sealnet-mcp 0.2.5 → 0.3.0

package/dist/cli.cjs

@@ -34,8 +34,9 @@ __export(cli_exports, {
   main: () => main
 });
 module.exports = __toCommonJS(cli_exports);
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_promises10 = require("fs/promises");
+var import_node_path11 = require("path");
 var import_commander = require("commander");
 
 // ../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
@@ -6901,6 +6902,9 @@ async function generateIdentity() {
   const { publicKey, secretKey } = await generateRecipientKeyPair();
   return { secret: secretKey, public: publicKey };
 }
+async function identityFromSeed(seed) {
+  return { secret: seed, public: await recipientPublicKey(seed) };
+}
 function identityToFields(id) {
   return {
     x25519_secret_b64: toB64(id.secret),
@@ -6934,20 +6938,27 @@ var import_node_crypto = require("crypto");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var LOCK_FILE_NAME = "state.lock";
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 25;
 var StateLockedError = class extends Error {
   code = "state_locked";
   holder;
   lockPath;
   constructor(lockPath, holder) {
     const who = holder === null ? "holder info unreadable" : `pid ${holder.pid} on ${holder.hostname} since ${holder.acquired_at}`;
-    super(
-      `state directory is locked by another sealnet-mcp process (${who}). Only one writer may use a state dir at a time; stop the other instance or point this one at a different --state-dir. Lock file: ${lockPath}`
-    );
+    super(`state directory is locked by another sealnet-mcp process (${who}). Lock file: ${lockPath}`);
     this.name = "StateLockedError";
     this.holder = holder;
     this.lockPath = lockPath;
   }
 };
+var StateBusyError = class extends Error {
+  code = "state_busy";
+  constructor(locked) {
+    super(`${locked.message}; waited ${LOCK_WAIT_MS / 1e3} s, nothing was changed, safe to retry`);
+    this.name = "StateBusyError";
+  }
+};
 var StateDirUnsafeError = class extends Error {
   code = "state_dir_unsafe";
   constructor(stateDir, reason) {
@@ -6966,6 +6977,9 @@ function defaultIsPidAlive(pid) {
     return code === "EPERM";
   }
 }
+function holderMayRun(holder, deps = {}) {
+  return holder.hostname !== (deps.host ?? (0, import_node_os.hostname)()) || (deps.isPidAlive ?? defaultIsPidAlive)(holder.pid);
+}
 function parseHolder(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -7008,7 +7022,7 @@ async function tryCreate(lockPath, info) {
     await (0, import_promises.unlink)(tmp).catch(() => void 0);
   }
 }
-async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
+async function tryBreakStale(lockPath, probed, deps) {
   const claimPath = `${lockPath}.break-${process.pid}-${(0, import_node_crypto.randomBytes)(4).toString("hex")}`;
   try {
     await (0, import_promises.rename)(lockPath, claimPath);
@@ -7016,8 +7030,7 @@ async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
     return true;
   }
   const claimed = parseHolder(await (0, import_promises.readFile)(claimPath, "utf8").catch(() => ""));
-  const claimedStale = claimed === null || claimed.hostname === selfHost && !isAlive(claimed.pid);
-  if (sameHolder(claimed, probed) || claimedStale) {
+  if (sameHolder(claimed, probed) || claimed === null || !holderMayRun(claimed, deps)) {
     await (0, import_promises.unlink)(claimPath).catch(() => void 0);
     return true;
   }
@@ -7030,11 +7043,9 @@ async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
 }
 async function acquireStateLock(stateDir, deps = {}) {
   const lockPath = (0, import_node_path.join)(stateDir, LOCK_FILE_NAME);
-  const isAlive = deps.isPidAlive ?? defaultIsPidAlive;
-  const selfHost = deps.host ?? (0, import_node_os.hostname)();
   const self2 = {
     pid: deps.pid ?? process.pid,
-    hostname: selfHost,
+    hostname: deps.host ?? (0, import_node_os.hostname)(),
     acquired_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   await (0, import_promises.mkdir)(stateDir, { recursive: true, mode: 448 });
@@ -7045,11 +7056,10 @@ async function acquireStateLock(stateDir, deps = {}) {
   await (0, import_promises.chmod)(stateDir, 448).catch(() => void 0);
   if (!await tryCreate(lockPath, self2)) {
     const holder = await readHolder(lockPath);
-    const stale = holder !== null && holder.hostname === selfHost && !isAlive(holder.pid);
-    if (holder !== null && !stale) {
+    if (holder !== null && holderMayRun(holder, deps)) {
       throw new StateLockedError(lockPath, holder);
     }
-    if (!await tryBreakStale(lockPath, holder, isAlive, selfHost)) {
+    if (!await tryBreakStale(lockPath, holder, deps)) {
       throw new StateLockedError(lockPath, await readHolder(lockPath));
     }
     if (!await tryCreate(lockPath, self2)) {
@@ -7081,6 +7091,30 @@ async function acquireStateLock(stateDir, deps = {}) {
     }
   };
 }
+var queues = /* @__PURE__ */ new Map();
+function withStateLock(stateDir, fn, deps = {}) {
+  const run = (queues.get(stateDir) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    let lock;
+    for (; ; ) {
+      try {
+        lock = await acquireStateLock(stateDir, deps);
+        break;
+      } catch (err2) {
+        if (!(err2 instanceof StateLockedError)) throw err2;
+        if (Date.now() >= deadline) throw new StateBusyError(err2);
+        await new Promise((resolve5) => setTimeout(resolve5, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await fn();
+    } finally {
+      await lock.release();
+    }
+  });
+  queues.set(stateDir, run);
+  return run;
+}
 async function probeStateLock(stateDir, deps = {}) {
   const lockPath = (0, import_node_path.join)(stateDir, LOCK_FILE_NAME);
   const holder = await readHolder(lockPath);
@@ -7092,182 +7126,7 @@ async function probeStateLock(stateDir, deps = {}) {
       return { held: false, holder: null, stale: false };
     }
   }
-  const isAlive = deps.isPidAlive ?? defaultIsPidAlive;
-  const sameHost = holder.hostname === (deps.host ?? (0, import_node_os.hostname)());
-  const stale = sameHost && !isAlive(holder.pid);
-  return { held: true, holder, stale };
-}
-
-// src/passphrase.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto2 = require("crypto");
-var SERVICE_NAME = "seal-mcp";
-var ACCOUNT_NAME = "state";
-var ENV_VAR = "SEAL_MCP_PASSPHRASE";
-var KEYCHAIN_SERVICE = SERVICE_NAME;
-var KEYCHAIN_ACCOUNT = ACCOUNT_NAME;
-var PASSPHRASE_ENV_VAR = ENV_VAR;
-var KeytarUnavailableError = class extends Error {
-  code = "keytar_unavailable";
-  constructor(detail) {
-    super(`keytar unavailable: ${detail}`);
-    this.name = "KeytarUnavailableError";
-  }
-};
-var PassphraseNotFoundError = class extends Error {
-  code = "passphrase_not_found";
-  constructor() {
-    super(
-      `No passphrase found. Run \`sealnet-mcp init\` to store one in your OS keychain, or export ${ENV_VAR} for CI/headless use.`
-    );
-    this.name = "PassphraseNotFoundError";
-  }
-};
-function keyringEntry(keyring, platform, service, account) {
-  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
-}
-function readKeytarLinuxEntry(service, account) {
-  return new Promise((resolve5) => {
-    (0, import_node_child_process.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
-      const value = err2 ? "" : stdout.replace(/\n$/, "");
-      resolve5(value.length > 0 ? value : null);
-    });
-  });
-}
-function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
-  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
-  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
-  return {
-    async getPassword(service, account) {
-      const secret = await entry(service, account).getSecret();
-      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
-      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
-      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
-      return legacy;
-    },
-    setPassword: store,
-    deletePassword: (service, account) => entry(service, account).deleteCredential()
-  };
-}
-var keytarCache = void 0;
-async function loadKeytar() {
-  if (keytarCache !== void 0) return keytarCache;
-  try {
-    const mod = await import("@napi-rs/keyring");
-    const keyring = mod.default ?? mod;
-    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
-    keytarCache = keytarOverKeyring(keyring);
-  } catch {
-    keytarCache = null;
-  }
-  return keytarCache;
-}
-async function loadKeytarOrThrow() {
-  const k = await loadKeytar();
-  if (k === null) {
-    throw new KeytarUnavailableError(
-      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
-    );
-  }
-  return k;
-}
-async function resolvePassphraseFromStores(env = process.env) {
-  const keytar = await loadKeytar();
-  if (keytar !== null) {
-    try {
-      const stored = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-      if (stored !== null && stored.length > 0) {
-        return { passphrase: stored, source: "keychain" };
-      }
-    } catch {
-    }
-  }
-  const fromEnv = env[ENV_VAR];
-  if (fromEnv !== void 0 && fromEnv.length > 0) {
-    return { passphrase: fromEnv, source: "env" };
-  }
-  return null;
-}
-async function passphraseForNewState(env = process.env) {
-  const stored = await resolvePassphraseFromStores(env);
-  if (stored !== null) return { ...stored, fresh: false };
-  if (!(await probeKeychain()).available) return null;
-  return { passphrase: (0, import_node_crypto2.randomBytes)(32).toString("base64url"), source: "keychain", fresh: true };
-}
-async function probeKeychain() {
-  const keytar = await loadKeytar();
-  if (keytar === null) return { available: false, hasEntry: false };
-  try {
-    const v = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-    return { available: true, hasEntry: v !== null && v.length > 0 };
-  } catch {
-    return { available: false, hasEntry: false };
-  }
-}
-async function setKeychainPassphrase(passphrase) {
-  if (passphrase.length === 0) {
-    throw new Error("refusing to store an empty passphrase in the keychain");
-  }
-  const keytar = await loadKeytarOrThrow();
-  await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, passphrase);
-}
-async function deleteKeychainPassphrase() {
-  const keytar = await loadKeytar();
-  if (keytar === null) return false;
-  try {
-    return await keytar.deletePassword(SERVICE_NAME, ACCOUNT_NAME);
-  } catch {
-    return false;
-  }
-}
-async function promptHiddenPassphrase(prompt) {
-  const stdin = process.stdin;
-  if (!stdin.isTTY) {
-    throw new Error(
-      `Cannot prompt for passphrase: stdin is not a TTY. Set ${ENV_VAR} for non-interactive use.`
-    );
-  }
-  process.stdout.write(prompt);
-  const wasRaw = stdin.isRaw;
-  stdin.setRawMode(true);
-  stdin.resume();
-  stdin.setEncoding("utf8");
-  return new Promise((resolve5, reject) => {
-    let buf = "";
-    const cleanup = () => {
-      stdin.removeListener("data", onData);
-      stdin.setRawMode(wasRaw);
-      stdin.pause();
-      process.stdout.write("\n");
-    };
-    const onData = (chunk) => {
-      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      for (let i = 0; i < text.length; i++) {
-        const ch = text[i];
-        if (ch === "") {
-          cleanup();
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "" && buf.length === 0) {
-          cleanup();
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "\r" || ch === "\n") {
-          cleanup();
-          resolve5(buf);
-          return;
-        }
-        if (ch === "\x7F" || ch === "\b") {
-          buf = buf.slice(0, -1);
-          continue;
-        }
-        buf += ch;
-      }
-    };
-    stdin.on("data", onData);
-  });
+  return { held: true, holder, stale: !holderMayRun(holder, deps) };
 }
 
 // src/paths.ts
@@ -7310,148 +7169,582 @@ function osDefaultDir(env, platform, home) {
   }
 }
 
-// src/server.ts
-var import_node_path10 = require("path");
-var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
-var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
-
-// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
-var external_exports = {};
-__export(external_exports, {
-  BRAND: () => BRAND,
-  DIRTY: () => DIRTY,
-  EMPTY_PATH: () => EMPTY_PATH,
-  INVALID: () => INVALID,
-  NEVER: () => NEVER,
-  OK: () => OK,
-  ParseStatus: () => ParseStatus,
-  Schema: () => ZodType,
-  ZodAny: () => ZodAny,
-  ZodArray: () => ZodArray,
-  ZodBigInt: () => ZodBigInt,
-  ZodBoolean: () => ZodBoolean,
-  ZodBranded: () => ZodBranded,
-  ZodCatch: () => ZodCatch,
-  ZodDate: () => ZodDate,
-  ZodDefault: () => ZodDefault,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodEffects: () => ZodEffects,
-  ZodEnum: () => ZodEnum,
-  ZodError: () => ZodError,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodFunction: () => ZodFunction,
-  ZodIntersection: () => ZodIntersection,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodLazy: () => ZodLazy,
-  ZodLiteral: () => ZodLiteral,
-  ZodMap: () => ZodMap,
-  ZodNaN: () => ZodNaN,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNever: () => ZodNever,
-  ZodNull: () => ZodNull,
-  ZodNullable: () => ZodNullable,
-  ZodNumber: () => ZodNumber,
-  ZodObject: () => ZodObject,
-  ZodOptional: () => ZodOptional,
-  ZodParsedType: () => ZodParsedType,
-  ZodPipeline: () => ZodPipeline,
-  ZodPromise: () => ZodPromise,
-  ZodReadonly: () => ZodReadonly,
