zas-agent 0.3.0 → 0.5.0

package/dist/cli.js

@@ -118,7 +118,12 @@ var RENAMES = {
   file_too_large: "file_too_big",
   read_only: "send_forbidden",
   unknown_channel: "grant_missing",
-  no_account: "grant_missing"
+  no_account: "grant_missing",
+  // The Directo routes' words. `not_live` is an exchange that ended under the
+  // agent (expired, or cancelled from the receiving side); `direct_too_big`
+  // is the plan's Directo ceiling.
+  not_live: "direct_cancelled",
+  direct_too_big: "file_too_big"
 };
 var ZasError = class extends Error {
   constructor(code, status, message, retryAfterMs, serverCode) {
@@ -161,6 +166,15 @@ var SENTENCES = {
   read_forbidden: "This agent cannot read that channel.",
   direct_mode: "That channel is in Directo mode. Use zas_send_direct.",
   not_direct_mode: "That channel is not in Directo mode. Use zas_send_file.",
+  not_claimed: "Nobody received the file within ten minutes. The offer was withdrawn.",
+  no_offer: "Nobody offered a file through Directo while this call waited. Ask the owner to press Send Direct, then call again.",
+  offer_taken: "Another device received that file first.",
+  direct_cancelled: "The offer was cancelled from the other side.",
+  direct_failed: "The Directo transfer failed ({path}). Ask the owner before you use zas_send_direct_fallback or zas_receive_direct_fallback.",
+  direct_not_failed: "That job is not a Directo transfer that failed in flight.",
+  file_changed: "The file changed since the Directo offer. Send it again.",
+  webrtc_unavailable: "The WebRTC engine (node-datachannel) could not be loaded on this machine.",
+  fallback_unavailable: "Reliable delivery is not available right now. Try again later.",
   key_stale: "The channel key changed. The owner refreshes it by opening Zas.",
   quota_exceeded: "The account reached its storage limit.",
   rate_limited: "Too many sends in a row. Wait a moment.",
@@ -550,6 +564,17 @@ var ZasClient = class _ZasClient {
     if (!Array.isArray(parsed)) return [];
     return parsed.filter((row) => !!row && typeof row === "object" && "document" in row).map((row) => row.document);
   }
+  /** Firestore REST get of one document, `null` when it is not there. The
+   *  rules decide what an agent may read; here that is its own Directo offer,
+   *  which an offer's sender may read without a grant on the channel. */
+  async firestoreGet(path) {
+    const base = _ZasClient.firestoreBase(this.identity.firestore_project);
+    const res = await this.authed(`${base}/${path}`, "GET", void 0, {});
+    const parsed = await readBody2(res);
+    if (res.status === 404) return null;
+    if (!res.ok) throw errorFromResponse(res.status, parsed);
+    return parsed;
+  }
   /** The web app's public config value. It identifies the project, it is not a secret. */
   static apiKey() {
     return process.env.ZAS_FIREBASE_API_KEY || "AIzaSyAiZbAPrxH7EKaJftJoGcEVEL0h6rAVcvE";
@@ -797,6 +822,11 @@ async function runPair(opts) {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 
+// src/direct.ts
+import { randomBytes } from "node:crypto";
+import { openAsBlob } from "node:fs";
+import { basename as basename2 } from "node:path";
+
 // src/shared/manifest.ts
 import { xchacha20poly1305 } from "@noble/ciphers/chacha";
 
@@ -861,6 +891,8 @@ function openSealed(key, sealed) {
   }
   return xchacha20poly1305(key, sealed.slice(0, 24)).decrypt(sealed.slice(24));
 }
+var sealRaw = sealBytes;
+var openRaw = openSealed;
 function sealManifest(channelKey, manifest, version = KEY_VERSION_LEGACY) {
   return sealBytes(channelKey, version, new TextEncoder().encode(JSON.stringify(manifest)));
 }
@@ -873,6 +905,852 @@ function decryptChannelName(channelKey, sealed) {
   return new TextDecoder().decode(openSealed(channelKey, sealed));
 }
 
+// src/shared/direct.ts
+var DIRECT_OFFER_TTL_MS = 10 * 60 * 1e3;
+var DIRECT_CLAIMED_TTL_MS = 6 * 60 * 60 * 1e3;
+var DIRECT_DONE_TTL_MS = 15 * 1e3;
+var DIRECT_FILE_MAX_BYTES = 20 * 1024 * 1024 * 1024;
+var DIRECT_FREE_FILE_MAX_BYTES = 10 * 1024 * 1024 * 1024;
+var DIRECT_ANON_FILE_MAX_BYTES = 5 * 1024 * 1024 * 1024;
+var DIRECT_ENTERPRISE_FILE_MAX_BYTES = 100 * 1024 * 1024 * 1024;
+var DIRECT_CHUNK_BYTES = 64 * 1024;
+var DIRECT_BUFFERED_HIGH = 8 * 1024 * 1024;
+var DIRECT_RECEIVE_WINDOW_BYTES = 4 * 1024 * 1024;
+var DIRECT_MEMORY_SINK_MAX_BYTES = 128 * 1024 * 1024;
+var DIRECT_FALLBACK_PART_BYTES = 16 * 1024 * 1024;
+var DIRECT_FALLBACK_TAG_BYTES = 16;
+var DIRECT_FALLBACK_TTL_MS = 24 * 60 * 60 * 1e3;
+function directFallbackPartCount(size) {
+  if (!Number.isSafeInteger(size) || size < 0) throw new Error("bad_size");
+  return Math.max(1, Math.ceil(size / DIRECT_FALLBACK_PART_BYTES));
+}
+function directFallbackCipherSize(size) {
+  return size + directFallbackPartCount(size) * DIRECT_FALLBACK_TAG_BYTES;
+}
+var DIRECT_CONNECT_TIMEOUT_MS = 30 * 1e3;
+var DIRECT_STALL_GRACE_MS = 5 * 1e3;
+var DIRECT_SIGNAL_WAIT_MS = 90 * 1e3;
+
+// src/shared/direct-engine.ts
+import { createSHA256 } from "hash-wasm";
+
+// src/shared/direct-protocol.ts
+var FRAME_META = 1;
+var FRAME_CHUNK = 2;
+var FRAME_DONE = 3;
+var FRAME_ABORT = 4;
+var FRAME_CREDIT = 5;
+function encodeMeta(meta) {
+  const body = new TextEncoder().encode(JSON.stringify(meta));
+  const frame = new Uint8Array(1 + body.length);
+  frame[0] = FRAME_META;
+  frame.set(body, 1);
+  return frame;
+}
+function encodeChunk(bytes) {
+  if (bytes.length > DIRECT_CHUNK_BYTES - 1) throw new Error("chunk_too_big");
+  const frame = new Uint8Array(1 + bytes.length);
+  frame[0] = FRAME_CHUNK;
+  frame.set(bytes, 1);
+  return frame;
+}
+function encodeDone(digest) {
+  if (!digest) return new Uint8Array([FRAME_DONE]);
+  const body = new TextEncoder().encode(JSON.stringify(digest));
+  const frame = new Uint8Array(1 + body.length);
+  frame[0] = FRAME_DONE;
+  frame.set(body, 1);
+  return frame;
+}
+function encodeCredit(received) {
+  if (!Number.isSafeInteger(received) || received < 0) throw new Error("bad_credit");
+  const body = new TextEncoder().encode(String(received));
+  const frame = new Uint8Array(1 + body.length);
+  frame[0] = FRAME_CREDIT;
+  frame.set(body, 1);
+  return frame;
+}
+var DONE_FRAME = encodeDone();
+var ABORT_FRAME = new Uint8Array([FRAME_ABORT]);
+function parseFrame(data) {
+  const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
+  if (bytes.length === 0) throw new Error("empty_frame");
+  const payload = bytes.subarray(1);
+  switch (bytes[0]) {
+    case FRAME_META: {
+      const meta = JSON.parse(new TextDecoder().decode(payload));
+      if (typeof meta.name !== "string" || typeof meta.size !== "number") {
+        throw new Error("bad_meta");
+      }
+      return { type: "meta", meta };
+    }
+    case FRAME_CHUNK:
+      return { type: "chunk", payload };
+    case FRAME_DONE: {
+      if (payload.length === 0) return { type: "done" };
+      const digest = JSON.parse(new TextDecoder().decode(payload));
