openmates 0.18.0-alpha.7 → 0.18.0-alpha.9

package/dist/{chunk-2H5LTEHD.js → chunk-34UCC43K.js}

@@ -8437,7 +8437,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!userId) {
       throw new Error("Could not resolve current user id for local connected-account connector.");
     }
-    const { createHash: createHash15 } = await import("crypto");
+    const { createHash: createHash16 } = await import("crypto");
     const accountId = randomUUID6();
     const masterKey = this.getMasterKeyBytes();
     const encryptLocalConnectorValue = async (value) => {
@@ -8446,9 +8446,9 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     const payload = {
       id: accountId,
-      hashed_user_id: createHash15("sha256").update(userId).digest("hex"),
+      hashed_user_id: createHash16("sha256").update(userId).digest("hex"),
       encrypted_provider_type: await encryptLocalConnectorValue(input.provider_id),
-      provider_type_hash: createHash15("sha256").update(input.provider_id).digest("hex"),
+      provider_type_hash: createHash16("sha256").update(input.provider_id).digest("hex"),
       encrypted_account_label: await encryptLocalConnectorValue(input.label),
       encrypted_capabilities: await encryptLocalConnectorValue(input.capabilities),
       encrypted_app_permissions: await encryptLocalConnectorValue({
@@ -9947,8 +9947,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const { createHash: createHash15 } = await import("crypto");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const { createHash: createHash16 } = await import("crypto");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -10056,7 +10056,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async resolveEmbedKey(cache, masterKey, embed, embedId, hashedEmbedId, visited = /* @__PURE__ */ new Set()) {
     if (visited.has(embedId)) return null;
     visited.add(embedId);
-    const { createHash: createHash15 } = await import("crypto");
+    const { createHash: createHash16 } = await import("crypto");
     const masterKeyEntry = cache.embedKeys.find(
       (ek) => ek.hashed_embed_id === hashedEmbedId && String(ek.key_type) === "master"
     );
@@ -10073,7 +10073,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (chatKeyEntry && typeof chatKeyEntry.encrypted_embed_key === "string") {
       const hashedChatId = String(chatKeyEntry.hashed_chat_id ?? "");
       const owningChat = cache.chats.find((c) => {
-        const chatHash = createHash15("sha256").update(String(c.details.id ?? "")).digest("hex");
+        const chatHash = createHash16("sha256").update(String(c.details.id ?? "")).digest("hex");
         return chatHash === hashedChatId;
       });
       if (owningChat) {
@@ -10102,7 +10102,7 @@ var OpenMatesClient = class _OpenMatesClient {
         const parentFullId = String(
           parentEmbed2.embed_id ?? parentEmbed2.id ?? ""
         );
-        const parentHashedId = createHash15("sha256").update(parentFullId).digest("hex");
+        const parentHashedId = createHash16("sha256").update(parentFullId).digest("hex");
         const parentKey = await this.resolveEmbedKey(
           cache,
           masterKey,
@@ -12841,6 +12841,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (Number.isSafeInteger(context.limit) && context.limit !== void 0 && context.limit > 0) {
       params.set("limit", String(context.limit));
     }
+    if (context.newestFirst) params.set("newest_first", "true");
     const query = params.toString();
     const response = await this.http.get(
       `/v1/user-tasks/${encodeURIComponent(taskId)}/activity${query ? `?${query}` : ""}`,
@@ -14136,7 +14137,7 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const masterKey = base64ToBytes(session.masterKeyExportedB64);
     const cache = await this.ensureSynced();
-    const { createHash: createHash15 } = await import("crypto");
+    const { createHash: createHash16 } = await import("crypto");
     const embed = cache.embeds.find(
       (e) => String(e.embed_id ?? "").startsWith(embedIdOrShort) || String(e.id ?? "").startsWith(embedIdOrShort)
     );
@@ -14144,7 +14145,7 @@ Required: ${schema.required.join(", ")}`
       throw new Error(`Embed '${embedIdOrShort}' not found in local cache.`);
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -14252,8 +14253,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash15 } = await import("crypto");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const { createHash: createHash16 } = await import("crypto");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -14369,8 +14370,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash15 } = await import("crypto");
-    const hashedEmbedId = createHash15("sha256").update(embedId).digest("hex");
+    const { createHash: createHash16 } = await import("crypto");
+    const hashedEmbedId = createHash16("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -14837,9 +14838,9 @@ Required: ${schema.required.join(", ")}`
     chats.splice(0, chats.length, ...reconciledChats);
     if (totalChatCount === 0) totalChatCount = chats.length;
     if (reconciliation.deleted_chat_ids?.length) {
-      const { createHash: createHash15 } = await import("crypto");
+      const { createHash: createHash16 } = await import("crypto");
       const deletedHashes = new Set(
-        reconciliation.deleted_chat_ids.map((id) => createHash15("sha256").update(id).digest("hex"))
+        reconciliation.deleted_chat_ids.map((id) => createHash16("sha256").update(id).digest("hex"))
       );
       const keptEmbeds = embeds.filter((embed) => !deletedHashes.has(String(embed.hashed_chat_id ?? "")));
       const keptKeys = embedKeys.filter((key) => !deletedHashes.has(String(key.hashed_chat_id ?? "")));
@@ -20224,12 +20225,12 @@ var ACCOUNT_EXPORT_FORBIDDEN_VALUE_PATTERNS = [
 ];
 async function writeAccountExportArchive(bundle, flags = {}) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join12, dirname: dirname11 } = await import("path");
+  const { join: join13, dirname: dirname11 } = await import("path");
   const exportId = safeArchiveSegment(String(bundle.export.export_id ?? `export-${Date.now()}`));
   const archiveFormat = flags.format === "directory" ? "directory" : "zip";
   const password = typeof flags.password === "string" && flags.password.length > 0 ? flags.password : null;
   if (password && archiveFormat !== "zip") throw new Error("Password-protected account export is only supported for zip format.");
-  const outputPath = typeof flags.output === "string" ? flags.output : join12(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
+  const outputPath = typeof flags.output === "string" ? flags.output : join13(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
   const zip = archiveFormat === "zip" ? new JSZip3() : null;
   const writtenFiles = [];
   async function writeArchiveText(relativePath, content) {
@@ -20240,7 +20241,7 @@ async function writeAccountExportArchive(bundle, flags = {}) {
       return;
     }
     const stagingDir = outputPath;
-    const fullPath = join12(stagingDir, relativePath);
+    const fullPath = join13(stagingDir, relativePath);
     await mkdir2(dirname11(fullPath), { recursive: true });
     await writeFile2(fullPath, content, "utf-8");
     writtenFiles.push(relativePath);
@@ -24391,10 +24392,115 @@ var OpenMatesBenchmark = class {
 // src/cli.ts
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as stdin3, stdout as stdout2 } from "process";
-import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync10 } from "fs";
+
+// src/taskActivityHistory.ts
+async function readActivityHistory(options) {
+  const { query } = options;
+  const maxEntries = options.maxEntries ?? Infinity;
+  if (options.maxEntries !== void 0 && (!Number.isSafeInteger(maxEntries) || maxEntries < 1 || maxEntries > 200)) {
+    throw new Error("--max-entries must be an integer from 1 to 200");
+  }
+  if (query !== void 0 && !query.trim()) throw new Error("Activity search requires a non-empty --query");
+  const pageSize = options.pageSize ?? 100;
+  if (!Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 200) throw new Error("--limit must be from 1 to 200");
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  let cursor = options.cursor;
+  let matched = 0;
+  do {
+    const page = await options.page(cursor, query === void 0 ? Math.min(pageSize, maxEntries - entries.length) : pageSize);
+    for (const entry of page.entries) {
+      if (query === void 0 || (entry.message || "").toLocaleLowerCase().includes(query.toLocaleLowerCase())) {
+        matched++;
+        if (entries.length < maxEntries) entries.push(entry);
+      }
+    }
+    cursor = page.next_cursor || void 0;
+    if (cursor && seen.has(cursor)) throw new Error("Activity pagination repeated a cursor");
+    if (cursor) seen.add(cursor);
+  } while (cursor && (query !== void 0 || entries.length < maxEntries));
+  return { entries, next_cursor: cursor || null, truncated: Boolean(cursor) || matched > entries.length, matched };
+}
+
+// src/taskActivityDelivery.ts
+import { createHash as createHash12 } from "crypto";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync4, rmSync as rmSync3, existsSync as existsSync7 } from "fs";
+import { join as join4 } from "path";
+import lockfile2 from "proper-lockfile";
+function activityDeliveryStore(scope, stateDir2 = resolveStateDir()) {
+  const directory = join4(stateDir2, "task-activity-delivery", createHash12("sha256").update(scope).digest("hex"));
+  mkdirSync4(directory, { recursive: true, mode: 448 });
+  const pendingDirectory = join4(directory, "pending");
+  const acknowledgedDirectory = join4(directory, "acknowledged");
+  mkdirSync4(pendingDirectory, { recursive: true, mode: 448 });
+  mkdirSync4(acknowledgedDirectory, { recursive: true, mode: 448 });
+  const save = (path2, record) => {
+    const temporary = `${path2}.${process.pid}.tmp`;
+    writeFileSync4(temporary, JSON.stringify(record), { mode: 384 });
+    renameSync2(temporary, path2);
+  };
+  const send = async (path2, record, create) => {
+    if (!record.acknowledged) {
+      const acknowledged = await create(record.input);
+      if (acknowledged.entry_id !== record.input.entry_id) throw new Error("Activity acknowledgement identity mismatch");
+      record.acknowledged = acknowledged;
+      save(join4(acknowledgedDirectory, `${record.input.entry_id}.json`), record);
+      rmSync3(path2, { force: true });
+    }
+    return record.acknowledged;
+  };
+  return {
+    async deliver(id, build, create) {
+      if (!/^[a-f0-9]{64}$/.test(id)) throw new Error("--delivery-id must be a SHA-256 hex identifier");
+      const release2 = await lockfile2.lock(directory, { retries: { retries: 3, minTimeout: 100, maxTimeout: 500 }, stale: 12e4 });
+      try {
+        const acknowledgedPath = join4(acknowledgedDirectory, `${id}.json`);
+        const path2 = existsSync7(acknowledgedPath) ? acknowledgedPath : join4(pendingDirectory, `${id}.json`);
+        let record;
+        try {
+          record = JSON.parse(readFileSync6(path2, "utf8"));
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          record = { input: await build() };
+          save(path2, record);
+        }
+        return await send(path2, record, create);
+      } finally {
+        await release2();
+      }
+    },
+    async flush(create) {
+      const release2 = await lockfile2.lock(directory, { retries: 0, stale: 12e4 });
+      try {
+        const names = readdirSync2(pendingDirectory).filter((name) => /^[a-f0-9]{64}\.json$/.test(name));
+        let pending = names.length;
+        let attempted = 0;
+        for (const name of names) {
+          const path2 = join4(pendingDirectory, name);
+          const record = JSON.parse(readFileSync6(path2, "utf8"));
+          if (record.acknowledged) continue;
+          if (attempted >= 3) break;
+          attempted++;
+          try {
+            await send(path2, record, create);
+            pending--;
+          } catch {
+            break;
+          }
+        }
+        return { pending, attempted };
+      } finally {
+        await release2();
+      }
+    }
+  };
+}
+
+// src/cli.ts
+import { existsSync as existsSync14, readFileSync as readFileSync13, realpathSync as realpathSync2, writeFileSync as writeFileSync11 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { basename as basename4, dirname as dirname10 } from "path";
-import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
+import { createHash as createHash15, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
 import { arch as arch2, platform as platform3 } from "os";
 import { parse as parseYaml } from "yaml";
 import WebSocket2 from "ws";
@@ -26573,12 +26679,12 @@ function formatTs(ts) {
 
 // src/server.ts
 import { execFileSync as execFileSync4, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes8, randomUUID as randomUUID11 } from "crypto";
-import { appendFileSync, chmodSync as chmodSync5, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, openSync as openSync2, readFileSync as readFileSync7, readSync, readdirSync as readdirSync4, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
+import { createHash as createHash13, randomBytes as randomBytes8, randomUUID as randomUUID11 } from "crypto";
