zas-agent 0.10.0 → 0.11.0

package/dist/cli.js

@@ -2,9 +2,9 @@
 import { createRequire as __cr } from "node:module"; const require = __cr(import.meta.url);
 
 // src/cli.ts
-import { realpathSync } from "node:fs";
+import { realpathSync as realpathSync2 } from "node:fs";
 import { createInterface } from "node:readline";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/shared/agent.ts
@@ -25,7 +25,7 @@ async function blake3Hex(data) {
   return blake3(data, 256);
 }
 function hkdf512(ikm, info, length) {
-  return hkdf(sha512, ikm, void 0, new TextEncoder().encode(info), length);
+  return hkdf(sha512, ikm, void 0, typeof info === "string" ? new TextEncoder().encode(info) : info, length);
 }
 function hmacSha256(key, data) {
   return hmac(sha256, key, data);
@@ -162,6 +162,9 @@ function errorFromResponse(status, body) {
   return new ZasError(code, status, raw, retryAfterMs, raw);
 }
 var SENTENCES = {
+  unsafe_endpoint: "Unsafe endpoint configuration ({path}). Use HTTPS; local emulators require ZAS_ALLOW_INSECURE_DEV=1 and an isolated demo-* project with all services on loopback.",
+  identity_permissions: "The secret file is not private: {path}. Restrict it to its owner before retrying.",
+  secret_store_failed: "The OS secret store could not open or save this profile. Unlock the store, or pair again in a new profile on this machine.",
   identity_corrupt: "The agent identity file is damaged: {path}. Restore it, or delete it and pair again.",
   not_paired: "This agent is not paired yet. Run \u201Cnpx -y zas-agent pair\u201D in the terminal.",
   internal: "Something failed inside the agent. Try again.",
@@ -207,6 +210,8 @@ var SENTENCES = {
   feature_disabled: "Agents are not enabled for this account yet.",
   upload_failed: "The upload failed. Try again.",
   oprf_failed: "Zas did not answer correctly while preparing the file. Try again.",
+  invalid_voprf_proof: "Zas could not verify the encryption service response. The file was not sent. Try again later.",
+  invalid_voprf_configuration: "The encryption service key is not configured for this agent. Update the agent configuration before sending.",
   network: "Zas cannot be reached. Try again in a moment.",
   sign_in_failed: "Zas did not accept this agent session. Try again, or pair again.",
   bad_signature: "Zas rejected this agent's signature. Pair it again.",
@@ -219,23 +224,189 @@ function humanSentence(error) {
 }
 
 // src/identity.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync as readFileSync2, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join as join2, resolve } from "node:path";
 import { x25519 } from "@noble/curves/ed25519";
 import { p256 as p2562 } from "@noble/curves/nist.js";
+
+// src/endpoints.ts
+var loopback = (url) => ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+var refuse = (setting) => {
+  throw new ZasError("unsafe_endpoint", 0, setting);
+};
+function validateBase(value, setting) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return refuse(setting);
+  }
+  if (url.username || url.password || url.search || url.hash) return refuse(setting);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback(url) && process.env.ZAS_ALLOW_INSECURE_DEV === "1")) {
+    return refuse(setting);
+  }
+  return url;
+}
+function emulatorBase(setting) {
+  const host = process.env[setting];
+  if (!host) return void 0;
+  const url = validateBase(`http://${host}`, setting);
+  if (!loopback(url) || url.pathname !== "/" || process.env.ZAS_ALLOW_INSECURE_DEV !== "1") return refuse(setting);
+  return url.origin;
+}
+function validateEndpoints(endpoints) {
+  const bases = [
+    validateBase(endpoints.api_base, "api_base / ZAS_API_BASE"),
+    validateBase(endpoints.token_base, "token_base / ZAS_TOKEN_BASE"),
+    validateBase(endpoints.oprf_base, "oprf_base / ZAS_OPRF_BASE")
+  ];
+  const auth = emulatorBase("FIREBASE_AUTH_EMULATOR_HOST");
+  const firestore = emulatorBase("FIRESTORE_EMULATOR_HOST");
+  if ((auth || firestore) && (!auth || !firestore || !/^demo-[a-z0-9-]+$/.test(endpoints.firestore_project) || !bases.every(loopback))) {
+    refuse("Emulators require both loopback emulator hosts, loopback API/token/OPRF bases and a demo-* Firebase project");
+  }
+}
+
+// src/secret-store.ts
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+var SERVICE = "red.zas.agent";
+var SECRET_KEYS = ["x25519_private", "p256_private", "poll_secret", "code"];
+function splitSecrets(value) {
+  const publicData = { ...value };
+  delete publicData.secret_ref;
+  const secrets = {};
+  for (const key of SECRET_KEYS) {
+    if (typeof value[key] === "string") secrets[key] = value[key];
+    delete publicData[key];
+  }
+  if (!secrets.x25519_private || !secrets.p256_private) throw new ZasError("identity_corrupt", 0);
+  return { publicData, secrets };
+}
+function checkedRef(raw) {
+  const ref = raw;
+  if (!ref || !["dpapi", "keychain", "secret-service", "file"].includes(ref.backend) || typeof ref.id !== "string" || !/^[a-f0-9-]{36}$/.test(ref.id)) throw new ZasError("identity_corrupt", 0);
+  if (ref.backend === "dpapi" && process.platform !== "win32" || ref.backend === "keychain" && process.platform !== "darwin" || ref.backend === "file" && process.platform === "win32") throw new ZasError("secret_store_failed", 0);
+  return ref;
+}
+function readPrivateText(path) {
+  let fd;
+  try {
+    if (lstatSync(path).isSymbolicLink()) throw new ZasError("identity_permissions", 0, path);
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const info = fstatSync(fd);
+    if (!info.isFile() || info.nlink !== 1 || process.platform !== "win32" && ((info.mode & 63) !== 0 || info.uid !== process.getuid?.())) {
+      const fix = process.platform === "win32" ? path : `${path}; run chmod 600 -- '${path.replaceAll("'", "'\\''")}'`;
+      throw new ZasError("identity_permissions", 0, fix);
+    }
+    return readFileSync(fd, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function command(file, args, input) {
+  try {
+    return execFileSync(file, args, {
+      input,
+      encoding: "utf8",
+      timeout: 15e3,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: 1024 * 1024
+    }).trim();
+  } catch {
+    throw new ZasError("secret_store_failed", 0);
+  }
+}
+function dpapi(input, decrypt, dir) {
+  const script = `$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.Security; $request=[Console]::In.ReadToEnd() | ConvertFrom-Json; ` + (decrypt ? "" : `$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User; $acl=New-Object Security.AccessControl.DirectorySecurity; $acl.SetOwner($sid); $acl.SetAccessRuleProtection($true,$false); $rule=New-Object Security.AccessControl.FileSystemAccessRule($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow'); $acl.AddAccessRule($rule); [IO.Directory]::SetAccessControl($request.dir,$acl); `) + `$b=[Convert]::FromBase64String($request.data); $out=[Security.Cryptography.ProtectedData]::${decrypt ? "Unprotect" : "Protect"}($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser); [Console]::Out.Write([Convert]::ToBase64String($out))`;
+  return command(
+    join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+    JSON.stringify({ data: input, dir })
+  );
+}
+var secretPath = (dir, ref) => join(dir, `secret-${ref.id}.json`);
+function storeSecrets(dir, secrets) {
+  const id = randomUUID();
+  const encoded = Buffer.from(JSON.stringify(secrets)).toString("base64");
+  let backend;
+  if (process.platform === "win32") {
+    backend = "dpapi";
+    const encrypted = dpapi(encoded, false, dir);
+    writeFileSync(secretPath(dir, { backend, id }), encrypted, { mode: 384, flag: "wx" });
+  } else if (process.platform === "darwin") {
+    backend = "keychain";
+    command("/usr/bin/security", ["-i"], `add-generic-password -a ${id} -s ${SERVICE} -w ${encoded}
+`);
+    if (command("/usr/bin/security", ["find-generic-password", "-a", id, "-s", SERVICE, "-w"]) !== encoded) {
+      throw new ZasError("secret_store_failed", 0);
+    }
+  } else {
+    let available = Boolean(process.env.DBUS_SESSION_BUS_ADDRESS || process.env.DISPLAY);
+    if (available) {
+      try {
+        command("secret-tool", ["store", "--help"]);
+      } catch {
+        available = false;
+      }
+    }
+    backend = available ? "secret-service" : "file";
+    if (available) {
+      command("secret-tool", ["store", "--label=Zas agent", "service", SERVICE, "id", id], encoded);
+      if (command("secret-tool", ["lookup", "service", SERVICE, "id", id]) !== encoded) throw new ZasError("secret_store_failed", 0);
+    } else {
+      writeFileSync(secretPath(dir, { backend, id }), encoded, { mode: 384, flag: "wx" });
+    }
+  }
+  return { backend, id };
+}
+function loadSecrets(dir, raw) {
+  const ref = checkedRef(raw);
+  try {
+    let encoded;
+    if (ref.backend === "keychain") encoded = command("/usr/bin/security", ["find-generic-password", "-a", ref.id, "-s", SERVICE, "-w"]);
+    else if (ref.backend === "secret-service") encoded = command("secret-tool", ["lookup", "service", SERVICE, "id", ref.id]);
+    else {
+      const stored = readPrivateText(secretPath(dir, ref));
+      if (stored === null) throw new ZasError("secret_store_failed", 0);
+      encoded = ref.backend === "dpapi" ? dpapi(stored, true) : stored;
+    }
+    const value = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new ZasError("secret_store_failed", 0);
+    return splitSecrets(value).secrets;
+  } catch (error) {
+    if (error instanceof ZasError && error.code === "identity_permissions") throw error;
+    throw new ZasError("secret_store_failed", 0);
+  }
+}
+function removeSecrets(dir, raw) {
+  const ref = checkedRef(raw);
+  if (ref.backend === "keychain") command("/usr/bin/security", ["delete-generic-password", "-a", ref.id, "-s", SERVICE]);
+  else if (ref.backend === "secret-service") command("secret-tool", ["clear", "service", SERVICE, "id", ref.id]);
+  else rmSync(secretPath(dir, ref), { force: true });
+}
+
+// src/identity.ts
 var IDENTITY_FILE = "identity.json";
 var PENDING_FILE = "pending.json";
 var GRANTS_FILE = "grants.json";
 var FINGERPRINTS_FILE = "fingerprints.json";
 var SETTINGS_FILE = "settings.json";
 function agentHome() {
-  return process.env.ZAS_AGENT_HOME || join(homedir(), ".zas", "agent");
+  return process.env.ZAS_AGENT_HOME || join2(homedir(), ".zas", "agent");
 }
 var PROFILE_RE = /^(?!\.)[A-Za-z0-9._-]{1,64}$/;
 function profileDir(profile) {
   if (!PROFILE_RE.test(profile)) throw new ZasError("internal", 0, `Invalid profile: ${profile}`);
-  return join(agentHome(), profile);
+  return join2(agentHome(), profile);
 }
 function ensureDir(dir) {
   mkdirSync(dir, { recursive: true, mode: 448 });
@@ -243,33 +414,29 @@ function ensureDir(dir) {
 }
 function writePrivate(dir, name, value) {
   ensureDir(dir);
-  const target = join(dir, name);
-  const tmp = `${target}.${process.pid}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-  if (process.platform !== "win32") chmodSync(tmp, 384);
-  renameSync(tmp, target);
-}
-function readText(path) {
+  const target = join2(dir, name);
+  const tmp = `${target}.${randomUUID2()}.tmp`;
   try {
-    return readFileSync(path, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    throw err;
+    writeFileSync2(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384, flag: "wx" });
+    if (process.platform !== "win32") chmodSync(tmp, 384);
+    renameSync(tmp, target);
+  } finally {
+    rmSync2(tmp, { force: true });
   }
 }
 function readCache(dir, name) {
-  const target = join(dir, name);
+  const target = join2(dir, name);
   if (!existsSync(target)) return null;
   try {
-    return JSON.parse(readFileSync(target, "utf8"));
+    return JSON.parse(readFileSync2(target, "utf8"));
   } catch {
     return null;
   }
 }
-function readSecret(dir, name) {
-  const target = resolve(join(dir, name));
-  const text2 = readText(target);
+function readStored(dir, name) {
+  const target = resolve(join2(dir, name));