+      if (!Number.isSafeInteger(digest.size) || digest.size < 0 || typeof digest.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(digest.sha256)) throw new Error("bad_digest");
+      return { type: "done", digest };
+    }
+    case FRAME_ABORT:
+      return { type: "abort" };
+    case FRAME_CREDIT: {
+      const received = Number(new TextDecoder().decode(payload));
+      if (!Number.isSafeInteger(received) || received < 0) throw new Error("bad_credit");
+      return { type: "credit", received };
+    }
+    default:
+      throw new Error("unknown_frame");
+  }
+}
+
+// src/shared/direct-engine.ts
+var DIRECT_ICE = [
+  { urls: ["stun:stun.l.google.com:19302", "stun:stun.cloudflare.com:3478"] }
+];
+function candType(candidate) {
+  const m = /\styp\s+(\S+)/.exec(candidate?.candidate ?? "");
+  return m ? m[1] : "other";
+}
+function countCand(diag, side, c) {
+  if (!c) return;
+  const t = candType(c);
+  if (t === "host") diag[side === "local" ? "localHost" : "remoteHost"]++;
+  else if (t === "srflx" || t === "prflx") diag[side === "local" ? "localSrflx" : "remoteSrflx"]++;
+  else if (t === "relay") diag[side === "local" ? "localRelay" : "remoteRelay"]++;
+}
+function countTurnUrls(servers) {
+  let n = 0;
+  for (const server of servers ?? []) {
+    const urls = typeof server.urls === "string" ? [server.urls] : server.urls;
+    for (const url of urls ?? []) {
+      if (/^turns?:/i.test(url)) n++;
+    }
+    const legacy = server.url;
+    if (typeof legacy === "string" && /^turns?:/i.test(legacy)) n++;
+  }
+  return n;
+}
+function pairFromStats(stats) {
+  let pair;
+  stats.forEach((s) => {
+    if (s.type === "candidate-pair" && s.state === "succeeded" && (s.nominated || s.selected)) {
+      pair = s;
+    }
+  });
+  if (!pair?.localCandidateId || !pair.remoteCandidateId) return void 0;
+  const local = stats.get(pair.localCandidateId);
+  const remote = stats.get(pair.remoteCandidateId);
+  if (!local?.candidateType || !remote?.candidateType) return void 0;
+  return { local: local.candidateType, remote: remote.candidateType };
+}
+function pathOf(pair) {
+  if (pair.local === "relay" || pair.remote === "relay") return "relay";
+  return pair.local === "host" && pair.remote === "host" ? "lan" : "wan";
+}
+function session(ice, onPhase, onDiag, iceTransportPolicy = "all") {
+  const initialIce = ice ?? DIRECT_ICE;
+  const pc = new RTCPeerConnection({
+    iceServers: initialIce,
+    iceTransportPolicy
+  });
+  let phase = "connecting";
+  let disconnectTimer;
+  let restartTimer;
+  let stallState = "idle";
+  const startedAt = Date.now();
+  const diag = {
+    reason: "",
+    ms: 0,
+    iceState: "",
+    gatherState: "",
+    hadRemoteDesc: false,
+    localHost: 0,
+    localSrflx: 0,
+    localRelay: 0,
+    remoteHost: 0,
+    remoteSrflx: 0,
+    remoteRelay: 0,
+    turnUrlsSupplied: countTurnUrls(initialIce),
+    turnUrlsConfigured: 0,
+    bytes: 0,
+    restarts: 0
+  };
+  const cleanup = () => {
+    clearTimeout(waitTimer);
+    clearTimeout(connectTimer);
+    clearTimeout(disconnectTimer);
+    clearTimeout(restartTimer);
+    pc.onicecandidate = null;
+    pc.oniceconnectionstatechange = null;
+    pc.close();
+  };
+  const setPhase = (p) => {
+    if (phase === "done" || phase === "failed") return;
+    phase = p;
+    if (p === "done" || p === "failed") {
+      diag.ms = Date.now() - startedAt;
+      diag.iceState = String(pc.iceConnectionState ?? "");
+      diag.gatherState = String(pc.iceGatheringState ?? "");
+      diag.hadRemoteDesc = !!pc.remoteDescription;
+      diag.turnUrlsConfigured = countTurnUrls(pc.getConfiguration().iceServers);
+      onDiag?.(diag);
+      onPhase(p);
+      cleanup();
+      return;
+    }
+    onPhase(p);
+  };
+  const fail = (reason) => {
+    if (phase === "done" || phase === "failed") return;
+    if (!diag.reason) diag.reason = reason;
+    setPhase("failed");
+  };
+  const waitTimer = setTimeout(() => fail("peer_silent"), DIRECT_SIGNAL_WAIT_MS);
+  let connectTimer;
+  let heard = false;
+  const signaled = () => {
+    if (heard) return;
+    heard = true;
+    clearTimeout(waitTimer);
+    connectTimer = setTimeout(() => fail("connect_timeout"), DIRECT_CONNECT_TIMEOUT_MS);
+  };
+  let onStall;
+  let stallWindowMs = DIRECT_CONNECT_TIMEOUT_MS;
+  const stalled = () => {
+    if (phase === "done" || phase === "failed") return;
+    clearTimeout(disconnectTimer);
+    if (stallState === "restarting") return;
+    if (diag.msConnect === void 0 || !onStall) {
+      fail("disconnected");
+      return;
+    }
+    stallState = "restarting";
+    diag.restarts++;
+    clearTimeout(restartTimer);
+    restartTimer = setTimeout(() => fail("disconnected"), stallWindowMs);
+    onStall();
+  };
+  pc.oniceconnectionstatechange = () => {
+    const s = pc.iceConnectionState;
+    if (s === "failed") {
+      if (diag.msConnect !== void 0 && onStall) stalled();
+      else fail("ice_failed");
+    }
+    if (s === "disconnected" && stallState === "idle") {
+      stallState = "grace";
+      disconnectTimer = setTimeout(stalled, DIRECT_STALL_GRACE_MS);
+    }
+    if (s === "connected" || s === "completed") {
+      clearTimeout(disconnectTimer);
+      clearTimeout(restartTimer);
+      stallState = "idle";
+    }
+  };
+  return {
+    pc,
+    diag,
+    setPhase,
+    fail,
+    cleanup,
+    signaled,
+    connected: () => {
+      clearTimeout(waitTimer);
+      clearTimeout(connectTimer);
+      if (diag.msConnect === void 0) diag.msConnect = Date.now() - startedAt;
+    },
+    isTerminal: () => phase === "done" || phase === "failed",
+    setStall: (fn, windowMs) => {
+      onStall = fn;
+      stallWindowMs = windowMs;
+    },
+    setIceServers: (iceServers) => {
+      diag.turnUrlsSupplied = countTurnUrls(iceServers);
+      pc.setConfiguration({ iceServers });
+    }
+  };
+}
+function signalPlumbing(pc, send, onSendError, diag) {
+  let localGeneration = 1;
+  let remoteGeneration = 0;
+  let remoteReady = false;
+  const pendingByGeneration = /* @__PURE__ */ new Map();
+  let pendingLegacy = [];
+  pc.onicecandidate = (e) => {
+    const c = e.candidate;
+    countCand(diag, "local", c);
+    void send({
+      kind: "ice",
+      candidate: c ? c.toJSON ? c.toJSON() : c : null,
+      protocol: 2,
+      generation: localGeneration
+    }).catch(onSendError);
+  };
+  const apply = (candidate) => {
+    void pc.addIceCandidate(candidate ?? void 0).catch(() => void 0);
+  };
+  const applyIce = (candidate, generation) => {
+    countCand(diag, "remote", candidate);
+    const normalized = candidate ?? null;
+    if (generation === void 0) {
+      if (remoteReady) apply(normalized);
+      else pendingLegacy.push(normalized);
+      return;
+    }
+    if (generation < remoteGeneration) return;
+    if (remoteReady && generation === remoteGeneration) {
+      apply(normalized);
+      return;
+    }
+    const queued = pendingByGeneration.get(generation) ?? [];
+    queued.push(normalized);
+    pendingByGeneration.set(generation, queued);
+  };
