openmates 0.15.0-alpha.8 → 0.15.0-alpha.9

package/dist/{chunk-4JMZEG73.js → chunk-LGY6IN75.js}

@@ -198,9 +198,9 @@ function generateSecureRecoveryKey(length = 24) {
     const chars = requiredSets[index];
     result[index] = chars.charAt(randomByte % chars.length);
   }
-  const randomBytes4 = cryptoApi.getRandomValues(new Uint8Array(length));
+  const randomBytes5 = cryptoApi.getRandomValues(new Uint8Array(length));
   for (let index = requiredSets.length; index < length; index += 1) {
-    result[index] = allChars.charAt(randomBytes4[index] % allChars.length);
+    result[index] = allChars.charAt(randomBytes5[index] % allChars.length);
   }
   for (let index = result.length - 1; index > 0; index -= 1) {
     const randomByte = cryptoApi.getRandomValues(new Uint8Array(1))[0];
@@ -4844,7 +4844,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!userId) {
       throw new Error("Could not resolve current user id for local connected-account connector.");
     }
-    const { createHash: createHash8 } = await import("crypto");
+    const { createHash: createHash9 } = await import("crypto");
     const accountId = randomUUID5();
     const masterKey = this.getMasterKeyBytes();
     const encryptLocalConnectorValue = async (value) => {
@@ -4853,9 +4853,9 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     const payload = {
       id: accountId,
-      hashed_user_id: createHash8("sha256").update(userId).digest("hex"),
+      hashed_user_id: createHash9("sha256").update(userId).digest("hex"),
       encrypted_provider_type: await encryptLocalConnectorValue(input.provider_id),
-      provider_type_hash: createHash8("sha256").update(input.provider_id).digest("hex"),
+      provider_type_hash: createHash9("sha256").update(input.provider_id).digest("hex"),
       encrypted_account_label: await encryptLocalConnectorValue(input.label),
       encrypted_capabilities: await encryptLocalConnectorValue(input.capabilities),
       encrypted_app_permissions: await encryptLocalConnectorValue({
@@ -5581,8 +5581,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
       let msgEmbedIds = [];
       if (clientMsgId && cache.embeds.length > 0) {
-        const { createHash: createHash8 } = await import("crypto");
-        const hashed = createHash8("sha256").update(clientMsgId).digest("hex");
+        const { createHash: createHash9 } = await import("crypto");
+        const hashed = createHash9("sha256").update(clientMsgId).digest("hex");
         msgEmbedIds = cache.embeds.filter(
           (e) => e.hashed_message_id === hashed && // Only include parent embeds (no parent_embed_id).
           // Child embeds inherit the parent's key and are loaded
@@ -5629,8 +5629,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const { createHash: createHash8 } = await import("crypto");
-    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
+    const { createHash: createHash9 } = await import("crypto");
+    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -5738,7 +5738,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async resolveEmbedKey(cache, masterKey, embed, embedId, hashedEmbedId, visited = /* @__PURE__ */ new Set()) {
     if (visited.has(embedId)) return null;
     visited.add(embedId);
-    const { createHash: createHash8 } = await import("crypto");
+    const { createHash: createHash9 } = await import("crypto");
     const masterKeyEntry = cache.embedKeys.find(
       (ek) => ek.hashed_embed_id === hashedEmbedId && String(ek.key_type) === "master"
     );
@@ -5755,7 +5755,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (chatKeyEntry && typeof chatKeyEntry.encrypted_embed_key === "string") {
       const hashedChatId = String(chatKeyEntry.hashed_chat_id ?? "");
       const owningChat = cache.chats.find((c) => {
-        const chatHash = createHash8("sha256").update(String(c.details.id ?? "")).digest("hex");
+        const chatHash = createHash9("sha256").update(String(c.details.id ?? "")).digest("hex");
         return chatHash === hashedChatId;
       });
       if (owningChat) {
@@ -5784,7 +5784,7 @@ var OpenMatesClient = class _OpenMatesClient {
         const parentFullId = String(
           parentEmbed2.embed_id ?? parentEmbed2.id ?? ""
         );
-        const parentHashedId = createHash8("sha256").update(parentFullId).digest("hex");
+        const parentHashedId = createHash9("sha256").update(parentFullId).digest("hex");
         const parentKey = await this.resolveEmbedKey(
           cache,
           masterKey,
@@ -8796,7 +8796,7 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const masterKey = base64ToBytes(session.masterKeyExportedB64);
     const cache = await this.ensureSynced();
-    const { createHash: createHash8 } = await import("crypto");
+    const { createHash: createHash9 } = await import("crypto");
     const embed = cache.embeds.find(
       (e) => String(e.embed_id ?? "").startsWith(embedIdOrShort) || String(e.id ?? "").startsWith(embedIdOrShort)
     );
@@ -8804,7 +8804,7 @@ Required: ${schema.required.join(", ")}`
       throw new Error(`Embed '${embedIdOrShort}' not found in local cache.`);
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
+    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -8912,8 +8912,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash8 } = await import("crypto");
-    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
+    const { createHash: createHash9 } = await import("crypto");
+    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -9007,8 +9007,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash8 } = await import("crypto");
-    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
+    const { createHash: createHash9 } = await import("crypto");
+    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -9397,9 +9397,9 @@ Required: ${schema.required.join(", ")}`
     const reconciledChats = reconcileAuthoritativeChats(chats, reconciliation);
     chats.splice(0, chats.length, ...reconciledChats);
     if (reconciliation.deleted_chat_ids?.length) {
-      const { createHash: createHash8 } = await import("crypto");
+      const { createHash: createHash9 } = await import("crypto");
       const deletedHashes = new Set(
-        reconciliation.deleted_chat_ids.map((id) => createHash8("sha256").update(id).digest("hex"))
+        reconciliation.deleted_chat_ids.map((id) => createHash9("sha256").update(id).digest("hex"))
       );
       const keptEmbeds = embeds.filter((embed) => !deletedHashes.has(String(embed.hashed_chat_id ?? "")));
       const keptKeys = embedKeys.filter((key) => !deletedHashes.has(String(key.hashed_chat_id ?? "")));
@@ -9674,15 +9674,6 @@ function printLogo() {
   stdout.write(lines.join("\n") + "\n");
 }
 
-// src/cli.ts
-import { createInterface as createInterface5 } from "readline/promises";
-import { stdin as stdin3, stdout as stdout2 } from "process";
-import { readFileSync as readFileSync9, realpathSync, writeFileSync as writeFileSync6 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { basename as basename3, dirname as dirname3 } from "path";
-import { randomUUID as randomUUID7 } from "crypto";
-import WebSocket2 from "ws";
-
 // src/generated/appSkills.ts
 var APP_SKILL_METADATA = [
   {
@@ -13590,6 +13581,1374 @@ var GeneratedAppSkills = class {
   workflows;
 };
 
+// src/sdk.ts
+import { decode as toonDecode } from "@toon-format/toon";
+import { createHash as createHash6, randomBytes as randomBytes3, randomUUID as randomUUID6 } from "crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname, join as join3 } from "path";
+var DEFAULT_API_URL2 = "https://api.openmates.org";
+var DEFAULT_RECOVERY_POLL_INTERVAL_MS = 500;
+var DEFAULT_RECOVERY_TIMEOUT_MS = 6e4;
+var OpenMatesConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OpenMatesConfigError";
+  }
+};
+var OpenMatesApiError = class extends Error {
+  status;
+  data;
+  constructor(status, data) {
+    super(`OpenMates API request failed with HTTP ${status}`);
+    this.name = "OpenMatesApiError";
+    this.status = status;
+    this.data = data;
+  }
+};
+var OpenMates = class {
+  apps;
+  account;
+  benchmark;
+  billing;
+  chats;
+  connectedAccounts;
+  docs;
+  drafts;
+  embeds;
+  feedback;
+  inspirations;
+  learningMode;
+  memories;
+  newChatSuggestions;
+  notifications;
+  reminders;
+  projects;
+  settings;
+  plans;
+  tasks;
+  workflows;
+  apiKey;
+  apiUrl;
+  deviceId;
+  sdkSessionPromise;
+  masterKeyPromise;
+  constructor(options = {}) {
+    this.apiKey = options.apiKey ?? process.env.OPENMATES_API_KEY;
+    this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL2).replace(/\/$/, "");
+    this.deviceId = options.deviceId ?? loadOrCreateDeviceId(options.deviceIdPath);
+    this.apps = new GeneratedAppSkills(this.runAppSkill.bind(this));
+    this.account = new OpenMatesAccount(this);
+    this.benchmark = new OpenMatesBenchmark(this);
+    this.billing = new OpenMatesBilling(this);
+    this.chats = new OpenMatesChats(this);
+    this.connectedAccounts = new OpenMatesConnectedAccounts(this);
+    this.docs = new OpenMatesDocs(this);
+    this.drafts = new OpenMatesDrafts(this);
+    this.embeds = new OpenMatesEmbeds(this);
+    this.feedback = new OpenMatesFeedback(this);
+    this.inspirations = new OpenMatesInspirations(this);
+    this.learningMode = new OpenMatesLearningMode(this);
+    this.memories = new OpenMatesMemories(this);
+    this.newChatSuggestions = new OpenMatesNewChatSuggestions(this);
+    this.notifications = new OpenMatesNotifications(this);
+    this.reminders = new OpenMatesReminders(this);
+    this.projects = new OpenMatesProjects(this);
+    this.settings = new OpenMatesSettings(this);
+    this.plans = new OpenMatesPlans(this);
+    this.tasks = new OpenMatesTasks(this);
+    this.workflows = new OpenMatesWorkflows(this);
+  }
+  async runAppSkill(appId, skillId, input) {
+    return this.request(`/v1/apps/${appId}/skills/${skillId}`, input);
+  }
+  async request(path, body, timeoutMs, extraHeaders) {
+    return this.requestWithMethod("POST", path, body, timeoutMs, extraHeaders);
+  }
+  async patch(path, body) {
+    return this.requestWithMethod("PATCH", path, body);
+  }
+  async put(path, body) {
+    return this.requestWithMethod("PUT", path, body);
+  }
+  async delete(path, body) {
+    return this.requestWithMethod("DELETE", path, body);
+  }
+  async get(path) {
+    if (!this.apiKey) {
+      throw new OpenMatesConfigError("OpenMates API key is required");
+    }
+    const response = await fetch(`${this.apiUrl}${path}`, {
+      method: "GET",
+      headers: this.headers(false)
+    });
+    return this.parseResponse(response);
+  }
+  async getPublic(path) {
+    const response = await fetch(`${this.apiUrl}${path}`, {
+      method: "GET",
+      headers: this.publicHeaders()
+    });
+    return this.parseResponse(response);
+  }
+  async getRaw(path) {
+    if (!this.apiKey) {
+      throw new OpenMatesConfigError("OpenMates API key is required");
+    }
+    const response = await fetch(`${this.apiUrl}${path}`, {
+      method: "GET",
+      headers: this.headers(false)
+    });
+    if (!response.ok) {
+      await this.parseResponse(response);
+    }
+    return {
+      contentType: response.headers.get("content-type") ?? "application/octet-stream",
+      filename: extractFilename(response.headers.get("content-disposition")),
+      data: await response.arrayBuffer()
+    };
+  }
+  webOrigin() {
+    return deriveWebOrigin(this.apiUrl);
+  }
+  masterKey() {
+    return this.getMasterKey();
+  }
+  sdkSession() {
+    return this.getSdkSession();
+  }
+  async resolveEmbedKeyForShare(embedKeys, embedId) {
+    const masterKey = await this.getMasterKey();
+    const hashedEmbedId = createHash6("sha256").update(embedId).digest("hex");
+    return this.resolveLoadedEmbedKey(embedKeys, hashedEmbedId, masterKey, masterKey);
+  }
+  async decryptChatMetadata(chat) {
+    if (typeof chat.encrypted_chat_key !== "string") {
+      return chat;
+    }
+    const masterKey = await this.getMasterKey();
+    const chatKey = await decryptBytesWithAesGcm(chat.encrypted_chat_key, masterKey);
+    if (!chatKey) {
+      return chat;
+    }
+    const decrypted = { ...chat };
+    if (typeof chat.encrypted_title === "string") {
+      decrypted.title = await decryptWithAesGcmCombined(chat.encrypted_title, chatKey);
+    }
+    if (typeof chat.encrypted_chat_summary === "string") {
+      decrypted.chat_summary = await decryptWithAesGcmCombined(chat.encrypted_chat_summary, chatKey);
+    }
+    if (typeof chat.encrypted_category === "string") {
+      decrypted.category = await decryptWithAesGcmCombined(chat.encrypted_category, chatKey);
+    }
+    return decrypted;
+  }
+  async decryptLoadedChatPayload(payload) {
+    const chat = payload.chat;
+    if (!chat || typeof chat !== "object") {
+      return payload;
+    }
+    const chatMetadata = chat;
+    const decryptedChat = await this.decryptChatMetadata(chatMetadata);
+    const chatKey = typeof chatMetadata.encrypted_chat_key === "string" ? await decryptBytesWithAesGcm(chatMetadata.encrypted_chat_key, await this.getMasterKey()) : null;
+    if (!chatKey || !Array.isArray(payload.messages)) {
+      return { ...payload, chat: decryptedChat };
+    }
+    const messages = await Promise.all(payload.messages.map(async (rawMessage) => {
+      const message = typeof rawMessage === "string" ? JSON.parse(rawMessage) : { ...rawMessage };
+      if (typeof message.encrypted_content === "string") {
+        message.content = await decryptWithAesGcmCombined(message.encrypted_content, chatKey);
+      }
+      if (typeof message.encrypted_sender_name === "string") {
+        message.senderName = await decryptWithAesGcmCombined(message.encrypted_sender_name, chatKey);
+      }
+      if (typeof message.encrypted_category === "string") {
+        message.category = await decryptWithAesGcmCombined(message.encrypted_category, chatKey);
+      }
+      if (typeof message.encrypted_model_name === "string") {
+        message.modelName = await decryptWithAesGcmCombined(message.encrypted_model_name, chatKey);
+      }
+      return message;
+    }));
+    const embeds = Array.isArray(payload.embeds) ? await this.decryptLoadedChatEmbeds(
+      payload.embeds,
+      Array.isArray(payload.embed_keys) ? payload.embed_keys : [],
+      chatKey
+    ) : payload.embeds;
+    return { ...payload, chat: decryptedChat, messages, embeds };
+  }
+  async decryptLoadedChatEmbeds(embeds, embedKeys, chatKey) {
+    const masterKey = await this.getMasterKey();
+    return Promise.all(embeds.map(async (embed) => {
+      const embedId = String(embed.embed_id ?? embed.id ?? "");
+      if (!embedId) {
+        return { ...embed };
+      }
+      const hashedEmbedId = createHash6("sha256").update(embedId).digest("hex");
+      const embedKey = await this.resolveLoadedEmbedKey(embedKeys, hashedEmbedId, masterKey, chatKey);
+      if (!embedKey) {
+        return { ...embed };
+      }
+      const decrypted = { ...embed };
+      if (typeof embed.encrypted_type === "string") {
+        decrypted.type = await decryptWithAesGcmCombined(embed.encrypted_type, embedKey);
+      }
+      if (typeof embed.encrypted_text_preview === "string") {