+  const text2 = readPrivateText(target);
   if (text2 === null) return null;
   let parsed = null;
   try {
@@ -277,9 +444,51 @@ function readSecret(dir, name) {
   } catch {
     parsed = null;
   }
-  if (!parsed || typeof parsed !== "object") throw new ZasError("identity_corrupt", 0, target);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new ZasError("identity_corrupt", 0, target);
   return parsed;
 }
+function writeSecret(dir, name, value) {
+  validateEndpoints(value);
+  const { publicData, secrets } = splitSecrets({ ...value });
+  const previous = readStored(dir, name);
+  ensureDir(dir);
+  const ref = storeSecrets(dir, secrets);
+  try {
+    writePrivate(dir, name, { ...publicData, secret_ref: ref });
+  } catch (error) {
+    try {
+      removeSecrets(dir, ref);
+    } catch {
+    }
+    throw error;
+  }
+  if (previous?.secret_ref) {
+    try {
+      removeSecrets(dir, previous.secret_ref);
+    } catch {
+    }
+  }
+}
+function readSecret(dir, name) {
+  const stored = readStored(dir, name);
+  if (!stored) return null;
+  validateEndpoints(stored);
+  if (stored.secret_ref) {
+    const { secret_ref, ...publicData } = stored;
+    const secrets = loadSecrets(dir, secret_ref);
+    return { ...publicData, ...secrets };
+  }
+  splitSecrets(stored);
+  writeSecret(dir, name, stored);
+  return stored;
+}
+function secretStorage(profile) {
+  const stored = readStored(profileDir(profile), IDENTITY_FILE) ?? readStored(profileDir(profile), PENDING_FILE);
+  if (!stored) return "not paired";
+  if (!stored.secret_ref) return "legacy file (migration pending)";
+  const labels = { dpapi: "Windows DPAPI (current user)", keychain: "macOS Keychain", "secret-service": "Linux Secret Service", file: "owner-only file (OS store unavailable)" };
+  return labels[checkedRef(stored.secret_ref).backend];
+}
 function newKeyMaterial() {
   const x = x25519.utils.randomSecretKey();
   const p = p2562.utils.randomSecretKey();
@@ -292,16 +501,26 @@ function newKeyMaterial() {
   };
 }
 function loadIdentity(profile) {
-  return readSecret(profileDir(profile), IDENTITY_FILE);
+  const identity = readSecret(profileDir(profile), IDENTITY_FILE);
+  if (identity) validateEndpoints(identity);
+  return identity;
 }
 function saveIdentity(profile, identity) {
-  writePrivate(profileDir(profile), IDENTITY_FILE, identity);
+  writeSecret(profileDir(profile), IDENTITY_FILE, identity);
+}
+function loadPending(profile) {
+  const pending2 = readSecret(profileDir(profile), PENDING_FILE);
+  if (pending2) validateEndpoints(pending2);
+  return pending2;
 }
 function savePending(profile, pending2) {
-  writePrivate(profileDir(profile), PENDING_FILE, pending2);
+  writeSecret(profileDir(profile), PENDING_FILE, pending2);
 }
 function clearPending(profile) {
-  rmSync(join(profileDir(profile), PENDING_FILE), { force: true });
+  const dir = profileDir(profile);
+  const stored = readStored(dir, PENDING_FILE);
+  rmSync2(join2(dir, PENDING_FILE), { force: true });
+  if (stored?.secret_ref) removeSecrets(dir, stored.secret_ref);
 }
 function loadGrants(profile) {
   return readCache(profileDir(profile), GRANTS_FILE);
@@ -326,20 +545,23 @@ function saveSettings(settings) {
   writePrivate(agentHome(), SETTINGS_FILE, settings);
 }
 function defaultEndpoints() {
-  return {
+  const endpoints = {
     api_base: process.env.ZAS_API_BASE || "https://zas.red/api",
     token_base: process.env.ZAS_TOKEN_BASE || "https://zas.red/anon-token",
     oprf_base: process.env.ZAS_OPRF_BASE || "https://zas.red/oprf",
     firestore_project: process.env.ZAS_FIREBASE_PROJECT || "zas-me"
   };
+  validateEndpoints(endpoints);
+  if (process.env.ZAS_WEB_BASE) validateBase(process.env.ZAS_WEB_BASE, "ZAS_WEB_BASE");
+  return endpoints;
 }
 
 // src/open.ts
 import { spawn } from "node:child_process";
 function openInBrowser(url, platform = process.platform) {
   try {
-    const [command, args] = platform === "win32" ? ["cmd", ["/c", "start", "", url]] : platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-    const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+    const [command2, args] = platform === "win32" ? ["cmd", ["/c", "start", "", url]] : platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+    const child = spawn(command2, args, { detached: true, stdio: "ignore", windowsHide: true });
     child.on("error", () => void 0);
     child.unref();
   } catch {
@@ -353,16 +575,16 @@ import { hostname } from "node:os";
 import { createServer } from "node:http";
 var BODY_MAX = 1024;
 function readBody(req) {
-  return new Promise((resolve2) => {
-    let size = 0;
+  return new Promise((resolve4) => {
+    let size2 = 0;
     let resolved = false;
     const chunks = [];
     req.on("data", (chunk) => {
-      size += chunk.length;
-      if (size > BODY_MAX) {
+      size2 += chunk.length;
+      if (size2 > BODY_MAX) {
         if (!resolved) {
           resolved = true;
-          resolve2(null);
+          resolve4(null);
         }
         return;
       }
@@ -371,13 +593,13 @@ function readBody(req) {
     req.on("end", () => {
       if (!resolved) {
         resolved = true;
-        resolve2(Buffer.concat(chunks).toString("utf8"));
+        resolve4(Buffer.concat(chunks).toString("utf8"));
       }
     });
     req.on("error", () => {
       if (!resolved) {
         resolved = true;
-        resolve2(null);
+        resolve4(null);
       }
     });
   });
@@ -445,24 +667,236 @@ async function startClaimListener(opts) {
     if ("error" in outcome) json(outcome.status, { error: outcome.error });
     else json(200, { status: "claimed" });
   });
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve4, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve2();
+      resolve4();
     });
   });
   const address = server.address();
   return {
     host: address.address,
     port: address.port,
-    close: () => new Promise((resolve2) => {
+    close: () => new Promise((resolve4) => {
       server.closeAllConnections();
-      server.close(() => resolve2());
+      server.close(() => resolve4());
     })
   };
 }
 
+// src/shared/oprf.ts
+import { RistrettoPoint } from "@noble/curves/ed25519";
+import { sha512 as sha5122 } from "@noble/hashes/sha2";
+import { invert, mod } from "@noble/curves/abstract/modular";
+
+// src/shared/constants.ts
+var CHUNKER_VERSION = "chunker_v1";
+var CHUNK_MIN = 1 * 1024 * 1024;
+var CHUNK_AVG_BITS = 22;
+var CHUNK_MAX = 8 * 1024 * 1024;
+var STORAGE_V2_PART_BYTES = 16 * 1024 * 1024;
+var GEAR_SEED = "zas-gear-v1:";
+var HKDF_INFO_CHUNK_KEY = "zas-chunk-key-v1";
+var HKDF_INFO_CHUNK_NONCE = "zas-chunk-nonce-v1";
+var OPRF_CONTEXT = "OPRFV1-\0-ristretto255-SHA512";
+var MANIFEST_VERSION = 1;
+var MIN_EXPIRY_DAYS = 1;
+var ANON_EMPTY_TTL_MS = 30 * 60 * 1e3;
+var FREE_RELAY_MAX_BYTES = 50 * 1024 * 1024;
+var SAFE_STORED_FILE_LIMITS = {
+  anon: 30 * 1024 * 1024,
+  free: FREE_RELAY_MAX_BYTES,
+  pro: 200 * 1024 * 1024,
+  max: 200 * 1024 * 1024
+};
+var STORED_FILE_LIMITS_V2 = {
+  anon: 30 * 1024 * 1024,
+  free: FREE_RELAY_MAX_BYTES,
+  pro: 5 * 1024 * 1024 * 1024,
+  max: 20 * 1024 * 1024 * 1024
+};
+var STORAGE_LIMITS = {
+  anon: 30 * 1024 * 1024,
+  free: 100 * 1024 * 1024,
+  pro: null,
+  max: null
+};
+var THUMBNAIL_MAX_EDGE = 640;
+var THUMBNAIL_MAX_BYTES = 14e4;
+
+// src/shared/oprf.ts
+var ORDER = 2n ** 252n + 27742317777372353535851937790883648493n;
+var te = new TextEncoder();
+function i2osp(value, length) {
+  const out = new Uint8Array(length);
+  for (let i = length - 1; i >= 0; i--) {
+    out[i] = value & 255;
+    value >>>= 8;
+  }
+  return out;
+}
+function expandMessageXmd(msg, dst, lenInBytes) {
+  const bInBytes = 64;
+  const rInBytes = 128;
+  const ell = Math.ceil(lenInBytes / bInBytes);
+  if (ell > 255) throw new Error("expand_message_xmd: ell too large");
+  const dstPrime = concatBytes(dst, i2osp(dst.length, 1));
+  const zPad = new Uint8Array(rInBytes);
+  const lIbStr = i2osp(lenInBytes, 2);
+  const msgPrime = concatBytes(zPad, msg, lIbStr, i2osp(0, 1), dstPrime);
+  const b0 = sha5122(msgPrime);
+  const b = [];
+  b[0] = sha5122(concatBytes(b0, i2osp(1, 1), dstPrime));
+  for (let i = 2; i <= ell; i++) {
+    const xored = new Uint8Array(bInBytes);
+    for (let j = 0; j < bInBytes; j++) xored[j] = b0[j] ^ b[i - 2][j];
+    b[i - 1] = sha5122(concatBytes(xored, i2osp(i, 1), dstPrime));
+  }
+  return concatBytes(...b).slice(0, lenInBytes);
+}
+function bytesToBigIntBE(bytes) {
+  let v = 0n;
+  for (const byte of bytes) v = v << 8n | BigInt(byte);
+  return v;
+}
+function hashToGroup(input) {
+  const dst = te.encode("HashToGroup-" + OPRF_CONTEXT);
+  const uniform = expandMessageXmd(input, dst, 64);
+  return RistrettoPoint.hashToCurve(uniform);
+}
+function randomScalar() {
+  const bytes = new Uint8Array(64);
+  crypto.getRandomValues(bytes);
+  const s = mod(bytesToBigIntBE(bytes), ORDER);
+  return s === 0n ? 1n : s;
+}
+function oprfBlind(input) {
+  const blind = randomScalar();
+  const P = hashToGroup(input);
+  return { blind, blindedElement: P.multiply(blind).toRawBytes() };
+}
+function oprfFinalize(input, blind, evaluatedElement) {
+  const E = decodeOprfElement(evaluatedElement);
+  const N = E.multiply(invert(blind, ORDER));
+  const unblinded = N.toRawBytes();
+  const hashInput = concatBytes(
+    i2osp(input.length, 2),
+    input,
+    i2osp(unblinded.length, 2),
+    unblinded,
+    te.encode("Finalize")
+  );
+  return sha5122(hashInput);
+}
+function decodeOprfElement(bytes) {
+  try {
+    if (bytes.length !== 32) throw new Error();
+    const point2 = RistrettoPoint.fromHex(bytes);
+    if (point2.equals(RistrettoPoint.ZERO)) throw new Error();
+    return point2;
+  } catch {
+    throw new Error("invalid_oprf_element");
+  }
+}
+
+// src/shared/voprf.ts
+import { RistrettoPoint as Point } from "@noble/curves/ed25519";
+import { sha512 as sha5123 } from "@noble/hashes/sha2";
+var ORDER2 = 2n ** 252n + 27742317777372353535851937790883648493n;
+var CONTEXT = "OPRFV1-
-ristretto255-SHA512";
+var utf8 = (s) => new TextEncoder().encode(s);
+var size = (n) => new Uint8Array([n >>> 8, n & 255]);
+var framed = (b) => concatBytes(size(b.length), b);
+var reduce = (s) => (s % ORDER2 + ORDER2) % ORDER2;
+var multiply = (p, s) => s === 0n ? Point.ZERO : p.multiply(s);
+function le(bytes) {
+  let n = 0n;
+  for (let i = bytes.length - 1; i >= 0; i--) n = n << 8n | BigInt(bytes[i]);
+  return n;
+}
+function hashScalar(input, label = "HashToScalar-") {
+  return reduce(le(expandMessageXmd(input, utf8(label + CONTEXT), 64)));
+}
+function point(bytes) {
+  try {
+    if (bytes.length !== 32) throw new Error();
+    const p = Point.fromHex(bytes);
+    if (p.equals(Point.ZERO)) throw new Error();
+    return p;
+  } catch {
+    throw new Error("invalid_oprf_element");
+  }
+}
+function voprfBlind(input, blind = randomScalar()) {
+  if (input.length > 65535 || blind <= 0n || blind >= ORDER2) throw new Error("invalid_oprf_input");
+  const p = Point.hashToCurve(expandMessageXmd(input, utf8("HashToGroup-" + CONTEXT), 64));
+  if (p.equals(Point.ZERO)) throw new Error("invalid_oprf_input");
+  return { blind, blindedElement: p.multiply(blind).toRawBytes() };
+}
+function composites(publicKey, blinded, evaluated) {
+  if (!blinded.length || blinded.length > 256 || blinded.length !== evaluated.length) throw new Error("invalid_oprf_batch");
+  const seed = sha5123(concatBytes(framed(publicKey), framed(utf8("Seed-" + CONTEXT))));
+  let m = Point.ZERO;
+  let z2 = Point.ZERO;
+  for (let i = 0; i < blinded.length; i++) {
+    const c = point(blinded[i]);
+    const d = point(evaluated[i]);
+    const coefficient = hashScalar(concatBytes(framed(seed), size(i), framed(blinded[i]), framed(evaluated[i]), utf8("Composite")));
+    m = m.add(multiply(c, coefficient));
+    z2 = z2.add(multiply(d, coefficient));
+  }
+  return [m, z2];
+}
+function challenge(publicKey, m, z2, t2, t3) {
