sealnet-mcp 0.2.5 → 0.4.0

package/dist/cli.cjs

@@ -34,8 +34,9 @@ __export(cli_exports, {
   main: () => main
 });
 module.exports = __toCommonJS(cli_exports);
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_promises10 = require("fs/promises");
+var import_node_path11 = require("path");
 var import_commander = require("commander");
 
 // ../../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
@@ -2889,9 +2890,60 @@ var limits_default = {
     INTAKE_TTL_DEFAULT_SECONDS: 900,
     INTAKE_TTL_MAX_SECONDS: 86400,
     INTAKE_WAIT_MAX_SECONDS: 25,
-    PAYMENT_WAIT_MAX_SECONDS: 82800
+    PAYMENT_WAIT_MAX_SECONDS: 82800,
+    ADDRESS_PROOF_TTL_SECONDS: 300,
+    INBOX_MAX_ITEMS: 200
   }
 };
+var seal_address_v1_default = {
+  version: 1,
+  $comment: "Address of a key: who a seal is for, without a URL (audit/SPEC-ADDRESS.md). Numbers live in limits.json, error codes in error_codes.json.",
+  address: {
+    key: "X25519 public key, 32 bytes",
+    text: "base64url without padding, 43 characters",
+    emoji: "fingerprint_emoji.json over sha256(key)[0..3], the same picture as intake",
+    inbox_hash: "sha256(key), 32 bytes: the server finds an inbox by it"
+  },
+  seed: {
+    env: "SEAL_SEED",
+    text: "base64url without padding of the 32-byte X25519 secret, 43 characters",
+    same_as: [
+      "sealnet-mcp state.identity.x25519_secret_b64",
+      "seal identity.v1.json x25519_secret_b64url",
+      "sealnet (npm) KeyPair.secretKey",
+      "sealnet (PyPI) keygen().secret_key"
+    ]
+  },
+  scopes: {
+    share_link: "seal_share",
+    owner_copy: "seal_owner",
+    address_proof: "seal_address_proof"
+  },
+  proof: {
+    header_address: "X-Seal-Address",
+    header_proof: "X-Seal-Proof",
+    proof_text: "<ts>.<token>: ts is the decimal Unix second from the challenge, token base64url of 32 bytes",
+    challenge: "sealed box of the 32-byte token to the address with scope (address_proof, decimal ts): ephemeral_pub(32) || nonce(12) || ciphertext(48), base64url, 123 characters",
+    token: "opaque to clients: unwrap it and send it back"
+  },
+  items: {
+    delivery: {
+      id: "s.<seal_id>.<share_code>",
+      is: "a share link addressed to this key; fragment = its key wrapped to the address (x25519:, targeted_x25519_v1, scope share_link)"
+    }
+  },
+  request_kinds: ["secret", "file", "any"],
+  vectors: [
+    {
+      comment: "generated once by backend_crypto.sealed_box.seal_key_for_recipient; every client must unwrap it",
+      secret: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc",
+      address: "E75P6uryBMf9M1j8nAByGIHRdCeBKCJ-xnTzf3_pe20",
+      ts: 179e7,
+      challenge: "4Oel-UMfgP_1dBhmf13yZiujhPDouCIQ6sSx1nY1qy-vyzFqDqb9jARbJ0e5A8vv4EDELDS5OPqBQMcsmDA-C_lXO95y_CVUyYtSu-1fltsy5ZihOFDp0T-C9Ro",
+      token: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
+    }
+  ]
+};
 var upload_default = {
   version: 1,
   upload: {
@@ -3223,13 +3275,24 @@ var SealApi = class _SealApi {
     });
     return { etag: resp.headers.get("ETag") };
   }
-  /** `POST /seal/{id}/share` — mint a share link, returns its code. */
+  /**
+   * `POST /seal/{id}/share` — mint a share link, returns its code. With an
+   * address the link also lands in that key's inbox, in the same request.
+   */
   async createShareLink(sealId, ownerToken, encryptedBlobB64, opts = {}) {
+    const headers = _SealApi.ownerHeaders(ownerToken, true);
+    const body = { encrypted_blob: encryptedBlobB64 };
+    if ("to" in opts) {
+      body.to = opts.to;
+      body.fragment = opts.fragment;
+      if (opts.label) body.label = opts.label;
+      if (opts.sender) Object.assign(headers, proofHeaders(opts.sender));
+    }
     const resp = await this.request(`/seal/${encode(sealId)}/share`, {
       what: `POST /seal/${sealId}/share`,
       method: "POST",
-      headers: _SealApi.ownerHeaders(ownerToken, true),
-      body: JSON.stringify({ encrypted_blob: encryptedBlobB64 }),
+      headers,
+      body: JSON.stringify(body),
       signal: opts.signal
     });
     const data = await resp.json();
@@ -3412,8 +3475,57 @@ var SealApi = class _SealApi {
     });
     return await resp.json();
   }
+  // ---------------------------------------------------------------------------
+  // Inbox (SPEC-ADDRESS F2): the share links addressed to a key
+  // ---------------------------------------------------------------------------
+  /** `POST /intake/proof` — a challenge sealed to `address`. */
+  async requestAddressProof(address, opts = {}) {
+    const resp = await this.request("/intake/proof", {
+      what: "POST /intake/proof",
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ address }),
+      signal: opts.signal
+    });
+    return await resp.json();
+  }
+  /**
+   * `GET /intake?to=` — every live item. `waitSeconds` holds the answer
+   * while the inbox is empty, or, with `seen`, while its version is still
+   * `seen`; one call waits at most `INTAKE_WAIT_MAX_SECONDS`, longer waits
+   * are the caller's loop.
+   */
+  async listInbox(proof, opts = {}) {
+    const params = new URLSearchParams({ to: proof.address });
+    if (opts.waitSeconds) {
+      params.set("wait", String(Math.min(opts.waitSeconds, limits_default.limits.INTAKE_WAIT_MAX_SECONDS)));
+    }
+    if (opts.seen) params.set("seen", opts.seen);
+    const resp = await this.request(`/intake?${params.toString()}`, {
+      what: "GET /intake",
+      headers: proofHeaders(proof),
+      signal: opts.signal
+    });
+    return await resp.json();
+  }
+  /** `DELETE /intake?to=&item=` — take one item out; the link keeps working. */
+  async dismissInboxItem(itemId, proof, opts = {}) {
+    const params = new URLSearchParams({ to: proof.address, item: itemId });
+    await this.request(`/intake?${params.toString()}`, {
+      what: "DELETE /intake",
+      method: "DELETE",
+      headers: proofHeaders(proof),
+      signal: opts.signal
+    });
+  }
 };
 var NOT_READY_DEFAULT_RETRY_AFTER_S = 3;
+function proofHeaders(proof) {
+  return {
+    [seal_address_v1_default.proof.header_address]: proof.address,
+    [seal_address_v1_default.proof.header_proof]: proof.proof
+  };
+}
 function abortableSleep(ms, signal) {
   return new Promise((resolve5, reject) => {
     if (signal?.aborted) {
@@ -6178,6 +6290,7 @@ function parseUrlType(pathname) {
 var TARGETED_PREFIX_V1 = "x25519:";
 var TARGETED_PREFIX_V2_RESERVED = "x25519v2:";
 var SCOPE_TYPE = "seal_share";
+var ADDRESS_PROOF_SCOPE = "seal_address_proof";
 var X25519_KEY_BYTES = 32;
 var LINK_KEY_BYTES2 = 32;
 var PACKED_BYTES_V1 = 92;
@@ -6284,6 +6397,11 @@ async function unwrapTargetedFragment(fragment, recipientSecret, sealId) {
   }
   return linkKey;
 }
+async function proveAddress(secret, challenge, ts) {
+  const wasm3 = await ensureWasm();
+  const token = wasm3.wasm_sealbox_unwrap(base64urlToBytes(challenge), secret, ADDRESS_PROOF_SCOPE, String(ts));
+  return `${ts}.${bytesToBase64url(token)}`;
+}
 var fingerprint_emoji_default = {
   version: 1,
   name: "FINGERPRINT_EMOJI",
@@ -6743,6 +6861,36 @@ async function waitForIntake(api, intakeId, opts = {}) {
     if (view.status === "fulfilled" && view.share_path) return view.share_path;
   }
 }
+var PROOF_MARGIN_MS = 3e4;
+var proofs = /* @__PURE__ */ new Map();
+async function addressProof(api, secret, opts = {}) {
+  const address = bytesToBase64url(await recipientPublicKey(secret));
+  const key = `${api.baseUrl} ${address}`;
+  const kept = proofs.get(key);
+  if (!opts.fresh && kept && kept.until > Date.now()) return kept.proof;
+  const challenge = await api.requestAddressProof(address, opts);
+  const proof = { address, proof: await proveAddress(secret, challenge.challenge, challenge.ts) };
+  proofs.set(key, { proof, until: Date.parse(challenge.expires_at) - PROOF_MARGIN_MS });
+  return proof;
+}
+async function withAddressProof(api, secret, signal, call) {
+  const request = signal ? { signal } : {};
+  try {
+    return await call(await addressProof(api, secret, request));
+  } catch (err2) {
+    if (!(err2 instanceof BackendError && err2.appCode === "intake.proof_required")) throw err2;
+    return call(await addressProof(api, secret, { ...request, fresh: true }));
+  }
+}
+async function readInbox(api, secret, opts = {}) {
+  return withAddressProof(api, secret, opts.signal, (proof) => api.listInbox(proof, opts));
+}
+async function removeFromInbox(api, secret, itemId, opts = {}) {
+  return withAddressProof(api, secret, opts.signal, (proof) => api.dismissInboxItem(itemId, proof, opts));
+}
+function inboxItemUrl(site, item) {
+  return `${site.replace(/\/+$/, "")}${item.path}#${item.fragment}`;
+}
 async function describeFile(file, fileKeys) {
   const keyB64 = file.sha256_hex ? fileKeys[file.sha256_hex] : void 0;
   const base = { id: file.id, size: file.size, sha256Hex: file.sha256_hex };
@@ -6901,6 +7049,9 @@ async function generateIdentity() {
   const { publicKey, secretKey } = await generateRecipientKeyPair();
   return { secret: secretKey, public: publicKey };
 }
+async function identityFromSeed(seed) {
+  return { secret: seed, public: await recipientPublicKey(seed) };
+}
 function identityToFields(id) {
   return {
     x25519_secret_b64: toB64(id.secret),
@@ -6934,20 +7085,27 @@ var import_node_crypto = require("crypto");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var LOCK_FILE_NAME = "state.lock";
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 25;
 var StateLockedError = class extends Error {
   code = "state_locked";
   holder;
   lockPath;
   constructor(lockPath, holder) {
     const who = holder === null ? "holder info unreadable" : `pid ${holder.pid} on ${holder.hostname} since ${holder.acquired_at}`;
-    super(
-      `state directory is locked by another sealnet-mcp process (${who}). Only one writer may use a state dir at a time; stop the other instance or point this one at a different --state-dir. Lock file: ${lockPath}`
-    );
+    super(`state directory is locked by another sealnet-mcp process (${who}). Lock file: ${lockPath}`);
     this.name = "StateLockedError";
     this.holder = holder;
     this.lockPath = lockPath;
   }
 };
+var StateBusyError = class extends Error {
+  code = "state_busy";
+  constructor(locked) {
+    super(`${locked.message}; waited ${LOCK_WAIT_MS / 1e3} s, nothing was changed, safe to retry`);
+    this.name = "StateBusyError";
+  }
+};
 var StateDirUnsafeError = class extends Error {
   code = "state_dir_unsafe";
   constructor(stateDir, reason) {
@@ -6966,6 +7124,9 @@ function defaultIsPidAlive(pid) {
     return code === "EPERM";
   }
 }
+function holderMayRun(holder, deps = {}) {
+  return holder.hostname !== (deps.host ?? (0, import_node_os.hostname)()) || (deps.isPidAlive ?? defaultIsPidAlive)(holder.pid);
+}
 function parseHolder(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -7008,7 +7169,7 @@ async function tryCreate(lockPath, info) {
     await (0, import_promises.unlink)(tmp).catch(() => void 0);
   }
 }
-async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
+async function tryBreakStale(lockPath, probed, deps) {
   const claimPath = `${lockPath}.break-${process.pid}-${(0, import_node_crypto.randomBytes)(4).toString("hex")}`;
   try {
     await (0, import_promises.rename)(lockPath, claimPath);
@@ -7016,8 +7177,7 @@ async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
     return true;
   }
   const claimed = parseHolder(await (0, import_promises.readFile)(claimPath, "utf8").catch(() => ""));
-  const claimedStale = claimed === null || claimed.hostname === selfHost && !isAlive(claimed.pid);
-  if (sameHolder(claimed, probed) || claimedStale) {
+  if (sameHolder(claimed, probed) || claimed === null || !holderMayRun(claimed, deps)) {
     await (0, import_promises.unlink)(claimPath).catch(() => void 0);
     return true;
   }
@@ -7030,11 +7190,9 @@ async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
 }
 async function acquireStateLock(stateDir, deps = {}) {
   const lockPath = (0, import_node_path.join)(stateDir, LOCK_FILE_NAME);
-  const isAlive = deps.isPidAlive ?? defaultIsPidAlive;
-  const selfHost = deps.host ?? (0, import_node_os.hostname)();
   const self2 = {
     pid: deps.pid ?? process.pid,
-    hostname: selfHost,
+    hostname: deps.host ?? (0, import_node_os.hostname)(),
     acquired_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   await (0, import_promises.mkdir)(stateDir, { recursive: true, mode: 448 });
@@ -7045,11 +7203,10 @@ async function acquireStateLock(stateDir, deps = {}) {
   await (0, import_promises.chmod)(stateDir, 448).catch(() => void 0);
   if (!await tryCreate(lockPath, self2)) {
     const holder = await readHolder(lockPath);
-    const stale = holder !== null && holder.hostname === selfHost && !isAlive(holder.pid);
-    if (holder !== null && !stale) {
+    if (holder !== null && holderMayRun(holder, deps)) {
       throw new StateLockedError(lockPath, holder);
     }
-    if (!await tryBreakStale(lockPath, holder, isAlive, selfHost)) {
+    if (!await tryBreakStale(lockPath, holder, deps)) {
       throw new StateLockedError(lockPath, await readHolder(lockPath));
     }
     if (!await tryCreate(lockPath, self2)) {
@@ -7081,6 +7238,30 @@ async function acquireStateLock(stateDir, deps = {}) {
     }
   };
 }
+var queues = /* @__PURE__ */ new Map();
+function withStateLock(stateDir, fn, deps = {}) {
+  const run = (queues.get(stateDir) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    let lock;
+    for (; ; ) {
+      try {
+        lock = await acquireStateLock(stateDir, deps);
+        break;
+      } catch (err2) {
+        if (!(err2 instanceof StateLockedError)) throw err2;
+        if (Date.now() >= deadline) throw new StateBusyError(err2);
+        await new Promise((resolve5) => setTimeout(resolve5, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await fn();
+    } finally {
+      await lock.release();
+    }
+  });
+  queues.set(stateDir, run);
+  return run;
+}
 async function probeStateLock(stateDir, deps = {}) {
   const lockPath = (0, import_node_path.join)(stateDir, LOCK_FILE_NAME);
   const holder = await readHolder(lockPath);
@@ -7092,182 +7273,7 @@ async function probeStateLock(stateDir, deps = {}) {
       return { held: false, holder: null, stale: false };
     }
   }
-  const isAlive = deps.isPidAlive ?? defaultIsPidAlive;
-  const sameHost = holder.hostname === (deps.host ?? (0, import_node_os.hostname)());
-  const stale = sameHost && !isAlive(holder.pid);
-  return { held: true, holder, stale };
-}
-
-// src/passphrase.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto2 = require("crypto");
-var SERVICE_NAME = "seal-mcp";
-var ACCOUNT_NAME = "state";
-var ENV_VAR = "SEAL_MCP_PASSPHRASE";
-var KEYCHAIN_SERVICE = SERVICE_NAME;
-var KEYCHAIN_ACCOUNT = ACCOUNT_NAME;
-var PASSPHRASE_ENV_VAR = ENV_VAR;
-var KeytarUnavailableError = class extends Error {
-  code = "keytar_unavailable";
-  constructor(detail) {
-    super(`keytar unavailable: ${detail}`);
-    this.name = "KeytarUnavailableError";
-  }
-};
-var PassphraseNotFoundError = class extends Error {
-  code = "passphrase_not_found";
-  constructor() {
-    super(
-      `No passphrase found. Run \`sealnet-mcp init\` to store one in your OS keychain, or export ${ENV_VAR} for CI/headless use.`
-    );
-    this.name = "PassphraseNotFoundError";
-  }
-};
-function keyringEntry(keyring, platform, service, account) {
-  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
-}
-function readKeytarLinuxEntry(service, account) {
-  return new Promise((resolve5) => {
-    (0, import_node_child_process.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
-      const value = err2 ? "" : stdout.replace(/\n$/, "");
-      resolve5(value.length > 0 ? value : null);
-    });
-  });
-}
-function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
-  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
-  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
-  return {
-    async getPassword(service, account) {
-      const secret = await entry(service, account).getSecret();
-      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
-      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
-      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
-      return legacy;
-    },
-    setPassword: store,
-    deletePassword: (service, account) => entry(service, account).deleteCredential()
-  };
-}
-var keytarCache = void 0;
-async function loadKeytar() {
-  if (keytarCache !== void 0) return keytarCache;
-  try {
-    const mod = await import("@napi-rs/keyring");
-    const keyring = mod.default ?? mod;
-    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
-    keytarCache = keytarOverKeyring(keyring);
-  } catch {
-    keytarCache = null;
-  }
-  return keytarCache;
-}
-async function loadKeytarOrThrow() {
-  const k = await loadKeytar();
-  if (k === null) {
-    throw new KeytarUnavailableError(
-      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
-    );
-  }
-  return k;
-}
-async function resolvePassphraseFromStores(env = process.env) {
-  const keytar = await loadKeytar();
-  if (keytar !== null) {
-    try {
-      const stored = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-      if (stored !== null && stored.length > 0) {
-        return { passphrase: stored, source: "keychain" };
-      }
-    } catch {
-    }
-  }
-  const fromEnv = env[ENV_VAR];
-  if (fromEnv !== void 0 && fromEnv.length > 0) {
-    return { passphrase: fromEnv, source: "env" };
-  }
-  return null;
-}
-async function passphraseForNewState(env = process.env) {
-  const stored = await resolvePassphraseFromStores(env);
-  if (stored !== null) return { ...stored, fresh: false };
-  if (!(await probeKeychain()).available) return null;
-  return { passphrase: (0, import_node_crypto2.randomBytes)(32).toString("base64url"), source: "keychain", fresh: true };
-}
-async function probeKeychain() {
-  const keytar = await loadKeytar();
-  if (keytar === null) return { available: false, hasEntry: false };
-  try {
-    const v = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-    return { available: true, hasEntry: v !== null && v.length > 0 };
-  } catch {
-    return { available: false, hasEntry: false };
-  }
-}
-async function setKeychainPassphrase(passphrase) {
-  if (passphrase.length === 0) {
-    throw new Error("refusing to store an empty passphrase in the keychain");
-  }
-  const keytar = await loadKeytarOrThrow();
-  await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, passphrase);
-}
-async function deleteKeychainPassphrase() {
-  const keytar = await loadKeytar();
-  if (keytar === null) return false;
-  try {
-    return await keytar.deletePassword(SERVICE_NAME, ACCOUNT_NAME);
-  } catch {
-    return false;
-  }
-}
-async function promptHiddenPassphrase(prompt) {
-  const stdin = process.stdin;
-  if (!stdin.isTTY) {
-    throw new Error(
-      `Cannot prompt for passphrase: stdin is not a TTY. Set ${ENV_VAR} for non-interactive use.`
-    );
-  }
-  process.stdout.write(prompt);
-  const wasRaw = stdin.isRaw;
-  stdin.setRawMode(true);
-  stdin.resume();
-  stdin.setEncoding("utf8");
-  return new Promise((resolve5, reject) => {
-    let buf = "";
-    const cleanup = () => {
-      stdin.removeListener("data", onData);
-      stdin.setRawMode(wasRaw);
-      stdin.pause();
-      process.stdout.write("\n");
-    };
-    const onData = (chunk) => {
-      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      for (let i = 0; i < text.length; i++) {
-        const ch = text[i];
-        if (ch === "") {
-          cleanup();
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "" && buf.length === 0) {
-          cleanup();
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "\r" || ch === "\n") {
-          cleanup();
-          resolve5(buf);
-          return;
-        }
-        if (ch === "\x7F" || ch === "\b") {
-          buf = buf.slice(0, -1);
-          continue;
-        }
-        buf += ch;
-      }
-    };
-    stdin.on("data", onData);
-  });
+  return { held: true, holder, stale: !holderMayRun(holder, deps) };
 }
 