+import { appendFileSync, chmodSync as chmodSync5, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, openSync as openSync2, readFileSync as readFileSync8, readSync, readdirSync as readdirSync5, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
 import { createInterface as createInterface3 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname6, join as join7, resolve as resolve6 } from "path";
+import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/branding.ts
 var OPENMATES_WORDMARK = "OPENMATES";
@@ -26614,33 +26720,33 @@ function renderSupportStartReminder() {
 import { execFileSync as execFileSync2 } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync2,
-  rmSync as rmSync3,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync3,
+  rmSync as rmSync4,
   symlinkSync
 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname3, join as join4, resolve as resolve4 } from "path";
-var UI_PACKAGE_RELATIVE_PATH = join4("frontend", "packages", "ui");
-var GENERATED_LOCALES_RELATIVE_PATH = join4(UI_PACKAGE_RELATIVE_PATH, "src", "i18n", "locales");
-var BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH = join4(UI_PACKAGE_RELATIVE_PATH, "scripts", "build-translations.js");
+import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
+var UI_PACKAGE_RELATIVE_PATH = join5("frontend", "packages", "ui");
+var GENERATED_LOCALES_RELATIVE_PATH = join5(UI_PACKAGE_RELATIVE_PATH, "src", "i18n", "locales");
+var BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH = join5(UI_PACKAGE_RELATIVE_PATH, "scripts", "build-translations.js");
 var REQUIRED_LOCALE_JSON = "en.json";
 function sourceInstallLocalesPath(rootPath) {
-  return join4(rootPath, GENERATED_LOCALES_RELATIVE_PATH);
+  return join5(rootPath, GENERATED_LOCALES_RELATIVE_PATH);
 }
 function ensureSourceInstallTranslations(installPath, sourcePath) {
   const localeDir = sourceInstallLocalesPath(installPath);
-  const requiredLocalePath = join4(localeDir, REQUIRED_LOCALE_JSON);
-  if (existsSync7(requiredLocalePath)) {
+  const requiredLocalePath = join5(localeDir, REQUIRED_LOCALE_JSON);
+  if (existsSync8(requiredLocalePath)) {
     return { status: "already_present", localeDir, copiedFiles: 0 };
   }
   const copiedFiles = copyGeneratedLocaleJson(sourcePath, installPath);
-  if (existsSync7(requiredLocalePath)) {
+  if (existsSync8(requiredLocalePath)) {
     return { status: "copied", localeDir, copiedFiles };
   }
   runBuildTranslationsScript(installPath);
-  if (!existsSync7(requiredLocalePath)) {
+  if (!existsSync8(requiredLocalePath)) {
     throw new Error(`Generated locale JSON was not created at ${requiredLocalePath}.`);
   }
   return { status: "built", localeDir, copiedFiles };
@@ -26651,31 +26757,31 @@ function copyGeneratedLocaleJson(sourcePath, installPath) {
   const targetRoot = resolve4(installPath);
   if (sourceRoot === targetRoot) return 0;
   const sourceLocaleDir = sourceInstallLocalesPath(sourceRoot);
-  if (!existsSync7(join4(sourceLocaleDir, REQUIRED_LOCALE_JSON))) return 0;
+  if (!existsSync8(join5(sourceLocaleDir, REQUIRED_LOCALE_JSON))) return 0;
   const targetLocaleDir = sourceInstallLocalesPath(targetRoot);
-  mkdirSync4(targetLocaleDir, { recursive: true });
+  mkdirSync5(targetLocaleDir, { recursive: true });
   let copiedFiles = 0;
-  for (const entry of readdirSync2(sourceLocaleDir, { withFileTypes: true })) {
+  for (const entry of readdirSync3(sourceLocaleDir, { withFileTypes: true })) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    copyFileSync(join4(sourceLocaleDir, entry.name), join4(targetLocaleDir, entry.name));
+    copyFileSync(join5(sourceLocaleDir, entry.name), join5(targetLocaleDir, entry.name));
     copiedFiles += 1;
   }
   return copiedFiles;
 }
 function runBuildTranslationsScript(installPath) {
-  const uiPackageDir = join4(installPath, UI_PACKAGE_RELATIVE_PATH);
-  const buildScript = join4(installPath, BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH);
-  if (!existsSync7(buildScript)) {
+  const uiPackageDir = join5(installPath, UI_PACKAGE_RELATIVE_PATH);
+  const buildScript = join5(installPath, BUILD_TRANSLATIONS_SCRIPT_RELATIVE_PATH);
+  if (!existsSync8(buildScript)) {
     throw new Error(`Translation build script not found at ${buildScript}.`);
   }
   const requireFromCli = createRequire3(import.meta.url);
   const yamlPackageDir = dirname3(requireFromCli.resolve("yaml/package.json"));
-  const nodeModulesDir = join4(uiPackageDir, "node_modules");
-  const yamlLink = join4(nodeModulesDir, "yaml");
-  const hadNodeModulesDir = existsSync7(nodeModulesDir);
-  const hadYamlPackage = existsSync7(yamlLink);
+  const nodeModulesDir = join5(uiPackageDir, "node_modules");
+  const yamlLink = join5(nodeModulesDir, "yaml");
+  const hadNodeModulesDir = existsSync8(nodeModulesDir);
+  const hadYamlPackage = existsSync8(yamlLink);
   if (!hadYamlPackage) {
-    mkdirSync4(nodeModulesDir, { recursive: true });
+    mkdirSync5(nodeModulesDir, { recursive: true });
     symlinkSync(yamlPackageDir, yamlLink, process.platform === "win32" ? "junction" : "dir");
   }
   try {
@@ -26684,15 +26790,15 @@ function runBuildTranslationsScript(installPath) {
       stdio: "inherit"
     });
   } finally {
-    if (!hadYamlPackage) rmSync3(yamlLink, { recursive: true, force: true });
-    if (!hadNodeModulesDir && existsSync7(nodeModulesDir) && readdirSync2(nodeModulesDir).length === 0) {
-      rmSync3(nodeModulesDir, { recursive: true, force: true });
+    if (!hadYamlPackage) rmSync4(yamlLink, { recursive: true, force: true });
+    if (!hadNodeModulesDir && existsSync8(nodeModulesDir) && readdirSync3(nodeModulesDir).length === 0) {
+      rmSync4(nodeModulesDir, { recursive: true, force: true });
     }
   }
 }
 
 // src/serverPlanning.ts
-import { dirname as dirname4, join as join5, resolve as resolve5 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolve5 } from "path";
 var CORE_WORKER_SERVICES = [
   "task-worker",
   "user-init-worker",
@@ -26902,10 +27008,10 @@ function parseServerRole(value) {
   throw new Error(`Unsupported server role '${value}'. Use core, upload, or preview.`);
 }
 function defaultOpenMatesCloudOverlayPath(openMatesPath) {
-  return resolve5(join5(dirname4(resolve5(openMatesPath)), OPENMATESCLOUD_OVERLAY_DIR));
+  return resolve5(join6(dirname4(resolve5(openMatesPath)), OPENMATESCLOUD_OVERLAY_DIR));
 }
 function defaultOpenMatesCloudComposeFile(overlayPath) {
-  return resolve5(join5(overlayPath, OPENMATESCLOUD_COMPOSE_FILE));
+  return resolve5(join6(overlayPath, OPENMATESCLOUD_COMPOSE_FILE));
 }
 function planOpenMatesCloudOverlay(input) {
   const deploymentMode = input.deploymentMode ?? "self_host";
@@ -27287,12 +27393,12 @@ function shouldAutoInstallRuntimeMonitoringServices(env) {
 
 // src/serverBackupArchive.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync3, renameSync as renameSync2, rmSync as rmSync4 } from "fs";
+import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync4, renameSync as renameSync3, rmSync as rmSync5 } from "fs";
 import { randomUUID as randomUUID8 } from "crypto";
 function assertRegularBackupTree(path2) {
   const stat2 = lstatSync(path2);
   if (stat2.isDirectory()) {
-    for (const entry of readdirSync3(path2)) assertRegularBackupTree(`${path2}/${entry}`);
+    for (const entry of readdirSync4(path2)) assertRegularBackupTree(`${path2}/${entry}`);
     return;
   }
   if (!stat2.isFile() || stat2.nlink !== 1) {
@@ -27306,11 +27412,11 @@ function publishServerBackupArchive(sourceDir, archivePath, options = {}) {
   try {
     execFileSync3(options.tarCommand ?? "tar", ["-czf", temporaryArchivePath, "-C", sourceDir, "."], { stdio: "pipe" });
     chmodSync3(temporaryArchivePath, 384);
-    renameSync2(temporaryArchivePath, archivePath);
+    renameSync3(temporaryArchivePath, archivePath);
     chmodSync3(archivePath, 384);
   } finally {
     process.umask(previousUmask);
-    rmSync4(temporaryArchivePath, { force: true });
+    rmSync5(temporaryArchivePath, { force: true });
   }
 }
 
@@ -27908,16 +28014,16 @@ function signRuntimeWebhookPayload(payload, secret, timestamp, eventId) {
 
 // src/serverUpdateState.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { chmodSync as chmodSync4, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, join as join6 } from "path";
+import { chmodSync as chmodSync4, closeSync, existsSync as existsSync9, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join7 } from "path";
 function serverUpdateStatusFile(installPath, role) {
-  return join6(installPath, ".openmates", `${role}-update-status.json`);
+  return join7(installPath, ".openmates", `${role}-update-status.json`);
 }
 function readServerUpdateStatus(installPath, role) {
   const filePath = serverUpdateStatusFile(installPath, role);
-  if (!existsSync8(filePath)) return {};
+  if (!existsSync9(filePath)) return {};
   try {
-    const parsed = JSON.parse(readFileSync6(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(filePath, "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { statusReadError: "invalid_update_status" };
     }
@@ -27928,23 +28034,23 @@ function readServerUpdateStatus(installPath, role) {
 }
 function writeServerUpdateStatus(installPath, role, status) {
   const filePath = serverUpdateStatusFile(installPath, role);
-  mkdirSync5(dirname5(filePath), { recursive: true, mode: 448 });
+  mkdirSync6(dirname5(filePath), { recursive: true, mode: 448 });
   const temporaryPath = `${filePath}.${process.pid}.${randomBytes7(4).toString("hex")}.tmp`;
-  writeFileSync4(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
+  writeFileSync5(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
 `, { mode: 384 });
-  renameSync3(temporaryPath, filePath);
+  renameSync4(temporaryPath, filePath);
   chmodSync4(filePath, 384);
 }
 function acquireServerUpdateLock(installPath) {
-  const stateDir2 = join6(installPath, ".openmates");
-  const lockPath = join6(stateDir2, "server-update.lock");
-  mkdirSync5(stateDir2, { recursive: true, mode: 448 });
+  const stateDir2 = join7(installPath, ".openmates");
+  const lockPath = join7(stateDir2, "server-update.lock");
+  mkdirSync6(stateDir2, { recursive: true, mode: 448 });
   let descriptor;
   try {
     descriptor = openSync(lockPath, "wx", 384);
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
-    const lockOwner = readFileSync6(lockPath, "utf8").trim();
+    const lockOwner = readFileSync7(lockPath, "utf8").trim();
     const lockPid = Number.parseInt(lockOwner.split(":", 1)[0] ?? "", 10);
     let stale = false;
     try {
@@ -27956,11 +28062,11 @@ function acquireServerUpdateLock(installPath) {
     throw new Error(stale ? "A stale OpenMates server update lock exists for this installation; verify no update is running, then remove .openmates/server-update.lock explicitly." : "Another OpenMates server update is already running for this installation.");
   }
   const ownershipToken = `${process.pid}:${randomBytes7(16).toString("hex")}`;
-  writeFileSync4(descriptor, ownershipToken);
+  writeFileSync5(descriptor, ownershipToken);
   return () => {
     closeSync(descriptor);
-    if (existsSync8(lockPath) && readFileSync6(lockPath, "utf8").trim() === ownershipToken) {
-      rmSync5(lockPath);
+    if (existsSync9(lockPath) && readFileSync7(lockPath, "utf8").trim() === ownershipToken) {
+      rmSync6(lockPath);
     }
   };
 }
@@ -28132,22 +28238,22 @@ function containsBoundedWebResult(value) {
 }
 
 // src/server.ts
-var SOURCE_COMPOSE_FILE = join7("backend", "core", "docker-compose.yml");
+var SOURCE_COMPOSE_FILE = join8("backend", "core", "docker-compose.yml");
 var ROLE_IMAGE_COMPOSE_FILES = {
-  core: join7("backend", "core", "docker-compose.selfhost.yml"),
-  upload: join7("backend", "upload", "docker-compose.yml"),
-  preview: join7("backend", "preview", "docker-compose.preview.yml")
+  core: join8("backend", "core", "docker-compose.selfhost.yml"),
+  upload: join8("backend", "upload", "docker-compose.yml"),
+  preview: join8("backend", "preview", "docker-compose.preview.yml")
 };
 var ROLE_TEMPLATE_FILES = {
-  core: join7("core", "docker-compose.selfhost.yml"),
-  upload: join7("upload", "docker-compose.yml"),
-  preview: join7("preview", "docker-compose.preview.yml")
+  core: join8("core", "docker-compose.selfhost.yml"),
+  upload: join8("upload", "docker-compose.yml"),
+  preview: join8("preview", "docker-compose.preview.yml")
 };
-var CORE_NO_WEBAPP_TEMPLATE_FILE = join7("core", "docker-compose.no-webapp.yml");
-var CORE_PROMTAIL_CONFIG_FILE = join7("backend", "core", "monitoring", "promtail", "promtail-config.yaml");
-var CORE_ALERTMANAGER_CONFIG_FILE = join7("backend", "core", "monitoring", "alertmanager", "alertmanager.yml");
-var COMPOSE_OVERRIDE2 = join7("backend", "core", "docker-compose.override.yml");
-var DEFAULT_INSTALL_PATH = join7(homedir6(), "openmates");
+var CORE_NO_WEBAPP_TEMPLATE_FILE = join8("core", "docker-compose.no-webapp.yml");
+var CORE_PROMTAIL_CONFIG_FILE = join8("backend", "core", "monitoring", "promtail", "promtail-config.yaml");
+var CORE_ALERTMANAGER_CONFIG_FILE = join8("backend", "core", "monitoring", "alertmanager", "alertmanager.yml");
+var COMPOSE_OVERRIDE2 = join8("backend", "core", "docker-compose.override.yml");
+var DEFAULT_INSTALL_PATH = join8(homedir6(), "openmates");