+  return hashScalar(concatBytes(framed(publicKey), ...[m, z2, t2, t3].map((p) => framed(p.toRawBytes())), utf8("Challenge")));
+}
+function voprfVerify(publicKey, blinded, evaluated, proof) {
+  try {
+    const pk = point(publicKey);
+    if (proof.length !== 64) return false;
+    const c = le(proof.slice(0, 32));
+    const s = le(proof.slice(32));
+    if (c >= ORDER2 || s >= ORDER2) return false;
+    const [m, z2] = composites(publicKey, blinded, evaluated);
+    return challenge(publicKey, m, z2, multiply(Point.BASE, s).add(multiply(pk, c)), multiply(m, s).add(multiply(z2, c))) === c;
+  } catch {
+    return false;
+  }
+}
+
+// src/shared/dedupe-oprf.ts
+function configuredDedupePolicy(capability, pinsJson) {
+  if (capability === void 0 || capability.mode === 0) return { mode: 0 };
+  try {
+    return dedupePolicy(capability, JSON.parse(pinsJson || "{}"));
+  } catch {
+    throw new Error("invalid_voprf_configuration");
+  }
+}
+function dedupePolicy(capability, pinnedKeys) {
+  if (capability === void 0 || capability.mode === 0) return { mode: 0 };
+  if (capability.mode !== 1 || !capability.key_id || !Object.hasOwn(pinnedKeys, capability.key_id)) throw new Error("invalid_voprf_configuration");
+  const publicKey = b64ToBytes(pinnedKeys[capability.key_id]);
+  if (publicKey.length !== 32 || publicKey.every((b) => b === 0)) throw new Error("invalid_voprf_configuration");
+  return { mode: 1, keyId: capability.key_id, publicKey };
+}
+var blindDedupe = (input, policy) => policy.mode === 1 ? voprfBlind(input) : oprfBlind(input);
+function dedupeRequest(blinded, policy) {
+  return { blinded: blinded.map(bytesToB64), ...policy.mode === 1 ? { mode: 1, key_id: policy.keyId } : {} };
+}
+function verifiedDedupeResponse(raw, blinded, policy) {
+  try {
+    const response = raw;
+    if (!Array.isArray(response?.evaluated) || response.evaluated.length !== blinded.length) throw new Error();
+    const evaluated = response.evaluated.map(b64ToBytes);
+    if (policy.mode === 1 && (response.mode !== 1 || response.key_id !== policy.keyId || typeof response.proof !== "string" || !voprfVerify(policy.publicKey, blinded, evaluated, b64ToBytes(response.proof)))) throw new Error();
+    return evaluated;
+  } catch {
+    throw new Error(policy.mode === 1 ? "invalid_voprf_proof" : "invalid_oprf_response");
+  }
+}
+
 // src/client.ts
 var REFRESH_MARGIN_MS = 5 * 60 * 1e3;
 async function readBody2(res) {
@@ -477,11 +911,13 @@ async function readBody2(res) {
 function jsonInit(method, body, headers) {
   return {
     method,
+    redirect: "error",
     headers: { ...body === void 0 ? {} : { "Content-Type": "application/json" }, ...headers },
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   };
 }
 async function apiPublic(base, method, path, body, headers = {}, fetchImpl) {
+  validateBase(base, "API base");
   const call = fetchImpl ?? ((input, init) => fetch(input, init));
   const res = await call(`${base}${path}`, jsonInit(method, body, headers));
   const parsed = res.status === 204 ? void 0 : await readBody2(res);
@@ -491,6 +927,7 @@ async function apiPublic(base, method, path, body, headers = {}, fetchImpl) {
 var ZasClient = class _ZasClient {
   constructor(identity, opts = {}) {
     this.identity = identity;
+    validateEndpoints(identity);
     this.call = opts.fetch ?? ((input, init) => fetch(input, init));
     this.now = opts.now ?? (() => Date.now());
   }
@@ -503,6 +940,7 @@ var ZasClient = class _ZasClient {
   /** Concurrent callers wait on the one sign-in instead of racing three. */
   pendingSignIn = null;
   async signIn() {
+    validateEndpoints(this.identity);
     const { agent_uid, owner_uid, token_base, p256_private } = this.identity;
     const chal = await apiPublic(
       token_base,
@@ -525,6 +963,7 @@ var ZasClient = class _ZasClient {
     );
     const res = await this.call(`${_ZasClient.identityToolkitBase()}/accounts:signInWithCustomToken?key=${_ZasClient.apiKey()}`, {
       method: "POST",
+      redirect: "error",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ token: tok.token, returnSecureToken: true })
     });
@@ -552,6 +991,7 @@ var ZasClient = class _ZasClient {
   /** Optional traffic must never initiate or invalidate the shared auth session.
    * One bounded request, no retries, and no response body parsing. */
   async reportTelemetry(body) {
+    validateEndpoints(this.identity);
     const session2 = this.session;
     if (this.telemetrySending || !session2 || session2.expiresAt <= this.now() + REFRESH_MARGIN_MS) return;
     this.telemetrySending = true;
@@ -573,6 +1013,8 @@ var ZasClient = class _ZasClient {
     return parsed;
   }
   async authed(url, method, body, headers) {
+    validateEndpoints(this.identity);
+    validateBase(url, "Request URL");
     const token = await this.idToken();
     return this.call(url, jsonInit(method, body, { Authorization: `Bearer ${token}`, ...headers }));
   }
@@ -589,10 +1031,27 @@ var ZasClient = class _ZasClient {
     this.session = null;
     return this.authed(url, method, body, headers);
   }
-  async oprfEvaluate(blinded) {
-    const res = await this.authedRetrying(`${this.identity.oprf_base}/evaluate`, "POST", { blinded }, {});
+  async dedupePolicy() {
+    const capabilities = await this.api("GET", "/agents/me");
+    try {
+      return configuredDedupePolicy(capabilities.dedupe, process.env.ZAS_VOPRF_PUBLIC_KEYS);
+    } catch {
+      throw new ZasError("invalid_voprf_configuration", 0);
+    }
+  }
+  async oprfEvaluate(blinded, policy = { mode: 0 }) {
+    const points = policy.mode === 1 ? blinded.map(b64ToBytes) : [];
+    const body = policy.mode === 1 ? dedupeRequest(points, policy) : { blinded };
+    const res = await this.authedRetrying(`${this.identity.oprf_base}/evaluate`, "POST", body, {});
     const parsed = await readBody2(res);
     if (!res.ok) throw errorFromResponse(res.status, parsed);
+    if (policy.mode === 1) {
+      try {
+        return verifiedDedupeResponse(parsed, points, policy).map(bytesToB64);
+      } catch {
+        throw new ZasError("invalid_voprf_proof", 0);
+      }
+    }
     return parsed.evaluated ?? [];
   }
   /** Firestore REST runQuery. `parentPath` is relative to the documents root
@@ -623,12 +1082,11 @@ var ZasClient = class _ZasClient {
     return process.env.ZAS_FIREBASE_API_KEY || "AIzaSyAiZbAPrxH7EKaJftJoGcEVEL0h6rAVcvE";
   }
   static identityToolkitBase() {
-    const host = process.env.FIREBASE_AUTH_EMULATOR_HOST;
-    return host ? `http://${host}/identitytoolkit.googleapis.com/v1` : "https://identitytoolkit.googleapis.com/v1";
+    const host = emulatorBase("FIREBASE_AUTH_EMULATOR_HOST");
+    return host ? `${host}/identitytoolkit.googleapis.com/v1` : "https://identitytoolkit.googleapis.com/v1";
   }
   static firestoreBase(project) {
-    const host = process.env.FIRESTORE_EMULATOR_HOST;
-    const root = host ? `http://${host}` : "https://firestore.googleapis.com";
+    const root = emulatorBase("FIRESTORE_EMULATOR_HOST") ?? "https://firestore.googleapis.com";
     return `${root}/v1/projects/${project}/databases/(default)/documents`;
   }
 };
@@ -636,12 +1094,12 @@ var ZasClient = class _ZasClient {
 // src/shared/agent-snippets.ts
 function agentSnippets(profile, windows = false, pkg = "zas-agent") {
   const runner = windows ? "npx.cmd" : "npx";
-  const command = `${runner} -y ${pkg}@latest`;
+  const command2 = `${runner} -y ${pkg}@latest`;
   const shell = windows ? "cmd /d /c " : "";
   return {
-    pair: `${command} pair --profile ${profile}`,
-    claude: `${shell}claude mcp add zas "--" ${command} --profile ${profile}`,
-    codex: `${shell}codex mcp add zas "--" ${command} --profile ${profile}`
+    pair: `${command2} pair --profile ${profile}`,
+    claude: `${shell}claude mcp add zas "--" ${command2} --profile ${profile}`,
+    codex: `${shell}codex mcp add zas "--" ${command2} --profile ${profile}`
   };
 }
 
@@ -672,13 +1130,13 @@ function pairUrl(webBase, pairingId, port) {
 function webOriginOf(webBase) {
   return new URL(webBase).origin;
 }
-var defaultSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var defaultSleep = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 function deferred() {
-  let resolve2;
+  let resolve4;
   const promise = new Promise((r) => {
-    resolve2 = r;
+    resolve4 = r;
   });
-  return { promise, resolve: resolve2 };
+  return { promise, resolve: resolve4 };
 }
 async function runPair(opts) {
   const sleep2 = opts.sleep ?? defaultSleep;
@@ -862,12 +1320,12 @@ async function runPair(opts) {
   clearPending(opts.profile);
   const claudeLines = (lead) => [lead, `  ${claudeSnippet(opts.profile)}`];
   const codexLines = (lead) => [lead, `  ${codexSnippet(opts.profile)}`];
-  const install = opts.kind === "claude_code" ? claudeLines("Add it to Claude Code:") : opts.kind === "codex" ? codexLines("Add it to Codex:") : [...claudeLines("Add it to Claude Code:"), ...codexLines("Or to Codex:")];
+  const install2 = opts.kind === "claude_code" ? claudeLines("Add it to Claude Code:") : opts.kind === "codex" ? codexLines("Add it to Codex:") : [...claudeLines("Add it to Claude Code:"), ...codexLines("Or to Codex:")];
   opts.log(
     [
       `Done: the agent \u201C${identity.name}\u201D is paired with your account.`,
       ...replacing ? ["It replaces the previous agent of this profile, which is now revoked."] : [],
-      ...install
+      ...install2
     ].join("\n")
   );
   return identity;
@@ -877,41 +1335,6 @@ async function runPair(opts) {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 
-// src/shared/constants.ts
-var CHUNKER_VERSION = "chunker_v1";
-var CHUNK_MIN = 1 * 1024 * 1024;
-var CHUNK_AVG_BITS = 22;
-var CHUNK_MAX = 8 * 1024 * 1024;
-var STORAGE_V2_PART_BYTES = 16 * 1024 * 1024;
-var GEAR_SEED = "zas-gear-v1:";
-var HKDF_INFO_CHUNK_KEY = "zas-chunk-key-v1";
-var HKDF_INFO_CHUNK_NONCE = "zas-chunk-nonce-v1";
-var OPRF_CONTEXT = "OPRFV1-\0-ristretto255-SHA512";
-var MANIFEST_VERSION = 1;
-var MIN_EXPIRY_DAYS = 1;
-var ANON_EMPTY_TTL_MS = 30 * 60 * 1e3;
-var FREE_RELAY_MAX_BYTES = 50 * 1024 * 1024;
-var SAFE_STORED_FILE_LIMITS = {
-  anon: 30 * 1024 * 1024,
-  free: FREE_RELAY_MAX_BYTES,
-  pro: 200 * 1024 * 1024,
-  max: 200 * 1024 * 1024
-};
-var STORED_FILE_LIMITS_V2 = {
-  anon: 30 * 1024 * 1024,
-  free: FREE_RELAY_MAX_BYTES,
-  pro: 5 * 1024 * 1024 * 1024,
-  max: 20 * 1024 * 1024 * 1024
-};
-var STORAGE_LIMITS = {
-  anon: 30 * 1024 * 1024,
-  free: 100 * 1024 * 1024,
-  pro: null,
-  max: null
-};
-var THUMBNAIL_MAX_EDGE = 640;
-var THUMBNAIL_MAX_BYTES = 14e4;
-
 // src/shared/direct.ts
 var DIRECT_OFFER_TTL_MS = 10 * 60 * 1e3;
 var DIRECT_CLAIMED_TTL_MS = 6 * 60 * 60 * 1e3;
@@ -927,12 +1350,12 @@ var DIRECT_MEMORY_SINK_MAX_BYTES = 128 * 1024 * 1024;
 var DIRECT_FALLBACK_PART_BYTES = 16 * 1024 * 1024;
 var DIRECT_FALLBACK_TAG_BYTES = 16;
 var DIRECT_FALLBACK_TTL_MS = 24 * 60 * 60 * 1e3;
-function directFallbackPartCount(size) {
-  if (!Number.isSafeInteger(size) || size < 0) throw new Error("bad_size");
-  return Math.max(1, Math.ceil(size / DIRECT_FALLBACK_PART_BYTES));
+function directFallbackPartCount(size2) {
+  if (!Number.isSafeInteger(size2) || size2 < 0) throw new Error("bad_size");
+  return Math.max(1, Math.ceil(size2 / DIRECT_FALLBACK_PART_BYTES));
 }
-function directFallbackCipherSize(size) {
-  return size + directFallbackPartCount(size) * DIRECT_FALLBACK_TAG_BYTES;
+function directFallbackCipherSize(size2) {
+  return size2 + directFallbackPartCount(size2) * DIRECT_FALLBACK_TAG_BYTES;
 }
 var DIRECT_CONNECT_TIMEOUT_MS = 30 * 1e3;
 var DIRECT_STALL_GRACE_MS = 5 * 1e3;
@@ -1477,10 +1900,10 @@ function startSender(opts) {
   s.setChannel(dc);
   dc.binaryType = "arraybuffer";
   dc.bufferedAmountLowThreshold = DIRECT_BUFFERED_HIGH / 8;
-  const waitLow = () => new Promise((resolve2) => {
+  const waitLow = () => new Promise((resolve4) => {
     const done = () => {
       dc.removeEventListener("bufferedamountlow", done);
-      resolve2();
+      resolve4();