-  ZodRecord: () => ZodRecord,
-  ZodSchema: () => ZodType,
-  ZodSet: () => ZodSet,
-  ZodString: () => ZodString,
-  ZodSymbol: () => ZodSymbol,
-  ZodTransformer: () => ZodEffects,
-  ZodTuple: () => ZodTuple,
-  ZodType: () => ZodType,
-  ZodUndefined: () => ZodUndefined,
-  ZodUnion: () => ZodUnion,
-  ZodUnknown: () => ZodUnknown,
-  ZodVoid: () => ZodVoid,
-  addIssueToContext: () => addIssueToContext,
-  any: () => anyType,
-  array: () => arrayType,
-  bigint: () => bigIntType,
-  boolean: () => booleanType,
-  coerce: () => coerce,
-  custom: () => custom,
-  date: () => dateType,
-  datetimeRegex: () => datetimeRegex,
-  defaultErrorMap: () => en_default,
-  discriminatedUnion: () => discriminatedUnionType,
-  effect: () => effectsType,
-  enum: () => enumType,
-  function: () => functionType,
-  getErrorMap: () => getErrorMap,
-  getParsedType: () => getParsedType,
-  instanceof: () => instanceOfType,
-  intersection: () => intersectionType,
-  isAborted: () => isAborted,
-  isAsync: () => isAsync,
-  isDirty: () => isDirty,
-  isValid: () => isValid,
-  late: () => late,
-  lazy: () => lazyType,
-  literal: () => literalType,
-  makeIssue: () => makeIssue,
-  map: () => mapType,
-  nan: () => nanType,
-  nativeEnum: () => nativeEnumType,
-  never: () => neverType,
-  null: () => nullType,
-  nullable: () => nullableType,
-  number: () => numberType,
-  object: () => objectType,
-  objectUtil: () => objectUtil,
-  oboolean: () => oboolean,
-  onumber: () => onumber,
-  optional: () => optionalType,
-  ostring: () => ostring,
-  pipeline: () => pipelineType,
-  preprocess: () => preprocessType,
-  promise: () => promiseType,
-  quotelessJson: () => quotelessJson,
-  record: () => recordType,
-  set: () => setType,
-  setErrorMap: () => setErrorMap,
-  strictObject: () => strictObjectType,
-  string: () => stringType,
-  symbol: () => symbolType,
-  transformer: () => effectsType,
-  tuple: () => tupleType,
-  undefined: () => undefinedType,
-  union: () => unionType,
-  unknown: () => unknownType,
-  util: () => util,
-  void: () => voidType
-});
+// src/seed.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto3 = require("crypto");
+var import_node_fs3 = require("fs");
+var import_node_path4 = require("path");
 
-// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
-var util;
-(function(util2) {
-  util2.assertEqual = (_) => {
-  };
-  function assertIs(_arg) {
-  }
-  util2.assertIs = assertIs;
-  function assertNever(_x) {
-    throw new Error();
-  }
-  util2.assertNever = assertNever;
-  util2.arrayToEnum = (items) => {
-    const obj = {};
-    for (const item of items) {
-      obj[item] = item;
-    }
-    return obj;
-  };
-  util2.getValidEnumValues = (obj) => {
-    const validKeys = util2.objectKeys(obj).filter((k) => typeof obj[obj[k]] !== "number");
-    const filtered = {};
-    for (const k of validKeys) {
-      filtered[k] = obj[k];
-    }
+// src/state.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_path3 = require("path");
+var import_argon2 = __toESM(require("argon2"), 1);
+var FORMAT_TAG = "SEAL_MCP_STATE v1";
+var STATE_VERSION = 1;
+var ARGON2_MEMORY_KIB = 65536;
+var ARGON2_ITERATIONS = 3;
+var ARGON2_PARALLELISM = 4;
+var ARGON2_SALT_BYTES = 16;
+var KDF_BOUNDS = {
+  memory_kib: { min: 8192, max: 1048576 },
+  // 8 MiB .. 1 GiB
+  iterations: { min: 1, max: 16 },
+  parallelism: { min: 1, max: 16 }
+};
+var AES_KEY_BYTES = 32;
+var AES_NONCE_BYTES = 12;
+var StatePassphraseInvalid = class extends Error {
+  constructor() {
+    super("AES-256-GCM tag check failed: another passphrase, or a tampered file");
+    this.name = "StatePassphraseInvalid";
+  }
+};
+var StateCorrupt = class extends Error {
+  constructor(reason) {
+    super(`state.corrupt: ${reason}`);
+    this.name = "StateCorrupt";
+  }
+};
+function toB642(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function fromB642(s) {
+  return new Uint8Array(Buffer.from(s, "base64"));
+}
+var CURRENT_KDF_PARAMS = {
+  memory_kib: ARGON2_MEMORY_KIB,
+  iterations: ARGON2_ITERATIONS,
+  parallelism: ARGON2_PARALLELISM
+};
+function boundedKdfParam(name, value) {
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    throw new StateCorrupt(`kdf.${name} is not an integer: ${String(value)}`);
+  }
+  const { min, max } = KDF_BOUNDS[name];
+  if (value < min || value > max) {
+    throw new StateCorrupt(`kdf.${name}=${value} outside sane bounds [${min}, ${max}]`);
+  }
+  return value;
+}
+async function deriveKek(passphrase, saltB64, params) {
+  const salt = fromB642(saltB64);
+  if (salt.length !== ARGON2_SALT_BYTES) {
+    throw new StateCorrupt(`salt length is ${salt.length}, expected ${ARGON2_SALT_BYTES}`);
+  }
+  const kek = await import_argon2.default.hash(passphrase, {
+    type: import_argon2.default.argon2id,
+    raw: true,
+    salt: Buffer.from(salt),
+    memoryCost: params.memory_kib,
+    timeCost: params.iterations,
+    parallelism: params.parallelism,
+    hashLength: AES_KEY_BYTES
+  });
+  return new Uint8Array(kek);
+}
+async function aesGcmEncrypt(kek, nonce, plaintext) {
+  const key = await import_node_crypto2.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["encrypt"]);
+  const ct = await import_node_crypto2.webcrypto.subtle.encrypt(
+    { name: "AES-GCM", iv: nonce, tagLength: 128 },
+    key,
+    plaintext
+  );
+  return new Uint8Array(ct);
+}
+async function aesGcmDecrypt(kek, nonce, ciphertextWithTag) {
+  const key = await import_node_crypto2.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["decrypt"]);
+  try {
+    const pt = await import_node_crypto2.webcrypto.subtle.decrypt(
+      { name: "AES-GCM", iv: nonce, tagLength: 128 },
+      key,
+      ciphertextWithTag
+    );
+    return new Uint8Array(pt);
+  } catch {
+    throw new StatePassphraseInvalid();
+  }
+}
+function createEmptyState(identity) {
+  return {
+    version: STATE_VERSION,
+    identity,
+    handles: {},
+    audit: [],
+    pending: {}
+  };
+}
+function validateEnvelope(json) {
+  if (typeof json !== "object" || json === null) {
+    throw new StateCorrupt("envelope is not an object");
+  }
+  const e = json;
+  if (e.version !== STATE_VERSION) {
+    throw new StateCorrupt(`unknown version: ${String(e.version)}`);
+  }
+  if (e.format !== FORMAT_TAG) {
+    throw new StateCorrupt(`unknown format tag: ${String(e.format)}`);
+  }
+  const kdf = e.kdf;
+  if (!kdf || kdf.algo !== "argon2id" || typeof kdf.salt_b64 !== "string") {
+    throw new StateCorrupt("kdf header missing or wrong algo");
+  }
+  const cipher = e.cipher;
+  if (!cipher || cipher.algo !== "aes-256-gcm" || typeof cipher.nonce_b64 !== "string" || typeof cipher.ciphertext_b64 !== "string") {
+    throw new StateCorrupt("cipher header missing or wrong algo");
+  }
+}
+function validatePlaintext(json) {
+  if (typeof json !== "object" || json === null) {
+    throw new StateCorrupt("plaintext is not an object");
+  }
+  const s = json;
+  if (s.version !== STATE_VERSION) {
+    throw new StateCorrupt(`plaintext version: ${String(s.version)}`);
+  }
+  const id = s.identity;
+  if (!id || typeof id.x25519_secret_b64 !== "string" || typeof id.x25519_public_b64 !== "string") {
+    throw new StateCorrupt("identity missing or malformed");
+  }
+  if (typeof s.handles !== "object" || s.handles === null) {
+    throw new StateCorrupt("handles is not an object");
+  }
+  if (!Array.isArray(s.audit)) {
+    throw new StateCorrupt("audit is not an array");
+  }
+  if (s.pending !== void 0 && (typeof s.pending !== "object" || s.pending === null)) {
+    throw new StateCorrupt("pending is not an object");
+  }
+}
+async function loadState(passphrase, statePath) {
+  const raw = await import_node_fs2.promises.readFile(statePath, "utf8");
+  let envelope;
+  try {
+    envelope = JSON.parse(raw);
+  } catch (err2) {
+    throw new StateCorrupt(`envelope is not valid JSON: ${err2.message}`);
+  }
+  validateEnvelope(envelope);
+  const kek = await deriveKek(passphrase, envelope.kdf.salt_b64, {
+    memory_kib: boundedKdfParam("memory_kib", envelope.kdf.memory_kib),
+    iterations: boundedKdfParam("iterations", envelope.kdf.iterations),
+    parallelism: boundedKdfParam("parallelism", envelope.kdf.parallelism)
+  });
+  const nonce = fromB642(envelope.cipher.nonce_b64);
+  if (nonce.length !== AES_NONCE_BYTES) {
+    throw new StateCorrupt(`nonce length is ${nonce.length}, expected ${AES_NONCE_BYTES}`);
+  }
+  const ct = fromB642(envelope.cipher.ciphertext_b64);
+  const ptBytes = await aesGcmDecrypt(kek, nonce, ct);
+  const ptText = new TextDecoder("utf-8", { fatal: true }).decode(ptBytes);
+  let plaintext;
+  try {
+    plaintext = JSON.parse(ptText);
+  } catch (err2) {
+    throw new StateCorrupt(`plaintext is not valid JSON: ${err2.message}`);
+  }
+  validatePlaintext(plaintext);
+  if (plaintext.pending === void 0) {
+    plaintext.pending = {};
+  }
+  return plaintext;
+}
+async function saveState(state, passphrase, statePath) {
+  validatePlaintext(state);
+  const salt = (0, import_node_crypto2.randomBytes)(ARGON2_SALT_BYTES);
+  const nonce = (0, import_node_crypto2.randomBytes)(AES_NONCE_BYTES);
+  const kek = await deriveKek(passphrase, toB642(salt), CURRENT_KDF_PARAMS);
+  const ptBytes = new TextEncoder().encode(JSON.stringify(state));
+  const ct = await aesGcmEncrypt(kek, nonce, ptBytes);
+  const envelope = {
+    version: STATE_VERSION,
+    format: FORMAT_TAG,
+    kdf: {
+      algo: "argon2id",
+      memory_kib: ARGON2_MEMORY_KIB,
+      iterations: ARGON2_ITERATIONS,
+      parallelism: ARGON2_PARALLELISM,
+      salt_b64: toB642(salt)
+    },
+    cipher: {
+      algo: "aes-256-gcm",
+      nonce_b64: toB642(nonce),
+      ciphertext_b64: toB642(ct),
+      tag_included: true
+    }
+  };
+  const dir = (0, import_node_path3.dirname)(statePath);
+  await import_node_fs2.promises.mkdir(dir, { recursive: true, mode: 448 });
+  const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
+  const fh = await import_node_fs2.promises.open(tmp, "w", 384);
+  try {
+    await fh.writeFile(JSON.stringify(envelope), "utf8");
+    await fh.sync();
+  } finally {
+    await fh.close();
+  }
+  await import_node_fs2.promises.rename(tmp, statePath);
+  try {
+    const dh = await import_node_fs2.promises.open(dir, "r");
+    try {
+      await dh.sync();
+    } finally {
+      await dh.close();
+    }
+  } catch {
+  }
+  await import_node_fs2.promises.chmod(dir, 448).catch(() => {
+  });
+}
+function updateState(passphrase, statePath, mutate) {
+  return withStateLock((0, import_node_path3.dirname)(statePath), async () => {
+    const view = await loadState(passphrase, statePath);
+    if (await mutate(view) !== false) await saveState(view, passphrase, statePath);
+    return view;
+  });
+}
+
+// src/seed.ts
+var SEED_ENV_VAR = "SEAL_SEED";
+var EPHEMERAL_ENV_VAR = "SEAL_MCP_EPHEMERAL";
+var PASSPHRASE_ENV_VAR = "SEAL_MCP_PASSPHRASE";
+var SEED_FILE_NAME = "seed";
+var KEYCHAIN_SERVICE = "seal-mcp";
+var KEYCHAIN_ACCOUNT = "seed";
+var LEGACY_KEYCHAIN_ACCOUNT = "state";
+var SeedInvalidError = class extends Error {
+  code = "seed_invalid";
+  constructor(where) {
+    super(
+      `${where} is not an agent key: expected 43 base64url characters, as \`sealnet-mcp seed --force\` or \`seal keygen --export --force\` print them`
+    );
+    this.name = "SeedInvalidError";
+  }
+};
+var IdentityConflictError = class extends Error {
+  code = "identity_conflict";
+  constructor(statePath) {
+    super(
+      `${statePath} does not open with this agent's key: it belongs to another key (a foreign ${SEED_ENV_VAR}?) or was tampered with. Unset ${SEED_ENV_VAR}, or run \`sealnet-mcp reset --force\` to start over with a new address.`
+    );
+    this.name = "IdentityConflictError";
+  }
+};
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    (0, import_node_child_process.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
+var keytarCache = void 0;
+async function loadKeytar() {
+  if (keytarCache !== void 0) return keytarCache;
+  try {
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    keytarCache = keytarOverKeyring(keyring);
+  } catch {
+    keytarCache = null;
+  }
+  return keytarCache;
+}
+async function keychainGet(account) {
+  const keytar = await loadKeytar();
+  if (keytar === null) return null;
+  try {
+    const value = await keytar.getPassword(KEYCHAIN_SERVICE, account);
+    return value !== null && value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function keychainDelete(account) {
+  const keytar = await loadKeytar();
+  if (keytar === null) return false;
+  try {
+    return await keytar.deletePassword(KEYCHAIN_SERVICE, account);
+  } catch {
+    return false;
+  }
+}
+function parseSeed(text, where) {
+  const seed = Buffer.from(text, "base64url");
+  if (!/^[A-Za-z0-9_-]{43}$/.test(text) || seed.toString("base64url") !== text) throw new SeedInvalidError(where);
+  return new Uint8Array(seed);
+}
+async function readSeed(stateDir, env = process.env) {
+  const fromEnv = env[SEED_ENV_VAR]?.trim();
+  if (fromEnv) return { seed: parseSeed(fromEnv, SEED_ENV_VAR), source: "env" };
+  const stored = await keychainGet(KEYCHAIN_ACCOUNT);
+  if (stored !== null) return { seed: parseSeed(stored, `keychain entry ${KEYCHAIN_SERVICE}/${KEYCHAIN_ACCOUNT}`), source: "keychain" };
