingEnrollmentPath();
+  if (!existsSync26(path))
+    return false;
+  try {
+    const saved = JSON.parse(readFileSync21(path, "utf8"));
+    return saved.central === invite.central && saved.token === invite.token;
+  } catch {
+    return false;
+  }
+}
+function loadOrCreatePending(invite, nodeName) {
+  const path = pendingEnrollmentPath();
+  if (existsSync26(path)) {
+    const saved = JSON.parse(readFileSync21(path, "utf8"));
+    if (saved.central === invite.central && saved.token === invite.token)
+      return saved;
+    throw new Error(`another Otium enrollment is pending at ${path}`);
+  }
+  const pair = generateKeyPairSync("x25519");
+  const pending2 = {
+    ...invite,
+    idempotencyKey: randomUUID27(),
+    privateKey: pair.privateKey.export({ format: "der", type: "pkcs8" }).toString("base64url"),
+    publicKey: pair.publicKey.export({ format: "der", type: "spki" }).toString("base64url"),
+    ...nodeName ? { nodeName } : {}
+  };
+  mkdirSync30(dirname18(path), { recursive: true });
+  const temporaryPath = resolve14(dirname18(path), `.otium-enrollment-pending.json.${process.pid}.${randomUUID27()}.tmp`);
+  let fd;
+  try {
+    fd = openSync4(temporaryPath, "wx", 384);
+    writeFileSync19(fd, `${JSON.stringify(pending2, null, 2)}
+`, "utf8");
+    fsyncSync3(fd);
+    closeSync4(fd);
+    fd = undefined;
+    linkSync2(temporaryPath, path);
+    unlinkSync19(temporaryPath);
+    chmodSync6(path, 384);
+    const directoryFd = openSync4(dirname18(path), "r");
+    try {
+      fsyncSync3(directoryFd);
+    } finally {
+      closeSync4(directoryFd);
+    }
+  } catch (error) {
+    if (fd !== undefined)
+      closeSync4(fd);
+    if (existsSync26(temporaryPath))
+      unlinkSync19(temporaryPath);
+    if (error.code === "EEXIST" && existsSync26(path)) {
+      const saved = JSON.parse(readFileSync21(path, "utf8"));
+      if (saved.central === invite.central && saved.token === invite.token)
+        return saved;
+    }
+    throw error;
+  }
+  return pending2;
+}
+function replacePendingEnrollment(pending2) {
+  const path = pendingEnrollmentPath();
+  const directory = dirname18(path);
+  const temporaryPath = resolve14(directory, `.otium-enrollment-pending.json.${process.pid}.${randomUUID27()}.tmp`);
+  let fd;
+  try {
+    fd = openSync4(temporaryPath, "wx", 384);
+    writeFileSync19(fd, `${JSON.stringify(pending2, null, 2)}
+`, "utf8");
+    fsyncSync3(fd);
+    closeSync4(fd);
+    fd = undefined;
+    renameSync14(temporaryPath, path);
+    const directoryFd = openSync4(directory, "r");
+    try {
+      fsyncSync3(directoryFd);
+    } finally {
+      closeSync4(directoryFd);
+    }
+  } catch (error) {
+    if (fd !== undefined)
+      closeSync4(fd);
+    if (existsSync26(temporaryPath))
+      unlinkSync19(temporaryPath);
+    throw error;
+  }
+}
+function recordClaimedCredential(pending2, join32) {
+  withJoinCredentialLock(() => {
+    const current3 = JSON.parse(readFileSync21(pendingEnrollmentPath(), "utf8"));
+    if (current3.central !== pending2.central || current3.token !== pending2.token || current3.idempotencyKey !== pending2.idempotencyKey || current3.publicKey !== pending2.publicKey) {
+      throw new Error("pending Otium enrollment changed while its claim was in flight");
+    }
+    const claimed = { digest: joinCredentialDigest(join32), cellId: join32.cellId };
+    if (current3.claimed && (current3.claimed.digest !== claimed.digest || current3.claimed.cellId !== claimed.cellId)) {
+      throw new Error("central returned different credentials for an idempotent enrollment claim");
+    }
+    replacePendingEnrollment({ ...current3, claimed });
+  });
+}
+function openCredential(envelope, privateKeyDer) {
+  if (envelope.v !== 1 || envelope.algorithm !== "X25519-HKDF-SHA256-AES-256-GCM") {
+    throw new Error("unsupported enrollment credential envelope");
+  }
+  const privateKey = createPrivateKey({
+    key: Buffer.from(privateKeyDer, "base64url"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const ephemeral = createPublicKey({
+    key: Buffer.from(envelope.ephemeralPublicKey, "base64url"),