 // src/paths.ts
@@ -7310,99 +7316,533 @@ function osDefaultDir(env, platform, home) {
   }
 }
 
-// src/server.ts
-var import_node_path10 = require("path");
-var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
-var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+// src/seed.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto3 = require("crypto");
+var import_node_fs3 = require("fs");
+var import_node_path4 = require("path");
 
-// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
-var external_exports = {};
-__export(external_exports, {
-  BRAND: () => BRAND,
-  DIRTY: () => DIRTY,
-  EMPTY_PATH: () => EMPTY_PATH,
-  INVALID: () => INVALID,
-  NEVER: () => NEVER,
-  OK: () => OK,
-  ParseStatus: () => ParseStatus,
-  Schema: () => ZodType,
-  ZodAny: () => ZodAny,
-  ZodArray: () => ZodArray,
-  ZodBigInt: () => ZodBigInt,
-  ZodBoolean: () => ZodBoolean,
-  ZodBranded: () => ZodBranded,
-  ZodCatch: () => ZodCatch,
-  ZodDate: () => ZodDate,
-  ZodDefault: () => ZodDefault,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodEffects: () => ZodEffects,
-  ZodEnum: () => ZodEnum,
-  ZodError: () => ZodError,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodFunction: () => ZodFunction,
-  ZodIntersection: () => ZodIntersection,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodLazy: () => ZodLazy,
-  ZodLiteral: () => ZodLiteral,
-  ZodMap: () => ZodMap,
-  ZodNaN: () => ZodNaN,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNever: () => ZodNever,
-  ZodNull: () => ZodNull,
-  ZodNullable: () => ZodNullable,
-  ZodNumber: () => ZodNumber,
-  ZodObject: () => ZodObject,
-  ZodOptional: () => ZodOptional,
-  ZodParsedType: () => ZodParsedType,
-  ZodPipeline: () => ZodPipeline,
-  ZodPromise: () => ZodPromise,
-  ZodReadonly: () => ZodReadonly,
-  ZodRecord: () => ZodRecord,
-  ZodSchema: () => ZodType,
-  ZodSet: () => ZodSet,
-  ZodString: () => ZodString,
-  ZodSymbol: () => ZodSymbol,
-  ZodTransformer: () => ZodEffects,
-  ZodTuple: () => ZodTuple,
-  ZodType: () => ZodType,
-  ZodUndefined: () => ZodUndefined,
-  ZodUnion: () => ZodUnion,
-  ZodUnknown: () => ZodUnknown,
-  ZodVoid: () => ZodVoid,
-  addIssueToContext: () => addIssueToContext,
-  any: () => anyType,
-  array: () => arrayType,
-  bigint: () => bigIntType,
-  boolean: () => booleanType,
-  coerce: () => coerce,
-  custom: () => custom,
-  date: () => dateType,
-  datetimeRegex: () => datetimeRegex,
-  defaultErrorMap: () => en_default,
-  discriminatedUnion: () => discriminatedUnionType,
-  effect: () => effectsType,
-  enum: () => enumType,
-  function: () => functionType,
-  getErrorMap: () => getErrorMap,
-  getParsedType: () => getParsedType,
-  instanceof: () => instanceOfType,
-  intersection: () => intersectionType,
-  isAborted: () => isAborted,
-  isAsync: () => isAsync,
-  isDirty: () => isDirty,
-  isValid: () => isValid,
-  late: () => late,
-  lazy: () => lazyType,
-  literal: () => literalType,
-  makeIssue: () => makeIssue,
-  map: () => mapType,
-  nan: () => nanType,
-  nativeEnum: () => nativeEnumType,
-  never: () => neverType,
-  null: () => nullType,
-  nullable: () => nullableType,
-  number: () => numberType,
-  object: () => objectType,
+// src/state.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_path3 = require("path");
+var import_argon2 = __toESM(require("argon2"), 1);
+var FORMAT_TAG = "SEAL_MCP_STATE v1";
+var STATE_VERSION = 1;
+var ARGON2_MEMORY_KIB = 65536;
+var ARGON2_ITERATIONS = 3;
+var ARGON2_PARALLELISM = 4;
+var ARGON2_SALT_BYTES = 16;
+var KDF_BOUNDS = {
+  memory_kib: { min: 8192, max: 1048576 },
+  // 8 MiB .. 1 GiB
+  iterations: { min: 1, max: 16 },
+  parallelism: { min: 1, max: 16 }
+};
+var AES_KEY_BYTES = 32;
+var AES_NONCE_BYTES = 12;
+var StatePassphraseInvalid = class extends Error {
+  constructor() {
+    super("AES-256-GCM tag check failed: another passphrase, or a tampered file");
+    this.name = "StatePassphraseInvalid";
+  }
+};
+var StateCorrupt = class extends Error {
+  constructor(reason) {
+    super(`state.corrupt: ${reason}`);
+    this.name = "StateCorrupt";
+  }
+};
+function toB642(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function fromB642(s) {
+  return new Uint8Array(Buffer.from(s, "base64"));
+}
+var CURRENT_KDF_PARAMS = {
+  memory_kib: ARGON2_MEMORY_KIB,
+  iterations: ARGON2_ITERATIONS,
+  parallelism: ARGON2_PARALLELISM
+};
+function boundedKdfParam(name, value) {
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    throw new StateCorrupt(`kdf.${name} is not an integer: ${String(value)}`);
+  }
+  const { min, max } = KDF_BOUNDS[name];
+  if (value < min || value > max) {
+    throw new StateCorrupt(`kdf.${name}=${value} outside sane bounds [${min}, ${max}]`);
+  }
+  return value;
+}
+async function deriveKek(passphrase, saltB64, params) {
+  const salt = fromB642(saltB64);
+  if (salt.length !== ARGON2_SALT_BYTES) {
+    throw new StateCorrupt(`salt length is ${salt.length}, expected ${ARGON2_SALT_BYTES}`);
+  }
+  const kek = await import_argon2.default.hash(passphrase, {
+    type: import_argon2.default.argon2id,
+    raw: true,
+    salt: Buffer.from(salt),
+    memoryCost: params.memory_kib,
+    timeCost: params.iterations,
+    parallelism: params.parallelism,
+    hashLength: AES_KEY_BYTES
+  });
+  return new Uint8Array(kek);
+}
+async function aesGcmEncrypt(kek, nonce, plaintext) {
+  const key = await import_node_crypto2.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["encrypt"]);
+  const ct = await import_node_crypto2.webcrypto.subtle.encrypt(
+    { name: "AES-GCM", iv: nonce, tagLength: 128 },
+    key,
+    plaintext
+  );
+  return new Uint8Array(ct);
+}
+async function aesGcmDecrypt(kek, nonce, ciphertextWithTag) {
+  const key = await import_node_crypto2.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["decrypt"]);
+  try {
+    const pt = await import_node_crypto2.webcrypto.subtle.decrypt(
+      { name: "AES-GCM", iv: nonce, tagLength: 128 },
+      key,
+      ciphertextWithTag
+    );
+    return new Uint8Array(pt);
+  } catch {
+    throw new StatePassphraseInvalid();
+  }
+}
+function createEmptyState(identity) {
+  return {
+    version: STATE_VERSION,
+    identity,
+    handles: {},
+    audit: [],
+    pending: {}
+  };
+}
+function validateEnvelope(json) {
+  if (typeof json !== "object" || json === null) {
+    throw new StateCorrupt("envelope is not an object");
+  }
+  const e = json;
+  if (e.version !== STATE_VERSION) {
+    throw new StateCorrupt(`unknown version: ${String(e.version)}`);
+  }
+  if (e.format !== FORMAT_TAG) {
+    throw new StateCorrupt(`unknown format tag: ${String(e.format)}`);
+  }
+  const kdf = e.kdf;
+  if (!kdf || kdf.algo !== "argon2id" || typeof kdf.salt_b64 !== "string") {
+    throw new StateCorrupt("kdf header missing or wrong algo");
+  }
+  const cipher = e.cipher;
+  if (!cipher || cipher.algo !== "aes-256-gcm" || typeof cipher.nonce_b64 !== "string" || typeof cipher.ciphertext_b64 !== "string") {
+    throw new StateCorrupt("cipher header missing or wrong algo");
+  }
+}
+function validatePlaintext(json) {
+  if (typeof json !== "object" || json === null) {
+    throw new StateCorrupt("plaintext is not an object");
+  }
+  const s = json;
+  if (s.version !== STATE_VERSION) {
+    throw new StateCorrupt(`plaintext version: ${String(s.version)}`);
+  }
+  const id = s.identity;
+  if (!id || typeof id.x25519_secret_b64 !== "string" || typeof id.x25519_public_b64 !== "string") {
+    throw new StateCorrupt("identity missing or malformed");
+  }
+  if (typeof s.handles !== "object" || s.handles === null) {
+    throw new StateCorrupt("handles is not an object");
+  }
+  if (!Array.isArray(s.audit)) {
+    throw new StateCorrupt("audit is not an array");
+  }
+  if (s.pending !== void 0 && (typeof s.pending !== "object" || s.pending === null)) {
+    throw new StateCorrupt("pending is not an object");
+  }
+}
+async function loadState(passphrase, statePath) {
+  const raw = await import_node_fs2.promises.readFile(statePath, "utf8");
+  let envelope;
+  try {
+    envelope = JSON.parse(raw);
+  } catch (err2) {
+    throw new StateCorrupt(`envelope is not valid JSON: ${err2.message}`);
+  }
+  validateEnvelope(envelope);
+  const kek = await deriveKek(passphrase, envelope.kdf.salt_b64, {
+    memory_kib: boundedKdfParam("memory_kib", envelope.kdf.memory_kib),
+    iterations: boundedKdfParam("iterations", envelope.kdf.iterations),
+    parallelism: boundedKdfParam("parallelism", envelope.kdf.parallelism)
+  });
+  const nonce = fromB642(envelope.cipher.nonce_b64);
+  if (nonce.length !== AES_NONCE_BYTES) {
+    throw new StateCorrupt(`nonce length is ${nonce.length}, expected ${AES_NONCE_BYTES}`);
+  }
+  const ct = fromB642(envelope.cipher.ciphertext_b64);
+  const ptBytes = await aesGcmDecrypt(kek, nonce, ct);
+  const ptText = new TextDecoder("utf-8", { fatal: true }).decode(ptBytes);
+  let plaintext;
+  try {
+    plaintext = JSON.parse(ptText);
+  } catch (err2) {
+    throw new StateCorrupt(`plaintext is not valid JSON: ${err2.message}`);
+  }
+  validatePlaintext(plaintext);
+  if (plaintext.pending === void 0) {
+    plaintext.pending = {};
+  }
+  return plaintext;
+}
+async function saveState(state, passphrase, statePath) {
+  validatePlaintext(state);
+  const salt = (0, import_node_crypto2.randomBytes)(ARGON2_SALT_BYTES);
+  const nonce = (0, import_node_crypto2.randomBytes)(AES_NONCE_BYTES);
+  const kek = await deriveKek(passphrase, toB642(salt), CURRENT_KDF_PARAMS);
+  const ptBytes = new TextEncoder().encode(JSON.stringify(state));
+  const ct = await aesGcmEncrypt(kek, nonce, ptBytes);
+  const envelope = {
+    version: STATE_VERSION,
+    format: FORMAT_TAG,
+    kdf: {
+      algo: "argon2id",
+      memory_kib: ARGON2_MEMORY_KIB,
+      iterations: ARGON2_ITERATIONS,
+      parallelism: ARGON2_PARALLELISM,
+      salt_b64: toB642(salt)
+    },
+    cipher: {
+      algo: "aes-256-gcm",
+      nonce_b64: toB642(nonce),
+      ciphertext_b64: toB642(ct),
+      tag_included: true
+    }
+  };
+  const dir = (0, import_node_path3.dirname)(statePath);
+  await import_node_fs2.promises.mkdir(dir, { recursive: true, mode: 448 });
+  const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
+  const fh = await import_node_fs2.promises.open(tmp, "w", 384);
+  try {
+    await fh.writeFile(JSON.stringify(envelope), "utf8");
+    await fh.sync();
+  } finally {
+    await fh.close();
+  }
+  await import_node_fs2.promises.rename(tmp, statePath);
+  try {
+    const dh = await import_node_fs2.promises.open(dir, "r");
+    try {
+      await dh.sync();
+    } finally {
+      await dh.close();
+    }
+  } catch {
+  }
+  await import_node_fs2.promises.chmod(dir, 448).catch(() => {
+  });
+}
+function updateState(passphrase, statePath, mutate) {
+  return withStateLock((0, import_node_path3.dirname)(statePath), async () => {
+    const view = await loadState(passphrase, statePath);
+    if (await mutate(view) !== false) await saveState(view, passphrase, statePath);
+    return view;
+  });
+}
+
+// src/seed.ts
+var SEED_ENV_VAR = "SEAL_SEED";
+var EPHEMERAL_ENV_VAR = "SEAL_MCP_EPHEMERAL";
+var PASSPHRASE_ENV_VAR = "SEAL_MCP_PASSPHRASE";
+var SEED_FILE_NAME = "seed";
+var KEYCHAIN_SERVICE = "seal-mcp";
+var KEYCHAIN_ACCOUNT = "seed";
+var LEGACY_KEYCHAIN_ACCOUNT = "state";
+var SeedInvalidError = class extends Error {
+  code = "seed_invalid";
+  constructor(where) {
+    super(
+      `${where} is not an agent key: expected 43 base64url characters, as \`sealnet-mcp seed --force\` or \`seal keygen --export --force\` print them`
+    );
+    this.name = "SeedInvalidError";
+  }
+};
+var IdentityConflictError = class extends Error {
+  code = "identity_conflict";
+  constructor(statePath) {
+    super(
+      `${statePath} does not open with this agent's key: it belongs to another key (a foreign ${SEED_ENV_VAR}?) or was tampered with. Unset ${SEED_ENV_VAR}, or run \`sealnet-mcp reset --force\` to start over with a new address.`
+    );
+    this.name = "IdentityConflictError";
+  }
+};
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    (0, import_node_child_process.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
+var keytarCache = void 0;
+async function loadKeytar() {
+  if (keytarCache !== void 0) return keytarCache;
+  try {
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    keytarCache = keytarOverKeyring(keyring);
+  } catch {
+    keytarCache = null;
+  }
+  return keytarCache;
+}
+async function keychainGet(account) {
+  const keytar = await loadKeytar();
+  if (keytar === null) return null;
+  try {
+    const value = await keytar.getPassword(KEYCHAIN_SERVICE, account);
+    return value !== null && value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function keychainDelete(account) {
+  const keytar = await loadKeytar();
+  if (keytar === null) return false;
+  try {
+    return await keytar.deletePassword(KEYCHAIN_SERVICE, account);
+  } catch {
+    return false;
+  }
+}
+function parseSeed(text, where) {
+  const seed = Buffer.from(text, "base64url");
+  if (!/^[A-Za-z0-9_-]{43}$/.test(text) || seed.toString("base64url") !== text) throw new SeedInvalidError(where);
+  return new Uint8Array(seed);
+}
+async function readSeed(stateDir, env = process.env) {
+  const fromEnv = env[SEED_ENV_VAR]?.trim();
+  if (fromEnv) return { seed: parseSeed(fromEnv, SEED_ENV_VAR), source: "env" };
+  const stored = await keychainGet(KEYCHAIN_ACCOUNT);
+  if (stored !== null) return { seed: parseSeed(stored, `keychain entry ${KEYCHAIN_SERVICE}/${KEYCHAIN_ACCOUNT}`), source: "keychain" };
+  const file = (0, import_node_path4.join)(stateDir, SEED_FILE_NAME);
+  let text;
+  try {
+    text = await import_node_fs3.promises.readFile(file, "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return null;
+    throw err2;
+  }
+  return { seed: parseSeed(text.trim(), file), source: "file" };
+}
+async function storeSeed(stateDir, seed) {
+  const text = Buffer.from(seed).toString("base64url");
+  const keytar = await loadKeytar();
+  if (keytar !== null) {
+    try {
+      await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, text);
+      return "keychain";
+    } catch {
+    }
+  }
+  const fh = await import_node_fs3.promises.open((0, import_node_path4.join)(stateDir, SEED_FILE_NAME), "wx", 384);
+  try {
+    await fh.writeFile(`${text}
+`, "utf8");
+    await fh.sync();
+  } finally {
+    await fh.close();
+  }
+  return "file";
+}
+function statePassphrase(seed) {
+  return Buffer.from((0, import_node_crypto3.hkdfSync)("sha256", seed, "seal-mcp:state:v1", "passphrase", 32)).toString("base64url");
+}
+async function legacyPassphrase(env) {
+  const stored = await keychainGet(LEGACY_KEYCHAIN_ACCOUNT);
+  if (stored !== null) return { passphrase: stored, source: "keychain" };
+  const fromEnv = env[PASSPHRASE_ENV_VAR];
+  return fromEnv ? { passphrase: fromEnv, source: "env" } : null;
+}
+async function tryOpen(passphrase, statePath) {
+  try {
+    return await loadState(passphrase, statePath);
+  } catch (err2) {
+    if (err2 instanceof StatePassphraseInvalid) return null;
+    throw err2;
+  }
+}
+async function requireIdentity(view, seed, statePath) {
+  const { secret } = await loadIdentity(view.identity);
+  if (!Buffer.from(secret).equals(Buffer.from(seed))) throw new IdentityConflictError(statePath);
+}
+function openAgentState(path, env = process.env) {
+  return withStateLock(path.dir, async () => {
+    let root = await readSeed(path.dir, env);
+    if (!await import_node_fs3.promises.stat(path.statePath).then(() => true, () => false)) {
+      if (root === null) {
+        const { secret } = await generateIdentity();
+        root = { seed: secret, source: await storeSeed(path.dir, secret) };
+      }
+      const passphrase2 = statePassphrase(root.seed);
+      const identity = await identityFromSeed(root.seed);
+      await saveState(createEmptyState(identityToFields(identity)), passphrase2, path.statePath);
+      return { root, passphrase: passphrase2, created: true, moved: null };
+    }
+    if (root !== null) {
+      const view2 = await tryOpen(statePassphrase(root.seed), path.statePath);
+      if (view2 !== null) {
+        await requireIdentity(view2, root.seed, path.statePath);
+        return { root, passphrase: statePassphrase(root.seed), created: false, moved: null };
+      }
+    }
+    const legacy = await legacyPassphrase(env);
+    const view = legacy === null ? null : await tryOpen(legacy.passphrase, path.statePath);
+    if (legacy === null || view === null) throw new IdentityConflictError(path.statePath);
+    if (root !== null) await requireIdentity(view, root.seed, path.statePath);
+    else {
+      const { secret } = await loadIdentity(view.identity);
+      root = { seed: secret, source: await storeSeed(path.dir, secret) };
+    }
+    const passphrase = statePassphrase(root.seed);
+    await saveState(view, passphrase, path.statePath);
+    await keychainDelete(LEGACY_KEYCHAIN_ACCOUNT);
+    return { root, passphrase, created: false, moved: legacy.source };
+  });
+}
+async function deleteRootSecret(stateDir) {
+  let seedFile = true;
+  await import_node_fs3.promises.unlink((0, import_node_path4.join)(stateDir, SEED_FILE_NAME)).catch((err2) => {
+    if (err2.code !== "ENOENT") throw err2;
+    seedFile = false;
+  });
