openmates 0.27.0-alpha.61 → 0.27.0-alpha.63

package/dist/{chunk-OR3BDIWR.js → chunk-D6TL3ILK.js}

@@ -8,6 +8,7 @@ import {
   getCredentialStorageMode,
   installPrivacyModel,
   loadAnonymousId,
+  loadCachedDirectChatAccountKey,
   loadLocalTeamKey,
   loadSession,
   loadStoredSessionApiUrl,
@@ -25,6 +26,7 @@ import {
   readPrivacyPreferences,
   resolveStateDir,
   saveAnonymousId,
+  saveCachedDirectChatAccountKey,
   saveLocalTeamKey,
   saveSession,
   saveSyncCache,
@@ -34,7 +36,7 @@ import {
   verifyInstalledModel,
   verifyPrivacyRuntime,
   withSessionRefreshLock
-} from "./chunk-5SFXCJJ4.js";
+} from "./chunk-Q6PGA2B3.js";
 import {
   RemoteAccessReplayGuard,
   createRemoteAccessHandshake,
@@ -1634,6 +1636,183 @@ async function prepareCliMessagePrivacy(text7, memories, existing = [], scope2 =
 
 // src/client.ts
 import { createHash as createHash13, randomBytes as randomBytes4, randomUUID as randomUUID9, timingSafeEqual } from "crypto";
+
+// ../pairing-crypto/src/directChatCrypto.ts
+import nacl from "tweetnacl";
+var PREFIX = "OMDM1.";
+var MAX_ENVELOPE_LENGTH = 2048;
+var MAX_PAYLOAD_BYTES = 768;
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var KEY_ID = /^[0-9a-f]{64}$/;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function ownedBuffer(bytes2) {
+  const copy = new Uint8Array(bytes2.length);
+  copy.set(bytes2);
+  return copy.buffer;
+}
+function directChatBase64Url(bytes2) {
+  let binary = "";
+  for (let offset = 0; offset < bytes2.length; offset += 8192) {
+    binary += String.fromCharCode(...bytes2.subarray(offset, offset + 8192));
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function directChatBase64UrlBytes(value, length, field3 = "key", maxLength = length ?? MAX_PAYLOAD_BYTES) {
+  if (typeof value !== "string" || value.length < 1 || value.length > Math.ceil(maxLength * 4 / 3) + 2 || !BASE64URL.test(value)) {
+    throw new Error(`Invalid direct-chat ${field3}`);
+  }
+  let decoded;
+  try {
+    const binary = atob(value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4));
+    decoded = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    throw new Error(`Invalid direct-chat ${field3}`);
+  }
+  if (length !== void 0 && decoded.length !== length || decoded.length > maxLength || directChatBase64Url(decoded) !== value) throw new Error(`Invalid direct-chat ${field3}`);
+  return decoded;
+}
+function boundedIdentity(identity3) {
+  if (!identity3 || typeof identity3 !== "object") throw new Error("Invalid direct-chat identity");
+  for (const value of [identity3.teamId, identity3.chatId, identity3.recipientHash]) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 128 || !/^[A-Za-z0-9_-]+$/.test(value)) {
+      throw new Error("Invalid direct-chat identity");
+    }
+  }
+  if (!KEY_ID.test(identity3.keyId)) throw new Error("Invalid direct-chat key ID");
+}
+function validNonzeroKey(value, field3) {
+  if (value.length !== 32 || value.every((byte) => byte === 0)) throw new Error(`Invalid direct-chat ${field3}`);
+}
+function validatePublicKey(value) {
+  const bytes2 = directChatBase64UrlBytes(value, 32, "public key");
+  validNonzeroKey(bytes2, "public key");
+  const probe = nacl.scalarMult(new Uint8Array(32).fill(7), bytes2);
+  if (probe.every((byte) => byte === 0)) throw new Error("Invalid direct-chat public key");
+  return bytes2;
+}
+async function directChatKeyId(publicKey) {
+  const bytes2 = validatePublicKey(publicKey);
+  const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer(bytes2)));
+  return [...digest4].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function generateIdentity() {
+  const pair = nacl.box.keyPair();
+  const publicKey = directChatBase64Url(pair.publicKey);
+  return { publicKey, privateKey: directChatBase64Url(pair.secretKey), keyId: await directChatKeyId(publicKey) };
+}
+async function sealDirectChatKey(rawKey, identity3, recipientPublicKey) {
+  boundedIdentity(identity3);
+  validNonzeroKey(rawKey, "chat key");
+  const recipient = validatePublicKey(recipientPublicKey);
+  if (identity3.keyId !== await directChatKeyId(recipientPublicKey)) throw new Error("Direct-chat recipient key ID mismatch");
+  const ephemeral = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(24);
+  const payload = encoder.encode(JSON.stringify({
+    v: 1,
+    team_id: identity3.teamId,
+    chat_id: identity3.chatId,
+    recipient_hash: identity3.recipientHash,
+    key_id: identity3.keyId,
+    key: directChatBase64Url(rawKey)
+  }));
+  const ciphertext = nacl.box(payload, nonce, recipient, ephemeral.secretKey);
+  const envelope = PREFIX + directChatBase64Url(encoder.encode(JSON.stringify({
+    v: 1,
+    ephemeral_public_key: directChatBase64Url(ephemeral.publicKey),
+    nonce: directChatBase64Url(nonce),
+    ciphertext: directChatBase64Url(ciphertext)
+  })));
+  ephemeral.secretKey.fill(0);
+  if (envelope.length > MAX_ENVELOPE_LENGTH) throw new Error("Direct-chat envelope too large");
+  return envelope;
+}
+async function openDirectChatKey(envelope, expected, privateKey) {
+  boundedIdentity(expected);
+  if (typeof envelope !== "string" || !envelope.startsWith(PREFIX) || envelope.length > MAX_ENVELOPE_LENGTH) {
+    throw new Error("Invalid direct-chat envelope");
+  }
+  const encoded = envelope.slice(PREFIX.length);
+  const decoded = directChatBase64UrlBytes(encoded, void 0, "envelope");
+  if (decoded.length > MAX_PAYLOAD_BYTES) throw new Error("Direct-chat envelope too large");
+  let parsed;
+  try {
+    parsed = JSON.parse(decoder.decode(decoded));
+  } catch {
+    throw new Error("Invalid direct-chat envelope");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid direct-chat envelope");
+  const outer = parsed;
+  if (Object.keys(outer).sort().join(",") !== "ciphertext,ephemeral_public_key,nonce,v" || outer.v !== 1) {
+    throw new Error("Invalid direct-chat envelope version or fields");
+  }
+  const sender = validatePublicKey(String(outer.ephemeral_public_key));
+  const nonce = directChatBase64UrlBytes(String(outer.nonce), 24, "nonce");
+  const ciphertext = directChatBase64UrlBytes(String(outer.ciphertext), void 0, "ciphertext", 512);
+  if (ciphertext.length < 17) throw new Error("Invalid direct-chat ciphertext");
+  const secret = directChatBase64UrlBytes(privateKey, 32, "private key");
+  validNonzeroKey(secret, "private key");
+  const ownPublic = directChatBase64Url(nacl.scalarMult.base(secret));
+  if (await directChatKeyId(ownPublic) !== expected.keyId) throw new Error("Direct-chat private key ID mismatch");
+  const plaintext = nacl.box.open(ciphertext, nonce, sender, secret);
+  if (!plaintext) throw new Error("Direct-chat key authentication failed");
+  let inner;
+  try {
+    inner = JSON.parse(decoder.decode(plaintext));
+  } catch {
+    throw new Error("Invalid direct-chat key payload");
+  }
+  if (!inner || typeof inner !== "object" || Array.isArray(inner)) throw new Error("Invalid direct-chat key payload");
+  const payload = inner;
+  if (Object.keys(payload).sort().join(",") !== "chat_id,key,key_id,recipient_hash,team_id,v" || payload.v !== 1 || payload.team_id !== expected.teamId || payload.chat_id !== expected.chatId || payload.recipient_hash !== expected.recipientHash || payload.key_id !== expected.keyId) {
+    throw new Error("Direct-chat key binding mismatch");
+  }
+  const key = directChatBase64UrlBytes(String(payload.key), 32, "chat key");
+  validNonzeroKey(key, "chat key");
+  return key;
+}
+
+// src/directChats.ts
+function validatePublicChatEncryptionKey(value) {
+  const row3 = value;
+  if (!row3 || typeof row3.public_key !== "string" || typeof row3.key_id !== "string" || !/^[0-9a-f]{64}$/.test(row3.key_id)) {
+    throw new Error("Invalid member chat encryption key");
+  }
+  directChatBase64UrlBytes(row3.public_key, 32, "public key");
+  return { key_id: row3.key_id, public_key: row3.public_key };
+}
+async function validatePublicChatEncryptionKeyId(value) {
+  const key = validatePublicChatEncryptionKey(value);
+  if (await directChatKeyId(key.public_key) !== key.key_id) throw new Error("Member chat encryption key ID mismatch");
+  return key;
+}
+async function recoverAccountChatIdentity(record10, masterKey) {
+  if (record10.version !== 1 || record10.algorithm !== "x25519-xsalsa20poly1305") throw new Error("Unsupported account chat encryption key");
+  const publicKey = await validatePublicChatEncryptionKeyId(record10);
+  if (typeof record10.encrypted_private_key !== "string" || record10.encrypted_private_key.length > 2048) throw new Error("Invalid account chat private key backup");
+  const encoded = record10.encrypted_private_key;
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(encoded)) throw new Error("Invalid account chat private key backup");