+  const file = (0, import_node_path4.join)(stateDir, SEED_FILE_NAME);
+  let text;
+  try {
+    text = await import_node_fs3.promises.readFile(file, "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return null;
+    throw err2;
+  }
+  return { seed: parseSeed(text.trim(), file), source: "file" };
+}
+async function storeSeed(stateDir, seed) {
+  const text = Buffer.from(seed).toString("base64url");
+  const keytar = await loadKeytar();
+  if (keytar !== null) {
+    try {
+      await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, text);
+      return "keychain";
+    } catch {
+    }
+  }
+  const fh = await import_node_fs3.promises.open((0, import_node_path4.join)(stateDir, SEED_FILE_NAME), "wx", 384);
+  try {
+    await fh.writeFile(`${text}
+`, "utf8");
+    await fh.sync();
+  } finally {
+    await fh.close();
+  }
+  return "file";
+}
+function statePassphrase(seed) {
+  return Buffer.from((0, import_node_crypto3.hkdfSync)("sha256", seed, "seal-mcp:state:v1", "passphrase", 32)).toString("base64url");
+}
+async function legacyPassphrase(env) {
+  const stored = await keychainGet(LEGACY_KEYCHAIN_ACCOUNT);
+  if (stored !== null) return { passphrase: stored, source: "keychain" };
+  const fromEnv = env[PASSPHRASE_ENV_VAR];
+  return fromEnv ? { passphrase: fromEnv, source: "env" } : null;
+}
+async function tryOpen(passphrase, statePath) {
+  try {
+    return await loadState(passphrase, statePath);
+  } catch (err2) {
+    if (err2 instanceof StatePassphraseInvalid) return null;
+    throw err2;
+  }
+}
+async function requireIdentity(view, seed, statePath) {
+  const { secret } = await loadIdentity(view.identity);
+  if (!Buffer.from(secret).equals(Buffer.from(seed))) throw new IdentityConflictError(statePath);
+}
+function openAgentState(path, env = process.env) {
+  return withStateLock(path.dir, async () => {
+    let root = await readSeed(path.dir, env);
+    if (!await import_node_fs3.promises.stat(path.statePath).then(() => true, () => false)) {
+      if (root === null) {
+        const { secret } = await generateIdentity();
+        root = { seed: secret, source: await storeSeed(path.dir, secret) };
+      }
+      const passphrase2 = statePassphrase(root.seed);
+      const identity = await identityFromSeed(root.seed);
+      await saveState(createEmptyState(identityToFields(identity)), passphrase2, path.statePath);
+      return { root, passphrase: passphrase2, created: true, moved: null };
+    }
+    if (root !== null) {
+      const view2 = await tryOpen(statePassphrase(root.seed), path.statePath);
+      if (view2 !== null) {
+        await requireIdentity(view2, root.seed, path.statePath);
+        return { root, passphrase: statePassphrase(root.seed), created: false, moved: null };
+      }
+    }
+    const legacy = await legacyPassphrase(env);
+    const view = legacy === null ? null : await tryOpen(legacy.passphrase, path.statePath);
+    if (legacy === null || view === null) throw new IdentityConflictError(path.statePath);
+    if (root !== null) await requireIdentity(view, root.seed, path.statePath);
+    else {
+      const { secret } = await loadIdentity(view.identity);
+      root = { seed: secret, source: await storeSeed(path.dir, secret) };
+    }
+    const passphrase = statePassphrase(root.seed);
+    await saveState(view, passphrase, path.statePath);
+    await keychainDelete(LEGACY_KEYCHAIN_ACCOUNT);
+    return { root, passphrase, created: false, moved: legacy.source };
+  });
+}
+async function deleteRootSecret(stateDir) {
+  let seedFile = true;
+  await import_node_fs3.promises.unlink((0, import_node_path4.join)(stateDir, SEED_FILE_NAME)).catch((err2) => {
+    if (err2.code !== "ENOENT") throw err2;
+    seedFile = false;
+  });
+  const seed = await keychainDelete(KEYCHAIN_ACCOUNT);
+  const legacy = await keychainDelete(LEGACY_KEYCHAIN_ACCOUNT);
+  return { seedFile, keychain: seed || legacy };
+}
+async function probeKeychain() {
+  const keytar = await loadKeytar();
+  if (keytar === null) return { available: false, hasSeed: false };
+  try {
+    const value = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    return { available: true, hasSeed: value !== null && value.length > 0 };
+  } catch {
+    return { available: false, hasSeed: false };
+  }
+}
+
+// src/server.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+var external_exports = {};
+__export(external_exports, {
+  BRAND: () => BRAND,
+  DIRTY: () => DIRTY,
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
+});
+
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+var util;
+(function(util2) {
+  util2.assertEqual = (_) => {
+  };
+  function assertIs(_arg) {
+  }
+  util2.assertIs = assertIs;
+  function assertNever(_x) {
+    throw new Error();
+  }
+  util2.assertNever = assertNever;
+  util2.arrayToEnum = (items) => {
+    const obj = {};
+    for (const item of items) {
+      obj[item] = item;
+    }
+    return obj;
+  };
+  util2.getValidEnumValues = (obj) => {
+    const validKeys = util2.objectKeys(obj).filter((k) => typeof obj[obj[k]] !== "number");
+    const filtered = {};
+    for (const k of validKeys) {
+      filtered[k] = obj[k];
+    }
     return util2.objectValues(filtered);
   };
   util2.objectValues = (obj) => {
@@ -11421,7 +11714,7 @@ var seal_mcp_v1_default = {
         required: ["handle", "receipt", "handoff_channel"],
         properties: {
           handle: { type: "string", pattern: "^h_[A-Za-z0-9_-]{12,}$", description: "Opaque server-internal ID. Used by `seal_revoke` and other tools. 12+ base64url chars after the `h_` prefix \u2014 the alphabet includes `-` and `_` (generateHandle emits base64url), so the pattern must too." },
-          receipt: { type: "string", description: "Plain-text status the model should relay verbatim to the user. e.g. 'The seal link is on your clipboard. Paste it to the recipient.' In ephemeral mode (see `passphrase_delivery`) it adds that the handle lives until the server restarts and the seal's expiry does not depend on it." },
+          receipt: { type: "string", description: "Plain-text status the model should relay verbatim to the user. e.g. 'The seal link is on your clipboard. Paste it to the recipient.' In ephemeral mode (see `root_secret.ephemeral_mode`) it adds that the handle lives until the server restarts and the seal's expiry does not depend on it." },
           handoff_channel: { type: "string", enum: ["clipboard", "file"] },
           handoff_file: { type: "string", description: "ONLY when handoff_channel='file'. Absolute path to a 0o600 file containing the share link and a newline." },
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
@@ -11757,7 +12050,7 @@ var seal_mcp_v1_default = {
           type: "object",
           required: ["x25519_secret_b64", "x25519_public_b64"],
           properties: {
-            x25519_secret_b64: { type: "string", description: "32 raw bytes, base64-padded. Generated once, at `sealnet-mcp init` or at the first `sealnet-mcp serve` without state. Lost passphrase = lost identity = unable to open incoming targeted seals; handoff continues to work without identity." },
+            x25519_secret_b64: { type: "string", description: "32 raw bytes, base64url. The seed of `root_secret`: must equal it, else the server refuses with `identity_conflict`. Lost seed = lost address = incoming targeted seals unopenable; handoff continues to work without identity." },
             x25519_public_b64: { type: "string", description: "32 raw bytes, derived from secret. Safe to publish; advertised so other parties can target this MCP." }
           }
         },
@@ -11778,7 +12071,7 @@ var seal_mcp_v1_default = {
         },
         pending: {
           type: "object",
-          description: "Durable operation journal (ISSUE-0623), keyed by handle. A seal_share journals BEFORE its first remote effect and checkpoints every step; completion removes the entry in the same envelope write that inserts the durable handle. OPTIONAL: envelopes written before the journal existed omit it and readers normalise to {}. Recovery semantics at server start: 'preparing' (no confirmed remote effect) is dropped; 'uploaded'/'awaiting_payment'/'compensating' (URL never delivered) is revoked, AWAITED \u2014 an unpaid seal cannot be finished after a restart, and a payment that lands after the revoke is refunded by the server; 'delivering' (URL possibly already delivered) is ADOPTED as a durable handle \u2014 never revoked, so the owner keeps control of a link the user may already hold.",
+          description: "Durable operation journal (ISSUE-0623), keyed by handle. A seal_share journals BEFORE its first remote effect and checkpoints every step; completion removes the entry in the same envelope write that inserts the durable handle. OPTIONAL: envelopes written before the journal existed omit it and readers normalise to {}. Recovery semantics at server start, for entries whose `owner` cannot still be running (several MCP hosts share one state, SPEC-ADDRESS F1 \xA74): 'preparing' (no confirmed remote effect) is dropped; 'uploaded'/'awaiting_payment'/'compensating' (URL never delivered) is revoked, AWAITED \u2014 an unpaid seal cannot be finished after a restart, and a payment that lands after the revoke is refunded by the server; 'delivering' (URL possibly already delivered) is ADOPTED as a durable handle \u2014 never revoked, so the owner keeps control of a link the user may already hold.",
           additionalProperties: {
             type: "object",
             required: ["tool", "mode", "started_at", "owner_token_b64", "expires_at", "step"],
@@ -11791,6 +12084,12 @@ var seal_mcp_v1_default = {
               step: { type: "string", enum: ["preparing", "awaiting_payment", "uploaded", "delivering", "compensating"] },
               seal_id: { type: "string", pattern: "^[A-Za-z0-9_-]{6,20}$", description: "Set once the upload confirms; (seal_id, owner_token_b64) is the full revoke capability." },
               handoff_channels_attempted: { type: "array", items: { type: "string", enum: ["clipboard", "file"] }, description: "Channels performHandoff will try, in order (handoff mode only; journaled before delivery starts)." },
+              owner: {
+                type: "object",
+                required: ["pid", "hostname"],
+                properties: { pid: { type: "integer" }, hostname: { type: "string" } },
+                description: "The process running the operation. Recovery leaves an entry alone while that process may still run: alive on this host, or on another host, which cannot be probed (the state lock's rule). Entries without it, from 0.2.x, are recovered as crashed."
+              },
               compensation: {
                 type: "object",
                 required: ["action", "outcome", "error", "at"],
@@ -11820,29 +12119,22 @@ var seal_mcp_v1_default = {
           }
         }
       }
-    }
-  },
-  passphrase_delivery: {
-    ordered_priority: [
-      {
-        rank: 1,
-        method: "os_keychain",
-        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
-        default: true
-      },
-      {
-        rank: 2,
-        method: "env_var",
-        implementation: "$SEAL_MCP_PASSPHRASE. Visible to same-user attackers via /proc/<pid>/environ on Linux. Warning logged on stderr at startup. Use only in CI / headless containers."
-      },
-      {
-        rank: 3,
-        method: "REFUSED",
-        implementation: "Cleartext passphrase file on disk is explicitly refused even if user passes `--passphrase-file \u2026`. Error message points at options 1 and 2."
-      }
+    }
+  },
+  root_secret: {
+    seed: "The agent's one root secret (SPEC-ADDRESS F1): a 32-byte X25519 secret, as text 43 base64url characters \u2014 the same bytes as `state.identity.x25519_secret_b64`, the CLI's `identity.v1.json::x25519_secret_b64url`, the SDK's `KeyPair.secretKey` and sealnet's `keygen().secret_key`. Its public half is the agent's address; it must survive a restart, a second MCP host on the machine and a move to the cloud.",
+    ordered_sources: [
+      { rank: 1, source: "env", implementation: "$SEAL_SEED. How a container or a cloud session gets the same address as at home." },
+      { rank: 2, source: "keychain", implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service 'seal-mcp', account 'seed', the seed as UTF-8 bytes." },
+      { rank: 3, source: "file", implementation: "`<state_dir>/seed`, mode 0600 in the 0700 state directory, created on the first start where there is no keychain. The CLI's threat model (`secrets.rs`): a process running as this user reads it either way, keychain or file." }
     ],
-    ephemeral_mode: "First `serve` without state where neither the keychain nor SEAL_MCP_PASSPHRASE is available (container, CI), or `serve --ephemeral`: identity, handles, journal and audit live only in process memory and nothing is written to disk (rank 3 stays refused). The `seal_share` receipt says the handle lives until the server restarts and the seal's expiry does not depend on it.",
-    lost_passphrase_recovery: "Passphrase is NOT recoverable. `sealnet-mcp init --force` mints a new identity, but old targeted seals (addressed to the old pubkey) become permanently unopenable. Handoff seals are not affected (they don't use identity)."