+  const seed = await keychainDelete(KEYCHAIN_ACCOUNT);
+  const legacy = await keychainDelete(LEGACY_KEYCHAIN_ACCOUNT);
+  return { seedFile, keychain: seed || legacy };
+}
+async function probeKeychain() {
+  const keytar = await loadKeytar();
+  if (keytar === null) return { available: false, hasSeed: false };
+  try {
+    const value = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    return { available: true, hasSeed: value !== null && value.length > 0 };
+  } catch {
+    return { available: false, hasSeed: false };
+  }
+}
+
+// src/server.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+var external_exports = {};
+__export(external_exports, {
+  BRAND: () => BRAND,
+  DIRTY: () => DIRTY,
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
   objectUtil: () => objectUtil,
   oboolean: () => oboolean,
   onumber: () => onumber,
@@ -11371,7 +11811,7 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Files sent to your key arrive in seal_inbox; open them with seal_open item. Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
@@ -11421,7 +11861,7 @@ var seal_mcp_v1_default = {
         required: ["handle", "receipt", "handoff_channel"],
         properties: {
           handle: { type: "string", pattern: "^h_[A-Za-z0-9_-]{12,}$", description: "Opaque server-internal ID. Used by `seal_revoke` and other tools. 12+ base64url chars after the `h_` prefix \u2014 the alphabet includes `-` and `_` (generateHandle emits base64url), so the pattern must too." },
-          receipt: { type: "string", description: "Plain-text status the model should relay verbatim to the user. e.g. 'The seal link is on your clipboard. Paste it to the recipient.' In ephemeral mode (see `passphrase_delivery`) it adds that the handle lives until the server restarts and the seal's expiry does not depend on it." },
+          receipt: { type: "string", description: "Plain-text status the model should relay verbatim to the user. e.g. 'The seal link is on your clipboard. Paste it to the recipient.' In ephemeral mode (see `root_secret.ephemeral_mode`) it adds that the handle lives until the server restarts and the seal's expiry does not depend on it." },
           handoff_channel: { type: "string", enum: ["clipboard", "file"] },
           handoff_file: { type: "string", description: "ONLY when handoff_channel='file'. Absolute path to a 0o600 file containing the share link and a newline." },
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
@@ -11439,7 +11879,8 @@ var seal_mcp_v1_default = {
           share_url: { type: "string", format: "uri", description: "`targeted_x25519_v1` link: the wrapped key is in the fragment, useless without the recipient's X25519 secret; there is no separate password." },
           expires_at: { type: "string", format: "date-time" },
           max_reads: { type: "integer", const: 1 },
-          mode: { type: "string", const: "forward" }
+          mode: { type: "string", const: "forward" },
+          delivered: { type: "boolean", description: "The link also lies in the recipient's inbox (SPEC-ADDRESS F2): the server keeps its wrapped key in the link's row, and the holder of the key finds it with seal_inbox without being handed the URL." }
         },
         policy: {
           max_expire_minutes: 30,
@@ -11507,9 +11948,11 @@ var seal_mcp_v1_default = {
       annotations: { readOnlyHint: false, destructiveHint: false },
       annotations_note: "Set on the tool, not per mode: `inline` and `file` consume an open, so the tool as a whole is not read-only.",
       input: {
-        required: ["url"],
+        one_of: ["url", "item"],
+        one_of_note: "Exactly one of `url` and `item`; `server.ts` takes both as optional and the handler refuses anything else with `url_invalid`.",
         properties: {
           url: { type: "string", format: "uri", description: "Full SEAL share URL including fragment." },
+          item: { type: "string", pattern: "^in_", description: "An inbox handle from seal_inbox (`in_\u2026`), instead of a URL." },
           mode: { type: "string", enum: ["metadata", "inline", "file"], default: "metadata", description: "`metadata` reads nothing; `file` saves to disk; `inline` returns small text." },
           dir: { type: "string", description: "mode=file: directory to save into; default ~/Downloads, created if missing. An existing file is never overwritten: the new one becomes `name (1).ext`." }
         }
@@ -11554,16 +11997,50 @@ var seal_mcp_v1_default = {
           max_reads: { type: "integer", minimum: 1 },
           expires_at: { type: "string", format: "date-time" }
         },
-        does_not_consume_counters: true
-      },
-      output_inline_allowed_mimes: ["application/json", "text/csv", "text/plain"],
-      output_inline_max_bytes: 102400,
-      output_inline_refusals: {
-        "secrets.json::mime": "inline_blocked.secret",
-        "text/html": "inline_blocked.injection_risk",
-        "application/pdf": "inline_blocked.injection_risk",
-        "application/xhtml+xml": "inline_blocked.injection_risk",
-        _binary_default: "inline_blocked.binary"
+        does_not_consume_counters: true
+      },
+      output_inline_allowed_mimes: ["application/json", "text/csv", "text/plain"],
+      output_inline_max_bytes: 102400,
+      output_inline_refusals: {
+        "secrets.json::mime": "inline_blocked.secret",
+        "text/html": "inline_blocked.injection_risk",
+        "application/pdf": "inline_blocked.injection_risk",
+        "application/xhtml+xml": "inline_blocked.injection_risk",
+        _binary_default: "inline_blocked.binary"
+      }
+    },
+    seal_inbox: {
+      title: "Check the inbox",
+      description: "Seals other agents or people sent to your key (your address). Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
+      annotations: { readOnlyHint: true, openWorldHint: true },
+      input: {
+        properties: {
+          wait: { type: "integer", minimum: 0, maximum: 300, default: 0, description: "Seconds to wait for an item this server has not seen yet; 0 returns the inbox now." }
+        }
+      },
+      flow: "`GET /intake?to=<this server's address>` under the proof of the key (seal_address.v1.json proof), cached until 30 s before it expires. The first call in a process returns the list at once; later ones long-poll by 25 s with `seen` = the version of the last answer until an id this process has not seen arrives or `wait` runs out. Handles, rows and the version live in process memory.",
+      output: {
+        type: "object",
+        required: ["address_emoji", "items"],
+        properties: {
+          address_emoji: { type: "string", description: "Three emoji of this server's address (`fingerprint_emoji.json`)." },
+          items: {
+            type: "array",
+            items: {
+              type: "object",
+              required: ["handle", "from", "label", "received_at", "expires_at"],
+              additionalProperties: false,
+              properties: {
+                handle: { type: "string", pattern: "^in_", description: "`in_` + the inbox item id; pass as seal_open `item`." },
+                from: { type: ["string", "null"], description: "Three emoji of the sender's address when the server verified it, else null." },
+                label: { type: ["string", "null"], description: "What the sender called itself (an agent's name, `sealnet`), in the clear: never content." },
+                received_at: { type: "string", format: "date-time" },
+                expires_at: { type: "string", format: "date-time" }
+              }
+            }
+          }
+        },
+        MUST_NOT_contain: ["path", "fragment", "url", "seal_id", "share_code"]
       }
     },
     seal_list: {
@@ -11757,7 +12234,7 @@ var seal_mcp_v1_default = {
           type: "object",
           required: ["x25519_secret_b64", "x25519_public_b64"],
           properties: {
-            x25519_secret_b64: { type: "string", description: "32 raw bytes, base64-padded. Generated once, at `sealnet-mcp init` or at the first `sealnet-mcp serve` without state. Lost passphrase = lost identity = unable to open incoming targeted seals; handoff continues to work without identity." },
+            x25519_secret_b64: { type: "string", description: "32 raw bytes, base64url. The seed of `root_secret`: must equal it, else the server refuses with `identity_conflict`. Lost seed = lost address = incoming targeted seals unopenable; handoff continues to work without identity." },
             x25519_public_b64: { type: "string", description: "32 raw bytes, derived from secret. Safe to publish; advertised so other parties can target this MCP." }
           }
         },
@@ -11778,7 +12255,7 @@ var seal_mcp_v1_default = {
         },
         pending: {
           type: "object",
-          description: "Durable operation journal (ISSUE-0623), keyed by handle. A seal_share journals BEFORE its first remote effect and checkpoints every step; completion removes the entry in the same envelope write that inserts the durable handle. OPTIONAL: envelopes written before the journal existed omit it and readers normalise to {}. Recovery semantics at server start: 'preparing' (no confirmed remote effect) is dropped; 'uploaded'/'awaiting_payment'/'compensating' (URL never delivered) is revoked, AWAITED \u2014 an unpaid seal cannot be finished after a restart, and a payment that lands after the revoke is refunded by the server; 'delivering' (URL possibly already delivered) is ADOPTED as a durable handle \u2014 never revoked, so the owner keeps control of a link the user may already hold.",
+          description: "Durable operation journal (ISSUE-0623), keyed by handle. A seal_share journals BEFORE its first remote effect and checkpoints every step; completion removes the entry in the same envelope write that inserts the durable handle. OPTIONAL: envelopes written before the journal existed omit it and readers normalise to {}. Recovery semantics at server start, for entries whose `owner` cannot still be running (several MCP hosts share one state, SPEC-ADDRESS F1 \xA74): 'preparing' (no confirmed remote effect) is dropped; 'uploaded'/'awaiting_payment'/'compensating' (URL never delivered) is revoked, AWAITED \u2014 an unpaid seal cannot be finished after a restart, and a payment that lands after the revoke is refunded by the server; 'delivering' (URL possibly already delivered) is ADOPTED as a durable handle \u2014 never revoked, so the owner keeps control of a link the user may already hold.",
           additionalProperties: {
             type: "object",
             required: ["tool", "mode", "started_at", "owner_token_b64", "expires_at", "step"],
@@ -11791,6 +12268,12 @@ var seal_mcp_v1_default = {
               step: { type: "string", enum: ["preparing", "awaiting_payment", "uploaded", "delivering", "compensating"] },
               seal_id: { type: "string", pattern: "^[A-Za-z0-9_-]{6,20}$", description: "Set once the upload confirms; (seal_id, owner_token_b64) is the full revoke capability." },
               handoff_channels_attempted: { type: "array", items: { type: "string", enum: ["clipboard", "file"] }, description: "Channels performHandoff will try, in order (handoff mode only; journaled before delivery starts)." },
+              owner: {
+                type: "object",
+                required: ["pid", "hostname"],
+                properties: { pid: { type: "integer" }, hostname: { type: "string" } },
+                description: "The process running the operation. Recovery leaves an entry alone while that process may still run: alive on this host, or on another host, which cannot be probed (the state lock's rule). Entries without it, from 0.2.x, are recovered as crashed."
+              },
               compensation: {
                 type: "object",
                 required: ["action", "outcome", "error", "at"],
@@ -11822,27 +12305,20 @@ var seal_mcp_v1_default = {
       }
     }
   },
-  passphrase_delivery: {
-    ordered_priority: [
-      {
-        rank: 1,
-        method: "os_keychain",
-        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
-        default: true
-      },
-      {
-        rank: 2,
-        method: "env_var",
-        implementation: "$SEAL_MCP_PASSPHRASE. Visible to same-user attackers via /proc/<pid>/environ on Linux. Warning logged on stderr at startup. Use only in CI / headless containers."
-      },
-      {
-        rank: 3,
-        method: "REFUSED",
-        implementation: "Cleartext passphrase file on disk is explicitly refused even if user passes `--passphrase-file \u2026`. Error message points at options 1 and 2."
-      }
+  root_secret: {
+    seed: "The agent's one root secret (SPEC-ADDRESS F1): a 32-byte X25519 secret, as text 43 base64url characters \u2014 the same bytes as `state.identity.x25519_secret_b64`, the CLI's `identity.v1.json::x25519_secret_b64url`, the SDK's `KeyPair.secretKey` and sealnet's `keygen().secret_key`. Its public half is the agent's address; it must survive a restart, a second MCP host on the machine and a move to the cloud.",
+    ordered_sources: [
+      { rank: 1, source: "env", implementation: "$SEAL_SEED. How a container or a cloud session gets the same address as at home." },
+      { rank: 2, source: "keychain", implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service 'seal-mcp', account 'seed', the seed as UTF-8 bytes." },
+      { rank: 3, source: "file", implementation: "`<state_dir>/seed`, mode 0600 in the 0700 state directory, created on the first start where there is no keychain. The CLI's threat model (`secrets.rs`): a process running as this user reads it either way, keychain or file." }
     ],
-    ephemeral_mode: "First `serve` without state where neither the keychain nor SEAL_MCP_PASSPHRASE is available (container, CI), or `serve --ephemeral`: identity, handles, journal and audit live only in process memory and nothing is written to disk (rank 3 stays refused). The `seal_share` receipt says the handle lives until the server restarts and the seal's expiry does not depend on it.",
-    lost_passphrase_recovery: "Passphrase is NOT recoverable. `sealnet-mcp init --force` mints a new identity, but old targeted seals (addressed to the old pubkey) become permanently unopenable. Handoff seals are not affected (they don't use identity)."
+    created: "The first `serve` (or `init`) with no seed in any source makes one and keeps it in the keychain, or in the file where there is none. `init` asks nothing.",
+    state_passphrase: "base64url(HKDF-SHA256(ikm = seed, salt = 'seal-mcp:state:v1', info = 'passphrase', 32 bytes)). The state envelope (Argon2id \u2192 AES-256-GCM) is unchanged; only where its passphrase comes from changed. One root secret instead of a passphrase and a key.",
+    identity_conflict: "`state.identity` must be the seed. A state that opens neither with the seed's passphrase nor with a migration passphrase belongs to another key (a foreign SEAL_SEED): `serve` refuses with `identity_conflict`, exit 3. Unset SEAL_SEED, or `sealnet-mcp reset --force`. The address never changes silently.",
+    migration_0_2: "Once, when no seed exists in any source and a state does: open it with the old passphrase (keychain entry 'seal-mcp'/'state', including the Linux entry keytar wrote, or $SEAL_MCP_PASSPHRASE), take the seed from `state.identity`, store it (keychain 'seed', else the file), save the same state under the seed's passphrase (atomic, as every save), delete the old keychain entry. $SEAL_MCP_PASSPHRASE is read only here and warns that it is no longer used. Removed in the first minor release after no 0.2.x state is left, the condition `readKeytarLinuxEntry` carries.",
+    ephemeral_mode: "Only `serve --ephemeral` or $SEAL_MCP_EPHEMERAL=1: a new key each start; identity, handles, journal and audit live only in process memory, nothing is written to disk. The `seal_share` receipt says the handle lives until the server restarts and the seal's expiry does not depend on it.",
+    several_hosts: "Every MCP host of one user on one machine (Claude Desktop, Claude Code, Cursor) runs its own `serve` on the same state: one seed, one address. The state lock is taken per write, not for a process lifetime: each change re-reads `state.json`, applies this process's insertions and explicit deletions and saves. Waiting for the lock ends after 5 s with `state_busy`.",
+    lost_seed: "The seed is the address: lost (`reset --force`, a wiped keychain with no file) means links addressed to the old key stay unopenable and paired owners must pair again; handoff seals are unaffected. `sealnet-mcp seed --force` prints it, to move the agent by setting SEAL_SEED elsewhere."
   },
   handoff_delivery: {
     primary_channel: "system_clipboard",
@@ -11890,6 +12366,10 @@ var seal_mcp_v1_default = {
     share_blob_corrupt: "Share blob decoded but a file_key is not valid base64url or has the wrong length (32 bytes expected). Backend bug or share-blob tampering.",
     share_blob_failed: "`encryptShareBlob` threw during seal_share mint (Web Crypto failure or input shape bug). Caller-facing in seal_share path only.",
     share_link_failed: "POST /seal/{id}/share returned an error (network, 5xx, owner_token mismatch).",