+    format: "der",
+    type: "spki"
+  });
+  const shared = diffieHellman({ privateKey, publicKey: ephemeral });
+  const key = Buffer.from(hkdfSync("sha256", shared, Buffer.from(envelope.salt, "base64url"), INFO, 32));
+  const decipher = createDecipheriv2("aes-256-gcm", key, Buffer.from(envelope.nonce, "base64url"));
+  decipher.setAAD(INFO);
+  decipher.setAuthTag(Buffer.from(envelope.tag, "base64url"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(envelope.ciphertext, "base64url")),
+    decipher.final()
+  ]).toString("utf8");
+}
+async function postJson(url, body, headers) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...headers },
+    body: JSON.stringify(body)
+  });
+  const result = await response.json();
+  if (!response.ok)
+    throw new Error(String(result.error || `request failed (${response.status})`));
+  return result;
+}
+async function previewEnrollment(invite) {
+  return postJson(`${invite.central}/api/v1/node-enrollments/preview`, {
+    token: invite.token
+  });
+}
+async function claimEnrollment(invite, nodeName) {
+  const pending2 = loadOrCreatePending(invite, nodeName);
+  const response = await postJson(`${invite.central}/api/v1/node-enrollments/claim`, {
+    token: invite.token,
+    credentialPublicKey: pending2.publicKey,
+    ...pending2.nodeName ? { nodeName: pending2.nodeName } : {}
+  }, { "idempotency-key": pending2.idempotencyKey });
+  const credential = response.credential;
+  const secret = openCredential(credential, pending2.privateKey);
+  if (!secret.startsWith("rcs_"))
+    throw new Error("central returned an invalid runtime credential");
+  const join32 = {
+    v: 2,
+    central: invite.central,
+    relay: String(response.relayUrl),
+    cellId: String(response.cell?.id),
+    secret
+  };
+  if (!join32.relay || !join32.cellId || join32.cellId === "undefined") {
+    throw new Error("central returned an incomplete enrollment response");
+  }
+  assertSecureRelayUrl(join32.relay);
+  recordClaimedCredential(pending2, join32);
+  return join32;
+}
+function commitEnrollment(join32, options = {}) {
+  return withJoinCredentialLock(() => {
+    const pendingPath = pendingEnrollmentPath();
+    const pending2 = existsSync26(pendingPath) ? JSON.parse(readFileSync21(pendingPath, "utf8")) : null;
+    const digest = joinCredentialDigest(join32);
+    if (pending2 && (!pending2.claimed || pending2.claimed.digest !== digest || pending2.claimed.cellId !== join32.cellId)) {
+      throw new Error(`pending Otium enrollment at ${pendingPath} does not match these credentials`);
+    }
+    const path = saveJoinWhileLocked(join32, options);
+    if (!isJoinPersisted(join32)) {
+      throw new Error("Otium join credentials were not durably persisted");
+    }
+    if (!pending2)
+      return path;
+    unlinkSync19(pendingPath);
+    const directoryFd = openSync4(dirname18(pendingPath), "r");
+    try {
+      fsyncSync3(directoryFd);
+    } finally {
+      closeSync4(directoryFd);
+    }
+    return path;
+  });
+}
+var INFO;
+var init_enrollment = __esm(async () => {
+  await init_src();
+  await init_join();
+  INFO = Buffer.from("otium-node-enrollment-v1", "utf8");
+});
+
 // ../../adapters/otium/src/turn-bridge.ts
 import { randomUUID as randomUUID28 } from "crypto";
 function executionFor(payload) {
@@ -30205,67 +30195,20 @@ async function handleOtiumPeerRequest(req) {
   }
 }
 var RUNTIME_VERSION;
-var init_peer_server = __esm(async () => {
-  await init_src();
-  await init_bindings();
-  await init_central();
-  await init_peer_files();
-  init_protocol();
-  await init_session_bridge();
-  await init_store2();
-  await init_turn_bridge();
-  RUNTIME_VERSION = NEGOTIUM_VERSION;
-});
-
-// ../../adapters/otium/src/index.ts
-var exports_src5 = {};
-__export(exports_src5, {
-  verifyPeerToken: () => verifyPeerToken,
-  unbindOtiumTopic: () => unbindOtiumTopic,
-  translateBusEvent: () => translateBusEvent,
-  stopEventBackflow: () => stopEventBackflow,
-  startOtiumWorker: () => startOtiumWorker,
-  startOtiumAdapter: () => startOtiumAdapter,
-  startEventBackflow: () => startEventBackflow,
