openmates 0.18.0-alpha.0 → 0.18.0-alpha.10

package/dist/{chunk-RLOO6QKC.js → chunk-ISGTN5LQ.js}

@@ -1015,6 +1015,10 @@ var OpenMatesHttpClient = class {
   getCookieMap() {
     return Object.fromEntries(this.cookies.entries());
   }
+  replaceCookies(cookies) {
+    this.cookies.clear();
+    for (const [name, value] of Object.entries(cookies)) this.cookies.set(name, value);
+  }
   async get(path2, headers = {}) {
     return this.request("GET", path2, void 0, headers);
   }
@@ -1194,8 +1198,10 @@ import {
   readdirSync,
   readFileSync as readFileSync2,
   rmSync,
+  renameSync,
   writeFileSync
 } from "fs";
+import lockfile from "proper-lockfile";
 import { createHash as createHash4 } from "crypto";
 import { homedir as homedir2 } from "os";
 import { isAbsolute, join, resolve } from "path";
@@ -1483,7 +1489,55 @@ function saveAnonymousId(anonymousId) {
     createdAt: Math.floor(Date.now() / 1e3)
   });
 }
-function saveSession(session) {
+var SESSION_LOCK_STALE_MS = 3e4;
+var SESSION_LOCK_POLL_MS = 50;
+async function withSessionRefreshLock(operation) {
+  const path2 = join(ensureStateDir(), "session.json");
+  const release2 = await lockfile.lock(`${path2}.refresh`, {
+    realpath: false,
+    stale: SESSION_LOCK_STALE_MS,
+    retries: { retries: 600, factor: 1, minTimeout: SESSION_LOCK_POLL_MS, maxTimeout: SESSION_LOCK_POLL_MS }
+  });
+  try {
+    return await operation();
+  } finally {
+    await release2();
+  }
+}
+function saveSession(session, options = {}) {
+  const path2 = join(ensureStateDir(), "session.json");
+  let release2;
+  const waitCell = new Int32Array(new SharedArrayBuffer(4));
+  for (let attempt = 0; ; attempt++) {
+    try {
+      release2 = lockfile.lockSync(`${path2}.write`, { realpath: false, stale: SESSION_LOCK_STALE_MS });
+      break;
+    } catch (error) {
+      if (error.code !== "ELOCKED" || attempt >= 100) throw error;
+      Atomics.wait(waitCell, 0, 0, SESSION_LOCK_POLL_MS);
+    }
+  }
+  try {
+    const current = readJsonFile(path2);
+    if (current && !options.replace) {
+      if (current.sessionId !== session.sessionId || current.hashedEmail !== session.hashedEmail || current.apiUrl !== session.apiUrl) {
+        throw new Error("Login session changed in another process. Retry the command using the current profile.");
+      }
+      if (options.expectedRefreshToken !== void 0) {
+        if (current.cookies.auth_refresh_token !== options.expectedRefreshToken) {
+          throw new Error("Login credentials changed during refresh. Retry with the current profile.");
+        }
+      } else {
+        session.cookies = { ...current.cookies };
+        session.wsToken = current.wsToken;
+      }
+    }
+    writeSession(session);
+  } finally {
+    release2();
+  }
+}
+function writeSession(session) {
   const filePath = join(ensureStateDir(), "session.json");
   const result = storeMasterKey(session.masterKeyExportedB64, resolveKeyStorageId(session.hashedEmail));
   const onDisk = {
@@ -1516,7 +1570,13 @@ function saveSession(session) {
       onDisk.emailEncryptionKeyB64 = session.emailEncryptionKeyB64;
     }
   }
-  writeJsonFile(filePath, onDisk);
+  const temporary = `${filePath}.${process.pid}.tmp`;
+  try {
+    writeJsonFile(temporary, onDisk);
+    renameSync(temporary, filePath);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
   if (result.type !== "plaintext") {
     process.stderr.write("Decrypting data...\n");
   }
@@ -7509,7 +7569,9 @@ var OpenMatesClient = class _OpenMatesClient {
   apiUrl;
   session;
   http;
+  explicitSession;
   constructor(options = {}) {
+    this.explicitSession = options.session !== void 0;
     const diskSession = options.session ?? this.getValidSessionFromDisk();
     this.apiUrl = (options.apiUrl ?? process.env.OPENMATES_API_URL ?? diskSession?.apiUrl ?? loadDefaultServerApiUrl() ?? DEFAULT_API_URL).replace(/\/$/, "");
     this.session = diskSession;
@@ -8375,7 +8437,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!userId) {
       throw new Error("Could not resolve current user id for local connected-account connector.");
     }
-    const { createHash: createHash15 } = await import("crypto");
+    const { createHash: createHash16 } = await import("crypto");
     const accountId = randomUUID6();
     const masterKey = this.getMasterKeyBytes();
     const encryptLocalConnectorValue = async (value) => {
@@ -8384,9 +8446,9 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     const payload = {
       id: accountId,
-      hashed_user_id: createHash15("sha256").update(userId).digest("hex"),
+      hashed_user_id: createHash16("sha256").update(userId).digest("hex"),
       encrypted_provider_type: await encryptLocalConnectorValue(input.provider_id),
-      provider_type_hash: createHash15("sha256").update(input.provider_id).digest("hex"),
+      provider_type_hash: createHash16("sha256").update(input.provider_id).digest("hex"),
       encrypted_account_label: await encryptLocalConnectorValue(input.label),
       encrypted_capabilities: await encryptLocalConnectorValue(input.capabilities),
       encrypted_app_permissions: await encryptLocalConnectorValue({
@@ -8570,31 +8632,34 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     await this.hydrateEmailEncryptionKey(session);
     this.session = session;
-    saveSession(session);
+    saveSession(session, { replace: true });
   }
   async whoAmI() {
-    const session = this.requireSession();
-    const response = await this.http.post(
-      "/v1/auth/session",
-      { session_id: session.sessionId },
-      this.getCliRequestHeaders()
-    );
-    if (!response.ok || !response.data.success) {
-      if (response.status === 502 || response.status === 503 || response.status === 504) {
+    return this.withFreshStoredSession(async () => {
+      const session = this.requireSession();
+      const previousRefreshToken = session.cookies.auth_refresh_token;
+      const response = await this.http.post(
+        "/v1/auth/session",
+        { session_id: session.sessionId },
+        this.getCliRequestHeaders()
+      );
+      if (!response.ok || !response.data.success) {
+        if (response.status === 502 || response.status === 503 || response.status === 504) {
+          throw new Error(
+            `Session validation temporarily unavailable (HTTP ${response.status}). The API may be restarting; retry shortly.`
+          );
+        }
         throw new Error(
-          `Session validation temporarily unavailable (HTTP ${response.status}). The API may be restarting; retry shortly.`
+          `Session validation failed (HTTP ${response.status}): ${response.data.message ?? "invalid session"}${response.data.re_auth_reason ? ` (${response.data.re_auth_reason})` : ""}. Please run \`${this.loginRecoveryCommand()}\`.`
         );
       }
-      throw new Error(
-        `Session validation failed (HTTP ${response.status}): ${response.data.message ?? "invalid session"}${response.data.re_auth_reason ? ` (${response.data.re_auth_reason})` : ""}. Please run \`openmates login\`.`
-      );
-    }
-    if (response.data.ws_token) {
-      session.wsToken = response.data.ws_token;
-    }
-    session.cookies = this.http.getCookieMap();
-    saveSession(session);
-    return response.data.user ?? {};
+      if (response.data.ws_token) {
+        session.wsToken = response.data.ws_token;
+      }
+      session.cookies = this.http.getCookieMap();
+      saveSession(session, { expectedRefreshToken: previousRefreshToken });
+      return response.data.user ?? {};
+    });
   }
   async getTopicPreferences() {
     const user = await this.whoAmI();
@@ -8734,7 +8799,7 @@ var OpenMatesClient = class _OpenMatesClient {
       authorizerDeviceName: null,
       autoLogoutMinutes: null
     };
-    saveSession(session);
+    saveSession(session, { replace: true });
     this.session = session;
     return {
       success: true,
@@ -9882,8 +9947,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const { createHash: createHash15 } = await import("crypto");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const { createHash: createHash16 } = await import("crypto");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -9991,7 +10056,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async resolveEmbedKey(cache, masterKey, embed, embedId, hashedEmbedId, visited = /* @__PURE__ */ new Set()) {
     if (visited.has(embedId)) return null;
     visited.add(embedId);
-    const { createHash: createHash15 } = await import("crypto");
+    const { createHash: createHash16 } = await import("crypto");
     const masterKeyEntry = cache.embedKeys.find(
       (ek) => ek.hashed_embed_id === hashedEmbedId && String(ek.key_type) === "master"
     );
@@ -10008,7 +10073,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (chatKeyEntry && typeof chatKeyEntry.encrypted_embed_key === "string") {
       const hashedChatId = String(chatKeyEntry.hashed_chat_id ?? "");
       const owningChat = cache.chats.find((c) => {
-        const chatHash = createHash15("sha256").update(String(c.details.id ?? "")).digest("hex");
+        const chatHash = createHash16("sha256").update(String(c.details.id ?? "")).digest("hex");
         return chatHash === hashedChatId;
       });
       if (owningChat) {
@@ -10037,7 +10102,7 @@ var OpenMatesClient = class _OpenMatesClient {
         const parentFullId = String(
           parentEmbed2.embed_id ?? parentEmbed2.id ?? ""
         );
-        const parentHashedId = createHash15("sha256").update(parentFullId).digest("hex");
+        const parentHashedId = createHash16("sha256").update(parentFullId).digest("hex");
         const parentKey = await this.resolveEmbedKey(
           cache,
           masterKey,
@@ -12776,6 +12841,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (Number.isSafeInteger(context.limit) && context.limit !== void 0 && context.limit > 0) {
       params.set("limit", String(context.limit));
     }
+    if (context.newestFirst) params.set("newest_first", "true");
     const query = params.toString();
     const response = await this.http.get(
       `/v1/user-tasks/${encodeURIComponent(taskId)}/activity${query ? `?${query}` : ""}`,
@@ -13974,8 +14040,9 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const currentCookies = this.http.getCookieMap();
     if (JSON.stringify(session.cookies) !== JSON.stringify(currentCookies)) {
+      const previousRefreshToken = session.cookies.auth_refresh_token;
       session.cookies = currentCookies;
-      saveSession(session);
+      saveSession(session, { expectedRefreshToken: previousRefreshToken });
     }
     return session;
   }
@@ -14070,7 +14137,7 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const masterKey = base64ToBytes(session.masterKeyExportedB64);
     const cache = await this.ensureSynced();
-    const { createHash: createHash15 } = await import("crypto");
+    const { createHash: createHash16 } = await import("crypto");
     const embed = cache.embeds.find(
       (e) => String(e.embed_id ?? "").startsWith(embedIdOrShort) || String(e.id ?? "").startsWith(embedIdOrShort)
     );
@@ -14078,7 +14145,7 @@ Required: ${schema.required.join(", ")}`
       throw new Error(`Embed '${embedIdOrShort}' not found in local cache.`);
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -14186,8 +14253,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash15 } = await import("crypto");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const { createHash: createHash16 } = await import("crypto");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -14303,8 +14370,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash15 } = await import("crypto");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const { createHash: createHash16 } = await import("crypto");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -14445,9 +14512,30 @@ Required: ${schema.required.join(", ")}`
       session.userEmailSalt
     );
   }
+  async withFreshStoredSession(operation) {
+    return withSessionRefreshLock(async () => {
+      const previous = this.requireSession();
+      const current = loadSession();
+      if (!current && !this.explicitSession) {
+        throw new Error("Login session was removed. Log in to the current profile before retrying.");
+      }
+      if (current && !this.explicitSession) {
+        if (current.hashedEmail !== previous.hashedEmail || current.apiUrl !== previous.apiUrl) {
+          throw new Error("Login account changed in another process. Retry using the current profile.");
+        }
+        this.session = current;
+        this.http.replaceCookies(current.cookies);
+      }
+      return operation();
+    });
+  }
+  loginRecoveryCommand() {
+    const profile = process.env.OPENMATES_PROFILE?.trim();
+    return profile ? `openmates --profile ${profile} login` : "openmates login";
+  }
   requireSession() {
     if (!this.session) {
-      throw new Error("Not logged in. Run `openmates login`.");
+      throw new Error(`Not logged in. Run \`${this.loginRecoveryCommand()}\`.`);
     }
     return this.session;
   }
@@ -14527,24 +14615,30 @@ Required: ${schema.required.join(", ")}`
    * This method fetches a fresh ws_token and captures any rotated cookies.
    */
   async refreshWsToken() {
-    const session = this.requireSession();
-    let res;
-    try {
-      res = await this.http.post("/v1/auth/session", { session_id: session.sessionId }, this.getCliRequestHeaders());
-    } catch {
-      return null;
-    }
-    if (!res.ok || res.data.success === false) {
-      purgeLocalPrivateData();
-      this.session = null;
-      throw new Error("Session expired or invalid. Please run `openmates login` to re-authenticate.");
-    }
-    if (res.data.ws_token) {
-      session.wsToken = res.data.ws_token;
-    }
-    session.cookies = this.http.getCookieMap();
-    saveSession(session);
-    return typeof res.data.user?.id === "string" ? res.data.user.id : typeof res.data.user?.user_id === "string" ? res.data.user.user_id : null;
+    return this.withFreshStoredSession(async () => {
+      const session = this.requireSession();
+      const previousRefreshToken = session.cookies.auth_refresh_token;
+      let res;
+      try {
+        res = await this.http.post("/v1/auth/session", { session_id: session.sessionId }, this.getCliRequestHeaders());
+      } catch {
+        return null;
+      }
+      if (res.status >= 500) {
+        throw new Error(`Session validation temporarily unavailable (HTTP ${res.status}). Retry shortly.`);
+      }
+      if (!res.ok || res.data.success === false) {
+        purgeLocalPrivateData();
+        this.session = null;
+        throw new Error(`Session expired or invalid. Please run \`${this.loginRecoveryCommand()}\` to re-authenticate.`);
+      }
+      if (res.data.ws_token) {
+        session.wsToken = res.data.ws_token;
+      }
+      session.cookies = this.http.getCookieMap();
+      saveSession(session, { expectedRefreshToken: previousRefreshToken });
+      return typeof res.data.user?.id === "string" ? res.data.user.id : typeof res.data.user?.user_id === "string" ? res.data.user.user_id : null;
+    });
   }
   /**
    * Ensure the local sync cache is up to date. If the cache is fresh,
@@ -14744,9 +14838,9 @@ Required: ${schema.required.join(", ")}`
     chats.splice(0, chats.length, ...reconciledChats);
     if (totalChatCount === 0) totalChatCount = chats.length;
     if (reconciliation.deleted_chat_ids?.length) {
-      const { createHash: createHash15 } = await import("crypto");
+      const { createHash: createHash16 } = await import("crypto");
       const deletedHashes = new Set(
-        reconciliation.deleted_chat_ids.map((id) => createHash15("sha256").update(id).digest("hex"))
+        reconciliation.deleted_chat_ids.map((id) => createHash16("sha256").update(id).digest("hex"))
       );
       const keptEmbeds = embeds.filter((embed) => !deletedHashes.has(String(embed.hashed_chat_id ?? "")));
       const keptKeys = embedKeys.filter((key) => !deletedHashes.has(String(key.hashed_chat_id ?? "")));
@@ -20131,12 +20225,12 @@ var ACCOUNT_EXPORT_FORBIDDEN_VALUE_PATTERNS = [
 ];
 async function writeAccountExportArchive(bundle, flags = {}) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join11, dirname: dirname10 } = await import("path");
+  const { join: join13, dirname: dirname11 } = await import("path");
   const exportId = safeArchiveSegment(String(bundle.export.export_id ?? `export-${Date.now()}`));
   const archiveFormat = flags.format === "directory" ? "directory" : "zip";
   const password = typeof flags.password === "string" && flags.password.length > 0 ? flags.password : null;
   if (password && archiveFormat !== "zip") throw new Error("Password-protected account export is only supported for zip format.");
-  const outputPath = typeof flags.output === "string" ? flags.output : join11(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
+  const outputPath = typeof flags.output === "string" ? flags.output : join13(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
   const zip = archiveFormat === "zip" ? new JSZip3() : null;
   const writtenFiles = [];
   async function writeArchiveText(relativePath, content) {
@@ -20147,8 +20241,8 @@ async function writeAccountExportArchive(bundle, flags = {}) {
       return;
     }
     const stagingDir = outputPath;
-    const fullPath = join11(stagingDir, relativePath);
-    await mkdir2(dirname10(fullPath), { recursive: true });
+    const fullPath = join13(stagingDir, relativePath);
+    await mkdir2(dirname11(fullPath), { recursive: true });
     await writeFile2(fullPath, content, "utf-8");
     writtenFiles.push(relativePath);
   }
@@ -20165,7 +20259,7 @@ async function writeAccountExportArchive(bundle, flags = {}) {
   }
   await writeAccountExportChatFiles(domainPayloads.chats ?? [], writeArchiveText);
   if (archiveFormat === "directory") return { output: outputPath, format: "directory", files: writtenFiles.length };
-  await mkdir2(dirname10(outputPath), { recursive: true });
+  await mkdir2(dirname11(outputPath), { recursive: true });
   const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
   await writeFile2(outputPath, password ? encryptZipBuffer(zipBuffer, password) : zipBuffer);
   return { output: outputPath, format: "zip", files: writtenFiles.length, ...password ? { encrypted: true } : {} };
@@ -24298,10 +24392,115 @@ var OpenMatesBenchmark = class {
 // src/cli.ts
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as stdin3, stdout as stdout2 } from "process";
-import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync9 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { basename as basename3, dirname as dirname9 } from "path";
-import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID14 } from "crypto";
+
+// src/taskActivityHistory.ts
+async function readActivityHistory(options) {
+  const { query } = options;
+  const maxEntries = options.maxEntries ?? Infinity;
+  if (options.maxEntries !== void 0 && (!Number.isSafeInteger(maxEntries) || maxEntries < 1 || maxEntries > 200)) {
+    throw new Error("--max-entries must be an integer from 1 to 200");
+  }
+  if (query !== void 0 && !query.trim()) throw new Error("Activity search requires a non-empty --query");
+  const pageSize = options.pageSize ?? 100;
+  if (!Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 200) throw new Error("--limit must be from 1 to 200");
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  let cursor = options.cursor;
+  let matched = 0;
+  do {
+    const page = await options.page(cursor, query === void 0 ? Math.min(pageSize, maxEntries - entries.length) : pageSize);
+    for (const entry of page.entries) {
+      if (query === void 0 || (entry.message || "").toLocaleLowerCase().includes(query.toLocaleLowerCase())) {
+        matched++;
+        if (entries.length < maxEntries) entries.push(entry);
+      }
+    }
+    cursor = page.next_cursor || void 0;
+    if (cursor && seen.has(cursor)) throw new Error("Activity pagination repeated a cursor");
+    if (cursor) seen.add(cursor);
+  } while (cursor && (query !== void 0 || entries.length < maxEntries));
+  return { entries, next_cursor: cursor || null, truncated: Boolean(cursor) || matched > entries.length, matched };
+}
+
+// src/taskActivityDelivery.ts
+import { createHash as createHash12 } from "crypto";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync4, rmSync as rmSync3, existsSync as existsSync7 } from "fs";
+import { join as join4 } from "path";
+import lockfile2 from "proper-lockfile";
+function activityDeliveryStore(scope, stateDir2 = resolveStateDir()) {
+  const directory = join4(stateDir2, "task-activity-delivery", createHash12("sha256").update(scope).digest("hex"));
+  mkdirSync4(directory, { recursive: true, mode: 448 });
+  const pendingDirectory = join4(directory, "pending");
+  const acknowledgedDirectory = join4(directory, "acknowledged");
+  mkdirSync4(pendingDirectory, { recursive: true, mode: 448 });
+  mkdirSync4(acknowledgedDirectory, { recursive: true, mode: 448 });
+  const save = (path2, record) => {
+    const temporary = `${path2}.${process.pid}.tmp`;
+    writeFileSync4(temporary, JSON.stringify(record), { mode: 384 });
+    renameSync2(temporary, path2);
+  };
+  const send = async (path2, record, create) => {
+    if (!record.acknowledged) {
+      const acknowledged = await create(record.input);
+      if (acknowledged.entry_id !== record.input.entry_id) throw new Error("Activity acknowledgement identity mismatch");
+      record.acknowledged = acknowledged;
+      save(join4(acknowledgedDirectory, `${record.input.entry_id}.json`), record);
+      rmSync3(path2, { force: true });
+    }
+    return record.acknowledged;
+  };
+  return {
+    async deliver(id, build, create) {
+      if (!/^[a-f0-9]{64}$/.test(id)) throw new Error("--delivery-id must be a SHA-256 hex identifier");
+      const release2 = await lockfile2.lock(directory, { retries: { retries: 3, minTimeout: 100, maxTimeout: 500 }, stale: 12e4 });
+      try {
+        const acknowledgedPath = join4(acknowledgedDirectory, `${id}.json`);
+        const path2 = existsSync7(acknowledgedPath) ? acknowledgedPath : join4(pendingDirectory, `${id}.json`);
+        let record;
+        try {
+          record = JSON.parse(readFileSync6(path2, "utf8"));
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          record = { input: await build() };
+          save(path2, record);
+        }
+        return await send(path2, record, create);
+      } finally {
+        await release2();
+      }
+    },
+    async flush(create) {
+      const release2 = await lockfile2.lock(directory, { retries: 0, stale: 12e4 });
+      try {
+        const names = readdirSync2(pendingDirectory).filter((name) => /^[a-f0-9]{64}\.json$/.test(name));
+        let pending = names.length;
+        let attempted = 0;
+        for (const name of names) {
+          const path2 = join4(pendingDirectory, name);
+          const record = JSON.parse(readFileSync6(path2, "utf8"));
+          if (record.acknowledged) continue;
+          if (attempted >= 3) break;
+          attempted++;
+          try {
+            await send(path2, record, create);
+            pending--;
+          } catch {
+            break;
+          }
+        }
+        return { pending, attempted };
+      } finally {
+        await release2();
+      }
+    }
+  };
+}
+
+// src/cli.ts
+import { existsSync as existsSync14, readFileSync as readFileSync13, realpathSync as realpathSync2, writeFileSync as writeFileSync11 } from "fs";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { basename as basename4, dirname as dirname10 } from "path";
+import { createHash as createHash15, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
 import { arch as arch2, platform as platform3 } from "os";
 import { parse as parseYaml } from "yaml";
 import WebSocket2 from "ws";
@@ -26479,13 +26678,13 @@ function formatTs(ts) {
 }
 