+        decrypted.textPreview = await decryptWithAesGcmCombined(embed.encrypted_text_preview, embedKey);
+      }
+      if (typeof embed.encrypted_content === "string") {
+        const content = await decryptWithAesGcmCombined(embed.encrypted_content, embedKey);
+        decrypted.content = parseMaybeJson(content);
+      }
+      return decrypted;
+    }));
+  }
+  async resolveLoadedEmbedKey(embedKeys, hashedEmbedId, masterKey, chatKey) {
+    const matchingKeys = embedKeys.filter((key) => key.hashed_embed_id === hashedEmbedId);
+    const masterKeyEntry = matchingKeys.find((key) => key.key_type === "master");
+    if (typeof masterKeyEntry?.encrypted_embed_key === "string") {
+      const embedKey = await decryptBytesWithAesGcm(masterKeyEntry.encrypted_embed_key, masterKey);
+      if (embedKey) return embedKey;
+    }
+    const chatKeyEntry = matchingKeys.find((key) => key.key_type === "chat");
+    if (typeof chatKeyEntry?.encrypted_embed_key === "string") {
+      return decryptBytesWithAesGcm(chatKeyEntry.encrypted_embed_key, chatKey);
+    }
+    return null;
+  }
+  async requestWithMethod(method, path, body, timeoutMs, extraHeaders) {
+    if (!this.apiKey) {
+      throw new OpenMatesConfigError("OpenMates API key is required");
+    }
+    const response = await fetch(`${this.apiUrl}${path}`, {
+      method,
+      headers: { ...this.headers(body !== void 0), ...extraHeaders },
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: timeoutMs === void 0 ? void 0 : AbortSignal.timeout(timeoutMs)
+    });
+    return this.parseResponse(response);
+  }
+  getMasterKey() {
+    this.masterKeyPromise ??= this.loadMasterKey();
+    return this.masterKeyPromise;
+  }
+  async loadMasterKey() {
+    if (!this.apiKey) {
+      throw new OpenMatesConfigError("OpenMates API key is required");
+    }
+    const session = await this.getSdkSession();
+    const wrapper = session.key_wrapper;
+    if (!wrapper?.encrypted_key || !wrapper.salt || !wrapper.key_iv) {
+      throw new OpenMatesConfigError("SDK session did not include API-key-wrapped master key material");
+    }
+    const masterKey = await unwrapApiKeyMasterKey({
+      apiKey: this.apiKey,
+      encryptedMasterKeyB64: wrapper.encrypted_key,
+      saltB64: wrapper.salt,
+      keyIvB64: wrapper.key_iv
+    });
+    if (!masterKey) {
+      throw new OpenMatesConfigError("Unable to decrypt SDK session master key with API key");
+    }
+    return masterKey;
+  }
+  getSdkSession() {
+    this.sdkSessionPromise ??= this.request("/v1/sdk/session", {
+      sdk_name: "npm",
+      device_identity: this.deviceId
+    });
+    return this.sdkSessionPromise;
+  }
+  headers(hasBody = true) {
+    const headers = {
+      Accept: "application/json",
+      Authorization: `Bearer ${this.apiKey}`,
+      "X-OpenMates-SDK": "npm",
+      "X-OpenMates-Device-Identity": this.deviceId
+    };
+    if (hasBody) {
+      headers["Content-Type"] = "application/json";
+    }
+    return headers;
+  }
+  publicHeaders() {
+    return {
+      Accept: "application/json",
+      "X-OpenMates-SDK": "npm",
+      "X-OpenMates-Device-Identity": this.deviceId
+    };
+  }
+  async parseResponse(response) {
+    let data = {};
+    try {
+      data = await response.json();
+    } catch {
+      data = {};
+    }
+    if (!response.ok) {
+      throw new OpenMatesApiError(response.status, data);
+    }
+    return data;
+  }
+};
+function loadOrCreateDeviceId(customPath) {
+  const path = customPath ?? join3(homedir4(), ".openmates", "sdk-device-id");
+  if (existsSync5(path)) {
+    const stored = readFileSync4(path, "utf8").trim();
+    if (stored) return stored;
+  }
+  const deviceId = randomUUID6();
+  mkdirSync3(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync3(path, `${deviceId}
+`, { encoding: "utf8", mode: 384 });
+  chmodSync2(path, 384);
+  return deviceId;
+}
+function withQuery(path, query = {}) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== void 0 && value !== null) params.set(key, String(value));
+  }
+  const serialized = params.toString();
+  return serialized ? `${path}?${serialized}` : path;
+}
+function requireConfirmed(options, action) {
+  if (options?.confirmed !== true) {
+    throw new OpenMatesConfigError(`${action} requires confirmed: true`);
+  }
+}
+function unsupportedSdkFeature(feature) {
+  throw new OpenMatesConfigError(`${feature} is not available through the API-key SDK yet`);
+}
+function extractFilename(contentDisposition) {
+  if (!contentDisposition) return void 0;
+  const encoded = contentDisposition.match(/filename\*=UTF-8''([^;]+)/)?.[1];
+  if (encoded) return decodeURIComponent(encoded);
+  return contentDisposition.match(/filename="?([^";]+)"?/)?.[1];
+}
+function normalizeHistory(history) {
+  if (!history) return [];
+  if (Array.isArray(history)) return history;
+  return Array.isArray(history.messages) ? history.messages : [];
+}
+function parseMaybeJson(value) {
+  if (value === null) return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    try {
+      return toonDecode(value, { strict: false });
+    } catch {
+      return value;
+    }
+  }
+}
+var OpenMatesChats = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(options = {}) {
+    const result = await this.client.get(
+      withQuery("/v1/sdk/chats", { limit: options.limit ?? 10, offset: options.offset })
+    );
+    const chats = Array.isArray(result.chats) ? result.chats : [];
+    return Promise.all(chats.map((chat) => this.client.decryptChatMetadata(chat)));
+  }
+  async search(query, options = {}) {
+    const normalized = query.trim().toLowerCase();
+    const chats = await this.list({ limit: 0 });
+    const offset = options.offset ?? 0;
+    const limit = options.limit ?? 10;
+    const matches2 = chats.filter((chat) => {
+      const haystack = [chat.title, chat.chat_summary, chat.category, chat.id].filter((value) => typeof value === "string").join("\n").toLowerCase();
+      return haystack.includes(normalized);
+    });
+    return matches2.slice(offset, limit === 0 ? void 0 : offset + limit);
+  }
+  async load(chatId) {
+    const payload = await this.client.get(`/v1/sdk/chats/${encodeURIComponent(chatId)}`);
+    return this.client.decryptLoadedChatPayload(payload);
+  }
+  async send(message, options = {}) {
+    if (options.saveToAccount === true) {
+      return this.sendSaved(message, options);
+    }
+    const result = await this.client.request("/v1/sdk/chats", {
+      message,
+      history: normalizeHistory(options.history),
+      save_to_account: false,
+      memory_ids: options.memoryIds ?? [],
+      model: options.model,
+      focus_mode: options.focusMode ? { app_id: options.focusMode.appId, focus_mode_id: options.focusMode.focusModeId } : void 0
+    });
+    return result.response ?? result;
+  }
+  async sendSaved(message, options) {
+    const masterKey = await this.client.masterKey();
+    const session = await this.client.sdkSession();
+    if (!session.user?.id) {
+      throw new OpenMatesConfigError("SDK session did not include the authenticated user identity");
+    }
+    const chatId = options.chatId ?? randomUUID6();
+    const turnId = randomUUID6();
+    const messageId = randomUUID6();
+    const createdAt = Math.floor(Date.now() / 1e3);
+    let chatKey;
+    let encryptedChatKey;
+    let expectedMessagesV = 0;
+    let encryptedChatMetadata;
+    if (options.chatId) {
+      const loaded = await this.load(chatId);
+      const chat = loaded.chat;
+      if (!chat?.encrypted_chat_key) {
+        throw new OpenMatesConfigError("Saved chat does not include encrypted chat key material");
+      }
+      const decrypted = await decryptBytesWithAesGcm(chat.encrypted_chat_key, masterKey);
+      if (!decrypted) {
+        throw new OpenMatesConfigError("Unable to decrypt saved chat key material");
+      }
+      chatKey = decrypted;
+      encryptedChatKey = chat.encrypted_chat_key;
+      expectedMessagesV = Number(chat.messages_v ?? 0);
+    } else {
+      chatKey = new Uint8Array(randomBytes3(32));
+      encryptedChatKey = await encryptBytesWithAesGcm(chatKey, masterKey);
+      encryptedChatMetadata = {
+        encrypted_title: await encryptWithAesGcmCombined(options.title ?? message.slice(0, 80), chatKey),
+        encrypted_chat_key: encryptedChatKey,
+        created_at: createdAt,
+        updated_at: createdAt
+      };
+    }
+    const recovery = await deriveChatCompletionRecoveryKeypair(
+      Buffer.from(chatKey).toString("base64url"),
+      chatId,
+      1
+    );
+    const history = normalizeHistory(options.history);
+    const inferenceRequest = {
+      messages: [...history, { role: "user", content: message }],
+      model: options.model,
+      focus_mode: options.focusMode ? { app_id: options.focusMode.appId, focus_mode_id: options.focusMode.focusModeId } : void 0,
+      memory_ids: options.memoryIds ?? []
+    };
+    const result = await this.client.request("/v1/sdk/chats", {
+      message,
+      history,
+      save_to_account: true,
+      title: options.title,
+      memory_ids: options.memoryIds ?? [],
+      model: options.model,
+      focus_mode: inferenceRequest.focus_mode,
+      protocol_version: 1,
+      chat_id: chatId,
+      turn_id: turnId,
+      message_id: messageId,
+      chat_key_version: 1,
+      encrypted_chat_key: encryptedChatKey,
+      recovery_public_key: recovery.publicKey,
+      expected_messages_v: expectedMessagesV,
+      encrypted_user_message: {
+        client_message_id: messageId,
+        chat_id: chatId,
+        encrypted_content: await encryptWithAesGcmCombined(message, chatKey),
+        encrypted_sender_name: await encryptWithAesGcmCombined("User", chatKey),
+        role: "user",
+        created_at: createdAt,
+        updated_at: createdAt
+      },
+      encrypted_chat_metadata: encryptedChatMetadata,
+      inference_request: inferenceRequest
+    });
+    if (!result.task_id) {
+      throw new OpenMatesConfigError("Saved chat dispatch did not return a stable inference task id");
+    }
+    const claim = await this.pollRecoveryClaim(
+      result.task_id,
+      options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS,
+      options.recoveryPollIntervalMs ?? DEFAULT_RECOVERY_POLL_INTERVAL_MS
+    );
+    const recovered = await this.openRecoveryClaim(
+      claim,
+      recovery.privateKey,
+      session.user.id,
+      chatId,
+      turnId
+    );
+    const completedAt = Math.floor(Date.now() / 1e3);
+    const encryptedAssistantMessage = {
+      client_message_id: recovered.assistantMessageId,
+      chat_id: chatId,
+      encrypted_content: await encryptWithAesGcmCombined(recovered.content, chatKey),
+      encrypted_sender_name: await encryptWithAesGcmCombined("Assistant", chatKey),
+      role: "assistant",
+      user_message_id: messageId,
+      created_at: completedAt,
+      updated_at: completedAt
+    };
+    if (recovered.category !== null) {
+      encryptedAssistantMessage.encrypted_category = await encryptWithAesGcmCombined(recovered.category, chatKey);
+    }
+    if (recovered.modelName !== null) {
+      encryptedAssistantMessage.encrypted_model_name = await encryptWithAesGcmCombined(recovered.modelName, chatKey);
+    }
+    const terminal = await this.client.request(
+      `/v1/sdk/chats/recovery/${encodeURIComponent(result.task_id)}/persist`,
+      {
+        protocol_version: 1,
+        lease_generation: claim.lease_generation,
+        lease_token: claim.lease_token,
+        expected_messages_v: expectedMessagesV + 1,
+        encrypted_assistant_message: encryptedAssistantMessage
+      }
+    );
+    if (terminal.state !== "TERMINAL") {
+      throw new OpenMatesConfigError("Saved chat recovery did not reach terminal persistence");
+    }
+    return {
+      content: recovered.content,
+      category: recovered.category,
+      model_name: recovered.modelName,
+      chat_id: result.chat_id ?? chatId,
+      task_id: result.task_id,
+      preflight: result.preflight,
+      terminal
+    };
+  }
+  async pollRecoveryClaim(taskId, timeoutMs, pollIntervalMs) {
+    if (!Number.isFinite(timeoutMs) || !Number.isFinite(pollIntervalMs) || timeoutMs <= 0 || pollIntervalMs <= 0) {
+      throw new OpenMatesConfigError("Recovery timeout and poll interval must be finite and positive");
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      try {
+        const remainingMs2 = deadline - Date.now();
+        if (remainingMs2 <= 0) break;
+        return await this.client.request(
+          `/v1/sdk/chats/recovery/${encodeURIComponent(taskId)}/claim`,
+          { protocol_version: 1 },
+          remainingMs2
+        );
+      } catch (error) {
+        if (!(error instanceof OpenMatesApiError) || error.status !== 404) throw error;
+      }
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) break;
+      await new Promise((resolve7) => setTimeout(resolve7, Math.min(pollIntervalMs, remainingMs)));
+    }
+    throw new OpenMatesConfigError("Timed out waiting for saved chat recovery");
+  }
+  async openRecoveryClaim(claim, recoveryPrivateKey, ownerId, chatId, turnId) {
+    const jobId = typeof claim.job_id === "string" ? claim.job_id : null;
+    const assistantMessageId = typeof claim.assistant_message_id === "string" ? claim.assistant_message_id : null;
+    const keyVersion = Number.isSafeInteger(claim.chat_key_version) ? Number(claim.chat_key_version) : null;
+    if (claim.state !== "LEASED" || typeof claim.lease_token !== "string" || !Number.isSafeInteger(claim.lease_generation) || !jobId || !assistantMessageId || keyVersion !== 1 || claim.chat_id !== chatId || claim.turn_id !== turnId || typeof claim.sealed_payload !== "string") {
+      throw new OpenMatesConfigError("Recovery job claim returned invalid lease or identity data");
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(claim.sealed_payload);
+    } catch {
+      throw new OpenMatesConfigError("Recovery job contained an invalid sealed envelope");
+    }
+    const plaintext = await openChatCompletionRecoveryEnvelope(envelope, {
+      recoveryPrivateKey,
+      ownerId,
+      chatId,
+      turnId,
+      jobId,
+      assistantMessageId,
+      keyVersion
+    });
+    let payload;
+    try {
+      payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(plaintext));
+    } catch {
+      throw new OpenMatesConfigError("Recovery job plaintext was not valid UTF-8 JSON");
+    }
+    const fields = ["assistant_message_id", "category", "chat_id", "content", "job_id", "key_version", "model_name", "turn_id"];
+    if (Object.keys(payload).sort().join(",") !== fields.join(",") || payload.assistant_message_id !== assistantMessageId || payload.chat_id !== chatId || payload.turn_id !== turnId || payload.job_id !== jobId || payload.key_version !== keyVersion || typeof payload.content !== "string" || payload.category !== null && typeof payload.category !== "string" || payload.model_name !== null && typeof payload.model_name !== "string") {
+      throw new OpenMatesConfigError("Recovery job plaintext did not match the terminal completion identity");
+    }
+    return {
+      assistantMessageId,
+      content: payload.content,