-  shareOtiumTopic: () => shareOtiumTopic,
-  setOtiumTopicPrivate: () => setOtiumTopicPrivate,
-  selfPeerNode: () => selfPeerNode,
-  saveJoin: () => saveJoin,
-  runPeerTurn: () => runPeerTurn,
-  resolvePeerNodeByCellId: () => resolvePeerNodeByCellId,
-  resetPeerCentralCaches: () => resetPeerCentralCaches,
-  registerTurnForwarder: () => registerTurnForwarder,
-  provisionMirrorTopic: () => provisionMirrorTopic,
-  previewEnrollment: () => previewEnrollment,
-  pendingEnrollmentPath: () => pendingEnrollmentPath,
-  parseInviteCode: () => parseInviteCode,
-  parseEnrollmentInvite: () => parseEnrollmentInvite,
-  otiumPeerRuntimeBridge: () => otiumPeerRuntimeBridge,
-  otiumCentralConfig: () => otiumCentralConfig,
-  otiumAdapter: () => otiumAdapter,
-  mintPeerToken: () => mintPeerToken,
-  loadJoin: () => loadJoin,
-  listPeerNodes: () => listPeerNodes,
-  listOtiumTopicBindings: () => listOtiumTopicBindings,
-  joinFilePath: () => joinFilePath,
-  isJoinPersisted: () => isJoinPersisted,
-  isEnrollmentPending: () => isEnrollmentPending,
-  hubEventSender: () => hubEventSender,
-  handleOtiumPeerRequest: () => handleOtiumPeerRequest,
-  getActiveForwarder: () => getActiveForwarder,
-  failInterruptedPeerTurnRequestsOnStartup: () => failInterruptedPeerTurnRequestsOnStartup,
-  createTurnForwarder: () => createTurnForwarder,
-  configureOtiumCentral: () => configureOtiumCentral,
-  commitEnrollment: () => commitEnrollment,
-  cleanupPeerStateForLocalTopic: () => cleanupPeerStateForLocalTopic,
-  claimEnrollment: () => claimEnrollment,
-  bindOtiumTopic: () => bindOtiumTopic,
-  abortHostedPeerTurn: () => abortHostedPeerTurn,
-  TunnelClient: () => TunnelClient,
-  RELAY_PROTOCOL_VERSION: () => PROTOCOL_VERSION,
-  PEER_PROTOCOL_VERSION: () => PEER_PROTOCOL_VERSION
+var init_peer_server = __esm(async () => {
+  await init_src();
+  await init_bindings();
+  await init_central();
+  await init_peer_files();
+  init_protocol();
+  await init_session_bridge();
+  await init_store2();
+  await init_turn_bridge();
+  RUNTIME_VERSION = NEGOTIUM_VERSION;
 });
-function startOtiumAdapter(options) {
+
+// ../../adapters/otium/src/index.ts
+function startOtiumNodeRuntime(options) {
   const { join: join32 } = options;
   configureOtiumCentral(join32);
   const failed = failInterruptedPeerTurnRequestsOnStartup();
@@ -30293,7 +30236,6 @@ function startOtiumAdapter(options) {
     }
   });
   let stopped = false;
-  let tunnel = null;
   logger.info({ central: join32.central, cellId: join32.cellId }, "otium: worker mode enabled");
   selfPeerNode().then((self) => {
     if (self) {
@@ -30305,17 +30247,40 @@ function startOtiumAdapter(options) {
   return {
     name: "otium",
     join: join32,
+    stop: () => {
+      if (stopped)
+        return;
+      stopped = true;
+      unsubscribeTopicCleanup();
+      unregisterRuntimeBridge();
+      unregisterSessionBridge();
+      sessionBridgeIpc.stop();
+      canonicalMcpBridge.stop();
+      stopPeerReplyOutbox();
+      uninstallFileHooks();
+      stopBackflow();
+      configureOtiumCentral(null);
+    }
+  };
+}
+function startOtiumAdapter(options) {
+  const runtime = startOtiumNodeRuntime(options);
+  let tunnel = null;
+  let stopped = false;
+  return {
+    name: "otium",
+    join: runtime.join,
     startTunnel: ({ targetOrigin, relayUrl }) => {
       if (stopped || tunnel)
         return;
-      const selectedRelay = relayUrl?.trim() || join32.relay || process.env.OTIUM_RELAY_URL?.trim();
+      const selectedRelay = relayUrl?.trim() || runtime.join.relay || process.env.OTIUM_RELAY_URL?.trim();
       if (!selectedRelay) {
         logger.info({}, "otium: relay tunnel disabled (no relay URL configured)");
         return;
       }
       tunnel = new TunnelClient({
         relayUrl: selectedRelay,
-        token: join32.secret,
+        token: runtime.join.secret,
         targetOrigin,
         nodeVersion: `negotium@${NEGOTIUM_VERSION}`,
         logger
@@ -30328,24 +30293,10 @@ function startOtiumAdapter(options) {
       stopped = true;
       tunnel?.stop();
       tunnel = null;