+    inbox_proof_failed: "seal_inbox / seal_open item / seal_share forward: the server refused the proof of this server's key (`intake.proof_required`) even after one fresh challenge.",
+    inbox_full: "seal_share forward: the recipient's inbox holds `limits.json::INBOX_MAX_ITEMS` live items from other senders (`intake.inbox_full`). The seal is revoked; retry later.",
+    inbox_item_gone: "seal_open item: the handle is not in this process's inbox and not in a fresh read of it \u2014 the seal or link was revoked or expired, or the item was removed.",
+    inbox_failed: "seal_inbox / seal_open item: reading or cleaning the inbox failed for a reason other than the proof (network, 5xx, rate limit); the message has the status. Safe to retry.",
     targeted_fragment_invalid: "seal_open of `x25519:` URL: fragment is malformed base64url, wrong packed length, or AEAD-failed for a non-secret reason. Distinct from `targeted_decrypt_failed` which is the wrong-recipient case.",
     targeted_decrypt_failed: "seal_open of `x25519:` URL: AEAD verification failed under THIS device's identity. The URL was not addressed to this MCP's pubkey (or was tampered, or seal_id from path-segment was substituted). Recipient should ask the sender to re-mint with `--to <our pubkey>`.",
     auth_required: "Backend returned 401/403 because the seal has OTP / NDA / login gating; interactive auth is not supported in MCP. Open the URL in a browser.",
@@ -11918,11 +12398,12 @@ var seal_mcp_v1_default = {
     pro_file_not_granted: "seal_pro_file_get: the room's seal is visible but a file's key envelope is refused to this agent.",
     pro_failed: "seal_pro_*: SEAL Pro answered with another error; the message has the status.",
     state_persist_failed: "seal_share: the journal checkpoint (`uploaded` or `delivering`) could not be made durable. The fresh seal is auto-revoked (compensation outcome embedded in the message) because delivering a capability the journal cannot account for is worse than failing the call.",
+    state_busy: "Another sealnet-mcp process held the state lock for more than 5 s. Nothing was changed by this call; safe to retry.",
     runtime_unsupported: "Node runtime is missing a global the bundle assumes (e.g. `globalThis.File` or `globalThis.Blob`). Upgrade to Node \u226520.",
     internal_inconsistency: "Server detected a state branch the type-system thought was unreachable (e.g. forward gate passed but recipientPub is null). Always a bug \u2014 caller should report.",
-    "state.passphrase_invalid": "AES-256-GCM tag check failed. Likely wrong passphrase in keychain / env; could be tampered file. Server refuses to start.",
+    identity_conflict: "Startup: the state does not open with this seed's passphrase nor with a migration passphrase \u2014 it belongs to another key (a foreign SEAL_SEED), or it was tampered with. Server refuses to start (exit 3); see `root_secret.identity_conflict`.",
     "state.corrupt": "Envelope JSON malformed or version unknown. Server refuses to start; user must rerun `sealnet-mcp init --force` (lose old data) or restore from backup.",
-    state_dir_unsafe: "Startup: the state directory is a symlink or not a real directory \u2014 the lifetime lock and the envelope it protects would resolve to different places. Server refuses to start.",
+    state_dir_unsafe: "The state directory is a symlink or not a real directory \u2014 the state lock and the envelope it protects would resolve to different places. Refused.",
     base_url_invalid: "Startup/config: backend or public-host base URL is not an absolute http(s) URL, or carries a query string / fragment / embedded credentials. Every derived URL would be corrupt, so the value is rejected at configuration time."
   },
   current_format_version: 1,
@@ -11949,7 +12430,7 @@ function safeFilename(name) {
   return cleaned.length > 0 ? cleaned : "seal-file";
 }
 async function receiveToDisk(opened, dir, name) {
-  const fs3 = await import(
+  const fs4 = await import(
     /* webpackIgnore: true */
     /* @vite-ignore */
     "fs/promises"
@@ -11959,10 +12440,10 @@ async function receiveToDisk(opened, dir, name) {
     /* @vite-ignore */
     "path"
   );
-  await fs3.mkdir(dir, { recursive: true });
+  await fs4.mkdir(dir, { recursive: true });
   const suffix = Array.from(crypto.getRandomValues(new Uint8Array(6)), (b) => b.toString(16).padStart(2, "0")).join("");
   const tmp = path.join(dir, `.seal-partial-${suffix}`);
-  const fh = await fs3.open(tmp, "wx", 384);
+  const fh = await fs4.open(tmp, "wx", 384);
   let placed = false;
   try {
     await opened.stream.pipeTo(
@@ -11980,12 +12461,12 @@ async function receiveToDisk(opened, dir, name) {
     for (let i = 0; i < 1e3; i++) {
       const candidate = path.join(dir, i === 0 ? name : `${stem} (${i})${ext}`);
       try {
-        await fs3.link(tmp, candidate);
+        await fs4.link(tmp, candidate);
       } catch (err2) {
         if (err2.code === "EEXIST") continue;
         throw err2;
       }
-      await fs3.unlink(tmp);
+      await fs4.unlink(tmp);
       placed = true;
       return { path: candidate, sizeBytes, sha256: sha2562 };
     }
@@ -11993,7 +12474,7 @@ async function receiveToDisk(opened, dir, name) {
   } finally {
     if (!placed) {
       await fh.close().catch(() => void 0);
-      await fs3.unlink(tmp).catch(() => void 0);
+      await fs4.unlink(tmp).catch(() => void 0);
     }
   }
 }
@@ -12379,6 +12860,10 @@ async function recoverPendingOperations(view, client, opts = {}) {
       log4(`[seal-mcp] recovery: skipping unknown pending op tool=${String(op.tool)} handle=${handle}`);
       continue;
     }
+    if (op.owner !== void 0 && op.owner.pid !== process.pid && holderMayRun(op.owner)) {
+      log4(`[seal-mcp] recovery: left ${handle} alone \u2014 pid ${op.owner.pid} on ${op.owner.hostname} may still run it`);
+      continue;
+    }
     if (op.seal_id === void 0) {
       delete view.pending[handle];
       report.dropped.push(handle);
@@ -12399,274 +12884,52 @@ async function recoverPendingOperations(view, client, opts = {}) {
       op.step = "compensating";
       op.compensation = {
         action: "revoke",
-        outcome: "failed",
-        error: `backend mismatch: op belongs to ${op.backend_url}, server configured for ${client.baseUrl}`,
-        at: nowIso(opts.now)
-      };
-      report.stillFailing.push(handle);
-      changed = true;
-      log4(
-        `[seal-mcp] recovery: NOT compensating ${handle} \u2014 it belongs to ${op.backend_url} but this server talks to ${client.baseUrl}; kept in journal until the server runs against the original backend`
-      );
-      continue;
-    }
-    try {
-      await client.revoke(op.seal_id, op.owner_token_b64);
-      delete view.pending[handle];
-      report.revoked.push(handle);
-      changed = true;
-      log4(`[seal-mcp] recovery: revoked orphaned seal for ${handle} (step was '${op.step}')`);
-    } catch (err2) {
-      const msg = err2 instanceof Error ? err2.message : String(err2);
-      op.step = "compensating";
-      op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso(opts.now) };
-      report.stillFailing.push(handle);
-      changed = true;
-      log4(
-        `[seal-mcp] recovery: revoke retry for ${handle} failed (${msg}) \u2014 kept in journal, seal expires by TTL at ${op.expires_at}`
-      );
-    }
-  }
-  return { report, changed };
-}
-function adoptAsHandle(view, handle, op, now) {
-  const sealId = op.seal_id;
-  if (view.handles[handle] === void 0) {
-    view.handles[handle] = {
-      seal_id: sealId,
-      owner_token_b64: op.owner_token_b64,
-      created_at: op.started_at,
-      mode: op.mode,
-      expires_at: op.expires_at,
-      // Propagate provenance so a later seal_revoke on the adopted
-      // handle still refuses to target the wrong backend.
-      backend_url: op.backend_url
-    };
-    view.audit.push({ ts: nowIso(now), tool: "seal_share", handle, mode: op.mode });
-  }
-  delete view.pending[handle];
-}
-
-// src/state.ts
-var import_node_crypto3 = require("crypto");
-var import_node_fs2 = require("fs");
-var import_node_path3 = require("path");
-var import_argon2 = __toESM(require("argon2"), 1);
-var FORMAT_TAG = "SEAL_MCP_STATE v1";
-var STATE_VERSION = 1;
-var ARGON2_MEMORY_KIB = 65536;
-var ARGON2_ITERATIONS = 3;
-var ARGON2_PARALLELISM = 4;
-var ARGON2_SALT_BYTES = 16;
-var KDF_BOUNDS = {
-  memory_kib: { min: 8192, max: 1048576 },
-  // 8 MiB .. 1 GiB
-  iterations: { min: 1, max: 16 },
-  parallelism: { min: 1, max: 16 }
-};
-var AES_KEY_BYTES = 32;
-var AES_NONCE_BYTES = 12;
-var StatePassphraseInvalid = class extends Error {
-  constructor() {
-    super("state.passphrase_invalid: AES-256-GCM tag check failed");
-    this.name = "StatePassphraseInvalid";
-  }
-};
-var StateCorrupt = class extends Error {
-  constructor(reason) {
-    super(`state.corrupt: ${reason}`);
-    this.name = "StateCorrupt";
-  }
-};
-function toB642(bytes) {
-  return Buffer.from(bytes).toString("base64");
-}
-function fromB642(s) {
-  return new Uint8Array(Buffer.from(s, "base64"));
-}
-var CURRENT_KDF_PARAMS = {
-  memory_kib: ARGON2_MEMORY_KIB,
-  iterations: ARGON2_ITERATIONS,
-  parallelism: ARGON2_PARALLELISM
-};
-function boundedKdfParam(name, value) {
-  if (typeof value !== "number" || !Number.isInteger(value)) {
-    throw new StateCorrupt(`kdf.${name} is not an integer: ${String(value)}`);
-  }
-  const { min, max } = KDF_BOUNDS[name];
-  if (value < min || value > max) {
-    throw new StateCorrupt(`kdf.${name}=${value} outside sane bounds [${min}, ${max}]`);
-  }
-  return value;
-}
-async function deriveKek(passphrase, saltB64, params) {
-  const salt = fromB642(saltB64);
-  if (salt.length !== ARGON2_SALT_BYTES) {
-    throw new StateCorrupt(`salt length is ${salt.length}, expected ${ARGON2_SALT_BYTES}`);
-  }
-  const kek = await import_argon2.default.hash(passphrase, {
-    type: import_argon2.default.argon2id,
-    raw: true,
-    salt: Buffer.from(salt),
-    memoryCost: params.memory_kib,
-    timeCost: params.iterations,
-    parallelism: params.parallelism,
-    hashLength: AES_KEY_BYTES
-  });
-  return new Uint8Array(kek);
-}
-async function aesGcmEncrypt(kek, nonce, plaintext) {
-  const key = await import_node_crypto3.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["encrypt"]);
-  const ct = await import_node_crypto3.webcrypto.subtle.encrypt(
-    { name: "AES-GCM", iv: nonce, tagLength: 128 },
-    key,
-    plaintext
-  );
-  return new Uint8Array(ct);
-}
-async function aesGcmDecrypt(kek, nonce, ciphertextWithTag) {
-  const key = await import_node_crypto3.webcrypto.subtle.importKey("raw", kek, "AES-GCM", false, ["decrypt"]);
-  try {
-    const pt = await import_node_crypto3.webcrypto.subtle.decrypt(
-      { name: "AES-GCM", iv: nonce, tagLength: 128 },
-      key,
-      ciphertextWithTag
-    );
-    return new Uint8Array(pt);
-  } catch {
-    throw new StatePassphraseInvalid();
-  }
-}
-function createEmptyState(identity) {
-  return {
-    version: STATE_VERSION,
-    identity,
-    handles: {},
-    audit: [],
-    pending: {}
-  };
-}
-function validateEnvelope(json) {
-  if (typeof json !== "object" || json === null) {
-    throw new StateCorrupt("envelope is not an object");
-  }
-  const e = json;
-  if (e.version !== STATE_VERSION) {
-    throw new StateCorrupt(`unknown version: ${String(e.version)}`);
-  }
-  if (e.format !== FORMAT_TAG) {
-    throw new StateCorrupt(`unknown format tag: ${String(e.format)}`);
-  }
-  const kdf = e.kdf;
-  if (!kdf || kdf.algo !== "argon2id" || typeof kdf.salt_b64 !== "string") {
-    throw new StateCorrupt("kdf header missing or wrong algo");
-  }
-  const cipher = e.cipher;
-  if (!cipher || cipher.algo !== "aes-256-gcm" || typeof cipher.nonce_b64 !== "string" || typeof cipher.ciphertext_b64 !== "string") {
-    throw new StateCorrupt("cipher header missing or wrong algo");
-  }
-}
-function validatePlaintext(json) {
-  if (typeof json !== "object" || json === null) {
-    throw new StateCorrupt("plaintext is not an object");
-  }
-  const s = json;
-  if (s.version !== STATE_VERSION) {
-    throw new StateCorrupt(`plaintext version: ${String(s.version)}`);
-  }
-  const id = s.identity;
-  if (!id || typeof id.x25519_secret_b64 !== "string" || typeof id.x25519_public_b64 !== "string") {
-    throw new StateCorrupt("identity missing or malformed");
-  }
-  if (typeof s.handles !== "object" || s.handles === null) {
-    throw new StateCorrupt("handles is not an object");
-  }
-  if (!Array.isArray(s.audit)) {
-    throw new StateCorrupt("audit is not an array");
-  }
-  if (s.pending !== void 0 && (typeof s.pending !== "object" || s.pending === null)) {
-    throw new StateCorrupt("pending is not an object");
-  }
-}
-async function loadState(passphrase, statePath) {
-  const raw = await import_node_fs2.promises.readFile(statePath, "utf8");
-  let envelope;
-  try {
-    envelope = JSON.parse(raw);
-  } catch (err2) {
-    throw new StateCorrupt(`envelope is not valid JSON: ${err2.message}`);
-  }
-  validateEnvelope(envelope);
-  const kek = await deriveKek(passphrase, envelope.kdf.salt_b64, {
-    memory_kib: boundedKdfParam("memory_kib", envelope.kdf.memory_kib),
-    iterations: boundedKdfParam("iterations", envelope.kdf.iterations),
-    parallelism: boundedKdfParam("parallelism", envelope.kdf.parallelism)
-  });
-  const nonce = fromB642(envelope.cipher.nonce_b64);
-  if (nonce.length !== AES_NONCE_BYTES) {
-    throw new StateCorrupt(`nonce length is ${nonce.length}, expected ${AES_NONCE_BYTES}`);
-  }
-  const ct = fromB642(envelope.cipher.ciphertext_b64);
-  const ptBytes = await aesGcmDecrypt(kek, nonce, ct);
-  const ptText = new TextDecoder("utf-8", { fatal: true }).decode(ptBytes);
-  let plaintext;
-  try {
-    plaintext = JSON.parse(ptText);
-  } catch (err2) {
-    throw new StateCorrupt(`plaintext is not valid JSON: ${err2.message}`);
-  }
-  validatePlaintext(plaintext);
-  if (plaintext.pending === void 0) {
-    plaintext.pending = {};
-  }
-  return plaintext;
-}
-async function saveState(state, passphrase, statePath) {
-  validatePlaintext(state);
-  const salt = (0, import_node_crypto3.randomBytes)(ARGON2_SALT_BYTES);
-  const nonce = (0, import_node_crypto3.randomBytes)(AES_NONCE_BYTES);
-  const kek = await deriveKek(passphrase, toB642(salt), CURRENT_KDF_PARAMS);
-  const ptBytes = new TextEncoder().encode(JSON.stringify(state));
-  const ct = await aesGcmEncrypt(kek, nonce, ptBytes);
-  const envelope = {
-    version: STATE_VERSION,
-    format: FORMAT_TAG,
-    kdf: {
-      algo: "argon2id",
-      memory_kib: ARGON2_MEMORY_KIB,
-      iterations: ARGON2_ITERATIONS,
-      parallelism: ARGON2_PARALLELISM,
-      salt_b64: toB642(salt)
-    },
-    cipher: {
-      algo: "aes-256-gcm",
-      nonce_b64: toB642(nonce),
-      ciphertext_b64: toB642(ct),
-      tag_included: true
+        outcome: "failed",
+        error: `backend mismatch: op belongs to ${op.backend_url}, server configured for ${client.baseUrl}`,
+        at: nowIso(opts.now)
+      };
+      report.stillFailing.push(handle);
+      changed = true;
+      log4(
+        `[seal-mcp] recovery: NOT compensating ${handle} \u2014 it belongs to ${op.backend_url} but this server talks to ${client.baseUrl}; kept in journal until the server runs against the original backend`
+      );
+      continue;
     }
-  };
-  const dir = (0, import_node_path3.dirname)(statePath);
-  await import_node_fs2.promises.mkdir(dir, { recursive: true, mode: 448 });
-  const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
-  const fh = await import_node_fs2.promises.open(tmp, "w", 384);
-  try {
-    await fh.writeFile(JSON.stringify(envelope), "utf8");
-    await fh.sync();
-  } finally {
-    await fh.close();
-  }
-  await import_node_fs2.promises.rename(tmp, statePath);
-  try {
-    const dh = await import_node_fs2.promises.open(dir, "r");
     try {
-      await dh.sync();
-    } finally {
-      await dh.close();
+      await client.revoke(op.seal_id, op.owner_token_b64);
+      delete view.pending[handle];
+      report.revoked.push(handle);
+      changed = true;
+      log4(`[seal-mcp] recovery: revoked orphaned seal for ${handle} (step was '${op.step}')`);
+    } catch (err2) {
+      const msg = err2 instanceof Error ? err2.message : String(err2);
+      op.step = "compensating";
+      op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso(opts.now) };
+      report.stillFailing.push(handle);
+      changed = true;
+      log4(
+        `[seal-mcp] recovery: revoke retry for ${handle} failed (${msg}) \u2014 kept in journal, seal expires by TTL at ${op.expires_at}`
+      );
     }
-  } catch {
   }
-  await import_node_fs2.promises.chmod(dir, 448).catch(() => {
-  });
+  return { report, changed };
+}
+function adoptAsHandle(view, handle, op, now) {
+  const sealId = op.seal_id;
+  if (view.handles[handle] === void 0) {
+    view.handles[handle] = {
+      seal_id: sealId,
+      owner_token_b64: op.owner_token_b64,
+      created_at: op.started_at,
+      mode: op.mode,
+      expires_at: op.expires_at,
+      // Propagate provenance so a later seal_revoke on the adopted
+      // handle still refuses to target the wrong backend.
+      backend_url: op.backend_url
+    };
+    view.audit.push({ ts: nowIso(now), tool: "seal_share", handle, mode: op.mode });
+  }
+  delete view.pending[handle];
 }
 