 var REPO_URL = "https://github.com/glowingkitty/OpenMates.git";
 var ROLE_PROVENANCE_SERVICE = {
   core: "api",
@@ -28237,8 +28343,8 @@ scrape_configs:
       - labels:
           level: log_level
 `;
-var BACKEND_CONFIG_FILE = join7("backend", "config", "backend_config.yml");
-var IMAGE_RUNTIME_CONFIG_FILE = join7("config", "backend_config.yml");
+var BACKEND_CONFIG_FILE = join8("backend", "config", "backend_config.yml");
+var IMAGE_RUNTIME_CONFIG_FILE = join8("config", "backend_config.yml");
 var LOCAL_AI_MODELS_FILE = "local-ai-models.yml";
 var OFF_BY_DEFAULT_FEATURES = /* @__PURE__ */ new Map([
   ["embed:code:application", "Application previews are still unstable"],
@@ -28374,9 +28480,9 @@ function runInteractive(cmd, args, cwd) {
   });
 }
 function beginEngineeringRuntimeOperation(installPath, operationType, services) {
-  const manager = join7(installPath, "scripts", "engineering_control_plane.py");
-  const sharedConfig = join7(homedir6(), ".config", "openmates", "engineering-control-plane.env");
-  if (!existsSync9(manager) || !existsSync9(sharedConfig)) return null;
+  const manager = join8(installPath, "scripts", "engineering_control_plane.py");
+  const sharedConfig = join8(homedir6(), ".config", "openmates", "engineering-control-plane.env");
+  if (!existsSync10(manager) || !existsSync10(sharedConfig)) return null;
   const requestedBy = process.env.OPENCODE_SESSION_ID || `openmates-cli:${process.pid}`;
   const args = [
     manager,
@@ -28400,7 +28506,7 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
   return parsed.operation_key;
 }
 function finishEngineeringRuntimeOperation(installPath, operationKey, status) {
-  const manager = join7(installPath, "scripts", "engineering_control_plane.py");
+  const manager = join8(installPath, "scripts", "engineering_control_plane.py");
   execFileSync4(
     "python3",
     [manager, "operation", "update", "--operation-key", operationKey, "--status", status],
@@ -28429,8 +28535,8 @@ function loadConfigForInstallPath(installPath) {
 }
 function getInstallMode(installPath, config = loadConfigForInstallPath(installPath)) {
   if (config?.installMode) return config.installMode;
-  if (existsSync9(join7(installPath, SOURCE_COMPOSE_FILE))) return "source";
-  if (Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync9(join7(installPath, composeFile)))) return "image";
+  if (existsSync10(join8(installPath, SOURCE_COMPOSE_FILE))) return "source";
+  if (Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync10(join8(installPath, composeFile)))) return "image";
   return "source";
 }
 function getServerRole(flags, config) {
@@ -28561,26 +28667,26 @@ function composeArgs(installPath, withOverrides, installMode = getInstallMode(in
     withOverrides,
     installMode,
     role,
-    overrideExists: existsSync9(join7(installPath, COMPOSE_OVERRIDE2)),
+    overrideExists: existsSync10(join8(installPath, COMPOSE_OVERRIDE2)),
     deploymentMode,
     overlayPath,
     overlayComposeFile,
-    overlayExists: deploymentMode === "official_cloud" && existsSync9(resolvedOverlayPath) && existsSync9(overlayComposeFile)
+    overlayExists: deploymentMode === "official_cloud" && existsSync10(resolvedOverlayPath) && existsSync10(overlayComposeFile)
   });
 }
 function ensureGitWorkDirEnv(installPath) {
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(envPath)) return;
-  const content = readFileSync7(envPath, "utf-8");
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(envPath)) return;
+  const content = readFileSync8(envPath, "utf-8");
   const lineRegex = /^GIT_WORK_DIR=.*$/m;
   const value = `GIT_WORK_DIR=${installPath}`;
   if (lineRegex.test(content)) {
     const next = content.replace(lineRegex, value);
-    if (next !== content) writeFileSync5(envPath, next);
+    if (next !== content) writeFileSync6(envPath, next);
     return;
   }
   const separator2 = content.endsWith("\n") ? "" : "\n";
-  writeFileSync5(envPath, `${content}${separator2}${value}
+  writeFileSync6(envPath, `${content}${separator2}${value}
 `);
 }
 function requireDocker() {
@@ -28601,7 +28707,7 @@ function requireGit() {
 }
 function getPackageVersion() {
   try {
-    const packageJson = JSON.parse(readFileSync7(new URL("../package.json", import.meta.url), "utf-8"));
+    const packageJson = JSON.parse(readFileSync8(new URL("../package.json", import.meta.url), "utf-8"));
     return packageJson.version ?? "";
   } catch {
     return "";
@@ -28694,20 +28800,20 @@ async function fetchText(url) {
   return response.text();
 }
 function packagedTemplatePath(role) {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", ROLE_TEMPLATE_FILES[role]);
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", ROLE_TEMPLATE_FILES[role]);
 }
 function packagedNoWebappTemplatePath() {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", CORE_NO_WEBAPP_TEMPLATE_FILE);
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", CORE_NO_WEBAPP_TEMPLATE_FILE);
 }
 function packagedCaddyTemplatePath(role) {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", "caddy", role, "Caddyfile");
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", "caddy", role, "Caddyfile");
 }
 function packagedCoreAlertmanagerTemplatePath() {
-  return join7(dirname6(new URL(import.meta.url).pathname), "..", "templates", "core", "monitoring", "alertmanager", "alertmanager.yml");
+  return join8(dirname6(new URL(import.meta.url).pathname), "..", "templates", "core", "monitoring", "alertmanager", "alertmanager.yml");
 }
 function readOfficialCloudNoWebappComposeTemplate() {
   const packaged = packagedNoWebappTemplatePath();
-  if (existsSync9(packaged)) return readFileSync7(packaged, "utf-8");
+  if (existsSync10(packaged)) return readFileSync8(packaged, "utf-8");
   return [
     "# backend/core/docker-compose.no-webapp.yml",
     "#",
@@ -28722,51 +28828,51 @@ function readOfficialCloudNoWebappComposeTemplate() {
 }
 function ensureOfficialCloudNoWebappComposeFile(installPath, deploymentMode, role) {
   if (deploymentMode !== "official_cloud" || role !== "core") return;
-  const filePath = join7(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE);
-  if (existsSync9(filePath)) return;
-  mkdirSync6(dirname6(filePath), { recursive: true });
-  writeFileSync5(filePath, readOfficialCloudNoWebappComposeTemplate());
+  const filePath = join8(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE);
+  if (existsSync10(filePath)) return;
+  mkdirSync7(dirname6(filePath), { recursive: true });
+  writeFileSync6(filePath, readOfficialCloudNoWebappComposeTemplate());
 }
 function fileHash(path2) {
-  if (!existsSync9(path2)) return null;
-  return createHash12("sha256").update(readFileSync7(path2)).digest("hex");
+  if (!existsSync10(path2)) return null;
+  return createHash13("sha256").update(readFileSync8(path2)).digest("hex");
 }
 async function loadSelfHostComposeTemplate(templateRef, role) {
   const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
   if (templateDir) {
-    return readFileSync7(join7(resolve6(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
+    return readFileSync8(join8(resolve6(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
   }
   const overrideUrl = process.env.OPENMATES_SELFHOST_COMPOSE_URL;
   if (overrideUrl) {
     return fetchText(overrideUrl);
   }
   const packaged = packagedTemplatePath(role);
-  if (existsSync9(packaged)) return readFileSync7(packaged, "utf-8");
+  if (existsSync10(packaged)) return readFileSync8(packaged, "utf-8");
   return fetchText(`https://raw.githubusercontent.com/glowingkitty/OpenMates/${templateRef}/${ROLE_IMAGE_COMPOSE_FILES[role]}`);
 }
 async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
-  const roleDir = join7(installPath, "backend", role === "core" ? "core" : role);
-  const vaultConfigDir = join7(roleDir, "vault", "config");
-  mkdirSync6(vaultConfigDir, { recursive: true });
-  mkdirSync6(join7(installPath, "config", "providers"), { recursive: true });
-  writeFileSync5(join7(installPath, ROLE_IMAGE_COMPOSE_FILES[role]), await loadSelfHostComposeTemplate(templateRefForImageTag(imageTag, getPackageVersion()), role));
+  const roleDir = join8(installPath, "backend", role === "core" ? "core" : role);
+  const vaultConfigDir = join8(roleDir, "vault", "config");
+  mkdirSync7(vaultConfigDir, { recursive: true });
+  mkdirSync7(join8(installPath, "config", "providers"), { recursive: true });
+  writeFileSync6(join8(installPath, ROLE_IMAGE_COMPOSE_FILES[role]), await loadSelfHostComposeTemplate(templateRefForImageTag(imageTag, getPackageVersion()), role));
   if (role === "core") {
-    writeFileSync5(join7(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE), readOfficialCloudNoWebappComposeTemplate());
+    writeFileSync6(join8(installPath, OFFICIAL_CLOUD_NO_WEBAPP_COMPOSE_FILE), readOfficialCloudNoWebappComposeTemplate());
   }
   if (role === "core") {
-    const promtailConfigPath = join7(installPath, CORE_PROMTAIL_CONFIG_FILE);
-    mkdirSync6(dirname6(promtailConfigPath), { recursive: true });
-    writeFileSync5(promtailConfigPath, SELFHOST_PROMTAIL_CONFIG_TEMPLATE);
+    const promtailConfigPath = join8(installPath, CORE_PROMTAIL_CONFIG_FILE);
+    mkdirSync7(dirname6(promtailConfigPath), { recursive: true });
+    writeFileSync6(promtailConfigPath, SELFHOST_PROMTAIL_CONFIG_TEMPLATE);
     const alertmanagerTemplatePath = packagedCoreAlertmanagerTemplatePath();
-    if (!existsSync9(alertmanagerTemplatePath)) throw new Error(`Packaged Alertmanager config not found: ${alertmanagerTemplatePath}`);
-    const alertmanagerConfigPath = join7(installPath, CORE_ALERTMANAGER_CONFIG_FILE);
-    mkdirSync6(dirname6(alertmanagerConfigPath), { recursive: true });
+    if (!existsSync10(alertmanagerTemplatePath)) throw new Error(`Packaged Alertmanager config not found: ${alertmanagerTemplatePath}`);
+    const alertmanagerConfigPath = join8(installPath, CORE_ALERTMANAGER_CONFIG_FILE);
+    mkdirSync7(dirname6(alertmanagerConfigPath), { recursive: true });
     copyFileSync2(alertmanagerTemplatePath, alertmanagerConfigPath);
   }
-  writeFileSync5(join7(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
+  writeFileSync6(join8(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
   ensureImageRuntimeConfig(installPath);
-  const envPath = join7(installPath, ".env");
-  let envContent = existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
+  const envPath = join8(installPath, ".env");
+  let envContent = existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
   envContent = setEnvIfEmpty(envContent, "DATABASE_ADMIN_PASSWORD", randomHex(12));
   envContent = setEnvIfEmpty(envContent, "DATABASE_PASSWORD", randomHex(12));
   envContent = setEnvIfEmpty(envContent, "DIRECTUS_TOKEN", randomHex(32));
@@ -28778,13 +28884,13 @@ async function writeImageModeRuntimeFiles(installPath, imageTag, role) {
   envContent = setEnvVar(envContent, "OPENMATES_IMAGE_TAG", imageTag);
   envContent = setEnvVar(envContent, "OPENMATES_IMAGE_REGISTRY", DEFAULT_IMAGE_REGISTRY);
   envContent = setEnvVar(envContent, "GIT_WORK_DIR", installPath);
-  writeFileSync5(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
+  writeFileSync6(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
 `);
 }
 function getImageTagFromEnv(installPath, config) {
-  const envPath = join7(installPath, ".env");
-  if (existsSync9(envPath)) {
-    const envTag = getEnvVar(readFileSync7(envPath, "utf-8"), "OPENMATES_IMAGE_TAG");
+  const envPath = join8(installPath, ".env");
+  if (existsSync10(envPath)) {
+    const envTag = getEnvVar(readFileSync8(envPath, "utf-8"), "OPENMATES_IMAGE_TAG");
     if (envTag) return envTag;
   }
   return config?.imageTag ?? "";
@@ -28817,8 +28923,8 @@ async function waitForServerHealth(installPath, role = "core", options = {}) {
     }
     throw new Error(`Updated ${role} server did not pass health checks in time. Tried ${healthUrl}.`);
   }
-  const envPath = join7(installPath, ".env");
-  const envContent = existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "";
+  const envPath = join8(installPath, ".env");
+  const envContent = existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : "";
   const urls = deriveSelfHostCliUrls(envContent);
   const apiHealthUrl = `${trailingSlashTrimmed(urls.apiUrl)}/health`;
   const appUrl = trailingSlashTrimmed(urls.appUrl);
@@ -28841,9 +28947,9 @@ function defaultCloneBranchForVersion(version) {
   return /-(alpha|beta|rc)(\.|\d|$)/.test(version) ? DEV_BRANCH : null;
 }
 function hasLlmCredentials(envPath) {
-  if (!existsSync9(envPath)) return false;
+  if (!existsSync10(envPath)) return false;
   if (hasLocalAiModels(dirname6(envPath))) return true;
-  const content = readFileSync7(envPath, "utf-8");
+  const content = readFileSync8(envPath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (trimmed.startsWith("#") || !trimmed) continue;
@@ -28858,8 +28964,8 @@ function hasLlmCredentials(envPath) {
   return false;
 }
 function warnIfMissingLlmCredentials(installPath) {
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(envPath)) {
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(envPath)) {
     console.error(
       "No .env file found. Run 'openmates server install' first, or create .env from .env.example."