+  const privateKey = await decryptWithAesGcmCombined(Buffer.from(encoded, "base64url").toString("base64"), masterKey);
+  if (!privateKey) throw new Error("Could not decrypt account chat private key");
+  const secret = directChatBase64UrlBytes(privateKey, 32, "private key");
+  if (secret.every((byte) => byte === 0)) throw new Error("Invalid account chat private key");
+  const nacl2 = (await import("tweetnacl")).default;
+  if (directChatBase64Url(nacl2.scalarMult.base(secret)) !== publicKey.public_key) throw new Error("Account chat key pair mismatch");
+  return { publicKey: publicKey.public_key, privateKey, keyId: publicKey.key_id };
+}
+async function createAccountChatIdentity(masterKey) {
+  const identity3 = await generateIdentity();
+  const backup = await encryptWithAesGcmCombined(identity3.privateKey, masterKey);
+  return { identity: identity3, record: {
+    version: 1,
+    algorithm: "x25519-xsalsa20poly1305",
+    key_id: identity3.keyId,
+    public_key: identity3.publicKey,
+    encrypted_private_key: Buffer.from(backup, "base64").toString("base64url")
+  } };
+}
+
+// src/client.ts
 import { arch, platform, release } from "os";
 import { createInterface as createInterface3 } from "readline/promises";
 import { stdin as stdin2, stdout } from "process";
@@ -2475,13 +2654,13 @@ var OpenMatesHttpClient = class {
       throw new Error("SSE response body is not readable");
     }
     const reader = response.body.getReader();
-    const decoder2 = new TextDecoder();
+    const decoder3 = new TextDecoder();
     let buffer = "";
     try {
       while (true) {
         const { done, value } = await reader.read();
         if (done) break;
-        buffer += decoder2.decode(value, { stream: true });
+        buffer += decoder3.decode(value, { stream: true });
         let separatorIndex = buffer.indexOf("\n\n");
         while (separatorIndex >= 0) {
           const rawEvent = buffer.slice(0, separatorIndex);
@@ -2701,12 +2880,12 @@ import { randomUUID as randomUUID3 } from "crypto";
 
 // ../ui/src/utils/projectIgnoredReadGrant.ts
 var GRANT_LIFETIME_MS = 5 * 60 * 1e3;
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 function validScope(scope2) {
   return [scope2.projectId, scope2.sourceId, scope2.requestId, scope2.chatId, scope2.operationId].every((value) => typeof value === "string" && value.length > 0 && value.length <= 128) && typeof scope2.path === "string" && scope2.path.length > 0 && scope2.path.length <= 4096 && !scope2.path.includes("\\") && !scope2.path.startsWith("/") && !/^[a-z]:/i.test(scope2.path) && !Array.from(scope2.path).some((value) => value.charCodeAt(0) < 32 || value.charCodeAt(0) === 127) && scope2.path.split("/").every((part) => part && part !== "." && part !== "..");
 }
 function material(grant) {
-  return encoder.encode(JSON.stringify([
+  return encoder2.encode(JSON.stringify([
     "openmates-ignored-read-v1",
     grant.projectId,
     grant.sourceId,
@@ -3923,6 +4102,14 @@ async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId
       hashed_user_id: hashedUserId,
       file_path: embed.filePath,
       content_hash: embed.contentHash,
+      ...embed.appId && embed.skillId ? {
+        app_id: embed.appId,
+        skill_id: embed.skillId,
+        root_embed_id: embed.embedId,
+        workspace_origin: "chat"
+      } : {},
+      ...embed.versionNumber ? { version_number: embed.versionNumber } : {},
+      encryption_mode: "client",
       text_length_chars: embed.textLengthChars,
       created_at: nowSeconds3,
       updated_at: nowSeconds3,
@@ -7311,6 +7498,35 @@ import { basename as basename2, extname as extname2, resolve as resolve3 } from
 import { homedir as homedir2 } from "os";
 import { createHash as createHash10 } from "crypto";
 import JSZip2 from "jszip";
+
+// src/diagramHtml.ts
+function inspectDiagramHtml(source) {
+  if (!source || Buffer.byteLength(source, "utf8") > 1024 * 1024) return null;
+  if (!/^\s*<!doctype html\s*>/i.test(source) || !/<html\b[^>]*>[\s\S]*<head\b[^>]*>[\s\S]*<\/head\s*>[\s\S]*<body\b[^>]*>[\s\S]*<svg\b/i.test(source) || !/<\/svg\s*>[\s\S]*<\/body\s*>[\s\S]*<\/html\s*>\s*$/i.test(source) || !/<g\b[^>]*\bdata-om-component\s*=\s*["'][a-z][a-z0-9_-]{0,63}["']/i.test(source)) return null;
+  let checked = source.replace(/\sxmlns(?::[\w-]+)?\s*=\s*["']http:\/\/www\.w3\.org\/[A-Za-z0-9/.-]+["']/gi, "");
+  checked = checked.replace(/<!--[\s\S]*?-->/g, "").replace(/&amp;/gi, "&");
+  checked = checked.replace(/data:font\/woff2;base64,([A-Za-z0-9+/]+={0,2})/gi, (whole, encoded) => {
+    const bytes2 = Buffer.from(encoded, "base64");
+    return bytes2.length > 0 && bytes2.length <= 256 * 1024 && bytes2.subarray(0, 4).toString() === "wOF2" && /@font-face\s*\{[^}]*$/i.test(checked.slice(0, checked.indexOf(whole))) ? "#embedded-font" : "unsafe-font-data";
+  });
+  if (/<!--|-->|<![^d]|<\?|&#|&[a-z][a-z0-9]+;/i.test(checked) || /<\s*\/?\s*(?:script|iframe|frame|object|embed|applet|link|base|img|image|video|audio|source|track|form|input|textarea|select|button|template|portal|foreignobject|animate|set|discard|feimage|math|noscript)\b/i.test(source) || /\s(?:on[a-z]+|srcdoc|src|srcset|poster|data|action|formaction|background|http-equiv)\s*=/i.test(source) || /(?:https?:|file:|javascript:|data:|\/\/|unsafe-font-data)/i.test(checked) || /@\s*(?:import|namespace|document)|expression\s*\(|image-set\s*\(|behavior\s*:|-moz-binding\s*:|\\/i.test(checked)) return null;
+  for (const match of checked.matchAll(/url\(\s*(['"]?)([^)"']+)\1\s*\)/gi)) {
+    if (!/^#[a-z_][\w.:-]{0,119}$/i.test(match[2].trim())) return null;
+  }
+  if (/url\s*\(/i.test(checked.replace(/url\(\s*(['"]?)([^)"']+)\1\s*\)/gi, ""))) return null;
+  const title = /<title\b[^>]*>([^<>]{1,160})<\/title\s*>/i.exec(source)?.[1]?.trim();
+  const viewBox = /<svg\b[^>]*\bviewBox\s*=\s*["']([^"']+)["']/i.exec(source)?.[1];
+  if (!title || !viewBox) return null;
+  const parts = viewBox.trim().split(/[\s,]+/).map(Number);
+  if (parts.length !== 4 || parts.some((n) => !Number.isFinite(n)) || parts[2] < 1 || parts[2] > 8192 || parts[3] < 1 || parts[3] > 8192) return null;
+  const kind = /<svg\b[^>]*\bdata-diagram-kind\s*=\s*["']([a-z][a-z0-9_-]{0,63})["']/i.exec(source)?.[1] ?? /<svg\b[^>]*\bdata-om-diagram\s*=\s*["']([a-z][a-z0-9_-]{0,63})["']/i.exec(source)?.[1] ?? /<meta\b[^>]*\bname\s*=\s*["']diagram-kind["'][^>]*\bcontent\s*=\s*["']([a-z][a-z0-9_-]{0,63})["']/i.exec(source)?.[1] ?? "diagram";
+  const renderWidth = Number(/<html\b[^>]*\bdata-om-render-width\s*=\s*["']([0-9]{1,4})["']/i.exec(source)?.[1] ?? parts[2]);
+  const renderHeight = Number(/<html\b[^>]*\bdata-om-render-height\s*=\s*["']([0-9]{1,4})["']/i.exec(source)?.[1] ?? parts[3]);
+  if (!(renderWidth >= 1 && renderWidth <= 8192 && renderHeight >= 1 && renderHeight <= 8192)) return null;
+  return { title, diagramKind: kind, renderWidth: Math.round(renderWidth), renderHeight: Math.round(renderHeight) };
+}
+
+// src/fileEmbed.ts
 var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
 var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
   ".pem",
@@ -7833,6 +8049,47 @@ function processCodeFile(filePath, filename, redactor) {
       }
     }
     const language = detectLanguage(filename);
+    if (language === "html") {
+      const diagram = inspectDiagramHtml(content);
+      if (diagram) {
+        const embedId2 = generateEmbedId();
+        const embedRef2 = createEmbedRef("diagram_html", `${filename}:${embedId2}`);
+        return {
+          embed: {
+            embedId: embedId2,
+            embedRef: embedRef2,
+            type: "diagram_html",
+            content: toonEncodeContent({
+              type: "diagram_html",
+              app_id: "diagrams",
+              skill_id: "html",
+              html_source: content,
+              title: diagram.title,
+              diagram_kind: diagram.diagramKind,
+              render_width: diagram.renderWidth,
+              render_height: diagram.renderHeight,
+              schema_version: 1,
+              version_number: 1,
+              embed_ref: embedRef2,
+              status: "finished"
+            }),
+            textPreview: `${diagram.title} (${diagram.diagramKind})`,
+            status: "finished",
+            filePath: filename,
+            contentHash: createHash10("sha256").update(content).digest("hex"),
+            textLengthChars: content.length,
+            appId: "diagrams",
+            skillId: "html",
+            versionNumber: 1
+          },
+          referenceBlock: createEmbedReferenceBlock(embedRef2),
+          displayName: filename,
+          secretsRedacted,
+          zeroKnowledge,