-      unsubscribeTopicCleanup();
-      unregisterRuntimeBridge();
-      unregisterSessionBridge();
-      sessionBridgeIpc.stop();
-      canonicalMcpBridge.stop();
-      stopPeerReplyOutbox();
-      uninstallFileHooks();
-      stopBackflow();
-      configureOtiumCentral(null);
+      runtime.stop();
     }
   };
 }
-function startOtiumWorker() {
-  const join32 = loadJoin();
-  if (!join32)
-    return null;
-  return startOtiumAdapter({ join: join32 });
-}
 var otiumAdapter;
 var init_src8 = __esm(async () => {
   await init_src();
@@ -30387,6 +30338,245 @@ var init_src8 = __esm(async () => {
   });
 });
 
+// ../../adapters/otium/src/node-runtime.ts
+var exports_node_runtime = {};
+__export(exports_node_runtime, {
+  mountConfiguredOtiumNodeRuntime: () => mountConfiguredOtiumNodeRuntime,
+  handleOtiumAdapterControlRequest: () => handleOtiumAdapterControlRequest,
+  OTIUM_ADAPTER_CONTROL_PREFIX: () => OTIUM_ADAPTER_CONTROL_PREFIX,
+  OTIUM_ADAPTER_CONTROL_HEADER: () => OTIUM_ADAPTER_CONTROL_HEADER,
+  MAX_PEER_INPUT_REQUEST_BYTES: () => MAX_PEER_INPUT_REQUEST_BYTES
+});
+async function handleOtiumAdapterControlRequest(req) {
+  const url = new URL(req.url);
+  if (!url.pathname.startsWith(`${OTIUM_ADAPTER_CONTROL_PREFIX}/`))
+    return null;
+  if (req.headers.get(OTIUM_ADAPTER_CONTROL_HEADER) !== NODE_CONTROL_TOKEN) {
+    return Response.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  }
+  const peerPath = url.pathname.slice(OTIUM_ADAPTER_CONTROL_PREFIX.length) || "/";
+  const peerUrl = new URL(req.url);
+  peerUrl.pathname = peerPath;
+  const headers = new Headers(req.headers);
+  headers.delete(OTIUM_ADAPTER_CONTROL_HEADER);
+  const body = req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer();
+  return await handleOtiumPeerRequest(new Request(peerUrl.toString(), { method: req.method, headers, body, signal: req.signal })) ?? Response.json({ ok: false, error: "Otium route not found" }, { status: 404 });
+}
+function mountConfiguredOtiumNodeRuntime() {
+  const join32 = loadJoin();
+  if (!join32)
+    return null;
+  const runtime = startOtiumNodeRuntime({ join: join32 });
+  registerNodeRequestHandler("otium-adapter-control", handleOtiumAdapterControlRequest);
+  let stopped = false;
+  return {
+    ...runtime,
+    stop() {
+      if (stopped)
+        return;
+      stopped = true;
+      unregisterNodeRequestHandler("otium-adapter-control");
+      runtime.stop();
+    }
+  };
+}
+var init_node_runtime = __esm(async () => {
+  await init_src();
+  await init_src8();
+  await init_join();
+  await init_peer_server();
+  init_protocol();
+});
+
+// ../../adapters/otium/src/join-cli.ts
+var exports_join_cli = {};
+__export(exports_join_cli, {
+  joinCommand: () => joinCommand
+});
+function option2(args, name) {
+  const index = args.indexOf(`--${name}`);
+  return index >= 0 ? args[index + 1]?.trim() : undefined;
+}
+async function confirmEnrollment(message) {
+  if (!process.stdin.isTTY)
+    return false;
+  const { createInterface } = await import("readline/promises");
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return /^(?:y|yes)$/i.test((await prompt.question(`${message} [y/N] `)).trim());
+  } finally {
+    prompt.close();
+  }
+}
+async function joinCommand(args) {
+  const code = args[0]?.trim();
+  if (!code) {
+    console.error("usage: negotium-otium join <invite-code> [--yes] [--name <node-name>] [--legacy] [--replace]");
+    process.exitCode = 1;
+    return;
+  }
+  let join32;
+  let productionEnrollment = false;
+  if (args.includes("--legacy")) {
+    try {
+      join32 = parseInviteCode(code);
+    } catch (err2) {
+      console.error(`invalid legacy invite code: ${err2 instanceof Error ? err2.message : err2}`);
+      process.exitCode = 1;
+      return;
+    }
+  } else {
+    try {
+      const invite = parseEnrollmentInvite(code);
+      const resuming = isEnrollmentPending(invite);
+      let nodeName = option2(args, "name");
+      if (resuming) {
+        console.log(`Resuming interrupted Otium enrollment with ${invite.central}`);
+      } else {
+        const preview = await previewEnrollment(invite);