     };
     dc.addEventListener("bufferedamountlow", done);
   });
@@ -1495,7 +1918,7 @@ function startSender(opts) {
   };
   const waitPersisted = (target) => {
     if (peerProtocol < 2 || persisted >= target || s.isTerminal()) return Promise.resolve();
-    return new Promise((resolve2) => creditWaiters.push({ target, resolve: resolve2 }));
+    return new Promise((resolve4) => creditWaiters.push({ target, resolve: resolve4 }));
   };
   const pump = async () => {
     const meta = {
@@ -1683,8 +2106,8 @@ function startReceiver(opts) {
           finished = true;
           void pipeline.then(async (sink) => {
             if (got !== total || queued !== total) throw new Error("size_mismatch");
-            const sha2563 = (await hasherPromise).digest();
-            if (protocol >= 2 && (!frame.digest || frame.digest.size !== got || frame.digest.sha256 !== sha2563)) throw new Error("digest_mismatch");
+            const sha2564 = (await hasherPromise).digest();
+            if (protocol >= 2 && (!frame.digest || frame.digest.size !== got || frame.digest.sha256 !== sha2564)) throw new Error("digest_mismatch");
             await sink.close();
             dc?.send(DONE_FRAME);
             s.setPhase("done");
@@ -1740,9 +2163,143 @@ function startReceiver(opts) {
 }
 
 // src/transfer-telemetry.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
+
+// src/shared/nearby.ts
+import { sha256 as sha2563 } from "@noble/hashes/sha2";
+
+// src/shared/manifest.ts
+import { xchacha20poly1305 } from "@noble/ciphers/chacha";
+function newManifest(partial) {
+  return { v: MANIFEST_VERSION, chunker: CHUNKER_VERSION, ...partial };
+}
+var ENVELOPE_MAGIC = 90;
+var KEY_VERSION_LEGACY = 1;
+var ENVELOPE_V2_PREFIX = new Uint8Array([90, 0, 90, 65, 83, 69, 78, 86]);
+var V2_HEADER_BYTES = 8 + 1 + 1 + 24;
+function isV2Envelope(sealed) {
+  return ENVELOPE_V2_PREFIX.every((b, i) => sealed[i] === b);
+}
+function validateV2Envelope(sealed) {
+  if (sealed.length < V2_HEADER_BYTES + 16 || sealed[8] !== 2 || sealed[9] < 1) throw new Error("invalid_envelope");
+}
+function envelopeVersion(sealed) {
+  if (isV2Envelope(sealed)) {
+    validateV2Envelope(sealed);
+    return sealed[9];
+  }
+  if (sealed.length > 26 && sealed[0] === ENVELOPE_MAGIC && sealed[1] >= 1) return sealed[1];
+  return KEY_VERSION_LEGACY;
+}
+function sealBytes(key, version, plain) {
+  if (version < 1 || version > 255) throw new Error("key version out of range");
+  const nonce = new Uint8Array(24);
+  crypto.getRandomValues(nonce);
+  const ct = xchacha20poly1305(key, nonce).encrypt(plain);
+  return concatBytes(new Uint8Array([ENVELOPE_MAGIC, version]), nonce, ct);
+}
+function openSealed(key, sealed) {
+  if (isV2Envelope(sealed)) {
+    validateV2Envelope(sealed);
+    return xchacha20poly1305(key, sealed.slice(10, V2_HEADER_BYTES), sealed.slice(0, V2_HEADER_BYTES)).decrypt(sealed.slice(V2_HEADER_BYTES));
+  }
+  const versioned = envelopeVersion(sealed) !== KEY_VERSION_LEGACY || sealed[0] === ENVELOPE_MAGIC;
+  if (versioned && sealed.length > 26) {
+    try {
+      return xchacha20poly1305(key, sealed.slice(2, 26)).decrypt(sealed.slice(26));
+    } catch {
+    }
+  }
+  return xchacha20poly1305(key, sealed.slice(0, 24)).decrypt(sealed.slice(24));
+}
+var sealRaw = sealBytes;
+var openRaw = openSealed;
+function sealManifest(channelKey, manifest, version = KEY_VERSION_LEGACY) {
+  return sealBytes(channelKey, version, new TextEncoder().encode(JSON.stringify(manifest)));
+}
+function openManifest(channelKey, sealed) {
+  const m = JSON.parse(new TextDecoder().decode(openSealed(channelKey, sealed)));
+  if (!Array.isArray(m.chunks)) m.chunks = [];
+  return m;
+}
+function decryptChannelName(channelKey, sealed) {
+  return new TextDecoder().decode(openSealed(channelKey, sealed));
+}
+
+// src/shared/nearby.ts
+var NEARBY_TOKEN_BYTES = 16;
+var NEARBY_FINGERPRINT_BYTES = 16;
+var NEARBY_CARRIER_BYTES = NEARBY_TOKEN_BYTES + NEARBY_FINGERPRINT_BYTES;
+var NEARBY_REFUSAL_CODES = [
+  "nearby_token_expired",
+  "nearby_self",
+  "nearby_key_mismatch",
+  "nearby_code_expired",
+  "nearby_code_taken",
+  "nearby_offer_expired",
+  "nearby_delivery_not_ready",
+  "nearby_delivery_conflict",
+  "nearby_delivery_expired",
+  "nearby_channel_exists",
+  "nearby_channel_not_kept",
+  "nearby_channel_closed_membership",
+  "nearby_send_personal_only",
+  // The copy into the nearby channel did not fit the sender's personal
+  // storage (#43). Named so no client falls back to "try again".
+  "storage_limit",
+  "enterprise_sending_disabled",
+  "enterprise_guest_receiving_disabled",
+  "enterprise_plan_inactive",
+  "rate_limited"
+];
 
 // src/shared/product-analytics.ts
+var NEARBY_CLIENT_EVENTS = [
+  "nearby.session_started",
+  "nearby.permission_result",
+  "nearby.bluetooth_enable_result",
+  "nearby.advertising",
+  "nearby.token_failed",
+  "nearby.connect_received",
+  "nearby.scan_summary",
+  "nearby.touch_detected",
+  "nearby.touch_ambiguous",
+  "nearby.candidate_picked",
+  "nearby.carrier_read",
+  "nearby.resolved",
+  "nearby.face_shown",
+  "nearby.confirm_result",
+  "nearby.offer_sent",
+  "nearby.item_copied",
+  "nearby.offer_shown",
+  "nearby.offer_answered",
+  "nearby.answer_seen",
+  "nearby.code_shown",
+  "nearby.link_opened",
+  "nearby.card_state",
+  "nearby.claim_sent",
+  "nearby.claim_decided",
+  "nearby.claim_answer",
+  "nearby.feedback",
+  "nearby.session_ended"
+];
+var NEARBY_FAIL_CODES = [
+  ...NEARBY_REFUSAL_CODES,
+  "network",
+  "timeout",
+  "disconnected",
+  "no_service",
+  "bad_length",
+  "gatt_error",
+  "bt_off",
+  "bt_unauthorized",
+  "bt_unsupported",
+  "permission_denied",
+  "copy_failed",
+  "key_missing",
+  "expired",
+  "other"
+];
 var PRODUCT_EVENTS = [
   "account_created",
   "item.created",
@@ -1829,12 +2386,33 @@ var PRODUCT_EVENTS = [
   "agent.tool_call",
   // The public pages, which until now reported nothing at all: `capture_pageview`
   // is off, so a visitor who read the enterprise page and left was invisible.
-  // These five are the funnel that ends at `enterprise.org_create`.
+  // These five are the funnel that ends at `enterprise.org_create`; the sixth
+  // says how much of the home trailer people watched.
   "marketing.page_viewed",
   "marketing.section_viewed",
   "marketing.scroll_depth",
   "marketing.cta_clicked",
-  "marketing.language_switched"
+  "marketing.language_switched",
+  "marketing.video_progress",
+  // Zas Nearby (#35). The server writes them; none carries a token, a code,
+  // a key or a name.
+  "nearby_token_registered",
+  "nearby_resolved",
+  "nearby_offer_sent",
+  "nearby_offer_accepted",
+  "nearby_offer_declined",
+  "nearby_offer_withdrawn",
+  "nearby_offer_expired",
+  "nearby_code_created",
+  "nearby_code_claimed",
+  "nearby_code_allowed",
+  "nearby_code_denied",
+  "nearby_code_expired",
+  "nearby_refused",
+  // Zas Nearby on the device (#38): what the server cannot see. Bluetooth, the
+  // touch detector, the reads, the choices on screen, the feedback and the
+  // timing. Web sends the QR half only; Android and iOS send all of them.
+  ...NEARBY_CLIENT_EVENTS
 ];
 var SERVER_OWNED_PRODUCT_EVENTS = [
   "account_created",
@@ -1849,7 +2427,20 @@ var SERVER_OWNED_PRODUCT_EVENTS = [
   "agent.send",
   "agent.edit",
   "agent.replace",
-  "agent.tool_call"
+  "agent.tool_call",
+  "nearby_token_registered",
+  "nearby_resolved",
+  "nearby_offer_sent",
+  "nearby_offer_accepted",
+  "nearby_offer_declined",
+  "nearby_offer_withdrawn",
+  "nearby_offer_expired",
+  "nearby_code_created",
+  "nearby_code_claimed",
+  "nearby_code_allowed",
+  "nearby_code_denied",
+  "nearby_code_expired",
+  "nearby_refused"
 ];
 var SERVER_OWNED_PRODUCT_EVENT_SET = new Set(SERVER_OWNED_PRODUCT_EVENTS);
 var CLIENT_PRODUCT_EVENTS = PRODUCT_EVENTS.filter(
@@ -1875,7 +2466,8 @@ var marketingSection = oneOf(
   "agents",
   "fit",
   "billing",
-  "signin"
+  "signin",
+  "trailer"
 );
 var marketingCta = oneOf(
   "see_enterprise",
@@ -1885,9 +2477,12 @@ var marketingCta = oneOf(
   "sign_in",
   "open_console",
   "switch_language",
-  "footer_home"
+  "footer_home",
+  "play_trailer",
+  "get_app",
+  "dismiss_app_banner"
 );
-var marketingPlacement = oneOf("nav", "hero", "band", "fit", "billing", "signin", "footer", "menu", "limit");
+var marketingPlacement = oneOf("nav", "hero", "band", "fit", "billing", "signin", "footer", "menu", "limit", "trailer", "app_banner");
 var arrivalKind = oneOf("direct", "internal", "search", "social", "other");
 var uiLocale = oneOf("es-AR", "pt-BR", "en");
 var signinContext = oneOf("page", "alpha_access", "handoff_site", "handoff_share");
@@ -1963,8 +2558,9 @@ function agentDurationBucket(ms) {
   if (ms < 6e4) return "10_60s";
   return "gt_60s";
 }
+var transferErrorCode = oneOf("none", "network", "timeout", "authorization", "storage", "crypto", "worker", "other");
 var transferProperties = {
-  transfer_id: { type: "transfer_id" },
+  transfer_id: { type: "uuid" },
   item_kind: oneOf("file", "text", "code", "link", "unknown"),
   transport: oneOf("storage", "manifest", "direct", "fallback"),
   cache_hit: bool,
@@ -1980,10 +2576,88 @@ var transferProperties = {
   foreground: bool,
   online: bool,
   outcome: oneOf("success", "failure", "cancelled"),
-  error_code: oneOf("none", "network", "timeout", "authorization", "storage", "crypto", "worker", "other"),
+  error_code: transferErrorCode,
   timing_mode: oneOf("wall", "cumulative_work")
 };
+var nearbyOutcome = oneOf("ok", "refused", "network");
+var nearbyRefusal = oneOf(...NEARBY_REFUSAL_CODES);
+var signed = { type: "number" };
+var nearby = (props) => ({
+  nearby_session: { type: "uuid" },
+  role,
+  method: oneOf("touch", "qr"),
+  t_ms: count,
+  ...props
+});
+var NEARBY_CLIENT_RULES = {
+  "nearby.session_started": nearby({
+    entry: oneOf("item_menu", "item_detail", "rail", "menu", "shortcut", "tile", "control", "app_link", "intent_extra", "offer", "browser"),
+    bt_state: oneOf("on", "off", "unauthorized", "unsupported")
+  }),
+  "nearby.permission_result": nearby({ result: oneOf("granted", "denied", "already"), prompt_ms: count }),
+  "nearby.bluetooth_enable_result": nearby({ result: oneOf("on", "declined") }),
+  "nearby.advertising": nearby({
+    state: oneOf("started", "failed", "stopped"),
+    error_code: signed,
+    reason: oneOf("background", "workspace_switch", "bt_off", "signed_out", "user")
+  }),
+  "nearby.token_failed": nearby({ code: oneOf("rate_limited", "network", "other"), attempt: count }),
+  "nearby.connect_received": nearby({ count_in_session: count }),
+  "nearby.scan_summary": nearby({
+    outcome: oneOf("touched", "ambiguous", "none", "cancelled"),
+    devices_seen: count,
+    readings: count,
+    max_rssi: signed,
+    scan_ms: count
+  }),
+  "nearby.touch_detected": nearby({ median_rssi: signed, hold_ms: count, rivals: count, margin_db: signed, ms_since_scan: count }),
+  "nearby.touch_ambiguous": nearby({ candidates: count, margin_db: signed }),
+  "nearby.candidate_picked": nearby({ picked_rank: { type: "number", min: 1 }, decide_ms: count }),
+  "nearby.carrier_read": nearby({
+    outcome: oneOf("ok", "timeout", "disconnected", "no_service", "bad_length", "gatt_error"),
+    gatt_status: signed,
+    mtu: count,
+    duration_ms: count,
+    attempt: count
+  }),
+  "nearby.resolved": nearby({ outcome: nearbyOutcome, refusal: nearbyRefusal, key_check: oneOf("match", "mismatch"), duration_ms: count }),
+  "nearby.face_shown": nearby({ touch_to_face_ms: count }),
+  "nearby.confirm_result": nearby({ result: oneOf("send", "not_now", "closed"), decide_ms: count }),
+  "nearby.offer_sent": nearby({ outcome: nearbyOutcome, refusal: nearbyRefusal, reused: bool, duration_ms: count }),
+  "nearby.item_copied": nearby({
+    outcome: oneOf("ok", "failed"),
+    kind: itemKind,
+    size_bucket: sizeBucket,
+    // The transfer vocabulary: the copy is a transfer, and mobile has it already.