+    created: "The first `serve` (or `init`) with no seed in any source makes one and keeps it in the keychain, or in the file where there is none. `init` asks nothing.",
+    state_passphrase: "base64url(HKDF-SHA256(ikm = seed, salt = 'seal-mcp:state:v1', info = 'passphrase', 32 bytes)). The state envelope (Argon2id \u2192 AES-256-GCM) is unchanged; only where its passphrase comes from changed. One root secret instead of a passphrase and a key.",
+    identity_conflict: "`state.identity` must be the seed. A state that opens neither with the seed's passphrase nor with a migration passphrase belongs to another key (a foreign SEAL_SEED): `serve` refuses with `identity_conflict`, exit 3. Unset SEAL_SEED, or `sealnet-mcp reset --force`. The address never changes silently.",
+    migration_0_2: "Once, when no seed exists in any source and a state does: open it with the old passphrase (keychain entry 'seal-mcp'/'state', including the Linux entry keytar wrote, or $SEAL_MCP_PASSPHRASE), take the seed from `state.identity`, store it (keychain 'seed', else the file), save the same state under the seed's passphrase (atomic, as every save), delete the old keychain entry. $SEAL_MCP_PASSPHRASE is read only here and warns that it is no longer used. Removed in the first minor release after no 0.2.x state is left, the condition `readKeytarLinuxEntry` carries.",
+    ephemeral_mode: "Only `serve --ephemeral` or $SEAL_MCP_EPHEMERAL=1: a new key each start; identity, handles, journal and audit live only in process memory, nothing is written to disk. The `seal_share` receipt says the handle lives until the server restarts and the seal's expiry does not depend on it.",
+    several_hosts: "Every MCP host of one user on one machine (Claude Desktop, Claude Code, Cursor) runs its own `serve` on the same state: one seed, one address. The state lock is taken per write, not for a process lifetime: each change re-reads `state.json`, applies this process's insertions and explicit deletions and saves. Waiting for the lock ends after 5 s with `state_busy`.",
+    lost_seed: "The seed is the address: lost (`reset --force`, a wiped keychain with no file) means links addressed to the old key stay unopenable and paired owners must pair again; handoff seals are unaffected. `sealnet-mcp seed --force` prints it, to move the agent by setting SEAL_SEED elsewhere."
   },
   handoff_delivery: {
     primary_channel: "system_clipboard",
@@ -11918,11 +12210,12 @@ var seal_mcp_v1_default = {
     pro_file_not_granted: "seal_pro_file_get: the room's seal is visible but a file's key envelope is refused to this agent.",
     pro_failed: "seal_pro_*: SEAL Pro answered with another error; the message has the status.",
     state_persist_failed: "seal_share: the journal checkpoint (`uploaded` or `delivering`) could not be made durable. The fresh seal is auto-revoked (compensation outcome embedded in the message) because delivering a capability the journal cannot account for is worse than failing the call.",
+    state_busy: "Another sealnet-mcp process held the state lock for more than 5 s. Nothing was changed by this call; safe to retry.",
     runtime_unsupported: "Node runtime is missing a global the bundle assumes (e.g. `globalThis.File` or `globalThis.Blob`). Upgrade to Node \u226520.",
     internal_inconsistency: "Server detected a state branch the type-system thought was unreachable (e.g. forward gate passed but recipientPub is null). Always a bug \u2014 caller should report.",
-    "state.passphrase_invalid": "AES-256-GCM tag check failed. Likely wrong passphrase in keychain / env; could be tampered file. Server refuses to start.",
+    identity_conflict: "Startup: the state does not open with this seed's passphrase nor with a migration passphrase \u2014 it belongs to another key (a foreign SEAL_SEED), or it was tampered with. Server refuses to start (exit 3); see `root_secret.identity_conflict`.",
     "state.corrupt": "Envelope JSON malformed or version unknown. Server refuses to start; user must rerun `sealnet-mcp init --force` (lose old data) or restore from backup.",
-    state_dir_unsafe: "Startup: the state directory is a symlink or not a real directory \u2014 the lifetime lock and the envelope it protects would resolve to different places. Server refuses to start.",
+    state_dir_unsafe: "The state directory is a symlink or not a real directory \u2014 the state lock and the envelope it protects would resolve to different places. Refused.",
     base_url_invalid: "Startup/config: backend or public-host base URL is not an absolute http(s) URL, or carries a query string / fragment / embedded credentials. Every derived URL would be corrupt, so the value is rejected at configuration time."
   },
   current_format_version: 1,
@@ -11949,7 +12242,7 @@ function safeFilename(name) {
   return cleaned.length > 0 ? cleaned : "seal-file";
 }
 async function receiveToDisk(opened, dir, name) {
-  const fs3 = await import(
+  const fs4 = await import(
     /* webpackIgnore: true */
     /* @vite-ignore */
     "fs/promises"
@@ -11959,10 +12252,10 @@ async function receiveToDisk(opened, dir, name) {
     /* @vite-ignore */
     "path"
   );
-  await fs3.mkdir(dir, { recursive: true });
+  await fs4.mkdir(dir, { recursive: true });
   const suffix = Array.from(crypto.getRandomValues(new Uint8Array(6)), (b) => b.toString(16).padStart(2, "0")).join("");
   const tmp = path.join(dir, `.seal-partial-${suffix}`);
-  const fh = await fs3.open(tmp, "wx", 384);
+  const fh = await fs4.open(tmp, "wx", 384);
   let placed = false;
   try {
     await opened.stream.pipeTo(
@@ -11980,12 +12273,12 @@ async function receiveToDisk(opened, dir, name) {
     for (let i = 0; i < 1e3; i++) {
       const candidate = path.join(dir, i === 0 ? name : `${stem} (${i})${ext}`);
       try {
-        await fs3.link(tmp, candidate);
+        await fs4.link(tmp, candidate);
       } catch (err2) {
         if (err2.code === "EEXIST") continue;
         throw err2;
       }
-      await fs3.unlink(tmp);
+      await fs4.unlink(tmp);
       placed = true;
       return { path: candidate, sizeBytes, sha256: sha2562 };
     }
@@ -11993,7 +12286,7 @@ async function receiveToDisk(opened, dir, name) {
   } finally {
     if (!placed) {
       await fh.close().catch(() => void 0);
-      await fs3.unlink(tmp).catch(() => void 0);
+      await fs4.unlink(tmp).catch(() => void 0);
     }
   }
 }
@@ -12353,320 +12646,102 @@ async function loadWorkloadCredentials(env = process.env) {
   const path = workloadCredentialsPath(env);
   let text;
   try {
-    text = await (0, import_promises2.readFile)(path, "utf-8");
-  } catch (err2) {
-    if (err2.code === "ENOENT") return null;
-    throw err2;
-  }
-  const file = JSON.parse(text);
-  if (file.version !== 1 || !file.workload_id || !file.base_url || !file.seed_b64) {
-    throw new Error(`${path} is not a SEAL Pro workload credentials file`);
-  }
-  return { workloadId: file.workload_id, baseUrl: file.base_url, seedB64: file.seed_b64 };
-}
-
-// src/recovery.ts
-function nowIso(now) {
-  return (now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-}
-async function recoverPendingOperations(view, client, opts = {}) {
-  const log4 = opts.log ?? ((line) => void process.stderr.write(`${line}
-`));
-  const report = { adopted: [], revoked: [], stillFailing: [], dropped: [] };
-  let changed = false;
-  for (const [handle, op] of Object.entries(view.pending)) {
-    if (op.tool !== "seal_share") {
-      log4(`[seal-mcp] recovery: skipping unknown pending op tool=${String(op.tool)} handle=${handle}`);
-      continue;
-    }
-    if (op.seal_id === void 0) {
-      delete view.pending[handle];
-      report.dropped.push(handle);
-      changed = true;
-      log4(`[seal-mcp] recovery: dropped pre-upload journal entry ${handle} (no remote effect)`);
-      continue;
-    }
-    if (op.step === "delivering") {
-      adoptAsHandle(view, handle, op, opts.now);
-      report.adopted.push(handle);
-      changed = true;
-      log4(
-        `[seal-mcp] recovery: adopted ${handle} as a durable handle \u2014 handoff was in flight (attempted: ${(op.handoff_channels_attempted ?? []).join("\u2192") || "unknown"}); the URL may have been delivered, so the seal stays live under owner control`
-      );
-      continue;
-    }
-    if (op.backend_url !== void 0 && op.backend_url !== client.baseUrl) {
-      op.step = "compensating";
-      op.compensation = {
-        action: "revoke",
-        outcome: "failed",
-        error: `backend mismatch: op belongs to ${op.backend_url}, server configured for ${client.baseUrl}`,
-        at: nowIso(opts.now)
-      };
-      report.stillFailing.push(handle);
-      changed = true;
-      log4(
-        `[seal-mcp] recovery: NOT compensating ${handle} \u2014 it belongs to ${op.backend_url} but this server talks to ${client.baseUrl}; kept in journal until the server runs against the original backend`
-      );
-      continue;
-    }
-    try {
-      await client.revoke(op.seal_id, op.owner_token_b64);
-      delete view.pending[handle];
-      report.revoked.push(handle);
-      changed = true;
-      log4(`[seal-mcp] recovery: revoked orphaned seal for ${handle} (step was '${op.step}')`);
-    } catch (err2) {
-      const msg = err2 instanceof Error ? err2.message : String(err2);
-      op.step = "compensating";
-      op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso(opts.now) };
-      report.stillFailing.push(handle);
-      changed = true;
-      log4(
-        `[seal-mcp] recovery: revoke retry for ${handle} failed (${msg}) \u2014 kept in journal, seal expires by TTL at ${op.expires_at}`
-      );
-    }
-  }
-  return { report, changed };
-}
-function adoptAsHandle(view, handle, op, now) {
-  const sealId = op.seal_id;
-  if (view.handles[handle] === void 0) {
-    view.handles[handle] = {
-      seal_id: sealId,
-      owner_token_b64: op.owner_token_b64,
-      created_at: op.started_at,
-      mode: op.mode,
-      expires_at: op.expires_at,
-      // Propagate provenance so a later seal_revoke on the adopted
-      // handle still refuses to target the wrong backend.