+        const workspace = preview.preview?.workspace;
+        nodeName ||= preview.preview?.suggestedNodeName || undefined;
+        console.log(`Otium workspace: ${workspace?.name ?? workspace?.slug ?? workspace?.id}`);
+        console.log(`  central:   ${invite.central}`);
+        console.log(`  transport: ${preview.preview?.transport ?? "relay"}`);
+        console.log(`  access:    ${preview.preview?.topics ?? "explicitly shared topics only"}`);
+        const accepted = args.includes("--yes") || await confirmEnrollment("Join this workspace?");
+        if (!accepted) {
+          console.log("enrollment cancelled");
+          return;
+        }
+      }
+      join32 = await claimEnrollment(invite, nodeName);
+      productionEnrollment = true;
+    } catch (err2) {
+      console.error(`enrollment failed: ${err2 instanceof Error ? err2.message : err2}`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  let path;
+  try {
+    const saveOptions = { replaceExisting: args.includes("--replace") };
+    path = productionEnrollment ? commitEnrollment(join32, saveOptions) : saveJoin(join32, saveOptions);
+  } catch (err2) {
+    console.error(`could not save join credentials: ${err2 instanceof Error ? err2.message : err2}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`otium join credentials saved to ${path}`);
+  console.log(`  central: ${join32.central}`);
+  console.log(`  cellId:  ${join32.cellId}`);
+  configureOtiumCentral(join32);
+  try {
+    const self = await selfPeerNode();
+    if (self) {
+      console.log(`attached to workspace as "${self.nodeName ?? self.cellId}" (baseUrl ${self.baseUrl})`);
+    } else {
+      console.warn("warning: central answered but this cell has no visible assignment yet \u2014 check the workspace assignment");
+    }
+  } catch (err2) {
+    console.warn(`warning: could not verify against central (${err2 instanceof Error ? err2.message : err2}) \u2014 credentials saved anyway`);
+  } finally {
+    configureOtiumCentral(null);
+  }
+  console.log("\nnext: `negotium-otium serve` (mounts the otium peer routes automatically)");
+}
+var init_join_cli = __esm(async () => {
+  await init_central();
+  await init_enrollment();
+  await init_join();
+});
+
+// ../../adapters/otium/src/sidecar.ts
+var exports_sidecar = {};
+__export(exports_sidecar, {
+  runOtiumSidecar: () => runOtiumSidecar,
+  proxyOtiumPeerRequest: () => proxyOtiumPeerRequest
+});
+async function proxyOtiumPeerRequest(req, dependencies = {}) {
+  const inspectNode = dependencies.inspectNode ?? inspectNodeDaemon;
+  const fetchRequest = dependencies.fetch ?? fetch;
+  const status = await inspectNode();
+  if (!status.running || !status.info) {
+    return Response.json({ ok: false, error: "canonical Negotium node is unavailable" }, { status: 503 });
+  }
+  const source = new URL(req.url);
+  const target = new URL(`http://127.0.0.1:${status.info.port}`);
+  target.pathname = `${OTIUM_ADAPTER_CONTROL_PREFIX}${source.pathname}`;
+  target.search = source.search;
+  const headers = new Headers(req.headers);
+  headers.set(OTIUM_ADAPTER_CONTROL_HEADER, NODE_CONTROL_TOKEN);
+  try {
+    const body = req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer();
+    return await fetchRequest(new Request(target.toString(), { method: req.method, headers, body, signal: req.signal }));
+  } catch (error) {
+    logger.warn({ err: error }, "otium sidecar: canonical node request failed");
+    return Response.json({ ok: false, error: "canonical Negotium node connection failed" }, { status: 503 });
+  }
+}
+async function runOtiumSidecar(options) {
+  const join32 = loadJoin();
+  if (!join32) {
+    throw new Error("not joined to an Otium workspace \u2014 run `negotium otium join <code>` first");
+  }
+  const initialNode = await inspectNodeDaemon();
+  if (!initialNode.running) {
+    throw new Error("canonical Negotium node is not running");
+  }
+  const ready = await proxyOtiumPeerRequest(new Request("http://127.0.0.1/ready"));
+  if (!ready.ok) {
+    throw new Error("canonical Negotium node has no Otium runtime; restart it after joining the workspace");