 // src/server.ts
-import { execFileSync as execFileSync3, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes8, randomUUID as randomUUID10 } from "crypto";
-import { appendFileSync, chmodSync as chmodSync4, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, openSync as openSync2, readFileSync as readFileSync7, readSync, readdirSync as readdirSync3, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import { execFileSync as execFileSync4, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
+import { createHash as createHash13, randomBytes as randomBytes8, randomUUID as randomUUID11 } from "crypto";
+import { appendFileSync, chmodSync as chmodSync5, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, openSync as openSync2, readFileSync as readFileSync8, readSync, readdirSync as readdirSync5, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
 import { createInterface as createInterface3 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join7, resolve as resolve6 } from "path";
+import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/branding.ts
 var OPENMATES_WORDMARK = "OPENMATES";
@@ -26521,33 +26720,33 @@ function renderSupportStartReminder() {
 import { execFileSync as execFileSync2 } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync2,
-  rmSync as rmSync3,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync3,
+  rmSync as rmSync4,
   symlinkSync
 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname3, join as join4, resolve as resolve4 } from "path";
-var UI_PACKAGE_RELATIVE_PATH = join4("frontend", "packages", "ui");
-var GENERATED_LOCALES_RELATIVE_PATH = join4(UI_PACKAGE_RELATIVE_PATH, "src", "i18n", "locales");
-var BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH = join4(UI_PACKAGE_RELATIVE_PATH, "scripts", "build-translations.js");
+import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
+var UI_PACKAGE_RELATIVE_PATH = join5("frontend", "packages", "ui");
+var GENERATED_LOCALES_RELATIVE_PATH = join5(UI_PACKAGE_RELATIVE_PATH, "src", "i18n", "locales");
+var BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH = join5(UI_PACKAGE_RELATIVE_PATH, "scripts", "build-translations.js");
 var REQUIRED_LOCALE_JSON = "en.json";
 function sourceInstallLocalesPath(rootPath) {
-  return join4(rootPath, GENERATED_LOCALES_RELATIVE_PATH);
+  return join5(rootPath, GENERATED_LOCALES_RELATIVE_PATH);
 }
 function ensureSourceInstallTranslations(installPath, sourcePath) {
   const localeDir = sourceInstallLocalesPath(installPath);
-  const requiredLocalePath = join4(localeDir, REQUIRED_LOCALE_JSON);
-  if (existsSync7(requiredLocalePath)) {
+  const requiredLocalePath = join5(localeDir, REQUIRED_LOCALE_JSON);
+  if (existsSync8(requiredLocalePath)) {
     return { status: "already_present", localeDir, copiedFiles: 0 };
   }
   const copiedFiles = copyGeneratedLocaleJson(sourcePath, installPath);
-  if (existsSync7(requiredLocalePath)) {
+  if (existsSync8(requiredLocalePath)) {
     return { status: "copied", localeDir, copiedFiles };
   }
   runBuildTranslationsScript(installPath);
-  if (!existsSync7(requiredLocalePath)) {
+  if (!existsSync8(requiredLocalePath)) {
     throw new Error(`Generated locale JSON was not created at ${requiredLocalePath}.`);
   }
   return { status: "built", localeDir, copiedFiles };
@@ -26558,31 +26757,31 @@ function copyGeneratedLocaleJson(sourcePath, installPath) {
   const targetRoot = resolve4(installPath);
   if (sourceRoot === targetRoot) return 0;
   const sourceLocaleDir = sourceInstallLocalesPath(sourceRoot);
-  if (!existsSync7(join4(sourceLocaleDir, REQUIRED_LOCALE_JSON))) return 0;
+  if (!existsSync8(join5(sourceLocaleDir, REQUIRED_LOCALE_JSON))) return 0;
   const targetLocaleDir = sourceInstallLocalesPath(targetRoot);
-  mkdirSync4(targetLocaleDir, { recursive: true });
+  mkdirSync5(targetLocaleDir, { recursive: true });
   let copiedFiles = 0;
-  for (const entry of readdirSync2(sourceLocaleDir, { withFileTypes: true })) {
+  for (const entry of readdirSync3(sourceLocaleDir, { withFileTypes: true })) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    copyFileSync(join4(sourceLocaleDir, entry.name), join4(targetLocaleDir, entry.name));
+    copyFileSync(join5(sourceLocaleDir, entry.name), join5(targetLocaleDir, entry.name));
     copiedFiles += 1;
   }
   return copiedFiles;
 }
 function runBuildTranslationsScript(installPath) {
-  const uiPackageDir = join4(installPath, UI_PACKAGE_RELATIVE_PATH);
-  const buildScript = join4(installPath, BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH);
-  if (!existsSync7(buildScript)) {
+  const uiPackageDir = join5(installPath, UI_PACKAGE_RELATIVE_PATH);
+  const buildScript = join5(installPath, BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH);
+  if (!existsSync8(buildScript)) {
     throw new Error(`Translation build script not found at ${buildScript}.`);
   }
   const requireFromCli = createRequire3(import.meta.url);
   const yamlPackageDir = dirname3(requireFromCli.resolve("yaml/package.json"));
-  const nodeModulesDir = join4(uiPackageDir, "node_modules");
-  const yamlLink = join4(nodeModulesDir, "yaml");
-  const hadNodeModulesDir = existsSync7(nodeModulesDir);
-  const hadYamlPackage = existsSync7(yamlLink);
+  const nodeModulesDir = join5(uiPackageDir, "node_modules");
+  const yamlLink = join5(nodeModulesDir, "yaml");
+  const hadNodeModulesDir = existsSync8(nodeModulesDir);
+  const hadYamlPackage = existsSync8(yamlLink);
   if (!hadYamlPackage) {
-    mkdirSync4(nodeModulesDir, { recursive: true });
+    mkdirSync5(nodeModulesDir, { recursive: true });
     symlinkSync(yamlPackageDir, yamlLink, process.platform === "win32" ? "junction" : "dir");
   }
   try {
@@ -26591,15 +26790,15 @@ function runBuildTranslationsScript(installPath) {
       stdio: "inherit"
     });
   } finally {
-    if (!hadYamlPackage) rmSync3(yamlLink, { recursive: true, force: true });
-    if (!hadNodeModulesDir && existsSync7(nodeModulesDir) && readdirSync2(nodeModulesDir).length === 0) {
-      rmSync3(nodeModulesDir, { recursive: true, force: true });
+    if (!hadYamlPackage) rmSync4(yamlLink, { recursive: true, force: true });
+    if (!hadNodeModulesDir && existsSync8(nodeModulesDir) && readdirSync3(nodeModulesDir).length === 0) {
+      rmSync4(nodeModulesDir, { recursive: true, force: true });
     }
   }
 }
 
 // src/serverPlanning.ts
-import { dirname as dirname4, join as join5, resolve as resolve5 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolve5 } from "path";
 var CORE_WORKER_SERVICES = [
   "task-worker",
   "user-init-worker",
@@ -26809,10 +27008,10 @@ function parseServerRole(value) {
   throw new Error(`Unsupported server role '${value}'. Use core, upload, or preview.`);
 }
 function defaultOpenMatesCloudOverlayPath(openMatesPath) {
-  return resolve5(join5(dirname4(resolve5(openMatesPath)), OPENMATESCLOUD_OVERLAY_DIR));
+  return resolve5(join6(dirname4(resolve5(openMatesPath)), OPENMATESCLOUD_OVERLAY_DIR));
 }
 function defaultOpenMatesCloudComposeFile(overlayPath) {
-  return resolve5(join5(overlayPath, OPENMATESCLOUD_COMPOSE_FILE));
+  return resolve5(join6(overlayPath, OPENMATESCLOUD_COMPOSE_FILE));
 }
 function planOpenMatesCloudOverlay(input) {
   const deploymentMode = input.deploymentMode ?? "self_host";
@@ -26955,12 +27154,11 @@ function planUpdate(input) {
 function planBackup(input) {
   const role = parseServerRole(input.role);
   const contentsByRole = {
-    core: ["postgres-dump", "directus-uploads", "directus-extensions", "vault-data", "vault-setup-data", "runtime-env", "runtime-config", "manifest", "checksums"],
-    upload: ["vault-data", "vault-setup-data", "runtime-env", "runtime-config", "manifest", "checksums"],
-    preview: ["runtime-env", "runtime-config", "preview-cache", "manifest", "checksums"]
+    core: ["postgres-dump", "runtime-env", "runtime-config", "manifest", "checksums"],
+    upload: ["runtime-env", "runtime-config", "manifest", "checksums"],
+    preview: ["runtime-env", "runtime-config", "manifest", "checksums"]
   };
   const contents = [...contentsByRole[role]];
-  if (input.includeObservability) contents.push("openobserve-data", "prometheus-data");
   return { role, contents, fileMode: 384 };
 }
 function planRestore(input) {
@@ -27193,9 +27391,38 @@ function shouldAutoInstallRuntimeMonitoringServices(env) {
   return env.OPENMATES_SKIP_RUNTIME_MONITORING !== "1";
 }
 
+// src/serverBackupArchive.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync4, renameSync as renameSync3, rmSync as rmSync5 } from "fs";
+import { randomUUID as randomUUID8 } from "crypto";
+function assertRegularBackupTree(path2) {
+  const stat2 = lstatSync(path2);
+  if (stat2.isDirectory()) {
+    for (const entry of readdirSync4(path2)) assertRegularBackupTree(`${path2}/${entry}`);
+    return;
+  }
+  if (!stat2.isFile() || stat2.nlink !== 1) {
+    throw new Error(`Backup archive refused unsafe entry: ${path2}`);
+  }
+}
+function publishServerBackupArchive(sourceDir, archivePath, options = {}) {
+  assertRegularBackupTree(sourceDir);
+  const temporaryArchivePath = `${archivePath}.tmp-${randomUUID8()}`;
+  const previousUmask = process.umask(63);
+  try {
+    execFileSync3(options.tarCommand ?? "tar", ["-czf", temporaryArchivePath, "-C", sourceDir, "."], { stdio: "pipe" });
+    chmodSync3(temporaryArchivePath, 384);
+    renameSync3(temporaryArchivePath, archivePath);
+    chmodSync3(archivePath, 384);
+  } finally {
+    process.umask(previousUmask);
+    rmSync5(temporaryArchivePath, { force: true });
+  }
+}
+
 // src/serverHealth.ts
 import dnsModule, { promises as dns } from "dns";
-import { createHmac as createHmac4, randomUUID as randomUUID8 } from "crypto";
+import { createHmac as createHmac4, randomUUID as randomUUID9 } from "crypto";
 import { promises as fs } from "fs";
 import { isIP } from "net";
 import { request as httpsRequest } from "https";
@@ -27578,7 +27805,7 @@ async function resolveGenericWebhookTarget(rawUrl, allowLocalDevelopmentFixture
 async function sendGenericWebhook(target, secret, payload, allowLocalDevelopmentFixture = false) {
   const { url, addresses } = await resolveGenericWebhookTarget(target, allowLocalDevelopmentFixture);
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const eventId = randomUUID8();
+  const eventId = randomUUID9();
   const signed = signRuntimeWebhookPayload(payload, secret, timestamp, eventId);
   const selected = addresses[0];
   await new Promise((resolve11, reject) => {
@@ -27787,16 +28014,16 @@ function signRuntimeWebhookPayload(payload, secret, timestamp, eventId) {
 
 // src/serverUpdateState.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { chmodSync as chmodSync3, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, join as join6 } from "path";
+import { chmodSync as chmodSync4, closeSync, existsSync as existsSync9, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join7 } from "path";
 function serverUpdateStatusFile(installPath, role) {
-  return join6(installPath, ".openmates", `${role}-update-status.json`);
+  return join7(installPath, ".openmates", `${role}-update-status.json`);
 }
 function readServerUpdateStatus(installPath, role) {
   const filePath = serverUpdateStatusFile(installPath, role);
-  if (!existsSync8(filePath)) return {};
+  if (!existsSync9(filePath)) return {};
   try {
-    const parsed = JSON.parse(readFileSync6(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(filePath, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { statusReadError: "invalid_update_status" };
     }
@@ -27807,23 +28034,23 @@ function readServerUpdateStatus(installPath, role) {
 }
 function writeServerUpdateStatus(installPath, role, status) {
   const filePath = serverUpdateStatusFile(installPath, role);
-  mkdirSync5(dirname5(filePath), { recursive: true, mode: 448 });
+  mkdirSync6(dirname5(filePath), { recursive: true, mode: 448 });
   const temporaryPath = `${filePath}.${process.pid}.${randomBytes7(4).toString("hex")}.tmp`;
-  writeFileSync4(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
+  writeFileSync5(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
 `, { mode: 384 });
-  renameSync(temporaryPath, filePath);
-  chmodSync3(filePath, 384);
+  renameSync4(temporaryPath, filePath);
+  chmodSync4(filePath, 384);
 }
 function acquireServerUpdateLock(installPath) {
-  const stateDir2 = join6(installPath, ".openmates");
-  const lockPath = join6(stateDir2, "server-update.lock");
-  mkdirSync5(stateDir2, { recursive: true, mode: 448 });
+  const stateDir2 = join7(installPath, ".openmates");
+  const lockPath = join7(stateDir2, "server-update.lock");
+  mkdirSync6(stateDir2, { recursive: true, mode: 448 });
   let descriptor;
   try {
     descriptor = openSync(lockPath, "wx", 384);
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
-    const lockOwner = readFileSync6(lockPath, "utf8").trim();
+    const lockOwner = readFileSync7(lockPath, "utf8").trim();
     const lockPid = Number.parseInt(lockOwner.split(":", 1)[0] ?? "", 10);
     let stale = false;
     try {
@@ -27835,17 +28062,17 @@ function acquireServerUpdateLock(installPath) {
     throw new Error(stale ? "A stale OpenMates server update lock exists for this installation; verify no update is running, then remove .openmates/server-update.lock explicitly." : "Another OpenMates server update is already running for this installation.");
   }
   const ownershipToken = `${process.pid}:${randomBytes7(16).toString("hex")}`;
-  writeFileSync4(descriptor, ownershipToken);
+  writeFileSync5(descriptor, ownershipToken);
   return () => {
     closeSync(descriptor);
-    if (existsSync8(lockPath) && readFileSync6(lockPath, "utf8").trim() === ownershipToken) {
-      rmSync4(lockPath);
+    if (existsSync9(lockPath) && readFileSync7(lockPath, "utf8").trim() === ownershipToken) {
+      rmSync6(lockPath);
     }
   };
 }
 
 // src/serverQuickTest.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var QUICK_TEST_RESPONSE_TIMEOUT_MS = 12e4;
 var QUICK_TEST_WEB_QUERY = "site:openmates.org OpenMates";
 var QUICK_TEST_EXPECTED_RESPONSE = "server quick test passed";
@@ -27911,7 +28138,7 @@ function decideQuickServerTestAction(input) {
 async function runQuickServerTest(client, options = {}) {
   const now = options.now ?? Date.now;
   const checks = [];
-  const chatId = randomUUID9();
+  const chatId = randomUUID10();
   let chatMayExist = false;
   checks.push({ id: "account.session", status: "passed", duration_ms: 0 });
   const createStarted = now();
@@ -28011,22 +28238,22 @@ function containsBoundedWebResult(value) {
 }
 