     );
@@ -28884,22 +28990,22 @@ function printJson(data) {
   console.log(JSON.stringify(data, null, 2));
 }
 function localModelsOverlayPath(installPath, installMode = getInstallMode(installPath)) {
-  if (installMode === "source") return join7(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
-  return join7(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
+  if (installMode === "source") return join8(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
+  return join8(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
 }
 function imageBackendConfigPath(installPath) {
-  return join7(installPath, IMAGE_RUNTIME_CONFIG_FILE);
+  return join8(installPath, IMAGE_RUNTIME_CONFIG_FILE);
 }
 function ensureImageRuntimeConfig(installPath) {
   const configPath = imageBackendConfigPath(installPath);
-  if (existsSync9(configPath)) return;
-  mkdirSync6(dirname6(configPath), { recursive: true });
-  writeFileSync5(configPath, renderFeatureOverrides({ enabled: [], disabled: [] }));
+  if (existsSync10(configPath)) return;
+  mkdirSync7(dirname6(configPath), { recursive: true });
+  writeFileSync6(configPath, renderFeatureOverrides({ enabled: [], disabled: [] }));
 }
 function readLocalModelOverlay(path2) {
-  if (!existsSync9(path2)) return { providers: [] };
+  if (!existsSync10(path2)) return { providers: [] };
   try {
-    const parsed = JSON.parse(readFileSync7(path2, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(path2, "utf-8"));
     return { providers: Array.isArray(parsed.providers) ? parsed.providers : [] };
   } catch (error) {
     throw new Error(
@@ -28908,15 +29014,15 @@ function readLocalModelOverlay(path2) {
   }
 }
 function writeLocalModelOverlay(path2, overlay) {
-  mkdirSync6(dirname6(path2), { recursive: true });
-  writeFileSync5(path2, `${JSON.stringify(overlay, null, 2)}
+  mkdirSync7(dirname6(path2), { recursive: true });
+  writeFileSync6(path2, `${JSON.stringify(overlay, null, 2)}
 `);
 }
 function hasLocalAiModels(installPath) {
-  const imagePath = join7(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
-  const sourcePath = join7(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
+  const imagePath = join8(installPath, "config", "providers", LOCAL_AI_MODELS_FILE);
+  const sourcePath = join8(installPath, "backend", "providers", LOCAL_AI_MODELS_FILE);
   return [imagePath, sourcePath].some((path2) => {
-    if (!existsSync9(path2)) return false;
+    if (!existsSync10(path2)) return false;
     try {
       return readLocalModelOverlay(path2).providers.some((provider) => provider.models.length > 0);
     } catch {
@@ -28957,10 +29063,10 @@ function nowStamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function backupRoot(installPath) {
-  return join7(installPath, "backups");
+  return join8(installPath, "backups");
 }
 function roleBackupDir(installPath, role) {
-  return join7(backupRoot(installPath), role);
+  return join8(backupRoot(installPath), role);
 }
 function persistQuickServerTestOutcome(installPath, role, outcome) {
   const current = readServerUpdateStatus(installPath, role);
@@ -29109,15 +29215,15 @@ function sourceUpdateMetadata(installPath) {
   };
 }
 function copyIfExists(source, destination) {
-  if (!existsSync9(source)) return;
-  mkdirSync6(dirname6(destination), { recursive: true });
+  if (!existsSync10(source)) return;
+  mkdirSync7(dirname6(destination), { recursive: true });
   cpSync(source, destination, { recursive: true, force: true });
 }
 function readEnvMap(installPath) {
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(envPath)) return {};
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(envPath)) return {};
   const values = {};
-  for (const line of readFileSync7(envPath, "utf-8").split("\n")) {
+  for (const line of readFileSync8(envPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eqIdx = trimmed.indexOf("=");
@@ -29127,22 +29233,22 @@ function readEnvMap(installPath) {
   return values;
 }
 function envPathForInstall(installPath) {
-  return join7(installPath, ".env");
+  return join8(installPath, ".env");
 }
 function readEnvContent(installPath) {
   const envPath = envPathForInstall(installPath);
-  return existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "";
+  return existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : "";
 }
 function pruneEnvBackups(installPath) {
-  const backups = readdirSync4(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
+  const backups = readdirSync5(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
   for (const backup of backups.slice(0, Math.max(0, backups.length - ENV_BACKUP_RETENTION_COUNT))) {
-    rmSync6(join7(installPath, backup), { force: true });
+    rmSync7(join8(installPath, backup), { force: true });
   }
 }
 function backupEnvFile(installPath) {
   const envPath = envPathForInstall(installPath);
-  if (!existsSync9(envPath)) return null;
-  const backupPath = join7(installPath, `${ENV_BACKUP_PREFIX}${nowStamp()}`);
+  if (!existsSync10(envPath)) return null;
+  const backupPath = join8(installPath, `${ENV_BACKUP_PREFIX}${nowStamp()}`);
   copyFileSync2(envPath, backupPath);
   chmodSync5(backupPath, 384);
   pruneEnvBackups(installPath);
@@ -29150,8 +29256,8 @@ function backupEnvFile(installPath) {
 }
 function writeEnvContent(installPath, content) {
   const envPath = envPathForInstall(installPath);
-  mkdirSync6(dirname6(envPath), { recursive: true });
-  writeFileSync5(envPath, content, { mode: 384 });
+  mkdirSync7(dirname6(envPath), { recursive: true });
+  writeFileSync6(envPath, content, { mode: 384 });
   chmodSync5(envPath, 384);
 }
 function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
@@ -29166,7 +29272,7 @@ function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
   }
   const resolvedOverlayPath = resolve6(overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath));
   const overlayComposeFile = defaultOpenMatesCloudComposeFile(resolvedOverlayPath);
-  if (!existsSync9(resolvedOverlayPath) || !existsSync9(overlayComposeFile)) {
+  if (!existsSync10(resolvedOverlayPath) || !existsSync10(overlayComposeFile)) {
     throw new Error(
       `OpenMatesCloud official-cloud mode requires an overlay checkout with ${overlayComposeFile}. Pass --openmatescloud-path <dir> or create the sibling OpenMatesCloud repository.`
     );
@@ -29363,7 +29469,7 @@ function formatSecretPreflight(preflight) {
   return parts.join("; ");
 }
 function hashFile(path2) {
-  const hash = createHash12("sha256");
+  const hash = createHash13("sha256");
   const fd = openSync2(path2, "r");
   const buffer = Buffer.allocUnsafe(CHECKSUM_BUFFER_BYTES);
   try {
@@ -29380,8 +29486,8 @@ function hashFile(path2) {
 function writeChecksums(rootDir) {
   const lines = [];
   const walk = (dir) => {
-    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-      const path2 = join7(dir, entry.name);
+    for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+      const path2 = join8(dir, entry.name);
       if (entry.isDirectory()) {
         walk(path2);
         continue;
@@ -29392,13 +29498,13 @@ function writeChecksums(rootDir) {
     }
   };
   walk(rootDir);
-  writeFileSync5(join7(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
+  writeFileSync6(join8(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
 `);
 }
 function verifyChecksums(rootDir) {
-  const checksumsPath = join7(rootDir, "checksums.sha256");
-  if (!existsSync9(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
-  for (const line of readFileSync7(checksumsPath, "utf-8").split("\n")) {
+  const checksumsPath = join8(rootDir, "checksums.sha256");
+  if (!existsSync10(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
+  for (const line of readFileSync8(checksumsPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed) continue;
     const match = trimmed.match(/^([a-f0-9]{64}) {2}(.+)$/);
@@ -29407,8 +29513,8 @@ function verifyChecksums(rootDir) {
     if (relative3.startsWith("/") || relative3.split(/[\\/]/).includes("..")) {
       throw new Error(`Unsafe checksum path in backup archive: ${relative3}`);
     }
-    const filePath = join7(rootDir, relative3);
-    if (!existsSync9(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative3}`);
+    const filePath = join8(rootDir, relative3);
+    if (!existsSync10(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative3}`);
     const actual = hashFile(filePath);
     if (actual !== match[1]) throw new Error(`Backup checksum mismatch for ${relative3}.`);
   }
@@ -29416,28 +29522,28 @@ function verifyChecksums(rootDir) {
 function createServerBackup(installPath, role, options = {}) {
   const plan = planBackup({ role, includeObservability: options.includeObservability });
   const backupDir = roleBackupDir(installPath, role);
-  mkdirSync6(backupDir, { recursive: true, mode: 448 });
-  const archivePath = options.output ? resolve6(options.output) : join7(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
-  mkdirSync6(dirname6(archivePath), { recursive: true, mode: 448 });
-  const tempDir = mkdtempSync(join7(backupDir, ".tmp-"));
+  mkdirSync7(backupDir, { recursive: true, mode: 448 });
+  const archivePath = options.output ? resolve6(options.output) : join8(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  mkdirSync7(dirname6(archivePath), { recursive: true, mode: 448 });
+  const tempDir = mkdtempSync(join8(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
   const manifest = {
     role,
     backup_format_version: BACKUP_FORMAT_VERSION,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     cli_version: getPackageVersion(),
-    image_tag: getEnvVar(existsSync9(join7(installPath, ".env")) ? readFileSync7(join7(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
+    image_tag: getEnvVar(existsSync10(join8(installPath, ".env")) ? readFileSync8(join8(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
     recovery_scope: role === "core" ? "database-and-runtime-only" : "runtime-only",
     include_observability: false,
-    contents: plan.contents.filter((content) => content !== "runtime-env" || existsSync9(join7(installPath, ".env"))).filter((content) => content !== "runtime-config" || existsSync9(join7(installPath, "config")))
+    contents: plan.contents.filter((content) => content !== "runtime-env" || existsSync10(join8(installPath, ".env"))).filter((content) => content !== "runtime-config" || existsSync10(join8(installPath, "config")))
   };
   try {
-    copyIfExists(join7(installPath, ".env"), join7(tempDir, "runtime", ".env"));
-    copyIfExists(join7(installPath, "config"), join7(tempDir, "runtime", "config"));
+    copyIfExists(join8(installPath, ".env"), join8(tempDir, "runtime", ".env"));
+    copyIfExists(join8(installPath, "config"), join8(tempDir, "runtime", "config"));
     if (role === "core") {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      const dumpFile = openSync2(join7(tempDir, "postgres.sql"), "w");
+      const dumpFile = openSync2(join8(tempDir, "postgres.sql"), "w");
       try {
         const result = spawnSync(
           "docker",
@@ -29452,35 +29558,35 @@ function createServerBackup(installPath, role, options = {}) {
         closeSync2(dumpFile);
       }
     }
-    writeFileSync5(join7(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    writeFileSync6(join8(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
     writeChecksums(tempDir);
     publishServerBackupArchive(tempDir, archivePath);
     return archivePath;
   } finally {
-    rmSync6(tempDir, { recursive: true, force: true });
+    rmSync7(tempDir, { recursive: true, force: true });
   }
 }
 function restoreServerBackup(installPath, role, file) {
   const archivePath = resolve6(file);
-  if (!existsSync9(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
-  mkdirSync6(roleBackupDir(installPath, role), { recursive: true, mode: 448 });
-  const tempDir = mkdtempSync(join7(roleBackupDir(installPath, role), ".restore-"));
+  if (!existsSync10(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
+  mkdirSync7(roleBackupDir(installPath, role), { recursive: true, mode: 448 });
+  const tempDir = mkdtempSync(join8(roleBackupDir(installPath, role), ".restore-"));
   const env = readEnvMap(installPath);
   try {
     execSync(`tar -xzf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)}`, { stdio: "pipe" });
     verifyChecksums(tempDir);
-    const manifestPath = join7(tempDir, "manifest.json");
-    if (!existsSync9(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
-    const manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
+    const manifestPath = join8(tempDir, "manifest.json");
+    if (!existsSync10(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
+    const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
     if (manifest.role !== role) throw new Error(`Backup role '${manifest.role}' does not match requested role '${role}'.`);
     if (role === "core" && manifest.backup_format_version === BACKUP_FORMAT_VERSION && manifest.recovery_scope !== "full-core") {
       throw new Error("This backup records database and runtime state only; refusing unsafe full core restore.");
     }
-    copyIfExists(join7(tempDir, "runtime", ".env"), join7(installPath, ".env"));
-    copyIfExists(join7(tempDir, "runtime", "config"), join7(installPath, "config"));
-    const postgresDump = join7(tempDir, "postgres.sql");
-    if (role === "core" && existsSync9(postgresDump)) {
+    copyIfExists(join8(tempDir, "runtime", ".env"), join8(installPath, ".env"));
+    copyIfExists(join8(tempDir, "runtime", "config"), join8(installPath, "config"));
+    const postgresDump = join8(tempDir, "postgres.sql");
+    if (role === "core" && existsSync10(postgresDump)) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
       const dumpFile = openSync2(postgresDump, "r");
@@ -29497,7 +29603,7 @@ function restoreServerBackup(installPath, role, file) {
       }
     }
   } finally {
-    rmSync6(tempDir, { recursive: true, force: true });
+    rmSync7(tempDir, { recursive: true, force: true });
   }
 }
 function restoreStopServices(installPath, withOverrides, installMode, role) {
@@ -29766,11 +29872,11 @@ async function serverRegister(flags) {
   const installPath = resolveServerPath(
     typeof flags.path === "string" ? flags : { ...flags, path: process.cwd() }
   );
-  const envPath = join7(installPath, ".env");
-  if (!existsSync9(join7(installPath, SOURCE_COMPOSE_FILE))) {
-    throw new Error(`Source Compose file not found: ${join7(installPath, SOURCE_COMPOSE_FILE)}`);
+  const envPath = join8(installPath, ".env");
+  if (!existsSync10(join8(installPath, SOURCE_COMPOSE_FILE))) {
+    throw new Error(`Source Compose file not found: ${join8(installPath, SOURCE_COMPOSE_FILE)}`);
   }
-  if (!existsSync9(envPath)) {
+  if (!existsSync10(envPath)) {
     throw new Error(`Runtime env file not found: ${envPath}`);
   }
   const gitRoot = resolve6(exec("git rev-parse --show-toplevel", installPath));
@@ -29792,7 +29898,7 @@ async function serverRegister(flags) {
   }
   const overlayPath = getOpenMatesCloudOverlayPath(flags, null) ?? readEnvMap(installPath).OPENMATES_CLOUD_OVERLAY_PATH ?? defaultOpenMatesCloudOverlayPath(installPath);
   const overlayComposeFile = defaultOpenMatesCloudComposeFile(overlayPath);
-  if (deploymentMode === "official_cloud" && (!existsSync9(overlayPath) || !existsSync9(overlayComposeFile))) {
+  if (deploymentMode === "official_cloud" && (!existsSync10(overlayPath) || !existsSync10(overlayComposeFile))) {
     throw new Error(`OpenMatesCloud overlay path is required for official-cloud mode: ${overlayPath}`);
   }
   const runtimePlan = planServerRuntime({
@@ -29802,7 +29908,7 @@ async function serverRegister(flags) {
     includeWebapp: deploymentMode !== "official_cloud"
   });
   const defaultServices = hasServiceFilter(flags) ? selectedComposeServices(role, flags) : runtimePlan.defaultServices;
-  const cliUrls = deriveSelfHostCliUrls(readFileSync7(envPath, "utf-8"));
+  const cliUrls = deriveSelfHostCliUrls(readFileSync8(envPath, "utf-8"));
   const config = {
     installPath,
     installedAt: existing?.installPath === installPath ? existing.installedAt : Date.now(),
@@ -29844,27 +29950,27 @@ async function serverInstall(flags) {
     withAlerts: flags["with-alerts"] === true,
     includeWebapp: deploymentMode !== "official_cloud"
   });
-  if (existsSync9(join7(installPath, SOURCE_COMPOSE_FILE)) || Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync9(join7(installPath, composeFile)))) {
+  if (existsSync10(join8(installPath, SOURCE_COMPOSE_FILE)) || Object.values(ROLE_IMAGE_COMPOSE_FILES).some((composeFile) => existsSync10(join8(installPath, composeFile)))) {
     console.error(`OpenMates already exists at ${installPath}.`);
     console.error("Use 'openmates server update' to update, or choose a different --path.");
     process.exit(1);
   }
   if (!fromSource) {
     requireDocker();
-    mkdirSync6(installPath, { recursive: true });