+  const expectRemoteGeneration = (generation) => {
+    remoteGeneration = generation;
+    remoteReady = false;
+  };
+  const remoteDescriptionSet = (generation) => {
+    remoteGeneration = generation;
+    remoteReady = true;
+    const queued = pendingByGeneration.get(generation) ?? [];
+    pendingByGeneration.delete(generation);
+    const legacy = pendingLegacy;
+    pendingLegacy = [];
+    queued.forEach(apply);
+    legacy.forEach(apply);
+  };
+  return {
+    applyIce,
+    expectRemoteGeneration,
+    remoteDescriptionSet,
+    setLocalGeneration: (generation) => void (localGeneration = generation)
+  };
+}
+function startSender(opts) {
+  const s = session(opts.ice, opts.onPhase, opts.onDiag, opts.iceTransportPolicy);
+  opts.onPhase("connecting");
+  const { pc } = s;
+  const plumbing = signalPlumbing(pc, opts.send, () => s.fail("signal_send"), s.diag);
+  let generation = 1;
+  let peerProtocol = 1;
+  s.setStall(() => {
+    void (async () => {
+      generation++;
+      plumbing.setLocalGeneration(generation);
+      plumbing.expectRemoteGeneration(generation);
+      if (opts.refreshIce) {
+        const iceServers = await opts.refreshIce();
+        s.setIceServers(iceServers);
+      }
+      pc.restartIce?.();
+      const offer = await pc.createOffer({ iceRestart: true });
+      await pc.setLocalDescription(offer);
+      await opts.send({ kind: "offer", sdp: offer.sdp, protocol: 2, generation });
+    })().catch(() => s.fail("signaling"));
+  }, DIRECT_CONNECT_TIMEOUT_MS);
+  const dc = pc.createDataChannel("zas-direct", { ordered: true });
+  dc.binaryType = "arraybuffer";
+  dc.bufferedAmountLowThreshold = DIRECT_BUFFERED_HIGH / 8;
+  const waitLow = () => new Promise((resolve2) => {
+    const done = () => {
+      dc.removeEventListener("bufferedamountlow", done);
+      resolve2();
+    };
+    dc.addEventListener("bufferedamountlow", done);
+  });
+  let persisted = 0;
+  const creditWaiters = [];
+  const wakeCredits = () => {
+    for (let i = creditWaiters.length - 1; i >= 0; i--) {
+      if (s.isTerminal() || persisted >= creditWaiters[i].target) {
+        creditWaiters.splice(i, 1)[0].resolve();
+      }
+    }
+  };
+  const waitPersisted = (target) => {
+    if (peerProtocol < 2 || persisted >= target || s.isTerminal()) return Promise.resolve();
+    return new Promise((resolve2) => creditWaiters.push({ target, resolve: resolve2 }));
+  };
+  const pump = async () => {
+    const meta = {
+      name: opts.file.name ?? opts.name ?? "zas",
+      size: opts.file.size,
+      mime: opts.file.type || "application/octet-stream",
+      ...opts.label !== void 0 ? { label: opts.label } : {}
+    };
+    dc.send(encodeMeta(meta));
+    const hasher = await createSHA256();
+    let sent = 0;
+    for (let off = 0; off < opts.file.size; off += DIRECT_RECEIVE_WINDOW_BYTES) {
+      const window = new Uint8Array(
+        await opts.file.slice(
+          off,
+          Math.min(off + DIRECT_RECEIVE_WINDOW_BYTES, opts.file.size)
+        ).arrayBuffer()
+      );
+      hasher.update(window);
+      if (s.isTerminal()) return;
+      for (let at = 0; at < window.length; at += DIRECT_CHUNK_BYTES - 1) {
+        if (dc.bufferedAmount > DIRECT_BUFFERED_HIGH) await waitLow();
+        if (s.isTerminal()) return;
+        const slice = window.subarray(at, Math.min(at + DIRECT_CHUNK_BYTES - 1, window.length));
+        dc.send(encodeChunk(slice));
+        sent += slice.length;
+        s.diag.bytes = sent;
+        opts.onProgress?.(sent, opts.file.size);
+      }
+      await waitPersisted(sent);
+      if (s.isTerminal()) return;
+    }
+    dc.send(encodeDone({ size: sent, sha256: hasher.digest() }));
+  };
+  dc.onopen = () => {
+    s.connected();
+    s.setPhase("flight");
+    void pc.getStats().then((stats) => {
+      const pair = pairFromStats(stats);
+      if (!pair) return;
+      s.diag.pairLocal = pair.local;
+      s.diag.pairRemote = pair.remote;
+      opts.onPath?.(pathOf(pair));
+    }).catch(() => void 0);
+    void pump().catch(() => s.fail("transfer"));
+  };
+  dc.onmessage = (e) => {
+    try {
+      const frame = parseFrame(e.data);
+      if (frame.type === "done") s.setPhase("done");
+      if (frame.type === "abort") s.fail("peer_abort");
+      if (frame.type === "credit") {
+        if (frame.received < persisted || frame.received > opts.file.size) throw new Error("bad_credit");
+        persisted = frame.received;
+        wakeCredits();
+      }
+    } catch {
+      s.fail("protocol");
+    }
+  };
+  dc.onclose = () => {
+    wakeCredits();
+    if (!s.isTerminal()) s.fail("peer_closed");
+  };
+  void (async () => {
+    const offer = await pc.createOffer();
+    await pc.setLocalDescription(offer);
+    plumbing.setLocalGeneration(generation);
+    plumbing.expectRemoteGeneration(generation);
+    await opts.send({ kind: "offer", sdp: offer.sdp, protocol: 2, generation });
+  })().catch(() => s.fail("signaling"));
+  return {
+    accept: (msg) => {
+      if (s.isTerminal()) return;
+      s.signaled();
+      if (msg.kind === "answer" && pc.signalingState === "have-local-offer") {
+        const answerGeneration = msg.generation ?? generation;
+        if (msg.generation !== void 0 && answerGeneration !== generation) return;
+        peerProtocol = msg.protocol === 2 ? 2 : 1;
+        plumbing.expectRemoteGeneration(answerGeneration);
+        void pc.setRemoteDescription({ type: "answer", sdp: msg.sdp }).then(() => plumbing.remoteDescriptionSet(answerGeneration)).catch(() => s.fail("signaling"));
+      }
+      if (msg.kind === "ice") plumbing.applyIce(msg.candidate, msg.generation);
+    },
+    close: () => {
+      if (!s.isTerminal() && dc.readyState === "open") {
+        try {
+          dc.send(ABORT_FRAME);
+        } catch {
+        }
+      }
+      wakeCredits();
+      s.cleanup();
+    }
+  };
+}
+function startReceiver(opts) {
+  let sinkRef = null;
+  const s = session(
+    opts.ice,
+    (p) => {
+      if (p === "failed") {
+        try {
+          sinkRef?.abort?.();
+        } catch {
+        }
+        sinkRef = null;
+      }
+      opts.onPhase(p);
+    },
+    opts.onDiag,
+    opts.iceTransportPolicy
+  );
+  s.setStall(() => void 0, DIRECT_CONNECT_TIMEOUT_MS * 2);
+  opts.onPhase("connecting");
+  const { pc } = s;
+  const plumbing = signalPlumbing(pc, opts.send, () => s.fail("signal_send"), s.diag);
+  let protocol = 1;
+  let generation = 1;
+  let dc;
+  let pipeline = null;
+  let total = 0;
+  let got = 0;
+  let queued = 0;
+  let nextCredit = DIRECT_RECEIVE_WINDOW_BYTES;
+  let hasherPromise = null;
+  let finished = false;
+  pc.ondatachannel = (e) => {
+    dc = e.channel;
+    dc.binaryType = "arraybuffer";
+    dc.onopen = () => {
+      s.connected();
+      s.setPhase("flight");
+      void pc.getStats().then((stats) => {
+        const pair = pairFromStats(stats);
+        if (!pair) return;
+        s.diag.pairLocal = pair.local;
+        s.diag.pairRemote = pair.remote;
+        opts.onPath?.(pathOf(pair));