+      category: payload.category,
+      modelName: payload.model_name
+    };
+  }
+  async export(chatId, options = {}) {
+    const payload = await this.load(chatId);
+    return this.client.request(`/v1/sdk/chats/${encodeURIComponent(chatId)}/export`, {
+      format: options.format ?? "json",
+      payload
+    });
+  }
+  async delete(chatId, options) {
+    requireConfirmed(options, "Deleting a chat");
+    return this.client.delete(`/v1/sdk/chats/${encodeURIComponent(chatId)}`);
+  }
+  async share(chatId, options = {}) {
+    const loaded = await this.load(chatId);
+    const chat = loaded.chat;
+    if (!chat?.encrypted_chat_key) {
+      throw new OpenMatesConfigError("Chat does not include an encrypted chat key");
+    }
+    const chatKey = await decryptBytesWithAesGcm(chat.encrypted_chat_key, await this.client.masterKey());
+    if (!chatKey) {
+      throw new OpenMatesConfigError("Unable to decrypt chat key for share link");
+    }
+    const blob = await generateChatShareBlob(chatId, chatKey, options.expires ?? 0, options.password);
+    return { url: buildChatShareUrl(this.client.webOrigin(), chatId, blob) };
+  }
+  async followUps(chatId) {
+    const payload = await this.load(chatId);
+    const chat = payload.chat;
+    const encrypted = chat?.encrypted_follow_up_request_suggestions;
+    if (typeof encrypted !== "string") return [];
+    const raw = await decryptWithAesGcmCombined(encrypted, await this.client.masterKey());
+    const parsed = raw ? parseMaybeJson(raw) : [];
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  }
+  async incognito(message) {
+    return this.send(message, { saveToAccount: false });
+  }
+};
+var OpenMatesDrafts = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async listEncrypted() {
+    const response = await this.client.get("/v1/sdk/drafts");
+    return (response.drafts ?? []).map(normalizeEncryptedDraft);
+  }
+  async list() {
+    return Promise.all((await this.listEncrypted()).map((draft) => this.decrypt(draft)));
+  }
+  async getEncrypted(chatId) {
+    const response = await this.client.get(
+      `/v1/sdk/drafts/${encodeURIComponent(chatId)}`
+    );
+    return response.draft ? normalizeEncryptedDraft(response.draft) : null;
+  }
+  async get(chatId) {
+    const encrypted = await this.getEncrypted(chatId);
+    return encrypted ? this.decrypt(encrypted) : null;
+  }
+  async decrypt(draft) {
+    const masterKey = await this.client.masterKey();
+    const markdown = await decryptWithAesGcmCombined(draft.encryptedDraftMd, masterKey);
+    if (markdown === null) throw new OpenMatesConfigError("Unable to decrypt draft markdown");
+    const preview = draft.encryptedDraftPreview ? await decryptWithAesGcmCombined(draft.encryptedDraftPreview, masterKey) : markdown.slice(0, 160);
+    return { ...draft, markdown, preview };
+  }
+};
+function normalizeEncryptedDraft(raw) {
+  return {
+    chatId: String(raw.chat_id ?? ""),
+    encryptedDraftMd: String(raw.encrypted_draft_md ?? ""),
+    encryptedDraftPreview: typeof raw.encrypted_draft_preview === "string" ? raw.encrypted_draft_preview : null,
+    draftV: Number(raw.draft_v ?? 0)
+  };
+}
+var OpenMatesAccount = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async info() {
+    return this.client.get("/v1/sdk/account");
+  }
+  async setTimezone(timezone) {
+    return this.client.request("/v1/sdk/account/timezone", { timezone });
+  }
+  async listInterests() {
+    const data = await this.client.get("/v1/sdk/account/topic-preferences");
+    const encrypted = data.encrypted_settings;
+    if (typeof encrypted !== "string") return { selectedTagIds: [] };
+    const raw = await decryptWithAesGcmCombined(encrypted, await this.client.masterKey());
+    const parsed = raw ? parseMaybeJson(raw) : {};
+    return {
+      selectedTagIds: typeof parsed === "object" && parsed !== null && Array.isArray(parsed.selected_tag_ids) ? parsed.selected_tag_ids : []
+    };
+  }
+  async setInterests(selectedTagIds) {
+    const encrypted_settings = await encryptWithAesGcmCombined(
+      JSON.stringify({ selected_tag_ids: selectedTagIds }),
+      await this.client.masterKey()
+    );
+    return this.client.request("/v1/sdk/account/topic-preferences", { encrypted_settings });
+  }
+  async clearInterests() {
+    return this.setInterests([]);
+  }
+  async exportManifest() {
+    return this.client.get("/v1/sdk/account/export/manifest");
+  }
+  async exportData() {
+    return this.client.get("/v1/sdk/account/export/data");
+  }
+  async setUsername(username) {
+    return this.client.request("/v1/sdk/account/username", { username });
+  }
+  async storageOverview() {
+    return this.client.get("/v1/sdk/account/storage");
+  }
+  async storageFiles(options = {}) {
+    return this.client.get(withQuery("/v1/sdk/account/storage/files", options.query));
+  }
+  async deleteStorage(options) {
+    requireConfirmed(options, "Deleting stored account files");
+    return this.client.delete("/v1/sdk/account/storage/files", {
+      file_id: options.fileId,
+      category: options.category,
+      all: options.all === true
+    });
+  }
+};
+var OpenMatesSettings = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async setLanguage(language) {
+    return this.client.request("/v1/sdk/settings/language", { language });
+  }
+  async setDarkMode(enabled) {
+    return this.client.request("/v1/sdk/settings/dark-mode", { enabled });
+  }
+  async setFont(font) {
+    return this.client.request("/v1/sdk/settings/font", { font });
+  }
+  async setModelDefaults(defaults) {
+    return this.client.request("/v1/sdk/settings/ai-model-defaults", defaults);
+  }
+  async setChatAutoDelete(period) {
+    return this.client.request("/v1/sdk/settings/auto-delete/chats", { period });
+  }
+  async shareDebugLogs(options) {
+    requireConfirmed(options, "Sharing debug logs");
+    return unsupportedSdkFeature("Debug-log sharing");
+  }
+};
+var OpenMatesMemories = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(options = {}) {
+    const data = await this.client.get(withQuery("/v1/sdk/memories", options.query));
+    const memories = await Promise.all((data.memories ?? []).map(async (memory) => {
+      const decrypted = { ...memory };
+      if (typeof memory.encrypted_item_json === "string") {
+        const raw = await decryptWithAesGcmCombined(memory.encrypted_item_json, await this.client.masterKey());
+        decrypted.data = raw ? parseMaybeJson(raw) : null;
+      }
+      return decrypted;
+    }));
+    return { memories };
+  }
+  async types(options = {}) {
+    return this.client.get(withQuery("/v1/sdk/memories/types", options.query));
+  }
+  async create(input) {
+    return this.storeMemory(input);
+  }
+  async update(id, input) {
+    return this.storeMemory({ ...input, id });
+  }
+  async delete(id, options) {
+    requireConfirmed(options, "Deleting a memory");
+    return this.client.delete(`/v1/sdk/memories/${encodeURIComponent(id)}`);
+  }
+  async storeMemory(input) {
+    const appId = String(input.appId ?? input.app_id ?? "");
+    const itemType = String(input.itemType ?? input.item_type ?? "");
+    const rawItemValue = input.itemValue ?? input.item_value ?? input.data ?? {};
+    const itemValue = rawItemValue && typeof rawItemValue === "object" && !Array.isArray(rawItemValue) ? rawItemValue : { value: rawItemValue };
+    if (!appId || !itemType) {
+      throw new OpenMatesConfigError("Memory create/update requires appId and itemType");
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const entry = {
+      id: String(input.id ?? randomUUID6()),
+      app_id: appId,
+      item_key: hashItemKey(appId, itemType),
+      item_type: itemType,
+      encrypted_item_json: await encryptWithAesGcmCombined(
+        JSON.stringify({ ...itemValue, settings_group: appId, _original_item_key: itemType, added_date: now }),
+        await this.client.masterKey()
+      ),
+      encrypted_app_key: "",
+      created_at: Number(input.created_at ?? now),
+      updated_at: now,
+      item_version: Number(input.itemVersion ?? input.item_version ?? 1)
+    };
+    return this.client.request("/v1/sdk/memories", { entry });
+  }
+};
+var OpenMatesBilling = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async overview() {
+    return this.client.get("/v1/sdk/billing");
+  }
+  async usage(options = {}) {
+    return this.client.get(withQuery("/v1/sdk/billing/usage", options.query));
+  }
+  async usageSummaries() {
+    return this.client.get("/v1/sdk/billing/usage/summaries");
+  }
+  async usageDaily() {
+    return this.client.get("/v1/sdk/billing/usage/daily");
+  }
+  async usageExport(options = {}) {
+    return this.client.getRaw(withQuery("/v1/sdk/billing/usage/export", { months: options.months }));
+  }
+  async createBankTransferOrder(credits) {
+    return this.client.request("/v1/sdk/billing/bank-transfer-orders", { credits_amount: credits, currency: "eur" });
+  }
+  async bankTransferStatus(orderId) {
+    return this.client.get(`/v1/sdk/billing/bank-transfer-orders/${encodeURIComponent(orderId)}`);
+  }
+  async listBankTransferOrders() {
+    return this.client.get("/v1/sdk/billing/bank-transfer-orders");
+  }
+  async listInvoices() {
+    return this.client.get("/v1/sdk/billing/invoices");
+  }
+  async downloadInvoice(invoiceId) {
+    return this.client.getRaw(`/v1/sdk/billing/invoices/${encodeURIComponent(invoiceId)}/download`);
+  }
+  async downloadCreditNote(invoiceId) {
+    return this.client.getRaw(`/v1/sdk/billing/invoices/${encodeURIComponent(invoiceId)}/credit-note/download`);
+  }
+  async requestRefund(invoiceId, options) {
+    requireConfirmed(options, "Requesting an invoice refund");
+    return this.client.request("/v1/sdk/billing/refund", { invoice_id: invoiceId, email_encryption_key: options.emailEncryptionKey });
+  }
+  async redeemGiftCard(code) {
+    return this.client.request("/v1/sdk/billing/gift-cards/redeem", { code });
+  }
+  async listRedeemedGiftCards() {
+    return this.client.get("/v1/sdk/billing/gift-cards/redeemed");
+  }
+  async createGiftCardBankTransferOrder(credits) {
+    return this.client.request("/v1/sdk/billing/gift-cards/bank-transfer-orders", { credits_amount: credits, currency: "eur" });
+  }
+  async giftCardPurchaseStatus(orderId) {
+    return this.client.get(`/v1/sdk/billing/gift-cards/purchases/${encodeURIComponent(orderId)}`);
+  }
+  async listPurchasedGiftCards() {
+    return this.client.get("/v1/sdk/billing/gift-cards/purchased");
+  }
+  async setLowBalanceAutoTopup(input) {
+    return this.client.request("/v1/sdk/billing/auto-topup/low-balance", input);
+  }
+};
+var OpenMatesNotifications = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async status() {
+    return this.client.get("/v1/sdk/notifications/status");
+  }
+  async list(options = {}) {
+    return this.client.get(withQuery("/v1/sdk/notifications", { limit: options.limit }));
+  }
+};
+var OpenMatesReminders = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    return this.client.get("/v1/sdk/reminders");
+  }
+  async update(id, input) {
+    return this.client.patch(`/v1/sdk/reminders/${encodeURIComponent(id)}`, input);
+  }
+  async delete(id, options) {
+    requireConfirmed(options, "Deleting a reminder");
+    return this.client.delete(`/v1/sdk/reminders/${encodeURIComponent(id)}`);
+  }
+};
+var OpenMatesProjects = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async listSources(projectId) {
+    const response = await this.client.get(`/v1/projects/${encodeURIComponent(projectId)}/sources`);
+    return response.sources ?? [];
+  }
+  async createSource(projectId, input) {
+    const response = await this.client.request(`/v1/projects/${encodeURIComponent(projectId)}/sources`, input);
+    if (!response.source) throw new OpenMatesApiError(500, { detail: "Project source response missing source" });
+    return response.source;
+  }
+};
+var OpenMatesTasks = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(filters = {}) {
+    const response = await this.client.get(withQuery("/v1/user-tasks", {
+      status: filters.status,
+      chat_id: filters.chatId,
+      project_id: filters.projectId
+    }));
+    return response.tasks ?? [];
+  }
+  async create(input) {
+    const response = await this.client.request("/v1/user-tasks", input);
+    if (!response.task) throw new OpenMatesApiError(500, { detail: "User task response missing task" });
+    return response.task;
+  }
+  async update(taskId, input) {
+    const response = await this.client.patch(`/v1/user-tasks/${encodeURIComponent(taskId)}`, input);
+    if (!response.task) throw new OpenMatesApiError(500, { detail: "User task response missing task" });
+    return response.task;
+  }
+  async startAI(taskId, input) {
+    const response = await this.client.request(`/v1/user-tasks/${encodeURIComponent(taskId)}/start-ai`, input);
+    if (!response.task) throw new OpenMatesApiError(500, { detail: "User task response missing task" });
+    return response.task;
+  }
+};
+var OpenMatesPlans = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(filters = {}) {
+    const response = await this.client.get(withQuery("/v1/user-plans", {
+      status: filters.status,
+      chat_id: filters.chatId,
+      project_id: filters.projectId,
+      active_only: filters.activeOnly
+    }));
+    return response.plans ?? [];
+  }
+  async create(input) {
+    const response = await this.client.request("/v1/user-plans", input);
+    if (!response.plan) throw new OpenMatesApiError(500, { detail: "User plan response missing plan" });
+    return response.plan;
+  }
+  async update(planId, input) {
+    const response = await this.client.patch(`/v1/user-plans/${encodeURIComponent(planId)}`, input);
+    if (!response.plan) throw new OpenMatesApiError(500, { detail: "User plan response missing plan" });
+    return response.plan;
+  }
+  async activate(planId, input = {}) {
+    const response = await this.client.request(`/v1/user-plans/${encodeURIComponent(planId)}/activate`, input);
+    if (!response.plan) throw new OpenMatesApiError(500, { detail: "User plan response missing plan" });
+    return response.plan.primary_chat_id || typeof input.chat_id !== "string" ? response.plan : { ...response.plan, primary_chat_id: input.chat_id };
+  }
+  async complete(planId, input = {}) {
+    const response = await this.client.request(`/v1/user-plans/${encodeURIComponent(planId)}/complete`, input);
+    if (!response.plan) throw new OpenMatesApiError(500, { detail: "User plan response missing plan" });
+    return response.plan;
+  }
+  async createCriterion(planId, input) {
+    const response = await this.client.request(`/v1/user-plans/${encodeURIComponent(planId)}/criteria`, input);
+    if (!response.criterion) throw new OpenMatesApiError(500, { detail: "User plan criterion response missing criterion" });
+    return response.criterion;
+  }
+  async createVerification(planId, input) {
+    const response = await this.client.request(`/v1/user-plans/${encodeURIComponent(planId)}/verification`, input);
+    if (!response.verification) throw new OpenMatesApiError(500, { detail: "User plan verification response missing verification" });
+    return response.verification;