-      backend_url: op.backend_url
-    };
-    view.audit.push({ ts: nowIso(now), tool: "seal_share", handle, mode: op.mode });
-  }
-  delete view.pending[handle];
-}
-
-// src/state.ts
-var import_node_crypto3 = require("crypto");
-var import_node_fs2 = require("fs");
-var import_node_path3 = require("path");
-var import_argon2 = __toESM(require("argon2"), 1);
-var FORMAT_TAG = "SEAL_MCP_STATE v1";
-var STATE_VERSION = 1;
-var ARGON2_MEMORY_KIB = 65536;
-var ARGON2_ITERATIONS = 3;
-var ARGON2_PARALLELISM = 4;
-var ARGON2_SALT_BYTES = 16;
-var KDF_BOUNDS = {
-  memory_kib: { min: 8192, max: 1048576 },
-  // 8 MiB .. 1 GiB
-  iterations: { min: 1, max: 16 },
-  parallelism: { min: 1, max: 16 }
-};
-var AES_KEY_BYTES = 32;
-var AES_NONCE_BYTES = 12;
-var StatePassphraseInvalid = class extends Error {
-  constructor() {
-    super("state.passphrase_invalid: AES-256-GCM tag check failed");
-    this.name = "StatePassphraseInvalid";
-  }
-};
-var StateCorrupt = class extends Error {
-  constructor(reason) {
-    super(`state.corrupt: ${reason}`);
-    this.name = "StateCorrupt";
-  }
-};
-function toB642(bytes) {
-  return Buffer.from(bytes).toString("base64");
-}
-function fromB642(s) {
-  return new Uint8Array(Buffer.from(s, "base64"));
-}
-var CURRENT_KDF_PARAMS = {
-  memory_kib: ARGON2_MEMORY_KIB,
-  iterations: ARGON2_ITERATIONS,
-  parallelism: ARGON2_PARALLELISM
-};
-function boundedKdfParam(name, value) {
-  if (typeof value !== "number" || !Number.isInteger(value)) {
-    throw new StateCorrupt(`kdf.${name} is not an integer: ${String(value)}`);
-  }
-  const { min, max } = KDF_BOUNDS[name];
-  if (value < min || value > max) {
-    throw new StateCorrupt(`kdf.${name}=${value} outside sane bounds [${min}, ${max}]`);
-  }
-  return value;
-}
-async function deriveKek(passphrase, saltB64, params) {
-  const salt = fromB642(saltB64);
-  if (salt.length !== ARGON2_SALT_BYTES) {
-    throw new StateCorrupt(`salt length is ${salt.length}, expected ${ARGON2_SALT_BYTES}`);
-  }
-  const kek = await import_argon2.default.hash(passphrase, {
-    type: import_argon2.default.argon2id,
-    raw: true,
-    salt: Buffer.from(salt),
-    memoryCost: params.memory_kib,
-    timeCost: params.iterations,
-    parallelism: params.parallelism,
-    hashLength: AES_KEY_BYTES
-  });
-  return new Uint8Array(kek);
-}
-async function aesGcmEncrypt(kek, nonce, plaintext) {
-  const key = await import_node_crypto3.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["encrypt"]);
-  const ct = await import_node_crypto3.webcrypto.subtle.encrypt(
-    { name: "AES-GCM", iv: nonce, tagLength: 128 },
-    key,
-    plaintext
-  );
-  return new Uint8Array(ct);
-}
-async function aesGcmDecrypt(kek, nonce, ciphertextWithTag) {
-  const key = await import_node_crypto3.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["decrypt"]);
-  try {
-    const pt = await import_node_crypto3.webcrypto.subtle.decrypt(
-      { name: "AES-GCM", iv: nonce, tagLength: 128 },
-      key,
-      ciphertextWithTag
-    );
-    return new Uint8Array(pt);
-  } catch {
-    throw new StatePassphraseInvalid();
-  }
-}
-function createEmptyState(identity) {
-  return {
-    version: STATE_VERSION,
-    identity,
-    handles: {},
-    audit: [],
-    pending: {}
-  };
-}
-function validateEnvelope(json) {
-  if (typeof json !== "object" || json === null) {
-    throw new StateCorrupt("envelope is not an object");
-  }
-  const e = json;
-  if (e.version !== STATE_VERSION) {
-    throw new StateCorrupt(`unknown version: ${String(e.version)}`);
-  }
-  if (e.format !== FORMAT_TAG) {
-    throw new StateCorrupt(`unknown format tag: ${String(e.format)}`);
-  }
-  const kdf = e.kdf;
-  if (!kdf || kdf.algo !== "argon2id" || typeof kdf.salt_b64 !== "string") {
-    throw new StateCorrupt("kdf header missing or wrong algo");
-  }
-  const cipher = e.cipher;
-  if (!cipher || cipher.algo !== "aes-256-gcm" || typeof cipher.nonce_b64 !== "string" || typeof cipher.ciphertext_b64 !== "string") {
-    throw new StateCorrupt("cipher header missing or wrong algo");
-  }
-}
-function validatePlaintext(json) {
-  if (typeof json !== "object" || json === null) {
-    throw new StateCorrupt("plaintext is not an object");
-  }
-  const s = json;
-  if (s.version !== STATE_VERSION) {
-    throw new StateCorrupt(`plaintext version: ${String(s.version)}`);
-  }
-  const id = s.identity;
-  if (!id || typeof id.x25519_secret_b64 !== "string" || typeof id.x25519_public_b64 !== "string") {
-    throw new StateCorrupt("identity missing or malformed");
-  }
-  if (typeof s.handles !== "object" || s.handles === null) {
-    throw new StateCorrupt("handles is not an object");
-  }
-  if (!Array.isArray(s.audit)) {
-    throw new StateCorrupt("audit is not an array");
-  }
-  if (s.pending !== void 0 && (typeof s.pending !== "object" || s.pending === null)) {
-    throw new StateCorrupt("pending is not an object");
-  }
-}
-async function loadState(passphrase, statePath) {
-  const raw = await import_node_fs2.promises.readFile(statePath, "utf8");
-  let envelope;
-  try {
-    envelope = JSON.parse(raw);
-  } catch (err2) {
-    throw new StateCorrupt(`envelope is not valid JSON: ${err2.message}`);
-  }
-  validateEnvelope(envelope);
-  const kek = await deriveKek(passphrase, envelope.kdf.salt_b64, {
-    memory_kib: boundedKdfParam("memory_kib", envelope.kdf.memory_kib),
-    iterations: boundedKdfParam("iterations", envelope.kdf.iterations),
-    parallelism: boundedKdfParam("parallelism", envelope.kdf.parallelism)
-  });
-  const nonce = fromB642(envelope.cipher.nonce_b64);
-  if (nonce.length !== AES_NONCE_BYTES) {
-    throw new StateCorrupt(`nonce length is ${nonce.length}, expected ${AES_NONCE_BYTES}`);
-  }
-  const ct = fromB642(envelope.cipher.ciphertext_b64);
-  const ptBytes = await aesGcmDecrypt(kek, nonce, ct);
-  const ptText = new TextDecoder("utf-8", { fatal: true }).decode(ptBytes);
-  let plaintext;
-  try {
-    plaintext = JSON.parse(ptText);
+    text = await (0, import_promises2.readFile)(path, "utf-8");
   } catch (err2) {
-    throw new StateCorrupt(`plaintext is not valid JSON: ${err2.message}`);
+    if (err2.code === "ENOENT") return null;
+    throw err2;
   }
-  validatePlaintext(plaintext);
-  if (plaintext.pending === void 0) {
-    plaintext.pending = {};
+  const file = JSON.parse(text);
+  if (file.version !== 1 || !file.workload_id || !file.base_url || !file.seed_b64) {
+    throw new Error(`${path} is not a SEAL Pro workload credentials file`);
   }
-  return plaintext;
+  return { workloadId: file.workload_id, baseUrl: file.base_url, seedB64: file.seed_b64 };
 }
-async function saveState(state, passphrase, statePath) {
-  validatePlaintext(state);
-  const salt = (0, import_node_crypto3.randomBytes)(ARGON2_SALT_BYTES);
-  const nonce = (0, import_node_crypto3.randomBytes)(AES_NONCE_BYTES);
-  const kek = await deriveKek(passphrase, toB642(salt), CURRENT_KDF_PARAMS);
-  const ptBytes = new TextEncoder().encode(JSON.stringify(state));
-  const ct = await aesGcmEncrypt(kek, nonce, ptBytes);
-  const envelope = {
-    version: STATE_VERSION,
-    format: FORMAT_TAG,
-    kdf: {
-      algo: "argon2id",
-      memory_kib: ARGON2_MEMORY_KIB,
-      iterations: ARGON2_ITERATIONS,
-      parallelism: ARGON2_PARALLELISM,
-      salt_b64: toB642(salt)
-    },
-    cipher: {
-      algo: "aes-256-gcm",
-      nonce_b64: toB642(nonce),
-      ciphertext_b64: toB642(ct),
-      tag_included: true
+
+// src/recovery.ts
+function nowIso(now) {
+  return (now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+}
+async function recoverPendingOperations(view, client, opts = {}) {
+  const log4 = opts.log ?? ((line) => void process.stderr.write(`${line}
+`));
+  const report = { adopted: [], revoked: [], stillFailing: [], dropped: [] };
+  let changed = false;
+  for (const [handle, op] of Object.entries(view.pending)) {
+    if (op.tool !== "seal_share") {
+      log4(`[seal-mcp] recovery: skipping unknown pending op tool=${String(op.tool)} handle=${handle}`);
+      continue;
+    }
+    if (op.owner !== void 0 && op.owner.pid !== process.pid && holderMayRun(op.owner)) {
+      log4(`[seal-mcp] recovery: left ${handle} alone \u2014 pid ${op.owner.pid} on ${op.owner.hostname} may still run it`);
+      continue;
+    }
+    if (op.seal_id === void 0) {
+      delete view.pending[handle];
+      report.dropped.push(handle);
+      changed = true;
+      log4(`[seal-mcp] recovery: dropped pre-upload journal entry ${handle} (no remote effect)`);
+      continue;
+    }
+    if (op.step === "delivering") {
+      adoptAsHandle(view, handle, op, opts.now);
+      report.adopted.push(handle);
+      changed = true;
+      log4(
+        `[seal-mcp] recovery: adopted ${handle} as a durable handle \u2014 handoff was in flight (attempted: ${(op.handoff_channels_attempted ?? []).join("\u2192") || "unknown"}); the URL may have been delivered, so the seal stays live under owner control`
+      );
+      continue;
+    }
+    if (op.backend_url !== void 0 && op.backend_url !== client.baseUrl) {
+      op.step = "compensating";
+      op.compensation = {
+        action: "revoke",
+        outcome: "failed",
+        error: `backend mismatch: op belongs to ${op.backend_url}, server configured for ${client.baseUrl}`,
+        at: nowIso(opts.now)
+      };
+      report.stillFailing.push(handle);
+      changed = true;
+      log4(
+        `[seal-mcp] recovery: NOT compensating ${handle} \u2014 it belongs to ${op.backend_url} but this server talks to ${client.baseUrl}; kept in journal until the server runs against the original backend`
+      );
+      continue;
     }
-  };
-  const dir = (0, import_node_path3.dirname)(statePath);
-  await import_node_fs2.promises.mkdir(dir, { recursive: true, mode: 448 });
-  const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
-  const fh = await import_node_fs2.promises.open(tmp, "w", 384);
-  try {
-    await fh.writeFile(JSON.stringify(envelope), "utf8");
-    await fh.sync();
-  } finally {
-    await fh.close();
-  }
-  await import_node_fs2.promises.rename(tmp, statePath);
-  try {
-    const dh = await import_node_fs2.promises.open(dir, "r");
     try {
-      await dh.sync();
-    } finally {
-      await dh.close();
+      await client.revoke(op.seal_id, op.owner_token_b64);
+      delete view.pending[handle];
+      report.revoked.push(handle);
+      changed = true;
+      log4(`[seal-mcp] recovery: revoked orphaned seal for ${handle} (step was '${op.step}')`);
+    } catch (err2) {
+      const msg = err2 instanceof Error ? err2.message : String(err2);
+      op.step = "compensating";
+      op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso(opts.now) };
+      report.stillFailing.push(handle);
+      changed = true;
+      log4(
+        `[seal-mcp] recovery: revoke retry for ${handle} failed (${msg}) \u2014 kept in journal, seal expires by TTL at ${op.expires_at}`
+      );
     }
-  } catch {
   }
-  await import_node_fs2.promises.chmod(dir, 448).catch(() => {
-  });
+  return { report, changed };
+}
+function adoptAsHandle(view, handle, op, now) {
+  const sealId = op.seal_id;
+  if (view.handles[handle] === void 0) {
+    view.handles[handle] = {
+      seal_id: sealId,
+      owner_token_b64: op.owner_token_b64,
+      created_at: op.started_at,
+      mode: op.mode,
+      expires_at: op.expires_at,
+      // Propagate provenance so a later seal_revoke on the adopted
+      // handle still refuses to target the wrong backend.
+      backend_url: op.backend_url
+    };
+    view.audit.push({ ts: nowIso(now), tool: "seal_share", handle, mode: op.mode });
+  }
+  delete view.pending[handle];
 }
 
 // src/tools/context.ts
@@ -12685,19 +12760,18 @@ var HANDLE_REGEX = /^h_[A-Za-z0-9_-]{12,}$/;
 function isValidHandle(handle) {
   return typeof handle === "string" && HANDLE_REGEX.test(handle);
 }
+function auditEntry(ctx, tool, handle, mode) {
+  return { ts: (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString(), tool, handle, mode };
+}
 function appendAudit(ctx, tool, handle, mode) {
-  ctx.state.audit.push({
-    ts: (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
-    tool,
-    handle,
-    mode
-  });
+  const entry = auditEntry(ctx, tool, handle, mode);
+  return ctx.update((state) => void state.audit.push(entry));
 }
-function insertHandle(ctx, handle, entry) {
-  if (ctx.state.handles[handle]) {
+function insertHandle(state, handle, entry) {
+  if (state.handles[handle]) {
     throw new Error(`insertHandle: collision on ${handle}`);
   }
-  ctx.state.handles[handle] = entry;
+  state.handles[handle] = entry;
 }
 function lookupHandle(ctx, handle) {
   const entry = ctx.state.handles[handle];
@@ -12720,6 +12794,7 @@ var ToolError = class extends Error {
 // src/tools/list.ts
 var SINGLE_FILE_COUNT = 1;
 async function sealList(ctx, input = {}) {
+  await appendAudit(ctx, "seal_list", null, null);
   const now = (ctx.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const entries = [];
   for (const [handle, entry] of Object.entries(ctx.state.handles)) {
@@ -12736,15 +12811,13 @@ async function sealList(ctx, input = {}) {
     });
   }
   entries.sort((a, b) => Date.parse(b.created_at) - Date.parse(a.created_at));
-  appendAudit(ctx, "seal_list", null, null);
-  await ctx.persist();
   return { entries };
 }
 
 // src/tools/open.ts
 var import_promises3 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path4 = require("path");
+var import_node_path5 = require("path");
 var INLINE_ALLOWED_MIMES = ["application/json", "text/csv", "text/plain"];
 var INLINE_INJECTION_RISK_MIMES = /* @__PURE__ */ new Set([
   "text/html",
@@ -12822,13 +12895,11 @@ async function sealOpen(ctx, input) {
   if (mode === "inline") {
     const refusal = classifyInlineRefusal(first.mime);
     if (refusal !== null) {
-      appendAudit(ctx, "seal_open", handle, mode);
-      await ctx.persist();
+      await appendAudit(ctx, "seal_open", handle, mode);
       return { handle, refusal, mime: first.mime, note: refusalNote(refusal, first.mime) };
     }
     if (first.size > INLINE_CIPHERTEXT_MAX_BYTES) {