+      }).catch(() => void 0);
+    };
+    dc.onmessage = (e2) => {
+      try {
+        const frame = parseFrame(e2.data);
+        if (frame.type === "meta") {
+          if (pipeline || !Number.isSafeInteger(frame.meta.size) || frame.meta.size < 0 || frame.meta.size > DIRECT_FILE_MAX_BYTES || typeof frame.meta.name !== "string" || frame.meta.name.length === 0 || typeof frame.meta.mime !== "string") {
+            try {
+              dc?.send(ABORT_FRAME);
+            } catch {
+            }
+            s.fail(frame.meta.size > DIRECT_FILE_MAX_BYTES ? "too_big" : "protocol");
+            return;
+          }
+          if (opts.expectedMeta && (frame.meta.name !== opts.expectedMeta.name || frame.meta.size !== opts.expectedMeta.size || frame.meta.mime !== opts.expectedMeta.mime)) {
+            dc?.send(ABORT_FRAME);
+            s.fail("protocol");
+            return;
+          }
+          total = frame.meta.size;
+          hasherPromise = createSHA256();
+          opts.onMeta?.(frame.meta);
+          pipeline = opts.sink(frame.meta).then((sink) => {
+            sinkRef = sink;
+            return sink;
+          });
+          pipeline.catch(() => s.fail("sink"));
+        } else if (frame.type === "chunk") {
+          if (!pipeline || finished) throw new Error("chunk_before_meta");
+          queued += frame.payload.length;
+          if (queued > total) throw new Error("too_many_bytes");
+          pipeline = pipeline.then(async (sink) => {
+            await sink.write(frame.payload);
+            const hasher = await hasherPromise;
+            hasher.update(frame.payload);
+            got += frame.payload.length;
+            s.diag.bytes = got;
+            opts.onProgress?.(got, total);
+            if (protocol >= 2 && (got >= nextCredit || got === total)) {
+              dc?.send(encodeCredit(got));
+              while (nextCredit <= got) nextCredit += DIRECT_RECEIVE_WINDOW_BYTES;
+            }
+            return sink;
+          });
+          pipeline.catch(() => s.fail("sink"));
+        } else if (frame.type === "done") {
+          if (!pipeline || finished) throw new Error("done_before_meta");
+          finished = true;
+          void pipeline.then(async (sink) => {
+            if (got !== total || queued !== total) throw new Error("size_mismatch");
+            const sha2563 = (await hasherPromise).digest();
+            if (protocol >= 2 && (!frame.digest || frame.digest.size !== got || frame.digest.sha256 !== sha2563)) throw new Error("digest_mismatch");
+            await sink.close();
+            dc?.send(DONE_FRAME);
+            s.setPhase("done");
+          }).catch(() => s.fail("integrity"));
+        } else if (frame.type === "abort") {
+          s.fail("peer_abort");
+        }
+      } catch {
+        s.fail("protocol");
+      }
+    };
+    dc.onclose = () => {
+      if (!s.isTerminal()) s.fail("peer_closed");
+    };
+  };
+  return {
+    accept: (msg) => {
+      if (s.isTerminal()) return;
+      s.signaled();
+      if (msg.kind === "offer" && (!pc.remoteDescription || pc.signalingState === "stable")) {
+        const isRestart = !!pc.remoteDescription;
+        const offerGeneration = msg.generation ?? (isRestart ? generation + 1 : 1);
+        if (isRestart && msg.generation !== void 0 && offerGeneration <= generation) return;
+        generation = offerGeneration;
+        protocol = msg.protocol === 2 ? 2 : 1;
+        plumbing.expectRemoteGeneration(generation);
+        plumbing.setLocalGeneration(generation);
+        void (async () => {
+          if (isRestart && opts.refreshIce) {
+            const iceServers = await opts.refreshIce();
+            s.setIceServers(iceServers);
+          }
+          await pc.setRemoteDescription({ type: "offer", sdp: msg.sdp });
+          plumbing.remoteDescriptionSet(generation);
+          const answer = await pc.createAnswer();
+          await pc.setLocalDescription(answer);
+          await opts.send({ kind: "answer", sdp: answer.sdp, protocol: 2, generation });
+        })().catch(() => s.fail("signaling"));
+      }
+      if (msg.kind === "ice") plumbing.applyIce(msg.candidate, msg.generation);
+    },
+    close: () => {
+      if (!s.isTerminal() && dc?.readyState === "open") {
+        try {
+          dc.send(ABORT_FRAME);
+        } catch {
+        }
+      }
+      sinkRef?.abort?.();
+      s.cleanup();
+    }
+  };
+}
+
+// src/shared/direct-fallback.ts
+function createFallbackMeta(file) {
+  const key = crypto.getRandomValues(new Uint8Array(32));
+  const nonce = crypto.getRandomValues(new Uint8Array(8));
+  return {
+    v: 1,
+    name: file.name,
+    size: file.size,
+    mime: file.type,
+    key_b64: bytesToB64(key),
+    nonce_b64: bytesToB64(nonce),
+    part_bytes: DIRECT_FALLBACK_PART_BYTES,
+    tag_bytes: DIRECT_FALLBACK_TAG_BYTES,
+    part_count: directFallbackPartCount(file.size),
+    cipher_size: directFallbackCipherSize(file.size)
+  };
+}
+function fallbackMetaOf(value) {
+  const meta = value;
+  if (!meta || meta.v !== 1 || typeof meta.name !== "string" || meta.name.length === 0 || typeof meta.mime !== "string" || !Number.isSafeInteger(meta.size) || (meta.size ?? -1) < 0 || typeof meta.key_b64 !== "string" || typeof meta.nonce_b64 !== "string" || meta.part_bytes !== DIRECT_FALLBACK_PART_BYTES || meta.tag_bytes !== DIRECT_FALLBACK_TAG_BYTES || meta.part_count !== directFallbackPartCount(meta.size) || meta.cipher_size !== directFallbackCipherSize(meta.size)) throw new Error("bad_fallback_meta");
+  let key;
+  let nonce;
+  try {
+    key = b64ToBytes(meta.key_b64);
+    nonce = b64ToBytes(meta.nonce_b64);
+  } catch {
+    throw new Error("bad_fallback_meta");
+  }
+  if (key.length !== 32 || nonce.length !== 8) throw new Error("bad_fallback_meta");
+  return meta;
+}
+function partPlainBytes(meta, partNumber) {
+  if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > meta.part_count) {
+    throw new Error("bad_fallback_part");
+  }
+  if (partNumber < meta.part_count) return meta.part_bytes;
+  return meta.size - meta.part_bytes * (meta.part_count - 1);
+}
+function fallbackCipherPartBytes(meta, partNumber) {
+  return partPlainBytes(meta, partNumber) + meta.tag_bytes;
+}
+function fallbackCipherOffset(meta, partNumber) {
+  if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > meta.part_count) {
+    throw new Error("bad_fallback_part");
+  }
+  return (partNumber - 1) * (meta.part_bytes + meta.tag_bytes);
+}
+function ivFor(meta, partNumber) {
+  const iv = new Uint8Array(12);
+  iv.set(b64ToBytes(meta.nonce_b64), 0);
+  new DataView(iv.buffer).setUint32(8, partNumber, false);
+  return iv;
+}
+function aadFor(offerId, partNumber, plainBytes) {
+  return new TextEncoder().encode(
+    `zas-direct-fallback-v1\0${offerId}\0${partNumber}\0${plainBytes}`
+  );
+}
+async function aesKey(meta) {
+  return crypto.subtle.importKey(
+    "raw",
+    b64ToBytes(meta.key_b64),