 // src/tools/context.ts
@@ -12685,19 +12948,18 @@ var HANDLE_REGEX = /^h_[A-Za-z0-9_-]{12,}$/;
 function isValidHandle(handle) {
   return typeof handle === "string" && HANDLE_REGEX.test(handle);
 }
+function auditEntry(ctx, tool, handle, mode) {
+  return { ts: (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString(), tool, handle, mode };
+}
 function appendAudit(ctx, tool, handle, mode) {
-  ctx.state.audit.push({
-    ts: (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
-    tool,
-    handle,
-    mode
-  });
+  const entry = auditEntry(ctx, tool, handle, mode);
+  return ctx.update((state) => void state.audit.push(entry));
 }
-function insertHandle(ctx, handle, entry) {
-  if (ctx.state.handles[handle]) {
+function insertHandle(state, handle, entry) {
+  if (state.handles[handle]) {
     throw new Error(`insertHandle: collision on ${handle}`);
   }
-  ctx.state.handles[handle] = entry;
+  state.handles[handle] = entry;
 }
 function lookupHandle(ctx, handle) {
   const entry = ctx.state.handles[handle];
@@ -12717,9 +12979,76 @@ var ToolError = class extends Error {
   }
 };
 
+// src/tools/inbox.ts
+var HANDLE_PREFIX2 = "in_";
+function inboxError(err2) {
+  if (!(err2 instanceof BackendError)) return err2;
+  if (err2.appCode === "intake.proof_required") {
+    return new ToolError("inbox_proof_failed", `the server refused the proof of this server's key: ${err2.message}`, err2);
+  }
+  return new ToolError("inbox_failed", `the inbox failed (${err2.status}): ${err2.message}`, err2);
+}
+function memoryOf(ctx) {
+  if (!ctx.inbox) throw new ToolError("internal_inconsistency", "this server keeps no inbox memory");
+  return ctx.inbox;
+}
+async function sealInbox(ctx, input = {}) {
+  const memory = memoryOf(ctx);
+  const deadline = Date.now() + (memory.version === null ? 0 : (input.wait ?? 0) * 1e3);
+  let seen = memory.version ?? void 0;
+  let inbox;
+  for (; ; ) {
+    const left = Math.ceil((deadline - Date.now()) / 1e3);
+    try {
+      inbox = await readInbox(ctx.client, ctx.identity.secret, left > 0 ? { waitSeconds: left, seen } : {});
+    } catch (err2) {
+      throw inboxError(err2);
+    }
+    const arrived = inbox.items.some((item) => !memory.items.has(HANDLE_PREFIX2 + item.id));
+    if (left <= 0 || arrived || Date.now() >= deadline) break;
+    seen = inbox.version;
+  }
+  memory.items.clear();
+  for (const item of inbox.items) memory.items.set(HANDLE_PREFIX2 + item.id, item);
+  memory.version = inbox.version;
+  return {
+    addressEmoji: keyEmoji(ctx.identity.public),
+    items: inbox.items.map((item) => ({
+      handle: HANDLE_PREFIX2 + item.id,
+      from: item.sender === null ? null : keyEmoji(base64urlToBytes(item.sender)),
+      label: item.label,
+      receivedAt: item.at,
+      expiresAt: item.expires_at
+    }))
+  };
+}
+async function inboxItem(ctx, handle) {
+  const memory = memoryOf(ctx);
+  if (!memory.items.has(handle)) await sealInbox(ctx, {});
+  const item = memory.items.get(handle);
+  if (!item) {
+    throw new ToolError(
+      "inbox_item_gone",
+      `${handle} is not in the inbox: the seal or link was revoked or expired, or the item was removed`
+    );
+  }
+  return item;
+}
+async function forgetInboxItem(ctx, handle) {
+  const item = memoryOf(ctx).items.get(handle);
+  if (!item) return;
+  try {
+    await removeFromInbox(ctx.client, ctx.identity.secret, item.id);
+  } catch (err2) {
+    throw inboxError(err2);
+  }
+  memoryOf(ctx).items.delete(handle);
+}
+
 // src/tools/list.ts
 var SINGLE_FILE_COUNT = 1;
 async function sealList(ctx, input = {}) {
+  await appendAudit(ctx, "seal_list", null, null);
   const now = (ctx.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const entries = [];
   for (const [handle, entry] of Object.entries(ctx.state.handles)) {
@@ -12736,15 +13065,13 @@ async function sealList(ctx, input = {}) {
     });
   }
   entries.sort((a, b) => Date.parse(b.created_at) - Date.parse(a.created_at));
-  appendAudit(ctx, "seal_list", null, null);
-  await ctx.persist();
   return { entries };
 }
 
 // src/tools/open.ts
 var import_promises3 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path4 = require("path");
+var import_node_path5 = require("path");
 var INLINE_ALLOWED_MIMES = ["application/json", "text/csv", "text/plain"];
 var INLINE_INJECTION_RISK_MIMES = /* @__PURE__ */ new Set([
   "text/html",
@@ -12809,11 +13136,28 @@ async function download(ctx, sealId, file) {
   return resp.body;
 }
 async function sealOpen(ctx, input) {
+  if (input.url === void 0 === (input.item === void 0)) {
+    throw new ToolError("url_invalid", "give exactly one of `url` (a SEAL link) and `item` (an inbox handle from seal_inbox)");
+  }
+  const recipient = { recipientSecret: ctx.identity.secret };
+  if (input.url !== void 0) return openSeal(ctx, input, () => openShareLink(ctx.client, input.url, recipient));
+  const handle = input.item;
+  const item = await inboxItem(ctx, handle);
+  try {
+    return await openSeal(ctx, input, () => openShareLink(ctx.client, inboxItemUrl(resolvePublicHost(), item), recipient));
+  } catch (err2) {
+    if (err2 instanceof ToolError && (err2.code === "seal_revoked" || err2.code === "share_link_revoked")) {
+      await forgetInboxItem(ctx, handle).catch(() => void 0);
+    }
+    throw err2;
+  }
+}
+async function openSeal(ctx, input, read) {
   const mode = input.mode ?? "metadata";
   const handle = generateHandle();
   let seal;
   try {
-    seal = await openShareLink(ctx.client, input.url, { recipientSecret: ctx.identity.secret });
+    seal = await read();
   } catch (err2) {
     throw asToolError(err2);
   }
@@ -12822,13 +13166,11 @@ async function sealOpen(ctx, input) {
   if (mode === "inline") {
     const refusal = classifyInlineRefusal(first.mime);
     if (refusal !== null) {
-      appendAudit(ctx, "seal_open", handle, mode);
-      await ctx.persist();
+      await appendAudit(ctx, "seal_open", handle, mode);
       return { handle, refusal, mime: first.mime, note: refusalNote(refusal, first.mime) };
     }
     if (first.size > INLINE_CIPHERTEXT_MAX_BYTES) {
-      appendAudit(ctx, "seal_open", handle, mode);
-      await ctx.persist();
+      await appendAudit(ctx, "seal_open", handle, mode);
       return {
         handle,
         refusal: "inline_blocked.too_large",
@@ -12864,12 +13206,10 @@ async function sealOpen(ctx, input) {
         err2
       );
     }
-    appendAudit(ctx, "seal_open", handle, mode);
-    await ctx.persist();
+    await appendAudit(ctx, "seal_open", handle, mode);
     return { handle, mime: bareMime(first.mime), sizeBytes: plaintext.byteLength, encoding: "utf-8", content };
   }
-  appendAudit(ctx, "seal_open", handle, mode);
-  await ctx.persist();
+  await appendAudit(ctx, "seal_open", handle, mode);
   return {
     handle,
     filename: first.name,
@@ -12891,7 +13231,7 @@ async function openToDisk(ctx, seal, handle, input) {
       `the link carries no key for any file in seal ${seal.sealId} (files appended after it was minted); ask the sender for a fresh link`
     );
   }
-  const dir = (0, import_node_path4.resolve)(input.dir ?? (0, import_node_path4.join)((0, import_node_os3.homedir)(), "Downloads"));
+  const dir = (0, import_node_path5.resolve)(input.dir ?? (0, import_node_path5.join)((0, import_node_os3.homedir)(), "Downloads"));
   try {
     await (0, import_promises3.mkdir)(dir, { recursive: true });
   } catch (err2) {
@@ -12915,15 +13255,14 @@ async function openToDisk(ctx, seal, handle, input) {
       throw streamError(err2, file.id);
     }
   }
-  appendAudit(ctx, "seal_open", handle, "file");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_open", handle, "file");
   return { handle, files: out };
 }
 