+  }
+  let server;
+  const lease = await waitForRequiredRuntimeProcessLease("adapter:otium", {
+    workloadName: "Otium adapter",
+    onLost: () => {
+      process.stderr.write(`negotium otium: singleton lease lost; shutting down
+`);
+      runShutdown("test");
+    }
+  });
+  try {
+    server = Bun.serve({
+      port: options.port,
+      hostname: "127.0.0.1",
+      idleTimeout: 240,
+      maxRequestBodySize: MAX_PEER_INPUT_REQUEST_BYTES,
+      fetch: (req) => proxyOtiumPeerRequest(req)
+    });
+  } catch (error) {
+    lease.stop();
+    throw error;
+  }
+  const selectedRelay = options.relayUrl?.trim() || join32.relay || process.env.OTIUM_RELAY_URL?.trim();
+  const tunnel = selectedRelay ? new TunnelClient({
+    relayUrl: selectedRelay,
+    token: join32.secret,
+    targetOrigin: `http://127.0.0.1:${server.port}`,
+    nodeVersion: `negotium@${NEGOTIUM_VERSION}`,
+    logger
+  }) : null;
+  tunnel?.start();
+  let resolveCompleted;
+  const completed = new Promise((resolve15) => {
+    resolveCompleted = resolve15;
+  });
+  onShutdown("otium-sidecar-server", 130, () => server?.stop(true));
+  onShutdown("otium-sidecar-tunnel", 120, () => tunnel?.stop());
+  onShutdown("otium-sidecar-lease", 110, () => lease.stop());
+  onShutdown("otium-sidecar-completed", -100, resolveCompleted);
+  process.stdout.write(`negotium Otium adapter listening on 127.0.0.1:${server.port} (canonical node pid ${initialNode.info?.pid})
+`);
+  await completed;
+}
+var init_sidecar = __esm(async () => {
+  await init_src();
+  await init_src5();
+  await init_join();
+  init_protocol();
+  init_tunnel_client();
+});
+
 // ../../adapters/otium/src/cli.ts
 var exports_cli3 = {};
 __export(exports_cli3, {
@@ -30464,66 +30654,57 @@ async function resolveHostNodeId(explicit) {
     configureOtiumCentral2(null);
   }
 }
+async function spawnCanonicalNode2() {
+  const entry = process.argv[1];
+  if (!entry)
+    throw new Error("cannot locate the Negotium CLI entrypoint");
+  const { LOG_DIR: LOG_DIR2 } = await init_src().then(() => exports_src);
+  const child = Bun.spawn({
+    cmd: [process.execPath, entry, "__node-daemon", "--port=0"],
+    detached: true,
+    env: { ...process.env, LOG_LEVEL: process.env.NEGOTIUM_NODE_LOG_LEVEL?.trim() || "info" },
+    stdin: "ignore",
+    stdout: "ignore",
+    stderr: Bun.file(`${LOG_DIR2}/node-daemon.log`)
+  });
+  child.unref();
+}
+async function ensureCanonicalNode2() {
+  const { inspectNodeDaemon: inspectNodeDaemon2, waitForNodeDaemon: waitForNodeDaemon2 } = await init_src5().then(() => exports_src3);
+  const status = await inspectNodeDaemon2();
+  if (status.running)
+    return;
+  await spawnCanonicalNode2();
+  await waitForNodeDaemon2(15000);
+}
+async function runCanonicalNodeChild2() {
+  const { onShutdown: onShutdown2 } = await init_src().then(() => exports_src);
+  const { MAX_PEER_INPUT_REQUEST_BYTES: MAX_PEER_INPUT_REQUEST_BYTES2, mountConfiguredOtiumNodeRuntime: mountConfiguredOtiumNodeRuntime2 } = await init_node_runtime().then(() => exports_node_runtime);
+  const { runNodeDaemon: runNodeDaemon2 } = await init_src5().then(() => exports_src3);
+  const runtime = mountConfiguredOtiumNodeRuntime2();
+  if (runtime)
+    onShutdown2("otium-node-runtime", 125, () => runtime.stop());
+  await runNodeDaemon2({ port: 0, maxRequestBodySize: MAX_PEER_INPUT_REQUEST_BYTES2 });
+}
 async function runOtiumCli(args = process.argv.slice(2)) {
   const [command, ...commandArgs] = args;
   switch (command) {
+    case "__node-daemon": {
+      await runCanonicalNodeChild2();
+      break;
+    }
     case "join": {
       const { joinCommand: joinCommand2 } = await init_join_cli().then(() => exports_join_cli);
       await joinCommand2(commandArgs);
       break;
     }
     case "serve": {
-      const {
-        NEGOTIUM_PORT: NEGOTIUM_PORT2,
-        onShutdown: onShutdown2,
-        registerNodeRequestHandler: registerNodeRequestHandler2,
-        unregisterNodeRequestHandler: unregisterNodeRequestHandler2,
-        waitForRequiredRuntimeProcessLease: waitForRequiredRuntimeProcessLease2