+    mkdirSync7(installPath, { recursive: true });
     if (typeof flags["env-path"] === "string") {
       const envSource = resolve6(flags["env-path"]);
-      if (!existsSync9(envSource)) {
+      if (!existsSync10(envSource)) {
         throw new Error(`Env file not found: ${envSource}`);
       }
-      copyFileSync2(envSource, join7(installPath, ".env"));
+      copyFileSync2(envSource, join8(installPath, ".env"));
       console.error(`Copied ${envSource} to ${installPath}/.env`);
     }
     const imageTag = typeof flags["image-tag"] === "string" ? flags["image-tag"] : getDefaultImageTag();
     console.error(`Preparing OpenMates image-mode install at ${installPath}...`);
     await writeImageModeRuntimeFiles(installPath, imageTag, role);
     const overlay2 = writeDeploymentModeEnv(installPath, deploymentMode, requestedOverlayPath);
-    const cliUrls2 = deriveSelfHostCliUrls(readFileSync7(join7(installPath, ".env"), "utf-8"));
+    const cliUrls2 = deriveSelfHostCliUrls(readFileSync8(join8(installPath, ".env"), "utf-8"));
     try {
       exec("docker network create openmates", installPath);
     } catch {
@@ -29891,7 +29997,7 @@ async function serverInstall(flags) {
     if (flags.json === true) {
       printJson({ command: "install", status: "success", path: installPath, mode: "image", imageTag });
     } else {
-      const firstInvite = getEnvVar(readFileSync7(join7(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
+      const firstInvite = getEnvVar(readFileSync8(join8(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
       console.log(`
 OpenMates installed at ${installPath}`);
       console.log(`Mode: image (${DEFAULT_IMAGE_REGISTRY}, tag ${imageTag})`);
@@ -29929,10 +30035,10 @@ CLI default API: ${cliUrls2.apiUrl}`);
   }
   if (typeof flags["env-path"] === "string") {
     const envSource = resolve6(flags["env-path"]);
-    if (!existsSync9(envSource)) {
+    if (!existsSync10(envSource)) {
       throw new Error(`Env file not found: ${envSource}`);
     }
-    copyFileSync2(envSource, join7(installPath, ".env"));
+    copyFileSync2(envSource, join8(installPath, ".env"));
     console.error(`Copied ${envSource} to ${installPath}/.env`);
   }
   const translationResult = ensureSourceInstallTranslations(installPath, sourcePath);
@@ -29951,9 +30057,9 @@ CLI default API: ${cliUrls2.apiUrl}`);
     console.error("Setup script failed. Check the output above for details.");
     process.exit(setupCode);
   }
-  const envPath = join7(installPath, ".env");
+  const envPath = join8(installPath, ".env");
   const overlay = writeDeploymentModeEnv(installPath, deploymentMode, requestedOverlayPath);
-  const cliUrls = deriveSelfHostCliUrls(existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "");
+  const cliUrls = deriveSelfHostCliUrls(existsSync10(envPath) ? readFileSync8(envPath, "utf-8") : "");
   saveServerConfig({
     installPath,
     installedAt: Date.now(),
@@ -29994,15 +30100,15 @@ async function installContinuousUpdateService(flags) {
   const channel = typeof flags.channel === "string" ? flags.channel : config?.imageChannel ?? "main";
   const window = typeof flags.window === "string" ? flags.window : "02:00-04:00 UTC";
   const plan = planContinuousUpdateService({ role, channel, window });
-  const servicePath = join7("/etc", "systemd", "system", plan.serviceName);
-  const timerPath = join7("/etc", "systemd", "system", plan.timerName);
+  const servicePath = join8("/etc", "systemd", "system", plan.serviceName);
+  const timerPath = join8("/etc", "systemd", "system", plan.timerName);
   if (flags["dry-run"] === true || flags.json === true) {
     printJson({ command: "update install-service", status: "planned", role, servicePath, timerPath, unit: plan.unit, timer: plan.timer });
     return;
   }
   try {
-    writeFileSync5(servicePath, plan.unit, { mode: 420 });
-    writeFileSync5(timerPath, plan.timer, { mode: 420 });
+    writeFileSync6(servicePath, plan.unit, { mode: 420 });
+    writeFileSync6(timerPath, plan.timer, { mode: 420 });
     execSync("systemctl daemon-reload", { stdio: "pipe" });
     execSync(`systemctl enable --now ${shellQuote(plan.timerName)}`, { stdio: "pipe" });
   } catch (error) {
@@ -30013,13 +30119,13 @@ async function installContinuousUpdateService(flags) {
   console.log(`Installed ${plan.timerName}.`);
 }
 function runRuntimeVerification(installPath, role, config) {
-  const envText = existsSync9(join7(installPath, ".env")) ? readFileSync7(join7(installPath, ".env"), "utf-8") : "";
+  const envText = existsSync10(join8(installPath, ".env")) ? readFileSync8(join8(installPath, ".env"), "utf-8") : "";
   const mode = resolveRuntimeDeploymentMode({
     envText,
-    overlayExists: existsSync9(config?.openMatesCloudOverlayPath ?? defaultOpenMatesCloudOverlayPath(installPath))
+    overlayExists: existsSync10(config?.openMatesCloudOverlayPath ?? defaultOpenMatesCloudOverlayPath(installPath))
   });
-  const backupPath = join7(roleBackupDir(installPath, role), `latest-pre-update-${role}.tar.gz`);
-  const plan = planRuntimeVerification({ role, deploymentMode: mode.effectiveMode, hasVerifiedBackup: existsSync9(backupPath) });
+  const backupPath = join8(roleBackupDir(installPath, role), `latest-pre-update-${role}.tar.gz`);
+  const plan = planRuntimeVerification({ role, deploymentMode: mode.effectiveMode, hasVerifiedBackup: existsSync10(backupPath) });
   const verifierService = { core: "api", upload: "app-uploads", preview: "preview" }[role];
   const installMode = getInstallMode(installPath, config);
   const withOverrides = config?.composeProfile === "full";
@@ -30226,10 +30332,10 @@ async function installRuntimeMonitoringServices(installPath, role) {
       [operationalPlan.watchdogTimerName, operationalPlan.watchdogTimer]
     ] : []
   ].filter((entry) => Boolean(entry[0] && entry[1]));
-  const reportStatePath = join7(installPath, ".openmates", "runtime-health", `${role}-operational-report.json`);
-  const reportMetricsDir = join7(installPath, ".openmates", "runtime-health", "metrics");
-  const startedMetricPath = join7(reportMetricsDir, "operational-report-started.prom");
-  const successMetricPath = join7(reportMetricsDir, "operational-report.prom");
+  const reportStatePath = join8(installPath, ".openmates", "runtime-health", `${role}-operational-report.json`);
+  const reportMetricsDir = join8(installPath, ".openmates", "runtime-health", "metrics");
+  const startedMetricPath = join8(reportMetricsDir, "operational-report-started.prom");
+  const successMetricPath = join8(reportMetricsDir, "operational-report.prom");
   const operationalUnitNames = [
     operationalPlan.digestServiceName,
     operationalPlan.digestTimerName,
@@ -30237,18 +30343,18 @@ async function installRuntimeMonitoringServices(installPath, role) {
     operationalPlan.watchdogTimerName
   ];
   if (operationalPlan.scheduleEnabled) {
-    mkdirSync6(dirname6(reportStatePath), { recursive: true, mode: 448 });
-    mkdirSync6(reportMetricsDir, { recursive: true, mode: 448 });
-    if (!existsSync9(reportStatePath)) {
-      writeFileSync5(
+    mkdirSync7(dirname6(reportStatePath), { recursive: true, mode: 448 });
+    mkdirSync7(reportMetricsDir, { recursive: true, mode: 448 });
+    if (!existsSync10(reportStatePath)) {
+      writeFileSync6(
         reportStatePath,
         `${JSON.stringify({ incidentOpen: false, monitoringStartedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `,
         { mode: 384 }
       );
     }
-    if (!existsSync9(startedMetricPath)) {
-      writeFileSync5(
+    if (!existsSync10(startedMetricPath)) {
+      writeFileSync6(
         startedMetricPath,
         `operational_report_monitoring_started_timestamp_seconds{environment="${operationalPlan.environment}"} ${Math.floor(Date.now() / 1e3)}
 `,
@@ -30256,17 +30362,17 @@ async function installRuntimeMonitoringServices(installPath, role) {
       );
     }
   } else {
-    const installedOperationalUnits = operationalUnitNames.filter((name) => existsSync9(join7("/etc", "systemd", "system", name)));
+    const installedOperationalUnits = operationalUnitNames.filter((name) => existsSync10(join8("/etc", "systemd", "system", name)));
     const installedOperationalTimers = installedOperationalUnits.filter((name) => name.endsWith(".timer"));
     if (installedOperationalTimers.length) {
       execFileSync4("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
     }
-    for (const name of installedOperationalUnits) rmSync6(join7("/etc", "systemd", "system", name));
+    for (const name of installedOperationalUnits) rmSync7(join8("/etc", "systemd", "system", name));
     for (const path2 of [reportStatePath, startedMetricPath, successMetricPath]) {
-      if (existsSync9(path2)) rmSync6(path2);
+      if (existsSync10(path2)) rmSync7(path2);
     }
   }
-  for (const [name, content] of files) writeFileSync5(join7("/etc", "systemd", "system", name), content, { mode: 420 });
+  for (const [name, content] of files) writeFileSync6(join8("/etc", "systemd", "system", name), content, { mode: 420 });
   execSync("systemctl daemon-reload", { stdio: "pipe" });
   const timers = files.filter(([name]) => name.endsWith(".timer")).map(([name]) => name);
   execSync(`systemctl enable --now ${timers.map(shellQuote).join(" ")}`, { stdio: "pipe" });
@@ -30288,10 +30394,10 @@ async function serverUpdate(client, rest, flags) {
     const filePath = serverUpdateStatusFile(installPath2, role2);
     const status = readServerUpdateStatus(installPath2, role2);
     if (flags.json === true) {
-      printJson(existsSync9(filePath) ? status : { role: role2, status: "unknown" });
+      printJson(existsSync10(filePath) ? status : { role: role2, status: "unknown" });
       return;
     }
-    if (!existsSync9(filePath)) {
+    if (!existsSync10(filePath)) {
       console.log(`No update status recorded for ${role2}.`);
       return;
     }
@@ -30477,7 +30583,7 @@ async function serverUpdate(client, rest, flags) {
       try {
         await autoInstallRuntimeMonitoringServices(installPath, role);
       } catch (error) {
-        const restoreCommand = safetyPlan.backupName ? `openmates server restore --role ${role} --file ${join7(roleBackupDir(installPath, role), safetyPlan.backupName)}` : null;
+        const restoreCommand = safetyPlan.backupName ? `openmates server restore --role ${role} --file ${join8(roleBackupDir(installPath, role), safetyPlan.backupName)}` : null;
         writeServerUpdateStatus(installPath, role, {
           status: "degraded",
           targetImageTag: target.tag,
@@ -30803,11 +30909,11 @@ async function serverMonitoring(rest, flags) {
     const state2 = await readOperationalReportState(installPath, role);
     const nextState2 = accepted ? { ...state2, incidentOpen: false, incidentOpenedAt: void 0, lastAcceptedReportAt: (/* @__PURE__ */ new Date()).toISOString() } : state2;
     await writeOperationalReportState(installPath, role, nextState2);
-    const metricsDir = join7(installPath, ".openmates", "runtime-health", "metrics");
-    mkdirSync6(metricsDir, { recursive: true, mode: 448 });
+    const metricsDir = join8(installPath, ".openmates", "runtime-health", "metrics");
+    mkdirSync7(metricsDir, { recursive: true, mode: 448 });
     if (accepted) {
-      writeFileSync5(
-        join7(metricsDir, "operational-report.prom"),
+      writeFileSync6(
+        join8(metricsDir, "operational-report.prom"),
         `operational_report_last_success_timestamp_seconds{environment="${output2.receipts[0]?.environment ?? environment}"} ${Math.floor(Date.now() / 1e3)}
 `,
         { mode: 384 }
@@ -30825,11 +30931,11 @@ async function serverMonitoring(rest, flags) {
       destinationSource: receipt.destination_source,
       fallbackUsed: receipt.fallback_used
     }));
-    const receiptDir = join7(installPath, ".openmates", "runtime-health", "receipts");
-    mkdirSync6(receiptDir, { recursive: true, mode: 448 });
+    const receiptDir = join8(installPath, ".openmates", "runtime-health", "receipts");
+    mkdirSync7(receiptDir, { recursive: true, mode: 448 });
     const receiptMonth = (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
     for (const receipt of redactedReceipts) {
-      appendFileSync(join7(receiptDir, `${receiptMonth}.jsonl`), `${JSON.stringify(receipt)}
+      appendFileSync(join8(receiptDir, `${receiptMonth}.jsonl`), `${JSON.stringify(receipt)}
 `, { mode: 384 });
     }
     const displayed = { command: "monitoring digest", reportId: output2.report_id, reportSha256: output2.report_sha256, deliveryState: output2.delivery_state, receipts: redactedReceipts };
@@ -31033,14 +31139,14 @@ async function serverFeatures(rest, flags) {
   const installPath = resolveServerPath(flags);
   const installMode = getInstallMode(installPath);
   if (installMode === "image") ensureImageRuntimeConfig(installPath);
-  const configPath = installMode === "image" ? imageBackendConfigPath(installPath) : join7(installPath, BACKEND_CONFIG_FILE);
-  if (!existsSync9(configPath)) {
+  const configPath = installMode === "image" ? imageBackendConfigPath(installPath) : join8(installPath, BACKEND_CONFIG_FILE);
+  if (!existsSync10(configPath)) {
     throw new Error(`Backend config not found at ${configPath}. Run 'openmates server install' first or pass --path <dir>.`);
   }
-  const content = readFileSync7(configPath, "utf-8");
+  const content = readFileSync8(configPath, "utf-8");
   const overrides = parseFeatureOverrides(content);
   const writeOverrides = (nextOverrides) => {
-    writeFileSync5(configPath, updateFeatureOverridesContent(content, nextOverrides));
+    writeFileSync6(configPath, updateFeatureOverridesContent(content, nextOverrides));
     console.log(`Updated ${configPath}`);
     console.log("Restart the server for feature changes to take effect: openmates server restart");
   };
@@ -31273,7 +31379,7 @@ async function serverBackup(rest, flags) {
   const role = getServerRole(flags, config);
   if (action === "list") {
     const dir = roleBackupDir(installPath, role);
-    const files = existsSync9(dir) ? readdirSync4(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
+    const files = existsSync10(dir) ? readdirSync5(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
     if (flags.json === true) {
       printJson({ role, backupDir: dir, files });
       return;
@@ -31283,7 +31389,7 @@ async function serverBackup(rest, flags) {
       console.log("  none");
       return;
     }
-    for (const file of files) console.log(`  ${join7(dir, file)}`);
+    for (const file of files) console.log(`  ${join8(dir, file)}`);
     return;
   }
   requireDocker();
@@ -31368,7 +31474,7 @@ async function serverUninstall(flags) {
   } catch {
   }
   try {
-    rmSync6(installPath, { recursive: true, force: true });
+    rmSync7(installPath, { recursive: true, force: true });
     console.error(`  Removed installation directory: ${installPath}`);
   } catch (e) {
     console.error(`  Could not remove ${installPath}: ${e instanceof Error ? e.message : e}`);
@@ -31443,7 +31549,7 @@ async function serverCaddy(rest, flags) {
   const role = getServerRole(flags, config);
   const appliedPath = typeof flags.config === "string" ? flags.config : "/etc/caddy/Caddyfile";
   const templatePath = packagedCaddyTemplatePath(role);
-  if (!existsSync9(templatePath)) throw new Error(`Packaged Caddy template not found: ${templatePath}`);
+  if (!existsSync10(templatePath)) throw new Error(`Packaged Caddy template not found: ${templatePath}`);
   const plan = planCaddyCommand({ role, action, appliedPath });
   const payload = {
     ...plan,
@@ -31462,7 +31568,7 @@ async function serverCaddy(rest, flags) {
     return;
   }
   if (action === "diff") {
-    if (!existsSync9(appliedPath)) throw new Error(`Applied Caddyfile not found: ${appliedPath}`);
+    if (!existsSync10(appliedPath)) throw new Error(`Applied Caddyfile not found: ${appliedPath}`);
     try {
       execSync(`diff -u ${shellQuote(appliedPath)} ${shellQuote(templatePath)}`, { stdio: "inherit" });
     } catch (error) {
@@ -31483,9 +31589,9 @@ WARNING: This will replace ${appliedPath} with the packaged ${role} Caddyfile.`)
       }
     }
     const backupPath = `${appliedPath}.openmates-backup-${nowStamp()}`;
-    const hadExistingCaddyfile = existsSync9(appliedPath);
+    const hadExistingCaddyfile = existsSync10(appliedPath);
     try {
-      mkdirSync6(dirname6(appliedPath), { recursive: true });
+      mkdirSync7(dirname6(appliedPath), { recursive: true });
       if (hadExistingCaddyfile) copyFileSync2(appliedPath, backupPath);
       copyFileSync2(templatePath, appliedPath);
       execSync("systemctl reload caddy", { stdio: "inherit" });
@@ -50610,6 +50716,12 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       }
     },
     calendar: {
+      list_calendars: {
+        text: "List Calendars",
+        description: {
+          text: "List calendars, timezones, and access roles in a connected account."