+    error_code: transferErrorCode,
+    duration_ms: count
+  }),
+  "nearby.offer_shown": nearby({ has_preview: bool, offer_age_ms: count }),
+  "nearby.offer_answered": nearby({ answer: oneOf("accept", "decline", "dismissed", "expired"), keep: bool, decide_ms: count }),
+  "nearby.answer_seen": nearby({ answer: oneOf("accepted", "declined", "no_answer"), wait_ms: count }),
+  "nearby.code_shown": nearby({ refresh: oneOf("first", "timer", "manual", "expired") }),
+  // `browser` is the web: the /n/ page opened in a browser, not in an app.
+  "nearby.link_opened": nearby({ source: oneOf("app_link", "universal_link", "intent_extra", "browser"), signed_in: bool, has_key: bool }),
+  "nearby.card_state": nearby({ state: oneOf("ready", "expired", "done", "taken", "no_key", "error") }),
+  "nearby.claim_sent": nearby({ outcome: nearbyOutcome, refusal: nearbyRefusal, keep: bool }),
+  // `outcome` is the allow or deny call itself; a copy after it fails apart.
+  "nearby.claim_decided": nearby({ decision: oneOf("allow", "deny"), outcome: nearbyOutcome, refusal: nearbyRefusal, decide_ms: count, existing: bool }),
+  "nearby.claim_answer": nearby({ answer: oneOf("allowed", "denied", "taken", "expired"), wait_ms: count }),
+  "nearby.feedback": nearby({
+    moment: oneOf("found", "ambiguous", "request", "accepted", "delivered", "declined", "error"),
+    haptic: oneOf("rich", "basic", "none"),
+    sound: oneOf("played", "muted", "off")
+  }),
+  "nearby.session_ended": nearby({
+    outcome: oneOf("delivered", "declined", "denied", "no_answer", "cancelled", "failed", "abandoned"),
+    fail_step: oneOf(...NEARBY_CLIENT_EVENTS),
+    fail_code: oneOf(...NEARBY_FAIL_CODES),
+    total_ms: count,
+    touch_to_delivered_ms: count
+  })
+};
 var EVENT_PROPERTY_RULES = {
+  ...NEARBY_CLIENT_RULES,
   "transfer.started": transferProperties,
   "transfer.stage_started": transferProperties,
   "transfer.phase_timing": transferProperties,
@@ -2241,6 +2915,30 @@ var EVENT_PROPERTY_RULES = {
     placement: marketingPlacement
   },
   "marketing.language_switched": { surface: marketingSurface, from: uiLocale, to: uiLocale },
+  // How far into a video the viewer got, once per milestone per page load.
+  // `shape` is the cut that played (16:9 or 9:16); `muted` is whether the
+  // sound was off when the milestone was reached.
+  "marketing.video_progress": {
+    surface: marketingSurface,
+    video: oneOf("trailer"),
+    locale: uiLocale,
+    shape: oneOf("h", "v"),
+    depth: oneOf("p25", "p50", "p75", "p100"),
+    muted: bool
+  },
+  nearby_token_registered: {},
+  nearby_resolved: {},
+  nearby_offer_sent: { reused: bool },
+  nearby_offer_accepted: { keep: bool },
+  nearby_offer_declined: {},
+  nearby_offer_withdrawn: {},
+  nearby_offer_expired: {},
+  nearby_code_created: {},
+  nearby_code_claimed: { keep: bool },
+  nearby_code_allowed: { existing: bool },
+  nearby_code_denied: {},
+  nearby_code_expired: {},
+  nearby_refused: { code: oneOf(...NEARBY_REFUSAL_CODES), step: oneOf("token", "resolve", "offer", "accept", "code", "claim", "allow", "send") },
   "agent.tool_call": {
     tool: oneOf(...AGENT_TOOL_NAMES),
     result: oneOf("ok", "error"),
@@ -2254,7 +2952,7 @@ var EVENT_PROPERTY_RULES = {
 };
 var platformRule = oneOf("web", "android", "ios", "agent", "unknown");
 function valid(rule, value) {
-  if (rule.type === "transfer_id") return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+  if (rule.type === "uuid") return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
   if (rule.type === "boolean") return typeof value === "boolean";
   if (rule.type === "number") {
     return typeof value === "number" && Number.isFinite(value) && (rule.min === void 0 || value >= rule.min);
@@ -2346,13 +3044,13 @@ function toolCallProperties(input) {
 var REPORT_TIMEOUT_MS = 5e3;
 async function report(client, properties) {
   if (properties === null) return;
-  await new Promise((resolve2) => {
-    const timer = setTimeout(resolve2, 0);
+  await new Promise((resolve4) => {
+    const timer = setTimeout(resolve4, 0);
     timer.unref?.();
   });
   if (!telemetryState().on) return;
-  const timeout = new Promise((resolve2) => {
-    const timer = setTimeout(resolve2, REPORT_TIMEOUT_MS);
+  const timeout = new Promise((resolve4) => {
+    const timer = setTimeout(resolve4, REPORT_TIMEOUT_MS);
     timer.unref?.();
   });
   const body = { event: "agent.tool_call", properties };
@@ -2400,7 +3098,7 @@ var TransferTelemetry = class {
     this.slow = setTimeout(() => this.capture("transfer.slow"), 3e4);
     this.slow.unref?.();
   }
-  id = randomUUID();
+  id = randomUUID3();
   started = performance.now();
   changed = this.started;
   stage = "staging";
@@ -2410,8 +3108,8 @@ var TransferTelemetry = class {
   slow;
   size = 0;
   completed = 0;
-  describe(size, kind = this.kind, transport = this.transport) {
-    this.size = Math.max(0, size);
+  describe(size2, kind = this.kind, transport = this.transport) {
+    this.size = Math.max(0, size2);
     this.kind = kind;
     this.transport = transport;
   }
@@ -2485,48 +3183,6 @@ import { randomBytes } from "node:crypto";
 import { openAsBlob } from "node:fs";
 import { basename as basename2 } from "node:path";
 
-// src/shared/manifest.ts
-import { xchacha20poly1305 } from "@noble/ciphers/chacha";
-function newManifest(partial) {
-  return { v: MANIFEST_VERSION, chunker: CHUNKER_VERSION, ...partial };
-}
-var ENVELOPE_MAGIC = 90;
-var KEY_VERSION_LEGACY = 1;
-function envelopeVersion(sealed) {
-  if (sealed.length > 26 && sealed[0] === ENVELOPE_MAGIC && sealed[1] >= 1) return sealed[1];
-  return KEY_VERSION_LEGACY;
-}
-function sealBytes(key, version, plain) {
-  if (version < 1 || version > 255) throw new Error("key version out of range");
-  const nonce = new Uint8Array(24);
-  crypto.getRandomValues(nonce);
-  const ct = xchacha20poly1305(key, nonce).encrypt(plain);
-  return concatBytes(new Uint8Array([ENVELOPE_MAGIC, version]), nonce, ct);
-}
-function openSealed(key, sealed) {
-  const versioned = envelopeVersion(sealed) !== KEY_VERSION_LEGACY || sealed[0] === ENVELOPE_MAGIC;
-  if (versioned && sealed.length > 26) {
-    try {
-      return xchacha20poly1305(key, sealed.slice(2, 26)).decrypt(sealed.slice(26));
-    } catch {
-    }
-  }
-  return xchacha20poly1305(key, sealed.slice(0, 24)).decrypt(sealed.slice(24));
-}
-var sealRaw = sealBytes;
-var openRaw = openSealed;
-function sealManifest(channelKey, manifest, version = KEY_VERSION_LEGACY) {
-  return sealBytes(channelKey, version, new TextEncoder().encode(JSON.stringify(manifest)));
-}
-function openManifest(channelKey, sealed) {
-  const m = JSON.parse(new TextDecoder().decode(openSealed(channelKey, sealed)));
-  if (!Array.isArray(m.chunks)) m.chunks = [];
-  return m;
-}
-function decryptChannelName(channelKey, sealed) {
-  return new TextDecoder().decode(openSealed(channelKey, sealed));
-}
-
 // src/file-source.ts
 import { promises as fsp, statSync } from "node:fs";
 async function readFileRange(path, start, length) {
@@ -2670,8 +3326,8 @@ var CONCURRENCY = 2;
 function aborted(signal) {
   if (signal?.aborted) throw new DOMException("Aborted", "AbortError");
 }
-var pause = (ms, signal) => new Promise((resolve2, reject) => {
-  const timer = setTimeout(resolve2, ms);
+var pause = (ms, signal) => new Promise((resolve4, reject) => {
+  const timer = setTimeout(resolve4, ms);
   signal?.addEventListener("abort", () => {
     clearTimeout(timer);
     reject(new DOMException("Aborted", "AbortError"));
@@ -2691,14 +3347,14 @@ async function uploadFallback(options) {
   for (let first = 1; first <= meta.part_count; first += URL_BATCH) {
     aborted(signal);
     const count2 = Math.min(URL_BATCH, meta.part_count - first + 1);
-    const signed = await options.getUrls(first, count2);
-    if (signed.length !== count2 || signed.some((entry, i) => entry.part_number !== first + i || typeof entry.url !== "string")) throw new Error("bad_fallback_urls");
+    const signed2 = await options.getUrls(first, count2);
+    if (signed2.length !== count2 || signed2.some((entry, i) => entry.part_number !== first + i || typeof entry.url !== "string")) throw new Error("bad_fallback_urls");
     let cursor = 0;
-    const workers = Array.from({ length: Math.min(CONCURRENCY, signed.length) }, async () => {
+    const workers = Array.from({ length: Math.min(CONCURRENCY, signed2.length) }, async () => {
       for (; ; ) {
         const at = cursor++;
-        if (at >= signed.length) return;
-        const entry = signed[at];
+        if (at >= signed2.length) return;
+        const entry = signed2[at];
         const partNumber = entry.part_number;
         const plainStart = (partNumber - 1) * meta.part_bytes;
         const plainEnd = Math.min(file.size, plainStart + meta.part_bytes);
@@ -2808,17 +3464,28 @@ import { x25519 as x255192 } from "@noble/curves/ed25519";
 var ASSIGNMENT_MAGIC = new Uint8Array([90, 67, 1]);
 var ASSIGNMENT_HEADER_BYTES = 3 + 1 + 32 + 24;
 function assignmentEnvelope(envelope) {
-  return envelope.length >= ASSIGNMENT_HEADER_BYTES + 16 && envelope[0] === ASSIGNMENT_MAGIC[0] && envelope[1] === ASSIGNMENT_MAGIC[1] && envelope[2] === ASSIGNMENT_MAGIC[2];
+  return envelope[0] === ASSIGNMENT_MAGIC[0] && envelope[1] === ASSIGNMENT_MAGIC[1] && (envelope[2] === 1 || envelope[2] === 2);
+}
+function validateAssignment(envelope) {
+  if (!assignmentEnvelope(envelope) || envelope.length !== ASSIGNMENT_HEADER_BYTES + 32 + 16 || envelope[3] < 1) throw new Error("bad envelope");
+}
+function assignmentKdf(shared, header) {
+  return hkdf512(shared, header[2] === 2 ? concatBytes(new TextEncoder().encode("ZAS-CHANNEL-ASSIGNMENT-ENVELOPE-V2"), header) : "ZAS-CHANNEL-ASSIGNMENT-ENVELOPE-V1", 32);
 }
 function openChannelAssignment(privateKey, envelope) {
-  if (!assignmentEnvelope(envelope)) throw new Error("bad envelope");
+  validateAssignment(envelope);
   const ephemeralPublic = envelope.slice(4, 36);
   const nonce = envelope.slice(36, 60);
   const shared = x255192.getSharedSecret(privateKey, ephemeralPublic);
-  const key = hkdf512(shared, "ZAS-CHANNEL-ASSIGNMENT-ENVELOPE-V1", 32);
-  const plain = xchacha20poly13052(key, nonce).decrypt(envelope.slice(60));
-  shared.fill(0);
-  key.fill(0);
+  const header = envelope.slice(0, ASSIGNMENT_HEADER_BYTES);
+  const key = assignmentKdf(shared, header);
+  let plain;
+  try {
+    plain = xchacha20poly13052(key, nonce, envelope[2] === 2 ? header : void 0).decrypt(envelope.slice(60));
+  } finally {
+    shared.fill(0);
+    key.fill(0);
+  }
   if (plain.length !== 32) throw new Error("bad channel key");
   return plain;
 }
@@ -2975,74 +3642,6 @@ function decryptChunk(key, nonce, ciphertext) {
   return xchacha20poly13053(key, nonce).decrypt(ciphertext);
 }
 
-// src/shared/oprf.ts
-import { RistrettoPoint } from "@noble/curves/ed25519";
-import { sha512 as sha5122 } from "@noble/hashes/sha2";
-import { invert, mod } from "@noble/curves/abstract/modular";
-var ORDER = 2n ** 252n + 27742317777372353535851937790883648493n;
-var te = new TextEncoder();
-function i2osp(value, length) {
-  const out = new Uint8Array(length);
-  for (let i = length - 1; i >= 0; i--) {
-    out[i] = value & 255;
-    value >>>= 8;
-  }
-  return out;
-}
-function expandMessageXmd(msg, dst, lenInBytes) {
-  const bInBytes = 64;
-  const rInBytes = 128;
-  const ell = Math.ceil(lenInBytes / bInBytes);
-  if (ell > 255) throw new Error("expand_message_xmd: ell too large");