 // src/server.ts
-var SOURCE_COMPOSE_FILE = join7("backend", "core", "docker-compose.yml");
+var SOURCE_COMPOSE_FILE = join8("backend", "core", "docker-compose.yml");
 var ROLE_IMAGE_COMPOSE_FILES = {
-  core: join7("backend", "core", "docker-compose.selfhost.yml"),
-  upload: join7("backend", "upload", "docker-compose.yml"),
-  preview: join7("backend", "preview", "docker-compose.preview.yml")
+  core: join8("backend", "core", "docker-compose.selfhost.yml"),
+  upload: join8("backend", "upload", "docker-compose.yml"),
+  preview: join8("backend", "preview", "docker-compose.preview.yml")
 };
 var ROLE_TEMPLATE_FILES = {
-  core: join7("core", "docker-compose.selfhost.yml"),
-  upload: join7("upload", "docker-compose.yml"),
-  preview: join7("preview", "docker-compose.preview.yml")
+  core: join8("core", "docker-compose.selfhost.yml"),
+  upload: join8("upload", "docker-compose.yml"),
+  preview: join8("preview", "docker-compose.preview.yml")
 };
-var CORE_NO_WEBAPP_TEMPLATE_FILE = join7("core", "docker-compose.no-webapp.yml");
-var CORE_PROMTAIL_CONFIG_FILE = join7("backend", "core", "monitoring", "promtail", "promtail-config.yaml");
-var CORE_ALERTMANAGER_CONFIG_FILE = join7("backend", "core", "monitoring", "alertmanager", "alertmanager.yml");
-var COMPOSE_OVERRIDE2 = join7("backend", "core", "docker-compose.override.yml");
-var DEFAULT_INSTALL_PATH = join7(homedir6(), "openmates");
+var CORE_NO_WEBAPP_TEMPLATE_FILE = join8("core", "docker-compose.no-webapp.yml");
+var CORE_PROMTAIL_CONFIG_FILE = join8("backend", "core", "monitoring", "promtail", "promtail-config.yaml");
+var CORE_ALERTMANAGER_CONFIG_FILE = join8("backend", "core", "monitoring", "alertmanager", "alertmanager.yml");
+var COMPOSE_OVERRIDE2 = join8("backend", "core", "docker-compose.override.yml");
+var DEFAULT_INSTALL_PATH = join8(homedir6(), "openmates");
 var REPO_URL = "https://github.com/glowingkitty/OpenMates.git";
 var ROLE_PROVENANCE_SERVICE = {
   core: "api",
@@ -28042,6 +28269,7 @@ var HEALTH_REQUEST_TIMEOUT_MS = 5e3;
 var CHECKSUM_BUFFER_BYTES = 1024 * 1024;
 var ENV_BACKUP_PREFIX = ".env.openmates-backup-";
 var ENV_BACKUP_RETENTION_COUNT = 5;
+var BACKUP_FORMAT_VERSION = 2;
 var IMAGE_CHANNEL_TAGS = {
   stable: MAIN_BRANCH,
   main: MAIN_BRANCH,
@@ -28115,8 +28343,8 @@ scrape_configs:
       - labels:
           level: log_level
 `;
-var BACKEND_CONFIG_FILE = join7("backend", "config", "backend_config.yml");
-var IMAGE_RUNTIME_CONFIG_FILE = join7("config", "backend_config.yml");
+var BACKEND_CONFIG_FILE = join8("backend", "config", "backend_config.yml");
+var IMAGE_RUNTIME_CONFIG_FILE = join8("config", "backend_config.yml");
 var LOCAL_AI_MODELS_FILE = "local-ai-models.yml";
 var OFF_BY_DEFAULT_FEATURES = /* @__PURE__ */ new Map([
   ["embed:code:application", "Application previews are still unstable"],
@@ -28252,9 +28480,9 @@ function runInteractive(cmd, args, cwd) {
   });
 }
 function beginEngineeringRuntimeOperation(installPath, operationType, services) {
-  const manager = join7(installPath, "scripts", "engineering_control_plane.py");
-  const sharedConfig = join7(homedir6(), ".config", "openmates", "engineering-control-plane.env");
-  if (!existsSync9(manager) || !existsSync9(sharedConfig)) return null;
+  const manager = join8(installPath, "scripts", "engineering_control_plane.py");
+  const sharedConfig = join8(homedir6(), ".config", "openmates", "engineering-control-plane.env");
+  if (!existsSync10(manager) || !existsSync10(sharedConfig)) return null;
   const requestedBy = process.env.OPENCODE_SESSION_ID || `openmates-cli:${process.pid}`;
   const args = [
     manager,
@@ -28268,7 +28496,7 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
     "dev-stack"
   ];
   for (const service of services) args.push("--service", service);
-  const output = execFileSync3("python3", args, {
+  const output = execFileSync4("python3", args, {
     cwd: installPath,
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -28278,8 +28506,8 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
   return parsed.operation_key;
 }
 function finishEngineeringRuntimeOperation(installPath, operationKey, status) {
-  const manager = join7(installPath, "scripts", "engineering_control_plane.py");
-  execFileSync3(
+  const manager = join8(installPath, "scripts", "engineering_control_plane.py");
+  execFileSync4(
     "python3",
     [manager, "operation", "update", "--operation-key", operationKey, "--status", status],
     { cwd: installPath, stdio: ["ignore", "ignore", "pipe"] }
@@ -28307,8 +28535,8 @@ function loadConfigForInstallPath(installPath) {
 }
 function getInstallMode(installPath, config = loadConfigForInstallPath(installPath)) {
   if (config?.installMode) return config.installMode;
-  if (existsSync9(join7(installPath, SOURCE_COMPOSE_FILE))) return "source";
-  if (Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync9(join7(installPath, composeFile)))) return "image";
+  if (existsSync10(join8(installPath, SOURCE_COMPOSE_FILE))) return "source";
+  if (Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync10(join8(installPath, composeFile)))) return "image";
   return "source";
 }
 function getServerRole(flags, config) {
@@ -28439,26 +28667,26 @@ function composeArgs(installPath, withOverrides, installMode = getInstallMode(in
     withOverrides,
     installMode,
     role,
-    overrideExists: existsSync9(join7(installPath, COMPOSE_OVERRIDE2)),
+    overrideExists: existsSync10(join8(installPath, COMPOSE_OVERRIDE2)),
     deploymentMode,
     overlayPath,
     overlayComposeFile,
-    overlayExists: deploymentMode === "official_cloud" && existsSync9(resolvedOverlayPath) && existsSync9(overlayComposeFile)
+    overlayExists: deploymentMode === "official_cloud" && existsSync10(resolvedOverlayPath) && existsSync10(overlayComposeFile)
   });
 }
 function ensureGitWorkDirEnv(installPath) {
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(envPath)) return;
-  const content = readFileSync7(envPath, "utf-8");
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(envPath)) return;
+  const content = readFileSync8(envPath, "utf-8");
   const lineRegex = /^GIT_WORK_DIR=.*$/m;
   const value = `GIT_WORK_DIR=${installPath}`;
   if (lineRegex.test(content)) {
     const next = content.replace(lineRegex, value);
-    if (next !== content) writeFileSync5(envPath, next);
+    if (next !== content) writeFileSync6(envPath, next);
     return;
   }
   const separator2 = content.endsWith("\n") ? "" : "\n";
-  writeFileSync5(envPath, `${content}${separator2}${value}
+  writeFileSync6(envPath, `${content}${separator2}${value}
 `);
 }
 function requireDocker() {
@@ -28479,7 +28707,7 @@ function requireGit() {
 }
 function getPackageVersion() {
   try {
-    const packageJson = JSON.parse(readFileSync7(new URL("../package.json", import.meta.url), "utf-8"));
+    const packageJson = JSON.parse(readFileSync8(new URL("../package.json", import.meta.url), "utf-8"));
     return packageJson.version ?? "";
   } catch {
     return "";
@@ -28572,20 +28800,20 @@ async function fetchText(url) {
   return response.text();
 }
 function packagedTemplatePath(role) {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", ROLE_TEMPLATE_FILES[role]);
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", ROLE_TEMPLATE_FILES[role]);
 }
 function packagedNoWebappTemplatePath() {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", CORE_NO_WEBAPP_TEMPLATE_FILE);
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", CORE_NO_WEBAPP_TEMPLATE_FILE);
 }
 function packagedCaddyTemplatePath(role) {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", "caddy", role, "Caddyfile");
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", "caddy", role, "Caddyfile");
 }
 function packagedCoreAlertmanagerTemplatePath() {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", "core", "monitoring", "alertmanager", "alertmanager.yml");
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", "core", "monitoring", "alertmanager", "alertmanager.yml");
 }
 function readOfficialCloudNoWebappComposeTemplate() {
   const packaged = packagedNoWebappTemplatePath();
-  if (existsSync9(packaged)) return readFileSync7(packaged, "utf-8");
+  if (existsSync10(packaged)) return readFileSync8(packaged, "utf-8");
   return [
     "# backend/core/docker-compose.no-webapp.yml",
     "#",
@@ -28600,51 +28828,51 @@ function readOfficialCloudNoWebappComposeTemplate() {
 }
 function ensureOfficialCloudNoWebappComposeFile(installPath, deploymentMode, role) {
   if (deploymentMode !== "official_cloud" || role !== "core") return;
-  const filePath = join7(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE);
-  if (existsSync9(filePath)) return;
-  mkdirSync6(dirname6(filePath), { recursive: true });
-  writeFileSync5(filePath, readOfficialCloudNoWebappComposeTemplate());
+  const filePath = join8(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE);
+  if (existsSync10(filePath)) return;
+  mkdirSync7(dirname6(filePath), { recursive: true });
+  writeFileSync6(filePath, readOfficialCloudNoWebappComposeTemplate());
 }
 function fileHash(path2) {
-  if (!existsSync9(path2)) return null;
-  return createHash12("sha256").update(readFileSync7(path2)).digest("hex");
+  if (!existsSync10(path2)) return null;
+  return createHash13("sha256").update(readFileSync8(path2)).digest("hex");
 }
 async function loadSelfHostComposeTemplate(templateRef, role) {
   const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
   if (templateDir) {
-    return readFileSync7(join7(resolve6(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
+    return readFileSync8(join8(resolve6(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
   }
   const overrideUrl = process.env.OPENMATES_SELFHOST_COMPOSE_URL;
   if (overrideUrl) {
     return fetchText(overrideUrl);
   }
   const packaged = packagedTemplatePath(role);
-  if (existsSync9(packaged)) return readFileSync7(packaged, "utf-8");
+  if (existsSync10(packaged)) return readFileSync8(packaged, "utf-8");
   return fetchText(`https://raw.githubusercontent.com/glowingkitty/OpenMates/${templateRef}/${ROLE_IMAGE_COMPOSE_FILES[role]}`);
 }
 async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
-  const roleDir = join7(installPath, "backend", role === "core" ? "core" : role);
-  const vaultConfigDir = join7(roleDir, "vault", "config");
-  mkdirSync6(vaultConfigDir, { recursive: true });
-  mkdirSync6(join7(installPath, "config", "providers"), { recursive: true });
-  writeFileSync5(join7(installPath, ROLE_IMAGE_COMPOSE_FILES[role]), await loadSelfHostComposeTemplate(templateRefForImageTag(imageTag, getPackageVersion()), role));
+  const roleDir = join8(installPath, "backend", role === "core" ? "core" : role);
+  const vaultConfigDir = join8(roleDir, "vault", "config");
+  mkdirSync7(vaultConfigDir, { recursive: true });
+  mkdirSync7(join8(installPath, "config", "providers"), { recursive: true });
+  writeFileSync6(join8(installPath, ROLE_IMAGE_COMPOSE_FILES[role]), await loadSelfHostComposeTemplate(templateRefForImageTag(imageTag, getPackageVersion()), role));
   if (role === "core") {
-    writeFileSync5(join7(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE), readOfficialCloudNoWebappComposeTemplate());
+    writeFileSync6(join8(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE), readOfficialCloudNoWebappComposeTemplate());
   }
   if (role === "core") {
-    const promtailConfigPath = join7(installPath, CORE_PROMTAIL_CONFIG_FILE);
-    mkdirSync6(dirname6(promtailConfigPath), { recursive: true });
-    writeFileSync5(promtailConfigPath, SELFHOST_PROMTAIL_CONFIG_TEMPLATE);
+    const promtailConfigPath = join8(installPath, CORE_PROMTAIL_CONFIG_FILE);
+    mkdirSync7(dirname6(promtailConfigPath), { recursive: true });
+    writeFileSync6(promtailConfigPath, SELFHOST_PROMTAIL_CONFIG_TEMPLATE);
     const alertmanagerTemplatePath = packagedCoreAlertmanagerTemplatePath();
-    if (!existsSync9(alertmanagerTemplatePath)) throw new Error(`Packaged Alertmanager config not found: ${alertmanagerTemplatePath}`);
-    const alertmanagerConfigPath = join7(installPath, CORE_ALERTMANAGER_CONFIG_FILE);
-    mkdirSync6(dirname6(alertmanagerConfigPath), { recursive: true });
+    if (!existsSync10(alertmanagerTemplatePath)) throw new Error(`Packaged Alertmanager config not found: ${alertmanagerTemplatePath}`);
+    const alertmanagerConfigPath = join8(installPath, CORE_ALERTMANAGER_CONFIG_FILE);
+    mkdirSync7(dirname6(alertmanagerConfigPath), { recursive: true });
     copyFileSync2(alertmanagerTemplatePath, alertmanagerConfigPath);
   }
-  writeFileSync5(join7(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
+  writeFileSync6(join8(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
   ensureImageRuntimeConfig(installPath);
-  const envPath = join7(installPath, ".env");
-  let envContent = existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
+  const envPath = join8(installPath, ".env");
+  let envContent = existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
   envContent = setEnvIfEmpty(envContent, "DATABASE_ADMIN_PASSWORD", randomHex(12));
   envContent = setEnvIfEmpty(envContent, "DATABASE_PASSWORD", randomHex(12));
   envContent = setEnvIfEmpty(envContent, "DIRECTUS_TOKEN", randomHex(32));
@@ -28656,13 +28884,13 @@ async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
   envContent = setEnvVar(envContent, "OPENMATES_IMAGE_TAG", imageTag);
   envContent = setEnvVar(envContent, "OPENMATES_IMAGE_REGISTRY", DEFAULT_IMAGE_REGISTRY);
   envContent = setEnvVar(envContent, "GIT_WORK_DIR", installPath);
-  writeFileSync5(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
+  writeFileSync6(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
 `);
 }
 function getImageTagFromEnv(installPath, config) {
-  const envPath = join7(installPath, ".env");
-  if (existsSync9(envPath)) {
-    const envTag = getEnvVar(readFileSync7(envPath, "utf-8"), "OPENMATES_IMAGE_TAG");
+  const envPath = join8(installPath, ".env");
+  if (existsSync10(envPath)) {
+    const envTag = getEnvVar(readFileSync8(envPath, "utf-8"), "OPENMATES_IMAGE_TAG");
     if (envTag) return envTag;
   }
   return config?.imageTag ?? "";
@@ -28695,8 +28923,8 @@ async function waitForServerHealth(installPath, role = "core", options = {}) {
     }
     throw new Error(`Updated ${role} server did not pass health checks in time. Tried ${healthUrl}.`);
   }
-  const envPath = join7(installPath, ".env");
-  const envContent = existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "";
+  const envPath = join8(installPath, ".env");
+  const envContent = existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : "";
   const urls = deriveSelfHostCliUrls(envContent);
   const apiHealthUrl = `${trailingSlashTrimmed(urls.apiUrl)}/health`;
   const appUrl = trailingSlashTrimmed(urls.appUrl);
@@ -28719,9 +28947,9 @@ function defaultCloneBranchForVersion(version) {
   return /-(alpha|beta|rc)(\.|\d|$)/.test(version) ? DEV_BRANCH : null;
 }
 function hasLlmCredentials(envPath) {
-  if (!existsSync9(envPath)) return false;
+  if (!existsSync10(envPath)) return false;
   if (hasLocalAiModels(dirname6(envPath))) return true;
-  const content = readFileSync7(envPath, "utf-8");
+  const content = readFileSync8(envPath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (trimmed.startsWith("#") || !trimmed) continue;
@@ -28736,8 +28964,8 @@ function hasLlmCredentials(envPath) {
   return false;
 }
 function warnIfMissingLlmCredentials(installPath) {
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(envPath)) {
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(envPath)) {
     console.error(
       "No .env file found. Run 'openmates server install' first, or create .env from .env.example."
     );
@@ -28762,22 +28990,22 @@ function printJson(data) {
   console.log(JSON.stringify(data, null, 2));
 }
 function localModelsOverlayPath(installPath, installMode = getInstallMode(installPath)) {
-  if (installMode === "source") return join7(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
-  return join7(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
+  if (installMode === "source") return join8(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
+  return join8(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
 }
 function imageBackendConfigPath(installPath) {
-  return join7(installPath, IMAGE_RUNTIME_CONFIG_FILE);
+  return join8(installPath, IMAGE_RUNTIME_CONFIG_FILE);
 }
 function ensureImageRuntimeConfig(installPath) {
   const configPath = imageBackendConfigPath(installPath);
-  if (existsSync9(configPath)) return;
-  mkdirSync6(dirname6(configPath), { recursive: true });
-  writeFileSync5(configPath, renderFeatureOverrides({ enabled: [], disabled: [] }));
+  if (existsSync10(configPath)) return;
+  mkdirSync7(dirname6(configPath), { recursive: true });
+  writeFileSync6(configPath, renderFeatureOverrides({ enabled: [], disabled: [] }));
 }
 function readLocalModelOverlay(path2) {
-  if (!existsSync9(path2)) return { providers: [] };
+  if (!existsSync10(path2)) return { providers: [] };
   try {
-    const parsed = JSON.parse(readFileSync7(path2, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(path2, "utf-8"));
     return { providers: Array.isArray(parsed.providers) ? parsed.providers : [] };
   } catch (error) {
     throw new Error(
@@ -28786,15 +29014,15 @@ function readLocalModelOverlay(path2) {
   }
 }
 function writeLocalModelOverlay(path2, overlay) {
-  mkdirSync6(dirname6(path2), { recursive: true });
-  writeFileSync5(path2, `${JSON.stringify(overlay, null, 2)}
+  mkdirSync7(dirname6(path2), { recursive: true });
+  writeFileSync6(path2, `${JSON.stringify(overlay, null, 2)}
 `);
 }
 function hasLocalAiModels(installPath) {
-  const imagePath = join7(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
-  const sourcePath = join7(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
+  const imagePath = join8(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
+  const sourcePath = join8(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
   return [imagePath, sourcePath].some((path2) => {
-    if (!existsSync9(path2)) return false;
+    if (!existsSync10(path2)) return false;
     try {
       return readLocalModelOverlay(path2).providers.some((provider) => provider.models.length > 0);
     } catch {
@@ -28835,10 +29063,10 @@ function nowStamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function backupRoot(installPath) {
-  return join7(installPath, "backups");
+  return join8(installPath, "backups");
 }
 function roleBackupDir(installPath, role) {
-  return join7(backupRoot(installPath), role);
+  return join8(backupRoot(installPath), role);
 }
 function persistQuickServerTestOutcome(installPath, role, outcome) {
   const current = readServerUpdateStatus(installPath, role);
@@ -28939,13 +29167,13 @@ function targetSourceLinks(imageTag, templateRef) {
   };
 }
 function installedImageMetadata(input) {
-  const containerId = execFileSync3(
+  const containerId = execFileSync4(
     "docker",
     [...composeArgs(input.installPath, input.withOverrides, "image", input.role), "ps", "-q", ROLE_PROVENANCE_SERVICE[input.role]],
     { cwd: input.installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
   ).trim();
   if (!containerId) throw new Error("updated_container_unavailable");
-  const labels = JSON.parse(execFileSync3(
+  const labels = JSON.parse(execFileSync4(
     "docker",
     ["inspect", "--format", "{{json .Config.Labels}}", containerId],
     { cwd: input.installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
@@ -28987,15 +29215,15 @@ function sourceUpdateMetadata(installPath) {
   };
 }
 function copyIfExists(source, destination) {
-  if (!existsSync9(source)) return;
-  mkdirSync6(dirname6(destination), { recursive: true });
+  if (!existsSync10(source)) return;
+  mkdirSync7(dirname6(destination), { recursive: true });
   cpSync(source, destination, { recursive: true, force: true });
 }
 function readEnvMap(installPath) {
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(envPath)) return {};
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(envPath)) return {};
   const values = {};
-  for (const line of readFileSync7(envPath, "utf-8").split("\n")) {
+  for (const line of readFileSync8(envPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eqIdx = trimmed.indexOf("=");
@@ -29005,32 +29233,32 @@ function readEnvMap(installPath) {
   return values;
 }
 function envPathForInstall(installPath) {
-  return join7(installPath, ".env");
+  return join8(installPath, ".env");
 }
 function readEnvContent(installPath) {
   const envPath = envPathForInstall(installPath);
-  return existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "";
+  return existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : "";
 }
 function pruneEnvBackups(installPath) {
-  const backups = readdirSync3(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
+  const backups = readdirSync5(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
   for (const backup of backups.slice(0, Math.max(0, backups.length - ENV_BACKUP_RETENTION_COUNT))) {
-    rmSync5(join7(installPath, backup), { force: true });
+    rmSync7(join8(installPath, backup), { force: true });
   }
 }
 function backupEnvFile(installPath) {
   const envPath = envPathForInstall(installPath);
-  if (!existsSync9(envPath)) return null;
-  const backupPath = join7(installPath, `${ENV_BACKUP_PREFIX}${nowStamp()}`);
+  if (!existsSync10(envPath)) return null;
+  const backupPath = join8(installPath, `${ENV_BACKUP_PREFIX}${nowStamp()}`);
   copyFileSync2(envPath, backupPath);
-  chmodSync4(backupPath, 384);
+  chmodSync5(backupPath, 384);
   pruneEnvBackups(installPath);
   return backupPath;
 }
 function writeEnvContent(installPath, content) {
   const envPath = envPathForInstall(installPath);
-  mkdirSync6(dirname6(envPath), { recursive: true });
-  writeFileSync5(envPath, content, { mode: 384 });
-  chmodSync4(envPath, 384);
+  mkdirSync7(dirname6(envPath), { recursive: true });
+  writeFileSync6(envPath, content, { mode: 384 });
+  chmodSync5(envPath, 384);
 }
 function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
   let content = readEnvContent(installPath);
@@ -29044,7 +29272,7 @@ function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
   }
   const resolvedOverlayPath = resolve6(overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath));
   const overlayComposeFile = defaultOpenMatesCloudComposeFile(resolvedOverlayPath);
-  if (!existsSync9(resolvedOverlayPath) || !existsSync9(overlayComposeFile)) {
+  if (!existsSync10(resolvedOverlayPath) || !existsSync10(overlayComposeFile)) {
     throw new Error(
       `OpenMatesCloud official-cloud mode requires an overlay checkout with ${overlayComposeFile}. Pass --openmatescloud-path <dir> or create the sibling OpenMatesCloud repository.`
     );
@@ -29203,7 +29431,7 @@ for item in checks:
 print(json.dumps({"ok": True, "presence": presence}))
 `;
   try {
-    const output = execFileSync3(
+    const output = execFileSync4(
       "docker",
       ["exec", "-e", `OPENMATES_SECRET_CHECKS=${JSON.stringify(checks)}`, container, "python", "-c", script],
       { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
@@ -29241,7 +29469,7 @@ function formatSecretPreflight(preflight) {
   return parts.join("; ");
 }
 function hashFile(path2) {
-  const hash = createHash12("sha256");
+  const hash = createHash13("sha256");
   const fd = openSync2(path2, "r");
   const buffer = Buffer.allocUnsafe(CHECKSUM_BUFFER_BYTES);
   try {
@@ -29258,8 +29486,8 @@ function hashFile(path2) {
 function writeChecksums(rootDir) {
   const lines = [];
   const walk = (dir) => {
-    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-      const path2 = join7(dir, entry.name);
+    for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+      const path2 = join8(dir, entry.name);
       if (entry.isDirectory()) {
         walk(path2);
         continue;
@@ -29270,13 +29498,13 @@ function writeChecksums(rootDir) {
     }
   };
   walk(rootDir);
-  writeFileSync5(join7(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
+  writeFileSync6(join8(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
 `);
 }
 function verifyChecksums(rootDir) {
-  const checksumsPath = join7(rootDir, "checksums.sha256");
-  if (!existsSync9(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
-  for (const line of readFileSync7(checksumsPath, "utf-8").split("\n")) {
+  const checksumsPath = join8(rootDir, "checksums.sha256");
+  if (!existsSync10(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
+  for (const line of readFileSync8(checksumsPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed) continue;
     const match = trimmed.match(/^([a-f0-9]{64}) {2}(.+)$/);
@@ -29285,8 +29513,8 @@ function verifyChecksums(rootDir) {
     if (relative3.startsWith("/") || relative3.split(/[\\/]/).includes("..")) {
       throw new Error(`Unsafe checksum path in backup archive: ${relative3}`);
     }
-    const filePath = join7(rootDir, relative3);
-    if (!existsSync9(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative3}`);
+    const filePath = join8(rootDir, relative3);
+    if (!existsSync10(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative3}`);
     const actual = hashFile(filePath);
     if (actual !== match[1]) throw new Error(`Backup checksum mismatch for ${relative3}.`);
   }
@@ -29294,27 +29522,28 @@ function verifyChecksums(rootDir) {
 function createServerBackup(installPath, role, options = {}) {
   const plan = planBackup({ role, includeObservability: options.includeObservability });
   const backupDir = roleBackupDir(installPath, role);
-  mkdirSync6(backupDir, { recursive: true, mode: 448 });
-  const archivePath = options.output ? resolve6(options.output) : join7(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
-  const tempDir = mkdtempSync(join7(backupDir, ".tmp-"));
+  mkdirSync7(backupDir, { recursive: true, mode: 448 });
+  const archivePath = options.output ? resolve6(options.output) : join8(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  mkdirSync7(dirname6(archivePath), { recursive: true, mode: 448 });
+  const tempDir = mkdtempSync(join8(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
   const manifest = {
     role,
+    backup_format_version: BACKUP_FORMAT_VERSION,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     cli_version: getPackageVersion(),
-    image_tag: getEnvVar(existsSync9(join7(installPath, ".env")) ? readFileSync7(join7(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
-    include_observability: options.includeObservability === true,
-    contents: plan.contents
+    image_tag: getEnvVar(existsSync10(join8(installPath, ".env")) ? readFileSync8(join8(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
+    recovery_scope: role === "core" ? "database-and-runtime-only" : "runtime-only",
+    include_observability: false,
+    contents: plan.contents.filter((content) => content !== "runtime-env" || existsSync10(join8(installPath, ".env"))).filter((content) => content !== "runtime-config" || existsSync10(join8(installPath, "config")))
   };
   try {
-    writeFileSync5(join7(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
-`);
-    copyIfExists(join7(installPath, ".env"), join7(tempDir, "runtime", ".env"));
-    copyIfExists(join7(installPath, "config"), join7(tempDir, "runtime", "config"));
+    copyIfExists(join8(installPath, ".env"), join8(tempDir, "runtime", ".env"));
+    copyIfExists(join8(installPath, "config"), join8(tempDir, "runtime", "config"));
     if (role === "core") {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      const dumpFile = openSync2(join7(tempDir, "postgres.sql"), "w");
+      const dumpFile = openSync2(join8(tempDir, "postgres.sql"), "w");
       try {
         const result = spawnSync(
           "docker",
@@ -29329,47 +29558,52 @@ function createServerBackup(installPath, role, options = {}) {
         closeSync2(dumpFile);
       }
     }
-    for (const item of [
-      [join7(installPath, "backend", "core", "uploads"), join7(tempDir, "directus-uploads")],
-      [join7(installPath, "backend", "core", "extensions"), join7(tempDir, "directus-extensions")],
-      [join7(installPath, "backend", role, "vault"), join7(tempDir, `${role}-vault-config`)]
-    ]) {
-      copyIfExists(item[0], item[1]);
-    }
+    writeFileSync6(join8(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384 });
     writeChecksums(tempDir);
-    execSync(`tar -czf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)} .`, { stdio: "pipe" });
-    chmodSync4(archivePath, plan.fileMode);
+    publishServerBackupArchive(tempDir, archivePath);
     return archivePath;
   } finally {
-    rmSync5(tempDir, { recursive: true, force: true });
+    rmSync7(tempDir, { recursive: true, force: true });
   }
 }
 function restoreServerBackup(installPath, role, file) {
   const archivePath = resolve6(file);
-  if (!existsSync9(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
-  mkdirSync6(roleBackupDir(installPath, role), { recursive: true, mode: 448 });
-  const tempDir = mkdtempSync(join7(roleBackupDir(installPath, role), ".restore-"));
+  if (!existsSync10(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
+  mkdirSync7(roleBackupDir(installPath, role), { recursive: true, mode: 448 });
+  const tempDir = mkdtempSync(join8(roleBackupDir(installPath, role), ".restore-"));
   const env = readEnvMap(installPath);
   try {
     execSync(`tar -xzf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)}`, { stdio: "pipe" });
     verifyChecksums(tempDir);
-    const manifestPath = join7(tempDir, "manifest.json");
-    if (!existsSync9(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
-    const manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
+    const manifestPath = join8(tempDir, "manifest.json");
+    if (!existsSync10(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
+    const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
     if (manifest.role !== role) throw new Error(`Backup role '${manifest.role}' does not match requested role '${role}'.`);
-    copyIfExists(join7(tempDir, "runtime", ".env"), join7(installPath, ".env"));
-    copyIfExists(join7(tempDir, "runtime", "config"), join7(installPath, "config"));
-    const postgresDump = join7(tempDir, "postgres.sql");
-    if (role === "core" && existsSync9(postgresDump)) {
+    if (role === "core" && manifest.backup_format_version === BACKUP_FORMAT_VERSION && manifest.recovery_scope !== "full-core") {
+      throw new Error("This backup records database and runtime state only; refusing unsafe full core restore.");
+    }
+    copyIfExists(join8(tempDir, "runtime", ".env"), join8(installPath, ".env"));
+    copyIfExists(join8(tempDir, "runtime", "config"), join8(installPath, "config"));
+    const postgresDump = join8(tempDir, "postgres.sql");
+    if (role === "core" && existsSync10(postgresDump)) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      execSync(`docker exec -i cms-database psql -v ON_ERROR_STOP=1 -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, {
-        input: readFileSync7(postgresDump),
-        stdio: ["pipe", "pipe", "pipe"]
-      });
+      const dumpFile = openSync2(postgresDump, "r");
+      try {
+        const result = spawnSync(
+          "docker",
+          ["exec", "-i", "cms-database", "psql", "-v", "ON_ERROR_STOP=1", "-U", databaseUser, databaseName],
+          { encoding: "utf-8", stdio: [dumpFile, "pipe", "pipe"] }
+        );
+        if (result.error) throw result.error;
+        if (result.status !== 0) throw new Error(result.stderr || `psql exited with status ${result.status}`);
+      } finally {
+        closeSync2(dumpFile);
+      }
     }
   } finally {
-    rmSync5(tempDir, { recursive: true, force: true });
+    rmSync7(tempDir, { recursive: true, force: true });
   }
 }
 function restoreStopServices(installPath, withOverrides, installMode, role) {
@@ -29638,11 +29872,11 @@ async function serverRegister(flags) {
   const installPath = resolveServerPath(
     typeof flags.path === "string" ? flags : { ...flags, path: process.cwd() }
   );
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(join7(installPath, SOURCE_COMPOSE_FILE))) {
-    throw new Error(`Source Compose file not found: ${join7(installPath, SOURCE_COMPOSE_FILE)}`);
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(join8(installPath, SOURCE_COMPOSE_FILE))) {
+    throw new Error(`Source Compose file not found: ${join8(installPath, SOURCE_COMPOSE_FILE)}`);
   }
-  if (!existsSync9(envPath)) {
+  if (!existsSync10(envPath)) {
     throw new Error(`Runtime env file not found: ${envPath}`);
   }
   const gitRoot = resolve6(exec("git rev-parse --show-toplevel", installPath));
@@ -29664,7 +29898,7 @@ async function serverRegister(flags) {
   }
   const overlayPath = getOpenMatesCloudOverlayPath(flags, null) ?? readEnvMap(installPath).OPENMATES_CLOUD_OVERLAY_PATH ?? defaultOpenMatesCloudOverlayPath(installPath);
   const overlayComposeFile = defaultOpenMatesCloudComposeFile(overlayPath);
-  if (deploymentMode === "official_cloud" && (!existsSync9(overlayPath) || !existsSync9(overlayComposeFile))) {
+  if (deploymentMode === "official_cloud" && (!existsSync10(overlayPath) || !existsSync10(overlayComposeFile))) {
     throw new Error(`OpenMatesCloud overlay path is required for official-cloud mode: ${overlayPath}`);
   }
   const runtimePlan = planServerRuntime({
@@ -29674,7 +29908,7 @@ async function serverRegister(flags) {
     includeWebapp: deploymentMode !== "official_cloud"
   });
   const defaultServices = hasServiceFilter(flags) ? selectedComposeServices(role, flags) : runtimePlan.defaultServices;
-  const cliUrls = deriveSelfHostCliUrls(readFileSync7(envPath, "utf-8"));
+  const cliUrls = deriveSelfHostCliUrls(readFileSync8(envPath, "utf-8"));
   const config = {
     installPath,
     installedAt: existing?.installPath === installPath ? existing.installedAt : Date.now(),
@@ -29716,27 +29950,27 @@ async function serverInstall(flags) {
     withAlerts: flags["with-alerts"] === true,
     includeWebapp: deploymentMode !== "official_cloud"
   });
-  if (existsSync9(join7(installPath, SOURCE_COMPOSE_FILE)) || Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync9(join7(installPath, composeFile)))) {
+  if (existsSync10(join8(installPath, SOURCE_COMPOSE_FILE)) || Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync10(join8(installPath, composeFile)))) {
     console.error(`OpenMates already exists at ${installPath}.`);
     console.error("Use 'openmates server update' to update, or choose a different --path.");
     process.exit(1);
   }
   if (!fromSource) {
     requireDocker();
-    mkdirSync6(installPath, { recursive: true });
+    mkdirSync7(installPath, { recursive: true });
     if (typeof flags["env-path"] === "string") {
       const envSource = resolve6(flags["env-path"]);
-      if (!existsSync9(envSource)) {
+      if (!existsSync10(envSource)) {
         throw new Error(`Env file not found: ${envSource}`);
       }
-      copyFileSync2(envSource, join7(installPath, ".env"));
+      copyFileSync2(envSource, join8(installPath, ".env"));
       console.error(`Copied ${envSource} to ${installPath}/.env`);
     }
     const imageTag = typeof flags["image-tag"] === "string" ? flags["image-tag"] : getDefaultImageTag();
     console.error(`Preparing OpenMates image-mode install at ${installPath}...`);
     await writeImageModeRuntimeFiles(installPath, imageTag, role);
     const overlay2 = writeDeploymentModeEnv(installPath, deploymentMode, requestedOverlayPath);
-    const cliUrls2 = deriveSelfHostCliUrls(readFileSync7(join7(installPath, ".env"), "utf-8"));
+    const cliUrls2 = deriveSelfHostCliUrls(readFileSync8(join8(installPath, ".env"), "utf-8"));
     try {
       exec("docker network create openmates", installPath);
     } catch {
@@ -29763,7 +29997,7 @@ async function serverInstall(flags) {
     if (flags.json === true) {
       printJson({ command: "install", status: "success", path: installPath, mode: "image", imageTag });
     } else {
-      const firstInvite = getEnvVar(readFileSync7(join7(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
+      const firstInvite = getEnvVar(readFileSync8(join8(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
       console.log(`
 OpenMates installed at ${installPath}`);
       console.log(`Mode: image (${DEFAULT_IMAGE_REGISTRY}, tag ${imageTag})`);
@@ -29801,10 +30035,10 @@ CLI default API: ${cliUrls2.apiUrl}`);
   }
   if (typeof flags["env-path"] === "string") {
     const envSource = resolve6(flags["env-path"]);
-    if (!existsSync9(envSource)) {
+    if (!existsSync10(envSource)) {
       throw new Error(`Env file not found: ${envSource}`);
     }
-    copyFileSync2(envSource, join7(installPath, ".env"));
+    copyFileSync2(envSource, join8(installPath, ".env"));
     console.error(`Copied ${envSource} to ${installPath}/.env`);
   }
   const translationResult = ensureSourceInstallTranslations(installPath, sourcePath);
@@ -29823,9 +30057,9 @@ CLI default API: ${cliUrls2.apiUrl}`);
     console.error("Setup script failed. Check the output above for details.");
     process.exit(setupCode);
   }
-  const envPath = join7(installPath, ".env");
+  const envPath = join8(installPath, ".env");
   const overlay = writeDeploymentModeEnv(installPath, deploymentMode, requestedOverlayPath);
-  const cliUrls = deriveSelfHostCliUrls(existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "");
+  const cliUrls = deriveSelfHostCliUrls(existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : "");
   saveServerConfig({
     installPath,
     installedAt: Date.now(),
@@ -29866,15 +30100,15 @@ async function installContinuousUpdateService(flags) {
   const channel = typeof flags.channel === "string" ? flags.channel : config?.imageChannel ?? "main";
   const window = typeof flags.window === "string" ? flags.window : "02:00-04:00 UTC";
   const plan = planContinuousUpdateService({ role, channel, window });
-  const servicePath = join7("/etc", "systemd", "system", plan.serviceName);
-  const timerPath = join7("/etc", "systemd", "system", plan.timerName);
+  const servicePath = join8("/etc", "systemd", "system", plan.serviceName);
+  const timerPath = join8("/etc", "systemd", "system", plan.timerName);
   if (flags["dry-run"] === true || flags.json === true) {
     printJson({ command: "update install-service", status: "planned", role, servicePath, timerPath, unit: plan.unit, timer: plan.timer });
     return;
   }
   try {
-    writeFileSync5(servicePath, plan.unit, { mode: 420 });
-    writeFileSync5(timerPath, plan.timer, { mode: 420 });
+    writeFileSync6(servicePath, plan.unit, { mode: 420 });
+    writeFileSync6(timerPath, plan.timer, { mode: 420 });
     execSync("systemctl daemon-reload", { stdio: "pipe" });
     execSync(`systemctl enable --now ${shellQuote(plan.timerName)}`, { stdio: "pipe" });
   } catch (error) {
@@ -29885,13 +30119,13 @@ async function installContinuousUpdateService(flags) {
   console.log(`Installed ${plan.timerName}.`);
 }
 function runRuntimeVerification(installPath, role, config) {
-  const envText = existsSync9(join7(installPath, ".env")) ? readFileSync7(join7(installPath, ".env"), "utf-8") : "";
+  const envText = existsSync10(join8(installPath, ".env")) ? readFileSync8(join8(installPath, ".env"), "utf-8") : "";
   const mode = resolveRuntimeDeploymentMode({
     envText,
-    overlayExists: existsSync9(config?.openMatesCloudOverlayPath ?? defaultOpenMatesCloudOverlayPath(installPath))
+    overlayExists: existsSync10(config?.openMatesCloudOverlayPath ?? defaultOpenMatesCloudOverlayPath(installPath))
   });
-  const backupPath = join7(roleBackupDir(installPath, role), `latest-pre-update-${role}.tar.gz`);
-  const plan = planRuntimeVerification({ role, deploymentMode: mode.effectiveMode, hasVerifiedBackup: existsSync9(backupPath) });
+  const backupPath = join8(roleBackupDir(installPath, role), `latest-pre-update-${role}.tar.gz`);
+  const plan = planRuntimeVerification({ role, deploymentMode: mode.effectiveMode, hasVerifiedBackup: existsSync10(backupPath) });
   const verifierService = { core: "api", upload: "app-uploads", preview: "preview" }[role];
   const installMode = getInstallMode(installPath, config);
   const withOverrides = config?.composeProfile === "full";
@@ -29992,7 +30226,7 @@ async function runUpdateCompletionEmailGate(input) {
       deliveryId: deliveryPlan.deliveryId
     };
   }
-  const deliveryId = deliveryPlan.deliveryId ?? randomUUID10();
+  const deliveryId = deliveryPlan.deliveryId ?? randomUUID11();
   const deliveryPendingAt = deliveryPlan.pendingAt ?? completedAt;
   const previousAttempts = deliveryPlan.previousAttempts ?? 0;
   const { role: _role, updated_at: _updatedAt, ...currentStatus } = readServerUpdateStatus(input.installPath, input.role);
@@ -30098,10 +30332,10 @@ async function installRuntimeMonitoringServices(installPath, role) {
       [operationalPlan.watchdogTimerName, operationalPlan.watchdogTimer]
     ] : []
   ].filter((entry) => Boolean(entry[0] && entry[1]));
-  const reportStatePath = join7(installPath, ".openmates", "runtime-health", `${role}-operational-report.json`);
-  const reportMetricsDir = join7(installPath, ".openmates", "runtime-health", "metrics");
-  const startedMetricPath = join7(reportMetricsDir, "operational-report-started.prom");
-  const successMetricPath = join7(reportMetricsDir, "operational-report.prom");
+  const reportStatePath = join8(installPath, ".openmates", "runtime-health", `${role}-operational-report.json`);
+  const reportMetricsDir = join8(installPath, ".openmates", "runtime-health", "metrics");
+  const startedMetricPath = join8(reportMetricsDir, "operational-report-started.prom");
+  const successMetricPath = join8(reportMetricsDir, "operational-report.prom");
   const operationalUnitNames = [
     operationalPlan.digestServiceName,
     operationalPlan.digestTimerName,
@@ -30109,18 +30343,18 @@ async function installRuntimeMonitoringServices(installPath, role) {
     operationalPlan.watchdogTimerName
   ];
   if (operationalPlan.scheduleEnabled) {
-    mkdirSync6(dirname6(reportStatePath), { recursive: true, mode: 448 });
-    mkdirSync6(reportMetricsDir, { recursive: true, mode: 448 });
-    if (!existsSync9(reportStatePath)) {
-      writeFileSync5(
+    mkdirSync7(dirname6(reportStatePath), { recursive: true, mode: 448 });
+    mkdirSync7(reportMetricsDir, { recursive: true, mode: 448 });
+    if (!existsSync10(reportStatePath)) {
+      writeFileSync6(
         reportStatePath,
         `${JSON.stringify({ incidentOpen: false, monitoringStartedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `,
         { mode: 384 }
       );
     }
-    if (!existsSync9(startedMetricPath)) {
-      writeFileSync5(
+    if (!existsSync10(startedMetricPath)) {
+      writeFileSync6(
         startedMetricPath,
         `operational_report_monitoring_started_timestamp_seconds{environment="${operationalPlan.environment}"} ${Math.floor(Date.now() / 1e3)}
 `,
@@ -30128,21 +30362,21 @@ async function installRuntimeMonitoringServices(installPath, role) {
       );
     }
   } else {
-    const installedOperationalUnits = operationalUnitNames.filter((name) => existsSync9(join7("/etc", "systemd", "system", name)));
+    const installedOperationalUnits = operationalUnitNames.filter((name) => existsSync10(join8("/etc", "systemd", "system", name)));
     const installedOperationalTimers = installedOperationalUnits.filter((name) => name.endsWith(".timer"));
     if (installedOperationalTimers.length) {
-      execFileSync3("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
+      execFileSync4("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
     }
-    for (const name of installedOperationalUnits) rmSync5(join7("/etc", "systemd", "system", name));
+    for (const name of installedOperationalUnits) rmSync7(join8("/etc", "systemd", "system", name));
     for (const path2 of [reportStatePath, startedMetricPath, successMetricPath]) {
-      if (existsSync9(path2)) rmSync5(path2);
+      if (existsSync10(path2)) rmSync7(path2);
     }
   }
-  for (const [name, content] of files) writeFileSync5(join7("/etc", "systemd", "system", name), content, { mode: 420 });
+  for (const [name, content] of files) writeFileSync6(join8("/etc", "systemd", "system", name), content, { mode: 420 });
   execSync("systemctl daemon-reload", { stdio: "pipe" });
   const timers = files.filter(([name]) => name.endsWith(".timer")).map(([name]) => name);
   execSync(`systemctl enable --now ${timers.map(shellQuote).join(" ")}`, { stdio: "pipe" });
-  for (const timer of timers) execFileSync3("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
+  for (const timer of timers) execFileSync4("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
 }
 async function autoInstallRuntimeMonitoringServices(installPath, role) {
   if (!shouldAutoInstallRuntimeMonitoringServices(process.env)) {
@@ -30160,10 +30394,10 @@ async function serverUpdate(client, rest, flags) {
     const filePath = serverUpdateStatusFile(installPath2, role2);
     const status = readServerUpdateStatus(installPath2, role2);
     if (flags.json === true) {
-      printJson(existsSync9(filePath) ? status : { role: role2, status: "unknown" });
+      printJson(existsSync10(filePath) ? status : { role: role2, status: "unknown" });
       return;
     }
-    if (!existsSync9(filePath)) {
+    if (!existsSync10(filePath)) {
       console.log(`No update status recorded for ${role2}.`);
       return;
     }
@@ -30349,7 +30583,7 @@ async function serverUpdate(client, rest, flags) {
       try {
         await autoInstallRuntimeMonitoringServices(installPath, role);
       } catch (error) {
-        const restoreCommand = safetyPlan.backupName ? `openmates server restore --role ${role} --file ${join7(roleBackupDir(installPath, role), safetyPlan.backupName)}` : null;
+        const restoreCommand = safetyPlan.backupName ? `openmates server restore --role ${role} --file ${join8(roleBackupDir(installPath, role), safetyPlan.backupName)}` : null;
         writeServerUpdateStatus(installPath, role, {
           status: "degraded",
           targetImageTag: target.tag,
@@ -30675,11 +30909,11 @@ async function serverMonitoring(rest, flags) {
     const state2 = await readOperationalReportState(installPath, role);
     const nextState2 = accepted ? { ...state2, incidentOpen: false, incidentOpenedAt: void 0, lastAcceptedReportAt: (/* @__PURE__ */ new Date()).toISOString() } : state2;
     await writeOperationalReportState(installPath, role, nextState2);
-    const metricsDir = join7(installPath, ".openmates", "runtime-health", "metrics");
-    mkdirSync6(metricsDir, { recursive: true, mode: 448 });
+    const metricsDir = join8(installPath, ".openmates", "runtime-health", "metrics");
+    mkdirSync7(metricsDir, { recursive: true, mode: 448 });
     if (accepted) {
-      writeFileSync5(
-        join7(metricsDir, "operational-report.prom"),
+      writeFileSync6(
+        join8(metricsDir, "operational-report.prom"),
         `operational_report_last_success_timestamp_seconds{environment="${output2.receipts[0]?.environment ?? environment}"} ${Math.floor(Date.now() / 1e3)}
 `,
         { mode: 384 }
@@ -30697,11 +30931,11 @@ async function serverMonitoring(rest, flags) {
       destinationSource: receipt.destination_source,
       fallbackUsed: receipt.fallback_used
     }));
-    const receiptDir = join7(installPath, ".openmates", "runtime-health", "receipts");
-    mkdirSync6(receiptDir, { recursive: true, mode: 448 });
+    const receiptDir = join8(installPath, ".openmates", "runtime-health", "receipts");
+    mkdirSync7(receiptDir, { recursive: true, mode: 448 });
     const receiptMonth = (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
     for (const receipt of redactedReceipts) {
-      appendFileSync(join7(receiptDir, `${receiptMonth}.jsonl`), `${JSON.stringify(receipt)}
+      appendFileSync(join8(receiptDir, `${receiptMonth}.jsonl`), `${JSON.stringify(receipt)}
 `, { mode: 384 });
     }
     const displayed = { command: "monitoring digest", reportId: output2.report_id, reportSha256: output2.report_sha256, deliveryState: output2.delivery_state, receipts: redactedReceipts };
@@ -30905,14 +31139,14 @@ async function serverFeatures(rest, flags) {
   const installPath = resolveServerPath(flags);
   const installMode = getInstallMode(installPath);
   if (installMode === "image") ensureImageRuntimeConfig(installPath);
-  const configPath = installMode === "image" ? imageBackendConfigPath(installPath) : join7(installPath, BACKEND_CONFIG_FILE);
-  if (!existsSync9(configPath)) {
+  const configPath = installMode === "image" ? imageBackendConfigPath(installPath) : join8(installPath, BACKEND_CONFIG_FILE);
+  if (!existsSync10(configPath)) {
     throw new Error(`Backend config not found at ${configPath}. Run 'openmates server install' first or pass --path <dir>.`);
   }
-  const content = readFileSync7(configPath, "utf-8");
+  const content = readFileSync8(configPath, "utf-8");
   const overrides = parseFeatureOverrides(content);
   const writeOverrides = (nextOverrides) => {
-    writeFileSync5(configPath, updateFeatureOverridesContent(content, nextOverrides));
+    writeFileSync6(configPath, updateFeatureOverridesContent(content, nextOverrides));
     console.log(`Updated ${configPath}`);
     console.log("Restart the server for feature changes to take effect: openmates server restart");
   };
@@ -31145,7 +31379,7 @@ async function serverBackup(rest, flags) {
   const role = getServerRole(flags, config);
   if (action === "list") {
     const dir = roleBackupDir(installPath, role);
-    const files = existsSync9(dir) ? readdirSync3(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
+    const files = existsSync10(dir) ? readdirSync5(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
     if (flags.json === true) {
       printJson({ role, backupDir: dir, files });
       return;
@@ -31155,7 +31389,7 @@ async function serverBackup(rest, flags) {
       console.log("  none");
       return;
     }
-    for (const file of files) console.log(`  ${join7(dir, file)}`);
+    for (const file of files) console.log(`  ${join8(dir, file)}`);
     return;
   }
   requireDocker();
@@ -31240,7 +31474,7 @@ async function serverUninstall(flags) {
   } catch {
   }
   try {
-    rmSync5(installPath, { recursive: true, force: true });
+    rmSync7(installPath, { recursive: true, force: true });
     console.error(`  Removed installation directory: ${installPath}`);
   } catch (e) {
     console.error(`  Could not remove ${installPath}: ${e instanceof Error ? e.message : e}`);
@@ -31315,7 +31549,7 @@ async function serverCaddy(rest, flags) {
   const role = getServerRole(flags, config);
   const appliedPath = typeof flags.config === "string" ? flags.config : "/etc/caddy/Caddyfile";
   const templatePath = packagedCaddyTemplatePath(role);
-  if (!existsSync9(templatePath)) throw new Error(`Packaged Caddy template not found: ${templatePath}`);
+  if (!existsSync10(templatePath)) throw new Error(`Packaged Caddy template not found: ${templatePath}`);
   const plan = planCaddyCommand({ role, action, appliedPath });
   const payload = {
     ...plan,
@@ -31334,7 +31568,7 @@ async function serverCaddy(rest, flags) {
     return;
   }
   if (action === "diff") {
-    if (!existsSync9(appliedPath)) throw new Error(`Applied Caddyfile not found: ${appliedPath}`);
+    if (!existsSync10(appliedPath)) throw new Error(`Applied Caddyfile not found: ${appliedPath}`);
     try {
       execSync(`diff -u ${shellQuote(appliedPath)} ${shellQuote(templatePath)}`, { stdio: "inherit" });
     } catch (error) {
@@ -31355,9 +31589,9 @@ WARNING: This will replace ${appliedPath} with the packaged ${role} Caddyfile.`)
       }
     }
     const backupPath = `${appliedPath}.openmates-backup-${nowStamp()}`;
-    const hadExistingCaddyfile = existsSync9(appliedPath);
+    const hadExistingCaddyfile = existsSync10(appliedPath);
     try {
-      mkdirSync6(dirname6(appliedPath), { recursive: true });
+      mkdirSync7(dirname6(appliedPath), { recursive: true });
       if (hadExistingCaddyfile) copyFileSync2(appliedPath, backupPath);
       copyFileSync2(templatePath, appliedPath);
       execSync("systemctl reload caddy", { stdio: "inherit" });
@@ -48913,9 +49147,9 @@ function basenameFromUrl(url) {
   return withoutQuery.split("/").pop()?.replace(/[^a-zA-Z0-9._-]/g, "_") ?? "";
 }
 function extensionFromUrl(url) {
-  const basename4 = basenameFromUrl(url);
-  const dotIndex = basename4.lastIndexOf(".");
-  return dotIndex > 0 ? basename4.slice(dotIndex + 1).toLowerCase() : "";
+  const basename5 = basenameFromUrl(url);
+  const dotIndex = basename5.lastIndexOf(".");
+  return dotIndex > 0 ? basename5.slice(dotIndex + 1).toLowerCase() : "";
 }
 function extensionFromLanguage(language) {
   const normalized = language.toLowerCase();
@@ -49527,6 +49761,14 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
         }
       }
     },
+    tasks: {
+      daily_meeting_and_orchestration: {
+        text: "Daily meeting & orchestration",
+        description: {
+          text: "Choose today's priorities and coordinate project tasks and chats through completion."
+        }
+      }
+    },
     videos: {
       analyze_video: {
         text: "Analyze video",
@@ -50482,6 +50724,12 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       }
     },
     calendar: {
+      list_calendars: {
+        text: "List Calendars",
+        description: {
+          text: "List calendars, timezones, and access roles in a connected account."
+        }
+      },
       get_events: {
         text: "Search",
         description: {
@@ -56671,6 +56919,9 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       generating_title: {
         text: "Processing..."
       },
+      selecting_mate_and_model: {
+        text: "Selecting mate & AI model..."
+      },
       selecting_mate: {
         text: "Selecting optimal mate..."
       },
@@ -59616,6 +59867,21 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
         text: "You are an expert education and career counselor. Your role is to help users discover the right degree and field of study through thoughtful, strategic questioning. Use the Socratic method to guide them toward self-discovery rather than just giving advice. Help them understand their true interests, strengths, and values. Ask follow-up questions to dig deeper and uncover patterns. Provide personalized recommendations based on their responses."
       }
     },
+    tasks_daily_meeting_and_orchestration: {
+      text: "Daily meeting & orchestration",
+      description: {
+        text: "Choose today's priorities and coordinate project tasks and chats through completion."
+      },
+      process: {
+        text: "- Clarify your weekly priorities and today's focus, one question at a time\n- Review the last working day's chats, progress, and remaining tasks\n- Agree on goals and completion criteria before starting work\n- Coordinate project subchats, check progress, and resolve shared blockers\n- Summarize results and suggest the most relevant tasks to work on next"
+      },
+      how_to_use: {
+        text: "- Let's have a **daily meeting** for my shop launch and decide what matters today.\n- **Coordinate today's work** on my research project after reviewing our previous chats.\n- All our chats are finished. **What should we work on next** toward today's goal?"
+      },
+      systemprompt: {
+        text: "Help the user choose today's outcomes and coordinate work on their own projects.\nAsk one question per message, include **Recommendation:** with a brief reason and\n**Examples:** with concrete outcomes, then wait for the answer. Reuse decisions\nalready made. Keep replies concise and use the user's language.\n\nUse OpenMates tasks and task activities as the record of priorities, assignments,\nlearnings, decisions, blockers, and handoffs. Search before creating duplicates.\nUse only information accessible to this user in the selected project or team.\nPrivate history and task search require the authorized connected client; missing\naccess is not proof that no previous work exists. Never invent tool results or\nclaim a task update, chat action, or scheduled check without acknowledgement.\nUse available tools; explain missing capabilities and continue the useful parts\nof the meeting without promising unsupported automation. Preview requests are\nread-only: propose work without changing tasks, scheduling, or starting chats.\n\nFollow these steps:\n\n### Step 1: Establish today's focus\n\nAsk about this week's priorities, using recorded priorities as context. If unclear,\nestablish today's most useful outcome first. Clarify project scope, available time,\nor deadlines only when needed. Surface urgent issues when they affect the plan.\n\n### Step 2: Review the last working day\n\nIn the user's timezone, search backward from yesterday through at most 30 calendar\ndays for the latest day with relevant chat activity. Review every accessible chat\nactive on that day, including completed work, linked task activities, and subchat\nfindings. Group subchats with their parent and deduplicate copied history. Automatic\nnotifications alone do not establish a working day. Paused chats are resumption\ncandidates, but review unpaused chats too. Check today's active work for duplicates.\nIf the full window is empty, plan from tasks and user priorities. Disclose missing\naccess or partial results. Compare intended outcomes with actual progress and blockers.\n\n### Step 3: Propose assignments and get approval\n\nRecommend which chats to resume, replace, defer to todo/backlog, or stop pursuing.\nPreserve useful findings in task activities. For each assignment give the task,\ngoal, next instruction, completion criteria, required checks, scope limits,\ndependencies, and next meaningful checkpoint. Resume existing chats by default.\nIf conflicting context or repeated misunderstanding warrants a fresh subchat,\ntransfer requirements, decisions, saved work, and remaining checks; keep one owner.\n\nGet approval for the daily plan before starting or resuming work. Make clear which\ntasks OpenMates will execute and which require the user; only execute tasks assigned\nto OpenMates. Plan approval covers in-focus additions and urgent corrections, within\nexisting permissions and budgets. Cancellation still requires a user decision.\n\n### Step 4: Start or resume approved work\n\nUse OpenMates subchats for independent assignments and available chat controls for\nresumption. Give each subchat its approved goal, limits, task link, and completion\ncriteria. Verify acceptance before recording it as started. Preserve existing chat\nand task identity when resuming; reconcile uncertain starts before retrying. Keep\ncoordination in this meeting chat and avoid duplicate owners or recursive delegation.\nAsk workers to report important progress, learnings, decisions, and blockers so\nthey can be recorded in task activity. Do not post routine command or heartbeat logs.\n\n### Step 5: Monitor and handle changes\n\nFor each started/resumed chat, check at 5, 10, 15, and 20 minutes, then every 20\nminutes. Each new worker starts its own cadence. Where supported, use OpenMates\nfollow-ups in this meeting chat for approved scheduled checks. Use a full AI\nfollow-up only for an actual monitoring action; a passive reminder cannot inspect\nwork. Track acknowledged follow-ups, avoid duplicate schedules, preserve timing\nacross continuations, and cancel pending checks when work finishes or the day ends.\nIf scheduling or live progress access is unavailable, say so and use explicit\nuser-requested check-ins. Do not claim background supervision from prompt text alone.\n\nCompare actual results with the assignment. Leave healthy work uninterrupted;\ncorrect urgent drift within approved scope. Honor acceptance and scope changes.\nCoordinate one recovery effort for shared blockers, request user-only action once,\nverify recovery, and continue unaffected work.\n\nFor repeated failed approaches, absent measurable progress, or disproportionate\neffort, explain evidence and recommend narrowing or cancellation. Wait for the\nuser's decision; pause orchestration of only that chat and keep monitoring others.\nReport if the affected worker remains running. Do not cancel it or send further\ncontinuation instructions while waiting.\n\nIf an additional request fits today's focus, reuse/create the task and start it\nwithin approval. Otherwise capture it in todo/backlog. Preserve explicit deadlines;\nsuggest due dates only with a reason. Ask before materially changing today's focus.\n\n### Step 6: Summarize results and ask what comes next\n\nVerify outcomes and required checks before marking tasks done. Idle, paused,\nblocked, and awaiting-input chats are not complete. Ensure important outcomes,\ndecisions, and next steps are recorded in task activities.\n\nOnce all coordinated chats are done, summarize outcomes and fetch still-open tasks.\nRank by relevance to today's focus: direct outcomes, enabling dependencies, related\nimprovements, then unrelated work. Include task links, deadlines, blockers, remaining\nwork, and brief reasons. Label partial lists. Ask **What would you like to work on\nnext?** with a recommendation and concrete examples. Wait before starting another\nbatch, even within today's focus. If nothing remains, suggest ending the day or\nchoosing a new goal. If chats are blocked, ask the needed blocker decision instead.\n\n### Step 7: Close the day\n\nAt any step, respect the user's stop or end-of-day instruction. Cancel remaining\nmonitoring follow-ups and preserve handoffs in task activities. Paused work is\nneither done nor cancelled. At the next daily meeting, reassess it against the new\npriorities before resuming."
+      }
+    },
     videos_analyze_video: {
       text: "Analyze video",
       description: {
@@ -70488,10 +70754,10 @@ function buildAssistantFeedbackDecision(rating) {
 }
 