+  }
+  async addVerificationEvidence(planId, verificationId, input) {
+    const response = await this.client.request(`/v1/user-plans/${encodeURIComponent(planId)}/verification/${encodeURIComponent(verificationId)}/evidence`, input);
+    if (!response.verification) throw new OpenMatesApiError(500, { detail: "User plan verification response missing verification" });
+    return response.verification;
+  }
+};
+var OpenMatesWorkflows = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    const response = await this.client.get("/v1/workflows");
+    return response.workflows ?? [];
+  }
+  async temporary() {
+    const response = await this.client.get("/v1/workflows/temporary");
+    return response.workflows ?? [];
+  }
+  async capabilities() {
+    const response = await this.client.get("/v1/workflows/capabilities");
+    return response.capabilities ?? [];
+  }
+  async validateYaml(source) {
+    const response = await this.client.request("/v1/workflows/validate", { source });
+    if (!response.validation) throw new OpenMatesApiError(500, { detail: "Workflow validation response missing validation" });
+    return response.validation;
+  }
+  async createFromYaml(source) {
+    const response = await this.client.request("/v1/workflows/yaml", { source });
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow YAML response missing workflow" });
+    if (!response.validation) throw new OpenMatesApiError(500, { detail: "Workflow YAML response missing validation" });
+    return { workflow: response.workflow, validation: response.validation };
+  }
+  async updateFromYaml(workflowId, source) {
+    const response = await this.client.request(`/v1/workflows/${encodeURIComponent(workflowId)}/yaml`, { source });
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow YAML response missing workflow" });
+    if (!response.validation) throw new OpenMatesApiError(500, { detail: "Workflow YAML response missing validation" });
+    return { workflow: response.workflow, validation: response.validation };
+  }
+  async startInput(params) {
+    const response = await this.client.request("/v1/workflows/input", {
+      ...params.text !== void 0 ? { text: params.text } : {},
+      input_type: params.inputType ?? "text",
+      ...params.audioRef !== void 0 ? { audio_ref: params.audioRef } : {},
+      ...params.selectedWorkflowId !== void 0 ? { selected_workflow_id: params.selectedWorkflowId } : {},
+      ...params.selectedProjectId !== void 0 ? { selected_project_id: params.selectedProjectId } : {}
+    });
+    if (!response.session) throw new OpenMatesApiError(500, { detail: "Workflow input response missing session" });
+    return response.session;
+  }
+  async inputSession(sessionId) {
+    const response = await this.client.get(`/v1/workflows/input/${encodeURIComponent(sessionId)}`);
+    if (!response.session) throw new OpenMatesApiError(500, { detail: "Workflow input response missing session" });
+    return response.session;
+  }
+  async inputEvents(sessionId, afterEventId = 0) {
+    const response = await this.client.get(`/v1/workflows/input/${encodeURIComponent(sessionId)}/events?after_event_id=${encodeURIComponent(String(afterEventId))}`);
+    return response.events ?? [];
+  }
+  async followUpInput(sessionId, text) {
+    const response = await this.client.request(`/v1/workflows/input/${encodeURIComponent(sessionId)}/follow-up`, { text });
+    if (!response.session) throw new OpenMatesApiError(500, { detail: "Workflow input response missing session" });
+    return response.session;
+  }
+  async stopInput(sessionId) {
+    const response = await this.client.request(`/v1/workflows/input/${encodeURIComponent(sessionId)}/stop`, {});
+    if (!response.session) throw new OpenMatesApiError(500, { detail: "Workflow input response missing session" });
+    return response.session;
+  }
+  async undoInput(sessionId) {
+    const response = await this.client.request(`/v1/workflows/input/${encodeURIComponent(sessionId)}/undo`, {});
+    if (!response.session) throw new OpenMatesApiError(500, { detail: "Workflow input response missing session" });
+    return response.session;
+  }
+  async get(workflowId) {
+    const response = await this.client.get(`/v1/workflows/${encodeURIComponent(workflowId)}`);
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow response missing workflow" });
+    return response.workflow;
+  }
+  async create(params) {
+    const response = await this.client.request("/v1/workflows", {
+      title: params.title,
+      ...params.description !== void 0 ? { description: params.description } : {},
+      graph: params.graph,
+      enabled: params.enabled ?? false,
+      run_content_retention: params.runContentRetention ?? "last_5",
+      ...params.lifecycle ? { lifecycle: params.lifecycle } : {},
+      ...params.source ? { source: params.source } : {},
+      ...params.sourceChatId !== void 0 ? { source_chat_id: params.sourceChatId } : {},
+      ...params.createdByAssistant !== void 0 ? { created_by_assistant: params.createdByAssistant } : {},
+      ...params.autoDeleteAt !== void 0 ? { auto_delete_at: params.autoDeleteAt } : {}
+    });
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow response missing workflow" });
+    return response.workflow;
+  }
+  async update(workflowId, params) {
+    const payload = {};
+    if (params.title !== void 0) payload.title = params.title;
+    if (params.description !== void 0) payload.description = params.description;
+    if (params.graph !== void 0) payload.graph = params.graph;
+    if (params.enabled !== void 0) payload.enabled = params.enabled;
+    if (params.runContentRetention !== void 0) payload.run_content_retention = params.runContentRetention;
+    const response = await this.client.patch(`/v1/workflows/${encodeURIComponent(workflowId)}`, payload);
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow response missing workflow" });
+    return response.workflow;
+  }
+  async enable(workflowId) {
+    const response = await this.client.request(`/v1/workflows/${encodeURIComponent(workflowId)}/enable`, {});
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow response missing workflow" });
+    return response.workflow;
+  }
+  async disable(workflowId) {
+    const response = await this.client.request(`/v1/workflows/${encodeURIComponent(workflowId)}/disable`, {});
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow response missing workflow" });
+    return response.workflow;
+  }
+  async delete(workflowId, options = {}) {
+    requireConfirmed(options, "Deleting a workflow");
+    return this.client.delete(`/v1/workflows/${encodeURIComponent(workflowId)}`);
+  }
+  async keep(workflowId) {
+    const response = await this.client.request(`/v1/workflows/${encodeURIComponent(workflowId)}/keep`, {});
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow response missing workflow" });
+    return response.workflow;
+  }
+  async run(workflowId, params) {
+    if (!params.idempotencyKey.trim()) throw new OpenMatesConfigError("Workflow run requires a stable idempotencyKey");
+    const response = await this.client.request(`/v1/workflows/${encodeURIComponent(workflowId)}/run`, {
+      mode: params.mode ?? "manual",
+      input: params.input ?? {}
+    }, void 0, { "Idempotency-Key": params.idempotencyKey });
+    if (!response.run) throw new OpenMatesApiError(500, { detail: "Workflow response missing run" });
+    return response.run;
+  }
+  async runs(workflowId) {
+    const response = await this.client.get(`/v1/workflows/${encodeURIComponent(workflowId)}/runs`);
+    return response.runs ?? [];
+  }
+  async runDetail(workflowId, runId) {
+    const response = await this.client.get(`/v1/workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}`);
+    if (!response.run) throw new OpenMatesApiError(500, { detail: "Workflow response missing run" });
+    return response.run;
+  }
+  async cancelRun(workflowId, runId) {
+    const result = await this.client.request(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}/cancel`,
+      {}
+    );
+    if (result.status !== "cancellation_requested" && result.status !== "cancelled") {
+      throw new OpenMatesApiError(500, { detail: "Workflow response has invalid cancellation status" });
+    }
+    return result;
+  }
+  async respond(workflowId, runId, stepId, input) {
+    const response = await this.client.request(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}/respond`,
+      { step_id: stepId, input }
+    );
+    if (!response.run) throw new OpenMatesApiError(500, { detail: "Workflow response missing run" });
+    return response.run;
+  }
+  async upsertTemplateProjection(workflowId, params) {
+    return this.client.put(`/v1/workflows/${encodeURIComponent(workflowId)}/template-projection`, {
+      template_id: params.templateId,
+      source_version: params.sourceVersion,
+      ciphertext: params.ciphertext,
+      ciphertext_checksum: params.ciphertextChecksum,
+      owner_wrapped_key: params.ownerWrappedKey,
+      projection_schema_version: params.projectionSchemaVersion
+    });
+  }
+  async getPublicTemplateProjection(templateId) {
+    return this.client.getPublic(
+      `/v1/workflows/template-projections/${encodeURIComponent(templateId)}`
+    );
+  }
+  async revokeTemplateProjection(workflowId) {
+    return this.client.request(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/template-projection/revoke`,
+      {}
+    );
+  }
+  async unrevokeTemplateProjection(workflowId) {
+    return this.client.request(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/template-projection/unrevoke`,
+      {}
+    );
+  }
+  async completeImportedBinding(workflowId, params) {
+    return this.client.request(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/binding-requirements/complete`,
+      { type: params.type, node_id: params.nodeId }
+    );
+  }
+  async createTemplateShortUrl(params) {
+    return this.client.request("/v1/share/short-url", {
+      token: params.token,
+      encrypted_url: params.encryptedUrl,
+      content_type: "workflow_template",
+      content_id: params.templateId,
+      password_protected: params.passwordProtected ?? false,
+      ...params.ttlSeconds !== void 0 ? { ttl_seconds: params.ttlSeconds } : {}
+    });
+  }
+  async revokeShortUrl(token) {
+    return this.client.delete(`/v1/share/short-url/${encodeURIComponent(token)}`);
+  }
+  async importTemplate(payload) {
+    const response = await this.client.request("/v1/workflows/template-import", payload);
+    if (!response.workflow) throw new OpenMatesApiError(500, { detail: "Workflow template import response missing workflow" });
+    return response.workflow;
+  }
+};
+var OpenMatesDocs = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    return this.client.get("/v1/sdk/docs");
+  }
+  async search(query) {
+    return this.client.get(withQuery("/v1/sdk/docs/search", { q: query }));
+  }
+  async show(slug) {
+    return this.client.get(`/v1/sdk/docs/${encodeURIComponent(slug)}`);
+  }
+  async download(slug) {
+    return this.client.get(`/v1/sdk/docs/${encodeURIComponent(slug)}/download`);
+  }
+};
+var OpenMatesEmbeds = class {
+  preview;
+  client;
+  constructor(client) {
+    this.client = client;
+    this.preview = new OpenMatesEmbedPreview(client);
+  }
+  async show(embedId) {
+    return this.client.get(`/v1/sdk/embeds/${encodeURIComponent(embedId)}`);
+  }
+  async share(embedId, options = {}) {
+    const shown = await this.show(embedId);
+    const keys = Array.isArray(shown.embed_keys) ? shown.embed_keys : [];
+    const embedKey = await this.client.resolveEmbedKeyForShare(keys, embedId);
+    if (!embedKey) throw new OpenMatesConfigError("Unable to resolve embed key for share link");
+    const blob = await generateEmbedShareBlob(embedId, embedKey, options.expires ?? 0, options.password);
+    return { url: buildEmbedShareUrl(this.client.webOrigin(), embedId, blob) };
+  }
+  async versions(embedId) {
+    return this.client.get(`/v1/sdk/embeds/${encodeURIComponent(embedId)}/versions`);
+  }
+  async version(embedId, version) {
+    return this.client.get(`/v1/sdk/embeds/${encodeURIComponent(embedId)}/versions/${version}`);
+  }
+  async restoreVersion(embedId, version, options) {
+    requireConfirmed(options, "Restoring an embed version");
+    return this.client.request(`/v1/sdk/embeds/${encodeURIComponent(embedId)}/versions/${version}/restore`);
+  }
+};
+var OpenMatesEmbedPreview = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async start(embedId, options) {
+    const response = await this.client.request(
+      `/v1/applications/${encodeURIComponent(embedId)}/preview/start`,
+      {
+        chat_id: options.chatId,
+        ...options.sharedContext ? { shared_context: options.sharedContext } : {},
+        ...options.requestedRuntime ? { requested_runtime: options.requestedRuntime } : {},
+        ...options.sourceMessageId ? { source_message_id: options.sourceMessageId } : {}
+      }
+    );
+    return options.wait === true ? this.waitForRunning(response.session_id, options.timeoutMs ?? 12e4) : response;
+  }
+  async status(sessionId) {
+    return this.client.get(`/v1/applications/preview/${encodeURIComponent(sessionId)}`);
+  }
+  async open(sessionId) {
+    return this.client.request(`/v1/applications/preview/${encodeURIComponent(sessionId)}/open`, {});
+  }
+  async stop(sessionId) {
+    return this.client.request(`/v1/applications/preview/${encodeURIComponent(sessionId)}/stop`, {});
+  }
+  async waitForRunning(sessionId, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      const status = await this.status(sessionId);
+      if (["running", "failed", "timeout", "cancelled", "stopped"].includes(status.status)) {
+        return status;
+      }
+      await new Promise((resolve7) => setTimeout(resolve7, 1e3));
+    }
+    throw new OpenMatesApiError(408, { detail: "Application preview did not reach running state before timeout" });
+  }
+};
+var OpenMatesConnectedAccounts = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async import(input) {
+    const payload = await decryptConnectedAccountCliTransferPayload(input.payload, input.passcode);
+    const account = await this.client.get("/v1/sdk/account");
+    const userId = typeof account.id === "string" ? account.id : "";
+    if (!userId) {
+      throw new OpenMatesConfigError("Could not resolve current user id for connected account import");
+    }
+    const row = await buildEncryptedConnectedAccountImportRow({
+      payload,
+      userId,
+      masterKey: await this.client.masterKey()
+    });
+    return this.client.request("/v1/sdk/connected-accounts/import", { row });
+  }
+};
+var OpenMatesLearningMode = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async status() {
+    return this.client.get("/v1/sdk/learning-mode");
+  }
+  async enable(input) {
+    return this.client.request("/v1/sdk/learning-mode/enable", { age_group: input.ageGroup, passcode: input.passcode });
+  }
+  async disable(passcode) {
+    return this.client.request("/v1/sdk/learning-mode/disable", { passcode });
+  }
+};
+var OpenMatesInspirations = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(options = {}) {