+    { name: "AES-GCM" },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptFallbackPart(meta, offerId, partNumber, plain, key) {
+  const expected = partPlainBytes(meta, partNumber);
+  if (plain.length !== expected) throw new Error("bad_fallback_part_size");
+  const out = await crypto.subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv: ivFor(meta, partNumber),
+      additionalData: aadFor(offerId, partNumber, plain.length),
+      tagLength: 128
+    },
+    key ?? await aesKey(meta),
+    plain
+  );
+  return new Uint8Array(out);
+}
+async function decryptFallbackPart(meta, offerId, partNumber, cipher, key) {
+  const plainBytes = partPlainBytes(meta, partNumber);
+  if (cipher.length !== plainBytes + meta.tag_bytes) throw new Error("bad_fallback_part_size");
+  const out = await crypto.subtle.decrypt(
+    {
+      name: "AES-GCM",
+      iv: ivFor(meta, partNumber),
+      additionalData: aadFor(offerId, partNumber, plainBytes),
+      tagLength: 128
+    },
+    key ?? await aesKey(meta),
+    cipher
+  );
+  return new Uint8Array(out);
+}
+var RETRIES = 3;
+var URL_BATCH = 16;
+var CONCURRENCY = 2;
+function aborted(signal) {
+  if (signal?.aborted) throw new DOMException("Aborted", "AbortError");
+}
+var pause = (ms, signal) => new Promise((resolve2, reject) => {
+  const timer = setTimeout(resolve2, ms);
+  signal?.addEventListener("abort", () => {
+    clearTimeout(timer);
+    reject(new DOMException("Aborted", "AbortError"));
+  }, { once: true });
+});
+async function uploadFallback(options) {
+  const { file, offerId, meta, signal } = options;
+  fallbackMetaOf(meta);
+  if (file.size !== meta.size || file.name !== meta.name) throw new Error("fallback_file_changed");
+  const key = await aesKey(meta);
+  const completed = [];
+  const partProgress = /* @__PURE__ */ new Map();
+  const report = () => options.onProgress?.(
+    Math.min(meta.cipher_size, [...partProgress.values()].reduce((sum, value) => sum + value, 0)),
+    meta.cipher_size
+  );
+  for (let first = 1; first <= meta.part_count; first += URL_BATCH) {
+    aborted(signal);
+    const count = Math.min(URL_BATCH, meta.part_count - first + 1);
+    const signed = await options.getUrls(first, count);
+    if (signed.length !== count || signed.some((entry, i) => entry.part_number !== first + i || typeof entry.url !== "string")) throw new Error("bad_fallback_urls");
+    let cursor = 0;
+    const workers = Array.from({ length: Math.min(CONCURRENCY, signed.length) }, async () => {
+      for (; ; ) {
+        const at = cursor++;
+        if (at >= signed.length) return;
+        const entry = signed[at];
+        const partNumber = entry.part_number;
+        const plainStart = (partNumber - 1) * meta.part_bytes;
+        const plainEnd = Math.min(file.size, plainStart + meta.part_bytes);
+        const plain = new Uint8Array(await file.slice(plainStart, plainEnd).arrayBuffer());
+        const cipher = await encryptFallbackPart(meta, offerId, partNumber, plain, key);
+        let etag = "";
+        let lastError;
+        for (let attempt = 0; attempt < RETRIES; attempt++) {
+          aborted(signal);
+          partProgress.set(partNumber, 0);
+          report();
+          try {
+            etag = await options.put(entry.url, cipher, signal, (loaded) => {
+              partProgress.set(partNumber, loaded);
+              report();
+            });
+            break;
+          } catch (error) {
+            lastError = error;
+            if (error.name === "AbortError") throw error;
+            if (attempt + 1 < RETRIES) {
+              options.onRetry?.();
+              await pause(250 * 2 ** attempt, signal);
+            }
+          }
+        }
+        if (!etag) throw lastError ?? new Error("fallback_put_failed");
+        completed.push({ partNumber, etag });
+      }
+    });
+    await Promise.all(workers);
+  }
+  return completed.sort((a, b) => a.partNumber - b.partNumber);
+}
+async function downloadFallback(options) {
+  const { meta, offerId, sink, signal } = options;
+  fallbackMetaOf(meta);
+  const key = await aesKey(meta);
+  const fetcher = options.fetcher ?? fetch;
+  let partNumber = 1;
+  let plainDone = 0;
+  let attempts = 0;
+  try {
+    while (partNumber <= meta.part_count) {
+      aborted(signal);
+      const cipherOffset = fallbackCipherOffset(meta, partNumber);
+      try {
+        const url = await options.getUrl();
+        const response = await fetcher(url, {
+          headers: cipherOffset > 0 ? { Range: `bytes=${cipherOffset}-` } : void 0,
+          signal
+        });
+        if (!response.ok || cipherOffset > 0 && response.status !== 206 || !response.body) {
+          throw new Error(`fallback_get_${response.status}`);
+        }
+        const reader = response.body.getReader();
+        const held = [];
+        let heldBytes = 0;
+        while (partNumber <= meta.part_count) {
+          const needed = fallbackCipherPartBytes(meta, partNumber);
+          while (heldBytes < needed) {
+            const next = await reader.read();
+            if (next.done) throw new Error("fallback_get_short");
+            held.push(next.value);
+            heldBytes += next.value.length;
+          }
+          const cipher = new Uint8Array(needed);
+          let copied = 0;
+          while (copied < needed) {
+            const chunk = held.shift();
+            const take = Math.min(chunk.length, needed - copied);
+            cipher.set(chunk.subarray(0, take), copied);
+            copied += take;
+            heldBytes -= take;
+            if (take < chunk.length) held.unshift(chunk.subarray(take));
+          }
+          const plain = await decryptFallbackPart(meta, offerId, partNumber, cipher, key);
+          await sink.write(plain);
+          plainDone += plain.length;
+          partNumber++;
+          attempts = 0;
+          options.onProgress?.(plainDone, meta.size);
+        }
+        if (heldBytes > 0) throw new Error("fallback_get_long");
+      } catch (error) {
+        if (error.name === "AbortError") throw error;
+        if (error.name === "OperationError" || error.message === "fallback_get_long") {
+          throw error;
+        }
+        attempts++;
+        if (attempts >= RETRIES) throw error;
+        options.onRetry?.();
+        await pause(250 * 2 ** (attempts - 1), signal);
+      }
+    }
+    if (plainDone !== meta.size) throw new Error("fallback_plain_size");
+    await sink.close();
+  } catch (error) {
+    sink.abort?.();
+    throw error;
+  }
+}
+
 // src/shared/sharedchannel.ts
 import { xchacha20poly1305 as xchacha20poly13052 } from "@noble/ciphers/chacha";
 import { x25519 as x255192 } from "@noble/curves/ed25519";
@@ -943,97 +1821,83 @@ function resolveChannel(identity, grants, channel) {
   throw new ZasError("grant_missing", 0);
 }
 
-// src/jobs.ts
-import { randomUUID } from "node:crypto";
-var DEFAULT_WAIT_MS = 6e4;
-var HISTORY = 50;
-var JobRunner = class {
-  now;
-  waitMs;
-  /** Newest first, and trimmed. */
-  jobs = [];