+        }
+      },
       get_events: {
         text: "Search",
         description: {
@@ -56799,6 +56911,9 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       generating_title: {
         text: "Processing..."
       },
+      selecting_mate_and_model: {
+        text: "Selecting mate & AI model..."
+      },
       selecting_mate: {
         text: "Selecting optimal mate..."
       },
@@ -70616,10 +70731,10 @@ function buildAssistantFeedbackDecision(rating) {
 }
 
 // src/benchmark.ts
-import { createHash as createHash13, randomUUID as randomUUID12 } from "crypto";
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync6 } from "fs";
+import { createHash as createHash14, randomUUID as randomUUID12 } from "crypto";
+import { existsSync as existsSync11, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, readdirSync as readdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname7, join as join8, resolve as resolve8 } from "path";
+import { dirname as dirname7, join as join9, resolve as resolve8 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_JUDGE_MODEL = "google/gemini-3-flash-preview";
 var DEFAULT_PROMPT_BUDGET_MODEL = "google/gemini-3.5-flash";
@@ -71505,7 +71620,7 @@ async function buildPromptWithAttachments(client, benchmarkCase, model, imagePat
 ${attachment.messageSuffix}`, embeds: attachment.embeds };
 }
 async function prepareImageAttachment(client, imagePath) {
-  if (!existsSync10(imagePath)) throw new Error(`Benchmark image not found: ${imagePath}`);
+  if (!existsSync11(imagePath)) throw new Error(`Benchmark image not found: ${imagePath}`);
   const processed = processFiles([imagePath], null);
   if (processed.blocked.length > 0 || processed.errors.length > 0 || processed.embeds.length === 0) {
     const reason = [...processed.blocked, ...processed.errors].map((entry) => entry.error).join("; ") || "no image embed produced";
@@ -71785,10 +71900,10 @@ function loadProviderPricing() {
   const providersDir = findProvidersDir();
   const pricing = /* @__PURE__ */ new Map();
   if (!providersDir) return pricing;
-  for (const fileName of readdirSync5(providersDir)) {
+  for (const fileName of readdirSync6(providersDir)) {
     if (!fileName.endsWith(".yml")) continue;
-    const filePath = join8(providersDir, fileName);
-    const text = readFileSync8(filePath, "utf-8");
+    const filePath = join9(providersDir, fileName);
+    const text = readFileSync9(filePath, "utf-8");
     const provider = parseProviderId(text) ?? fileName.replace(/\.yml$/, "");
     for (const modelPricing of parseModelPricing(text, provider)) {
       pricing.set(`${modelPricing.provider}/${modelPricing.modelId}`, modelPricing);
@@ -71842,10 +71957,10 @@ function findProvidersDir() {
   const currentFile = fileURLToPath(import.meta.url);
   let current = dirname7(currentFile);
   for (let index = 0; index < 8; index += 1) {
-    const candidate = join8(current, "backend", "providers");
-    if (existsSync10(candidate)) return candidate;
-    const parentCandidate = join8(current, "..", "..", "backend", "providers");
-    if (existsSync10(parentCandidate)) return resolve8(parentCandidate);
+    const candidate = join9(current, "backend", "providers");
+    if (existsSync11(candidate)) return candidate;
+    const parentCandidate = join9(current, "..", "..", "backend", "providers");
+    if (existsSync11(parentCandidate)) return resolve8(parentCandidate);
     const next = dirname7(current);
     if (next === current) break;
     current = next;
@@ -72050,21 +72165,21 @@ function hashPromptBudgetCorpus(cases) {
   return stableHash(cases.map((benchmarkCase) => ({ id: benchmarkCase.id, turns: benchmarkCase.turns })));
 }
 function stableHash(value) {
-  return createHash13("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash14("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function defaultImageFixturePath() {
-  const fixtureDir = join8(dirname7(fileURLToPath(import.meta.url)), "..", "fixtures");
-  const fixturePath = join8(fixtureDir, "brandenburger-tor.png");
-  if (existsSync10(fixturePath)) return fixturePath;
-  const tempDir = mkdtempSync2(join8(tmpdir(), "openmates-benchmark-"));
-  const tempPath = join8(tempDir, "brandenburger-tor.svg");
-  writeFileSync6(tempPath, FIXTURE_IMAGE_SVG, "utf-8");
+  const fixtureDir = join9(dirname7(fileURLToPath(import.meta.url)), "..", "fixtures");
+  const fixturePath = join9(fixtureDir, "brandenburger-tor.png");
+  if (existsSync11(fixturePath)) return fixturePath;
+  const tempDir = mkdtempSync2(join9(tmpdir(), "openmates-benchmark-"));
+  const tempPath = join9(tempDir, "brandenburger-tor.svg");
+  writeFileSync7(tempPath, FIXTURE_IMAGE_SVG, "utf-8");
   return tempPath;
 }
 function writeBenchmarkResult(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync6(output, json, "utf-8");
+  if (output) writeFileSync7(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -72088,7 +72203,7 @@ function writeBenchmarkResult(result, flags, output) {
 function writePromptBudgetResult(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync6(output, json, "utf-8");
+  if (output) writeFileSync7(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -72114,7 +72229,7 @@ function writePromptBudgetResult(result, flags, output) {
 function writePromptBudgetComparison(result, flags, output) {
   const json = `${JSON.stringify(result, null, 2)}
 `;
-  if (output) writeFileSync6(output, json, "utf-8");
+  if (output) writeFileSync7(output, json, "utf-8");
   if (flags.json === true || output) {
     process.stdout.write(json);
     return;
@@ -72164,7 +72279,7 @@ function comparePromptBudgetArtifacts(flags) {
   };
 }
 function readPromptBudgetResult(path2) {
-  const parsed = JSON.parse(readFileSync8(path2, "utf-8"));
+  const parsed = JSON.parse(readFileSync9(path2, "utf-8"));
   if (!parsed || typeof parsed !== "object") throw new Error(`Invalid prompt-budget artifact: ${path2}`);
   return parsed;
 }
@@ -73565,19 +73680,19 @@ import {
   chmodSync as chmodSync6,
   closeSync as closeSync3,
   constants,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   fstatSync,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   openSync as openSync3,
-  readFileSync as readFileSync9,
-  readdirSync as readdirSync6,
+  readFileSync as readFileSync10,
+  readdirSync as readdirSync7,
   readSync as readSync2,
   realpathSync,
   statSync as statSync2,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "fs";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
-import { join as join9, resolve as resolve9, relative as relative2 } from "path";
+import { join as join10, resolve as resolve9, relative as relative2 } from "path";
 
 // src/projectFileRisk.ts
 var SECRET_OR_ENVIRONMENT_PATTERNS = [
@@ -73700,7 +73815,7 @@ function resolveRemoteAccessRoots(pathFlag, cwd = process.cwd()) {
   const roots = [];
   for (const value of requested) {
     const candidate = resolve9(cwd, value);
-    if (!existsSync11(candidate) || !statSync2(candidate).isDirectory()) {
+    if (!existsSync12(candidate) || !statSync2(candidate).isDirectory()) {
       throw new Error(`Remote source path does not exist or is not a directory: ${candidate}`);
     }
     const canonical = realpathSync(candidate);
@@ -73714,7 +73829,7 @@ function discoverRemoteAccessRepositories(roots) {
   const visit = (directory, approvedRoot) => {
     let entries;
     try {
-      entries = readdirSync6(directory, { withFileTypes: true });
+      entries = readdirSync7(directory, { withFileTypes: true });
     } catch (error) {
       const code = error.code;
       if (code === "EACCES" || code === "EPERM") {
@@ -73728,7 +73843,7 @@ function discoverRemoteAccessRepositories(roots) {
     }
     for (const entry of entries) {
       if (entry.name === ".git" || entry.isSymbolicLink() || !entry.isDirectory()) continue;
-      visit(join9(directory, entry.name), approvedRoot);
+      visit(join10(directory, entry.name), approvedRoot);
     }
   };
   for (const root of roots) visit(root, root);
@@ -73738,8 +73853,8 @@ function discoverRemoteAccessRepositories(roots) {
   };
 }
 function remoteAccessSourceType(rootPath) {
-  const gitMarker = join9(rootPath, ".git");
-  return existsSync11(gitMarker) ? "local_git_repository" : "local_folder";
+  const gitMarker = join10(rootPath, ".git");
+  return existsSync12(gitMarker) ? "local_git_repository" : "local_folder";
 }
 function listRemoteAccessDirectory(options) {
   const root = realpathSync(options.sourceRoot);
@@ -73752,9 +73867,9 @@ function listRemoteAccessDirectory(options) {
   const entries = [];
   let omitted = 0;
   let excluded = 0;
-  for (const entry of readdirSync6(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-    const entryPath = relative2(root, join9(directory, entry.name)).replace(/\\/g, "/");
-    if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, entryPath) || classifyProjectFileRisk(entryPath, options.userProtectedPatterns ?? []).isHighRisk || entry.isFile() && isBinaryFile(join9(directory, entry.name))) {
+  for (const entry of readdirSync7(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const entryPath = relative2(root, join10(directory, entry.name)).replace(/\\/g, "/");
+    if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, entryPath) || classifyProjectFileRisk(entryPath, options.userProtectedPatterns ?? []).isHighRisk || entry.isFile() && isBinaryFile(join10(directory, entry.name))) {
       excluded += 1;
       continue;
     }
@@ -73982,7 +74097,7 @@ function remoteAccessOperationErrorCode(error) {
   return "operation_failed";
 }
 function isGitIgnoredPath(sourceRoot, relativePath) {
-  if (!existsSync11(join9(sourceRoot, ".git"))) return false;
+  if (!existsSync12(join10(sourceRoot, ".git"))) return false;
   const result = spawnSync2("git", ["check-ignore", "--quiet", "--", relativePath], {
     cwd: sourceRoot,
     stdio: "ignore"
@@ -74012,13 +74127,13 @@ function waitForAbort2(signal, timeoutMs) {
 }
 function resolveRemoteCachePath(sourceId, homeDirectory = homedir7()) {
   assertSafeSourceId(sourceId);
-  return join9(homeDirectory, ".openmates", "remote-cache", sourceId);
+  return join10(homeDirectory, ".openmates", "remote-cache", sourceId);
 }
 function startRemoteAccessSource(input) {
   assertSafeSourceId(input.sourceId);
   const homeDirectory = input.homeDirectory ?? homedir7();
   const requestedRootPath = resolve9(input.rootPath);
-  if (!existsSync11(requestedRootPath) || !statSync2(requestedRootPath).isDirectory()) {
+  if (!existsSync12(requestedRootPath) || !statSync2(requestedRootPath).isDirectory()) {
     throw new Error(`Remote source path does not exist or is not a directory: ${requestedRootPath}`);
   }
   const rootPath = realpathSync(requestedRootPath);
@@ -74036,14 +74151,14 @@ function startRemoteAccessSource(input) {
   };
   const sources = listRemoteAccessSources(homeDirectory).filter((entry) => entry.sourceId !== input.sourceId);
   saveRemoteAccessSources([...sources, source], homeDirectory);
-  mkdirSync7(source.cachePath, { recursive: true, mode: 448 });
+  mkdirSync8(source.cachePath, { recursive: true, mode: 448 });
   return source;
 }
 function listRemoteAccessSources(homeDirectory = homedir7()) {
   const filePath = remoteAccessStorePath(homeDirectory);
-  if (!existsSync11(filePath)) return [];
+  if (!existsSync12(filePath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync9(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(filePath, "utf-8"));
     if (!Array.isArray(parsed.sources)) {
       throw new Error("Remote source store is missing the sources array");
     }
@@ -74100,13 +74215,13 @@ function searchRemoteSourceWithoutRg(query, sourceRoot, maxResults, userProtecte
     const directory = directories.pop();
     let entries;
     try {
-      entries = readdirSync6(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+      entries = readdirSync7(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
     } catch {
       excluded += 1;
       continue;
     }
     for (const entry of entries) {
-      const absolutePath = join9(directory, entry.name);
+      const absolutePath = join10(directory, entry.name);
       const relativePath = relative2(root, absolutePath).replace(/\\/g, "/");
       if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, relativePath) || classifyProjectFileRisk(relativePath, userProtectedPatterns).isHighRisk) {
         excluded += 1;
@@ -74275,7 +74390,7 @@ function assertInsideRoot(sourceRoot, path2) {
 }
 function openedDescriptorPath(descriptor, requestedPath) {
   const procPath = `/proc/self/fd/${descriptor}`;
-  if (existsSync11(procPath)) return realpathSync(procPath);
+  if (existsSync12(procPath)) return realpathSync(procPath);
   return realpathSync(requestedPath);
 }
 function isBinaryFile(path2) {
@@ -74307,14 +74422,14 @@ function normalizeBound(value, maximum, label) {
   return result;
 }
 function remoteAccessStorePath(homeDirectory) {
-  return join9(homeDirectory, ".openmates", "remote-sources.json");
+  return join10(homeDirectory, ".openmates", "remote-sources.json");
 }
 function saveRemoteAccessSources(sources, homeDirectory) {
   const filePath = remoteAccessStorePath(homeDirectory);
-  const stateDir2 = join9(homeDirectory, ".openmates");
-  mkdirSync7(stateDir2, { recursive: true, mode: 448 });
+  const stateDir2 = join10(homeDirectory, ".openmates");
+  mkdirSync8(stateDir2, { recursive: true, mode: 448 });
   chmodSync6(stateDir2, 448);
-  writeFileSync7(filePath, `${JSON.stringify({ sources }, null, 2)}
+  writeFileSync8(filePath, `${JSON.stringify({ sources }, null, 2)}
 `, { mode: 384 });