+          requiresUpload: false
+        };
+      }
+    }
     const lineCount = content.split("\n").length;
     const embedId = generateEmbedId();
     const embedRef = createEmbedRef("code", `${filename}:${embedId}`);
@@ -9906,13 +10163,13 @@ import { client, ready, server } from "@serenity-kit/opaque";
 var PAIR_PIN_ALPHABET = "ABCDEFGHJKLMNPQRTUVWXY3468";
 var PIN_LENGTH = 6;
 var KSF = { "argon2id-custom": { memory: 8192, iterations: 3, parallelism: 1 } };
-var encoder2 = new TextEncoder();
-var decoder = new TextDecoder("utf-8", { fatal: true });
-var BUNDLE_INFO = encoder2.encode("openmates-pair-v2/bundle");
-var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encoder3 = new TextEncoder();
+var decoder2 = new TextDecoder("utf-8", { fatal: true });
+var BUNDLE_INFO = encoder3.encode("openmates-pair-v2/bundle");
+var BASE64URL2 = /^[A-Za-z0-9_-]+$/;
 var HEX_256 = /^[0-9a-f]{64}$/;
 var BUNDLE_KEYS = /* @__PURE__ */ new Set(["protocol_version", "master_key_exported", "grant_secret", "user_email_salt", "hashed_email", "user_id", "account_context"]);
-function ownedBuffer(bytes2) {
+function ownedBuffer2(bytes2) {
   return bytes2;
 }
 function requireAscii(value, name, max = 128) {
@@ -9952,7 +10209,7 @@ function validateContext(context) {
     auto_logout_minutes: parsed[6]
   };
   if (createPairContext(fields) !== context) throw new Error("Noncanonical pairing context");
-  return { text: context, bytes: encoder2.encode(context), fields };
+  return { text: context, bytes: encoder3.encode(context), fields };
 }
 function identifiers(context) {
   return { client: `openmates-pair-v2/client/${context}`, server: `openmates-pair-v2/server/${context}` };
@@ -9968,7 +10225,7 @@ function base64url(bytes2) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 function decodeBase64url(value, maxBytes) {
-  if (typeof value !== "string" || value.length < 1 || value.length > Math.ceil(maxBytes * 4 / 3) + 2 || !BASE64URL.test(value)) {
+  if (typeof value !== "string" || value.length < 1 || value.length > Math.ceil(maxBytes * 4 / 3) + 2 || !BASE64URL2.test(value)) {
     throw new Error("Invalid pairing encoding");
   }
   let bytes2;
@@ -9995,7 +10252,7 @@ async function hashPairSecret(secret) {
   const bytes2 = decodeBase64url(secret, 32);
   if (bytes2.length !== 32) throw new Error("Invalid pairing secret");
   try {
-    const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer(bytes2)));
+    const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer2(bytes2)));
     return [...digest4].map((byte) => byte.toString(16).padStart(2, "0")).join("");
   } finally {
     bytes2.fill(0);
@@ -10011,10 +10268,10 @@ async function deriveBundleKey(sessionKey, contextBytes) {
   const raw = decodeBase64url(sessionKey, 64);
   if (raw.length !== 64) throw new Error("Invalid pairing session key");
   try {
-    const salt = await crypto.subtle.digest("SHA-256", ownedBuffer(contextBytes));
-    const ikm = await crypto.subtle.importKey("raw", ownedBuffer(raw), "HKDF", false, ["deriveKey"]);
+    const salt = await crypto.subtle.digest("SHA-256", ownedBuffer2(contextBytes));
+    const ikm = await crypto.subtle.importKey("raw", ownedBuffer2(raw), "HKDF", false, ["deriveKey"]);
     return crypto.subtle.deriveKey(
-      { name: "HKDF", hash: "SHA-256", salt, info: ownedBuffer(BUNDLE_INFO) },
+      { name: "HKDF", hash: "SHA-256", salt, info: ownedBuffer2(BUNDLE_INFO) },
       ikm,
       { name: "AES-GCM", length: 256 },
       false,
@@ -10090,13 +10347,13 @@ async function createPairReceiver(context, pin) {
         if (nonce.length !== 12) throw new Error("Invalid pairing IV");
         const ciphertext = decodeBase64url(encryptedBundle, 65536);
         const plaintext = new Uint8Array(await crypto.subtle.decrypt(
-          { name: "AES-GCM", iv: ownedBuffer(nonce), additionalData: ownedBuffer(binding.bytes), tagLength: 128 },
+          { name: "AES-GCM", iv: ownedBuffer2(nonce), additionalData: ownedBuffer2(binding.bytes), tagLength: 128 },
           key,
-          ownedBuffer(ciphertext)
+          ownedBuffer2(ciphertext)
         ));
         try {
           assertActive();
-          return validateBundle(JSON.parse(decoder.decode(plaintext)), binding.fields.authorizer_user_id);
+          return validateBundle(JSON.parse(decoder2.decode(plaintext)), binding.fields.authorizer_user_id);
         } finally {
           nonce.fill(0);
           ciphertext.fill(0);
@@ -11157,6 +11414,7 @@ function extractVersionedEmbedContent(content) {
     ].join("\n").trim();
   }
   if (typeof content.remotion_source === "string") return content.remotion_source;
+  if (typeof content.html_source === "string") return content.html_source;
   if (typeof content.code === "string") return content.code;
   if (typeof content.html === "string") return content.html;
   if (typeof content.table === "string") return content.table;
@@ -11172,6 +11430,7 @@ function buildRestoredEmbedContentObject(current2, restoredContent, newVersion)
   if (typeof current2.remotion_source === "string") {
     return { ...restored, remotion_source: restoredContent, current_source_version: newVersion };
   }
+  if (typeof current2.html_source === "string") return { ...restored, html_source: restoredContent };
   if (typeof current2.code === "string") return { ...restored, code: restoredContent };
   if (typeof current2.html === "string") return { ...restored, html: restoredContent };
   if (typeof current2.table === "string") return { ...restored, table: restoredContent };
@@ -11286,6 +11545,8 @@ var OpenMatesClient = class _OpenMatesClient {
   session;
   http;
   explicitSession;
+  directChatIdentity;
+  directChatUserHash;
   constructor(options = {}) {
     this.explicitSession = options.session !== void 0;
     const diskSession = options.session ?? (options.loadStoredSession === false ? null : this.getValidSessionFromDisk());
@@ -11551,6 +11812,8 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!response.ok) throw new Error(`Team list failed with HTTP ${response.status}`);
     if (!owner2.isCurrent()) throw new Error("Account changed while loading Teams.");
     const teams = response.data.teams ?? [];
+    if (teams.length) await this.ensureDirectChatIdentity();
+    if (!owner2.isCurrent()) throw new Error("Account changed while loading Teams.");
     await Promise.all(teams.map((team) => this.cacheTeamKeyFromRecord(team, owner2.isCurrent)));
     if (!owner2.isCurrent()) throw new Error("Account changed while loading Teams.");
     const teamIds = teams.map((team) => team.team_id).filter((teamId) => typeof teamId === "string" && teamId.length > 0);
@@ -11560,6 +11823,60 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return teams;
   }
+  async openTeamDirectChat(teamId, recipientHash) {
+    if (!teamId || !/^[0-9a-f]{64}$/.test(recipientHash)) throw new Error("A Team ID and member hash are required.");
+    const owner2 = this.captureTeamAccountOwner();
+    const [ownHash, ownIdentity] = await Promise.all([this.ownDirectChatHash(), this.ensureDirectChatIdentity()]);
+    if (recipientHash === ownHash) throw new Error("Choose another Team member to message.");
+    const cache = await this.ensureSynced(false, [], { teamId });
+    if (!owner2.isCurrent()) throw new Error("Account changed while opening the direct chat.");
+    const existing = cache.chats.find((row4) => row4.details.chat_visibility === "direct" && (!row4.details.team_id || row4.details.team_id === teamId) && (!row4.details.hashed_team_id || row4.details.hashed_team_id === computeSHA256(teamId)) && Array.isArray(row4.details.participant_user_hashes) && row4.details.participant_user_hashes.length === 2 && row4.details.participant_user_hashes.includes(ownHash) && row4.details.participant_user_hashes.includes(recipientHash));
+    if (existing) {
+      const wrapping2 = await this.getChatWrappingKey(teamId, this.getMasterKeyBytes());
+      return this.decryptChatListItem(existing, wrapping2, cache, teamId);
+    }
+    const recipient = await this.http.get(
+      `/v1/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(recipientHash)}/chat-encryption-key`,
+      this.getCliRequestHeaders()
+    );
+    if (recipient.status === 404) throw new Error("Direct message pending: this Team member has not enrolled a chat encryption key yet.");
+    if (!recipient.ok) throw new Error(`Team member chat encryption key failed with HTTP ${recipient.status}`);
+    const recipientKey = await validatePublicChatEncryptionKeyId(recipient.data);
+    const chatId = randomUUID9();
+    const chatKey = new Uint8Array(randomBytes4(32));
+    const ownEnvelope = await sealDirectChatKey(chatKey, { teamId, chatId, recipientHash: ownHash, keyId: ownIdentity.keyId }, ownIdentity.publicKey);