 // src/tools/pro.ts
 var import_promises4 = require("fs/promises");
 var import_node_os4 = require("os");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var SECRET_CODES = {
   not_found: "pro_secret_not_found",
   not_granted: "pro_secret_not_granted",
@@ -12948,9 +13287,9 @@ async function asTool(fn, codes = SECRET_CODES) {
 }
 async function sealProSecretUse(source, input) {
   const got = await asTool(() => source.getSecret(input.secret, input.version));
-  const dir = await (0, import_promises4.mkdtemp)((0, import_node_path5.join)((0, import_node_os4.tmpdir)(), "seal-mcp-pro-"));
+  const dir = await (0, import_promises4.mkdtemp)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "seal-mcp-pro-"));
   const name = (got.path?.split("/").pop() || got.id).replace(/[^A-Za-z0-9._-]/g, "_");
-  const path = (0, import_node_path5.join)(dir, name);
+  const path = (0, import_node_path6.join)(dir, name);
   try {
     await (0, import_promises4.writeFile)(path, got.value, { mode: 384, flag: "wx" });
     return { path, sizeBytes: got.value.length, secretId: got.id, version: got.version };
@@ -12964,7 +13303,7 @@ async function sealProSecretRequest(source, input) {
   return asTool(() => source.waitForAccess(asked));
 }
 async function sealProFileGet(source, input) {
-  const dir = (0, import_node_path5.resolve)(input.dir ?? (0, import_node_path5.join)((0, import_node_os4.homedir)(), "Downloads"));
+  const dir = (0, import_node_path6.resolve)(input.dir ?? (0, import_node_path6.join)((0, import_node_os4.homedir)(), "Downloads"));
   const ids = input.file ? [input.file] : (await asTool(() => source.listFiles(input.seal), FILE_CODES)).map((f) => f.id);
   const files = [];
   for (const id of ids) {
@@ -12976,16 +13315,16 @@ async function sealProFileGet(source, input) {
 
 // src/tools/request.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var import_promises5 = require("fs/promises");
 var import_node_os5 = require("os");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function findSealCli() {
   const names = process.platform === "win32" ? ["seal.exe", "seal.cmd"] : ["seal"];
-  for (const dir of (process.env.PATH ?? "").split(import_node_path6.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(import_node_path7.delimiter)) {
     for (const name of names) {
-      const candidate = (0, import_node_path6.join)(dir, name);
-      if (dir && (0, import_node_fs3.existsSync)(candidate)) return candidate;
+      const candidate = (0, import_node_path7.join)(dir, name);
+      if (dir && (0, import_node_fs4.existsSync)(candidate)) return candidate;
     }
   }
   return null;
@@ -13019,8 +13358,7 @@ async function sealRequest(ctx, input, deps) {
   if (input.whereUrl) cliArgs.push("--where", input.whereUrl);
   const local = await (deps.runCli ?? runSealCli)(cliArgs);
   if (local && "files" in local) {
-    appendAudit(ctx, "seal_request", handle, "local");
-    await ctx.persist();
+    await appendAudit(ctx, "seal_request", handle, "local");
     return {
       handle,
       source: "local",
@@ -13060,8 +13398,7 @@ async function sealRequest(ctx, input, deps) {
     }
     return receiveThroughLink(ctx, handle, intake.id, deps, input.onProgress);
   }
-  appendAudit(ctx, "seal_request", handle, "link");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_request", handle, "link");
   return { handle, url, emoji, expiresAt: intake.expires_at };
 }
 async function receiveThroughLink(ctx, handle, intakeId, deps, onProgress) {
@@ -13078,12 +13415,11 @@ async function receiveThroughLink(ctx, handle, intakeId, deps, onProgress) {
     );
   }
   await deps.elicitationDone?.(intakeId).catch(() => void 0);
-  const dir = await (0, import_promises5.mkdtemp)((0, import_node_path6.join)((0, import_node_os5.tmpdir)(), "seal-mcp-request-"));
+  const dir = await (0, import_promises5.mkdtemp)((0, import_node_path7.join)((0, import_node_os5.tmpdir)(), "seal-mcp-request-"));
   const opened = await sealOpen(ctx, { url: `${deps.publicHost}${sharePath}`, mode: "file", dir, onProgress });
   if (!("files" in opened)) throw new ToolError("internal_inconsistency", "seal_open mode=file returned no files");
   ctx.requests?.delete(handle);
-  appendAudit(ctx, "seal_request", handle, "link");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_request", handle, "link");
   return {
     handle,
     source: "link",
@@ -13096,6 +13432,7 @@ async function sealRevoke(ctx, input) {
   if (!isValidHandle(input.handle)) {
     throw new ToolError("handle_invalid", `handle does not match contract pattern: ${input.handle}`);
   }
+  await ctx.update(() => false);
   const entry = lookupHandle(ctx, input.handle);
   const now = (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   if (entry.revoked_at) {
@@ -13130,16 +13467,18 @@ async function sealRevoke(ctx, input) {
       err2
     );
   }
-  entry.revoked_at = now;
-  appendAudit(ctx, "seal_revoke", input.handle, entry.mode);
-  await ctx.persist();
+  await ctx.update((state) => {
+    state.handles[input.handle] = { ...entry, revoked_at: now };
+    state.audit.push(auditEntry(ctx, "seal_revoke", input.handle, entry.mode));
+  });
   return { revoked: true, revokedAt: now };
 }
 
 // src/tools/share.ts
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_promises9 = require("fs/promises");
-var import_node_path9 = require("path");
+var import_node_os8 = require("os");
+var import_node_path10 = require("path");
 
 // ../../contracts/limits.json
 var limits_default2 = {
@@ -13166,14 +13505,16 @@ var limits_default2 = {
     INTAKE_TTL_DEFAULT_SECONDS: 900,
     INTAKE_TTL_MAX_SECONDS: 86400,
     INTAKE_WAIT_MAX_SECONDS: 25,
-    PAYMENT_WAIT_MAX_SECONDS: 82800
+    PAYMENT_WAIT_MAX_SECONDS: 82800,
+    ADDRESS_PROOF_TTL_SECONDS: 300,
+    INBOX_MAX_ITEMS: 200
   }
 };
 
 // src/handoff.ts
 var import_promises6 = require("fs/promises");
 var import_node_os6 = require("os");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var ONE_HOUR_MS = 36e5;
 var HandoffBothChannelsFailedError = class extends Error {
   code = "handoff_both_channels_failed";
@@ -13189,10 +13530,10 @@ var HandoffBothChannelsFailedError = class extends Error {
 function handoffDir(deps) {
   const xdg = process.env.XDG_RUNTIME_DIR;
   const base = deps.tmpdirOverride ?? (xdg && xdg.length > 0 ? xdg : (0, import_node_os6.tmpdir)());
-  return (0, import_node_path7.join)(base, "seal-mcp");
+  return (0, import_node_path8.join)(base, "seal-mcp");
 }
 function handoffPath(deps, handle) {
-  return (0, import_node_path7.join)(handoffDir(deps), `handoff-${handle}.txt`);
+  return (0, import_node_path8.join)(handoffDir(deps), `handoff-${handle}.txt`);
 }
 async function writeClipboard(text) {
   const mod = await import("clipboardy");
@@ -13259,10 +13600,10 @@ async function performHandoff(payload, deps = {}) {
 }
 