 // src/benchmark.ts
-import { createHash as createHash13, randomUUID as randomUUID11 } from "crypto";
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { createHash as createHash14, randomUUID as randomUUID12 } from "crypto";
+import { existsSync as existsSync11, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, readdirSync as readdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname7, join as join8, resolve as resolve8 } from "path";
+import { dirname as dirname7, join as join9, resolve as resolve8 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_JUDGE_MODEL = "google/gemini-3-flash-preview";
 var DEFAULT_PROMPT_BUDGET_MODEL = "google/gemini-3.5-flash";
@@ -70904,7 +71170,7 @@ async function handleBenchmark(client, subcommand, rest, flags) {
   const caseIds = parseCaseIds(flags.case);
   const dryRun = flags["dry-run"] === true;
   const output = typeof flags.output === "string" ? flags.output : void 0;
-  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID11();
+  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID12();
   const imagePath = typeof flags.image === "string" ? resolve8(flags.image) : defaultImageFixturePath();
   if (!dryRun && flags["confirm-spend-credits"] !== true) {
     throw new Error(
@@ -71006,7 +71272,7 @@ async function handlePromptBudgetBenchmark(client, rest, flags) {
   if (resumeArtifact) {
     validatePromptBudgetResumeArtifact(resumeArtifact, { phase, targetModel, judgeModel });
   }
-  const runId = stringFlag(flags["run-id"]) ?? resumeArtifact?.runId ?? randomUUID11();
+  const runId = stringFlag(flags["run-id"]) ?? resumeArtifact?.runId ?? randomUUID12();
   const result = makePromptBudgetBaseResult({
     phase,
     runId,
@@ -71377,7 +71643,7 @@ async function buildPromptWithAttachments(client, benchmarkCase, model, imagePat
 ${attachment.messageSuffix}`, embeds: attachment.embeds };
 }
 async function prepareImageAttachment(client, imagePath) {
-  if (!existsSync10(imagePath)) throw new Error(`Benchmark image not found: ${imagePath}`);
+  if (!existsSync11(imagePath)) throw new Error(`Benchmark image not found: ${imagePath}`);
   const processed = processFiles([imagePath], null);
   if (processed.blocked.length > 0 || processed.errors.length > 0 || processed.embeds.length === 0) {
     const reason = [...processed.blocked, ...processed.errors].map((entry) => entry.error).join("; ") || "no image embed produced";
@@ -71567,7 +71833,7 @@ function buildLongContextHistory() {
 }
 function appendHistory(history, role, content) {
   history.push({
-    message_id: randomUUID11(),
+    message_id: randomUUID12(),
     role,
     sender_name: role === "user" ? "User" : "Assistant",
     content,
@@ -71657,10 +71923,10 @@ function loadProviderPricing() {
   const providersDir = findProvidersDir();
   const pricing = /* @__PURE__ */ new Map();
   if (!providersDir) return pricing;
-  for (const fileName of readdirSync4(providersDir)) {
+  for (const fileName of readdirSync6(providersDir)) {
     if (!fileName.endsWith(".yml")) continue;
-    const filePath = join8(providersDir, fileName);
-    const text = readFileSync8(filePath, "utf-8");
+    const filePath = join9(providersDir, fileName);
+    const text = readFileSync9(filePath, "utf-8");
     const provider = parseProviderId(text) ?? fileName.replace(/\.yml$/, "");
     for (const modelPricing of parseModelPricing(text, provider)) {
       pricing.set(`${modelPricing.provider}/${modelPricing.modelId}`, modelPricing);
@@ -71714,10 +71980,10 @@ function findProvidersDir() {
   const currentFile = fileURLToPath(import.meta.url);
   let current = dirname7(currentFile);
   for (let index = 0; index < 8; index += 1) {
-    const candidate = join8(current, "backend", "providers");
-    if (existsSync10(candidate)) return candidate;
-    const parentCandidate = join8(current, "..", "..", "backend", "providers");
-    if (existsSync10(parentCandidate)) return resolve8(parentCandidate);
+    const candidate = join9(current, "backend", "providers");
+    if (existsSync11(candidate)) return candidate;
+    const parentCandidate = join9(current, "..", "..", "backend", "providers");
+    if (existsSync11(parentCandidate)) return resolve8(parentCandidate);
     const next = dirname7(current);
     if (next === current) break;
     current = next;
@@ -71922,21 +72188,21 @@ function hashPromptBudgetCorpus(cases) {
   return stableHash(cases.map((benchmarkCase) => ({ id: benchmarkCase.id, turns: benchmarkCase.turns })));
 }
 function stableHash(value) {
-  return createHash13("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash14("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function defaultImageFixturePath() {
-  const fixtureDir = join8(dirname7(fileURLToPath(import.meta.url)), "..", "fixtures");
-  const fixturePath = join8(fixtureDir, "brandenburger-tor.png");
-  if (existsSync10(fixturePath)) return fixturePath;
-  const tempDir = mkdtempSync2(join8(tmpdir(), "openmates-benchmark-"));
-  const tempPath = join8(tempDir, "brandenburger-tor.svg");
-  writeFileSync6(tempPath, FIXTURE_IMAGE_SVG, "utf-8");
+  const fixtureDir = join9(dirname7(fileURLToPath(import.meta.url)), "..", "fixtures");
+  const fixturePath = join9(fixtureDir, "brandenburger-tor.png");
+  if (existsSync11(fixturePath)) return fixturePath;
+  const tempDir = mkdtempSync2(join9(tmpdir(), "openmates-benchmark-"));
+  const tempPath = join9(tempDir, "brandenburger-tor.svg");
+  writeFileSync7(tempPath, FIXTURE_IMAGE_SVG, "utf-8");
   return tempPath;
 }
 function writeBenchmarkResult(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync6(output, json, "utf-8");
+  if (output) writeFileSync7(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -71960,7 +72226,7 @@ function writeBenchmarkResult(result, flags, output) {
 function writePromptBudgetResult(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync6(output, json, "utf-8");
+  if (output) writeFileSync7(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -71986,7 +72252,7 @@ function writePromptBudgetResult(result, flags, output) {
 function writePromptBudgetComparison(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync6(output, json, "utf-8");
+  if (output) writeFileSync7(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -72036,7 +72302,7 @@ function comparePromptBudgetArtifacts(flags) {
   };
 }
 function readPromptBudgetResult(path2) {
-  const parsed = JSON.parse(readFileSync8(path2, "utf-8"));
+  const parsed = JSON.parse(readFileSync9(path2, "utf-8"));
   if (!parsed || typeof parsed !== "object") throw new Error(`Invalid prompt-budget artifact: ${path2}`);
   return parsed;
 }
@@ -73434,22 +73700,22 @@ function clamp(value, min, max) {
 // src/remoteAccess.ts
 import { homedir as homedir7 } from "os";
 import {
-  chmodSync as chmodSync5,
+  chmodSync as chmodSync6,
   closeSync as closeSync3,
   constants,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   fstatSync,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   openSync as openSync3,
-  readFileSync as readFileSync9,
-  readdirSync as readdirSync5,
+  readFileSync as readFileSync10,
+  readdirSync as readdirSync7,
   readSync as readSync2,
   realpathSync,
   statSync as statSync2,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "fs";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
-import { join as join9, resolve as resolve9, relative as relative2 } from "path";
+import { join as join10, resolve as resolve9, relative as relative2 } from "path";
 