+    const recipientEnvelope = await sealDirectChatKey(chatKey, { teamId, chatId, recipientHash, keyId: recipientKey.key_id }, recipientKey.public_key);
+    if (!owner2.isCurrent()) throw new Error("Account changed while opening the direct chat.");
+    const response = await this.http.post(
+      `/v1/teams/${encodeURIComponent(teamId)}/direct-chats`,
+      {
+        chat_id: chatId,
+        recipient_user_hash: recipientHash,
+        participant_key_envelopes: {
+          [ownHash]: { key_id: ownIdentity.keyId, encrypted_chat_key: ownEnvelope },
+          [recipientHash]: { key_id: recipientKey.key_id, encrypted_chat_key: recipientEnvelope }
+        },
+        encrypted_title: await encryptWithAesGcmCombined("Private Team message", chatKey)
+      },
+      this.getCliRequestHeaders()
+    );
+    if (!owner2.isCurrent()) throw new Error("Account changed while opening the direct chat.");
+    if (!response.ok || !response.data.chat) throw new Error(`Direct chat creation failed with HTTP ${response.status}`);
+    const details = response.data.chat;
+    if (details.chat_visibility !== "direct" || details.team_id !== teamId || details.id !== chatId) {
+      throw new Error("Direct chat creation returned mismatched metadata.");
+    }
+    const latest = loadSyncCache(teamId) ?? cache;
+    const row3 = { details, messages: [] };
+    saveSyncCache({
+      ...latest,
+      chats: [row3, ...latest.chats],
+      loadedChatCount: latest.loadedChatCount + 1,
+      totalChatCount: latest.totalChatCount + 1
+    }, teamId);
+    const wrapping = await this.getChatWrappingKey(teamId, this.getMasterKeyBytes());
+    return this.decryptChatListItem(row3, wrapping, loadSyncCache(teamId), teamId);
+  }
   async approveTeamName(name) {
     this.requireSession();
     const normalized = name.trim().toLowerCase();
@@ -11610,6 +11927,7 @@ var OpenMatesClient = class _OpenMatesClient {
     return response.data.team;
   }
   async getTeam(teamId) {
+    await this.ensureDirectChatIdentity();
     const owner2 = this.captureTeamAccountOwner();
     const response = await this.http.get(`/v1/teams/${encodeURIComponent(teamId)}`, this.getCliRequestHeaders());
     if (!response.ok || !response.data.team) throw new Error(`Team get failed with HTTP ${response.status}`);
@@ -11659,6 +11977,7 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async listTeamMembers(teamId) {
     this.requireSession();
+    await this.ensureDirectChatIdentity();
     const response = await this.http.get(`/v1/teams/${encodeURIComponent(teamId)}/members`, this.getCliRequestHeaders());
     if (!response.ok) throw new Error(`Team members failed with HTTP ${response.status}`);
     return Promise.all((response.data.members ?? []).map((member) => this.decryptTeamMember(teamId, member)));
@@ -12785,6 +13104,111 @@ var OpenMatesClient = class _OpenMatesClient {
       return response.data.user ?? {};
     });
   }
+  async ownDirectChatHash() {
+    const session = this.requireSession();
+    const owner2 = this.captureTeamAccountOwner();
+    const scope2 = `${session.apiUrl}:${session.sessionId}:${session.hashedEmail}:${session.masterKeyExportedB64}`;
+    if (this.directChatUserHash?.scope !== scope2) {
+      const cached = loadCachedDirectChatAccountKey(session, this.apiUrl);
+      const promise = (cached ? Promise.resolve({ id: cached.accountId }) : this.whoAmI()).then((user2) => {
+        const id = typeof user2.id === "string" ? user2.id : typeof user2.user_id === "string" ? user2.user_id : null;
+        if (!id) throw new Error("Authenticated identity is required for direct chats.");
+        if (!owner2.isCurrent()) throw new Error("Account changed while loading direct chat identity.");
+        return createHash13("sha256").update(id).digest("hex");
+      }).catch((error) => {
+        if (!(error instanceof TypeError)) throw error;
+        const cached2 = loadCachedDirectChatAccountKey(session, this.apiUrl);
+        if (!cached2) throw error;
+        if (!owner2.isCurrent()) throw new Error("Account changed while loading direct chat identity.");
+        return createHash13("sha256").update(cached2.accountId).digest("hex");
+      }).catch((error) => {
+        if (this.directChatUserHash?.promise === promise) this.directChatUserHash = void 0;
+        throw error;
+      });
+      this.directChatUserHash = { scope: scope2, promise };
+    }
+    return this.directChatUserHash.promise;
+  }
+  async ensureDirectChatIdentity() {
+    const session = this.requireSession();
+    const scope2 = `${session.apiUrl}:${session.sessionId}:${session.hashedEmail}:${session.masterKeyExportedB64}`;
+    if (this.directChatIdentity?.scope !== scope2) {
+      const promise = this.loadDirectChatIdentity().catch((error) => {
+        if (this.directChatIdentity?.promise === promise) this.directChatIdentity = void 0;
+        throw error;
+      });
+      this.directChatIdentity = { scope: scope2, promise };
+    }
+    return this.directChatIdentity.promise;
+  }
+  async loadDirectChatIdentity() {
+    const owner2 = this.captureTeamAccountOwner();
+    const masterKey = this.getMasterKeyBytes();
+    const recover = async (record11) => {
+      const identity4 = await recoverAccountChatIdentity(record11, masterKey);
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      return identity4;
+    };
+    const local = loadCachedDirectChatAccountKey(this.requireSession(), this.apiUrl);
+    if (local) return recover(local.record);
+    const cacheVerifiedRecord = async (record11) => {
+      try {
+        const user2 = await this.whoAmI();
+        if (!owner2.isCurrent()) return;
+        const accountId = typeof user2.id === "string" ? user2.id : typeof user2.user_id === "string" ? user2.user_id : null;
+        const trustedAccountId = loadTrustedAccountId();
+        if (accountId && (trustedAccountId ? trustedAccountId === accountId : process.env.OPENMATES_ACCOUNT_GUARD !== "required")) {
+          saveCachedDirectChatAccountKey(this.requireSession(), this.apiUrl, accountId, record11);
+        }
+      } catch {
+      }
+    };
+    let existing;
+    try {
+      existing = await this.http.get(
+        "/v1/account/chat-encryption-key",
+        this.getCliRequestHeaders()
+      );
+    } catch (error) {
+      if (!(error instanceof TypeError)) throw error;
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      const cached = loadCachedDirectChatAccountKey(this.requireSession(), this.apiUrl);
+      if (!cached) throw error;
+      return recover(cached.record);
+    }
+    if (!existing.ok && existing.status !== 404) throw new Error(`Account chat encryption key failed with HTTP ${existing.status}`);
+    if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key enrollment.");
+    if (existing.data.key) {
+      const identity4 = await recover(existing.data.key);
+      await cacheVerifiedRecord(existing.data.key);
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      return identity4;
+    }
+    const generated = await createAccountChatIdentity(masterKey);
+    if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key enrollment.");
+    const saved = await this.http.put(
+      "/v1/account/chat-encryption-key",
+      generated.record,
+      this.getCliRequestHeaders()
+    );
+    if (saved.status === 409) {
+      const current2 = await this.http.get(
+        "/v1/account/chat-encryption-key",
+        this.getCliRequestHeaders()
+      );
+      if (!owner2.isCurrent() || !current2.ok || !current2.data.key) throw new Error("Account chat encryption key enrollment conflicted. Retry.");
+      const identity4 = await recover(current2.data.key);
+      await cacheVerifiedRecord(current2.data.key);
+      if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+      return identity4;
+    }
+    if (!owner2.isCurrent() || !saved.ok) throw new Error(`Account chat encryption key enrollment failed with HTTP ${saved.status}`);
+    const record10 = saved.data.key ?? generated.record;
+    const identity3 = await recover(record10);
+    await cacheVerifiedRecord(record10);
+    if (!owner2.isCurrent()) throw new Error("Account changed during chat encryption key recovery.");
+    return identity3;
+  }
   async getTopicPreferences() {
     const user2 = await this.whoAmI();
     return await this.decryptTopicPreferences(user2.encrypted_settings);
@@ -13151,6 +13575,20 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async resolveChatKey(cache, cached, wrappingKey, teamId = null) {
     const chatId = String(cached.details.id ?? "");
+    if (cached.details.chat_visibility === "direct") {