-  /** Keyed on the job object, not its id, so a caller holding a job that has
-   *  already aged out of the list can still wait for it to finish. */
-  settled = /* @__PURE__ */ new WeakMap();
-  constructor(opts = {}) {
-    this.now = opts.now ?? (() => Date.now());
-    this.waitMs = opts.waitMs ?? DEFAULT_WAIT_MS;
-  }
-  start(kind, title, channel, work) {
-    const job = {
-      id: randomUUID(),
-      kind,
-      title,
-      channel,
-      started_at: this.now(),
-      phase: null,
-      status: "running"
-    };
-    this.jobs.unshift(job);
-    this.jobs.length = Math.min(this.jobs.length, HISTORY);
-    const report = (phase) => {
-      if (job.status === "running") job.phase = phase;
-    };
-    this.settled.set(job, work(report).then(
-      (result) => {
-        job.status = "done";
-        job.result = result;
-        return job;
-      },
-      (error) => {
-        job.status = "failed";
-        job.error = error instanceof ZasError ? {
-          code: error.code,
-          status: error.status,
-          sentence: humanSentence(error),
-          message: error.message,
-          ...error.retryAfterMs !== void 0 ? { retryAfterMs: error.retryAfterMs } : {},
-          ...error.serverCode !== void 0 ? { serverCode: error.serverCode } : {}
-        } : { code: "upload_failed", status: 0, sentence: humanSentence(new ZasError("upload_failed", 0)) };
-        return job;
+// src/send.ts
+import { promises as fsp } from "node:fs";
+import { basename, extname } from "node:path";
+
+// src/shared/chunker.ts
+import { blake3 as blake32 } from "hash-wasm";
+var gearPromise = null;
+function gearTable() {
+  if (!gearPromise) {
+    gearPromise = (async () => {
+      const table = new Uint32Array(256);
+      for (let i = 0; i < 256; i++) {
+        const hex = await blake32(new TextEncoder().encode(GEAR_SEED + i), 256);
+        table[i] = parseInt(hex.slice(0, 8), 16) >>> 0;
       }
-    ));
-    return job;
+      return table;
+    })();
   }
-  /** Resolves when the work settles, or when the wait runs out — the same job
-   *  object either way, so the caller reads `status` rather than guessing. */
-  async wait(job) {
-    const settled = this.settled.get(job);
-    if (!settled) return job;
-    let timer;
-    const deadline = new Promise((resolve2) => {
-      timer = setTimeout(() => resolve2(job), this.waitMs);
-    });
-    try {
-      return await Promise.race([settled, deadline]);
-    } finally {
-      clearTimeout(timer);
-    }
+  return gearPromise;
+}
+var AVG = 1 << CHUNK_AVG_BITS;
+var MASK_S = (1 << CHUNK_AVG_BITS + 2) - 1;
+var MASK_L = (1 << CHUNK_AVG_BITS - 2) - 1;
+function cutPoint(buf, gear, eof) {
+  const len = Math.min(buf.length, CHUNK_MAX);
+  if (buf.length < CHUNK_MAX && !eof) {
+    if (buf.length <= CHUNK_MIN) return null;
   }
-  list() {
-    return this.jobs.slice(0, HISTORY);
+  if (eof && len <= CHUNK_MIN) return len > 0 ? len : null;
+  let hash = 0;
+  const normal = Math.min(AVG, len);
+  let i = CHUNK_MIN;
+  for (; i < normal; i++) {
+    hash = (hash << 1 >>> 0) + gear[buf[i]] >>> 0;
+    if ((hash & MASK_S) === 0) return i + 1;
   }
-  get(id) {
-    return this.jobs.find((job) => job.id === id);
+  for (; i < len; i++) {
+    hash = (hash << 1 >>> 0) + gear[buf[i]] >>> 0;
+    if ((hash & MASK_L) === 0) return i + 1;
   }
-};
-
-// src/read.ts
-import { randomBytes } from "node:crypto";
-import {
-  closeSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  mkdtempSync,
-  openSync,
-  renameSync as renameSync2,
-  rmdirSync,
-  statSync,
-  unlinkSync,
-  writeSync
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, extname, join as join2 } from "node:path";
+  if (len === CHUNK_MAX) return CHUNK_MAX;
+  if (eof) return len > 0 ? len : null;
+  return null;
+}
+async function* chunkStream(source) {
+  const gear = await gearTable();
+  let pending = [];
+  let pendingLen = 0;
+  const compact = () => {
+    if (pending.length === 1) return pending[0];
+    const merged = new Uint8Array(pendingLen);
+    let off = 0;
+    for (const p of pending) {
+      merged.set(p, off);
+      off += p.length;
+    }
+    pending = [merged];
+    return merged;
+  };
+  const drain = function* (eof) {
+    while (pendingLen > 0) {
+      const buf = compact();
+      const cut = cutPoint(buf, gear, eof);
+      if (cut === null) return;
+      yield buf.slice(0, cut);
+      pending = cut < buf.length ? [buf.slice(cut)] : [];
+      pendingLen = buf.length - cut;
+    }
+  };
+  for await (const piece of source) {
+    if (piece.length === 0) continue;
+    pending.push(piece);
+    pendingLen += piece.length;
+    if (pendingLen >= CHUNK_MAX) yield* drain(false);
+  }
+  yield* drain(true);
+}
 
 // src/shared/mle.ts
 import { xchacha20poly1305 as xchacha20poly13053 } from "@noble/ciphers/chacha";
@@ -1053,830 +1917,1417 @@ function decryptChunk(key, nonce, ciphertext) {
   return xchacha20poly13053(key, nonce).decrypt(ciphertext);
 }
 
-// src/read.ts
-var DEFAULT_LIMIT = 20;
-var MAX_LIMIT = 50;
-var DOWNLOAD_PREFIX = "zas-agent-";
-var ID_SEGMENT = /^(?!__)[A-Za-z0-9_-]{1,128}$/;
-var MAX_CHUNKS = 8192;
-var MAX_DUPLICATES = 100;
-function stringOf(value) {
-  return typeof value?.stringValue === "string" ? value.stringValue : void 0;
-}
-function timeOf(value) {
-  const parsed = typeof value?.timestampValue === "string" ? Date.parse(value.timestampValue) : NaN;
-  return Number.isFinite(parsed) ? parsed : null;
-}
-function rowOf(doc) {
-  const document = doc ?? {};
-  const name = typeof document.name === "string" ? document.name : "";
-  const fields = document.fields && typeof document.fields === "object" ? document.fields : {};
-  return {
-    id: name.slice(name.lastIndexOf("/") + 1),
-    manifestEnc: stringOf(fields.manifest_enc),
-    agent: stringOf(fields.agent),
-    createdAt: timeOf(fields.created_at),
-    expiresAt: timeOf(fields.expires_at),
-    bar: fields.bar?.booleanValue === true
-  };
-}
-function readable(row) {
-  if (!row.id || row.bar || !row.manifestEnc) return false;
-  return row.expiresAt === null || row.expiresAt > Date.now();
-}
-function openFor(channelKey, row) {
-  try {
-    return openManifest(channelKey, b64ToBytes(row.manifestEnc));
-  } catch {
-    return null;
+// src/shared/oprf.ts
+import { RistrettoPoint } from "@noble/curves/ed25519";
+import { sha512 as sha5122 } from "@noble/hashes/sha2";
+import { invert, mod } from "@noble/curves/abstract/modular";
+var ORDER = 2n ** 252n + 27742317777372353535851937790883648493n;
+var te = new TextEncoder();
+function i2osp(value, length) {
+  const out = new Uint8Array(length);
+  for (let i = length - 1; i >= 0; i--) {
+    out[i] = value & 255;
+    value >>>= 8;
   }
+  return out;
 }
-function summaryOf(row, manifest) {
-  const kind = manifest.kind === "text" ? "text" : "file";
-  const name = typeof manifest.name === "string" ? manifest.name : "";
-  return {
-    id: row.id,
-    kind,
-    // Absence means "show the file name": the sender chose no title.