-      } = await init_src().then(() => exports_src);
-      const [{ startDefaultNode: startDefaultNode2 }, otium] = await Promise.all([
-        init_src5().then(() => exports_src3),
-        init_src8().then(() => exports_src5)
-      ]);
+      const { NEGOTIUM_PORT: NEGOTIUM_PORT2 } = await init_src().then(() => exports_src);
+      const { runOtiumSidecar: runOtiumSidecar2 } = await init_sidecar().then(() => exports_sidecar);
       const port = parseOtiumServePort(commandArgs, NEGOTIUM_PORT2);
       const relayUrl = parseOtiumServeRelayUrl(commandArgs);
-      let node;
-      const singleton = await waitForRequiredRuntimeProcessLease2("adapter:otium", {
-        workloadName: "Otium adapter",
-        onLost: () => {
-          console.error("negotium otium: singleton lease lost; shutting down");
-          node?.stop();
-        }
-      });
-      const { handleOtiumPeerRequest: handleOtiumPeerRequest2, startOtiumWorker: startOtiumWorker2 } = otium;
-      const worker = startOtiumWorker2();
-      if (!worker) {
-        singleton.stop();
-        throw new Error("not joined to an otium workspace \u2014 run `negotium otium join <code>` first");
-      }
-      registerNodeRequestHandler2("otium-peer", handleOtiumPeerRequest2);
-      let workerStopped = false;
-      const stopWorker = () => {
-        if (workerStopped)
-          return;
-        workerStopped = true;
-        unregisterNodeRequestHandler2("otium-peer");
-        worker.stop();
-      };
-      onShutdown2("otium-worker", 100, stopWorker);
-      onShutdown2("otium-singleton", 90, () => singleton.stop());
-      try {
-        node = await startDefaultNode2({
-          port,
-          maxRequestBodySize: MAX_PEER_INPUT_REQUEST_BYTES
-        });
-      } catch (error) {
-        stopWorker();
-        singleton.stop();
-        throw error;
-      }
-      console.log(`negotium node (otium worker) listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
-      worker.startTunnel({ targetOrigin: `http://127.0.0.1:${node.port}`, relayUrl });
-      await node.completed;
+      await ensureCanonicalNode2();
+      await runOtiumSidecar2({ port, relayUrl });
       break;
     }
     case "bindings": {
@@ -30590,7 +30771,6 @@ async function runOtiumCli(args = process.argv.slice(2)) {
   }
 }
 var init_cli3 = __esm(() => {
-  init_protocol();
   if (false) {}
 });
 
@@ -31304,6 +31484,36 @@ function numericOption(values, name, fallback) {
   const parsed = Number.parseInt(values.find((value) => value.startsWith(prefix))?.slice(prefix.length) ?? "", 10);
   return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
 }
+async function runCanonicalNode(port) {
+  const { onShutdown: onShutdown2 } = await init_src().then(() => exports_src);
+  const { MAX_PEER_INPUT_REQUEST_BYTES: MAX_PEER_INPUT_REQUEST_BYTES2, mountConfiguredOtiumNodeRuntime: mountConfiguredOtiumNodeRuntime2 } = await init_node_runtime().then(() => exports_node_runtime);
+  const { startDefaultNode: startDefaultNode2 } = await init_src5().then(() => exports_src3);
+  const otiumRuntime = mountConfiguredOtiumNodeRuntime2();
+  if (otiumRuntime)
+    onShutdown2("otium-node-runtime", 125, () => otiumRuntime.stop());
+  const node = await startDefaultNode2({
+    port,
+    advertise: true,
+    singleton: true,
+    maxRequestBodySize: MAX_PEER_INPUT_REQUEST_BYTES2
+  });
+  console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
+  await node.completed;
+}
+async function stopAdapter(name) {
+  const { getRuntimeProcessLease: getRuntimeProcessLease2 } = await init_src().then(() => exports_src);
+  const lease = getRuntimeProcessLease2(`adapter:${name}`);
+  if (!lease)
+    return false;
+  try {
+    process.kill(lease.pid, "SIGTERM");
+    return true;
+  } catch (error) {
+    if (error.code === "ESRCH")
+      return false;
+    throw error;
+  }
+}
 switch (command) {
   case "init": {
     const { initCommand: initCommand2 } = await init_init().then(() => exports_init);
@@ -31316,22 +31526,20 @@ switch (command) {
     break;
   }
   case "serve": {