-  const dstPrime = concatBytes(dst, i2osp(dst.length, 1));
-  const zPad = new Uint8Array(rInBytes);
-  const lIbStr = i2osp(lenInBytes, 2);
-  const msgPrime = concatBytes(zPad, msg, lIbStr, i2osp(0, 1), dstPrime);
-  const b0 = sha5122(msgPrime);
-  const b = [];
-  b[0] = sha5122(concatBytes(b0, i2osp(1, 1), dstPrime));
-  for (let i = 2; i <= ell; i++) {
-    const xored = new Uint8Array(bInBytes);
-    for (let j = 0; j < bInBytes; j++) xored[j] = b0[j] ^ b[i - 2][j];
-    b[i - 1] = sha5122(concatBytes(xored, i2osp(i, 1), dstPrime));
-  }
-  return concatBytes(...b).slice(0, lenInBytes);
-}
-function bytesToBigIntBE(bytes) {
-  let v = 0n;
-  for (const byte of bytes) v = v << 8n | BigInt(byte);
-  return v;
-}
-function hashToGroup(input) {
-  const dst = te.encode("HashToGroup-" + OPRF_CONTEXT);
-  const uniform = expandMessageXmd(input, dst, 64);
-  return RistrettoPoint.hashToCurve(uniform);
-}
-function randomScalar() {
-  const bytes = new Uint8Array(64);
-  crypto.getRandomValues(bytes);
-  const s = mod(bytesToBigIntBE(bytes), ORDER);
-  return s === 0n ? 1n : s;
-}
-function oprfBlind(input) {
-  const blind = randomScalar();
-  const P = hashToGroup(input);
-  return { blind, blindedElement: P.multiply(blind).toRawBytes() };
-}
-function oprfFinalize(input, blind, evaluatedElement) {
-  const E = RistrettoPoint.fromHex(evaluatedElement);
-  const N = E.multiply(invert(blind, ORDER));
-  const unblinded = N.toRawBytes();
-  const hashInput = concatBytes(
-    i2osp(input.length, 2),
-    input,
-    i2osp(unblinded.length, 2),
-    unblinded,
-    te.encode("Finalize")
-  );
-  return sha5122(hashInput);
-}
-
 // src/thumbnail.ts
 import { Jimp } from "jimp";
 var PREFIX = "data:image/jpeg;base64,";
@@ -3078,9 +3677,9 @@ var UPLOAD_CONCURRENCY = 4;
 var OPRF_PROBE_BATCH = 200;
 var MAX_REFUSALS_PER_SEND = 8;
 var NOTE_NAME_MAX = 40;
-function batches(items, size) {
+function batches(items, size2) {
   const out = [];
-  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+  for (let i = 0; i < items.length; i += size2) out.push(items.slice(i, i + size2));
   return out;
 }
 function sliceSize(ctx) {
@@ -3177,8 +3776,8 @@ function remember(ctx, key, receipt) {
   saveFingerprints(ctx.profile, { entries });
 }
 function sleep(ms) {
-  return new Promise((resolve2) => {
-    setTimeout(resolve2, ms);
+  return new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
   });
 }
 var CHUNK_PUT_RETRY_DELAY_MS = 1e3;
@@ -3232,12 +3831,12 @@ async function uploadChunk(ctx, enc) {
   }
   return commitChunk(ctx, enc.blobId, reserved.upload_id);
 }
-async function proveChunk(ctx, enc, challenge) {
-  const samples = challenge.offsets.map((o) => enc.ciphertext.slice(o, o + challenge.sample_len));
+async function proveChunk(ctx, enc, challenge2) {
+  const samples = challenge2.offsets.map((o) => enc.ciphertext.slice(o, o + challenge2.sample_len));
   try {
     const { cap } = await ctx.client.api("POST", `/blobs/${enc.blobId}/prove`, {
-      challenge_id: challenge.challenge_id,
-      mac: bytesToHex(hmacSha256(b64ToBytes(challenge.nonce), concatBytes(...samples)))
+      challenge_id: challenge2.challenge_id,
+      mac: bytesToHex(hmacSha256(b64ToBytes(challenge2.nonce), concatBytes(...samples)))
     });
     return cap;
   } catch (err) {
@@ -3358,16 +3957,23 @@ async function placeFile(ctx, bytes, onPhase) {
   const plains = [];
   for await (const piece of chunkStream([bytes])) plains.push(piece);
   const hashes = await Promise.all(plains.map((p) => blake3Bytes(p)));
-  const blinds = hashes.map((h) => oprfBlind(h));
+  const policy = await ctx.client.dedupePolicy();
+  const blinds = hashes.map((h) => blindDedupe(h, policy));
   const evaluated = [];
   for (const slice of batches(blinds.map((b) => bytesToB64(b.blindedElement)), sliceSize(ctx))) {
-    const answers = await ctx.client.oprfEvaluate(slice);
+    const answers = await ctx.client.oprfEvaluate(slice, policy);
     if (answers.length !== slice.length) throw new ZasError("oprf_failed", 0);
     for (const one of answers) evaluated.push(one);
   }
   onPhase?.("encrypting");
+  let outputs;
+  try {
+    outputs = hashes.map((hash, i) => oprfFinalize(hash, blinds[i].blind, b64ToBytes(evaluated[i])));
+  } catch {
+    throw new ZasError("oprf_failed", 0);
+  }
   const encs = await Promise.all(plains.map(
-    (plain, i) => encryptChunk(oprfFinalize(hashes[i], blinds[i].blind, b64ToBytes(evaluated[i])), plain)
+    (plain, i) => encryptChunk(outputs[i], plain)
   ));
   onPhase?.("uploading");
   return placeChunks(ctx, encs);
@@ -3551,8 +4157,8 @@ var SIGNALS_FOR_SENDER = {
   where: { fieldFilter: { field: { fieldPath: "for" }, op: "EQUAL", value: { stringValue: "sender" } } }
 };
 var stringField = (doc, key) => doc?.fields?.[key]?.stringValue;
-var defaultSleep2 = (ms) => new Promise((resolve2) => {
-  setTimeout(resolve2, ms);
+var defaultSleep2 = (ms) => new Promise((resolve4) => {
+  setTimeout(resolve4, ms);
 });
 var newDeviceToken = () => randomBytes(16).toString("base64url");
 var webrtc = null;
@@ -3646,8 +4252,8 @@ async function sendDirectMeasured(ctx, input, report2, deps = {}) {
   const turn = await fetchIce();
   report2("connecting");
   let resolveOutcome;
-  const outcome = new Promise((resolve2) => {
-    resolveOutcome = resolve2;
+  const outcome = new Promise((resolve4) => {
+    resolveOutcome = resolve4;
   });
   let diag;
   let path;
@@ -3834,25 +4440,79 @@ async function sendDirectFallback(...args) {
 // src/read.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import {
-  closeSync,
+  closeSync as closeSync2,
   existsSync as existsSync2,
   mkdirSync as mkdirSync2,
-  mkdtempSync,
-  openSync,
-  renameSync as renameSync2,
+  openSync as openSync2,
   rmdirSync,
-  statSync as statSync2,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeSync
 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+
+// src/destination.ts
+import { linkSync, mkdtempSync, statSync as statSync2, unlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, extname as extname2, join as join2 } from "node:path";
+import { basename as basename3, dirname, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "node:path";
+
+// src/shared/filename.ts
+function safeFileName(raw, fallback = "file") {
+  const clean = (value) => (value.split(/[\\/]/).pop() ?? "").replace(/[\x00-\x1f\x7f-\x9f<>:"|?*]/g, "_").trim().replace(/^\.+/, "").replace(/[. ]+$/, "");
+  let name = clean(typeof raw === "string" ? raw : "") || clean(fallback) || "file";
+  if (/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(name)) name = "_" + name;
+  if (name.length <= 180) return name;
+  const dot = name.lastIndexOf(".");
+  const ext = dot > 0 ? name.slice(dot) : "";
+  return ext.length > 1 && ext.length <= 17 ? name.slice(0, 180 - ext.length) + ext : name.slice(0, 180);
+}
+
+// src/destination.ts
+function contained(folder, name) {
+  const target = resolve2(folder, name);
+  const rel = relative(resolve2(folder), target);
+  if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    throw new ZasError("write_failed", 0);
+  }
+  return target;
+}
+function destinationOf(dest, name, fallback) {
+  const base = safeFileName(name, fallback);
+  if (dest === void 0) {
+    const created = mkdtempSync(join3(tmpdir(), "zas-agent-"));
+    return { target: contained(created, base), created };
+  }
+  if (statSync2(dest, { throwIfNoEntry: false })?.isDirectory()) return { target: contained(dest, base) };
+  const leaf = basename3(dest);
+  if (!leaf || leaf !== safeFileName(leaf)) throw new ZasError("write_failed", 0);
+  return { target: contained(dirname(dest), leaf) };
+}
+function publishDownload(tmp, target) {
+  const folder = dirname(target);
+  const base = basename3(target);
+  const dot = base.lastIndexOf(".");
+  const ext = dot > 0 && base.length - dot <= 17 ? base.slice(dot) : "";
+  const stem = ext ? base.slice(0, -ext.length) : base;
+  for (let n = 0; n <= 100; n++) {
+    const suffix = n ? ` (${n})` : "";
+    const name = stem.slice(0, 180 - suffix.length - ext.length) + suffix + ext;
+    const candidate = contained(folder, name);
+    try {
+      linkSync(tmp, candidate);
+    } catch (error) {
+      if (error.code === "EEXIST") continue;
+      throw error;
+    }
+    unlinkSync(tmp);
+    return candidate;
+  }
+  throw new ZasError("write_failed", 0);
+}
+
+// src/read.ts
 var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 50;
-var DOWNLOAD_PREFIX = "zas-agent-";
 var ID_SEGMENT = /^(?!__)[A-Za-z0-9_-]{1,128}$/;
 var MAX_CHUNKS = 8192;
-var MAX_DUPLICATES = 100;
 function stringOf(value) {
   return typeof value?.stringValue === "string" ? value.stringValue : void 0;
 }
@@ -3998,29 +4658,6 @@ async function fetchChunk(ctx, chunk) {
     throw new ZasError("invalid_cap", 403);
   }
 }
-function safeName(name, fallback) {
-  const base = (typeof name === "string" ? name : "").split(/[\\/]/).pop() ?? "";
-  return base.replace(/^\.+/, "").trim() || fallback;
-}
-function freeName(target) {
-  if (!existsSync2(target)) return target;
-  const ext = extname2(target);
-  const stem = target.slice(0, target.length - ext.length);
-  for (let n = 1; n <= MAX_DUPLICATES; n++) {
-    const candidate = `${stem} (${n})${ext}`;
-    if (!existsSync2(candidate)) return candidate;
-  }
-  throw new ZasError("write_failed", 0, target);
-}
-function destinationOf(dest, name, fallback) {
-  const base = safeName(name, fallback);
-  if (dest === void 0) {
-    const created = mkdtempSync(join2(tmpdir(), DOWNLOAD_PREFIX));
-    return { target: freeName(join2(created, base)), created };
-  }
-  const at = statSync2(dest, { throwIfNoEntry: false })?.isDirectory() ? join2(dest, base) : dest;
-  return { target: freeName(at) };
-}
 async function loadItem(ctx, channel, id) {
   const grant = await readGrant(ctx, channel);
   if (!ID_SEGMENT.test(id)) throw new ZasError("not_found", 404);
@@ -4061,20 +4698,20 @@ async function getItemMeasured(ctx, channel, id, dest) {
     const chosen = destinationOf(dest, manifest.name, row.id);
     target = chosen.target;
     created = chosen.created;
-    mkdirSync2(dirname(target), { recursive: true, mode: 448 });
+    mkdirSync2(dirname2(target), { recursive: true, mode: 448 });
     tmp = `${target}.${randomBytes2(6).toString("hex")}.tmp`;
-    fd = openSync(tmp, "wx", 384);
+    fd = openSync2(tmp, "wx", 384);
     for (const chunk of manifest.chunks) {
       const bytes = await fetchChunk(ctx, chunk);
       ctx.transferTelemetry?.mark("assembling");
       written += writeSync(fd, bytes);
       ctx.transferTelemetry?.progress(written);
     }
-    const size = typeof manifest.size === "number" ? manifest.size : 0;
-    if (size > 0 && written !== size) throw new ZasError("not_found", 404);
-    closeSync(fd);
+    const size2 = typeof manifest.size === "number" ? manifest.size : 0;
+    if (size2 > 0 && written !== size2) throw new ZasError("not_found", 404);
+    closeSync2(fd);
     fd = void 0;
-    renameSync2(tmp, target);
+    target = publishDownload(tmp, target);
   } catch (err) {
     if (err instanceof ZasError) throw err;
     const failure = err;
@@ -4084,11 +4721,11 @@ async function getItemMeasured(ctx, channel, id, dest) {
     throw new ZasError("network", 0, String(err?.message ?? err));
   } finally {
     if (fd !== void 0) try {
-      closeSync(fd);
+      closeSync2(fd);
     } catch {
     }
     if (tmp !== void 0 && existsSync2(tmp)) try {