 // src/zip.ts
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_node_os7 = require("os");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 var import_node_stream = require("stream");
 var import_promises8 = require("stream/promises");
 var ZIP32_MAX_BYTES = 4294967295;
@@ -13270,16 +13611,16 @@ async function collectFiles(dir) {
   const found = [];
   const walk = async (current) => {
     for (const dirent of await (0, import_promises7.readdir)(current, { withFileTypes: true })) {
-      const abs = (0, import_node_path8.join)(current, dirent.name);
+      const abs = (0, import_node_path9.join)(current, dirent.name);
       if (dirent.isDirectory()) await walk(abs);
-      else if (dirent.isFile()) found.push({ rel: (0, import_node_path8.relative)(dir, abs).split(import_node_path8.sep).join("/"), abs });
+      else if (dirent.isFile()) found.push({ rel: (0, import_node_path9.relative)(dir, abs).split(import_node_path9.sep).join("/"), abs });
     }
   };
   await walk(dir);
   found.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
   return Promise.all(
     found.map(async ({ rel, abs }) => {
-      const file = new File([await (0, import_node_fs4.openAsBlob)(abs)], (0, import_node_path8.basename)(abs));
+      const file = new File([await (0, import_node_fs5.openAsBlob)(abs)], (0, import_node_path9.basename)(abs));
       return Object.defineProperty(file, "webkitRelativePath", { value: rel });
     })
   );
@@ -13289,19 +13630,19 @@ async function planFolderArchive(dir) {
   if (files.length === 0) {
     throw new Error(`directory contains no regular files: ${dir}`);
   }
-  const folderName = (0, import_node_path8.basename)((0, import_node_path8.resolve)(dir)) || "folder";
+  const folderName = (0, import_node_path9.basename)((0, import_node_path9.resolve)(dir)) || "folder";
   const size = estimateZipSize({ files, folderName });
   if (size > ZIP32_MAX_BYTES) {
     throw new Error(`the folder's archive would be ${size} bytes, over the ZIP limit of ${ZIP32_MAX_BYTES}`);
   }
   const write = async () => {
-    const tempDir = await (0, import_promises7.mkdtemp)((0, import_node_path8.join)((0, import_node_os7.tmpdir)(), "seal-mcp-zip-"));
+    const tempDir = await (0, import_promises7.mkdtemp)((0, import_node_path9.join)((0, import_node_os7.tmpdir)(), "seal-mcp-zip-"));
     const cleanup = () => (0, import_promises7.rm)(tempDir, { recursive: true, force: true });
-    const path = (0, import_node_path8.join)(tempDir, `${folderName}.zip`);
+    const path = (0, import_node_path9.join)(tempDir, `${folderName}.zip`);
     try {
       await (0, import_promises8.pipeline)(
         import_node_stream.Readable.fromWeb(createZipStream2({ files, folderName })),
-        (0, import_node_fs4.createWriteStream)(path, { mode: 384 })
+        (0, import_node_fs5.createWriteStream)(path, { mode: 384 })
       );
       const written = (await (0, import_promises7.stat)(path)).size;
       if (written !== size) {
@@ -13393,31 +13734,46 @@ var FORWARD_MAX_READS_FORCED = 1;
 function nowIso2(ctx) {
   return (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
 }
-async function persistBestEffort(ctx) {
+function journal(ctx, handle, op) {
+  return ctx.update((state) => {
+    state.pending[handle] = op;
+  });
+}
+function dropJournal(ctx, handle) {
+  return ctx.update((state) => {
+    delete state.pending[handle];
+  });
+}
+function complete(ctx, handle, entry) {
+  return ctx.update((state) => {
+    insertHandle(state, handle, entry);
+    state.audit.push(auditEntry(ctx, "seal_share", handle, entry.mode));
+    delete state.pending[handle];
+  });
+}
+async function bestEffort(write) {
   try {
-    await ctx.persist();
+    await write;
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
-    process.stderr.write(`[seal-mcp] warn: journal persist failed during compensation: ${msg}
+    process.stderr.write(`[seal-mcp] warn: journal write failed: ${msg}
 `);
   }
 }
-async function compensateRevoke(ctx, handle) {
-  const op = ctx.state.pending[handle];
-  const sealId = op?.seal_id;
-  if (!op || sealId === void 0) {
+async function compensateRevoke(ctx, handle, op) {
+  const sealId = op.seal_id;
+  if (sealId === void 0) {
     return "no live seal to revoke";
   }
   try {
     await ctx.client.revoke(sealId, op.owner_token_b64);
-    delete ctx.state.pending[handle];
-    await persistBestEffort(ctx);
+    await bestEffort(dropJournal(ctx, handle));
     return "seal auto-revoked";
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     op.step = "compensating";
     op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso2(ctx) };
-    await persistBestEffort(ctx);
+    await bestEffort(journal(ctx, handle, op));
     return `auto-revoke FAILED (${msg}) \u2014 the orphaned seal stays live until its TTL (${op.expires_at}); revoke is journaled and will be retried at next server start`;
   }
 }
@@ -13442,7 +13798,7 @@ async function openSource(path, mime, requestedTier) {
   } catch (err2) {
     throw failed("unable to open", err2);
   }
-  let name = (0, import_node_path9.basename)(path);
+  let name = (0, import_node_path10.basename)(path);
   let source = path;
   let cleanup = async () => void 0;
   let tier;
@@ -13468,7 +13824,7 @@ async function openSource(path, mime, requestedTier) {
   }
   let fileBlob;
   try {
-    fileBlob = await (0, import_node_fs5.openAsBlob)(source);
+    fileBlob = await (0, import_node_fs6.openAsBlob)(source);
   } catch (err2) {
     await cleanup();
     throw failed("unable to open", err2);
@@ -13589,13 +13945,14 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
     // backend this seal is actually created on — recovery refuses to
     // "revoke" against a different backend whose 404 would be misread
     // as success.
-    backend_url: ctx.client.baseUrl
+    backend_url: ctx.client.baseUrl,
+    // SPEC-ADDRESS F1 §4: another MCP host starting now must not recover
+    // (revoke) this upload while it runs.
+    owner: { pid: process.pid, hostname: (0, import_node_os8.hostname)() }
   };
-  ctx.state.pending[handle] = op;
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    delete ctx.state.pending[handle];
     throw new ToolError(
       "state_persist_failed",
       `refusing to upload: could not journal the operation before its first remote effect: ${err2 instanceof Error ? err2.message : String(err2)}`,
@@ -13616,7 +13973,7 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
       // `uploaded` checkpoint after this call is the durability gate.
       onSealCreated: async (sealId) => {
         op.seal_id = sealId;
-        await persistBestEffort(ctx);
+        await bestEffort(journal(ctx, handle, op));
       }
     });
   } catch (err2) {
@@ -13625,15 +13982,14 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
       return awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, expiresAt, session });
     }
     if (op.seal_id !== void 0) {
-      const outcome = await compensateRevoke(ctx, handle);
+      const outcome = await compensateRevoke(ctx, handle, op);
       throw new ToolError(
         "upload_failed",
         `seal upload failed after the seal was created: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
         err2
       );
     }
-    delete ctx.state.pending[handle];
-    await persistBestEffort(ctx);
+    await bestEffort(dropJournal(ctx, handle));
     throw new ToolError(
       "upload_failed",
       `seal upload failed: ${err2 instanceof Error ? err2.message : String(err2)}`,
@@ -13646,9 +14002,9 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   op.seal_id = uploaded.sealId;
   op.step = "uploaded";
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "state_persist_failed",
       `could not journal the live seal after upload: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13661,7 +14017,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     shareBlobBytes = await encryptShareBlob(fileKeysB64, shareLinkKey, void 0);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "share_blob_failed",
       `share blob encryption failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13669,17 +14025,6 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     );
   }
   const shareBlobB64 = bytesToBase64url(shareBlobBytes);
-  let shareCode;
-  try {
-    shareCode = await ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64);
-  } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
-    throw new ToolError(
-      "share_link_failed",
-      `POST /seal/${uploaded.sealId}/share failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
-      err2
-    );
-  }
   let fragment;
   if (mode === "forward") {
     if (recipientPub === null) {
@@ -13691,7 +14036,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     try {
       fragment = await buildTargetedFragment(shareLinkKey, recipientPub, uploaded.sealId);
     } catch (err2) {
-      const outcome = await compensateRevoke(ctx, handle);
+      const outcome = await compensateRevoke(ctx, handle, op);
       const message = err2 instanceof Error ? err2.message : String(err2);
       if (message.includes("non-contributory")) {
         throw new ToolError(
@@ -13709,10 +14054,33 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   } else {
     fragment = bytesToBase64url(shareLinkKey);
   }
+  if (mode === "forward") await journalDelivering(ctx, handle, op);
+  let shareCode;
+  try {
+    shareCode = mode === "forward" && recipientPub !== null ? await withAddressProof(
+      ctx.client,
+      ctx.identity.secret,
+      void 0,
+      (sender) => ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64, {
+        to: bytesToBase64url(recipientPub),
+        fragment,
+        label: deps.label?.slice(0, 80),
+        sender
+      })
+    ) : await ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64);
+  } catch (err2) {
+    const outcome = await compensateRevoke(ctx, handle, op);
+    const appCode = err2 instanceof BackendError ? err2.appCode : void 0;
+    throw new ToolError(
+      appCode === "intake.inbox_full" ? "inbox_full" : appCode === "intake.proof_required" ? "inbox_proof_failed" : "share_link_failed",
+      `POST /seal/${uploaded.sealId}/share failed: ${messageOf3(err2)} (${outcome})`,
+      err2
+    );
+  }
   const host = resolvePublicHost(deps.publicHost);
   const shareUrl = `${host}/s/${uploaded.sealId}/${shareCode}#${fragment}`;
   if (mode === "forward") {
-    insertHandle(ctx, handle, {
+    await complete(ctx, handle, {
       seal_id: uploaded.sealId,
       owner_token_b64: ownerTokenB64,
       created_at: nowIso2(ctx),
@@ -13720,41 +14088,29 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
       expires_at: expiresAt,
       backend_url: ctx.client.baseUrl
     });
-    appendAudit(ctx, "seal_share", handle, mode);
-    delete ctx.state.pending[handle];
-    await ctx.persist();
     return {
       handle,
       shareUrl,
       expiresAt,
       maxReads: FORWARD_MAX_READS_FORCED,
-      mode: "forward"
+      mode: "forward",
+      delivered: true
     };
   }
-  op.step = "delivering";
   op.handoff_channels_attempted = deps.handoff?.disableClipboard ? ["file"] : ["clipboard", "file"];
-  try {
-    await ctx.persist();
-  } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
-    throw new ToolError(
-      "state_persist_failed",
-      `could not journal the delivery attempt before handing off the URL: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
-      err2
-    );
-  }
+  await journalDelivering(ctx, handle, op);
   let handoff;
   try {
     handoff = await performHandoff({ handle, shareUrl, expireMs }, deps.handoff);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "handoff_both_channels_failed",
       `both clipboard and file handoff channels failed \u2014 ${outcome}`,
       err2
     );
   }
-  insertHandle(ctx, handle, {
+  await complete(ctx, handle, {
     seal_id: uploaded.sealId,
     owner_token_b64: ownerTokenB64,
     created_at: nowIso2(ctx),
@@ -13763,9 +14119,6 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     handoff_channel: handoff.channel,
     backend_url: ctx.client.baseUrl
   });
-  appendAudit(ctx, "seal_share", handle, mode);
-  delete ctx.state.pending[handle];
-  await ctx.persist();
   const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
@@ -13780,16 +14133,29 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
 function messageOf3(err2) {
   return err2 instanceof Error ? err2.message : String(err2);
 }
+async function journalDelivering(ctx, handle, op) {
+  op.step = "delivering";
+  try {
+    await journal(ctx, handle, op);
+  } catch (err2) {
+    const outcome = await compensateRevoke(ctx, handle, op);
+    throw new ToolError(
+      "state_persist_failed",
+      `could not journal the delivery attempt before the link could reach anyone: ${messageOf3(err2)} (${outcome})`,
+      err2
+    );
+  }
+}
 async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, session }) {
   const tier = prepared.tier;
   const sealId = op.seal_id;
   op.step = "awaiting_payment";
-  await persistBestEffort(ctx);
+  await bestEffort(journal(ctx, handle, op));
   let paymentUrl;
   try {
     paymentUrl = await ctx.client.createCheckout(sealId, ownerTokenB64, tier);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError("payment_failed", `POST /billing/checkout failed: ${messageOf3(err2)} (${outcome})`, err2);
   }
   const deadline = paymentDeadline(op.expires_at);
@@ -13799,7 +14165,7 @@ async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, se
     clearTimeout(timer);
     ctx.payments?.delete(handle);
     await prepared.cleanup();
-    throw new ToolError(code, `${why} (${await compensateRevoke(ctx, handle)})`);
+    throw new ToolError(code, `${why} (${await compensateRevoke(ctx, handle, op)})`);
   };
   const finish = async (onProgress) => {
     if (running) throw new ToolError("payment_invalid", `share ${handle} is already being finished`);
@@ -13871,7 +14237,8 @@ function shareOutputToWire(out) {
       share_url: out.shareUrl,
       expires_at: out.expiresAt,
       max_reads: out.maxReads,
-      mode: out.mode
+      mode: out.mode,
+      delivered: out.delivered
     };
   }
   const wire = {
@@ -13938,6 +14305,18 @@ function openOutputToWire(out) {
     expires_at: out.expiresAt
   };
 }
+function inboxOutputToWire(out) {
+  return {
+    address_emoji: out.addressEmoji,
+    items: out.items.map((item) => ({
+      handle: item.handle,
+      from: item.from,
+      label: item.label,
+      received_at: item.receivedAt,
+      expires_at: item.expiresAt
+    }))
+  };
+}
 function listOutputToWire(out) {
   return {
     entries: out.entries.map((entry) => ({
@@ -13968,7 +14347,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.5";
+var SERVER_VERSION = "0.4.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -13976,6 +14355,7 @@ var toolMeta = (name) => {
 var SHARE_INPUT = seal_mcp_v1_default.tools.seal_share.input.properties;
 var REQUEST_INPUT = seal_mcp_v1_default.tools.seal_request.input.properties;
 var OPEN_INPUT = seal_mcp_v1_default.tools.seal_open.input.properties;
+var INBOX_INPUT = seal_mcp_v1_default.tools.seal_inbox.input.properties;
 var PRO_SECRET_USE = seal_mcp_v1_default.pro_tools.seal_pro_secret_use;
 var PRO_SECRET_REQUEST = seal_mcp_v1_default.pro_tools.seal_pro_secret_request;
 var PRO_FILE_GET = seal_mcp_v1_default.pro_tools.seal_pro_file_get;
@@ -13995,44 +14375,33 @@ function progressReporter(extra) {
 }
 async function createServer(options) {
   logEngineToStderr();
-  let view;
-  let identity;
-  let lock = null;
   const client = new SealApi({ baseUrl: resolveBackendUrl(options.backendBaseUrl) });
   const disk = options.state;
+  let view;
+  const update = async (mutate) => {
+    if (disk === null) await mutate(view);
+    else view = await updateState(disk.passphrase, disk.path, mutate);
+  };
+  let identity;
   if (disk === null) {
     identity = await generateIdentity();
     view = createEmptyState(identityToFields(identity));
   } else {
-    const held = await acquireStateLock((0, import_node_path10.dirname)(disk.path));
-    lock = held;
-    try {
-      view = await loadState(disk.passphrase, disk.path);
-      identity = await loadIdentity(view.identity);
-      const { changed } = await recoverPendingOperations(view, client);
-      if (changed) {
-        await saveState(view, disk.passphrase, disk.path);
-      }
-    } catch (err2) {
-      await held.release();
-      throw err2;
-    }
+    view = await updateState(disk.passphrase, disk.path, async (state) => (await recoverPendingOperations(state, client)).changed);
+    identity = await loadIdentity(view.identity);
   }
   const publicHost = resolvePublicHost(options.publicHost);
-  let persistChain = Promise.resolve();
-  const persist = () => {
-    if (disk === null) return Promise.resolve();
-    persistChain = persistChain.catch(() => void 0).then(() => saveState(view, disk.passphrase, disk.path));
-    return persistChain;
-  };
   const ctx = {
-    state: view,
+    get state() {
+      return view;
+    },
     identity,
     client,
-    persist,
+    update,
     ephemeral: disk === null,
     requests: /* @__PURE__ */ new Map(),
-    payments: /* @__PURE__ */ new Map()
+    payments: /* @__PURE__ */ new Map(),
+    inbox: { items: /* @__PURE__ */ new Map(), version: null }
   };
   const mcp = new import_mcp.McpServer(
     { name: "sealnet-mcp", version: SERVER_VERSION },
@@ -14079,6 +14448,7 @@ async function createServer(options) {
           },
           {
             publicHost,
+            label: client2.getClientVersion()?.name,
             handoff: disableClipboard ? { disableClipboard: true } : void 0,
             elicitUrl: urlMode ? async (params) => (await client2.elicitInput({ mode: "url", ...params })).action : void 0,
             elicitationDone: urlMode ? (id) => client2.createElicitationCompletionNotifier(id)() : void 0
@@ -14132,19 +14502,37 @@ async function createServer(options) {
     {
       ...toolMeta("seal_open"),
       inputSchema: {
-        url: external_exports.string().url().describe(OPEN_INPUT.url.description),
+        // Exactly one of `url` and `item`: the handler refuses anything else (contract `one_of`).
+        url: external_exports.string().url().optional().describe(OPEN_INPUT.url.description),
+        item: external_exports.string().regex(/^in_/).optional().describe(OPEN_INPUT.item.description),
         mode: external_exports.enum(["metadata", "inline", "file"]).default("metadata").describe(OPEN_INPUT.mode.description),
         dir: external_exports.string().optional().describe(OPEN_INPUT.dir.description)
       }
     },
     async (args, extra) => {
       const result = await wrapTool(
-        () => sealOpen(ctx, { url: args.url, mode: args.mode, dir: args.dir, onProgress: progressReporter(extra) }),
+        () => sealOpen(ctx, {
+          url: args.url,
+          item: args.item,
+          mode: args.mode,
+          dir: args.dir,
+          onProgress: progressReporter(extra)
+        }),
         openOutputToWire
       );
       return result;
     }
   );
+  mcp.registerTool(
+    "seal_inbox",
+    {
+      ...toolMeta("seal_inbox"),
+      inputSchema: {
+        wait: external_exports.number().int().min(0).max(300).default(0).describe(INBOX_INPUT.wait.description)
+      }
+    },
+    async (args) => wrapTool(() => sealInbox(ctx, { wait: args.wait }), inboxOutputToWire)
+  );
   mcp.registerTool(
     "seal_list",
     {
@@ -14232,18 +14620,12 @@ async function createServer(options) {
     );
   }
   const transport = new import_stdio.StdioServerTransport();
-  try {
-    await mcp.connect(transport);
-  } catch (err2) {
-    await lock?.release();
-    throw err2;
-  }
+  await mcp.connect(transport);
   const close = async () => {
     try {
       await mcp.close();
     } finally {
       await transport.close().catch(() => void 0);
-      await lock?.release();
     }
   };
   return { mcp, transport, close };
@@ -14257,7 +14639,7 @@ async function wrapTool(fn, toWire) {
       structuredContent: wire
     };
   } catch (err2) {
-    if (err2 instanceof ToolError) {
+    if (err2 instanceof ToolError || err2 instanceof StateBusyError) {
       return {