+      if (!teamId || !chatId || cached.details.team_id && cached.details.team_id !== teamId || cached.details.hashed_team_id && cached.details.hashed_team_id !== computeSHA256(teamId)) {
+        throw new Error("Direct chat Team binding mismatch.");
+      }
+      const ownHash = await this.ownDirectChatHash();
+      const participants = cached.details.participant_user_hashes;
+      if (!Array.isArray(participants) || participants.length !== 2 || !participants.includes(ownHash)) {
+        throw new Error("Direct chat participant binding mismatch.");
+      }
+      const encrypted = cached.details.encrypted_chat_key;
+      if (typeof encrypted !== "string") throw new Error("Direct chat envelope unavailable.");
+      const identity3 = await this.ensureDirectChatIdentity();
+      return openDirectChatKey(encrypted, { teamId, chatId, recipientHash: ownHash, keyId: identity3.keyId }, identity3.privateKey);
+    }
     const wrapperKey = chatId ? this.getContextWrapperEncryptedChatKey(cache, chatId, teamId) : null;
     const encryptedChatKey = wrapperKey ?? (typeof cached.details.encrypted_chat_key === "string" ? cached.details.encrypted_chat_key : null);
     return encryptedChatKey ? this.decryptChatKey(encryptedChatKey, wrappingKey) : null;
@@ -13182,6 +13620,8 @@ var OpenMatesClient = class _OpenMatesClient {
     const slug = chatKeyBytes && typeof d.encrypted_slug === "string" ? slugValue ?? "" : null;
     return {
       id,
+      chatVisibility: d.chat_visibility === "direct" ? "direct" : teamId ? "team" : "personal",
+      participantUserHashes: Array.isArray(d.participant_user_hashes) ? d.participant_user_hashes.filter((value) => typeof value === "string") : void 0,
       shortId: id.slice(0, 8),
       slug,
       title,
@@ -14328,17 +14768,40 @@ var OpenMatesClient = class _OpenMatesClient {
     const selectedTeamId = this.getActiveTeamId();
     const current2 = () => {
       const active = this.session;
-      if (!active || active.apiUrl !== owner2[0] || active.hashedEmail !== owner2[1] || active.sessionId !== owner2[2] || active.createdAt !== owner2[3] || active.masterKeyExportedB64 !== owner2[4] || options.preferCache && this.getActiveTeamId() !== selectedTeamId)
+      if (!active || active.apiUrl !== owner2[0] || active.hashedEmail !== owner2[1] || active.sessionId !== owner2[2] || active.createdAt !== owner2[3] || active.masterKeyExportedB64 !== owner2[4] || this.getActiveTeamId() !== selectedTeamId || this.resolveTeamContext(options) !== teamId)
         throw new Error("Chat workspace changed");
     };
-    const cache = options.preferCache ? loadSyncCache(teamId) : await this.ensureSynced(false, [], options);
+    let cache = options.preferCache ? loadSyncCache(teamId) : await this.ensureSynced(false, [], options);
     current2();
     if (!cache) throw new Error("Chat cache unavailable. Open the chat to refresh it.");
+    const diskCacheAtStart = loadSyncCache(teamId);
+    const diskChatIdsAtStart = diskCacheAtStart?.chats.map((chat) => String(chat.details.id));
     const localTeamKey = options.preferCache && teamId ? loadLocalTeamKey(owner2[1], teamId) : null;
     if (options.preferCache && teamId && !localTeamKey) throw new Error("Team key unavailable offline. Reconnect to refresh Team access.");
     const wrappingKey = localTeamKey ? base64ToBytes(localTeamKey) : await this.getChatWrappingKey(teamId, masterKey);
     current2();
-    const found = await this.resolveCachedChatForQuery(query, cache, wrappingKey, teamId);
+    let found;
+    let fetchedMetadata = false;
+    try {
+      found = await this.resolveCachedChatForQuery(query, cache, wrappingKey, teamId);
+    } catch (error) {
+      if (options.preferCache || !(error instanceof Error) || !/^Chat '.*' not found\./.test(error.message) || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(query)) throw error;
+      const response2 = await this.http.post(
+        this.appendTeamQuery("/v1/chats/metadata/batch", { teamId }),
+        { chat_ids: [query] },
+        this.getCliRequestHeaders()
+      );
+      current2();
+      if (!response2.ok) throw new Error(`Chat metadata failed with HTTP ${response2.status}`);
+      const details = response2.data.chats.find((chat) => String(chat.id ?? "") === query);
+      if (!details) throw error;
+      found = { details, messages: [] };
+      fetchedMetadata = true;
+      cache = { ...cache, chats: [...cache.chats, found], chatKeyWrappers: [
+        ...cache.chatKeyWrappers ?? [],
+        ...Array.isArray(details.chat_key_wrappers) ? details.chat_key_wrappers : []
+      ] };
+    }
     current2();
     const chatItem = await this.decryptChatListItem(found, wrappingKey, cache, teamId);
     current2();
@@ -14366,17 +14829,19 @@ var OpenMatesClient = class _OpenMatesClient {
     const rawMessages = Array.isArray(response.data.messages) ? response.data.messages : [];
     const messages = await this.decryptRawChatMessages(rawMessages, chatItem, chatKeyBytes, cache.embeds);
     current2();
-    if (options.preferCache && teamId && (options.direction ?? "latest") === "latest") {
+    if ((options.direction ?? "latest") === "latest") {
       const latestCache = loadSyncCache(teamId);
       const row3 = latestCache?.chats.find((chat) => String(chat.details.id) === chatId);
-      if (row3 && row3.details.messages_v === found.details.messages_v && row3.details.encrypted_chat_key === found.details.encrypted_chat_key && row3.messages.length === found.messages.length && row3.messages.every((raw, index) => raw === found.messages[index])) {
+      const sameVersion = row3 && row3.details.messages_v === found.details.messages_v && row3.details.encrypted_chat_key === found.details.encrypted_chat_key && row3.messages.length === found.messages.length && row3.messages.every((raw, index) => raw === found.messages[index]);
+      if (latestCache && (sameVersion || fetchedMetadata && !row3 && diskCacheAtStart && latestCache.syncedAt === diskCacheAtStart.syncedAt && latestCache.totalChatCount === diskCacheAtStart.totalChatCount && latestCache.loadedChatCount === diskCacheAtStart.loadedChatCount && latestCache.chats.length === diskChatIdsAtStart?.length && latestCache.chats.every((chat, index) => String(chat.details.id) === diskChatIdsAtStart[index]))) {
         const canonicalId = (raw) => {
           const value = typeof raw === "string" ? JSON.parse(raw) : raw;
           return String(value.client_message_id ?? value.id ?? value.message_id ?? "");
         };
-        const existingById = new Map(row3.messages.map((raw, index) => [canonicalId(raw), index]));
+        const existing = row3?.messages ?? [];
+        const existingById = new Map(existing.map((raw, index) => [canonicalId(raw), index]));
         const overlap = rawMessages.find((raw) => !!canonicalId(raw) && existingById.has(canonicalId(raw)));
-        const older = response.data.has_more_before !== true ? [] : overlap ? row3.messages.slice(0, existingById.get(canonicalId(overlap))) : row3.messages;
+        const older = response.data.has_more_before !== true ? [] : overlap ? existing.slice(0, existingById.get(canonicalId(overlap))) : existing;
         const byId = /* @__PURE__ */ new Map();
         for (const raw of [...older, ...rawMessages]) {
           const value = typeof raw === "string" ? JSON.parse(raw) : raw;
@@ -14386,8 +14851,21 @@ var OpenMatesClient = class _OpenMatesClient {
         }
         const merged = [...byId.values()].sort((a, b) => a.createdAt - b.createdAt).map((message) => message.raw);
         current2();
-        if (merged.length !== row3.messages.length || merged.some((raw, index) => raw !== row3.messages[index]))
-          saveSyncCache({ ...latestCache, chats: latestCache.chats.map((chat) => chat === row3 ? { ...row3, messages: merged } : chat) }, teamId);
+        try {
+          if (!row3) {
+            const wrappers = Array.isArray(found.details.chat_key_wrappers) ? found.details.chat_key_wrappers : [];
+            saveSyncCache({
+              ...latestCache,
+              chats: [...latestCache.chats, { details: found.details, messages: merged }],
+              loadedChatCount: latestCache.loadedChatCount + 1,
+              totalChatCount: Math.max(latestCache.totalChatCount, latestCache.loadedChatCount + 1),
+              chatKeyWrappers: [...latestCache.chatKeyWrappers ?? [], ...wrappers]
+            }, teamId);
+          } else if (merged.length !== row3.messages.length || merged.some((raw, index) => raw !== row3.messages[index])) {
+            saveSyncCache({ ...latestCache, chats: latestCache.chats.map((chat) => chat === row3 ? { ...row3, messages: merged } : chat) }, teamId);