-      unlinkSync(tmp);
+      unlinkSync2(tmp);
     } catch {
     }
     if (created !== void 0) try {
@@ -4235,16 +4872,15 @@ async function replaceFile(ctx, input, onPhase) {
 // src/receive.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import {
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   existsSync as existsSync3,
   mkdirSync as mkdirSync3,
-  openSync as openSync2,
-  renameSync as renameSync3,
+  openSync as openSync3,
   rmdirSync as rmdirSync2,
-  unlinkSync as unlinkSync2,
+  unlinkSync as unlinkSync3,
   writeSync as writeSync2
 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 var OFFER_WAIT_MS2 = 9.5 * 60 * 1e3;
 var OFFER_POLL_MS2 = 1e3;
 var SIGNAL_POLL_MS2 = 400;
@@ -4285,9 +4921,9 @@ var DiskSink = class {
       const chosen = destinationOf(this.dest, meta.name, this.fallbackName);
       this.target = chosen.target;
       this.created = chosen.created;
-      mkdirSync3(dirname2(this.target), { recursive: true, mode: 448 });
+      mkdirSync3(dirname3(this.target), { recursive: true, mode: 448 });
       this.tmp = `${this.target}.${randomBytes3(6).toString("hex")}.tmp`;
-      this.fd = openSync2(this.tmp, "wx", 384);
+      this.fd = openSync3(this.tmp, "wx", 384);
     } catch (error) {
       throw this.remember(error);
     }
@@ -4303,9 +4939,9 @@ var DiskSink = class {
   close() {
     try {
       if (this.fd === void 0) return;
-      closeSync2(this.fd);
+      closeSync3(this.fd);
       this.fd = void 0;
-      renameSync3(this.tmp, this.target);
+      this.target = publishDownload(this.tmp, this.target);
       this.tmp = void 0;
     } catch (error) {
       throw this.remember(error);
@@ -4316,14 +4952,14 @@ var DiskSink = class {
   abort() {
     if (this.fd !== void 0) {
       try {
-        closeSync2(this.fd);
+        closeSync3(this.fd);
       } catch {
       }
       this.fd = void 0;
     }
     if (this.tmp !== void 0) {
       if (existsSync3(this.tmp)) try {
-        unlinkSync2(this.tmp);
+        unlinkSync3(this.tmp);
       } catch {
       }
       this.tmp = void 0;
@@ -4342,6 +4978,7 @@ var DiskSink = class {
    *  also carries. */
   remember(error) {
     const failure = error;
+    if (error instanceof ZasError && error.code === "write_failed") this.failure = error;
     if (typeof failure?.syscall === "string" || typeof failure?.errno === "number") this.failure = failure;
     return error;
   }
@@ -4416,8 +5053,8 @@ async function receiveDirectMeasured(ctx, input, report2, deps = {}) {
   report2("connecting");
   const sink = new DiskSink(input.dest, offerId);
   let resolveOutcome;
-  const outcome = new Promise((resolve2) => {
-    resolveOutcome = resolve2;
+  const outcome = new Promise((resolve4) => {
+    resolveOutcome = resolve4;
   });
   let diag;
   let via;
@@ -4589,7 +5226,7 @@ async function receiveDirectFallback(...args) {
 }
 
 // src/jobs.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var DEFAULT_WAIT_MS = 6e4;
 var HISTORY = 50;
 var JobRunner = class {
@@ -4606,7 +5243,7 @@ var JobRunner = class {
   }
   start(kind, title, channel, work) {
     const job = {
-      id: randomUUID2(),
+      id: randomUUID4(),
       kind,
       title,
       channel,
@@ -4649,8 +5286,8 @@ var JobRunner = class {
     const settled = this.settled.get(job);
     if (!settled) return job;
     let timer;
-    const deadline = new Promise((resolve2) => {
-      timer = setTimeout(() => resolve2(job), this.waitMs);
+    const deadline = new Promise((resolve4) => {
+      timer = setTimeout(() => resolve4(job), this.waitMs);
     });
     try {
       return await Promise.race([settled, deadline]);
@@ -4666,16 +5303,351 @@ var JobRunner = class {
   }
 };
 
+// src/updates.ts
+import { spawn as spawn2, execFile } from "node:child_process";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync3, realpathSync, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { delimiter, dirname as dirname4, join as join4, resolve as resolve3 } from "node:path";
+import { fileURLToPath } from "node:url";
+var DAY = 24 * 60 * 60 * 1e3;
+var REGISTRY = "https://registry.npmjs.org";
+var RELEASE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function newerRelease(candidate, current) {
+  if (!RELEASE.test(candidate) || !RELEASE.test(current)) return false;
+  const a = candidate.split(".").map(BigInt), b = current.split(".").map(BigInt);
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return false;
+}
+function updatesEnabled() {
+  const env = process.env.ZAS_AGENT_AUTO_UPDATE;
+  if (env !== void 0) return env === "1";
+  return loadSettings()?.auto_update !== false;
+}
+function setUpdates(enabled) {
+  saveSettings({ ...loadSettings(), version: 1, auto_update: enabled });
+}
+function isReleaseInstall(version, selfUrl) {
+  if (!RELEASE.test(version)) return false;
+  const root = dirname4(dirname4(fileURLToPath(selfUrl)));
+  return !existsSync4(join4(root, ".git"));
+}
+var updateHome = () => resolve3(agentHome(), ".updates");
+function checkedDirectory(path) {
+  const stat = lstatSync2(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || process.platform !== "win32" && (stat.uid !== process.getuid?.() || (stat.mode & 18) !== 0)) {
+    throw new Error("Update directory must be owned by this user and not writable by others.");
+  }
+}
+async function prepareHome(signal) {
+  const home = updateHome();
+  mkdirSync4(home, { recursive: true, mode: 448 });
+  checkedDirectory(home);
+  if (process.platform === "win32") {
+    const script = `$ErrorActionPreference='Stop'; $dir=[Console]::In.ReadToEnd(); $sid=[Security.Principal.WindowsIdentity]::GetCurrent().User; $acl=New-Object Security.AccessControl.DirectorySecurity; $acl.SetOwner($sid); $acl.SetAccessRuleProtection($true,$false); $rule=New-Object Security.AccessControl.FileSystemAccessRule($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow'); $acl.AddAccessRule($rule); [IO.Directory]::SetAccessControl($dir,$acl)`;
+    await new Promise((done, fail) => {
+      const child = execFile(
+        join4(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+        ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+        { windowsHide: true, timeout: 15e3, signal, maxBuffer: 4096 },
+        (error) => error ? fail(new Error("Could not protect the update directory.")) : done()
+      );
+      child.stdin?.on("error", () => {
+      });
+      child.stdin?.end(home);
+    });
+  }
+  return home;
+}
+function readState() {
+  try {
+    checkedDirectory(updateHome());
+    const value = JSON.parse(readFileSync3(join4(updateHome(), "state.json"), "utf8"));
+    return value && typeof value === "object" ? value : {};
+  } catch {
+    return {};
+  }
+}
+function writeState(home, state) {
+  const tmp = join4(home, `state-${randomUUID5()}.tmp`);
+  try {
+    writeFileSync3(tmp, JSON.stringify(state), { flag: "wx", mode: 384 });
+    renameSync2(tmp, join4(home, "state.json"));
+  } finally {
+    rmSync3(tmp, { force: true });
+  }
+}
+function releaseEntry(ready) {
+  if (!ready || !RELEASE.test(ready.version) || typeof ready.directory !== "string" || !/^release-[a-f0-9-]{36}$/.test(ready.directory)) throw new Error("Invalid staged release.");
+  let dir = updateHome();
+  checkedDirectory(dir);
+  for (const part of [ready.directory, "node_modules", "zas-agent", "dist"]) {
+    dir = join4(dir, part);
+    checkedDirectory(dir);
+  }
+  const entry = join4(dir, "cli.js");
+  const stat = lstatSync2(entry);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Invalid release entry point.");
+  const pkg = JSON.parse(readFileSync3(join4(dirname4(dir), "package.json"), "utf8"));
+  if (pkg.name !== "zas-agent" || pkg.version !== ready.version) throw new Error("Release version does not match.");
+  return entry;
+}
+function stagedRelease(current) {
+  if (!updatesEnabled()) return null;
+  try {
+    const ready = readState().ready;
+    return ready && newerRelease(ready.version, current) ? { version: ready.version, entry: releaseEntry(ready) } : null;
+  } catch {
+    return null;
+  }
+}
+async function verifiedStagedRelease(current) {
+  const ready = stagedRelease(current);
+  if (!ready) return null;
+  try {
+    await verify(ready.entry, ready.version);
+    return ready;
+  } catch {
+    return null;
+  }
+}
+function updateLine(current) {
+  const ready = stagedRelease(current);
+  return `Updates: ${updatesEnabled() ? "on" : "off"}${process.env.ZAS_AGENT_AUTO_UPDATE !== void 0 ? " (ZAS_AGENT_AUTO_UPDATE)" : ""}. Running ${current}.` + (ready ? ` ${ready.version} ready; restart the agent to use it.` : "");
+}
+function npmCommand() {
+  const candidates = [
+    ...process.env.npm_execpath ? [process.env.npm_execpath] : [],
+    join4(dirname4(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"),
+    join4(dirname4(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    ...(process.env.PATH ?? "").split(delimiter).flatMap((dir) => [
+      join4(dir, "node_modules", "npm", "bin", "npm-cli.js"),
+      join4(dir, "npm")
+    ])
+  ];
+  for (const candidate of candidates) {
+    try {
+      const path = realpathSync(candidate);
+      if (path.endsWith(`${process.platform === "win32" ? "\\" : "/"}npm-cli.js`)) return [process.execPath, path];
+    } catch {
+    }
+  }
+  throw new Error("npm is required to install updates.");
+}
+function runUpdateCommand(command2, cwd, signal, timeout = 18e4) {
+  return new Promise((resolveResult, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Update canceled."));
+      return;
+    }
+    const child = spawn2(command2[0], command2.slice(1), {
+      cwd,
+      windowsHide: true,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    let output = "", canceled = false;
+    const stop = () => {
+      canceled = true;
+      if (!child.pid) return;
+      if (process.platform === "win32") {
+        const killer = spawn2(
+          join4(process.env.SystemRoot || "C:\\Windows", "System32", "taskkill.exe"),
+          ["/PID", String(child.pid), "/T", "/F"],
+          { windowsHide: true, stdio: "ignore" }
+        );
+        killer.on("error", () => {
+          child.kill();
+        });
+      } else {
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+          child.kill();
+        }
+      }
+    };
+    const timer = setTimeout(stop, timeout);
+    signal?.addEventListener("abort", stop, { once: true });
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", stop);
+    };
+    child.stdout.on("data", (chunk) => {
+      if (output.length < 4096) output += chunk.toString().slice(0, 4096 - output.length);
+    });
+    child.on("error", () => {
+      cleanup();
+      reject(new Error("Could not start the update command."));
+    });
+    child.on("close", (code) => {
+      cleanup();
+      if (code === 0 && !canceled) resolveResult(output.trim());
+      else reject(new Error(canceled ? "Update canceled or timed out." : "Update installation or verification failed."));
+    });
+  });
+}
+async function install(directory, version, signal) {
+  writeFileSync3(join4(directory, "package.json"), '{"private":true}', { mode: 384, flag: "wx" });
+  await runUpdateCommand([
+    ...npmCommand(),
+    "install",
+    "--prefix",
+    directory,
+    "--no-save",
+    "--no-audit",
+    "--no-fund",
+    "--engine-strict",
+    "--progress=false",
+    "--loglevel=error",
+    `--registry=${REGISTRY}`,
+    `zas-agent@${version}`
+  ], directory, signal);