-    title: manifest.title ?? name,
-    name,
-    mime: typeof manifest.mime === "string" ? manifest.mime : "application/octet-stream",
-    size: typeof manifest.size === "number" ? manifest.size : 0,
-    // The sealed time is the sender's own; the row's is the server's, and it
-    // only answers for a manifest that carries none.
-    created_at: typeof manifest.created_at === "string" && manifest.created_at ? manifest.created_at : row.createdAt !== null ? new Date(row.createdAt).toISOString() : "",
-    by_agent: row.agent !== void 0,
-    ...kind === "text" ? { text: manifest.text ?? "" } : {}
-  };
-}
-async function readGrant(ctx, channel) {
-  const grant = resolveChannel(ctx.identity, await grantsFor(ctx.client, ctx.profile), channel);
-  if (!grant.read) throw new ZasError("read_forbidden", 403);
-  return grant;
-}
-function nameFrom(channelKey, grant) {
-  try {
-    return decryptChannelName(channelKey, b64ToBytes(grant.name_enc));
-  } catch {
-    throw new ZasError("key_stale", 0);
+function expandMessageXmd(msg, dst, lenInBytes) {
+  const bInBytes = 64;
+  const rInBytes = 128;
+  const ell = Math.ceil(lenInBytes / bInBytes);
+  if (ell > 255) throw new Error("expand_message_xmd: ell too large");
+  const dstPrime = concatBytes(dst, i2osp(dst.length, 1));
+  const zPad = new Uint8Array(rInBytes);
+  const lIbStr = i2osp(lenInBytes, 2);
+  const msgPrime = concatBytes(zPad, msg, lIbStr, i2osp(0, 1), dstPrime);
+  const b0 = sha5122(msgPrime);
+  const b = [];
+  b[0] = sha5122(concatBytes(b0, i2osp(1, 1), dstPrime));
+  for (let i = 2; i <= ell; i++) {
+    const xored = new Uint8Array(bInBytes);
+    for (let j = 0; j < bInBytes; j++) xored[j] = b0[j] ^ b[i - 2][j];
+    b[i - 1] = sha5122(concatBytes(xored, i2osp(i, 1), dstPrime));
   }
+  return concatBytes(...b).slice(0, lenInBytes);
 }
-function linksParent(identity, grant) {
-  return `accounts/${identity.owner_uid}/channels/${grant.channel_id}`;
+function bytesToBigIntBE(bytes) {
+  let v = 0n;
+  for (const byte of bytes) v = v << 8n | BigInt(byte);
+  return v;
 }
-function linkPath(identity, grant, id) {
-  return `projects/${identity.firestore_project}/databases/(default)/documents/${linksParent(identity, grant)}/links/${id}`;
+function hashToGroup(input) {
+  const dst = te.encode("HashToGroup-" + OPRF_CONTEXT);
+  const uniform = expandMessageXmd(input, dst, 64);
+  return RistrettoPoint.hashToCurve(uniform);
 }
-async function queryLinks(ctx, grant, query) {
-  try {
-    return await ctx.client.firestoreRunQuery(linksParent(ctx.identity, grant), query);
-  } catch (err) {
-    if (err instanceof ZasError && err.status === 403) throw new ZasError("read_forbidden", 403);
-    throw err;
-  }
+function randomScalar() {
+  const bytes = new Uint8Array(64);
+  crypto.getRandomValues(bytes);
+  const s = mod(bytesToBigIntBE(bytes), ORDER);
+  return s === 0n ? 1n : s;
 }
-function clampLimit(limit) {
-  if (limit === void 0 || !Number.isFinite(limit)) return DEFAULT_LIMIT;
-  return Math.min(MAX_LIMIT, Math.max(1, Math.trunc(limit)));
+function oprfBlind(input) {
+  const blind = randomScalar();
+  const P = hashToGroup(input);
+  return { blind, blindedElement: P.multiply(blind).toRawBytes() };
 }
-async function listItems(ctx, channel, limit) {
-  const grant = await readGrant(ctx, channel);
-  const channelKey = channelKeyOf(ctx.identity, grant);
-  const docs = await queryLinks(ctx, grant, {
-    from: [{ collectionId: "links" }],
-    orderBy: [{ field: { fieldPath: "created_at" }, direction: "DESCENDING" }],
-    limit: clampLimit(limit)
-  });
-  const items = [];
-  for (const doc of docs) {
-    const row = rowOf(doc);
-    if (!readable(row)) continue;
-    const manifest = openFor(channelKey, row);
-    if (!manifest) continue;
-    items.push(summaryOf(row, manifest));
-  }
-  return {
-    channel_id: grant.channel_id,
-    channel_name: nameFrom(channelKey, grant),
-    items
-  };
+function oprfFinalize(input, blind, evaluatedElement) {
+  const E = RistrettoPoint.fromHex(evaluatedElement);
+  const N = E.multiply(invert(blind, ORDER));
+  const unblinded = N.toRawBytes();
+  const hashInput = concatBytes(
+    i2osp(input.length, 2),
+    input,
+    i2osp(unblinded.length, 2),
+    unblinded,
+    te.encode("Finalize")
+  );
+  return sha5122(hashInput);
 }
-function redeemFailure(status) {
-  if (status === 429) return new ZasError("rate_limited", 429);
-  if (status >= 500) return new ZasError("network", status);
-  return new ZasError("invalid_cap", 403);
+
+// src/thumbnail.ts
+import { Jimp } from "jimp";
+var PREFIX = "data:image/jpeg;base64,";
+var READABLE = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/bmp", "image/gif", "image/tiff"]);
+var QUALITY_STEPS = [85, 70, 55, 40];
+var MAX_INPUT_BYTES = 80 * 1024 * 1024;
+function thumbnailable(mime) {
+  return READABLE.has(mime.split(";")[0].trim().toLowerCase());
 }
-async function fetchChunk(ctx, chunk) {
-  if (typeof chunk.cap !== "string" || chunk.cap === "") throw new ZasError("invalid_cap", 403);
-  let headers = {};
+async function thumbnailFor(bytes, mime) {
+  if (!thumbnailable(mime)) return void 0;
+  if (bytes.length > MAX_INPUT_BYTES) return void 0;
   try {
-    headers = { Authorization: `Bearer ${await ctx.client.idToken()}` };
+    const image = await Jimp.read(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength));
+    if (Math.max(image.width, image.height) > THUMBNAIL_MAX_EDGE) {
+      image.scaleToFit({ w: THUMBNAIL_MAX_EDGE, h: THUMBNAIL_MAX_EDGE });
+    }
+    for (const quality of QUALITY_STEPS) {
+      const jpeg = await image.getBuffer("image/jpeg", { quality });