+          }
+        } catch {
+        }
       }
     }
     return {
@@ -15232,7 +15710,8 @@ var OpenMatesClient = class _OpenMatesClient {
                   code: "code",
                   pcb_schematic: "code",
                   sheet: "table",
-                  mermaid: "diagram_code"
+                  mermaid: "diagram_code",
+                  diagram_html: "html_source"
                 };
                 const field3 = historicalFieldByType[content.type];
                 if (!field3 || typeof sealedEmbed[field3] !== "string") {
@@ -15683,7 +16162,7 @@ var OpenMatesClient = class _OpenMatesClient {
             baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
             const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
             if (encKey) {
-              chatKeyBytes = await decryptBytesWithAesGcm(encKey, wrappingKey);
+              chatKeyBytes = await this.resolveChatKey(cache, chat, wrappingKey, teamId);
               encryptedChatKey = encKey;
               if (!chatKeyBytes) throw new Error("Could not decrypt the saved chat key.");
               if (typeof chat.details.encrypted_title === "string") {
@@ -16598,7 +17077,8 @@ var OpenMatesClient = class _OpenMatesClient {
                 chatId,
                 chatKeyBytes,
                 fallbackMessageId: assistantId,
-                ownerId: ownerId2
+                ownerId: ownerId2,
+                teamId
               });
               clearSyncCache(teamId);
               await persistCompressionCheckpoints(ws, chatKeyBytes, resp.compressionCheckpoints);
@@ -16749,7 +17229,8 @@ var OpenMatesClient = class _OpenMatesClient {
               chatId,
               chatKeyBytes,
               fallbackMessageId: assistantId,
-              ownerId: ownerId2
+              ownerId: ownerId2,
+              teamId
             });
             if (isNewChat && (resp.generatedTitle || resp.generatedIcon)) {
               const metadataStored = ws.waitForMessage(
@@ -17196,6 +17677,12 @@ var OpenMatesClient = class _OpenMatesClient {
         version_number: embed.version_number,
         file_path: embed.file_path,
         content_hash: embed.content_hash,
+        ...embed.type === "diagram_html" ? {
+          app_id: "diagrams",
+          skill_id: "html",
+          chat_id: params.chatId,
+          ...params.teamId ? { team_id: params.teamId } : {}
+        } : {},
         text_length_chars: embed.text_length_chars,
         is_private: embed.is_private ?? false,
         is_shared: embed.is_shared ?? false,
@@ -21004,6 +21491,66 @@ Required: ${schema.required.join(", ")}`
     const now = Math.floor(Date.now() / 1e3);
     const { ws } = await this.openWsClient();
     try {
+      if (currentObject.type === "diagram_html") {
+        const chat = cache.chats.find((entry) => computeSHA256(String(entry.details.id ?? "")) === embed.hashed_chat_id);
+        const chatId = String(chat?.details.id ?? "");
+        if (!chatId || typeof embed.content_hash !== "string" || embed.content_hash !== computeSHA256(currentContent)) {
+          throw new Error("Diagram restore requires a current chat and matching source hash.");
+        }
+        const teamId = this.resolveTeamContext();
+        const versions = await this.listEmbedVersions(embedId, { chatId, teamId: teamId ?? void 0 });
+        if (versions.readonly) throw new Error("Diagram version history is read-only.");
+        const historyRows = [];
+        if (currentVersion === 1 && !versions.versions.some((row3) => row3.version_number === 1)) {
+          historyRows.push({
+            version_number: 1,
+            encrypted_snapshot: await encryptWithAesGcmCombined(currentContent, embedKey),
+            created_at: normalizeUnixSeconds(embed.created_at, now)
+          });
+        }
+        historyRows.push({
+          version_number: newVersion,
+          encrypted_patch: encryptedPatch,
+          encrypted_snapshot: encryptedSnapshot,
+          created_at: now
+        });
+        const requestId = randomUUID9();
+        const operationId = randomUUID9();
+        const receipt = ws.waitForMessage(
+          "commit_chat_diagram_revision_result",
+          (payload) => payload.request_id === requestId,
+          3e4
+        );
+        await ws.sendAsync("commit_chat_diagram_revision", {
+          request_id: requestId,
+          operation_id: operationId,
+          embed_id: embedId,
+          chat_id: chatId,
+          ...teamId ? { team_id: teamId } : {},
+          expected_revision: currentVersion,
+          expected_content_hash: embed.content_hash,
+          head: {
+            encrypted_content: encryptedRestoredContent,
+            encrypted_text_preview: embed.encrypted_text_preview ?? null,
+            content_hash: contentHash,
+            status: "finished",
+            updated_at: now
+          },
+          history_rows: historyRows
+        });
+        const result = (await receipt).payload;
+        if (result.status !== "committed" || result.current_revision !== newVersion || result.current_content_hash !== contentHash) {
+          throw new Error(result.status === "conflict" ? "Diagram advanced on another device; reload and retry restore." : `Diagram restore was rejected: ${String(result.code ?? "unknown")}`);
+        }
+        clearSyncCache(teamId);
+        return {
+          embed_id: embedId,
+          restored_from_version: version,
+          version_number: newVersion,
+          content: target.content,
+          content_hash: contentHash
+        };
+      }
       const storeRequestId = randomUUID9();
       const storeConfirmed = ws.waitForMessage(
         "store_embed_confirmed",
@@ -28870,6 +29417,7 @@ var OpenMates = class {
   sdkName;
   sdkSessionPromise;
   masterKeyPromise;
+  chatIdentityPromise;
   constructor(options = {}) {
     this.apiKey = options.apiKey ?? process.env.OPENMATES_API_KEY;
     this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL2).replace(/\/$/, "");
@@ -28974,6 +29522,34 @@ var OpenMates = class {
   sdkSession() {
     return this.getSdkSession();
   }
+  async chatIdentity() {
+    if (!this.chatIdentityPromise) this.chatIdentityPromise = this.loadChatIdentity().catch((error) => {
+      this.chatIdentityPromise = void 0;
+      throw error;
+    });
+    return this.chatIdentityPromise;
+  }
+  async loadChatIdentity() {
+    const masterKey = await this.masterKey();
+    let response;
+    try {
+      response = await this.get("/v1/account/chat-encryption-key");
+    } catch (error) {
+      if (!(error instanceof OpenMatesApiError) || error.status !== 404) throw error;
+      response = { key: null };
+    }
+    if (response.key) return recoverAccountChatIdentity(response.key, masterKey);
+    const generated = await createAccountChatIdentity(masterKey);
+    try {
+      const saved = await this.put("/v1/account/chat-encryption-key", generated.record);
+      return recoverAccountChatIdentity(saved.key ?? generated.record, masterKey);
+    } catch (error) {
+      if (!(error instanceof OpenMatesApiError) || error.status !== 409) throw error;
+      const current2 = await this.get("/v1/account/chat-encryption-key");
+      if (!current2.key) throw new OpenMatesConfigError("Account chat encryption key enrollment conflicted; retry.");
+      return recoverAccountChatIdentity(current2.key, masterKey);
+    }
+  }
   /** @internal Resource-key resolver shared by the Project namespace. */
   async _getProjectGrantKey(projectId) {
     const session = await this.getSdkSession();
@@ -29048,6 +29624,26 @@ var OpenMates = class {
     return { ...payload, chat: decryptedChat, messages, embeds };
   }
   async resolveLoadedChatKey(chat, chatKeyWrappers) {
+    if (chat.chat_visibility === "direct") {
+      const session = await this.sdkSession();
+      const userId = session.user?.id;
+      if (!userId) throw new OpenMatesConfigError("Authenticated identity is required for a direct chat");
+      const ownHash = createHash14("sha256").update(userId).digest("hex");
+      const participants = chat.participant_user_hashes;
+      if (!Array.isArray(participants) || participants.length !== 2 || !participants.includes(ownHash)) {
+        throw new OpenMatesConfigError("Direct chat participant binding mismatch");
+      }
+      const identity3 = await this.chatIdentity();
+      if (typeof chat.team_id !== "string" || typeof chat.encrypted_chat_key !== "string") {
+        throw new OpenMatesConfigError("Direct chat key metadata is incomplete");
+      }
+      return openDirectChatKey(chat.encrypted_chat_key, {
+        teamId: chat.team_id,
+        chatId: chat.id,
+        recipientHash: ownHash,