         isError: true,
         content: [
@@ -14279,7 +14661,6 @@ async function wrapTool(fn, toWire) {
 // src/cli.ts
 var PROGRAM_NAME = "sealnet-mcp";
 var DESCRIPTION = "MCP server for SEAL \u2014 share files via Cursor / Claude Desktop without handing the model the share link. Handoff mode (default) delivers the link out-of-band (clipboard / 0o600 file); the model only gets an opaque handle.";
-var MIN_PASSPHRASE_LEN = 8;
 function logStderr(line) {
   process.stderr.write(`${line}
 `);
@@ -14288,118 +14669,33 @@ function logStdout(line) {
   process.stdout.write(`${line}
 `);
 }
-async function pathExists(p) {
-  try {
-    await (0, import_promises10.stat)(p);
-    return true;
-  } catch {
-    return false;
-  }
+async function agentKey(path) {
+  return await readSeed(path.dir) ?? (await openAgentState(path)).root;
 }
 async function runInit(opts) {
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  if (!opts.force && await pathExists(path.statePath)) {
+  if (opts.force) await withStateLock(path.dir, () => import_node_fs7.promises.rm(path.statePath, { force: true }));
+  const opened = await openAgentState(path);
+  if (!opened.created) {
     logStderr(`${PROGRAM_NAME} init: state file already exists at ${path.statePath}`);
-    logStderr("Re-run with --force to overwrite (you will lose existing handles + identity).");
+    logStderr("Re-run with --force to replace it with an empty one (its handles are lost; the address stays).");
     process.exit(2);
   }
-  const fromEnv = process.env[PASSPHRASE_ENV_VAR];
-  let passphrase;
-  if (fromEnv !== void 0 && fromEnv.length > 0) {
-    passphrase = fromEnv;
-    logStderr(
-      `${PROGRAM_NAME} init: using passphrase from ${PASSPHRASE_ENV_VAR} (will also save to OS keychain).`
-    );
-  } else {
-    passphrase = await promptHiddenPassphrase("Choose a passphrase (will not echo): ");
-    if (passphrase.length < MIN_PASSPHRASE_LEN) {
-      throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LEN} characters.`);
-    }
-    const confirm = await promptHiddenPassphrase("Confirm passphrase: ");
-    if (confirm !== passphrase) {
-      throw new Error("Passphrases do not match.");
-    }
-  }
-  logStderr(`${PROGRAM_NAME} init: generating X25519 identity ...`);
-  const identity = await generateIdentity();
-  const identityFields = identityToFields(identity);
-  const state = createEmptyState(identityFields);
-  logStderr(`${PROGRAM_NAME} init: writing encrypted state to ${path.statePath} ...`);
-  const lock = await acquireStateLock(path.dir);
-  let keychainStored = false;
-  try {
-    if (!opts.force && await pathExists(path.statePath)) {
-      logStderr(`${PROGRAM_NAME} init: state file already exists at ${path.statePath}`);
-      logStderr("Re-run with --force to overwrite (you will lose existing handles + identity).");
-      process.exit(2);
-    }
-    await saveState(state, passphrase, path.statePath);
-    try {
-      await setKeychainPassphrase(passphrase);
-      keychainStored = true;
-      logStderr(
-        `${PROGRAM_NAME} init: passphrase stored in OS keychain (service=${KEYCHAIN_SERVICE} account=${KEYCHAIN_ACCOUNT}).`
-      );
-    } catch (err2) {
-      if (err2 instanceof KeytarUnavailableError) {
-        logStderr(`${PROGRAM_NAME} init: warning: ${err2.message}`);
-        logStderr(
-          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until the OS keychain works.`
-        );
-      } else {
-        throw err2;
-      }
-    }
-  } finally {
-    await lock.release();
-  }
+  const identity = await identityFromSeed(opened.root.seed);
   logStdout(`${PROGRAM_NAME} init: ready.`);
-  logStdout(`  state.json:        ${path.statePath}`);
-  logStdout(`  passphrase source: ${keychainStored ? "OS keychain" : `${PASSPHRASE_ENV_VAR} env`}`);
-  logStdout(`  pubkey (base64):   ${identityFields.x25519_public_b64}`);
+  logStdout(`  state.json:  ${path.statePath}`);
+  logStdout(`  key source:  ${opened.root.source}`);
+  logStdout(`  address:     ${Buffer.from(identity.public).toString("base64url")}`);
   logStdout("");
-  logStdout(
-    "Share the pubkey with senders so they can target SEALs to your MCP server (see `seal send --to <pubkey>` from `seal-cli`)."
-  );
-}
-async function createStateWithoutPrompt(path) {
-  const resolved = await passphraseForNewState();
-  if (resolved === null) return null;
-  const lock = await acquireStateLock(path.dir);
-  try {
-    if (await pathExists(path.statePath)) return void 0;
-    if (resolved.fresh) await setKeychainPassphrase(resolved.passphrase);
-    const identity = await generateIdentity();
-    await saveState(createEmptyState(identityToFields(identity)), resolved.passphrase, path.statePath);
-  } finally {
-    await lock.release();
-  }
-  logStderr(`${PROGRAM_NAME} serve: first start, state created at ${path.statePath}`);
-  return resolved;
+  logStdout("Senders use the address to deliver a link only this agent opens (`seal send --to <address>`).");
 }
 async function stateForServe(path) {
-  if (!await pathExists(path.statePath)) {
-    const created = await createStateWithoutPrompt(path);
-    if (created !== void 0) return created;
-  }
-  const resolved = await resolvePassphraseFromStores();
-  if (resolved === null) {
-    throw new PassphraseNotFoundError();
-  }
-  if (resolved.source === "env") {
-    logStderr(
-      `${PROGRAM_NAME} serve: warning: passphrase read from ${PASSPHRASE_ENV_VAR}. Environment variables are readable via /proc/<pid>/environ on Linux and the process listing on Windows. Prefer the OS keychain (run \`${PROGRAM_NAME} init\`).`
-    );
-  }
+  let opened;
   try {
-    const view = await loadState(resolved.passphrase, path.statePath);
-    await loadIdentity(view.identity);
+    opened = await openAgentState(path);
   } catch (err2) {
-    if (err2 instanceof StatePassphraseInvalid) {
-      logStderr(`${PROGRAM_NAME} serve: passphrase rejected (AES-256-GCM tag check failed).`);
-      logStderr(
-        `If you reset your OS keychain, re-run \`${PROGRAM_NAME} init --force\` (you will lose existing handles).`
-      );
+    if (err2 instanceof IdentityConflictError) {
+      logStderr(`${PROGRAM_NAME} serve: ${err2.message}`);
       process.exit(3);
     }
     if (err2 instanceof StateCorrupt) {
@@ -14408,29 +14704,27 @@ async function stateForServe(path) {
     }
     throw err2;
   }
-  return resolved;
+  if (opened.created) logStderr(`${PROGRAM_NAME} serve: first start, state created at ${path.statePath}`);
+  if (opened.moved !== null) logStderr(`${PROGRAM_NAME} serve: moved the 0.2 state under the agent's key (${opened.root.source})`);
+  if (opened.moved === "env") {
+    logStderr(
+      `${PROGRAM_NAME} serve: ${PASSPHRASE_ENV_VAR} is no longer used; to move this agent to another machine, set ${SEED_ENV_VAR} there (\`${PROGRAM_NAME} seed --force\` prints it).`
+    );
+  }
+  return opened;
 }
 async function runServe(opts) {
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  const resolved = opts.ephemeral ? null : await stateForServe(path);
+  const opened = opts.ephemeral || process.env[EPHEMERAL_ENV_VAR] === "1" ? null : await stateForServe(path);
   logStderr(
-    resolved === null ? `${PROGRAM_NAME} serve: ephemeral \u2014 identity and handles live in memory until exit, nothing on disk` : `${PROGRAM_NAME} serve: state OK at ${path.statePath} (passphrase=${resolved.source})`
+    opened === null ? `${PROGRAM_NAME} serve: ephemeral \u2014 a new key, identity and handles live in memory until exit, nothing on disk` : `${PROGRAM_NAME} serve: state OK at ${path.statePath} (key=${opened.root.source})`
   );
   logStderr(`${PROGRAM_NAME} serve: starting stdio MCP server ...`);
-  let handle;
-  try {
-    handle = await createServer({
-      state: resolved === null ? null : { path: path.statePath, passphrase: resolved.passphrase },
-      backendBaseUrl: opts.backendUrl,
-      publicHost: opts.publicHost
-    });
-  } catch (err2) {
-    if (err2 instanceof StateLockedError) {
-      logStderr(`${PROGRAM_NAME} serve: ${err2.message}`);
-      process.exit(5);
-    }
-    throw err2;
-  }
+  const handle = await createServer({
+    state: opened === null ? null : { path: path.statePath, passphrase: opened.passphrase },
+    backendBaseUrl: opts.backendUrl,
+    publicHost: opts.publicHost
+  });
   const shutdown = async (signal) => {
     logStderr(`${PROGRAM_NAME} serve: received ${signal}, shutting down ...`);
     try {
@@ -14449,28 +14743,39 @@ async function runServe(opts) {
   });
 }
 async function runPubkey(opts) {
-  const path = resolveStateDir({ cliFlag: opts.stateDir });
-  if (!await pathExists(path.statePath)) {
-    throw new Error(`No state found at ${path.statePath}. Run \`${PROGRAM_NAME} init\` first.`);
+  const root = await agentKey(resolveStateDir({ cliFlag: opts.stateDir }));
+  const { public: address } = await identityFromSeed(root.seed);
+  logStdout(Buffer.from(address).toString("base64url"));
+  logStderr(`${keyEmoji(address)}  key: ${root.source}`);
+}
+async function runSeed(opts) {
+  if (!opts.force) {
+    throw new Error(`seed prints the agent's secret key \u2014 re-run with --force to confirm, to set ${SEED_ENV_VAR} elsewhere.`);
   }
-  const resolved = await resolvePassphraseFromStores();
-  if (resolved === null) throw new PassphraseNotFoundError();
-  const view = await loadState(resolved.passphrase, path.statePath);
-  logStdout(view.identity.x25519_public_b64);
+  const root = await agentKey(resolveStateDir({ cliFlag: opts.stateDir }));
+  logStderr(
+    `${PROGRAM_NAME} seed: this is the agent's secret key. Whoever holds it opens the links sent to this agent; put it only in ${SEED_ENV_VAR} of a machine you control.`
+  );
+  logStdout(Buffer.from(root.seed).toString("base64url"));
+}
+async function perms(file) {
+  return (0, import_promises10.stat)(file).then(
+    (st) => (st.mode & 511).toString(8).padStart(3, "0"),
+    () => null
+  );
 }
 async function runDoctor(opts) {
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  const envPass = process.env[PASSPHRASE_ENV_VAR];
-  let stateExists = false;
-  let statePerms = null;
-  let stateOwnerUid = null;
+  const seedFile = (0, import_node_path11.join)(path.dir, SEED_FILE_NAME);
+  let seedSource = null;
+  let seedError = null;
   try {
-    const st = await (0, import_promises10.stat)(path.statePath);
-    stateExists = true;
-    statePerms = (st.mode & 511).toString(8).padStart(3, "0");
-    stateOwnerUid = typeof st.uid === "number" ? st.uid : null;
-  } catch {
+    seedSource = (await readSeed(path.dir))?.source ?? null;
+  } catch (err2) {
+    seedError = err2 instanceof Error ? err2.message : String(err2);
   }
+  const statePerms = await perms(path.statePath);
+  const seedPerms = await perms(seedFile);
   const kc = await probeKeychain();
   const lockProbe = await probeStateLock(path.dir);
   const client = new SealApi({ baseUrl: resolveBackendUrl(opts.backendUrl) });
@@ -14491,103 +14796,101 @@ async function runDoctor(opts) {
     backendReachable = false;
     backendError = err2 instanceof Error ? err2.message : String(err2);
   }
-  const report = {
-    state_path: path.statePath,
-    state_exists: stateExists,
-    state_perms_octal: statePerms,
-    state_owner_uid: stateOwnerUid,
-    lock_held: lockProbe.held,
-    lock_holder_pid: lockProbe.holder?.pid ?? null,
-    lock_stale: lockProbe.stale,
-    keychain_available: kc.available,
-    keychain_has_entry: kc.hasEntry,
-    env_passphrase_set: envPass !== void 0 && envPass.length > 0,
-    backend_url: client.baseUrl,
-    public_host: resolvePublicHost(opts.publicHost),
-    backend_reachable: backendReachable,
-    backend_status: backendStatus,
-    backend_error: backendError,
-    platform: process.platform,
-    node_version: process.version
-  };
-  logStdout(JSON.stringify(report, null, 2));
-  if (!stateExists) {
-    logStderr(`hint: no state.json yet \u2014 the first \`${PROGRAM_NAME} serve\` creates it.`);
-  } else if (statePerms !== "600") {
-    logStderr(`hint: state.json perms are ${statePerms}, expected 600. Run \`chmod 600 \u2026\`.`);
+  logStdout(
+    JSON.stringify(
+      {
+        state_path: path.statePath,
+        state_exists: statePerms !== null,
+        state_perms_octal: statePerms,
+        seed_source: seedSource,
+        seed_error: seedError,
+        seed_file_perms_octal: seedPerms,
+        keychain_available: kc.available,
+        keychain_has_seed: kc.hasSeed,
+        env_seed_set: Boolean(process.env[SEED_ENV_VAR]),
+        env_passphrase_set: Boolean(process.env[PASSPHRASE_ENV_VAR]),
+        lock_held: lockProbe.held,
+        lock_holder_pid: lockProbe.holder?.pid ?? null,
+        lock_stale: lockProbe.stale,
+        backend_url: client.baseUrl,
+        public_host: resolvePublicHost(opts.publicHost),
+        backend_reachable: backendReachable,
+        backend_status: backendStatus,
+        backend_error: backendError,
+        platform: process.platform,
+        node_version: process.version
+      },
+      null,
+      2
+    )
+  );
+  if (seedError !== null) logStderr(`hint: ${seedError}`);
+  else if (seedSource === null) {
+    logStderr(`hint: no agent key yet \u2014 the first \`${PROGRAM_NAME} serve\` makes it (${kc.available ? "in the OS keychain" : seedFile}).`);
   }
-  if (!kc.available) {
-    logStderr(
-      `hint: keychain unavailable. On Linux start a Secret Service (gnome-keyring or KWallet), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
-    );
-  } else if (stateExists && !kc.hasEntry && !report.env_passphrase_set) {
-    logStderr(`hint: keychain has no entry and ${PASSPHRASE_ENV_VAR} is unset \u2014 \`serve\` will fail.`);
+  for (const [file, got] of [[path.statePath, statePerms], [seedFile, seedPerms]]) {
+    if (got !== null && got !== "600") logStderr(`hint: ${file} perms are ${got}, expected 600. Run \`chmod 600 \u2026\`.`);
   }
   if (backendReachable === false) {
     logStderr(`hint: backend ${client.baseUrl} unreachable (${backendError ?? "unknown"}).`);
   }
-  if (lockProbe.held && !lockProbe.stale) {
-    logStderr(
-      `hint: state dir is locked by pid ${lockProbe.holder?.pid ?? "?"} \u2014 a serve instance is running.`
-    );
-  } else if (lockProbe.held && lockProbe.stale) {
-    logStderr("hint: stale state.lock detected (holder dead) \u2014 next serve/init will break it automatically.");
+  if (lockProbe.held && lockProbe.stale) {
+    logStderr("hint: stale state.lock detected (holder dead) \u2014 the next write breaks it automatically.");
   }
 }
 async function runReset(opts) {
   if (!opts.force) {
     throw new Error(
-      "reset is destructive \u2014 re-run with --force to confirm. This wipes state.json AND your keychain passphrase entry."
+      "reset is destructive \u2014 re-run with --force to confirm. This wipes state.json AND the agent's key: its address is lost for good."
     );
   }
   const path = resolveStateDir({ cliFlag: opts.stateDir });
-  const lock = await acquireStateLock(path.dir);
-  let stateDeleted = false;
-  let keychainDeleted = false;
-  try {
-    try {
-      await import_node_fs6.promises.unlink(path.statePath);
-      stateDeleted = true;
-    } catch (err2) {
-      const code = err2.code;
-      if (code !== "ENOENT") {
-        throw err2;
-      }
-    }
-    keychainDeleted = await deleteKeychainPassphrase();
-  } finally {
-    await lock.release();
-  }
+  const result = await withStateLock(path.dir, async () => {
+    let stateDeleted = true;
+    await import_node_fs7.promises.unlink(path.statePath).catch((err2) => {
+      if (err2.code !== "ENOENT") throw err2;
+      stateDeleted = false;
+    });
+    return { stateDeleted, ...await deleteRootSecret(path.dir) };
+  });
   logStdout(
     JSON.stringify(
       {
-        state_deleted: stateDeleted,
-        keychain_deleted: keychainDeleted,
+        state_deleted: result.stateDeleted,
+        seed_file_deleted: result.seedFile,
+        keychain_deleted: result.keychain,
         state_path: path.statePath
       },
       null,
       2
     )
   );
+  logStderr(
+    `${PROGRAM_NAME} reset: the agent's address is gone for good \u2014 links sent to it can no longer be opened, and whoever sends to this agent needs its new address.`
+  );
+  if (process.env[SEED_ENV_VAR]) {
+    logStderr(`${PROGRAM_NAME} reset: ${SEED_ENV_VAR} is still set: the next start uses the key from the environment.`);
+  }
 }
 function buildCli() {
   const program = new import_commander.Command();
   program.name(PROGRAM_NAME).description(DESCRIPTION).version(SERVER_VERSION, "-V, --version", `Print the ${PROGRAM_NAME} version and exit.`);
   program.command("init").description(
-    "Optional setup with a passphrase you choose: generate X25519 identity, store the passphrase in OS keychain, and write encrypted state.json (`serve` does this itself with a random passphrase when there is no state)."
-  ).option("--state-dir <path>", "Override default state directory").option("--force", "Overwrite an existing state.json (DESTRUCTIVE)", false).action(async (opts) => runInit(opts));
+    "Make the agent's key (SEAL_SEED, else the OS keychain, else a 0600 file) and an empty encrypted state.json, without starting the server (`serve` does this itself on its first start)."
+  ).option("--state-dir <path>", "Override default state directory").option("--force", "Replace an existing state.json with an empty one (DESTRUCTIVE; the address stays)", false).action(async (opts) => runInit(opts));
   program.command("serve", { isDefault: true }).description(`Start the stdio MCP server (DEFAULT \u2014 bare \`${PROGRAM_NAME}\` runs this).`).option("--state-dir <path>", "Override default state directory").option("--backend-url <url>", "SEAL backend base URL (overrides SEAL_MCP_BACKEND_URL; default https://api.seal.net)").option(
     "--public-host <url>",
     "Public origin for minted share URLs (overrides SEAL_MCP_PUBLIC_HOST; default https://seal.net). Set BOTH this and --backend-url for self-hosted deployments."
-  ).option("--ephemeral", "Keep identity and handles in memory only; write nothing to disk", false).action(async (opts) => runServe(opts));
+  ).option("--ephemeral", `A new key each start, handles in memory only, nothing on disk (also ${EPHEMERAL_ENV_VAR}=1)`, false).action(async (opts) => runServe(opts));
   program.command("pubkey").description(
-    "Print this server's X25519 public key (base64). Senders use it as the `--to` argument of `seal send` to deliver targeted SEALs."
+    "Print the agent's address, its X25519 public key (base64url), on stdout; its emoji and the key's source on stderr. Senders use it as the `--to` of `seal send` to deliver targeted SEALs."
   ).option("--state-dir <path>", "Override default state directory").action(async (opts) => runPubkey(opts));
+  program.command("seed").description(`Print the agent's secret key, to give another machine the same address through ${SEED_ENV_VAR}.`).option("--state-dir <path>", "Override default state directory").option("--force", "Confirm printing the secret key", false).action(async (opts) => runSeed(opts));
   program.command("doctor").description(
-    "Diagnose keychain availability, state-file permissions, env-var presence, and backend reachability. Prints a JSON report to stdout + hints to stderr."
+    "Diagnose the agent's key, keychain availability, file permissions and backend reachability. Prints a JSON report to stdout + hints to stderr."
   ).option("--state-dir <path>", "Override default state directory").option("--backend-url <url>", "Backend URL to probe").option("--public-host <url>", "Public share-URL origin to report (overrides SEAL_MCP_PUBLIC_HOST)").action(async (opts) => runDoctor(opts));
   program.command("reset").description(
-    "Wipe state.json + keychain passphrase entry. Use only after passphrase loss; destroys all locally-tracked handles and the X25519 identity."
+    "Wipe state.json and the agent's key (seed file and keychain entries): destroys all locally-tracked handles, and the address is lost for good."
   ).option("--state-dir <path>", "Override default state directory").option("--force", "Confirm destructive operation", false).action(async (opts) => runReset(opts));
   return program;
 }