-      appendAudit(ctx, "seal_open", handle, mode);
-      await ctx.persist();
+      await appendAudit(ctx, "seal_open", handle, mode);
       return {
         handle,
         refusal: "inline_blocked.too_large",
@@ -12864,12 +12935,10 @@ async function sealOpen(ctx, input) {
         err2
       );
     }
-    appendAudit(ctx, "seal_open", handle, mode);
-    await ctx.persist();
+    await appendAudit(ctx, "seal_open", handle, mode);
     return { handle, mime: bareMime(first.mime), sizeBytes: plaintext.byteLength, encoding: "utf-8", content };
   }
-  appendAudit(ctx, "seal_open", handle, mode);
-  await ctx.persist();
+  await appendAudit(ctx, "seal_open", handle, mode);
   return {
     handle,
     filename: first.name,
@@ -12891,7 +12960,7 @@ async function openToDisk(ctx, seal, handle, input) {
       `the link carries no key for any file in seal ${seal.sealId} (files appended after it was minted); ask the sender for a fresh link`
     );
   }
-  const dir = (0, import_node_path4.resolve)(input.dir ?? (0, import_node_path4.join)((0, import_node_os3.homedir)(), "Downloads"));
+  const dir = (0, import_node_path5.resolve)(input.dir ?? (0, import_node_path5.join)((0, import_node_os3.homedir)(), "Downloads"));
   try {
     await (0, import_promises3.mkdir)(dir, { recursive: true });
   } catch (err2) {
@@ -12915,15 +12984,14 @@ async function openToDisk(ctx, seal, handle, input) {
       throw streamError(err2, file.id);
     }
   }
-  appendAudit(ctx, "seal_open", handle, "file");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_open", handle, "file");
   return { handle, files: out };
 }
 
 // src/tools/pro.ts
 var import_promises4 = require("fs/promises");
 var import_node_os4 = require("os");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var SECRET_CODES = {
   not_found: "pro_secret_not_found",
   not_granted: "pro_secret_not_granted",
@@ -12948,9 +13016,9 @@ async function asTool(fn, codes = SECRET_CODES) {
 }
 async function sealProSecretUse(source, input) {
   const got = await asTool(() => source.getSecret(input.secret, input.version));
-  const dir = await (0, import_promises4.mkdtemp)((0, import_node_path5.join)((0, import_node_os4.tmpdir)(), "seal-mcp-pro-"));
+  const dir = await (0, import_promises4.mkdtemp)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "seal-mcp-pro-"));
   const name = (got.path?.split("/").pop() || got.id).replace(/[^A-Za-z0-9._-]/g, "_");
-  const path = (0, import_node_path5.join)(dir, name);
+  const path = (0, import_node_path6.join)(dir, name);
   try {
     await (0, import_promises4.writeFile)(path, got.value, { mode: 384, flag: "wx" });
     return { path, sizeBytes: got.value.length, secretId: got.id, version: got.version };
@@ -12964,7 +13032,7 @@ async function sealProSecretRequest(source, input) {
   return asTool(() => source.waitForAccess(asked));
 }
 async function sealProFileGet(source, input) {
-  const dir = (0, import_node_path5.resolve)(input.dir ?? (0, import_node_path5.join)((0, import_node_os4.homedir)(), "Downloads"));
+  const dir = (0, import_node_path6.resolve)(input.dir ?? (0, import_node_path6.join)((0, import_node_os4.homedir)(), "Downloads"));
   const ids = input.file ? [input.file] : (await asTool(() => source.listFiles(input.seal), FILE_CODES)).map((f) => f.id);
   const files = [];
   for (const id of ids) {
@@ -12976,16 +13044,16 @@ async function sealProFileGet(source, input) {
 
 // src/tools/request.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var import_promises5 = require("fs/promises");
 var import_node_os5 = require("os");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function findSealCli() {
   const names = process.platform === "win32" ? ["seal.exe", "seal.cmd"] : ["seal"];
-  for (const dir of (process.env.PATH ?? "").split(import_node_path6.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(import_node_path7.delimiter)) {
     for (const name of names) {
-      const candidate = (0, import_node_path6.join)(dir, name);
-      if (dir && (0, import_node_fs3.existsSync)(candidate)) return candidate;
+      const candidate = (0, import_node_path7.join)(dir, name);
+      if (dir && (0, import_node_fs4.existsSync)(candidate)) return candidate;
     }
   }
   return null;
@@ -13019,8 +13087,7 @@ async function sealRequest(ctx, input, deps) {
   if (input.whereUrl) cliArgs.push("--where", input.whereUrl);
   const local = await (deps.runCli ?? runSealCli)(cliArgs);
   if (local && "files" in local) {
-    appendAudit(ctx, "seal_request", handle, "local");
-    await ctx.persist();
+    await appendAudit(ctx, "seal_request", handle, "local");
     return {
       handle,
       source: "local",
@@ -13060,8 +13127,7 @@ async function sealRequest(ctx, input, deps) {
     }
     return receiveThroughLink(ctx, handle, intake.id, deps, input.onProgress);
   }
-  appendAudit(ctx, "seal_request", handle, "link");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_request", handle, "link");
   return { handle, url, emoji, expiresAt: intake.expires_at };
 }
 async function receiveThroughLink(ctx, handle, intakeId, deps, onProgress) {
@@ -13078,12 +13144,11 @@ async function receiveThroughLink(ctx, handle, intakeId, deps, onProgress) {
     );
   }
   await deps.elicitationDone?.(intakeId).catch(() => void 0);
-  const dir = await (0, import_promises5.mkdtemp)((0, import_node_path6.join)((0, import_node_os5.tmpdir)(), "seal-mcp-request-"));
+  const dir = await (0, import_promises5.mkdtemp)((0, import_node_path7.join)((0, import_node_os5.tmpdir)(), "seal-mcp-request-"));
   const opened = await sealOpen(ctx, { url: `${deps.publicHost}${sharePath}`, mode: "file", dir, onProgress });
   if (!("files" in opened)) throw new ToolError("internal_inconsistency", "seal_open mode=file returned no files");
   ctx.requests?.delete(handle);
-  appendAudit(ctx, "seal_request", handle, "link");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_request", handle, "link");
   return {
     handle,
     source: "link",
@@ -13096,6 +13161,7 @@ async function sealRevoke(ctx, input) {
   if (!isValidHandle(input.handle)) {
     throw new ToolError("handle_invalid", `handle does not match contract pattern: ${input.handle}`);
   }
+  await ctx.update(() => false);
   const entry = lookupHandle(ctx, input.handle);
   const now = (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   if (entry.revoked_at) {
@@ -13130,16 +13196,18 @@ async function sealRevoke(ctx, input) {
       err2
     );
   }
-  entry.revoked_at = now;
-  appendAudit(ctx, "seal_revoke", input.handle, entry.mode);
-  await ctx.persist();
+  await ctx.update((state) => {
+    state.handles[input.handle] = { ...entry, revoked_at: now };
+    state.audit.push(auditEntry(ctx, "seal_revoke", input.handle, entry.mode));
+  });
   return { revoked: true, revokedAt: now };
 }
 
 // src/tools/share.ts
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_promises9 = require("fs/promises");
-var import_node_path9 = require("path");
+var import_node_os8 = require("os");
+var import_node_path10 = require("path");
 
 // ../../contracts/limits.json
 var limits_default2 = {
@@ -13173,7 +13241,7 @@ var limits_default2 = {
 // src/handoff.ts
 var import_promises6 = require("fs/promises");
 var import_node_os6 = require("os");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var ONE_HOUR_MS = 36e5;
 var HandoffBothChannelsFailedError = class extends Error {
   code = "handoff_both_channels_failed";
@@ -13189,10 +13257,10 @@ var HandoffBothChannelsFailedError = class extends Error {
 function handoffDir(deps) {
   const xdg = process.env.XDG_RUNTIME_DIR;
   const base = deps.tmpdirOverride ?? (xdg && xdg.length > 0 ? xdg : (0, import_node_os6.tmpdir)());
-  return (0, import_node_path7.join)(base, "seal-mcp");
+  return (0, import_node_path8.join)(base, "seal-mcp");
 }
 function handoffPath(deps, handle) {
-  return (0, import_node_path7.join)(handoffDir(deps), `handoff-${handle}.txt`);
+  return (0, import_node_path8.join)(handoffDir(deps), `handoff-${handle}.txt`);
 }
 async function writeClipboard(text) {
   const mod = await import("clipboardy");
@@ -13259,10 +13327,10 @@ async function performHandoff(payload, deps = {}) {
 }
 
 // src/zip.ts
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_node_os7 = require("os");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 var import_node_stream = require("stream");
 var import_promises8 = require("stream/promises");
 var ZIP32_MAX_BYTES = 4294967295;
@@ -13270,16 +13338,16 @@ async function collectFiles(dir) {
   const found = [];
   const walk = async (current) => {
     for (const dirent of await (0, import_promises7.readdir)(current, { withFileTypes: true })) {
-      const abs = (0, import_node_path8.join)(current, dirent.name);
+      const abs = (0, import_node_path9.join)(current, dirent.name);
       if (dirent.isDirectory()) await walk(abs);
-      else if (dirent.isFile()) found.push({ rel: (0, import_node_path8.relative)(dir, abs).split(import_node_path8.sep).join("/"), abs });
+      else if (dirent.isFile()) found.push({ rel: (0, import_node_path9.relative)(dir, abs).split(import_node_path9.sep).join("/"), abs });
     }
   };
   await walk(dir);
   found.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
   return Promise.all(
     found.map(async ({ rel, abs }) => {
-      const file = new File([await (0, import_node_fs4.openAsBlob)(abs)], (0, import_node_path8.basename)(abs));
+      const file = new File([await (0, import_node_fs5.openAsBlob)(abs)], (0, import_node_path9.basename)(abs));
       return Object.defineProperty(file, "webkitRelativePath", { value: rel });
     })
   );
@@ -13289,19 +13357,19 @@ async function planFolderArchive(dir) {
   if (files.length === 0) {
     throw new Error(`directory contains no regular files: ${dir}`);
   }
-  const folderName = (0, import_node_path8.basename)((0, import_node_path8.resolve)(dir)) || "folder";
+  const folderName = (0, import_node_path9.basename)((0, import_node_path9.resolve)(dir)) || "folder";
   const size = estimateZipSize({ files, folderName });
   if (size > ZIP32_MAX_BYTES) {
     throw new Error(`the folder's archive would be ${size} bytes, over the ZIP limit of ${ZIP32_MAX_BYTES}`);
   }
   const write = async () => {
-    const tempDir = await (0, import_promises7.mkdtemp)((0, import_node_path8.join)((0, import_node_os7.tmpdir)(), "seal-mcp-zip-"));
+    const tempDir = await (0, import_promises7.mkdtemp)((0, import_node_path9.join)((0, import_node_os7.tmpdir)(), "seal-mcp-zip-"));
     const cleanup = () => (0, import_promises7.rm)(tempDir, { recursive: true, force: true });
-    const path = (0, import_node_path8.join)(tempDir, `${folderName}.zip`);
+    const path = (0, import_node_path9.join)(tempDir, `${folderName}.zip`);
     try {
       await (0, import_promises8.pipeline)(
         import_node_stream.Readable.fromWeb(createZipStream2({ files, folderName })),
-        (0, import_node_fs4.createWriteStream)(path, { mode: 384 })
+        (0, import_node_fs5.createWriteStream)(path, { mode: 384 })
       );
       const written = (await (0, import_promises7.stat)(path)).size;
       if (written !== size) {
@@ -13393,31 +13461,46 @@ var FORWARD_MAX_READS_FORCED = 1;
 function nowIso2(ctx) {
   return (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
 }
-async function persistBestEffort(ctx) {
+function journal(ctx, handle, op) {
+  return ctx.update((state) => {
+    state.pending[handle] = op;
+  });
+}
+function dropJournal(ctx, handle) {
+  return ctx.update((state) => {
+    delete state.pending[handle];
+  });
+}
+function complete(ctx, handle, entry) {
+  return ctx.update((state) => {
+    insertHandle(state, handle, entry);
+    state.audit.push(auditEntry(ctx, "seal_share", handle, entry.mode));
+    delete state.pending[handle];
+  });
+}
+async function bestEffort(write) {
   try {
-    await ctx.persist();
+    await write;
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
-    process.stderr.write(`[seal-mcp] warn: journal persist failed during compensation: ${msg}
+    process.stderr.write(`[seal-mcp] warn: journal write failed: ${msg}
 `);
   }
 }
-async function compensateRevoke(ctx, handle) {
-  const op = ctx.state.pending[handle];
-  const sealId = op?.seal_id;
-  if (!op || sealId === void 0) {
+async function compensateRevoke(ctx, handle, op) {
+  const sealId = op.seal_id;
+  if (sealId === void 0) {
     return "no live seal to revoke";
   }
   try {
     await ctx.client.revoke(sealId, op.owner_token_b64);
-    delete ctx.state.pending[handle];
-    await persistBestEffort(ctx);
+    await bestEffort(dropJournal(ctx, handle));
     return "seal auto-revoked";
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     op.step = "compensating";
     op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso2(ctx) };
-    await persistBestEffort(ctx);
+    await bestEffort(journal(ctx, handle, op));
     return `auto-revoke FAILED (${msg}) \u2014 the orphaned seal stays live until its TTL (${op.expires_at}); revoke is journaled and will be retried at next server start`;
   }
 }
@@ -13442,7 +13525,7 @@ async function openSource(path, mime, requestedTier) {
   } catch (err2) {
     throw failed("unable to open", err2);
   }
-  let name = (0, import_node_path9.basename)(path);
+  let name = (0, import_node_path10.basename)(path);
   let source = path;
   let cleanup = async () => void 0;
   let tier;
@@ -13468,7 +13551,7 @@ async function openSource(path, mime, requestedTier) {
   }
   let fileBlob;
   try {
-    fileBlob = await (0, import_node_fs5.openAsBlob)(source);
+    fileBlob = await (0, import_node_fs6.openAsBlob)(source);
   } catch (err2) {
     await cleanup();
     throw failed("unable to open", err2);
@@ -13589,13 +13672,14 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
     // backend this seal is actually created on — recovery refuses to
     // "revoke" against a different backend whose 404 would be misread
     // as success.
-    backend_url: ctx.client.baseUrl
+    backend_url: ctx.client.baseUrl,
+    // SPEC-ADDRESS F1 §4: another MCP host starting now must not recover
+    // (revoke) this upload while it runs.