+        keyId: identity3.keyId
+      }, identity3.privateKey);
+    }
     const hashedChatId = createHash14("sha256").update(chat.id).digest("hex");
     const wrapper = (chatKeyWrappers ?? []).find(
       (entry) => entry.key_type === "master" && entry.hashed_chat_id === hashedChatId && typeof entry.encrypted_chat_key === "string"
@@ -32684,9 +33280,11 @@ var OpenMatesTeams = class {
   }
   async list() {
     const result = await this.client.get("/v1/teams");
+    if (result.teams?.length) await this.client.chatIdentity();
     return result.teams ?? [];
   }
   async get(teamId) {
+    await this.client.chatIdentity();
     const result = await this.client.get(`/v1/teams/${encodeURIComponent(teamId)}`);
     return result.team ?? result;
   }
@@ -32744,6 +33342,62 @@ var OpenMatesTeams = class {
   async members(teamId) {
     return this.client.get(`/v1/teams/${encodeURIComponent(teamId)}/members`);
   }
+  async memberChatEncryptionKey(teamId, memberHash) {
+    if (!/^[0-9a-f]{64}$/.test(memberHash)) throw new OpenMatesConfigError("Member hash must be a SHA-256 hex digest");
+    try {
+      const result = await this.client.get(
+        `/v1/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(memberHash)}/chat-encryption-key`
+      );
+      return validatePublicChatEncryptionKeyId(result);
+    } catch (error) {
+      if (error instanceof OpenMatesApiError && error.status === 404) {
+        throw new OpenMatesConfigError("Direct message pending: this Team member has not enrolled a chat encryption key yet.");
+      }
+      throw error;
+    }
+  }
+  async openDirectChat(teamId, recipientHash) {
+    if (!teamId || !/^[0-9a-f]{64}$/.test(recipientHash)) throw new OpenMatesConfigError("A Team ID and member hash are required");
+    const session = await this.client.sdkSession();
+    const userId = session.user?.id;
+    if (!userId) throw new OpenMatesConfigError("Authenticated identity is required for a direct chat");
+    const ownHash = createHash14("sha256").update(userId).digest("hex");
+    if (ownHash === recipientHash) throw new OpenMatesConfigError("Choose another Team member to message");
+    const [ownIdentity, recipientKey] = await Promise.all([
+      this.client.chatIdentity(),
+      this.memberChatEncryptionKey(teamId, recipientHash)
+    ]);
+    const chatId = randomUUID10();
+    const chatKey = new Uint8Array(randomBytes6(32));
+    const ownEnvelope = await sealDirectChatKey(
+      chatKey,
+      { teamId, chatId, recipientHash: ownHash, keyId: ownIdentity.keyId },
+      ownIdentity.publicKey
+    );
+    const recipientEnvelope = await sealDirectChatKey(
+      chatKey,
+      { teamId, chatId, recipientHash, keyId: recipientKey.key_id },
+      recipientKey.public_key
+    );
+    const result = await this.client.request(
+      `/v1/teams/${encodeURIComponent(teamId)}/direct-chats`,
+      {
+        chat_id: chatId,
+        recipient_user_hash: recipientHash,
+        participant_key_envelopes: {
+          [ownHash]: { key_id: ownIdentity.keyId, encrypted_chat_key: ownEnvelope },
+          [recipientHash]: { key_id: recipientKey.key_id, encrypted_chat_key: recipientEnvelope }
+        },
+        encrypted_title: await encryptWithAesGcmCombined("Private Team message", chatKey)
+      }
+    );
+    if (!result.chat) throw new OpenMatesConfigError("Direct chat creation returned no metadata");
+    const participants = result.chat.participant_user_hashes;
+    if (result.chat.chat_visibility !== "direct" || result.chat.team_id !== teamId || result.chat.id !== chatId || !Array.isArray(participants) || participants.length !== 2 || !participants.includes(ownHash) || !participants.includes(recipientHash)) {
+      throw new OpenMatesConfigError("Direct chat creation returned mismatched metadata");
+    }
+    return this.client.decryptChatMetadata(result.chat);
+  }
   async decryptMemberProfile(teamKey, member) {
     const encrypted = member.encrypted_member_profile;
     if (typeof encrypted !== "string" || !encrypted) return { ...member, profile: null };
@@ -34367,6 +35021,8 @@ var DIRECT_TYPES = /* @__PURE__ */ new Set([
   "recording",
   "mail-email",
   "math-plot",
+  "diagram_html",
+  "diagrams-html",
   "mindmap",
   "mindmaps-mindmap",
   "events-event",
@@ -34398,6 +35054,8 @@ var DIRECT_TYPE_LABELS = {
   "recording": "recording",
   "mail-email": "email",
   "math-plot": "plot",
+  "diagram_html": "diagram",
+  "diagrams-html": "diagram",
   "mindmap": "Mind Map",
   "mindmaps-mindmap": "Mind Map",
   "events-event": "event",
@@ -35469,6 +36127,15 @@ function renderByDirectType(embed, c, ln) {
       ln("\x1B[2m[mathematical plot]\x1B[0m");
       break;
     }
+    case "diagram_html":
+    case "diagrams-html": {
+      ln(str(c.title) ?? "Diagram");
+      const kind = str(c.diagram_kind) ?? "diagram";
+      const width = typeof c.render_width === "number" ? c.render_width : 0;
+      const height = typeof c.render_height === "number" ? c.render_height : 0;
+      ln(`\x1B[2m${kind}${width && height ? ` \xB7 ${width} \xD7 ${height}` : ""}\x1B[0m`);
+      break;
+    }
     case "mindmap":
     case "mindmaps-mindmap": {
       const document = mindMapDocumentFromContent(c);
@@ -35660,6 +36327,18 @@ function renderDirectTypeFullscreen(embed, c, write) {
       }
       break;
     }
+    case "diagram_html":
+    case "diagrams-html": {
+      writeEmbedLine(write, `Title: ${str(c.title) ?? "Diagram"}`);
+      writeEmbedLine(write, `Kind: ${str(c.diagram_kind) ?? "diagram"}`);
+      if (typeof c.render_width === "number" && typeof c.render_height === "number") {
+        writeEmbedLine(write, `Size: ${c.render_width} \xD7 ${c.render_height}`);
+      }
+      writeEmbedLine(write, `Version: ${typeof c.version_number === "number" ? c.version_number : 1}`);
+      writeEmbedLine(write, `Source: ${typeof c.html_source === "string" ? c.html_source.length : 0} characters`);
+      writeEmbedLine(write, "Export with: openmates chats download <chat> --output <directory>");
+      break;
+    }
     case "mindmap":
     case "mindmaps-mindmap": {
       const document = mindMapDocumentFromContent(c);
@@ -67743,6 +68422,62 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       }
     }
   },
+  diagrams: {
+    html: {
+      text: "Editable Diagram"
+    },
+    edit: {
+      text: "Edit diagram"
+    },
+    loading: {
+      text: "Preparing diagram\u2026"
+    },
+    invalid_source: {
+      text: "This diagram contains unsupported content."
+    },
+    conflict: {
+      text: "The diagram changed on another device. Reload before editing."
+    },
+    saved: {
+      text: "Diagram saved"
+    },
+    saved_refresh: {
+      text: "Diagram saved. Refresh this page to sync this device before editing again."
+    },
+    history_unavailable: {
+      text: "This diagram version could not be loaded. Choose another version to retry."
+    },
+    history_version: {
+      text: "Viewing version"
+    },
+    save_failed: {
+      text: "Could not save diagram"
+    },
+    zoom_out: {
+      text: "Zoom out"
+    },
+    zoom_in: {
+      text: "Zoom in"
+    },
+    fit: {
+      text: "Fit diagram"
+    },
+    export: {
+      text: "Export HTML"
+    },
+    undo: {
+      text: "Undo"
+    },
+    cancel: {
+      text: "Cancel"
+    },
+    save: {
+      text: "Save changes"
+    },
+    saving: {
+      text: "Saving\u2026"
+    }
+  },
   digital_team_mates: {
     digital_team_mates: {
       text: "Digital Team Mates"
@@ -70474,6 +71209,9 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
     diagrams: {
       mermaid: {
         text: "Mermaid Diagram"
+      },
+      html: {
+        text: "Editable Diagram"
       }
     },
     mail: {
@@ -78196,6 +78934,14 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
     }
   },
   notifications: {
+    team_direct_chat: {
+      title: {
+        text: "Private Team message"
+      },
+      body: {
+        text: "You have a new private conversation in your Team."
+      }
+    },
     auto_logout: {
       title: {
         text: "Auto logout"
@@ -86391,6 +87137,18 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       members_description: {
         text: "Manage your team members and their permissions."
       },
+      direct_message_action: {
+        text: "Message"
+      },
+      direct_message_scope: {
+        text: "Only you and this member can read this chat."
+      },
+      direct_message_pending: {
+        text: "Secure messaging setup is pending. Ask this member to open OpenMates."
+      },
+      direct_message_failed: {
+        text: "Could not open a private message. Try again."