   chmodSync6(filePath, 384);
 }
@@ -74522,13 +74637,13 @@ function remoteErrorMessage(code) {
 
 // src/selfUpdate.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { readFileSync as readFileSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8, renameSync as renameSync4 } from "fs";
+import { readFileSync as readFileSync11, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, renameSync as renameSync5 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname8, basename as basename3, join as join10 } from "path";
+import { dirname as dirname8, basename as basename3, join as join11 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_NAME = "openmates";
 function channelFile() {
-  return join10(homedir8(), ".openmates", "updates.json");
+  return join11(homedir8(), ".openmates", "updates.json");
 }
 function parseChannel(value) {
   if (value === "dev") return "dev";
@@ -74537,7 +74652,7 @@ function parseChannel(value) {
 }
 function savedChannel() {
   try {
-    return parseChannel(JSON.parse(readFileSync10(channelFile(), "utf8")).channel);
+    return parseChannel(JSON.parse(readFileSync11(channelFile(), "utf8")).channel);
   } catch (error) {
     if (error.code === "ENOENT") {
       return getCliPackageVersion().includes("-") ? "dev" : "stable";
@@ -74548,10 +74663,10 @@ function savedChannel() {
 function persistSelfUpdateChannel(plan) {
   if (plan.dryRun || !plan.persistChannel) return;
   const path2 = channelFile();
-  mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
+  mkdirSync9(dirname8(path2), { recursive: true, mode: 448 });
   const temporary = `${path2}.${process.pid}.tmp`;
-  writeFileSync8(temporary, JSON.stringify({ channel: plan.channel }) + "\n", { mode: 384 });
-  renameSync4(temporary, path2);
+  writeFileSync9(temporary, JSON.stringify({ channel: plan.channel }) + "\n", { mode: 384 });
+  renameSync5(temporary, path2);
 }
 function installedNpmPrefix(moduleUrl = import.meta.url, platform4 = process.platform) {
   const packageRoot = dirname8(dirname8(fileURLToPath2(moduleUrl)));
@@ -74583,7 +74698,7 @@ function compareVersions(left, right) {
 var SAFE_TARGET_RE = /^[a-zA-Z0-9._@+~:-]+$/;
 function getCliPackageVersion() {
   try {
-    const packageJson = JSON.parse(readFileSync10(new URL("../package.json", import.meta.url), "utf-8"));
+    const packageJson = JSON.parse(readFileSync11(new URL("../package.json", import.meta.url), "utf-8"));
     return packageJson.version ?? "unknown";
   } catch {
     return "unknown";
@@ -74707,7 +74822,7 @@ function commandName(name) {
 }
 
 // src/workRecovery.ts
-import { mkdirSync as mkdirSync9, renameSync as renameSync5, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, renameSync as renameSync6, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname9 } from "path";
 import { stringify } from "yaml";
 async function projectPlanAssumption(plan, masterKey, assumption) {
@@ -74887,18 +75002,18 @@ function collectMismatchPaths(left, right, path2, mismatches) {
 }
 function writeWorkRecoveryAtomically(path2, document) {
   validateWorkRecoveryDocument(document);
-  mkdirSync9(dirname9(path2), { recursive: true, mode: 448 });
+  mkdirSync10(dirname9(path2), { recursive: true, mode: 448 });
   const temporaryPath = `${path2}.tmp`;
-  writeFileSync9(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
-  renameSync5(temporaryPath, path2);
+  writeFileSync10(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
+  renameSync6(temporaryPath, path2);
 }
 
 // src/revolutBusinessCertificate.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createSign, randomUUID as randomUUID14 } from "crypto";
-import { chmodSync as chmodSync7, existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync11 } from "fs";
+import { chmodSync as chmodSync7, existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join11, resolve as resolve10 } from "path";
+import { join as join12, resolve as resolve10 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
 var REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI = "https://app.dev.openmates.org/oauth/revolut-business/callback";
 var REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI = "https://openmates.org/oauth/revolut-business/callback";
@@ -74908,7 +75023,7 @@ var REVOLUT_BUSINESS_AUDIENCE = "https://revolut.com";
 var CERTIFICATE_DAYS = "1825";
 var RSA_BITS = "2048";
 function defaultRevolutBusinessCertificateDir(environment) {
-  return join11(homedir9(), ".openmates", "revolut-business", environment);
+  return join12(homedir9(), ".openmates", "revolut-business", environment);
 }
 function defaultRevolutBusinessRedirectUri(environment) {
   return environment === "sandbox" ? REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI : REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI;
@@ -74931,7 +75046,7 @@ async function exchangeRevolutBusinessAuthorizationCode(options) {
   if (!clientId) throw new Error("Missing Revolut Business client ID.");
   const code = extractRevolutBusinessAuthorizationCode(options.codeOrRedirectUrl);
   if (!code) throw new Error("Missing Revolut Business authorization code.");
-  const privateKeyPem = options.privateKeyPem ?? readFileSync11(options.privateKeyPath ?? join11(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
+  const privateKeyPem = options.privateKeyPem ?? readFileSync12(options.privateKeyPath ?? join12(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   const clientAssertion = generateRevolutBusinessClientAssertion({ clientId, privateKeyPem, redirectUri });
   const response = await fetch(environment === "sandbox" ? "https://sandbox-b2b.revolut.com/api/1.0/auth/token" : "https://b2b.revolut.com/api/1.0/auth/token", {
@@ -74984,11 +75099,11 @@ function generateRevolutBusinessCertificate(options = {}) {
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   if (!title) throw new Error("Revolut certificate title must not be empty.");
   if (!redirectUri.startsWith("https://")) throw new Error("Revolut OAuth redirect URI must start with https://.");
-  mkdirSync10(outputDir, { recursive: true, mode: 448 });
+  mkdirSync11(outputDir, { recursive: true, mode: 448 });
   chmodSync7(outputDir, 448);
-  const privateKeyPath = join11(outputDir, "privatecert.pem");
-  const publicCertificatePath = join11(outputDir, "publiccert.cer");
-  if (!options.overwrite && (existsSync12(privateKeyPath) || existsSync12(publicCertificatePath))) {
+  const privateKeyPath = join12(outputDir, "privatecert.pem");
+  const publicCertificatePath = join12(outputDir, "publiccert.cer");
+  if (!options.overwrite && (existsSync13(privateKeyPath) || existsSync13(publicCertificatePath))) {
     throw new Error(`Revolut certificate files already exist in ${outputDir}. Re-run with --overwrite to replace them.`);
   }
   try {
@@ -75022,7 +75137,7 @@ function generateRevolutBusinessCertificate(options = {}) {
     outputDir,
     privateKeyPath,
     publicCertificatePath,
-    publicCertificatePem: readFileSync11(publicCertificatePath, "utf8").trim()
+    publicCertificatePem: readFileSync12(publicCertificatePath, "utf8").trim()
   };
 }
 function escapeOpenSslSubjectValue(value) {
@@ -75559,35 +75674,55 @@ async function handleTasks(client, subcommand, rest, flags, redactor) {
     const action = rest[0] ?? "list";
     const task = await requiredResolvedTask(client, masterKey, rest[1], scope, `activity ${action}`);
     const context = { teamId: scope.teamId, personal: scope.personal };
-    if (action === "list") {
-      const records = [];
-      let cursor;
-      do {
-        const page = await client.listUserTaskActivity(task.taskId, {
-          ...context,
-          cursor,
-          limit: typeof flags.limit === "string" ? Number(flags.limit) : void 0
-        });
-        records.push(...page.entries);
-        cursor = page.next_cursor ?? void 0;
-      } while (cursor);
-      const entries = await decryptTaskActivityEntries(task, masterKey, records);
-      if (flags.json === true) printJson2({ entries: entries.map(taskActivityToJson) });
-      else console.log(renderTaskActivityList(entries));
+    const actor = flags["as-assignee"] === true ? "assignee" : "user";
+    const delivery = () => activityDeliveryStore(JSON.stringify([
+      client.getSession().apiUrl,
+      client.getSession().hashedEmail,
+      scope.teamId || "personal",
+      task.taskId,
+      actor
+    ]));
+    const createActivity = (input) => client.createUserTaskActivity(task.taskId, input, {
+      ...context,
+      ...actor === "assignee" ? { actorMode: "assignee" } : {}
+    });
+    if (action === "flush") {
+      printJson2(await delivery().flush(createActivity));
+      return;
+    }
+    if (action === "list" || action === "search") {
+      const pending = flags["flush-pending"] === true ? await delivery().flush(createActivity) : void 0;
+      const history = await readActivityHistory({
+        maxEntries: typeof flags["max-entries"] === "string" ? Number(flags["max-entries"]) : action === "search" ? 200 : void 0,
+        pageSize: typeof flags.limit === "string" ? Number(flags.limit) : 100,
+        cursor: typeof flags.cursor === "string" ? flags.cursor : void 0,
+        ...action === "search" ? { query: typeof flags.query === "string" ? flags.query : "" } : {},
+        page: async (cursor, limit) => {
+          const page = await client.listUserTaskActivity(task.taskId, {
+            ...context,
+            cursor,
+            limit,
+            newestFirst: flags["newest-first"] === true
+          });
+          return { entries: await decryptTaskActivityEntries(task, masterKey, page.entries), next_cursor: page.next_cursor };
+        }
+      });
+      if (flags.json === true) printJson2({ ...history, entries: history.entries.map(taskActivityToJson), delivery: pending });
+      else {
+        console.log(renderTaskActivityList(history.entries));
+        if (history.truncated) console.log(`Activity history truncated. Search all history: openmates tasks activity search ${task.shortId} --query "text" --max-entries 200`);
+        if (history.next_cursor) console.log(`Next cursor: ${history.next_cursor}`);
+      }
       return;
     }
     if (action === "add") {
       const message = typeof flags.message === "string" ? flags.message : rest.slice(2).join(" ");
       if (!message.trim()) throw new Error("Missing comment. Usage: openmates tasks activity add <task-id> --message <text>");
-      const input = await buildCreateTaskActivityInput(task, masterKey, { message });
-      const entry = await decryptTaskActivityEntry(
-        task,
-        masterKey,
-        await client.createUserTaskActivity(task.taskId, input, {
-          ...context,
-          ...flags["as-assignee"] === true ? { actorMode: "assignee" } : {}
-        })
-      );
+      const deliveryId = typeof flags["delivery-id"] === "string" ? flags["delivery-id"] : void 0;
+      const build = () => buildCreateTaskActivityInput(task, masterKey, { message, ...deliveryId ? { entryId: deliveryId } : {} });
+      const record = deliveryId ? await delivery().deliver(deliveryId, build, createActivity) : await createActivity(await build());
+      const entry = await decryptTaskActivityEntry(task, masterKey, record);
+      if (entry.message !== message) throw new Error("Activity delivery id already belongs to a different milestone message");
       if (flags.json === true) printJson2({ entry: taskActivityToJson(entry) });
       else console.log(renderTaskActivityList([entry]));
       return;
@@ -75604,7 +75739,7 @@ async function handleTasks(client, subcommand, rest, flags, redactor) {
       else console.log(renderTaskActivityList([entry]));
       return;
     }
-    throw new Error("Usage: openmates tasks activity list|add|delete <task-id> [<entry-id>] [--message <text>]");
+    throw new Error("Usage: openmates tasks activity list|search|add|flush|delete <task-id> [<entry-id>] [--message <text>]");
   }
   if (rest[0] === "add-to-project") {
     rejectRemoteCopyFlags(flags);
@@ -76540,7 +76675,7 @@ async function handlePlans(client, subcommand, rest, flags, redactor) {
     if (action === "diff") throw new Error("Revision diffs are reviewed in the authenticated web review page; use submit-for-review to print its URL.");
     if (action !== "submit-for-review") throw new Error("Usage: openmates plans revisions list|submit-for-review|status|diff <plan-id>");
     const snapshot = JSON.stringify(planToJson(plan));
-    const revision = await client.submitPlanRevision(plan.planId, { fingerprint: createHash14("sha256").update(snapshot).digest("hex"), encrypted_snapshot: await encryptPlanAssumptionSources(plan, masterKey, snapshot), created_at: nowSeconds3() });
+    const revision = await client.submitPlanRevision(plan.planId, { fingerprint: createHash15("sha256").update(snapshot).digest("hex"), encrypted_snapshot: await encryptPlanAssumptionSources(plan, masterKey, snapshot), created_at: nowSeconds3() });
     const reviewUrl = `${deriveAppUrl(client.apiUrl)}/plans/${plan.planId}/review?revision=${revision.revision_id}`;
     if (flags.json === true) printJson2({ revision, review_url: reviewUrl });
     else console.log(`Plan revision submitted for web review: ${reviewUrl}`);
@@ -77096,8 +77231,8 @@ async function handleWorkRecovery(client, subcommand, rest, flags) {
   }
   if (subcommand === "validate" || subcommand === "restore") {
     const path2 = requiredStringFlag(flags.file ?? rest[0], "--file <projection.yml>");
-    if (!existsSync13(path2)) throw new Error(`Recovery projection does not exist: ${path2}`);
-    const document = parseYaml(readFileSync12(path2, "utf8"));