+}
+async function verify(entry, version, signal) {
+  if (await runUpdateCommand([process.execPath, entry, "--version"], dirname4(entry), signal, 15e3) !== version) {
+    throw new Error("The staged agent did not report the expected version.");
+  }
+}
+async function checkForUpdate(current, force = false, signal, deps = {}) {
+  if (!RELEASE.test(current)) return "Development builds do not update themselves.";
+  if (!force && !updatesEnabled()) return "Automatic updates are off.";
+  const now = (deps.now ?? Date.now)();
+  let state = readState();
+  if (!force && typeof state.checked_at === "number" && now >= state.checked_at && now - state.checked_at < DAY) return "";
+  const home = await prepareHome(signal);
+  const lock = join4(home, "check.lock");
+  if (existsSync4(lock)) {
+    try {
+      const pid = Number(readFileSync3(lock, "utf8"));
+      if (Date.now() - lstatSync2(lock).mtimeMs < 10 * 6e4) {
+        if (!Number.isInteger(pid) || pid <= 0) return "Another update check is in progress.";
+        try {
+          process.kill(pid, 0);
+          return "Another update check is in progress.";
+        } catch (error) {
+          if (error.code !== "ESRCH") return "Another update check is in progress.";
+        }
+      }
+      rmSync3(lock);
+    } catch {
+      return "Another update check is in progress.";
+    }
+  }
+  try {
+    writeFileSync3(lock, String(process.pid), { flag: "wx", mode: 384 });
+  } catch {
+    return "Another update check is in progress.";
+  }
+  try {
+    state = readState();
+    writeState(home, { ...state, checked_at: now });
+    const response = await (deps.fetch ?? fetch)(`${REGISTRY}/zas-agent/latest`, {
+      redirect: "error",
+      signal: AbortSignal.any([AbortSignal.timeout(5e3), ...signal ? [signal] : []])
+    });
+    if (!response.ok) throw new Error("The npm registry is unavailable.");
+    const latest = await response.json();
+    if (latest?.name !== "zas-agent" || typeof latest.version !== "string" || !RELEASE.test(latest.version)) {
+      throw new Error("The npm registry returned an invalid release.");
+    }
+    if (!newerRelease(latest.version, current)) return `Already up to date (${current}).`;
+    if (state.ready && !newerRelease(latest.version, state.ready.version)) {
+      try {
+        const entry2 = releaseEntry(state.ready);
+        await (deps.verify ?? verify)(entry2, state.ready.version, signal);
+        return `${state.ready.version} is ready for the next launch.`;
+      } catch {
+      }
+    }
+    const ready = { version: latest.version, directory: `release-${randomUUID5()}` };
+    const directory = join4(home, ready.directory);
+    mkdirSync4(directory, { mode: 448 });
+    await (deps.install ?? install)(directory, ready.version, signal);
+    const entry = releaseEntry(ready);
+    await (deps.verify ?? verify)(entry, ready.version, signal);
+    if (signal?.aborted) throw new Error("Update canceled.");
+    writeState(home, { checked_at: now, ready });
+    return `${ready.version} is ready. Restart the agent to use it.${updatesEnabled() ? "" : " First enable updates with: zas-agent updates on"}`;
+  } finally {
+    rmSync3(lock, { force: true });
+  }
+}
+function startUpdateChecks(current, log) {
+  const controller = new AbortController();
+  let checking = false;
+  const check = async () => {
+    if (checking || controller.signal.aborted) return;
+    checking = true;
+    try {
+      const result = await checkForUpdate(current, false, controller.signal);
+      if (result.includes("ready")) log(`Zas update: ${result}`);
+    } catch {
+      if (!controller.signal.aborted) log("Zas update check failed; continuing with the current version.");
+    } finally {
+      checking = false;
+    }
+  };
+  const first = setTimeout(() => void check(), 5e3).unref();
+  const interval = setInterval(() => void check(), DAY).unref();
+  const terminate = () => {
+    stop();
+    process.kill(process.pid, "SIGTERM");
+  };
+  const interrupt = () => {
+    stop();
+    process.kill(process.pid, "SIGINT");
+  };
+  const stop = () => {
+    clearTimeout(first);
+    clearInterval(interval);
+    controller.abort();
+    process.stdin.removeListener("end", stop);
+    process.removeListener("exit", stop);
+    process.removeListener("SIGTERM", terminate);
+    process.removeListener("SIGINT", interrupt);
+  };
+  process.stdin.once("end", stop);
+  process.once("exit", stop);
+  process.once("SIGTERM", terminate);
+  process.once("SIGINT", interrupt);
+  return stop;
+}
+function launchStaged(entry, argv) {
+  return new Promise((done) => {
+    const child = spawn2(process.execPath, [entry, ...argv], { stdio: "inherit", windowsHide: true });
+    const term = () => {
+      child.kill("SIGTERM");
+    };
+    const interrupt = () => {
+      child.kill("SIGINT");
+    };
+    process.once("SIGTERM", term);
+    process.once("SIGINT", interrupt);
+    const cleanup = () => {
+      process.removeListener("SIGTERM", term);
+      process.removeListener("SIGINT", interrupt);
+    };
+    child.once("error", () => {
+      cleanup();
+      done(1);
+    });
+    child.once("exit", (code, signal) => {
+      cleanup();
+      done(code ?? (signal === "SIGINT" ? 130 : 143));
+    });
+  });
+}
+
 // src/server.ts
 function agentVersion() {
-  return true ? "0.10.0" : "0.0.0-dev";
+  return true ? "0.11.0" : "0.0.0-dev";
 }
 var AGENT_CUE = " The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.";
 var PAIR_ANNOUNCE_MS = 15e3;
 var NOTE_LABEL_MAX = 40;
 var EXPIRES_IN_DAYS = z.number().int().min(MIN_EXPIRY_DAYS).optional().describe("How many whole days the item should live for, at least 1. Leave it out for the account's normal life (5 days). It can only shorten an item, never extend one: a longer request is clamped to what the plan grants. Worth setting for output that is stale tomorrow, such as a build log or a test run.");
-var delay = (ms) => new Promise((resolve2) => {
-  setTimeout(resolve2, ms);
+var delay = (ms) => new Promise((resolve4) => {
+  setTimeout(resolve4, ms);
 });
 function rightsOf(grant) {
   if (grant.pending) return "waiting for the channel\u2019s owner";
@@ -4765,6 +5737,8 @@ ${formatDirectDiagLines(job.diag).join("\n")}`) };
       });
       return text2([
         `Paired as \u201C${c.identity.name}\u201D (${c.identity.kind}) with account ${c.identity.owner_uid}.`,
+        `Secret storage: ${secretStorage(profile)}.`,
+        updateLine(agentVersion()),
         grants.length > 0 ? "Channels:" : "No channels: the owner has not granted access to any yet.",
         ...lines,
         `${packageName()} ${agentVersion()} \xB7 profile ${profile}`,
@@ -4797,8 +5771,8 @@ ${formatDirectDiagLines(job.diag).join("\n")}`) };
         },
         // The person cannot type into this process; the coding agent relays
         // the code as an argument, and this promise is what it answers.
-        askCode: () => new Promise((resolve2) => {
-          state.ask = resolve2;
+        askCode: () => new Promise((resolve4) => {
+          state.ask = resolve4;
         }),
         ...process.env.ZAS_NO_OPEN === "1" ? {} : { open: openInBrowser }
       }).then(
@@ -5084,7 +6058,17 @@ function parseArgs(argv) {
     const inline = arg.startsWith("--") && eq > 0 ? arg.slice(eq + 1) : void 0;
     const take = () => inline !== void 0 ? inline : argv[++i] ?? "";
     if (name === "pair") parsed.command = "pair";
-    else if (name === "telemetry") {
+    else if (name === "update") parsed.command = "update";
+    else if (name === "updates") {
+      parsed.command = "updates";
+      const next = argv[i + 1];
+      if (next === "on" || next === "off") {
+        parsed.updates = next;
+        i++;
+      } else if (next !== void 0 && !next.startsWith("--")) {
+        return { ...parsed, command: "invalid", message: `Unknown update setting "${next}". Use "on" or "off".` };
+      }
+    } else if (name === "telemetry") {
       parsed.command = "telemetry";
       const next = argv[i + 1];
       if (next === "on" || next === "off") {
@@ -5117,6 +6101,8 @@ var USAGE = [
   "  zas-agent pair [--profile <name>]           pair this agent with a Zas account",
   "                 [--kind claude_code|codex|other] [--host <name>] [--no-open]",
   "  zas-agent telemetry [on|off]                say what this machine reports, or change it",
+  "  zas-agent updates [on|off]                  show or change automatic updates",
+  "  zas-agent update                            stage the latest release for the next launch",
   "  zas-agent --version"
 ].join("\n");
 function noticeOnServe(log) {
@@ -5150,6 +6136,38 @@ async function main(argv, log = (l) => console.error(l)) {
     log(args.telemetry === "off" ? `Nothing is sent. Turn it on again with: npx -y ${packageName()} telemetry on` : TELEMETRY_NOTICE);
     return 0;
   }
+  if (args.command === "updates") {
+    if (args.updates) setUpdates(args.updates === "on");
+    log(updateLine(agentVersion()));
+    log("Updates take effect on the next launch. Active transfers keep running.");
+    return 0;
+  }
+  const released = isReleaseInstall(agentVersion(), import.meta.url);
+  if (args.command === "update") {
+    if (!released) {
+      log("Development checkouts do not update themselves.");
+      return 0;
+    }
+    try {
+      log(await checkForUpdate(agentVersion(), true));
+      return 0;
+    } catch {
+      log("Update failed. The current agent is unchanged; check your network and npm installation, then retry.");
+      return 1;
+    }
+  }
+  if (released) {
+    const ready = await verifiedStagedRelease(agentVersion());
+    if (ready) return launchStaged(ready.entry, argv);
+  }
+  try {
+    defaultEndpoints();
+    loadIdentity(args.profile);
+    loadPending(args.profile);
+  } catch (error) {
+    log(humanSentence(error instanceof ZasError ? error : new ZasError("internal", 0)));
+    return 1;
+  }
   if (args.command === "pair") {
     log(TELEMETRY_NOTICE);
     log("");
@@ -5157,8 +6175,8 @@ async function main(argv, log = (l) => console.error(l)) {
     let rl = null;
     const askCode = process.stdin.isTTY ? () => {
       rl ??= createInterface({ input: process.stdin, output: process.stderr });
-      return new Promise((resolve2) => {
-        rl.question("Type the code shown in the browser: ", resolve2);
+      return new Promise((resolve4) => {
+        rl.question("Type the code shown in the browser: ", resolve4);
       });
     } : void 0;
     const noOpen = args.noOpen === true || process.env.ZAS_NO_OPEN === "1";
@@ -5183,12 +6201,21 @@ async function main(argv, log = (l) => console.error(l)) {
     return 0;
   }
   noticeOnServe(log);
-  await buildServer(args.profile).connect(new StdioServerTransport());
+  const transport = new StdioServerTransport();
+  await buildServer(args.profile).connect(transport);
+  if (released) {
+    const stop = startUpdateChecks(agentVersion(), log);
+    const onclose = transport.onclose;
+    transport.onclose = () => {
+      stop();
+      onclose?.();
+    };
+  }
   return 0;
 }
 var real = (path) => {
   try {
-    return realpathSync(path);
+    return realpathSync2(path);
   } catch {
     return "";
   }
@@ -5199,7 +6226,7 @@ function isInvokedDirectly(argv1, selfUrl) {
   if (entry === "") return false;
   let self = "";
   try {
-    self = real(fileURLToPath(selfUrl));
+    self = real(fileURLToPath2(selfUrl));
   } catch {
     return false;
   }