+    owner: { pid: process.pid, hostname: (0, import_node_os8.hostname)() }
   };
-  ctx.state.pending[handle] = op;
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    delete ctx.state.pending[handle];
     throw new ToolError(
       "state_persist_failed",
       `refusing to upload: could not journal the operation before its first remote effect: ${err2 instanceof Error ? err2.message : String(err2)}`,
@@ -13616,7 +13700,7 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
       // `uploaded` checkpoint after this call is the durability gate.
       onSealCreated: async (sealId) => {
         op.seal_id = sealId;
-        await persistBestEffort(ctx);
+        await bestEffort(journal(ctx, handle, op));
       }
     });
   } catch (err2) {
@@ -13625,15 +13709,14 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
       return awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, expiresAt, session });
     }
     if (op.seal_id !== void 0) {
-      const outcome = await compensateRevoke(ctx, handle);
+      const outcome = await compensateRevoke(ctx, handle, op);
       throw new ToolError(
         "upload_failed",
         `seal upload failed after the seal was created: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
         err2
       );
     }
-    delete ctx.state.pending[handle];
-    await persistBestEffort(ctx);
+    await bestEffort(dropJournal(ctx, handle));
     throw new ToolError(
       "upload_failed",
       `seal upload failed: ${err2 instanceof Error ? err2.message : String(err2)}`,
@@ -13646,9 +13729,9 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   op.seal_id = uploaded.sealId;
   op.step = "uploaded";
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "state_persist_failed",
       `could not journal the live seal after upload: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13661,7 +13744,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     shareBlobBytes = await encryptShareBlob(fileKeysB64, shareLinkKey, void 0);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "share_blob_failed",
       `share blob encryption failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13673,7 +13756,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     shareCode = await ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "share_link_failed",
       `POST /seal/${uploaded.sealId}/share failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13691,7 +13774,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     try {
       fragment = await buildTargetedFragment(shareLinkKey, recipientPub, uploaded.sealId);
     } catch (err2) {
-      const outcome = await compensateRevoke(ctx, handle);
+      const outcome = await compensateRevoke(ctx, handle, op);
       const message = err2 instanceof Error ? err2.message : String(err2);
       if (message.includes("non-contributory")) {
         throw new ToolError(
@@ -13712,7 +13795,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   const host = resolvePublicHost(deps.publicHost);
   const shareUrl = `${host}/s/${uploaded.sealId}/${shareCode}#${fragment}`;
   if (mode === "forward") {
-    insertHandle(ctx, handle, {
+    await complete(ctx, handle, {
       seal_id: uploaded.sealId,
       owner_token_b64: ownerTokenB64,
       created_at: nowIso2(ctx),
@@ -13720,9 +13803,6 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
       expires_at: expiresAt,
       backend_url: ctx.client.baseUrl
     });
-    appendAudit(ctx, "seal_share", handle, mode);
-    delete ctx.state.pending[handle];
-    await ctx.persist();
     return {
       handle,
       shareUrl,
@@ -13734,9 +13814,9 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   op.step = "delivering";
   op.handoff_channels_attempted = deps.handoff?.disableClipboard ? ["file"] : ["clipboard", "file"];
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "state_persist_failed",
       `could not journal the delivery attempt before handing off the URL: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13747,14 +13827,14 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     handoff = await performHandoff({ handle, shareUrl, expireMs }, deps.handoff);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "handoff_both_channels_failed",
       `both clipboard and file handoff channels failed \u2014 ${outcome}`,
       err2
     );
   }
-  insertHandle(ctx, handle, {
+  await complete(ctx, handle, {
     seal_id: uploaded.sealId,
     owner_token_b64: ownerTokenB64,
     created_at: nowIso2(ctx),
@@ -13763,9 +13843,6 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     handoff_channel: handoff.channel,
     backend_url: ctx.client.baseUrl
   });
-  appendAudit(ctx, "seal_share", handle, mode);
-  delete ctx.state.pending[handle];
-  await ctx.persist();
   const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
@@ -13784,12 +13861,12 @@ async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, se
   const tier = prepared.tier;
   const sealId = op.seal_id;
   op.step = "awaiting_payment";
-  await persistBestEffort(ctx);
+  await bestEffort(journal(ctx, handle, op));
   let paymentUrl;
   try {
     paymentUrl = await ctx.client.createCheckout(sealId, ownerTokenB64, tier);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError("payment_failed", `POST /billing/checkout failed: ${messageOf3(err2)} (${outcome})`, err2);
   }
   const deadline = paymentDeadline(op.expires_at);
@@ -13799,7 +13876,7 @@ async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, se
     clearTimeout(timer);
     ctx.payments?.delete(handle);
     await prepared.cleanup();
-    throw new ToolError(code, `${why} (${await compensateRevoke(ctx, handle)})`);
+    throw new ToolError(code, `${why} (${await compensateRevoke(ctx, handle, op)})`);
   };
   const finish = async (onProgress) => {
     if (running) throw new ToolError("payment_invalid", `share ${handle} is already being finished`);
@@ -13968,7 +14045,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.5";
+var SERVER_VERSION = "0.3.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -13995,41 +14072,29 @@ function progressReporter(extra) {
 }
 async function createServer(options) {
   logEngineToStderr();
-  let view;
-  let identity;
-  let lock = null;
   const client = new SealApi({ baseUrl: resolveBackendUrl(options.backendBaseUrl) });
   const disk = options.state;
+  let view;
+  const update = async (mutate) => {
+    if (disk === null) await mutate(view);
+    else view = await updateState(disk.passphrase, disk.path, mutate);
+  };
+  let identity;
   if (disk === null) {
     identity = await generateIdentity();
     view = createEmptyState(identityToFields(identity));
   } else {
-    const held = await acquireStateLock((0, import_node_path10.dirname)(disk.path));
-    lock = held;
-    try {
-      view = await loadState(disk.passphrase, disk.path);
-      identity = await loadIdentity(view.identity);
-      const { changed } = await recoverPendingOperations(view, client);
-      if (changed) {
-        await saveState(view, disk.passphrase, disk.path);
-      }
-    } catch (err2) {
-      await held.release();
-      throw err2;
-    }
+    view = await updateState(disk.passphrase, disk.path, async (state) => (await recoverPendingOperations(state, client)).changed);
+    identity = await loadIdentity(view.identity);
   }
   const publicHost = resolvePublicHost(options.publicHost);
-  let persistChain = Promise.resolve();
-  const persist = () => {
-    if (disk === null) return Promise.resolve();
-    persistChain = persistChain.catch(() => void 0).then(() => saveState(view, disk.passphrase, disk.path));
-    return persistChain;
-  };
   const ctx = {
-    state: view,
+    get state() {
+      return view;
+    },
     identity,
     client,
-    persist,
+    update,
     ephemeral: disk === null,
     requests: /* @__PURE__ */ new Map(),
     payments: /* @__PURE__ */ new Map()
@@ -14232,18 +14297,12 @@ async function createServer(options) {
     );
   }
   const transport = new import_stdio.StdioServerTransport();
-  try {
-    await mcp.connect(transport);
-  } catch (err2) {
-    await lock?.release();
-    throw err2;
-  }
+  await mcp.connect(transport);
   const close = async () => {
     try {
       await mcp.close();
     } finally {
       await transport.close().catch(() => void 0);
-      await lock?.release();
     }
   };
   return { mcp, transport, close };
@@ -14257,7 +14316,7 @@ async function wrapTool(fn, toWire) {
       structuredContent: wire
     };
   } catch (err2) {
-    if (err2 instanceof ToolError) {
+    if (err2 instanceof ToolError || err2 instanceof StateBusyError) {
       return {
         isError: true,
         content: [
@@ -14279,7 +14338,6 @@ async function wrapTool(fn, toWire) {
 // src/cli.ts
 var PROGRAM_NAME = "sealnet-mcp";
 var DESCRIPTION = "MCP server for SEAL \u2014 share files via Cursor / Claude Desktop without handing the model the share link. Handoff mode (default) delivers the link out-of-band (clipboard / 0o600 file); the model only gets an opaque handle.";
-var MIN_PASSPHRASE_LEN = 8;
 function logStderr(line) {
   process.stderr.write(`${line}
 `);
@@ -14288,118 +14346,33 @@ function logStdout(line) {
   process.stdout.write(`${line}
 `);
 }
-async function pathExists(p) {
-  try {
-    await (0, import_promises10.stat)(p);
-    return true;
-  } catch {
-    return false;
-  }
+async function agentKey(path) {
+  return await readSeed(path.dir) ?? (await openAgentState(path)).root;
 }
 async function runInit(opts) {
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  if (!opts.force && await pathExists(path.statePath)) {
+  if (opts.force) await withStateLock(path.dir, () => import_node_fs7.promises.rm(path.statePath, { force: true }));
+  const opened = await openAgentState(path);
+  if (!opened.created) {
     logStderr(`${PROGRAM_NAME} init: state file already exists at ${path.statePath}`);
-    logStderr("Re-run with --force to overwrite (you will lose existing handles + identity).");
+    logStderr("Re-run with --force to replace it with an empty one (its handles are lost; the address stays).");
     process.exit(2);
   }
-  const fromEnv = process.env[PASSPHRASE_ENV_VAR];
-  let passphrase;
-  if (fromEnv !== void 0 && fromEnv.length > 0) {
-    passphrase = fromEnv;
-    logStderr(
-      `${PROGRAM_NAME} init: using passphrase from ${PASSPHRASE_ENV_VAR} (will also save to OS keychain).`
-    );
-  } else {
-    passphrase = await promptHiddenPassphrase("Choose a passphrase (will not echo): ");
-    if (passphrase.length < MIN_PASSPHRASE_LEN) {
-      throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LEN} characters.`);
-    }
-    const confirm = await promptHiddenPassphrase("Confirm passphrase: ");
-    if (confirm !== passphrase) {
-      throw new Error("Passphrases do not match.");
-    }
-  }
-  logStderr(`${PROGRAM_NAME} init: generating X25519 identity ...`);
-  const identity = await generateIdentity();
-  const identityFields = identityToFields(identity);
-  const state = createEmptyState(identityFields);
-  logStderr(`${PROGRAM_NAME} init: writing encrypted state to ${path.statePath} ...`);
-  const lock = await acquireStateLock(path.dir);
-  let keychainStored = false;
-  try {
-    if (!opts.force && await pathExists(path.statePath)) {
-      logStderr(`${PROGRAM_NAME} init: state file already exists at ${path.statePath}`);
-      logStderr("Re-run with --force to overwrite (you will lose existing handles + identity).");
-      process.exit(2);
-    }
-    await saveState(state, passphrase, path.statePath);
-    try {
-      await setKeychainPassphrase(passphrase);
-      keychainStored = true;
-      logStderr(
-        `${PROGRAM_NAME} init: passphrase stored in OS keychain (service=${KEYCHAIN_SERVICE} account=${KEYCHAIN_ACCOUNT}).`
-      );
-    } catch (err2) {
-      if (err2 instanceof KeytarUnavailableError) {
-        logStderr(`${PROGRAM_NAME} init: warning: ${err2.message}`);
-        logStderr(
-          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until the OS keychain works.`
-        );
-      } else {
-        throw err2;
-      }
-    }
-  } finally {
-    await lock.release();
-  }
+  const identity = await identityFromSeed(opened.root.seed);
   logStdout(`${PROGRAM_NAME} init: ready.`);
-  logStdout(`  state.json:        ${path.statePath}`);
-  logStdout(`  passphrase source: ${keychainStored ? "OS keychain" : `${PASSPHRASE_ENV_VAR} env`}`);
-  logStdout(`  pubkey (base64):   ${identityFields.x25519_public_b64}`);
+  logStdout(`  state.json:  ${path.statePath}`);
+  logStdout(`  key source:  ${opened.root.source}`);
+  logStdout(`  address:     ${Buffer.from(identity.public).toString("base64url")}`);
   logStdout("");
-  logStdout(
-    "Share the pubkey with senders so they can target SEALs to your MCP server (see `seal send --to <pubkey>` from `seal-cli`)."