 // src/projectFileRisk.ts
 var SECRET_OR_ENVIRONMENT_PATTERNS = [
@@ -73572,7 +73838,7 @@ function resolveRemoteAccessRoots(pathFlag, cwd = process.cwd()) {
   const roots = [];
   for (const value of requested) {
     const candidate = resolve9(cwd, value);
-    if (!existsSync11(candidate) || !statSync2(candidate).isDirectory()) {
+    if (!existsSync12(candidate) || !statSync2(candidate).isDirectory()) {
       throw new Error(`Remote source path does not exist or is not a directory: ${candidate}`);
     }
     const canonical = realpathSync(candidate);
@@ -73586,7 +73852,7 @@ function discoverRemoteAccessRepositories(roots) {
   const visit = (directory, approvedRoot) => {
     let entries;
     try {
-      entries = readdirSync5(directory, { withFileTypes: true });
+      entries = readdirSync7(directory, { withFileTypes: true });
     } catch (error) {
       const code = error.code;
       if (code === "EACCES" || code === "EPERM") {
@@ -73600,7 +73866,7 @@ function discoverRemoteAccessRepositories(roots) {
     }
     for (const entry of entries) {
       if (entry.name === ".git" || entry.isSymbolicLink() || !entry.isDirectory()) continue;
-      visit(join9(directory, entry.name), approvedRoot);
+      visit(join10(directory, entry.name), approvedRoot);
     }
   };
   for (const root of roots) visit(root, root);
@@ -73610,8 +73876,8 @@ function discoverRemoteAccessRepositories(roots) {
   };
 }
 function remoteAccessSourceType(rootPath) {
-  const gitMarker = join9(rootPath, ".git");
-  return existsSync11(gitMarker) ? "local_git_repository" : "local_folder";
+  const gitMarker = join10(rootPath, ".git");
+  return existsSync12(gitMarker) ? "local_git_repository" : "local_folder";
 }
 function listRemoteAccessDirectory(options) {
   const root = realpathSync(options.sourceRoot);
@@ -73624,9 +73890,9 @@ function listRemoteAccessDirectory(options) {
   const entries = [];
   let omitted = 0;
   let excluded = 0;
-  for (const entry of readdirSync5(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-    const entryPath = relative2(root, join9(directory, entry.name)).replace(/\\/g, "/");
-    if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, entryPath) || classifyProjectFileRisk(entryPath, options.userProtectedPatterns ?? []).isHighRisk || entry.isFile() && isBinaryFile(join9(directory, entry.name))) {
+  for (const entry of readdirSync7(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const entryPath = relative2(root, join10(directory, entry.name)).replace(/\\/g, "/");
+    if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, entryPath) || classifyProjectFileRisk(entryPath, options.userProtectedPatterns ?? []).isHighRisk || entry.isFile() && isBinaryFile(join10(directory, entry.name))) {
       excluded += 1;
       continue;
     }
@@ -73854,7 +74120,7 @@ function remoteAccessOperationErrorCode(error) {
   return "operation_failed";
 }
 function isGitIgnoredPath(sourceRoot, relativePath) {
-  if (!existsSync11(join9(sourceRoot, ".git"))) return false;
+  if (!existsSync12(join10(sourceRoot, ".git"))) return false;
   const result = spawnSync2("git", ["check-ignore", "--quiet", "--", relativePath], {
     cwd: sourceRoot,
     stdio: "ignore"
@@ -73884,13 +74150,13 @@ function waitForAbort2(signal, timeoutMs) {
 }
 function resolveRemoteCachePath(sourceId, homeDirectory = homedir7()) {
   assertSafeSourceId(sourceId);
-  return join9(homeDirectory, ".openmates", "remote-cache", sourceId);
+  return join10(homeDirectory, ".openmates", "remote-cache", sourceId);
 }
 function startRemoteAccessSource(input) {
   assertSafeSourceId(input.sourceId);
   const homeDirectory = input.homeDirectory ?? homedir7();
   const requestedRootPath = resolve9(input.rootPath);
-  if (!existsSync11(requestedRootPath) || !statSync2(requestedRootPath).isDirectory()) {
+  if (!existsSync12(requestedRootPath) || !statSync2(requestedRootPath).isDirectory()) {
     throw new Error(`Remote source path does not exist or is not a directory: ${requestedRootPath}`);
   }
   const rootPath = realpathSync(requestedRootPath);
@@ -73908,14 +74174,14 @@ function startRemoteAccessSource(input) {
   };
   const sources = listRemoteAccessSources(homeDirectory).filter((entry) => entry.sourceId !== input.sourceId);
   saveRemoteAccessSources([...sources, source], homeDirectory);
-  mkdirSync7(source.cachePath, { recursive: true, mode: 448 });
+  mkdirSync8(source.cachePath, { recursive: true, mode: 448 });
   return source;
 }
 function listRemoteAccessSources(homeDirectory = homedir7()) {
   const filePath = remoteAccessStorePath(homeDirectory);
-  if (!existsSync11(filePath)) return [];
+  if (!existsSync12(filePath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync9(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(filePath, "utf-8"));
     if (!Array.isArray(parsed.sources)) {
       throw new Error("Remote source store is missing the sources array");
     }
@@ -73972,13 +74238,13 @@ function searchRemoteSourceWithoutRg(query, sourceRoot, maxResults, userProtecte
     const directory = directories.pop();
     let entries;
     try {
-      entries = readdirSync5(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+      entries = readdirSync7(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
     } catch {
       excluded += 1;
       continue;
     }
     for (const entry of entries) {
-      const absolutePath = join9(directory, entry.name);
+      const absolutePath = join10(directory, entry.name);
       const relativePath = relative2(root, absolutePath).replace(/\\/g, "/");
       if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, relativePath) || classifyProjectFileRisk(relativePath, userProtectedPatterns).isHighRisk) {
         excluded += 1;
@@ -74147,7 +74413,7 @@ function assertInsideRoot(sourceRoot, path2) {
 }
 function openedDescriptorPath(descriptor, requestedPath) {
   const procPath = `/proc/self/fd/${descriptor}`;
-  if (existsSync11(procPath)) return realpathSync(procPath);
+  if (existsSync12(procPath)) return realpathSync(procPath);
   return realpathSync(requestedPath);
 }
 function isBinaryFile(path2) {
@@ -74179,16 +74445,16 @@ function normalizeBound(value, maximum, label) {
   return result;
 }
 function remoteAccessStorePath(homeDirectory) {
-  return join9(homeDirectory, ".openmates", "remote-sources.json");
+  return join10(homeDirectory, ".openmates", "remote-sources.json");
 }
 function saveRemoteAccessSources(sources, homeDirectory) {
   const filePath = remoteAccessStorePath(homeDirectory);
-  const stateDir2 = join9(homeDirectory, ".openmates");
-  mkdirSync7(stateDir2, { recursive: true, mode: 448 });
-  chmodSync5(stateDir2, 448);
-  writeFileSync7(filePath, `${JSON.stringify({ sources }, null, 2)}
+  const stateDir2 = join10(homeDirectory, ".openmates");
+  mkdirSync8(stateDir2, { recursive: true, mode: 448 });
+  chmodSync6(stateDir2, 448);
+  writeFileSync8(filePath, `${JSON.stringify({ sources }, null, 2)}
 `, { mode: 384 });
-  chmodSync5(filePath, 384);
+  chmodSync6(filePath, 384);
 }
 function assertRemoteAccessSourceRecord(value, index) {
   if (typeof value !== "object" || value === null) {
@@ -74206,7 +74472,7 @@ function assertRemoteAccessSourceRecord(value, index) {
 }
 