+    return this.client.get(withQuery("/v1/sdk/inspirations", { lang: options.language }));
+  }
+};
+var OpenMatesNewChatSuggestions = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(options = {}) {
+    return this.client.get(withQuery("/v1/sdk/new-chat-suggestions", { limit: options.limit ?? 10 }));
+  }
+};
+var OpenMatesFeedback = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async assistantResponse(input) {
+    return this.client.request("/v1/sdk/feedback/assistant-response", input);
+  }
+};
+var OpenMatesBenchmark = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async run(input) {
+    return this.client.request("/v1/sdk/benchmark/run", input);
+  }
+  async estimate(input) {
+    return this.client.request("/v1/sdk/benchmark/estimate", input);
+  }
+};
+
+// src/cli.ts
+import { createInterface as createInterface5 } from "readline/promises";
+import { stdin as stdin3, stdout as stdout2 } from "process";
+import { readFileSync as readFileSync10, realpathSync, writeFileSync as writeFileSync7 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { basename as basename3, dirname as dirname4 } from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+import WebSocket2 from "ws";
+
 // ../secret-scanner/src/registry.ts
 import { createRequire as createRequire2 } from "module";
 
@@ -14303,10 +15662,10 @@ var OutputRedactor = class {
 };
 
 // src/fileEmbed.ts
-import { readFileSync as readFileSync4, statSync, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync5, statSync, existsSync as existsSync6 } from "fs";
 import { basename, extname, resolve as resolve2 } from "path";
-import { homedir as homedir4 } from "os";
-import { createHash as createHash6 } from "crypto";
+import { homedir as homedir5 } from "os";
+import { createHash as createHash7 } from "crypto";
 var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
 var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
   ".pem",
@@ -14510,7 +15869,7 @@ function processEnvFileZeroKnowledge(content) {
 }
 function resolvePath(filePath) {
   if (filePath.startsWith("~/")) {
-    return resolve2(homedir4(), filePath.slice(2));
+    return resolve2(homedir5(), filePath.slice(2));
   }
   return resolve2(filePath);
 }
@@ -14522,7 +15881,7 @@ function processFiles(filePaths, redactor) {
     const resolvedPath = resolvePath(rawPath);
     const filename = basename(resolvedPath);
     const ext = getExt(filename);
-    if (!existsSync5(resolvedPath)) {
+    if (!existsSync6(resolvedPath)) {
       errors.push({ path: rawPath, error: "File not found" });
       continue;
     }
@@ -14588,7 +15947,7 @@ function processFiles(filePaths, redactor) {
 }
 function processCodeFile(filePath, filename, redactor) {
   try {
-    let content = readFileSync4(filePath, "utf-8");
+    let content = readFileSync5(filePath, "utf-8");
     let secretsRedacted = false;
     let zeroKnowledge = false;
     if (isEnvFile(filename)) {
@@ -14616,7 +15975,7 @@ function processCodeFile(filePath, filename, redactor) {
       line_count: lineCount
     });
     const textPreview = `${filename} (${language}, ${lineCount} lines)`;
-    const contentHash = createHash6("sha256").update(content).digest("hex");
+    const contentHash = createHash7("sha256").update(content).digest("hex");
     const embed = {
       embedId,
       embedRef,
@@ -16171,12 +17530,12 @@ function formatTs(ts) {
 
 // src/server.ts
 import { execFileSync as execFileSync2, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
-import { createHash as createHash7, randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync2, closeSync, copyFileSync, cpSync, existsSync as existsSync6, mkdirSync as mkdirSync3, mkdtempSync, openSync, readFileSync as readFileSync5, readSync, readdirSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash8, randomBytes as randomBytes4 } from "crypto";
+import { chmodSync as chmodSync3, closeSync, copyFileSync, cpSync, existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, openSync, readFileSync as readFileSync6, readSync, readdirSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { createInterface as createInterface3 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
-import { homedir as homedir5 } from "os";
-import { dirname, join as join3, resolve as resolve3 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
 
 // src/branding.ts
 var OPENMATES_WORDMARK = "OPENMATES";
@@ -16446,19 +17805,19 @@ function planContinuousUpdateService(input) {
 }
 
 // src/server.ts
-var SOURCE_COMPOSE_FILE = join3("backend", "core", "docker-compose.yml");
+var SOURCE_COMPOSE_FILE = join4("backend", "core", "docker-compose.yml");
 var ROLE_IMAGE_COMPOSE_FILES = {
-  core: join3("backend", "core", "docker-compose.selfhost.yml"),
-  upload: join3("backend", "upload", "docker-compose.yml"),
-  preview: join3("backend", "preview", "docker-compose.preview.yml")
+  core: join4("backend", "core", "docker-compose.selfhost.yml"),
+  upload: join4("backend", "upload", "docker-compose.yml"),
+  preview: join4("backend", "preview", "docker-compose.preview.yml")
 };
 var ROLE_TEMPLATE_FILES = {
-  core: join3("core", "docker-compose.selfhost.yml"),
-  upload: join3("upload", "docker-compose.yml"),
-  preview: join3("preview", "docker-compose.preview.yml")
+  core: join4("core", "docker-compose.selfhost.yml"),
+  upload: join4("upload", "docker-compose.yml"),
+  preview: join4("preview", "docker-compose.preview.yml")
 };
-var COMPOSE_OVERRIDE = join3("backend", "core", "docker-compose.override.yml");
-var DEFAULT_INSTALL_PATH = join3(homedir5(), "openmates");
+var COMPOSE_OVERRIDE = join4("backend", "core", "docker-compose.override.yml");
+var DEFAULT_INSTALL_PATH = join4(homedir6(), "openmates");
 var REPO_URL = "https://github.com/glowingkitty/OpenMates.git";
 var DEV_BRANCH = "dev";
 var MAIN_BRANCH = "main";
@@ -16472,8 +17831,8 @@ var IMAGE_CHANNEL_TAGS = {
   main: MAIN_BRANCH,
   dev: DEV_BRANCH
 };
-var BACKEND_CONFIG_FILE = join3("backend", "config", "backend_config.yml");
-var IMAGE_RUNTIME_CONFIG_FILE = join3("config", "backend_config.yml");
+var BACKEND_CONFIG_FILE = join4("backend", "config", "backend_config.yml");
+var IMAGE_RUNTIME_CONFIG_FILE = join4("config", "backend_config.yml");
 var LOCAL_AI_MODELS_FILE = "local-ai-models.yml";
 var OFF_BY_DEFAULT_FEATURES = /* @__PURE__ */ new Map([
   ["embed:code:application", "Application previews are still unstable"],
@@ -16613,7 +17972,7 @@ function loadConfigForInstallPath(installPath) {
 }
 function getInstallMode(installPath, config = loadConfigForInstallPath(installPath)) {
   if (config?.installMode) return config.installMode;
-  if (Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync6(join3(installPath, composeFile)))) return "image";
+  if (Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync7(join4(installPath, composeFile)))) return "image";
   return "source";
 }
 function getServerRole(flags, config) {
@@ -16698,24 +18057,24 @@ function featureKind(featureId) {
 function composeArgs(installPath, withOverrides, installMode = getInstallMode(installPath), role = "core") {
   const composeFile = installMode === "image" ? ROLE_IMAGE_COMPOSE_FILES[role] : SOURCE_COMPOSE_FILE;
   const args = ["compose", "--env-file", ".env", "-f", composeFile];
-  if (withOverrides && existsSync6(join3(installPath, COMPOSE_OVERRIDE))) {
+  if (withOverrides && existsSync7(join4(installPath, COMPOSE_OVERRIDE))) {
     args.push("-f", COMPOSE_OVERRIDE);
   }
   return args;
 }
 function ensureGitWorkDirEnv(installPath) {
-  const envPath = join3(installPath, ".env");
-  if (!existsSync6(envPath)) return;
-  const content = readFileSync5(envPath, "utf-8");
+  const envPath = join4(installPath, ".env");
+  if (!existsSync7(envPath)) return;
+  const content = readFileSync6(envPath, "utf-8");
   const lineRegex = /^GIT_WORK_DIR=.*$/m;
   const value = `GIT_WORK_DIR=${installPath}`;
   if (lineRegex.test(content)) {
     const next = content.replace(lineRegex, value);
-    if (next !== content) writeFileSync3(envPath, next);
+    if (next !== content) writeFileSync4(envPath, next);
     return;
   }
   const separator2 = content.endsWith("\n") ? "" : "\n";
-  writeFileSync3(envPath, `${content}${separator2}${value}
+  writeFileSync4(envPath, `${content}${separator2}${value}
 `);
 }
 function requireDocker() {
@@ -16736,7 +18095,7 @@ function requireGit() {
 }
 function getPackageVersion() {
   try {
-    const packageJson = JSON.parse(readFileSync5(new URL("../package.json", import.meta.url), "utf-8"));
+    const packageJson = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf-8"));
     return packageJson.version ?? "";
   } catch {
     return "";
@@ -16789,10 +18148,10 @@ function resolveTargetImageTag(flags, currentTag, packageVersion) {
   return { tag: getDefaultImageTagForVersion(packageVersion) };
 }
 function randomHex(bytes) {
-  return randomBytes3(bytes).toString("hex");
+  return randomBytes4(bytes).toString("hex");
 }
 function generateInviteCode() {
-  const digits = Array.from(randomBytes3(12), (byte) => String(byte % 10)).join("");
+  const digits = Array.from(randomBytes4(12), (byte) => String(byte % 10)).join("");
   return `${digits.slice(0, 4)}-${digits.slice(4, 8)}-${digits.slice(8, 12)}`;
 }
 function getEnvVar(content, name) {
@@ -16829,38 +18188,38 @@ async function fetchText(url) {
   return response.text();
 }
 function packagedTemplatePath(role) {
-  return join3(dirname(new URL(import.meta.url).pathname), "..", "templates", ROLE_TEMPLATE_FILES[role]);
+  return join4(dirname2(new URL(import.meta.url).pathname), "..", "templates", ROLE_TEMPLATE_FILES[role]);
 }
 function packagedCaddyTemplatePath(role) {
-  return join3(dirname(new URL(import.meta.url).pathname), "..", "templates", "caddy", role, "Caddyfile");
+  return join4(dirname2(new URL(import.meta.url).pathname), "..", "templates", "caddy", role, "Caddyfile");
 }
 function fileHash(path) {
-  if (!existsSync6(path)) return null;
-  return createHash7("sha256").update(readFileSync5(path)).digest("hex");
+  if (!existsSync7(path)) return null;
+  return createHash8("sha256").update(readFileSync6(path)).digest("hex");
 }
 async function loadSelfHostComposeTemplate(templateRef, role) {
   const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
   if (templateDir) {
-    return readFileSync5(join3(resolve3(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
+    return readFileSync6(join4(resolve3(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
   }
   const overrideUrl = process.env.OPENMATES_SELFHOST_COMPOSE_URL;
   if (overrideUrl) {
     return fetchText(overrideUrl);
   }
   const packaged = packagedTemplatePath(role);
-  if (existsSync6(packaged)) return readFileSync5(packaged, "utf-8");
+  if (existsSync7(packaged)) return readFileSync6(packaged, "utf-8");
   return fetchText(`https://raw.githubusercontent.com/glowingkitty/OpenMates/${templateRef}/${ROLE_IMAGE_COMPOSE_FILES[role]}`);
 }
 async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
-  const roleDir = join3(installPath, "backend", role === "core" ? "core" : role);
-  const vaultConfigDir = join3(roleDir, "vault", "config");
-  mkdirSync3(vaultConfigDir, { recursive: true });
-  mkdirSync3(join3(installPath, "config", "providers"), { recursive: true });
-  writeFileSync3(join3(installPath, ROLE_IMAGE_COMPOSE_FILES[role]), await loadSelfHostComposeTemplate(templateRefForImageTag(imageTag, getPackageVersion()), role));
-  writeFileSync3(join3(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
+  const roleDir = join4(installPath, "backend", role === "core" ? "core" : role);
+  const vaultConfigDir = join4(roleDir, "vault", "config");
+  mkdirSync4(vaultConfigDir, { recursive: true });
+  mkdirSync4(join4(installPath, "config", "providers"), { recursive: true });
+  writeFileSync4(join4(installPath, ROLE_IMAGE_COMPOSE_FILES[role]), await loadSelfHostComposeTemplate(templateRefForImageTag(imageTag, getPackageVersion()), role));
+  writeFileSync4(join4(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
   ensureImageRuntimeConfig(installPath);
-  const envPath = join3(installPath, ".env");
-  let envContent = existsSync6(envPath) ? readFileSync5(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
+  const envPath = join4(installPath, ".env");
+  let envContent = existsSync7(envPath) ? readFileSync6(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
   envContent = setEnvIfEmpty(envContent, "DATABASE_ADMIN_PASSWORD", randomHex(12));
   envContent = setEnvIfEmpty(envContent, "DATABASE_PASSWORD", randomHex(12));
   envContent = setEnvIfEmpty(envContent, "DIRECTUS_TOKEN", randomHex(32));
@@ -16872,13 +18231,13 @@ async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
   envContent = setEnvVar(envContent, "OPENMATES_IMAGE_TAG", imageTag);
   envContent = setEnvVar(envContent, "OPENMATES_IMAGE_REGISTRY", DEFAULT_IMAGE_REGISTRY);
   envContent = setEnvVar(envContent, "GIT_WORK_DIR", installPath);
-  writeFileSync3(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
+  writeFileSync4(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
 `);
 }
 function getImageTagFromEnv(installPath, config) {
-  const envPath = join3(installPath, ".env");
-  if (existsSync6(envPath)) {
-    const envTag = getEnvVar(readFileSync5(envPath, "utf-8"), "OPENMATES_IMAGE_TAG");
+  const envPath = join4(installPath, ".env");
+  if (existsSync7(envPath)) {
+    const envTag = getEnvVar(readFileSync6(envPath, "utf-8"), "OPENMATES_IMAGE_TAG");
     if (envTag) return envTag;
   }
   return config?.imageTag ?? "";
@@ -16911,8 +18270,8 @@ async function waitForServerHealth(installPath, role = "core", options = {}) {
     }
     throw new Error(`Updated ${role} server did not pass health checks in time. Tried ${healthUrl}.`);
   }
-  const envPath = join3(installPath, ".env");
-  const envContent = existsSync6(envPath) ? readFileSync5(envPath, "utf-8") : "";
+  const envPath = join4(installPath, ".env");
+  const envContent = existsSync7(envPath) ? readFileSync6(envPath, "utf-8") : "";
   const urls = deriveSelfHostCliUrls(envContent);
   const apiHealthUrl = `${trailingSlashTrimmed(urls.apiUrl)}/health`;
   const appUrl = trailingSlashTrimmed(urls.appUrl);
@@ -16935,9 +18294,9 @@ function defaultCloneBranchForVersion(version) {
   return /-(alpha|beta|rc)(\.|\d|$)/.test(version) ? DEV_BRANCH : null;
 }
 function hasLlmCredentials(envPath) {
-  if (!existsSync6(envPath)) return false;
-  if (hasLocalAiModels(dirname(envPath))) return true;
-  const content = readFileSync5(envPath, "utf-8");
+  if (!existsSync7(envPath)) return false;
+  if (hasLocalAiModels(dirname2(envPath))) return true;
+  const content = readFileSync6(envPath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (trimmed.startsWith("#") || !trimmed) continue;
@@ -16952,8 +18311,8 @@ function hasLlmCredentials(envPath) {
   return false;
 }
 function warnIfMissingLlmCredentials(installPath) {
-  const envPath = join3(installPath, ".env");
-  if (!existsSync6(envPath)) {
+  const envPath = join4(installPath, ".env");
+  if (!existsSync7(envPath)) {
     console.error(
       "No .env file found. Run 'openmates server install' first, or create .env from .env.example."