-  );
-}
-async function createStateWithoutPrompt(path) {
-  const resolved = await passphraseForNewState();
-  if (resolved === null) return null;
-  const lock = await acquireStateLock(path.dir);
-  try {
-    if (await pathExists(path.statePath)) return void 0;
-    if (resolved.fresh) await setKeychainPassphrase(resolved.passphrase);
-    const identity = await generateIdentity();
-    await saveState(createEmptyState(identityToFields(identity)), resolved.passphrase, path.statePath);
-  } finally {
-    await lock.release();
-  }
-  logStderr(`${PROGRAM_NAME} serve: first start, state created at ${path.statePath}`);
-  return resolved;
+  logStdout("Senders use the address to deliver a link only this agent opens (`seal send --to <address>`).");
 }
 async function stateForServe(path) {
-  if (!await pathExists(path.statePath)) {
-    const created = await createStateWithoutPrompt(path);
-    if (created !== void 0) return created;
-  }
-  const resolved = await resolvePassphraseFromStores();
-  if (resolved === null) {
-    throw new PassphraseNotFoundError();
-  }
-  if (resolved.source === "env") {
-    logStderr(
-      `${PROGRAM_NAME} serve: warning: passphrase read from ${PASSPHRASE_ENV_VAR}. Environment variables are readable via /proc/<pid>/environ on Linux and the process listing on Windows. Prefer the OS keychain (run \`${PROGRAM_NAME} init\`).`
-    );
-  }
+  let opened;
   try {
-    const view = await loadState(resolved.passphrase, path.statePath);
-    await loadIdentity(view.identity);
+    opened = await openAgentState(path);
   } catch (err2) {
-    if (err2 instanceof StatePassphraseInvalid) {
-      logStderr(`${PROGRAM_NAME} serve: passphrase rejected (AES-256-GCM tag check failed).`);
-      logStderr(
-        `If you reset your OS keychain, re-run \`${PROGRAM_NAME} init --force\` (you will lose existing handles).`
-      );
+    if (err2 instanceof IdentityConflictError) {
+      logStderr(`${PROGRAM_NAME} serve: ${err2.message}`);
       process.exit(3);
     }
     if (err2 instanceof StateCorrupt) {
@@ -14408,29 +14381,27 @@ async function stateForServe(path) {
     }
     throw err2;
   }
-  return resolved;
+  if (opened.created) logStderr(`${PROGRAM_NAME} serve: first start, state created at ${path.statePath}`);
+  if (opened.moved !== null) logStderr(`${PROGRAM_NAME} serve: moved the 0.2 state under the agent's key (${opened.root.source})`);
+  if (opened.moved === "env") {
+    logStderr(
+      `${PROGRAM_NAME} serve: ${PASSPHRASE_ENV_VAR} is no longer used; to move this agent to another machine, set ${SEED_ENV_VAR} there (\`${PROGRAM_NAME} seed --force\` prints it).`
+    );
+  }
+  return opened;
 }
 async function runServe(opts) {
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  const resolved = opts.ephemeral ? null : await stateForServe(path);
+  const opened = opts.ephemeral || process.env[EPHEMERAL_ENV_VAR] === "1" ? null : await stateForServe(path);
   logStderr(
-    resolved === null ? `${PROGRAM_NAME} serve: ephemeral \u2014 identity and handles live in memory until exit, nothing on disk` : `${PROGRAM_NAME} serve: state OK at ${path.statePath} (passphrase=${resolved.source})`
+    opened === null ? `${PROGRAM_NAME} serve: ephemeral \u2014 a new key, identity and handles live in memory until exit, nothing on disk` : `${PROGRAM_NAME} serve: state OK at ${path.statePath} (key=${opened.root.source})`
   );
   logStderr(`${PROGRAM_NAME} serve: starting stdio MCP server ...`);
-  let handle;
-  try {
-    handle = await createServer({
-      state: resolved === null ? null : { path: path.statePath, passphrase: resolved.passphrase },
-      backendBaseUrl: opts.backendUrl,
-      publicHost: opts.publicHost
-    });
-  } catch (err2) {
-    if (err2 instanceof StateLockedError) {
-      logStderr(`${PROGRAM_NAME} serve: ${err2.message}`);
-      process.exit(5);
-    }
-    throw err2;
-  }
+  const handle = await createServer({
+    state: opened === null ? null : { path: path.statePath, passphrase: opened.passphrase },
+    backendBaseUrl: opts.backendUrl,
+    publicHost: opts.publicHost
+  });
   const shutdown = async (signal) => {
     logStderr(`${PROGRAM_NAME} serve: received ${signal}, shutting down ...`);
     try {
@@ -14449,28 +14420,39 @@ async function runServe(opts) {
   });
 }
 async function runPubkey(opts) {
-  const path = resolveStateDir({ cliFlag: opts.stateDir });
-  if (!await pathExists(path.statePath)) {
-    throw new Error(`No state found at ${path.statePath}. Run \`${PROGRAM_NAME} init\` first.`);
+  const root = await agentKey(resolveStateDir({ cliFlag: opts.stateDir }));
+  const { public: address } = await identityFromSeed(root.seed);
+  logStdout(Buffer.from(address).toString("base64url"));
+  logStderr(`${keyEmoji(address)}  key: ${root.source}`);
+}
+async function runSeed(opts) {
+  if (!opts.force) {
+    throw new Error(`seed prints the agent's secret key \u2014 re-run with --force to confirm, to set ${SEED_ENV_VAR} elsewhere.`);
   }
-  const resolved = await resolvePassphraseFromStores();
-  if (resolved === null) throw new PassphraseNotFoundError();
-  const view = await loadState(resolved.passphrase, path.statePath);
-  logStdout(view.identity.x25519_public_b64);
+  const root = await agentKey(resolveStateDir({ cliFlag: opts.stateDir }));
+  logStderr(
+    `${PROGRAM_NAME} seed: this is the agent's secret key. Whoever holds it opens the links sent to this agent; put it only in ${SEED_ENV_VAR} of a machine you control.`
+  );
+  logStdout(Buffer.from(root.seed).toString("base64url"));
+}
+async function perms(file) {
+  return (0, import_promises10.stat)(file).then(
+    (st) => (st.mode & 511).toString(8).padStart(3, "0"),
+    () => null
+  );
 }
 async function runDoctor(opts) {
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  const envPass = process.env[PASSPHRASE_ENV_VAR];
-  let stateExists = false;
-  let statePerms = null;
-  let stateOwnerUid = null;
+  const seedFile = (0, import_node_path11.join)(path.dir, SEED_FILE_NAME);
+  let seedSource = null;
+  let seedError = null;
   try {
-    const st = await (0, import_promises10.stat)(path.statePath);
-    stateExists = true;
-    statePerms = (st.mode & 511).toString(8).padStart(3, "0");
-    stateOwnerUid = typeof st.uid === "number" ? st.uid : null;
-  } catch {
+    seedSource = (await readSeed(path.dir))?.source ?? null;
+  } catch (err2) {
+    seedError = err2 instanceof Error ? err2.message : String(err2);
   }
+  const statePerms = await perms(path.statePath);
+  const seedPerms = await perms(seedFile);
   const kc = await probeKeychain();
   const lockProbe = await probeStateLock(path.dir);
   const client = new SealApi({ baseUrl: resolveBackendUrl(opts.backendUrl) });
@@ -14491,103 +14473,101 @@ async function runDoctor(opts) {
     backendReachable = false;
     backendError = err2 instanceof Error ? err2.message : String(err2);
   }
-  const report = {
-    state_path: path.statePath,
-    state_exists: stateExists,
-    state_perms_octal: statePerms,
-    state_owner_uid: stateOwnerUid,
-    lock_held: lockProbe.held,
-    lock_holder_pid: lockProbe.holder?.pid ?? null,
-    lock_stale: lockProbe.stale,
-    keychain_available: kc.available,
-    keychain_has_entry: kc.hasEntry,
-    env_passphrase_set: envPass !== void 0 && envPass.length > 0,
-    backend_url: client.baseUrl,
-    public_host: resolvePublicHost(opts.publicHost),
-    backend_reachable: backendReachable,
-    backend_status: backendStatus,
-    backend_error: backendError,
-    platform: process.platform,
-    node_version: process.version
-  };
-  logStdout(JSON.stringify(report, null, 2));
-  if (!stateExists) {
-    logStderr(`hint: no state.json yet \u2014 the first \`${PROGRAM_NAME} serve\` creates it.`);
-  } else if (statePerms !== "600") {
-    logStderr(`hint: state.json perms are ${statePerms}, expected 600. Run \`chmod 600 \u2026\`.`);
+  logStdout(
+    JSON.stringify(
+      {
+        state_path: path.statePath,
+        state_exists: statePerms !== null,
+        state_perms_octal: statePerms,
+        seed_source: seedSource,
+        seed_error: seedError,
+        seed_file_perms_octal: seedPerms,
+        keychain_available: kc.available,
+        keychain_has_seed: kc.hasSeed,
+        env_seed_set: Boolean(process.env[SEED_ENV_VAR]),
+        env_passphrase_set: Boolean(process.env[PASSPHRASE_ENV_VAR]),
+        lock_held: lockProbe.held,
+        lock_holder_pid: lockProbe.holder?.pid ?? null,
+        lock_stale: lockProbe.stale,
+        backend_url: client.baseUrl,
+        public_host: resolvePublicHost(opts.publicHost),
+        backend_reachable: backendReachable,
+        backend_status: backendStatus,
+        backend_error: backendError,
+        platform: process.platform,
+        node_version: process.version
+      },
+      null,
+      2
+    )
+  );
+  if (seedError !== null) logStderr(`hint: ${seedError}`);
+  else if (seedSource === null) {
+    logStderr(`hint: no agent key yet \u2014 the first \`${PROGRAM_NAME} serve\` makes it (${kc.available ? "in the OS keychain" : seedFile}).`);
   }
-  if (!kc.available) {
-    logStderr(
-      `hint: keychain unavailable. On Linux start a Secret Service (gnome-keyring or KWallet), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
-    );
-  } else if (stateExists && !kc.hasEntry && !report.env_passphrase_set) {
-    logStderr(`hint: keychain has no entry and ${PASSPHRASE_ENV_VAR} is unset \u2014 \`serve\` will fail.`);
+  for (const [file, got] of [[path.statePath, statePerms], [seedFile, seedPerms]]) {
+    if (got !== null && got !== "600") logStderr(`hint: ${file} perms are ${got}, expected 600. Run \`chmod 600 \u2026\`.`);
   }
   if (backendReachable === false) {
     logStderr(`hint: backend ${client.baseUrl} unreachable (${backendError ?? "unknown"}).`);
   }
-  if (lockProbe.held && !lockProbe.stale) {
-    logStderr(
-      `hint: state dir is locked by pid ${lockProbe.holder?.pid ?? "?"} \u2014 a serve instance is running.`
-    );
-  } else if (lockProbe.held && lockProbe.stale) {
-    logStderr("hint: stale state.lock detected (holder dead) \u2014 next serve/init will break it automatically.");
+  if (lockProbe.held && lockProbe.stale) {
+    logStderr("hint: stale state.lock detected (holder dead) \u2014 the next write breaks it automatically.");
   }
 }
 async function runReset(opts) {
   if (!opts.force) {
     throw new Error(
-      "reset is destructive \u2014 re-run with --force to confirm. This wipes state.json AND your keychain passphrase entry."
+      "reset is destructive \u2014 re-run with --force to confirm. This wipes state.json AND the agent's key: its address is lost for good."
     );
   }
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  const lock = await acquireStateLock(path.dir);
-  let stateDeleted = false;
-  let keychainDeleted = false;
-  try {
-    try {
-      await import_node_fs6.promises.unlink(path.statePath);
-      stateDeleted = true;
-    } catch (err2) {
-      const code = err2.code;
-      if (code !== "ENOENT") {
-        throw err2;
-      }
-    }
-    keychainDeleted = await deleteKeychainPassphrase();
-  } finally {
-    await lock.release();
-  }
+  const result = await withStateLock(path.dir, async () => {
+    let stateDeleted = true;
+    await import_node_fs7.promises.unlink(path.statePath).catch((err2) => {
+      if (err2.code !== "ENOENT") throw err2;
+      stateDeleted = false;
+    });
+    return { stateDeleted, ...await deleteRootSecret(path.dir) };
+  });
   logStdout(
     JSON.stringify(
       {
-        state_deleted: stateDeleted,
-        keychain_deleted: keychainDeleted,
+        state_deleted: result.stateDeleted,
+        seed_file_deleted: result.seedFile,
+        keychain_deleted: result.keychain,
         state_path: path.statePath
       },
       null,
       2
     )
   );
+  logStderr(
+    `${PROGRAM_NAME} reset: the agent's address is gone for good \u2014 links sent to it can no longer be opened, and whoever sends to this agent needs its new address.`
+  );
+  if (process.env[SEED_ENV_VAR]) {
+    logStderr(`${PROGRAM_NAME} reset: ${SEED_ENV_VAR} is still set: the next start uses the key from the environment.`);
+  }
 }
 function buildCli() {
   const program = new import_commander.Command();
   program.name(PROGRAM_NAME).description(DESCRIPTION).version(SERVER_VERSION, "-V, --version", `Print the ${PROGRAM_NAME} version and exit.`);
   program.command("init").description(
-    "Optional setup with a passphrase you choose: generate X25519 identity, store the passphrase in OS keychain, and write encrypted state.json (`serve` does this itself with a random passphrase when there is no state)."
-  ).option("--state-dir <path>", "Override default state directory").option("--force", "Overwrite an existing state.json (DESTRUCTIVE)", false).action(async (opts) => runInit(opts));
+    "Make the agent's key (SEAL_SEED, else the OS keychain, else a 0600 file) and an empty encrypted state.json, without starting the server (`serve` does this itself on its first start)."
+  ).option("--state-dir <path>", "Override default state directory").option("--force", "Replace an existing state.json with an empty one (DESTRUCTIVE; the address stays)", false).action(async (opts) => runInit(opts));
   program.command("serve", { isDefault: true }).description(`Start the stdio MCP server (DEFAULT \u2014 bare \`${PROGRAM_NAME}\` runs this).`).option("--state-dir <path>", "Override default state directory").option("--backend-url <url>", "SEAL backend base URL (overrides SEAL_MCP_BACKEND_URL; default https://api.seal.net)").option(
     "--public-host <url>",
     "Public origin for minted share URLs (overrides SEAL_MCP_PUBLIC_HOST; default https://seal.net). Set BOTH this and --backend-url for self-hosted deployments."
-  ).option("--ephemeral", "Keep identity and handles in memory only; write nothing to disk", false).action(async (opts) => runServe(opts));
+  ).option("--ephemeral", `A new key each start, handles in memory only, nothing on disk (also ${EPHEMERAL_ENV_VAR}=1)`, false).action(async (opts) => runServe(opts));
   program.command("pubkey").description(
-    "Print this server's X25519 public key (base64). Senders use it as the `--to` argument of `seal send` to deliver targeted SEALs."
+    "Print the agent's address, its X25519 public key (base64url), on stdout; its emoji and the key's source on stderr. Senders use it as the `--to` of `seal send` to deliver targeted SEALs."
   ).option("--state-dir <path>", "Override default state directory").action(async (opts) => runPubkey(opts));
+  program.command("seed").description(`Print the agent's secret key, to give another machine the same address through ${SEED_ENV_VAR}.`).option("--state-dir <path>", "Override default state directory").option("--force", "Confirm printing the secret key", false).action(async (opts) => runSeed(opts));
   program.command("doctor").description(
-    "Diagnose keychain availability, state-file permissions, env-var presence, and backend reachability. Prints a JSON report to stdout + hints to stderr."
+    "Diagnose the agent's key, keychain availability, file permissions and backend reachability. Prints a JSON report to stdout + hints to stderr."
   ).option("--state-dir <path>", "Override default state directory").option("--backend-url <url>", "Backend URL to probe").option("--public-host <url>", "Public share-URL origin to report (overrides SEAL_MCP_PUBLIC_HOST)").action(async (opts) => runDoctor(opts));
   program.command("reset").description(
-    "Wipe state.json + keychain passphrase entry. Use only after passphrase loss; destroys all locally-tracked handles and the X25519 identity."
+    "Wipe state.json and the agent's key (seed file and keychain entries): destroys all locally-tracked handles, and the address is lost for good."
   ).option("--state-dir <path>", "Override default state directory").option("--force", "Confirm destructive operation", false).action(async (opts) => runReset(opts));
   return program;
 }