+      },
       admins: {
         text: "Admins"
       },
@@ -99434,6 +100192,8 @@ var TUI_ACTIONS = [
   { label: "Show all workspace items", command: "/browse" },
   { label: "Use selected app skill", command: "/app-run" },
   { label: "Recent chats", command: "/chats" },
+  { label: "Team members", command: "/members" },
+  { label: "Message Team member", command: "/message" },
   { label: "Example chats", command: "/examples" },
   { label: "Projects", command: "/projects" },
   { label: "Tasks", command: "/tasks" },
@@ -102073,7 +102833,7 @@ function relativeTime(timestamp) {
   return `${Math.floor(seconds / 86400)}d ago`;
 }
 function renderStatus(state, width) {
-  return ["OpenMates", "", state.status ?? "Working..."].flatMap((line3) => wrap(line3, width));
+  return ["OpenMates", "", ...(state.status ?? "Working...").split("\n")].flatMap((line3) => wrap(line3, width).map((text7) => line3 === "Message \xB7 Enter" ? pointerLine(text7, { kind: "key", name: "return" }) : line3 === "Next member \xB7 \u2193" ? pointerLine(text7, { kind: "key", name: "down" }) : text7));
 }
 function prepareMessageContent(content, width, state, questionBlocks = true) {
   const segments2 = parseMessageSegments(content, { preserveCodeFences: true }).map((segment) => segment.type === "embed" ? segment : {
@@ -104801,6 +105561,19 @@ function createChatModelPreferences(client2) {
 }
 
 // src/tui.ts
+var teamMemberActions = /* @__PURE__ */ new WeakMap();
+function showSelectedTeamMember(state) {
+  const selection = teamMemberActions.get(state);
+  if (!selection?.members.length) {
+    state.status = "No other active Team members are available.";
+    return;
+  }
+  const member = selection.members[state.selectedIndex] ?? selection.members[0];
+  state.status = `Team members ${state.selectedIndex + 1}/${selection.members.length}
+${member.label}
+Message \xB7 Enter
+Next member \xB7 \u2193`;
+}
 function defaultModeForStreams(input, output) {
   return input.isTTY === true && output.isTTY === true ? "tui" : "quickstart";
 }
@@ -105083,6 +105856,21 @@ async function handleKey(params) {
     modelShell,
     mentionShell
   };
+  const memberActions = teamMemberActions.get(state);
+  if (state.screen === "status" && memberActions && !memberActions.isCurrent()) teamMemberActions.delete(state);
+  if (state.screen === "status" && memberActions && memberActions.isCurrent() && memberActions.teamId === client2.getActiveTeamId()) {
+    if (memberActions.members.length > 0 && (key.name === "up" || key.name === "down")) {
+      state.selectedIndex = (state.selectedIndex + (key.name === "down" ? 1 : -1) + memberActions.members.length) % memberActions.members.length;
+      showSelectedTeamMember(state);
+      render();
+      return;
+    }
+    if (key.name === "return" && !state.input.trim()) {
+      const member = memberActions.members[state.selectedIndex];
+      if (member) await handleCommand({ command: `/message ${member.hash}`, state, client: client2, terminal, render, finish, modelShell });
+      return;
+    }
+  }
   if (key.name === "mouseclick") {
     if (!key.mouse || key.ctrl || key.meta || key.shift) return;
     const action2 = pointerTargetAt(state, key.mouse.column, key.mouse.row, terminal.width, terminal.height);
@@ -105258,6 +106046,50 @@ async function handleCommand(params) {
   rememberDraft(state);
   state.input = "";
   state.inputCursor = null;
+  if (name === "/members") {
+    const teamId = client2.getActiveTeamId();
+    if (!teamId) {
+      state.status = "Select a Team to view members.";
+      state.screen = "status";
+      render();
+      return;
+    }
+    const isCurrent = captureTuiWorkspaceOwner(client2);
+    const members = await client2.listTeamMembers(teamId);
+    if (!isCurrent() || client2.getActiveTeamId() !== teamId) return;
+    const user2 = await client2.whoAmI();
+    if (!isCurrent() || client2.getActiveTeamId() !== teamId) return;
+    const ownId = typeof user2.id === "string" ? user2.id : typeof user2.user_id === "string" ? user2.user_id : "";
+    teamMemberActions.set(state, { teamId, isCurrent, members: members.filter((member) => member.status === "active" && member.hashed_user_id && member.user_id !== ownId).map((member) => ({ hash: member.hashed_user_id, label: `${member.profile?.display_name || member.user_id} \xB7 ${member.role}` })) });
+    state.selectedIndex = 0;
+    state.screen = "status";
+    showSelectedTeamMember(state);
+    render();
+    return;
+  }
+  if (name === "/message") {
+    const teamId = client2.getActiveTeamId();
+    if (!teamId) {
+      state.status = "Select a Team to message a member.";
+      state.screen = "status";
+      render();
+      return;
+    }
+    const memberHash = parts[0];
+    if (!memberHash) {
+      state.status = "Use /members to find a member, then /message <member-hash>.";
+      state.screen = "status";
+      render();
+      return;
+    }
+    const chat = await client2.openTeamDirectChat(teamId, memberHash);
+    if (client2.getActiveTeamId() !== teamId) return;
+    state.recentChats = [chat, ...state.recentChats.filter((item) => item.id !== chat.id)];
+    await openSavedChat({ state, client: client2, terminal, render, command: async () => {
+    }, send: async () => {
+    } }, chat.id);
+    return;
+  }
   if (name === "/privacy") {
     const action2 = parts[0] ?? "status";
     if (action2 === "later") {
@@ -115109,24 +115941,33 @@ async function handleTeams(client2, subcommand, rest, flags) {
     else printTeamRecord(team, client2.getActiveTeamId());
     return;
   }
-  if (subcommand === "members") {
+  if (subcommand === "members" || subcommand === "member") {
     const action2 = rest[0];
     const teamId = requiredStringFlag(rest[1], "<team-id>");
+    if (action2 === "message") {
+      const memberHash = requiredStringFlag(rest[2], "<member-hash>");
+      const chat = await client2.openTeamDirectChat(teamId, memberHash);
+      const message = rest.slice(3).join(" ").trim();
+      const response = message ? await client2.sendMessage({ message, chatId: chat.id, teamId }) : void 0;
+      if (flags.json === true) printJson2({ chat_id: chat.id, chat, ...response ? { response } : {} });
+      else console.log(message ? `Message sent in direct chat ${chat.id}` : `Direct chat: ${chat.id}`);
+      return;
+    }
     if (action2 === "list") {
       const members = (await client2.listTeamMembers(teamId)).map(publicTeamMember);
       if (flags.json === true) printJson2({ members });
       else if (!members.length) console.log("No Team members.");
-      else for (const member of members) console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.user_id}`.trim());
+      else for (const member of members) console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.hashed_user_id || member.user_id}`.trim());
       return;
     }
     if (action2 === "show") {
       const userId = requiredStringFlag(rest[2], "<member-user-id>");
       const member = publicTeamMember(await client2.getTeamMember(teamId, userId));
       if (flags.json === true) printJson2({ member });
-      else console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.user_id}`.trim());
+      else console.log(`${member.display_name || member.user_id}  ${member.role}  ${member.status || ""}  ${member.hashed_user_id || member.user_id}`.trim());
       return;
     }
-    throw new Error("Use teams members list <team-id> or teams members show <team-id> <member-user-id>.");
+    throw new Error("Use teams members list, show, or message <team-id> <member-hash> [text].");
   }
   if (subcommand === "profile") {
     const action2 = rest[0];
@@ -116889,6 +117730,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
     }
     const codeEmbeds = [];
     const transcriptEmbeds = [];
+    const diagramEmbeds = [];
     const processedEmbedIds = /* @__PURE__ */ new Set();
     const allEmbedIds = [];
     for (const msg of messages) {
@@ -116905,6 +117747,9 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       const eid = embedQueue.shift();
       try {
         const embed = await client2.getEmbed(eid);
+        if ((embed.type === "diagram_html" || embed.type === "diagrams-html") && typeof embed.content?.html_source === "string" && embed.content.html_source) {
+          diagramEmbeds.push({ embedId: embed.embedId, content: embed.content.html_source });
+        }
         if (embed.type === "code" && embed.content) {
           const code = typeof embed.content.code === "string" ? embed.content.code : typeof embed.content.content === "string" ? embed.content.content : null;
           if (code) {
@@ -116982,6 +117827,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
           await writeFile3(join31(tDir, te.filename), te.content);
         }
       }
+      if (diagramEmbeds.length > 0) {
+        const dDir = join31(tmpDir, "diagrams");
+        await mkdir4(dDir, { recursive: true });
+        for (const diagram of diagramEmbeds) {
+          await writeFile3(join31(dDir, `${diagram.embedId}.html`), diagram.content);
+        }
+      }
       const zipPath = join31(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
@@ -117023,6 +117875,15 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
           written.push(`transcripts/${te.filename}`);
         }
       }
+      if (diagramEmbeds.length > 0) {
+        const dDir = join31(chatDir, "diagrams");
+        await mkdir4(dDir, { recursive: true });
+        for (const diagram of diagramEmbeds) {
+          const filename = `${diagram.embedId}.html`;
+          await writeFile3(join31(dDir, filename), diagram.content);
+          written.push(`diagrams/${filename}`);
+        }
+      }
       const label4 = chat.title ? `"${chat.title}"` : chatHandle(chat);
       process.stdout.write(
         `\x1B[1mDownloaded chat ${label4}\x1B[0m \u2192 ${chatDir}
@@ -124360,6 +125221,7 @@ function printTeamsHelp() {
   openmates teams role <team-id> --user <user-id> --role admin|member|viewer [--json]
   openmates teams members list <team-id> [--json]
   openmates teams members show <team-id> <member-user-id> [--json]
+  openmates teams member message <team-id> <member-hash> [text] [--json]
   openmates teams profile show <team-id> [--json]
   openmates teams profile edit <team-id> [--name <display-name>] [--avatar <value>] [--json]
   openmates teams remove-member <team-id> --user <user-id> [--json]