     );
@@ -16978,22 +18337,22 @@ function printJson(data) {
   console.log(JSON.stringify(data, null, 2));
 }
 function localModelsOverlayPath(installPath, installMode = getInstallMode(installPath)) {
-  if (installMode === "source") return join3(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
-  return join3(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
+  if (installMode === "source") return join4(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
+  return join4(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
 }
 function imageBackendConfigPath(installPath) {
-  return join3(installPath, IMAGE_RUNTIME_CONFIG_FILE);
+  return join4(installPath, IMAGE_RUNTIME_CONFIG_FILE);
 }
 function ensureImageRuntimeConfig(installPath) {
   const configPath = imageBackendConfigPath(installPath);
-  if (existsSync6(configPath)) return;
-  mkdirSync3(dirname(configPath), { recursive: true });
-  writeFileSync3(configPath, renderFeatureOverrides({ enabled: [], disabled: [] }));
+  if (existsSync7(configPath)) return;
+  mkdirSync4(dirname2(configPath), { recursive: true });
+  writeFileSync4(configPath, renderFeatureOverrides({ enabled: [], disabled: [] }));
 }
 function readLocalModelOverlay(path) {
-  if (!existsSync6(path)) return { providers: [] };
+  if (!existsSync7(path)) return { providers: [] };
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
     return { providers: Array.isArray(parsed.providers) ? parsed.providers : [] };
   } catch (error) {
     throw new Error(
@@ -17002,15 +18361,15 @@ function readLocalModelOverlay(path) {
   }
 }
 function writeLocalModelOverlay(path, overlay) {
-  mkdirSync3(dirname(path), { recursive: true });
-  writeFileSync3(path, `${JSON.stringify(overlay, null, 2)}
+  mkdirSync4(dirname2(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(overlay, null, 2)}
 `);
 }
 function hasLocalAiModels(installPath) {
-  const imagePath = join3(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
-  const sourcePath = join3(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
+  const imagePath = join4(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
+  const sourcePath = join4(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
   return [imagePath, sourcePath].some((path) => {
-    if (!existsSync6(path)) return false;
+    if (!existsSync7(path)) return false;
     try {
       return readLocalModelOverlay(path).providers.some((provider) => provider.models.length > 0);
     } catch {
@@ -17051,30 +18410,30 @@ function nowStamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function backupRoot(installPath) {
-  return join3(installPath, "backups");
+  return join4(installPath, "backups");
 }
 function roleBackupDir(installPath, role) {
-  return join3(backupRoot(installPath), role);
+  return join4(backupRoot(installPath), role);
 }
 function updateStatusFile(installPath, role) {
-  return join3(installPath, ".openmates", `${role}-update-status.json`);
+  return join4(installPath, ".openmates", `${role}-update-status.json`);
 }
 function writeUpdateStatus(installPath, role, status) {
   const filePath = updateStatusFile(installPath, role);
-  mkdirSync3(dirname(filePath), { recursive: true, mode: 448 });
-  writeFileSync3(filePath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
+  mkdirSync4(dirname2(filePath), { recursive: true, mode: 448 });
+  writeFileSync4(filePath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
 `, { mode: 384 });
 }
 function copyIfExists(source, destination) {
-  if (!existsSync6(source)) return;
-  mkdirSync3(dirname(destination), { recursive: true });
+  if (!existsSync7(source)) return;
+  mkdirSync4(dirname2(destination), { recursive: true });
   cpSync(source, destination, { recursive: true, force: true });
 }
 function readEnvMap(installPath) {
-  const envPath = join3(installPath, ".env");
-  if (!existsSync6(envPath)) return {};
+  const envPath = join4(installPath, ".env");
+  if (!existsSync7(envPath)) return {};
   const values = {};
-  for (const line of readFileSync5(envPath, "utf-8").split("\n")) {
+  for (const line of readFileSync6(envPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eqIdx = trimmed.indexOf("=");
@@ -17222,7 +18581,7 @@ function formatSecretPreflight(preflight) {
   return parts.join("; ");
 }
 function hashFile(path) {
-  const hash = createHash7("sha256");
+  const hash = createHash8("sha256");
   const fd = openSync(path, "r");
   const buffer = Buffer.allocUnsafe(CHECKSUM_BUFFER_BYTES);
   try {
@@ -17240,7 +18599,7 @@ function writeChecksums(rootDir) {
   const lines = [];
   const walk = (dir) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const path = join3(dir, entry.name);
+      const path = join4(dir, entry.name);
       if (entry.isDirectory()) {
         walk(path);
         continue;
@@ -17251,13 +18610,13 @@ function writeChecksums(rootDir) {
     }
   };
   walk(rootDir);
-  writeFileSync3(join3(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
+  writeFileSync4(join4(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
 `);
 }
 function verifyChecksums(rootDir) {
-  const checksumsPath = join3(rootDir, "checksums.sha256");
-  if (!existsSync6(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
-  for (const line of readFileSync5(checksumsPath, "utf-8").split("\n")) {
+  const checksumsPath = join4(rootDir, "checksums.sha256");
+  if (!existsSync7(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
+  for (const line of readFileSync6(checksumsPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed) continue;
     const match = trimmed.match(/^([a-f0-9]{64}) {2}(.+)$/);
@@ -17266,8 +18625,8 @@ function verifyChecksums(rootDir) {
     if (relative3.startsWith("/") || relative3.split(/[\\/]/).includes("..")) {
       throw new Error(`Unsafe checksum path in backup archive: ${relative3}`);
     }
-    const filePath = join3(rootDir, relative3);
-    if (!existsSync6(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative3}`);
+    const filePath = join4(rootDir, relative3);
+    if (!existsSync7(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative3}`);
     const actual = hashFile(filePath);
     if (actual !== match[1]) throw new Error(`Backup checksum mismatch for ${relative3}.`);
   }
@@ -17275,27 +18634,27 @@ function verifyChecksums(rootDir) {
 function createServerBackup(installPath, role, options = {}) {
   const plan = planBackup({ role, includeObservability: options.includeObservability });
   const backupDir = roleBackupDir(installPath, role);
-  mkdirSync3(backupDir, { recursive: true, mode: 448 });
-  const archivePath = options.output ? resolve3(options.output) : join3(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
-  const tempDir = mkdtempSync(join3(backupDir, ".tmp-"));
+  mkdirSync4(backupDir, { recursive: true, mode: 448 });
+  const archivePath = options.output ? resolve3(options.output) : join4(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  const tempDir = mkdtempSync(join4(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
   const manifest = {
     role,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     cli_version: getPackageVersion(),
-    image_tag: getEnvVar(existsSync6(join3(installPath, ".env")) ? readFileSync5(join3(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
+    image_tag: getEnvVar(existsSync7(join4(installPath, ".env")) ? readFileSync6(join4(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
     include_observability: options.includeObservability === true,
     contents: plan.contents
   };
   try {
-    writeFileSync3(join3(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    writeFileSync4(join4(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
-    copyIfExists(join3(installPath, ".env"), join3(tempDir, "runtime", ".env"));
-    copyIfExists(join3(installPath, "config"), join3(tempDir, "runtime", "config"));
+    copyIfExists(join4(installPath, ".env"), join4(tempDir, "runtime", ".env"));
+    copyIfExists(join4(installPath, "config"), join4(tempDir, "runtime", "config"));
     if (role === "core") {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      const dumpFile = openSync(join3(tempDir, "postgres.sql"), "w");
+      const dumpFile = openSync(join4(tempDir, "postgres.sql"), "w");
       try {
         const result = spawnSync(
           "docker",
@@ -17311,15 +18670,15 @@ function createServerBackup(installPath, role, options = {}) {
       }
     }
     for (const item of [
-      [join3(installPath, "backend", "core", "uploads"), join3(tempDir, "directus-uploads")],
-      [join3(installPath, "backend", "core", "extensions"), join3(tempDir, "directus-extensions")],
-      [join3(installPath, "backend", role, "vault"), join3(tempDir, `${role}-vault-config`)]
+      [join4(installPath, "backend", "core", "uploads"), join4(tempDir, "directus-uploads")],
+      [join4(installPath, "backend", "core", "extensions"), join4(tempDir, "directus-extensions")],
+      [join4(installPath, "backend", role, "vault"), join4(tempDir, `${role}-vault-config`)]
     ]) {
       copyIfExists(item[0], item[1]);
     }
     writeChecksums(tempDir);
     execSync(`tar -czf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)} .`, { stdio: "pipe" });
-    chmodSync2(archivePath, plan.fileMode);
+    chmodSync3(archivePath, plan.fileMode);
     return archivePath;
   } finally {
     rmSync3(tempDir, { recursive: true, force: true });
@@ -17327,25 +18686,25 @@ function createServerBackup(installPath, role, options = {}) {
 }
 function restoreServerBackup(installPath, role, file) {
   const archivePath = resolve3(file);
-  if (!existsSync6(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
-  mkdirSync3(roleBackupDir(installPath, role), { recursive: true, mode: 448 });
-  const tempDir = mkdtempSync(join3(roleBackupDir(installPath, role), ".restore-"));
+  if (!existsSync7(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
+  mkdirSync4(roleBackupDir(installPath, role), { recursive: true, mode: 448 });
+  const tempDir = mkdtempSync(join4(roleBackupDir(installPath, role), ".restore-"));
   const env = readEnvMap(installPath);
   try {
     execSync(`tar -xzf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)}`, { stdio: "pipe" });
     verifyChecksums(tempDir);
-    const manifestPath = join3(tempDir, "manifest.json");
-    if (!existsSync6(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
-    const manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
+    const manifestPath = join4(tempDir, "manifest.json");
+    if (!existsSync7(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
+    const manifest = JSON.parse(readFileSync6(manifestPath, "utf-8"));
     if (manifest.role !== role) throw new Error(`Backup role '${manifest.role}' does not match requested role '${role}'.`);
-    copyIfExists(join3(tempDir, "runtime", ".env"), join3(installPath, ".env"));
-    copyIfExists(join3(tempDir, "runtime", "config"), join3(installPath, "config"));
-    const postgresDump = join3(tempDir, "postgres.sql");
-    if (role === "core" && existsSync6(postgresDump)) {
+    copyIfExists(join4(tempDir, "runtime", ".env"), join4(installPath, ".env"));
+    copyIfExists(join4(tempDir, "runtime", "config"), join4(installPath, "config"));
+    const postgresDump = join4(tempDir, "postgres.sql");
+    if (role === "core" && existsSync7(postgresDump)) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
       execSync(`docker exec -i cms-database psql -v ON_ERROR_STOP=1 -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, {
-        input: readFileSync5(postgresDump),
+        input: readFileSync6(postgresDump),
         stdio: ["pipe", "pipe", "pipe"]
       });
     }
@@ -17600,26 +18959,26 @@ async function serverInstall(flags) {
   const role = getServerRole(flags, null);
   const profile = getCoreProfile(flags, null);
   const runtimePlan = planServerRuntime({ role, profile, withAlerts: flags["with-alerts"] === true });
-  if (existsSync6(join3(installPath, SOURCE_COMPOSE_FILE)) || Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync6(join3(installPath, composeFile)))) {
+  if (existsSync7(join4(installPath, SOURCE_COMPOSE_FILE)) || Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync7(join4(installPath, composeFile)))) {
     console.error(`OpenMates already exists at ${installPath}.`);
     console.error("Use 'openmates server update' to update, or choose a different --path.");
     process.exit(1);
   }
   if (!fromSource) {
     requireDocker();
-    mkdirSync3(installPath, { recursive: true });
+    mkdirSync4(installPath, { recursive: true });
     if (typeof flags["env-path"] === "string") {
       const envSource = resolve3(flags["env-path"]);
-      if (!existsSync6(envSource)) {
+      if (!existsSync7(envSource)) {
         throw new Error(`Env file not found: ${envSource}`);
       }
-      copyFileSync(envSource, join3(installPath, ".env"));
+      copyFileSync(envSource, join4(installPath, ".env"));
       console.error(`Copied ${envSource} to ${installPath}/.env`);
     }
     const imageTag = typeof flags["image-tag"] === "string" ? flags["image-tag"] : getDefaultImageTag();
     console.error(`Preparing OpenMates image-mode install at ${installPath}...`);
     await writeImageModeRuntimeFiles(installPath, imageTag, role);
-    const cliUrls2 = deriveSelfHostCliUrls(readFileSync5(join3(installPath, ".env"), "utf-8"));
+    const cliUrls2 = deriveSelfHostCliUrls(readFileSync6(join4(installPath, ".env"), "utf-8"));
     try {
       exec("docker network create openmates", installPath);
     } catch {
@@ -17639,7 +18998,7 @@ async function serverInstall(flags) {
     if (flags.json === true) {
       printJson({ command: "install", status: "success", path: installPath, mode: "image", imageTag });
     } else {
-      const firstInvite = getEnvVar(readFileSync5(join3(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
+      const firstInvite = getEnvVar(readFileSync6(join4(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
       console.log(`
 OpenMates installed at ${installPath}`);
       console.log(`Mode: image (${DEFAULT_IMAGE_REGISTRY}, tag ${imageTag})`);
@@ -17676,10 +19035,10 @@ CLI default API: ${cliUrls2.apiUrl}`);
   }
   if (typeof flags["env-path"] === "string") {
     const envSource = resolve3(flags["env-path"]);
-    if (!existsSync6(envSource)) {
+    if (!existsSync7(envSource)) {
       throw new Error(`Env file not found: ${envSource}`);
     }
-    copyFileSync(envSource, join3(installPath, ".env"));
+    copyFileSync(envSource, join4(installPath, ".env"));
     console.error(`Copied ${envSource} to ${installPath}/.env`);
   }
   console.error("\nRunning setup script...");
@@ -17692,8 +19051,8 @@ CLI default API: ${cliUrls2.apiUrl}`);
     console.error("Setup script failed. Check the output above for details.");
     process.exit(setupCode);
   }
-  const envPath = join3(installPath, ".env");
-  const cliUrls = deriveSelfHostCliUrls(existsSync6(envPath) ? readFileSync5(envPath, "utf-8") : "");
+  const envPath = join4(installPath, ".env");
+  const cliUrls = deriveSelfHostCliUrls(existsSync7(envPath) ? readFileSync6(envPath, "utf-8") : "");
   saveServerConfig({
     installPath,
     installedAt: Date.now(),
@@ -17725,15 +19084,15 @@ async function installContinuousUpdateService(flags) {
   const channel = typeof flags.channel === "string" ? flags.channel : config?.imageChannel ?? "main";
   const window = typeof flags.window === "string" ? flags.window : "02:00-04:00 UTC";
   const plan = planContinuousUpdateService({ role, channel, window });
-  const servicePath = join3("/etc", "systemd", "system", plan.serviceName);
-  const timerPath = join3("/etc", "systemd", "system", plan.timerName);