+    if (!existsSync14(path2)) throw new Error(`Recovery projection does not exist: ${path2}`);
+    const document = parseYaml(readFileSync13(path2, "utf8"));
     validateWorkRecoveryDocument(document);
     if (subcommand === "validate") {
       if (flags.json === true) printJson2({ valid: true });
@@ -77445,7 +77580,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
       last_opened_at: timestamp,
       key_wrappers: wrapping.teamId ? [{
         key_type: "team",
-        hashed_team_id: createHash14("sha256").update(wrapping.teamId).digest("hex"),
+        hashed_team_id: createHash15("sha256").update(wrapping.teamId).digest("hex"),
         team_key_epoch: 1,
         encrypted_project_key: await encryptBytesWithAesGcm(projectKey, wrapping.key),
         wrapper_version: 1,
@@ -77928,7 +78063,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     if (action === "get") {
       const output = requiredStringFlag(flags.output ?? flags.file ?? rest[2], "--output <path>");
       const image = await client.getTeamProfileImage(teamId);
-      writeFileSync10(output, image.data, { mode: 384 });
+      writeFileSync11(output, image.data, { mode: 384 });
       if (flags.json === true) printJson2({ output, content_type: image.contentType, size_bytes: image.data.byteLength });
       else console.log(`Team profile image written: ${output}`);
       return;
@@ -78087,7 +78222,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     const output = requiredStringFlag(flags.output, "--output <path>");
     const result = await client.exportTeamData(teamId);
     const artifact = result.artifact && typeof result.artifact === "object" ? result.artifact : result;
-    writeFileSync10(output, `${JSON.stringify(artifact, null, 2)}
+    writeFileSync11(output, `${JSON.stringify(artifact, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
     if (flags.json === true) printJson2({ ...result, output });
     else console.log(`Team export written: ${output}`);
@@ -78095,7 +78230,7 @@ async function handleTeams(client, subcommand, rest, flags) {
   }
   if (subcommand === "import") {
     const file = requiredStringFlag(flags.file ?? rest[0], "--file <path>");
-    const artifact = JSON.parse(readFileSync12(file, "utf-8"));
+    const artifact = JSON.parse(readFileSync13(file, "utf-8"));
     let teamId = typeof flags.team === "string" ? flags.team : typeof flags["destination-team"] === "string" ? flags["destination-team"] : void 0;
     if (!teamId && typeof flags["new-team-name"] === "string") {
       const team = await client.createTeam({ name: flags["new-team-name"] });
@@ -78592,7 +78727,7 @@ async function createEncryptedRemoteAccessProject(client, masterKey, name, conte
     last_opened_at: timestamp,
     key_wrappers: wrapping.teamId ? [{
       key_type: "team",
-      hashed_team_id: createHash14("sha256").update(wrapping.teamId).digest("hex"),
+      hashed_team_id: createHash15("sha256").update(wrapping.teamId).digest("hex"),
       team_key_epoch: 1,
       encrypted_project_key: await encryptBytesWithAesGcm(projectKey, wrapping.key),
       wrapper_version: 1,
@@ -79392,16 +79527,16 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       }
     }
     const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-    const { join: join12 } = await import("path");
+    const { join: join13 } = await import("path");
     if (useZip) {
-      const tmpDir = join12(outputDir, `.${filenameBase}_tmp`);
+      const tmpDir = join13(outputDir, `.${filenameBase}_tmp`);
       await mkdir2(tmpDir, { recursive: true });
-      await writeFile2(join12(tmpDir, `${filenameBase}.yml`), yamlContent);
-      await writeFile2(join12(tmpDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join13(tmpDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join13(tmpDir, `${filenameBase}.md`), mdContent);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join12(tmpDir, "code", fpath);
+          const fullPath = join13(tmpDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79409,13 +79544,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join12(tmpDir, "transcripts");
+        const tDir = join13(tmpDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join12(tDir, te.filename), te.content);
+          await writeFile2(join13(tDir, te.filename), te.content);
         }
       }
-      const zipPath = join12(outputDir, `${filenameBase}.zip`);
+      const zipPath = join13(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
         execSync2(`cd "${tmpDir}" && zip -r "${zipPath}" .`, { stdio: "pipe" });
@@ -79430,17 +79565,17 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         );
       }
     } else {
-      const chatDir = join12(outputDir, filenameBase);
+      const chatDir = join13(outputDir, filenameBase);
       await mkdir2(chatDir, { recursive: true });
       const written = [];
-      await writeFile2(join12(chatDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join13(chatDir, `${filenameBase}.yml`), yamlContent);
       written.push(`${filenameBase}.yml`);
-      await writeFile2(join12(chatDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join13(chatDir, `${filenameBase}.md`), mdContent);
       written.push(`${filenameBase}.md`);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join12(chatDir, "code", fpath);
+          const fullPath = join13(chatDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79449,10 +79584,10 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join12(chatDir, "transcripts");
+        const tDir = join13(chatDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join12(tDir, te.filename), te.content);
+          await writeFile2(join13(tDir, te.filename), te.content);
           written.push(`transcripts/${te.filename}`);
         }
       }
@@ -79488,7 +79623,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       printJson2({
         chat_id: chat.id,
         title: chat.title,
-        output_dir: useZip ? join12(outputDir, `${filenameBase}.zip`) : join12(outputDir, filenameBase),
+        output_dir: useZip ? join13(outputDir, `${filenameBase}.zip`) : join13(outputDir, filenameBase),
         files,
         code_embeds: codeEmbeds.length,
         transcript_embeds: transcriptEmbeds.length
@@ -79808,7 +79943,7 @@ function normalizeApiKeyLoadedChat(payload) {
   const messages = rawMessages.map((message) => {
     const messageId = String(message.client_message_id ?? message.message_id ?? message.id ?? "");
     const directEmbedIds = Array.isArray(message.embedIds) ? message.embedIds : Array.isArray(message.embed_ids) ? message.embed_ids : [];
-    const hashedMessageId = messageId ? createHash14("sha256").update(messageId).digest("hex") : null;
+    const hashedMessageId = messageId ? createHash15("sha256").update(messageId).digest("hex") : null;
     const matchedEmbedIds = hashedMessageId ? rawEmbeds.filter((embed) => embed.hashed_message_id === hashedMessageId && !embed.parent_embed_id).map((embed) => String(embed.embed_id ?? embed.id ?? "")).filter(Boolean) : [];
     return {
       id: messageId,
@@ -80014,7 +80149,7 @@ async function handleWorkflows(client, subcommand, rest, flags, redactor) {
   if (subcommand === "validate") {
     const file = typeof flags.file === "string" ? flags.file : "";
     if (!file) throw new Error("Missing --file. Example: openmates workflows validate --file workflow.yml");
-    const validation = await client.validateWorkflowYaml(readFileSync12(file, "utf8"));
+    const validation = await client.validateWorkflowYaml(readFileSync13(file, "utf8"));
     if (flags.json === true) {
       printJson2(validation);
     } else {
@@ -80030,7 +80165,7 @@ async function handleWorkflows(client, subcommand, rest, flags, redactor) {
   if (subcommand === "create") {
     const yamlFile = typeof flags.file === "string" ? flags.file : "";
     if (yamlFile) {
-      const result = await client.createWorkflowYaml(readFileSync12(yamlFile, "utf8"));
+      const result = await client.createWorkflowYaml(readFileSync13(yamlFile, "utf8"));
       if (flags.json === true) {
         printJson2(result);
       } else {
@@ -80064,7 +80199,7 @@ async function handleWorkflows(client, subcommand, rest, flags, redactor) {
     const workflowId = rest[0] ? await requiredResolvedWorkflowId(client, rest[0], flags, "update") : void 0;
     const yamlFile = typeof flags.file === "string" ? flags.file : "";
     if (!workflowId || !yamlFile) throw new Error("Missing workflow ID or --file. Example: openmates workflows update <id> --file workflow.yml");
-    const result = await client.updateWorkflowYaml(workflowId, readFileSync12(yamlFile, "utf8"));
+    const result = await client.updateWorkflowYaml(workflowId, readFileSync13(yamlFile, "utf8"));
     if (typeof flags.slug === "string") {
       result.workflow = await client.updateWorkflow(result.workflow.id, { slug: flags.slug });
     }
@@ -80666,7 +80801,7 @@ function buildCodeImageToHtmlRequest(positionals, flags) {
     );
   }
   const request = {
-    image_base64: readFileSync12(file).toString("base64"),
+    image_base64: readFileSync13(file).toString("base64"),
     mime_type: inferImageToHtmlMimeType(file),
     filename: file.split(/[\\/]/).pop() ?? file
   };
@@ -81545,7 +81680,7 @@ async function handleEmbeds(client, subcommand, rest, flags) {
         throw new Error("Embed version content was not available after local reconstruction.");
       }
       if (typeof flags.output === "string") {
-        writeFileSync10(flags.output, result.content, "utf-8");
+        writeFileSync11(flags.output, result.content, "utf-8");
         if (flags.json === true) {
           printJson2({ ...result, output: flags.output });
         } else {
@@ -82204,10 +82339,10 @@ function parseYamlScalar(value) {
 }
 async function saveDownloadedDocument(document, output) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join12, basename: basename5, dirname: dirname11 } = await import("path");
+  const { join: join13, basename: basename5, dirname: dirname11 } = await import("path");
   const target = typeof output === "string" ? output : ".";
   const filename = basename5(document.filename || "document.pdf");
-  const filePath = target.endsWith(".pdf") ? target : join12(target, filename);
+  const filePath = target.endsWith(".pdf") ? target : join13(target, filename);
   await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, document.data);
   return filePath;
@@ -82380,7 +82515,7 @@ async function handleFinance(client, subcommand, _rest, flags) {
 }
 function readFinanceCsvStatements(flags) {
   const paths = parseCsvFlag(flags.csv) ?? [];
-  return paths.map((filePath) => ({ filename: basename4(filePath), content: readFileSync12(filePath, "utf8") }));
+  return paths.map((filePath) => ({ filename: basename4(filePath), content: readFileSync13(filePath, "utf8") }));
 }
 function buildFinanceCheckAccountsInput(flags, csvStatements, connectedAccount) {
   const input = {
@@ -82609,7 +82744,7 @@ async function handleRevolutBusinessConnect(client, rest, flags) {
   if (!clientId.trim()) throw new Error("ClientID is required to connect Revolut Business.");
   const code = providedCode || await promptPlainText("Code from OpenMates callback page: ");
   if (!code.trim()) throw new Error("Authorization code is required to connect Revolut Business.");
-  const privateKeyPem = readFileSync12(result.privateKeyPath, "utf8");
+  const privateKeyPem = readFileSync13(result.privateKeyPath, "utf8");
   const setup = await client.exchangeRevolutBusinessSetupCode({
     clientId: clientId.trim(),
     code: code.trim(),
@@ -86197,8 +86332,10 @@ function printTasksHelp() {
   openmates tasks reorder <task-id|short-id> [--before <task-id>] [--after <task-id>] [--position <n>] [--status <status>] [--json]
   openmates tasks dependencies list <task-id|short-id> [--json]
   openmates tasks dependencies add|remove <task-id|short-id> --target plan:<id>|task:<id> [--recovery-root <external-root>] [--json]
-  openmates tasks activity list <task-id|short-id> [--limit <n>] [--json]
-  openmates tasks activity add <task-id|short-id> --message <text> [--as-assignee] [--json]
+  openmates tasks activity list <task-id|short-id> [--max-entries <1-200>] [--cursor <cursor>] [--newest-first] [--json]
+  openmates tasks activity search <task-id|short-id> --query <text> [--max-entries <1-200>] [--json]
+  openmates tasks activity add <task-id|short-id> --message <text> [--as-assignee] [--delivery-id <sha256>] [--json]
+  openmates tasks activity flush <task-id|short-id> [--as-assignee] [--json]
   openmates tasks activity delete <task-id|short-id> <entry-id> [--json]
 
 Chat-scoped aliases:
@@ -86668,7 +86805,7 @@ async function handleDocs(client, subcommand, rest, flags) {
   }
   if (subcommand === "download") {
     const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-    const { join: join12, dirname: dirname11 } = await import("path");
+    const { join: join13, dirname: dirname11 } = await import("path");
     if (flags.all === true) {
       const outputDir = typeof flags.output === "string" ? flags.output : "./openmates-docs";
       const tree = await client.listDocs();
@@ -86677,7 +86814,7 @@ async function handleDocs(client, subcommand, rest, flags) {
       let count = 0;
       for (const slug2 of slugs) {
         const content2 = await client.getDoc(slug2);
-        const filePath = join12(outputDir, `${slug2}.md`);
+        const filePath = join13(outputDir, `${slug2}.md`);
         await mkdir2(dirname11(filePath), { recursive: true });
         await writeFile2(filePath, content2, "utf-8");
         count++;