 // src/projectRequester.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var REMOTE_PROTOCOL_TIMEOUT_MS = 45e3;
 var REMOTE_POLL_INTERVAL_MS = 250;
 var MAX_REMOTE_RESULT_BYTES = 200 * 1024;
@@ -74232,8 +74498,8 @@ async function requestProjectRemoteOperation(options) {
     keyEpoch = discovery.keyEpoch;
     routingIdentity = discovery.routingIdentity;
   }
-  const requestingClientId = randomUUID12();
-  const requestId = randomUUID12();
+  const requestingClientId = randomUUID13();
+  const requestId = randomUUID13();
   const identity = await buildIdentity(
     options.client,
     options.projectId,
@@ -74294,9 +74560,9 @@ async function requestProjectRemoteOperation(options) {
   return response.result;
 }
 async function discoverRouting(options, timeoutMs) {
-  const requestId = randomUUID12();
-  const requestingClientId = randomUUID12();
-  const nonce = randomUUID12();
+  const requestId = randomUUID13();
+  const requestingClientId = randomUUID13();
+  const nonce = randomUUID13();
   const encryptedEnvelope = await encryptWithAesGcmCombined(JSON.stringify({
     type: "routing_discovery",
     requesting_client_id: requestingClientId,
@@ -74394,13 +74660,68 @@ function remoteErrorMessage(code) {
 
 // src/selfUpdate.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, renameSync as renameSync5 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname8, basename as basename3, join as join11 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_NAME = "openmates";
-var DEFAULT_TARGET = "latest";
+function channelFile() {
+  return join11(homedir8(), ".openmates", "updates.json");
+}
+function parseChannel(value) {
+  if (value === "dev") return "dev";
+  if (value === "stable" || value === "main") return "stable";
+  throw new Error("--channel must be dev, stable, or main (alias for stable)");
+}
+function savedChannel() {
+  try {
+    return parseChannel(JSON.parse(readFileSync11(channelFile(), "utf8")).channel);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return getCliPackageVersion().includes("-") ? "dev" : "stable";
+    }
+    throw error;
+  }
+}
+function persistSelfUpdateChannel(plan) {
+  if (plan.dryRun || !plan.persistChannel) return;
+  const path2 = channelFile();
+  mkdirSync9(dirname8(path2), { recursive: true, mode: 448 });
+  const temporary = `${path2}.${process.pid}.tmp`;
+  writeFileSync9(temporary, JSON.stringify({ channel: plan.channel }) + "\n", { mode: 384 });
+  renameSync5(temporary, path2);
+}
+function installedNpmPrefix(moduleUrl = import.meta.url, platform4 = process.platform) {
+  const packageRoot = dirname8(dirname8(fileURLToPath2(moduleUrl)));
+  const modules = dirname8(packageRoot);
+  if (basename3(packageRoot) !== PACKAGE_NAME || basename3(modules) !== "node_modules") return null;
+  if (platform4 === "win32") return dirname8(modules);
+  return basename3(dirname8(modules)) === "lib" ? dirname8(dirname8(modules)) : null;
+}
+function compareVersions(left, right) {
+  const parse = (value) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+    if (!match) throw new Error(`Cannot compare CLI version '${value}'`);
+    return { core: match.slice(1, 4).map(BigInt), pre: match[4]?.split(".") };
+  };
+  const a = parse(left), b = parse(right);
+  for (let i = 0; i < 3; i++) if (a.core[i] !== b.core[i]) return a.core[i] > b.core[i] ? 1 : -1;
+  if (!a.pre || !b.pre) return a.pre ? -1 : b.pre ? 1 : 0;
+  for (let i = 0; i < Math.max(a.pre.length, b.pre.length); i++) {
+    const x = a.pre[i], y = b.pre[i];
+    if (x === y) continue;
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
+    if (nx && ny) return BigInt(x) > BigInt(y) ? 1 : BigInt(x) < BigInt(y) ? -1 : 0;
+    if (nx !== ny) return nx ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
 var SAFE_TARGET_RE = /^[a-zA-Z0-9._@+~:-]+$/;
 function getCliPackageVersion() {
   try {
-    const packageJson = JSON.parse(readFileSync10(new URL("../package.json", import.meta.url), "utf-8"));
+    const packageJson = JSON.parse(readFileSync11(new URL("../package.json", import.meta.url), "utf-8"));
     return packageJson.version ?? "unknown";
   } catch {
     return "unknown";
@@ -74408,10 +74729,14 @@ function getCliPackageVersion() {
 }
 function buildSelfUpdatePlan(flags) {
   const packageManager = parsePackageManager(flags["package-manager"]);
-  const target = parseTarget(flags.version);
+  const channel = flags.channel === void 0 ? savedChannel() : parseChannel(flags.channel);
+  const target = parseTarget(flags.version ?? (channel === "dev" ? "alpha" : "latest"));
   const packageSpec = `${PACKAGE_NAME}@${target}`;
   const { command, args } = commandForPackageManager(packageManager, packageSpec);
   return {
+    channel,
+    persistChannel: flags.channel !== void 0,
+    allowDowngrade: flags["allow-downgrade"] === true,
     packageManager,
     command,
     args,
@@ -74434,10 +74759,15 @@ function checkSelfUpdateStatus(plan) {
   return {
     currentVersion: plan.currentVersion,
     latestVersion: latest.version,
-    updateAvailable: plan.currentVersion !== latest.version,
+    updateAvailable: compareVersions(latest.version, plan.currentVersion) > 0 || plan.allowDowngrade && compareVersions(latest.version, plan.currentVersion) !== 0,
     checkError: null
   };
 }
+function pinSelfUpdatePlan(plan, version) {
+  const packageSpec = `${PACKAGE_NAME}@${parseTarget(version)}`;
+  const { command, args } = commandForPackageManager(plan.packageManager, packageSpec);
+  return { ...plan, target: version, packageSpec, command, args };
+}
 function runSelfUpdate(plan, options = {}) {
   if (plan.dryRun) return;
   const result = spawnSync3(plan.command, plan.args, {
@@ -74455,6 +74785,12 @@ function runSelfUpdate(plan, options = {}) {
 ${output}` : "";
     throw new Error(`${plan.command} ${plan.args.join(" ")} failed with exit code ${result.status ?? "unknown"}${suffix}`);
   }
+  if (installedNpmPrefix()) {
+    const installed = getCliPackageVersion();
+    if (installed !== plan.target) {
+      throw new Error(`CLI upgrade installed version ${installed}; expected ${plan.target}. Retry the upgrade with --verbose to inspect package-manager output.`);
+    }
+  }
 }
 function resolveTargetVersion(target) {
   const forced = process.env.OPENMATES_CLI_LATEST_VERSION;
@@ -74464,7 +74800,8 @@ function resolveTargetVersion(target) {
   }
   const result = spawnSync3(commandName("npm"), ["view", `${PACKAGE_NAME}@${target}`, "version"], {
     encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 3e4
   });
   if (result.error) return { version: null, error: result.error.message };
   if (result.status !== 0) {
@@ -74480,7 +74817,7 @@ function parsePackageManager(value) {
   throw new Error("--package-manager must be one of npm, pnpm, yarn, or bun");
 }
 function parseTarget(value) {
-  if (value === void 0) return DEFAULT_TARGET;
+  if (value === void 0) return "latest";
   if (typeof value !== "string" || value.length === 0) {
     throw new Error("--version requires a version or npm dist-tag");
   }
@@ -74500,15 +74837,16 @@ function commandForPackageManager(packageManager, packageSpec) {
   if (packageManager === "pnpm") return { command: commandName("pnpm"), args: ["add", "-g", packageSpec] };
   if (packageManager === "yarn") return { command: commandName("yarn"), args: ["global", "add", packageSpec] };
   if (packageManager === "bun") return { command: commandName("bun"), args: ["install", "-g", packageSpec] };
-  return { command: commandName("npm"), args: ["install", "-g", packageSpec] };
+  const prefix = installedNpmPrefix();
+  return { command: commandName("npm"), args: ["install", "-g", packageSpec, ...prefix ? ["--prefix", prefix] : []] };
 }
 function commandName(name) {
   return process.platform === "win32" ? `${name}.cmd` : name;
 }
 