+  const servicePath = join4("/etc", "systemd", "system", plan.serviceName);
+  const timerPath = join4("/etc", "systemd", "system", plan.timerName);
   if (flags["dry-run"] === true || flags.json === true) {
     printJson({ command: "update install-service", status: "planned", role, servicePath, timerPath, unit: plan.unit, timer: plan.timer });
     return;
   }
   try {
-    writeFileSync3(servicePath, plan.unit, { mode: 420 });
-    writeFileSync3(timerPath, plan.timer, { mode: 420 });
+    writeFileSync4(servicePath, plan.unit, { mode: 420 });
+    writeFileSync4(timerPath, plan.timer, { mode: 420 });
     execSync("systemctl daemon-reload", { stdio: "pipe" });
     execSync(`systemctl enable --now ${shellQuote(plan.timerName)}`, { stdio: "pipe" });
   } catch (error) {
@@ -17750,14 +19109,14 @@ async function serverUpdate(rest, flags) {
     const role2 = getServerRole(flags, config2);
     const filePath = updateStatusFile(installPath2, role2);
     if (flags.json === true) {
-      printJson(existsSync6(filePath) ? JSON.parse(readFileSync5(filePath, "utf-8")) : { role: role2, status: "unknown" });
+      printJson(existsSync7(filePath) ? JSON.parse(readFileSync6(filePath, "utf-8")) : { role: role2, status: "unknown" });
       return;
     }
-    if (!existsSync6(filePath)) {
+    if (!existsSync7(filePath)) {
       console.log(`No update status recorded for ${role2}.`);
       return;
     }
-    console.log(readFileSync5(filePath, "utf-8").trim());
+    console.log(readFileSync6(filePath, "utf-8").trim());
     return;
   }
   if (rest[0] === "install-service") {
@@ -18066,14 +19425,14 @@ async function serverFeatures(rest, flags) {
   const installPath = resolveServerPath(flags);
   const installMode = getInstallMode(installPath);
   if (installMode === "image") ensureImageRuntimeConfig(installPath);
-  const configPath = installMode === "image" ? imageBackendConfigPath(installPath) : join3(installPath, BACKEND_CONFIG_FILE);
-  if (!existsSync6(configPath)) {
+  const configPath = installMode === "image" ? imageBackendConfigPath(installPath) : join4(installPath, BACKEND_CONFIG_FILE);
+  if (!existsSync7(configPath)) {
     throw new Error(`Backend config not found at ${configPath}. Run 'openmates server install' first or pass --path <dir>.`);
   }
-  const content = readFileSync5(configPath, "utf-8");
+  const content = readFileSync6(configPath, "utf-8");
   const overrides = parseFeatureOverrides(content);
   const writeOverrides = (nextOverrides) => {
-    writeFileSync3(configPath, updateFeatureOverridesContent(content, nextOverrides));
+    writeFileSync4(configPath, updateFeatureOverridesContent(content, nextOverrides));
     console.log(`Updated ${configPath}`);
     console.log("Restart the server for feature changes to take effect: openmates server restart");
   };
@@ -18306,7 +19665,7 @@ async function serverBackup(rest, flags) {
   const role = getServerRole(flags, config);
   if (action === "list") {
     const dir = roleBackupDir(installPath, role);
-    const files = existsSync6(dir) ? readdirSync(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
+    const files = existsSync7(dir) ? readdirSync(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
     if (flags.json === true) {
       printJson({ role, backupDir: dir, files });
       return;
@@ -18316,7 +19675,7 @@ async function serverBackup(rest, flags) {
       console.log("  none");
       return;
     }
-    for (const file of files) console.log(`  ${join3(dir, file)}`);
+    for (const file of files) console.log(`  ${join4(dir, file)}`);
     return;
   }
   requireDocker();
@@ -18476,7 +19835,7 @@ async function serverCaddy(rest, flags) {
   const role = getServerRole(flags, config);
   const appliedPath = typeof flags.config === "string" ? flags.config : "/etc/caddy/Caddyfile";
   const templatePath = packagedCaddyTemplatePath(role);
-  if (!existsSync6(templatePath)) throw new Error(`Packaged Caddy template not found: ${templatePath}`);
+  if (!existsSync7(templatePath)) throw new Error(`Packaged Caddy template not found: ${templatePath}`);
   const plan = planCaddyCommand({ role, action, appliedPath });
   const payload = {
     ...plan,
@@ -18495,7 +19854,7 @@ async function serverCaddy(rest, flags) {
     return;
   }
   if (action === "diff") {
-    if (!existsSync6(appliedPath)) throw new Error(`Applied Caddyfile not found: ${appliedPath}`);
+    if (!existsSync7(appliedPath)) throw new Error(`Applied Caddyfile not found: ${appliedPath}`);
     try {
       execSync(`diff -u ${shellQuote(appliedPath)} ${shellQuote(templatePath)}`, { stdio: "inherit" });
     } catch (error) {
@@ -18516,9 +19875,9 @@ WARNING: This will replace ${appliedPath} with the packaged ${role} Caddyfile.`)
       }
     }
     const backupPath = `${appliedPath}.openmates-backup-${nowStamp()}`;
-    const hadExistingCaddyfile = existsSync6(appliedPath);
+    const hadExistingCaddyfile = existsSync7(appliedPath);
     try {
-      mkdirSync3(dirname(appliedPath), { recursive: true });
+      mkdirSync4(dirname2(appliedPath), { recursive: true });
       if (hadExistingCaddyfile) copyFileSync(appliedPath, backupPath);
       copyFileSync(templatePath, appliedPath);
       execSync("systemctl reload caddy", { stdio: "inherit" });
@@ -53151,10 +54510,10 @@ function buildAssistantFeedbackDecision(rating) {
 }
 
 // src/benchmark.ts
-import { randomUUID as randomUUID6 } from "crypto";
-import { existsSync as existsSync7, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, readdirSync as readdirSync2, writeFileSync as writeFileSync4 } from "fs";
+import { randomUUID as randomUUID7 } from "crypto";
+import { existsSync as existsSync8, mkdtempSync as mkdtempSync2, readFileSync as readFileSync7, readdirSync as readdirSync2, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join4, resolve as resolve5 } from "path";
+import { dirname as dirname3, join as join5, resolve as resolve5 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_JUDGE_MODEL = "google/gemini-3-flash-preview";
 var DEFAULT_EXTENSIVE_SIZE = 10;
@@ -53451,7 +54810,7 @@ async function handleBenchmark(client, subcommand, rest, flags) {
   const caseIds = parseCaseIds(flags.case);
   const dryRun = flags["dry-run"] === true;
   const output = typeof flags.output === "string" ? flags.output : void 0;
-  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID6();
+  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID7();
   const imagePath = typeof flags.image === "string" ? resolve5(flags.image) : defaultImageFixturePath();
   if (!dryRun && flags["confirm-spend-credits"] !== true) {
     throw new Error(
@@ -53747,7 +55106,7 @@ async function buildPromptWithAttachments(client, benchmarkCase, model, imagePat
 ${attachment.messageSuffix}`, embeds: attachment.embeds };
 }
 async function prepareImageAttachment(client, imagePath) {
-  if (!existsSync7(imagePath)) throw new Error(`Benchmark image not found: ${imagePath}`);
+  if (!existsSync8(imagePath)) throw new Error(`Benchmark image not found: ${imagePath}`);
   const processed = processFiles([imagePath], null);
   if (processed.blocked.length > 0 || processed.errors.length > 0 || processed.embeds.length === 0) {
     const reason = [...processed.blocked, ...processed.errors].map((entry) => entry.error).join("; ") || "no image embed produced";
@@ -53861,7 +55220,7 @@ function buildLongContextHistory() {
 }
 function appendHistory(history, role, content) {
   history.push({
-    message_id: randomUUID6(),
+    message_id: randomUUID7(),
     role,
     sender_name: role === "user" ? "User" : "Assistant",
     content,
@@ -53953,8 +55312,8 @@ function loadProviderPricing() {
   if (!providersDir) return pricing;
   for (const fileName of readdirSync2(providersDir)) {
     if (!fileName.endsWith(".yml")) continue;
-    const filePath = join4(providersDir, fileName);
-    const text = readFileSync6(filePath, "utf-8");
+    const filePath = join5(providersDir, fileName);
+    const text = readFileSync7(filePath, "utf-8");
     const provider = parseProviderId(text) ?? fileName.replace(/\.yml$/, "");
     for (const modelPricing of parseModelPricing(text, provider)) {
       pricing.set(`${modelPricing.provider}/${modelPricing.modelId}`, modelPricing);
@@ -54006,13 +55365,13 @@ function normalizeModelKey(model) {
 }
 function findProvidersDir() {
   const currentFile = fileURLToPath(import.meta.url);
-  let current = dirname2(currentFile);
+  let current = dirname3(currentFile);
   for (let index = 0; index < 8; index += 1) {
-    const candidate = join4(current, "backend", "providers");
-    if (existsSync7(candidate)) return candidate;
-    const parentCandidate = join4(current, "..", "..", "backend", "providers");
-    if (existsSync7(parentCandidate)) return resolve5(parentCandidate);
-    const next = dirname2(current);
+    const candidate = join5(current, "backend", "providers");
+    if (existsSync8(candidate)) return candidate;
+    const parentCandidate = join5(current, "..", "..", "backend", "providers");
+    if (existsSync8(parentCandidate)) return resolve5(parentCandidate);
+    const next = dirname3(current);
     if (next === current) break;
     current = next;
   }
@@ -54133,18 +55492,18 @@ function round2(value) {
   return Math.round(value * 100) / 100;
 }
 function defaultImageFixturePath() {
-  const fixtureDir = join4(dirname2(fileURLToPath(import.meta.url)), "..", "fixtures");
-  const fixturePath = join4(fixtureDir, "brandenburger-tor.png");
-  if (existsSync7(fixturePath)) return fixturePath;
-  const tempDir = mkdtempSync2(join4(tmpdir(), "openmates-benchmark-"));
-  const tempPath = join4(tempDir, "brandenburger-tor.svg");
-  writeFileSync4(tempPath, FIXTURE_IMAGE_SVG, "utf-8");
+  const fixtureDir = join5(dirname3(fileURLToPath(import.meta.url)), "..", "fixtures");
+  const fixturePath = join5(fixtureDir, "brandenburger-tor.png");
+  if (existsSync8(fixturePath)) return fixturePath;
+  const tempDir = mkdtempSync2(join5(tmpdir(), "openmates-benchmark-"));
+  const tempPath = join5(tempDir, "brandenburger-tor.svg");
+  writeFileSync5(tempPath, FIXTURE_IMAGE_SVG, "utf-8");
   return tempPath;
 }
 function writeBenchmarkResult(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync4(output, json, "utf-8");
+  if (output) writeFileSync5(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -55503,10 +56862,10 @@ function clamp(value, min, max) {
 }
 
 // src/remoteAccess.ts
-import { homedir as homedir6 } from "os";
-import { chmodSync as chmodSync3, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir7 } from "os";
+import { chmodSync as chmodSync4, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
 import { spawn as spawn2 } from "child_process";
-import { join as join5, resolve as resolve6, relative as relative2 } from "path";
+import { join as join6, resolve as resolve6, relative as relative2 } from "path";
 
 // src/projectFileRisk.ts
 var SECRET_OR_ENVIRONMENT_PATTERNS = [
@@ -55612,15 +56971,15 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mp4",
   ".mov"
 ]);
-function resolveRemoteCachePath(sourceId, homeDirectory = homedir6()) {
+function resolveRemoteCachePath(sourceId, homeDirectory = homedir7()) {
   assertSafeSourceId(sourceId);
-  return join5(homeDirectory, ".openmates", "remote-cache", sourceId);
+  return join6(homeDirectory, ".openmates", "remote-cache", sourceId);
 }
 function startRemoteAccessSource(input) {
   assertSafeSourceId(input.sourceId);
-  const homeDirectory = input.homeDirectory ?? homedir6();
+  const homeDirectory = input.homeDirectory ?? homedir7();
   const rootPath = resolve6(input.rootPath);
-  if (!existsSync8(rootPath) || !statSync2(rootPath).isDirectory()) {
+  if (!existsSync9(rootPath) || !statSync2(rootPath).isDirectory()) {
     throw new Error(`Remote source path does not exist or is not a directory: ${rootPath}`);
   }
   const now = Math.floor(Date.now() / 1e3);
@@ -55637,14 +56996,14 @@ function startRemoteAccessSource(input) {
   };
   const sources = listRemoteAccessSources(homeDirectory).filter((entry) => entry.sourceId !== input.sourceId);
   saveRemoteAccessSources([...sources, source], homeDirectory);
-  mkdirSync4(source.cachePath, { recursive: true, mode: 448 });
+  mkdirSync5(source.cachePath, { recursive: true, mode: 448 });
   return source;
 }
-function listRemoteAccessSources(homeDirectory = homedir6()) {
+function listRemoteAccessSources(homeDirectory = homedir7()) {
   const filePath = remoteAccessStorePath(homeDirectory);
-  if (!existsSync8(filePath)) return [];
+  if (!existsSync9(filePath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync7(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(filePath, "utf-8"));
     if (!Array.isArray(parsed.sources)) {
       throw new Error("Remote source store is missing the sources array");
     }
@@ -55793,16 +57152,16 @@ function parseRgMatch(line) {
   }
 }
 function remoteAccessStorePath(homeDirectory) {
-  return join5(homeDirectory, ".openmates", "remote-sources.json");
+  return join6(homeDirectory, ".openmates", "remote-sources.json");
 }
 function saveRemoteAccessSources(sources, homeDirectory) {
   const filePath = remoteAccessStorePath(homeDirectory);
-  const stateDir = join5(homeDirectory, ".openmates");
-  mkdirSync4(stateDir, { recursive: true, mode: 448 });
-  chmodSync3(stateDir, 448);
-  writeFileSync5(filePath, `${JSON.stringify({ sources }, null, 2)}
+  const stateDir = join6(homeDirectory, ".openmates");
+  mkdirSync5(stateDir, { recursive: true, mode: 448 });
+  chmodSync4(stateDir, 448);
+  writeFileSync6(filePath, `${JSON.stringify({ sources }, null, 2)}
 `, { mode: 384 });
-  chmodSync3(filePath, 384);
+  chmodSync4(filePath, 384);
 }
 function assertRemoteAccessSourceRecord(value, index) {
   if (typeof value !== "object" || value === null) {
@@ -55821,13 +57180,13 @@ function assertRemoteAccessSourceRecord(value, index) {
 
 // src/selfUpdate.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 var PACKAGE_NAME = "openmates";
 var DEFAULT_TARGET = "latest";
 var SAFE_TARGET_RE = /^[a-zA-Z0-9._@+~:-]+$/;
 function getCliPackageVersion() {
   try {
-    const packageJson = JSON.parse(readFileSync8(new URL("../package.json", import.meta.url), "utf-8"));
+    const packageJson = JSON.parse(readFileSync9(new URL("../package.json", import.meta.url), "utf-8"));
     return packageJson.version ?? "unknown";
   } catch {
     return "unknown";
@@ -56449,7 +57808,7 @@ async function handleRemoteAccess(client, subcommand, rest, flags) {
     if (!rootPath) {
       throw new Error("Missing source path. Usage: openmates remote-access start --path <folder>");
     }
-    const sourceId = typeof flags["source-id"] === "string" ? flags["source-id"] : randomUUID7();
+    const sourceId = typeof flags["source-id"] === "string" ? flags["source-id"] : randomUUID8();
     const projectId = typeof flags.project === "string" ? flags.project : void 0;
     validateRemoteSourceRegistrationFlags(projectId, flags);
     const sourceType = parseRemoteAccessSourceType(flags.type);
@@ -56606,6 +57965,7 @@ async function handleChats(client, subcommand, rest, flags, redactor) {
     printChatsHelp();
     return;
   }
+  const apiKey = resolveApiKey(flags) ?? void 0;
   if (rest[0] === "tasks") {
     await handleTasks(client, rest[1], rest.slice(2), { ...flags, chat: subcommand });
     return;
@@ -56613,7 +57973,7 @@ async function handleChats(client, subcommand, rest, flags, redactor) {
   if (subcommand === "list") {
     const limit = typeof flags.limit === "string" ? parseInt(flags.limit, 10) : 10;
     const page = typeof flags.page === "string" ? parseInt(flags.page, 10) : 1;