-    const { startDefaultNode: startDefaultNode2 } = await init_src5().then(() => exports_src3);
-    const node = await startDefaultNode2({
-      port: numericOption(args, "port", 7777),
-      advertise: true,
-      singleton: true
-    });
-    console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
-    await node.completed;
+    if (args[0] === "otium") {
+      const { runOtiumCli: runOtiumCli2 } = await loadOtiumCli();
+      await runOtiumCli2(["serve", ...args.slice(1)]);
+      break;
+    }
+    await runCanonicalNode(numericOption(args, "port", 7777));
     break;
   }
   case "__node-daemon": {
-    const { runNodeDaemon: runNodeDaemon2 } = await init_src5().then(() => exports_src3);
-    await runNodeDaemon2({ port: numericOption(args, "port", 0) });
+    await runCanonicalNode(numericOption(args, "port", 0));
     break;
   }
   case "status": {
+    const { listRuntimeProcessLeases: listRuntimeProcessLeases2 } = await init_src().then(() => exports_src);
     const { inspectNodeDaemon: inspectNodeDaemon2 } = await init_src5().then(() => exports_src3);
     const status = await inspectNodeDaemon2();
     if (status.running && status.info) {
@@ -31342,10 +31550,33 @@ switch (command) {
     } else {
       console.log("negotium node is stopped");
     }
+    const adapters = listRuntimeProcessLeases2("adapter:");
+    if (adapters.length === 0)
+      console.log("adapters: none");
+    else {
+      for (const adapter of adapters) {
+        console.log(`adapter ${adapter.role.slice("adapter:".length)} running (pid ${adapter.pid}, since ${new Date(adapter.startedAt).toISOString()})`);
+      }
+    }
     break;
   }
   case "stop": {
     const { stopNodeDaemon: stopNodeDaemon2 } = await init_src5().then(() => exports_src3);
+    const target = args[0];
+    if (target === "otium" || target === "telegram") {
+      const stopped2 = await stopAdapter(target);
+      console.log(stopped2 ? `${target} adapter shutdown requested` : `${target} adapter is not running`);
+      break;
+    }
+    if (target && target !== "--all") {
+      throw new Error("usage: negotium stop [otium|telegram|--all]");
+    }
+    if (target === "--all") {
+      for (const name of ["otium", "telegram"]) {
+        if (await stopAdapter(name))
+          console.log(`${name} adapter shutdown requested`);
+      }
+    }
     const stopped = await stopNodeDaemon2();
     console.log(stopped ? "negotium node shutdown requested" : "negotium node is not running");
     break;
@@ -31377,11 +31608,14 @@ switch (command) {
   }
   case "telegram": {
     const { runTelegramCli: runTelegramCli2 } = await loadTelegramCli();
-    await runTelegramCli2();
+    await runTelegramCli2(args);
     break;
   }
   case "otium": {
     const { runOtiumCli: runOtiumCli2 } = await loadOtiumCli();
+    if (args[0] === "serve") {
+      process.stderr.write("warning: `negotium otium serve` is deprecated; use `negotium serve otium`\n");
+    }
     await runOtiumCli2(args);
     break;
   }
@@ -31400,9 +31634,10 @@ switch (command) {
       "  init            bootstrap ~/.negotium and check agent auth",
       "  chat [topic]    interactive chat (creates the topic if missing)",
       "                  options: --agent=claude|codex|maestro",
-      "  serve           foreground long-lived node (default port 7777)",
-      "  status          show the local long-lived node status",
-      "  stop            stop the local long-lived node",
+      "  serve           foreground canonical node (default port 7777)",
+      "  serve otium     ensure the canonical node and run the Otium sidecar",
+      "  status          show the canonical node and adapter processes",
+      "  stop [otium|telegram|--all]  stop the node, one adapter, or everything",
       "  topics          list topics on this node",
       "  mcp list|add|remove|enable|disable   manage node MCP manifest",
       "  vault list|set|get|del               node secret store (encrypted at rest)",
@@ -31420,4 +31655,4 @@ switch (command) {
   }
 }
 
-//# debugId=4DB206AEE32F96CD64756E2164756E21
+//# debugId=F87B7DCB5931FEC964756E2164756E21