 // src/workRecovery.ts
-import { mkdirSync as mkdirSync8, renameSync as renameSync2, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8 } from "path";
+import { mkdirSync as mkdirSync10, renameSync as renameSync6, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname9 } from "path";
 import { stringify } from "yaml";
 async function projectPlanAssumption(plan, masterKey, assumption) {
   const key = await planKeyFromRecord(plan.encrypted, masterKey);
@@ -74687,18 +75025,18 @@ function collectMismatchPaths(left, right, path2, mismatches) {
 }
 function writeWorkRecoveryAtomically(path2, document) {
   validateWorkRecoveryDocument(document);
-  mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
+  mkdirSync10(dirname9(path2), { recursive: true, mode: 448 });
   const temporaryPath = `${path2}.tmp`;
-  writeFileSync8(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
-  renameSync2(temporaryPath, path2);
+  writeFileSync10(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
+  renameSync6(temporaryPath, path2);
 }
 
 // src/revolutBusinessCertificate.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { createSign, randomUUID as randomUUID13 } from "crypto";
-import { chmodSync as chmodSync6, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync11 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10, resolve as resolve10 } from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+import { createSign, randomUUID as randomUUID14 } from "crypto";
+import { chmodSync as chmodSync7, existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync12 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join12, resolve as resolve10 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
 var REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI = "https://app.dev.openmates.org/oauth/revolut-business/callback";
 var REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI = "https://openmates.org/oauth/revolut-business/callback";
@@ -74708,7 +75046,7 @@ var REVOLUT_BUSINESS_AUDIENCE = "https://revolut.com";
 var CERTIFICATE_DAYS = "1825";
 var RSA_BITS = "2048";
 function defaultRevolutBusinessCertificateDir(environment) {
-  return join10(homedir8(), ".openmates", "revolut-business", environment);
+  return join12(homedir9(), ".openmates", "revolut-business", environment);
 }
 function defaultRevolutBusinessRedirectUri(environment) {
   return environment === "sandbox" ? REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI : REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI;
@@ -74731,7 +75069,7 @@ async function exchangeRevolutBusinessAuthorizationCode(options) {
   if (!clientId) throw new Error("Missing Revolut Business client ID.");
   const code = extractRevolutBusinessAuthorizationCode(options.codeOrRedirectUrl);
   if (!code) throw new Error("Missing Revolut Business authorization code.");
-  const privateKeyPem = options.privateKeyPem ?? readFileSync11(options.privateKeyPath ?? join10(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
+  const privateKeyPem = options.privateKeyPem ?? readFileSync12(options.privateKeyPath ?? join12(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   const clientAssertion = generateRevolutBusinessClientAssertion({ clientId, privateKeyPem, redirectUri });
   const response = await fetch(environment === "sandbox" ? "https://sandbox-b2b.revolut.com/api/1.0/auth/token" : "https://b2b.revolut.com/api/1.0/auth/token", {
@@ -74769,7 +75107,7 @@ function generateRevolutBusinessClientAssertion(options) {
     aud: REVOLUT_BUSINESS_AUDIENCE,
     exp: now + 3600,
     iat: now,
-    jti: randomUUID13()
+    jti: randomUUID14()
   });
   const unsigned = `${header2}.${payload}`;
   const signer = createSign("RSA-SHA256");
@@ -74784,17 +75122,17 @@ function generateRevolutBusinessCertificate(options = {}) {
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   if (!title) throw new Error("Revolut certificate title must not be empty.");
   if (!redirectUri.startsWith("https://")) throw new Error("Revolut OAuth redirect URI must start with https://.");
-  mkdirSync9(outputDir, { recursive: true, mode: 448 });
-  chmodSync6(outputDir, 448);
-  const privateKeyPath = join10(outputDir, "privatecert.pem");
-  const publicCertificatePath = join10(outputDir, "publiccert.cer");
-  if (!options.overwrite && (existsSync12(privateKeyPath) || existsSync12(publicCertificatePath))) {
+  mkdirSync11(outputDir, { recursive: true, mode: 448 });
+  chmodSync7(outputDir, 448);
+  const privateKeyPath = join12(outputDir, "privatecert.pem");
+  const publicCertificatePath = join12(outputDir, "publiccert.cer");
+  if (!options.overwrite && (existsSync13(privateKeyPath) || existsSync13(publicCertificatePath))) {
     throw new Error(`Revolut certificate files already exist in ${outputDir}. Re-run with --overwrite to replace them.`);
   }
   try {
-    execFileSync4("openssl", ["genrsa", "-out", privateKeyPath, RSA_BITS], { stdio: "ignore" });
-    chmodSync6(privateKeyPath, 384);
-    execFileSync4(
+    execFileSync5("openssl", ["genrsa", "-out", privateKeyPath, RSA_BITS], { stdio: "ignore" });
+    chmodSync7(privateKeyPath, 384);
+    execFileSync5(
       "openssl",
       [
         "req",
@@ -74822,7 +75160,7 @@ function generateRevolutBusinessCertificate(options = {}) {
     outputDir,
     privateKeyPath,
     publicCertificatePath,
-    publicCertificatePem: readFileSync11(publicCertificatePath, "utf8").trim()
+    publicCertificatePem: readFileSync12(publicCertificatePath, "utf8").trim()
   };
 }
 function escapeOpenSslSubjectValue(value) {
@@ -74848,6 +75186,15 @@ async function main() {
     assertTrustedAccountGuardEnvironment(parsed.flags);
     assertTrustedAccountCommandAllowed(command);
   }
+  if (parsed.flags.profile !== void 0) {
+    const profile = parsed.flags.profile;
+    if (typeof profile !== "string" || !profile) throw new Error("--profile requires a profile name");
+    resolveStateDir({ profile, stateDir: "" });
+    if (process.env.OPENMATES_STATE_DIR?.trim()) {
+      throw new Error("--profile cannot be combined with OPENMATES_STATE_DIR");
+    }
+    process.env.OPENMATES_PROFILE = profile;
+  }
   const client = OpenMatesClient.load({
     apiUrl: typeof parsed.flags["api-url"] === "string" ? parsed.flags["api-url"] : void 0
   });
@@ -75213,6 +75560,9 @@ function assertTrustedAccountCommandAllowed(command) {
   }
 }
 function assertTrustedAccountGuardEnvironment(flags, environment = process.env) {
+  if (flags.profile !== void 0 && flags.profile !== TRUST_GUARD_PROFILE) {
+    throw new Error(`Trusted OpenCode CLI commands cannot override profile ${TRUST_GUARD_PROFILE}.`);
+  }
   if (environment.OPENMATES_PROFILE !== TRUST_GUARD_PROFILE) {
     throw new Error(`Trusted OpenCode CLI commands require OPENMATES_PROFILE=${TRUST_GUARD_PROFILE}.`);
   }
@@ -75250,13 +75600,19 @@ function handleSupport(flags) {
   console.log(renderSupportInfo());
 }
 function handleSelfUpdate(command, flags) {
-  const plan = buildSelfUpdatePlan(flags);
+  let plan = buildSelfUpdatePlan(flags);
   const status = checkSelfUpdateStatus(plan);
-  const shouldInstall = status.updateAvailable !== false;
+  if (status.checkError) throw new Error(`Update check failed: ${status.checkError}`);
+  const shouldInstall = status.updateAvailable === true;
+  if (!plan.dryRun && shouldInstall && status.latestVersion) {
+    plan = pinSelfUpdatePlan(plan, status.latestVersion);
+  }
   if (flags.json === true) {
     if (!plan.dryRun && shouldInstall) runSelfUpdate(plan, { verbose: flags.verbose === true });
+    persistSelfUpdateChannel(plan);
     printJson2({
       command,
+      channel: plan.channel,
       status: status.updateAvailable === false ? "up_to_date" : plan.dryRun ? "planned" : "success",
       current_version: plan.currentVersion,
       latest_version: status.latestVersion,
@@ -75273,6 +75629,7 @@ function handleSelfUpdate(command, flags) {
   console.log("");
   console.log("Checking for updates...");
   console.log("");
+  console.log(`Release channel: ${plan.channel}`);
   console.log(`Current version: ${plan.currentVersion}`);
   console.log(`Latest version:  ${status.latestVersion ?? "unknown"}`);
   if (status.checkError) {
@@ -75288,11 +75645,13 @@ function handleSelfUpdate(command, flags) {
     return;
   }
   if (status.updateAvailable === false) {
+    persistSelfUpdateChannel(plan);
     console.log("OpenMates CLI is already up to date.");
     return;
   }
   console.log(`Updating OpenMates CLI with ${plan.packageManager}...`);
   runSelfUpdate(plan, { verbose: flags.verbose === true });
+  persistSelfUpdateChannel(plan);
   console.log(`Installed OpenMates CLI ${status.latestVersion ?? plan.target}.`);
   console.log("");
   console.log("OpenMates is up to date.");
@@ -75305,6 +75664,7 @@ function handleCliVersion(flags) {
   if (flags.json === true) {
     printJson2({
       command: "version",
+      channel: plan.channel,
       current_version: status.currentVersion,
       latest_version: status.latestVersion,
       update_available: status.updateAvailable,
@@ -75314,6 +75674,7 @@ function handleCliVersion(flags) {
     return;
   }
   console.log(`OpenMates CLI ${status.currentVersion}`);
+  console.log(`Release channel: ${plan.channel}`);
   if (status.checkError) {
     console.log(`Update check failed: ${status.checkError}`);
     return;
@@ -75336,35 +75697,55 @@ async function handleTasks(client, subcommand, rest, flags, redactor) {
     const action = rest[0] ?? "list";
     const task = await requiredResolvedTask(client, masterKey, rest[1], scope, `activity ${action}`);
     const context = { teamId: scope.teamId, personal: scope.personal };
-    if (action === "list") {
-      const records = [];
-      let cursor;
-      do {
-        const page = await client.listUserTaskActivity(task.taskId, {
-          ...context,
-          cursor,
-          limit: typeof flags.limit === "string" ? Number(flags.limit) : void 0
-        });
-        records.push(...page.entries);
-        cursor = page.next_cursor ?? void 0;
-      } while (cursor);
-      const entries = await decryptTaskActivityEntries(task, masterKey, records);
-      if (flags.json === true) printJson2({ entries: entries.map(taskActivityToJson) });
-      else console.log(renderTaskActivityList(entries));
+    const actor = flags["as-assignee"] === true ? "assignee" : "user";
+    const delivery = () => activityDeliveryStore(JSON.stringify([
+      client.getSession().apiUrl,
+      client.getSession().hashedEmail,
+      scope.teamId || "personal",
+      task.taskId,
+      actor
+    ]));
+    const createActivity = (input) => client.createUserTaskActivity(task.taskId, input, {
+      ...context,
+      ...actor === "assignee" ? { actorMode: "assignee" } : {}
+    });
+    if (action === "flush") {
+      printJson2(await delivery().flush(createActivity));
+      return;
+    }
+    if (action === "list" || action === "search") {
+      const pending = flags["flush-pending"] === true ? await delivery().flush(createActivity) : void 0;
+      const history = await readActivityHistory({
+        maxEntries: typeof flags["max-entries"] === "string" ? Number(flags["max-entries"]) : action === "search" ? 200 : void 0,
+        pageSize: typeof flags.limit === "string" ? Number(flags.limit) : 100,
+        cursor: typeof flags.cursor === "string" ? flags.cursor : void 0,
+        ...action === "search" ? { query: typeof flags.query === "string" ? flags.query : "" } : {},
+        page: async (cursor, limit) => {
+          const page = await client.listUserTaskActivity(task.taskId, {
+            ...context,
+            cursor,
+            limit,
+            newestFirst: flags["newest-first"] === true
+          });
+          return { entries: await decryptTaskActivityEntries(task, masterKey, page.entries), next_cursor: page.next_cursor };
+        }
+      });
+      if (flags.json === true) printJson2({ ...history, entries: history.entries.map(taskActivityToJson), delivery: pending });
+      else {
+        console.log(renderTaskActivityList(history.entries));
+        if (history.truncated) console.log(`Activity history truncated. Search all history: openmates tasks activity search ${task.shortId} --query "text" --max-entries 200`);
+        if (history.next_cursor) console.log(`Next cursor: ${history.next_cursor}`);
+      }
       return;
     }
     if (action === "add") {
       const message = typeof flags.message === "string" ? flags.message : rest.slice(2).join(" ");
       if (!message.trim()) throw new Error("Missing comment. Usage: openmates tasks activity add <task-id> --message <text>");
-      const input = await buildCreateTaskActivityInput(task, masterKey, { message });
-      const entry = await decryptTaskActivityEntry(
-        task,
-        masterKey,
-        await client.createUserTaskActivity(task.taskId, input, {
-          ...context,
-          ...flags["as-assignee"] === true ? { actorMode: "assignee" } : {}
-        })
-      );
+      const deliveryId = typeof flags["delivery-id"] === "string" ? flags["delivery-id"] : void 0;
+      const build = () => buildCreateTaskActivityInput(task, masterKey, { message, ...deliveryId ? { entryId: deliveryId } : {} });
+      const record = deliveryId ? await delivery().deliver(deliveryId, build, createActivity) : await createActivity(await build());
+      const entry = await decryptTaskActivityEntry(task, masterKey, record);
+      if (entry.message !== message) throw new Error("Activity delivery id already belongs to a different milestone message");
       if (flags.json === true) printJson2({ entry: taskActivityToJson(entry) });
       else console.log(renderTaskActivityList([entry]));
       return;
@@ -75381,7 +75762,7 @@ async function handleTasks(client, subcommand, rest, flags, redactor) {
       else console.log(renderTaskActivityList([entry]));
       return;
     }
-    throw new Error("Usage: openmates tasks activity list|add|delete <task-id> [<entry-id>] [--message <text>]");
+    throw new Error("Usage: openmates tasks activity list|search|add|flush|delete <task-id> [<entry-id>] [--message <text>]");
   }
   if (rest[0] === "add-to-project") {
     rejectRemoteCopyFlags(flags);
@@ -76081,7 +76462,7 @@ async function resolveAddToProjectStorageChoice(client, project, flags, objectTy
 async function createEncryptedProjectItem(client, project, input) {
   const timestamp = nowSeconds3();
   return client.createProjectItem(project.projectId, {
-    project_item_id: randomUUID14(),
+    project_item_id: randomUUID15(),
     folder_id: input.folderId ?? null,
     item_type: input.itemType,
     target_id: input.targetId,
@@ -76275,7 +76656,7 @@ async function handlePlans(client, subcommand, rest, flags, redactor) {
     const encryptedSources = proof.length ? await encryptPlanAssumptionSources(plan, masterKey, proof) : void 0;
     if (action === "create" || action === "add") {
       const assumption = await client.createPlanAssumption(plan.planId, {
-        assumption_id: typeof flags.id === "string" ? flags.id : randomUUID14(),
+        assumption_id: typeof flags.id === "string" ? flags.id : randomUUID15(),
         encrypted_text: await encryptPlanAssumptionSources(plan, masterKey, requiredStringFlag(flags.text ?? rest.slice(2).join(" "), "--text <assumption>")),
         status: typeof flags.status === "string" ? flags.status : void 0,
         linked_sub_chat_id: typeof flags["sub-chat"] === "string" ? flags["sub-chat"] : void 0,
@@ -76317,7 +76698,7 @@ async function handlePlans(client, subcommand, rest, flags, redactor) {
     if (action === "diff") throw new Error("Revision diffs are reviewed in the authenticated web review page; use submit-for-review to print its URL.");
     if (action !== "submit-for-review") throw new Error("Usage: openmates plans revisions list|submit-for-review|status|diff <plan-id>");
     const snapshot = JSON.stringify(planToJson(plan));
-    const revision = await client.submitPlanRevision(plan.planId, { fingerprint: createHash14("sha256").update(snapshot).digest("hex"), encrypted_snapshot: await encryptPlanAssumptionSources(plan, masterKey, snapshot), created_at: nowSeconds3() });
+    const revision = await client.submitPlanRevision(plan.planId, { fingerprint: createHash15("sha256").update(snapshot).digest("hex"), encrypted_snapshot: await encryptPlanAssumptionSources(plan, masterKey, snapshot), created_at: nowSeconds3() });
     const reviewUrl = `${deriveAppUrl(client.apiUrl)}/plans/${plan.planId}/review?revision=${revision.revision_id}`;
     if (flags.json === true) printJson2({ revision, review_url: reviewUrl });
     else console.log(`Plan revision submitted for web review: ${reviewUrl}`);
@@ -76873,8 +77254,8 @@ async function handleWorkRecovery(client, subcommand, rest, flags) {
   }
   if (subcommand === "validate" || subcommand === "restore") {
     const path2 = requiredStringFlag(flags.file ?? rest[0], "--file <projection.yml>");
-    if (!existsSync13(path2)) throw new Error(`Recovery projection does not exist: ${path2}`);
-    const document = parseYaml(readFileSync12(path2, "utf8"));
+    if (!existsSync14(path2)) throw new Error(`Recovery projection does not exist: ${path2}`);
+    const document = parseYaml(readFileSync13(path2, "utf8"));
     validateWorkRecoveryDocument(document);
     if (subcommand === "validate") {
       if (flags.json === true) printJson2({ valid: true });
@@ -77200,7 +77581,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
     const name = requiredStringFlag(rest[0] ?? flags.name, "project name");
     const projectKey = randomBytes9(32);
     const wrapping = await client.projectWrappingKey(context);
-    const projectId = randomUUID14();
+    const projectId = randomUUID15();
     const timestamp = nowSeconds3();
     const slugMetadata = await buildEncryptedObjectSlugMetadata({
       value: typeof flags.slug === "string" ? flags.slug : name,
@@ -77222,7 +77603,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
       last_opened_at: timestamp,
       key_wrappers: wrapping.teamId ? [{
         key_type: "team",
-        hashed_team_id: createHash14("sha256").update(wrapping.teamId).digest("hex"),
+        hashed_team_id: createHash15("sha256").update(wrapping.teamId).digest("hex"),
         team_key_epoch: 1,
         encrypted_project_key: await encryptBytesWithAesGcm(projectKey, wrapping.key),
         wrapper_version: 1,
@@ -77308,7 +77689,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
     const proposal = isShortWorkspaceAsk(instruction) ? { name: instruction, description: "", icon: "folder", color: "default" } : extractRecord(await client.planProjectAsk({ instruction }), "proposed_project");
     const projectKey = randomBytes9(32);
     const timestamp = Math.floor(Date.now() / 1e3);
-    const projectId = randomUUID14();
+    const projectId = randomUUID15();
     const name = requiredString(proposal, "name", instruction);
     const slugMetadata = await buildEncryptedObjectSlugMetadata({
       value: typeof flags.slug === "string" ? flags.slug : name,
@@ -77705,7 +78086,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     if (action === "get") {
       const output = requiredStringFlag(flags.output ?? flags.file ?? rest[2], "--output <path>");
       const image = await client.getTeamProfileImage(teamId);
-      writeFileSync9(output, image.data, { mode: 384 });
+      writeFileSync11(output, image.data, { mode: 384 });
       if (flags.json === true) printJson2({ output, content_type: image.contentType, size_bytes: image.data.byteLength });
       else console.log(`Team profile image written: ${output}`);
       return;
@@ -77864,7 +78245,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     const output = requiredStringFlag(flags.output, "--output <path>");
     const result = await client.exportTeamData(teamId);
     const artifact = result.artifact && typeof result.artifact === "object" ? result.artifact : result;
-    writeFileSync9(output, `${JSON.stringify(artifact, null, 2)}
+    writeFileSync11(output, `${JSON.stringify(artifact, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
     if (flags.json === true) printJson2({ ...result, output });
     else console.log(`Team export written: ${output}`);
@@ -77872,7 +78253,7 @@ async function handleTeams(client, subcommand, rest, flags) {
   }
   if (subcommand === "import") {
     const file = requiredStringFlag(flags.file ?? rest[0], "--file <path>");
-    const artifact = JSON.parse(readFileSync12(file, "utf-8"));
+    const artifact = JSON.parse(readFileSync13(file, "utf-8"));
     let teamId = typeof flags.team === "string" ? flags.team : typeof flags["destination-team"] === "string" ? flags["destination-team"] : void 0;
     if (!teamId && typeof flags["new-team-name"] === "string") {
       const team = await client.createTeam({ name: flags["new-team-name"] });
@@ -78207,7 +78588,7 @@ async function handleRemoteAccess(client, subcommand, rest, flags) {
     const projects = await loadProjects(client, masterKey, hostingFlags, hostingContext);
     const bindings = await resolveRemoteAccessBindings(client, masterKey, projects, candidateRoots, hostingFlags, hostingContext);
     if (bindings.length === 0) throw new Error("No Project folders were approved for remote access.");
-    const sourceSessionId = randomUUID14();
+    const sourceSessionId = randomUUID15();
     const controller = new AbortController();
     const stop = () => controller.abort();
     process.once("SIGINT", stop);
@@ -78314,8 +78695,8 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
     const answer = (await promptLine2(`Create ${unresolved.length} missing Project${unresolved.length === 1 ? "" : "s"}? [y/N] `)).trim().toLowerCase();
     if (answer !== "y" && answer !== "yes") throw new Error("Remote access Project creation cancelled.");
     for (const rootPath of unresolved) {
-      const project = await createEncryptedRemoteAccessProject(client, masterKey, basename3(rootPath), context);
-      resolved.push({ rootPath, project, sourceId: randomUUID14() });
+      const project = await createEncryptedRemoteAccessProject(client, masterKey, basename4(rootPath), context);
+      resolved.push({ rootPath, project, sourceId: randomUUID15() });
     }
   }
   const bindings = [];
@@ -78326,7 +78707,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
       projectId: item.project.projectId,
       rootPath: item.rootPath,
       sourceType,
-      displayName: basename3(item.rootPath)
+      displayName: basename4(item.rootPath)
     });
     const remoteSources = await client.listProjectSources(item.project.projectId, context);
     const remoteSource = remoteSources.find((entry) => entry.source_id === source.sourceId);
@@ -78352,7 +78733,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
 }
 async function createEncryptedRemoteAccessProject(client, masterKey, name, context) {
   const projectKey = randomBytes9(32);
-  const projectId = randomUUID14();
+  const projectId = randomUUID15();
   const timestamp = Math.floor(Date.now() / 1e3);
   const wrapping = await client.projectWrappingKey(context);
   const payload = {
@@ -78369,7 +78750,7 @@ async function createEncryptedRemoteAccessProject(client, masterKey, name, conte
     last_opened_at: timestamp,
     key_wrappers: wrapping.teamId ? [{
       key_type: "team",
-      hashed_team_id: createHash14("sha256").update(wrapping.teamId).digest("hex"),
+      hashed_team_id: createHash15("sha256").update(wrapping.teamId).digest("hex"),
       team_key_epoch: 1,
       encrypted_project_key: await encryptBytesWithAesGcm(projectKey, wrapping.key),
       wrapper_version: 1,
@@ -79169,16 +79550,16 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       }
     }
     const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-    const { join: join11 } = await import("path");
+    const { join: join13 } = await import("path");
     if (useZip) {
-      const tmpDir = join11(outputDir, `.${filenameBase}_tmp`);
+      const tmpDir = join13(outputDir, `.${filenameBase}_tmp`);
       await mkdir2(tmpDir, { recursive: true });
-      await writeFile2(join11(tmpDir, `${filenameBase}.yml`), yamlContent);
-      await writeFile2(join11(tmpDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join13(tmpDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join13(tmpDir, `${filenameBase}.md`), mdContent);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join11(tmpDir, "code", fpath);
+          const fullPath = join13(tmpDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79186,13 +79567,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join11(tmpDir, "transcripts");
+        const tDir = join13(tmpDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join11(tDir, te.filename), te.content);
+          await writeFile2(join13(tDir, te.filename), te.content);
         }
       }
-      const zipPath = join11(outputDir, `${filenameBase}.zip`);
+      const zipPath = join13(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
         execSync2(`cd "${tmpDir}" && zip -r "${zipPath}" .`, { stdio: "pipe" });
@@ -79207,17 +79588,17 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         );
       }
     } else {
-      const chatDir = join11(outputDir, filenameBase);
+      const chatDir = join13(outputDir, filenameBase);
       await mkdir2(chatDir, { recursive: true });
       const written = [];
-      await writeFile2(join11(chatDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join13(chatDir, `${filenameBase}.yml`), yamlContent);
       written.push(`${filenameBase}.yml`);
-      await writeFile2(join11(chatDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join13(chatDir, `${filenameBase}.md`), mdContent);
       written.push(`${filenameBase}.md`);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join11(chatDir, "code", fpath);
+          const fullPath = join13(chatDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79226,10 +79607,10 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join11(chatDir, "transcripts");
+        const tDir = join13(chatDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join11(tDir, te.filename), te.content);
+          await writeFile2(join13(tDir, te.filename), te.content);
           written.push(`transcripts/${te.filename}`);
         }
       }
@@ -79265,7 +79646,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       printJson2({
         chat_id: chat.id,
         title: chat.title,
-        output_dir: useZip ? join11(outputDir, `${filenameBase}.zip`) : join11(outputDir, filenameBase),
+        output_dir: useZip ? join13(outputDir, `${filenameBase}.zip`) : join13(outputDir, filenameBase),
         files,
         code_embeds: codeEmbeds.length,
         transcript_embeds: transcriptEmbeds.length
@@ -79585,7 +79966,7 @@ function normalizeApiKeyLoadedChat(payload) {
   const messages = rawMessages.map((message) => {
     const messageId = String(message.client_message_id ?? message.message_id ?? message.id ?? "");
     const directEmbedIds = Array.isArray(message.embedIds) ? message.embedIds : Array.isArray(message.embed_ids) ? message.embed_ids : [];
-    const hashedMessageId = messageId ? createHash14("sha256").update(messageId).digest("hex") : null;
+    const hashedMessageId = messageId ? createHash15("sha256").update(messageId).digest("hex") : null;
     const matchedEmbedIds = hashedMessageId ? rawEmbeds.filter((embed) => embed.hashed_message_id === hashedMessageId && !embed.parent_embed_id).map((embed) => String(embed.embed_id ?? embed.id ?? "")).filter(Boolean) : [];
     return {
       id: messageId,
@@ -79791,7 +80172,7 @@ async function handleWorkflows(client, subcommand, rest, flags, redactor) {
   if (subcommand === "validate") {
     const file = typeof flags.file === "string" ? flags.file : "";
     if (!file) throw new Error("Missing --file. Example: openmates workflows validate --file workflow.yml");
-    const validation = await client.validateWorkflowYaml(readFileSync12(file, "utf8"));
+    const validation = await client.validateWorkflowYaml(readFileSync13(file, "utf8"));
     if (flags.json === true) {
       printJson2(validation);
     } else {
@@ -79807,7 +80188,7 @@ async function handleWorkflows(client, subcommand, rest, flags, redactor) {
   if (subcommand === "create") {
     const yamlFile = typeof flags.file === "string" ? flags.file : "";
     if (yamlFile) {
-      const result = await client.createWorkflowYaml(readFileSync12(yamlFile, "utf8"));
+      const result = await client.createWorkflowYaml(readFileSync13(yamlFile, "utf8"));
       if (flags.json === true) {
         printJson2(result);
       } else {
@@ -79841,7 +80222,7 @@ async function handleWorkflows(client, subcommand, rest, flags, redactor) {
     const workflowId = rest[0] ? await requiredResolvedWorkflowId(client, rest[0], flags, "update") : void 0;
     const yamlFile = typeof flags.file === "string" ? flags.file : "";
     if (!workflowId || !yamlFile) throw new Error("Missing workflow ID or --file. Example: openmates workflows update <id> --file workflow.yml");
-    const result = await client.updateWorkflowYaml(workflowId, readFileSync12(yamlFile, "utf8"));
+    const result = await client.updateWorkflowYaml(workflowId, readFileSync13(yamlFile, "utf8"));
     if (typeof flags.slug === "string") {
       result.workflow = await client.updateWorkflow(result.workflow.id, { slug: flags.slug });
     }
@@ -80291,7 +80672,7 @@ function buildImagesAiDetectionSummary(uploadResult, filePath) {
   const classification = classifyImagesAiDetection(score);
   return {
     file: filePath,
-    filename: uploadResult.filename || basename3(filePath),
+    filename: uploadResult.filename || basename4(filePath),
     content_type: uploadResult.content_type,
     embed_id: uploadResult.embed_id,
     deduplicated: uploadResult.deduplicated,
@@ -80443,7 +80824,7 @@ function buildCodeImageToHtmlRequest(positionals, flags) {
     );
   }
   const request = {
-    image_base64: readFileSync12(file).toString("base64"),
+    image_base64: readFileSync13(file).toString("base64"),
     mime_type: inferImageToHtmlMimeType(file),
     filename: file.split(/[\\/]/).pop() ?? file
   };
@@ -81322,7 +81703,7 @@ async function handleEmbeds(client, subcommand, rest, flags) {
         throw new Error("Embed version content was not available after local reconstruction.");
       }
       if (typeof flags.output === "string") {
-        writeFileSync9(flags.output, result.content, "utf-8");
+        writeFileSync11(flags.output, result.content, "utf-8");
         if (flags.json === true) {
           printJson2({ ...result, output: flags.output });
         } else {
@@ -81606,12 +81987,12 @@ async function parseAccountImportFile(parserFormat, file, flags = {}) {
   const selectedSource = requestedSource;
   if (parserFormat === "generic") {
     if (selectedSource !== "gemini" && selectedSource !== "other") throw new Error("Generic account import requires --source gemini or --source other.");
-    return parseGenericImportBuffer(payload, basename3(file), selectedSource);
+    return parseGenericImportBuffer(payload, basename4(file), selectedSource);
   }
-  if (parserFormat === "claude") return parseClaudeImportBuffer(payload, basename3(file), selectedSource);
-  if (parserFormat === "chatgpt") return parseChatGPTImportBuffer(payload, basename3(file), selectedSource);
-  if (parserFormat === "opencode") return parseOpenCodeImportBuffer(payload, basename3(file), selectedSource);
-  return parseOpenMatesImportBuffer(payload, basename3(file), typeof flags.password === "string" ? flags.password : void 0, selectedSource);
+  if (parserFormat === "claude") return parseClaudeImportBuffer(payload, basename4(file), selectedSource);
+  if (parserFormat === "chatgpt") return parseChatGPTImportBuffer(payload, basename4(file), selectedSource);
+  if (parserFormat === "opencode") return parseOpenCodeImportBuffer(payload, basename4(file), selectedSource);
+  return parseOpenMatesImportBuffer(payload, basename4(file), typeof flags.password === "string" ? flags.password : void 0, selectedSource);
 }
 async function runAccountImport(client, parserFormat, file, flags) {
   if (parserFormat === "generic" && typeof flags.source !== "string") throw new Error("Generic account import requires --source gemini or --source other.");
@@ -81650,7 +82031,7 @@ async function runAccountImport(client, parserFormat, file, flags) {
   if (flags.yes !== true) {
     await confirmOrExit(`Import ${selectedCount} chat(s) into new encrypted OpenMates chats? [y/N] `);
   }
-  const importId = typeof preview.import_id === "string" ? preview.import_id : randomUUID14();
+  const importId = typeof preview.import_id === "string" ? preview.import_id : randomUUID15();
   const selectedChats = parsed.chats.slice(0, selectedCount);
   const selectedFingerprints = selectedChats.map((chat) => chat.source_fingerprint);
   const confirmation = await client.confirmAccountImport(importId, selectedFingerprints);
@@ -81981,11 +82362,11 @@ function parseYamlScalar(value) {
 }
 async function saveDownloadedDocument(document, output) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join11, basename: basename4, dirname: dirname10 } = await import("path");
+  const { join: join13, basename: basename5, dirname: dirname11 } = await import("path");
   const target = typeof output === "string" ? output : ".";
-  const filename = basename4(document.filename || "document.pdf");
-  const filePath = target.endsWith(".pdf") ? target : join11(target, filename);
-  await mkdir2(dirname10(filePath), { recursive: true });
+  const filename = basename5(document.filename || "document.pdf");
+  const filePath = target.endsWith(".pdf") ? target : join13(target, filename);
+  await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, document.data);
   return filePath;
 }
@@ -82144,8 +82525,8 @@ async function handleFinance(client, subcommand, _rest, flags) {
         refresh_token_envelope: connectedAccount.refreshTokenBundle
       }
     ] : [],
-    chatId: `cli-finance-${randomUUID14()}`,
-    messageId: `cli-finance-message-${randomUUID14()}`,
+    chatId: `cli-finance-${randomUUID15()}`,
+    messageId: `cli-finance-message-${randomUUID15()}`,
     apiKey: resolveApiKey(flags) ?? void 0,
     promptInjectionProtection: false
   });
@@ -82157,7 +82538,7 @@ async function handleFinance(client, subcommand, _rest, flags) {
 }
 function readFinanceCsvStatements(flags) {
   const paths = parseCsvFlag(flags.csv) ?? [];
-  return paths.map((filePath) => ({ filename: basename3(filePath), content: readFileSync12(filePath, "utf8") }));
+  return paths.map((filePath) => ({ filename: basename4(filePath), content: readFileSync13(filePath, "utf8") }));
 }
 function buildFinanceCheckAccountsInput(flags, csvStatements, connectedAccount) {
   const input = {
@@ -82386,7 +82767,7 @@ async function handleRevolutBusinessConnect(client, rest, flags) {
   if (!clientId.trim()) throw new Error("ClientID is required to connect Revolut Business.");
   const code = providedCode || await promptPlainText("Code from OpenMates callback page: ");
   if (!code.trim()) throw new Error("Authorization code is required to connect Revolut Business.");
-  const privateKeyPem = readFileSync12(result.privateKeyPath, "utf8");
+  const privateKeyPem = readFileSync13(result.privateKeyPath, "utf8");
   const setup = await client.exchangeRevolutBusinessSetupCode({
     clientId: clientId.trim(),
     code: code.trim(),
@@ -82452,7 +82833,7 @@ async function promptPlainText(question) {
 }
 async function writeSecretFile(filePath, content, force = false) {
   const { mkdir: mkdir2, writeFile: writeFile2, stat: stat2 } = await import("fs/promises");
-  const { dirname: dirname10 } = await import("path");
+  const { dirname: dirname11 } = await import("path");
   try {
     await stat2(filePath);
     if (!force) throw new Error(`${filePath} already exists. Use --force to overwrite.`);
@@ -82462,7 +82843,7 @@ async function writeSecretFile(filePath, content, force = false) {
     }
     if (error instanceof Error && !("code" in error)) throw error;
   }
-  await mkdir2(dirname10(filePath), { recursive: true });
+  await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, content, { mode: 384 });
   return filePath;
 }
@@ -85607,6 +85988,7 @@ Commands:
 