-    const result = client.hasSession() ? await client.listChats(limit, page) : listExampleChats(limit, page);
+    const result = apiKey ? await listApiKeyChats(client, apiKey, limit, page) : client.hasSession() ? await client.listChats(limit, page) : listExampleChats(limit, page);
     if (flags.json === true) {
       printJson2(result);
     } else {
@@ -56627,7 +57987,7 @@ async function handleChats(client, subcommand, rest, flags, redactor) {
       throw new Error(
         "Missing search query. Usage: openmates chats search <query>"
       );
-    const result = client.hasSession() ? await client.searchChats(query) : searchExampleChats(query);
+    const result = apiKey ? await searchApiKeyChats(client, apiKey, query) : client.hasSession() ? await client.searchChats(query) : searchExampleChats(query);
     if (flags.json === true) {
       printJson2(result);
     } else {
@@ -56647,7 +58007,7 @@ async function handleChats(client, subcommand, rest, flags, redactor) {
       throw new Error(
         "Missing message text. Usage: openmates chats new <message>"
       );
-    const result = await sendMessageStreaming(
+    const result = apiKey ? await sendApiKeyChatNew(client, apiKey, message, flags) : await sendMessageStreaming(
       client,
       {
         message,
@@ -56887,7 +58247,14 @@ Run 'openmates chats show ` + chatId + "' to check if suggestions have been save
     let deleted = 0;
     for (const r of resolved) {
       try {
-        await client.deleteChat(r.input);
+        if (apiKey) {
+          await new OpenMates({ apiKey, apiUrl: client.apiUrl }).chats.delete(
+            r.input,
+            { confirmed: true }
+          );
+        } else {
+          await client.deleteChat(r.input);
+        }
         const label = r.title ? `"${r.title}"` : r.input;
         process.stdout.write(`  \x1B[32m\u2713\x1B[0m Deleted ${label}
 `);
@@ -57035,16 +58402,16 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       }
     }
     const { mkdir, writeFile } = await import("fs/promises");
-    const { join: join6 } = await import("path");
+    const { join: join7 } = await import("path");
     if (useZip) {
-      const tmpDir = join6(outputDir, `.${filenameBase}_tmp`);
+      const tmpDir = join7(outputDir, `.${filenameBase}_tmp`);
       await mkdir(tmpDir, { recursive: true });
-      await writeFile(join6(tmpDir, `${filenameBase}.yml`), yamlContent);
-      await writeFile(join6(tmpDir, `${filenameBase}.md`), mdContent);
+      await writeFile(join7(tmpDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile(join7(tmpDir, `${filenameBase}.md`), mdContent);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join6(tmpDir, "code", fpath);
+          const fullPath = join7(tmpDir, "code", fpath);
           await mkdir(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -57052,13 +58419,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join6(tmpDir, "transcripts");
+        const tDir = join7(tmpDir, "transcripts");
         await mkdir(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile(join6(tDir, te.filename), te.content);
+          await writeFile(join7(tDir, te.filename), te.content);
         }
       }
-      const zipPath = join6(outputDir, `${filenameBase}.zip`);
+      const zipPath = join7(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
         execSync2(`cd "${tmpDir}" && zip -r "${zipPath}" .`, { stdio: "pipe" });
@@ -57073,17 +58440,17 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         );
       }
     } else {
-      const chatDir = join6(outputDir, filenameBase);
+      const chatDir = join7(outputDir, filenameBase);
       await mkdir(chatDir, { recursive: true });
       const written = [];
-      await writeFile(join6(chatDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile(join7(chatDir, `${filenameBase}.yml`), yamlContent);
       written.push(`${filenameBase}.yml`);
-      await writeFile(join6(chatDir, `${filenameBase}.md`), mdContent);
+      await writeFile(join7(chatDir, `${filenameBase}.md`), mdContent);
       written.push(`${filenameBase}.md`);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join6(chatDir, "code", fpath);
+          const fullPath = join7(chatDir, "code", fpath);
           await mkdir(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -57092,10 +58459,10 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join6(chatDir, "transcripts");
+        const tDir = join7(chatDir, "transcripts");
         await mkdir(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile(join6(tDir, te.filename), te.content);
+          await writeFile(join7(tDir, te.filename), te.content);
           written.push(`transcripts/${te.filename}`);
         }
       }
@@ -57131,7 +58498,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       printJson2({
         chat_id: chat.id,
         title: chat.title,
-        output_dir: useZip ? join6(outputDir, `${filenameBase}.zip`) : join6(outputDir, filenameBase),
+        output_dir: useZip ? join7(outputDir, `${filenameBase}.zip`) : join7(outputDir, filenameBase),
         files,
         code_embeds: codeEmbeds.length,
         transcript_embeds: transcriptEmbeds.length
@@ -57256,6 +58623,109 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
   printChatsHelp();
   process.exit(1);
 }
+async function listApiKeyChats(client, apiKey, limit, page) {
+  const safeLimit = Number.isFinite(limit) && limit > 0 ? limit : 10;
+  const safePage = Number.isFinite(page) && page > 0 ? page : 1;
+  const sdk = new OpenMates({ apiKey, apiUrl: client.apiUrl });
+  const chats = await sdk.chats.list({ limit: safeLimit, offset: (safePage - 1) * safeLimit });
+  return sdkChatsToChatListPage(chats, safeLimit, safePage);
+}
+async function searchApiKeyChats(client, apiKey, query) {
+  const sdk = new OpenMates({ apiKey, apiUrl: client.apiUrl });
+  const chats = await sdk.chats.search(query, { limit: 0 });
+  return sdkChatsToChatListPage(chats, chats.length || 1, 1).chats;
+}
+function sdkChatsToChatListPage(chats, limit, page) {
+  return {
+    chats: chats.map((chat) => {
+      const category = typeof chat.category === "string" ? chat.category : null;
+      return {
+        id: chat.id,
+        shortId: chat.id.slice(0, 8),
+        title: typeof chat.title === "string" ? chat.title : null,
+        summary: typeof chat.chat_summary === "string" ? chat.chat_summary : null,
+        updatedAt: normalizeSdkTimestamp(chat.updated_at),
+        category,
+        mateName: category ? MATE_NAMES[category] ?? null : null
+      };
+    }),
+    total: chats.length,
+    page,
+    limit,
+    hasMore: chats.length >= limit
+  };
+}
+function normalizeSdkTimestamp(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? Math.floor(parsed / 1e3) : null;
+  }
+  return null;
+}
+async function sendApiKeyChatNew(client, apiKey, message, flags) {
+  const sdk = new OpenMates({ apiKey, apiUrl: client.apiUrl });
+  const response = await sdk.chats.send(message, {
+    saveToAccount: false
+  });
+  const result = normalizeApiKeyChatResponse(response);
+  if (flags.json !== true) {
+    const category = typeof result.category === "string" ? result.category : null;
+    const modelName = typeof result.modelName === "string" ? result.modelName : null;
+    const mateBlock = ansiMateBlock(category, category ? MATE_NAMES[category] ?? null : null);
+    const modelSuffix = modelName ? `  \x1B[2m${modelName}\x1B[0m` : "";
+    process.stdout.write(`${SEP}
+`);
+    process.stdout.write(`${mateBlock}${modelSuffix}
+`);
+    process.stdout.write(`${SEP}
+`);
+    process.stdout.write(`${String(result.assistant ?? "")}
+`);
+    const chatId = typeof result.chatId === "string" ? result.chatId : null;
+    if (chatId) {
+      const shortId = chatId.slice(0, 8);
+      process.stdout.write(`${SEP}
+`);
+      process.stdout.write(
+        `\x1B[2mContinue: openmates chats send --chat ${shortId} "your message"\x1B[0m
+\x1B[2mHistory:  openmates chats show ${shortId}\x1B[0m
+`
+      );
+    }
+  }
+  return result;
+}
+function normalizeApiKeyChatResponse(response) {
+  const chatId = typeof response.chat_id === "string" ? response.chat_id : null;
+  const category = typeof response.category === "string" ? response.category : null;
+  const modelName = typeof response.model_name === "string" ? response.model_name : null;
+  return {
+    status: "completed",
+    chatId,
+    chat_id: chatId,
+    messageId: null,
+    message_id: null,
+    assistant: typeof response.content === "string" ? response.content : "",
+    category,
+    modelName,
+    model_name: modelName,
+    mateName: category ? MATE_NAMES[category] ?? null : null,
+    followUpSuggestions: [],
+    follow_up_suggestions: [],
+    taskEvents: [],
+    task_events: [],
+    pendingTaskUpdateJobs: [],
+    pending_task_update_jobs: [],
+    subChatEvents: [],
+    sub_chat_events: [],
+    appSettingsMemoryRequests: [],
+    app_settings_memory_requests: [],
+    acceptedTaskProposals: [],
+    accepted_task_proposals: [],
+    raw: response
+  };
+}
 function resolveExampleChatForOpen(target) {
   const numericTarget = parseInt(target, 10);
   if (!Number.isNaN(numericTarget) && String(numericTarget) === target.trim()) {
@@ -57302,7 +58772,7 @@ async function handleWorkflows(client, subcommand, rest, flags) {
   if (subcommand === "validate") {
     const file = typeof flags.file === "string" ? flags.file : "";
     if (!file) throw new Error("Missing --file. Example: openmates workflows validate --file workflow.yml");
-    const validation = await client.validateWorkflowYaml(readFileSync9(file, "utf8"));
+    const validation = await client.validateWorkflowYaml(readFileSync10(file, "utf8"));
     if (flags.json === true) {
       printJson2(validation);
     } else {
@@ -57318,7 +58788,7 @@ async function handleWorkflows(client, subcommand, rest, flags) {
   if (subcommand === "create") {
     const yamlFile = typeof flags.file === "string" ? flags.file : "";
     if (yamlFile) {
-      const result = await client.createWorkflowYaml(readFileSync9(yamlFile, "utf8"));
+      const result = await client.createWorkflowYaml(readFileSync10(yamlFile, "utf8"));
       if (flags.json === true) {
         printJson2(result);
       } else {
@@ -57351,7 +58821,7 @@ async function handleWorkflows(client, subcommand, rest, flags) {
     const workflowId = rest[0];
     const yamlFile = typeof flags.file === "string" ? flags.file : "";
     if (!workflowId || !yamlFile) throw new Error("Missing workflow ID or --file. Example: openmates workflows update <id> --file workflow.yml");
-    const result = await client.updateWorkflowYaml(workflowId, readFileSync9(yamlFile, "utf8"));
+    const result = await client.updateWorkflowYaml(workflowId, readFileSync10(yamlFile, "utf8"));
     if (flags.json === true) {
       printJson2(result);
     } else {
@@ -58470,7 +59940,7 @@ async function handleEmbeds(client, subcommand, rest, flags) {
         throw new Error("Embed version content was not available after local reconstruction.");
       }
       if (typeof flags.output === "string") {
-        writeFileSync6(flags.output, result.content, "utf-8");
+        writeFileSync7(flags.output, result.content, "utf-8");
         if (flags.json === true) {
           printJson2({ ...result, output: flags.output });
         } else {
@@ -58912,11 +60382,11 @@ function parseYamlScalar(value) {
 }
 async function saveDownloadedDocument(document, output) {
   const { mkdir, writeFile } = await import("fs/promises");
-  const { join: join6, basename: basename4, dirname: dirname4 } = await import("path");
+  const { join: join7, basename: basename4, dirname: dirname5 } = await import("path");
   const target = typeof output === "string" ? output : ".";
   const filename = basename4(document.filename || "document.pdf");
-  const filePath = target.endsWith(".pdf") ? target : join6(target, filename);
-  await mkdir(dirname4(filePath), { recursive: true });
+  const filePath = target.endsWith(".pdf") ? target : join7(target, filename);
+  await mkdir(dirname5(filePath), { recursive: true });
   await writeFile(filePath, document.data);
   return filePath;
 }
@@ -59073,7 +60543,7 @@ async function promptPlainText(question) {
 }
 async function writeSecretFile(filePath, content, force = false) {
   const { mkdir, writeFile, stat: stat2 } = await import("fs/promises");
-  const { dirname: dirname4 } = await import("path");
+  const { dirname: dirname5 } = await import("path");
   try {
     await stat2(filePath);
     if (!force) throw new Error(`${filePath} already exists. Use --force to overwrite.`);
@@ -59083,13 +60553,13 @@ async function writeSecretFile(filePath, content, force = false) {
     }
     if (error instanceof Error && !("code" in error)) throw error;
   }
-  await mkdir(dirname4(filePath), { recursive: true });
+  await mkdir(dirname5(filePath), { recursive: true });
   await writeFile(filePath, content, { mode: 384 });
   return filePath;
 }
 async function generateProvisioningPassword() {
-  const { randomBytes: randomBytes4 } = await import("crypto");
-  return `OM-${randomBytes4(18).toString("base64url")}-aA2#`;
+  const { randomBytes: randomBytes5 } = await import("crypto");
+  return `OM-${randomBytes5(18).toString("base64url")}-aA2#`;
 }
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
@@ -62574,7 +64044,7 @@ async function handleDocs(client, subcommand, rest, flags) {
   }
   if (subcommand === "download") {
     const { writeFile, mkdir } = await import("fs/promises");
-    const { join: join6, dirname: dirname4 } = await import("path");
+    const { join: join7, dirname: dirname5 } = await import("path");
     if (flags.all === true) {
       const outputDir = typeof flags.output === "string" ? flags.output : "./openmates-docs";
       const tree = await client.listDocs();
@@ -62583,8 +64053,8 @@ async function handleDocs(client, subcommand, rest, flags) {
       let count = 0;
       for (const slug2 of slugs) {
         const content2 = await client.getDoc(slug2);
-        const filePath = join6(outputDir, `${slug2}.md`);
-        await mkdir(dirname4(filePath), { recursive: true });
+        const filePath = join7(outputDir, `${slug2}.md`);
+        await mkdir(dirname5(filePath), { recursive: true });
         await writeFile(filePath, content2, "utf-8");
         count++;
         process.stderr.write(`\r  Downloaded ${count}/${slugs.length}`);
@@ -62657,7 +64127,7 @@ function isCliEntrypoint() {
   try {
     const invokedPath = realpathSync(entrypoint);
     const modulePath = realpathSync(fileURLToPath2(import.meta.url));
-    return invokedPath === modulePath || basename3(invokedPath) === "cli.js" && dirname3(invokedPath) === dirname3(modulePath);
+    return invokedPath === modulePath || basename3(invokedPath) === "cli.js" && dirname4(invokedPath) === dirname4(modulePath);
   } catch {
     return false;
   }
@@ -62671,21 +64141,6 @@ if (isCliEntrypoint()) {
 }
 
 export {
-  deriveChatCompletionRecoveryKeypair,
-  openChatCompletionRecoveryEnvelope,
-  unwrapApiKeyMasterKey,
-  decryptWithAesGcmCombined,
-  decryptBytesWithAesGcm,
-  encryptBytesWithAesGcm,
-  encryptWithAesGcmCombined,
-  hashItemKey,
-  generateChatShareBlob,
-  generateEmbedShareBlob,
-  deriveWebOrigin,
-  buildChatShareUrl,
-  buildEmbedShareUrl,
-  decryptConnectedAccountCliTransferPayload,
-  buildEncryptedConnectedAccountImportRow,
   INTEREST_TAG_IDS,
   normalizeInterestTagIds,
   MEMORY_TYPE_REGISTRY,
@@ -62694,7 +64149,9 @@ export {
   deriveAppUrl,
   OpenMatesClient,
   APP_SKILL_METADATA,
-  GeneratedAppSkills,
+  OpenMatesConfigError,
+  OpenMatesApiError,
+  OpenMates,
   SUPPORT_URL,
   renderSupportInfo,
   defaultCloneBranchForVersion,