 Flags:
   --json          Output raw JSON instead of formatted output
+  --profile <name>        Use an isolated login profile (also OPENMATES_PROFILE)
   --api-url <url> Override API base URL (default: installed self-host server, then https://api.openmates.org)
   --api-key <key> Optional API key override (or set OPENMATES_API_KEY)
   --version       Show CLI version and update availability
@@ -85628,12 +86010,16 @@ function printSelfUpdateHelp() {
   openmates update [--version <version|tag>] [--package-manager <name>] [--dry-run] [--verbose] [--json]
   openmates upgrade [--version <version|tag>] [--package-manager <name>] [--dry-run] [--verbose] [--json]
 
-Updates the globally installed openmates package. The default target is latest.
+Updates the globally installed openmates package using the saved release channel.
+Stable installations default to stable; prereleases default to dev.
+Channel changes persist only after a successful update or up-to-date check.
 
 Options:
-  --version <version|tag>       Install a specific npm version or dist-tag (default: latest)
+  --version <version|tag>       Install a specific npm version or dist-tag (one-time override)
   --package-manager <name>      npm, pnpm, yarn, or bun (default: detect, then npm)
   --dry-run                     Print the package-manager command without running it
+  --channel <dev|stable|main>    Save release channel (dev uses npm alpha; stable/main uses latest)
+  --allow-downgrade             Explicitly allow installing an older version
   --verbose                     Stream package-manager output during installation
   --json                        Output the update plan/result as JSON`);
 }
@@ -85969,8 +86355,10 @@ function printTasksHelp() {
   openmates tasks reorder <task-id|short-id> [--before <task-id>] [--after <task-id>] [--position <n>] [--status <status>] [--json]
   openmates tasks dependencies list <task-id|short-id> [--json]
   openmates tasks dependencies add|remove <task-id|short-id> --target plan:<id>|task:<id> [--recovery-root <external-root>] [--json]
-  openmates tasks activity list <task-id|short-id> [--limit <n>] [--json]
-  openmates tasks activity add <task-id|short-id> --message <text> [--as-assignee] [--json]
+  openmates tasks activity list <task-id|short-id> [--max-entries <1-200>] [--cursor <cursor>] [--newest-first] [--json]
+  openmates tasks activity search <task-id|short-id> --query <text> [--max-entries <1-200>] [--json]
+  openmates tasks activity add <task-id|short-id> --message <text> [--as-assignee] [--delivery-id <sha256>] [--json]
+  openmates tasks activity flush <task-id|short-id> [--as-assignee] [--json]
   openmates tasks activity delete <task-id|short-id> <entry-id> [--json]
 
 Chat-scoped aliases:
@@ -86440,7 +86828,7 @@ async function handleDocs(client, subcommand, rest, flags) {
   }
   if (subcommand === "download") {
     const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-    const { join: join11, dirname: dirname10 } = await import("path");
+    const { join: join13, dirname: dirname11 } = await import("path");
     if (flags.all === true) {
       const outputDir = typeof flags.output === "string" ? flags.output : "./openmates-docs";
       const tree = await client.listDocs();
@@ -86449,8 +86837,8 @@ async function handleDocs(client, subcommand, rest, flags) {
       let count = 0;
       for (const slug2 of slugs) {
         const content2 = await client.getDoc(slug2);
-        const filePath = join11(outputDir, `${slug2}.md`);
-        await mkdir2(dirname10(filePath), { recursive: true });
+        const filePath = join13(outputDir, `${slug2}.md`);
+        await mkdir2(dirname11(filePath), { recursive: true });
         await writeFile2(filePath, content2, "utf-8");
         count++;
         process.stderr.write(`\r  Downloaded ${count}/${slugs.length}`);
@@ -86522,8 +86910,8 @@ function isCliEntrypoint() {
   if (!entrypoint) return false;
   try {
     const invokedPath = realpathSync2(entrypoint);
-    const modulePath = realpathSync2(fileURLToPath2(import.meta.url));
-    return invokedPath === modulePath || basename3(invokedPath) === "cli.js" && dirname9(invokedPath) === dirname9(modulePath);
+    const modulePath = realpathSync2(fileURLToPath3(import.meta.url));
+    return invokedPath === modulePath || basename4(invokedPath) === "cli.js" && dirname10(invokedPath) === dirname10(modulePath);
   } catch {
     return false;
   }