+      const uri = PREFIX + Buffer.from(jpeg).toString("base64");
+      if (uri.length <= THUMBNAIL_MAX_BYTES) return uri;
+    }
+    return void 0;
   } catch {
-    headers = {};
-  }
-  let url;
-  try {
-    const redeemed = await apiPublic(
-      ctx.identity.api_base,
-      "POST",
-      "/v1/blobs/redeem",
-      { cap: chunk.cap },
-      headers
-    );
-    url = typeof redeemed.url === "string" ? redeemed.url : "";
-  } catch (err) {
-    if (err instanceof ZasError) throw redeemFailure(err.status);
-    throw err;
+    return void 0;
   }
-  if (url === "") throw new ZasError("invalid_cap", 403);
-  const res = await fetch(url);
-  if (!res.ok) {
-    await res.body?.cancel().catch(() => void 0);
-    throw res.status >= 500 ? new ZasError("network", res.status) : new ZasError("invalid_cap", 403);
-  }
-  const ciphertext = new Uint8Array(await res.arrayBuffer());
-  try {
-    return decryptChunk(b64ToBytes(chunk.key), b64ToBytes(chunk.nonce), ciphertext);
-  } catch {
-    throw new ZasError("invalid_cap", 403);
+}
+
+// src/send.ts
+var MAX_FILE_BYTES = 5 * 1024 * 1024 * 1024;
+var REPLAY_WINDOW_MS = 10 * 60 * 1e3;
+var UPLOAD_CONCURRENCY = 4;
+var OPRF_PROBE_BATCH = 200;
+var MAX_REFUSALS_PER_SEND = 8;
+var NOTE_NAME_MAX = 40;
+function batches(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+  return out;
+}
+function sliceSize(ctx) {
+  return Math.max(1, Math.floor(ctx.batch ?? OPRF_PROBE_BATCH));
+}
+var MIME = new Map(Object.entries({
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  png: "image/png",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  svg: "image/svg+xml",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  json: "application/json",
+  html: "text/html",
+  zip: "application/zip",
+  gz: "application/gzip",
+  tar: "application/x-tar",
+  mp4: "video/mp4",
+  mov: "video/quicktime",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ts: "text/typescript",
+  js: "text/javascript",
+  py: "text/x-python",
+  go: "text/x-go",
+  rs: "text/x-rust",
+  java: "text/x-java",
+  c: "text/x-c",
+  h: "text/x-c",
+  cpp: "text/x-c++",
+  sh: "application/x-sh",
+  yml: "application/yaml",
+  yaml: "application/yaml",
+  toml: "application/toml",
+  xml: "application/xml"
+}));
+function mimeFor(path) {
+  return MIME.get(extname(path).slice(1).toLowerCase()) ?? "application/octet-stream";
+}
+async function mapLimit(items, limit, work) {
+  const out = new Array(items.length);
+  let next = 0;
+  const runner = async () => {
+    for (; ; ) {
+      const index = next++;
+      if (index >= items.length) return;
+      out[index] = await work(items[index], index);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, runner));
+  return out;
+}
+async function grantFor(ctx, channel) {
+  const grant = resolveChannel(ctx.identity, await grantsFor(ctx.client, ctx.profile), channel);
+  if (!grant.send || grant.mode === "view") throw new ZasError("send_forbidden", 403);
+  if (grant.direct_mode) throw new ZasError("direct_mode", 409);
+  return grant;
+}
+async function receiptKey(ctx, channelId, contentHash, title) {
+  const raw = `${ctx.identity.agent_uid}\0${channelId}\0${contentHash}\0${title}`;
+  return blake3Hex(new TextEncoder().encode(raw));
+}
+function receiptFor(ctx, key) {
+  const entries = loadFingerprints(ctx.profile).entries;
+  if (!Object.prototype.hasOwnProperty.call(entries, key)) return void 0;
+  const entry = entries[key];
+  if (!entry || typeof entry.at !== "number" || Date.now() - entry.at >= REPLAY_WINDOW_MS) return void 0;
+  return entry;
+}
+function remember(ctx, key, receipt) {
+  const cutoff = Date.now() - REPLAY_WINDOW_MS;
+  const entries = {};
+  for (const [k, v] of Object.entries(loadFingerprints(ctx.profile).entries)) {
+    if (v && typeof v.at === "number" && v.at >= cutoff) entries[k] = v;
   }
+  entries[key] = receipt;
+  saveFingerprints(ctx.profile, { entries });
 }
-function safeName(name, fallback) {
-  const base = (typeof name === "string" ? name : "").split(/[\\/]/).pop() ?? "";
-  return base.replace(/^\.+/, "").trim() || fallback;
+function sleep(ms) {
+  return new Promise((resolve2) => {
+    setTimeout(resolve2, ms);
+  });
 }
-function freeName(target) {
-  if (!existsSync2(target)) return target;
-  const ext = extname(target);
-  const stem = target.slice(0, target.length - ext.length);
-  for (let n = 1; n <= MAX_DUPLICATES; n++) {
-    const candidate = `${stem} (${n})${ext}`;
-    if (!existsSync2(candidate)) return candidate;
+var CHUNK_PUT_RETRY_DELAY_MS = 1e3;
+async function putWithRetry(url, body) {
+  for (let attempt = 0; ; attempt++) {
+    let res;
+    try {
+      res = await fetch(url, { method: "PUT", body });
+    } catch {
+      if (attempt > 0) throw new ZasError("upload_failed", 0);
+      await sleep(CHUNK_PUT_RETRY_DELAY_MS);
+      continue;
+    }
+    if (res.ok || res.status < 500 || attempt > 0) return res;
+    await res.body?.cancel().catch(() => void 0);
+    await sleep(CHUNK_PUT_RETRY_DELAY_MS);
   }
-  throw new ZasError("write_failed", 0, target);
 }
-function destinationOf(dest, name, fallback) {
-  const base = safeName(name, fallback);
-  if (dest === void 0) {
-    const created = mkdtempSync(join2(tmpdir(), DOWNLOAD_PREFIX));
-    return { target: freeName(join2(created, base)), created };
+var COMMIT_ATTEMPTS = 4;
+var COMMIT_RETRY_BASE_MS = 250;
+async function commitChunk(ctx, blobId, uploadId) {
+  for (let attempt = 0; attempt < COMMIT_ATTEMPTS; attempt++) {
+    try {
+      const { cap } = await ctx.client.api(
+        "POST",
+        `/blobs/${blobId}/commit`,
+        { upload_id: uploadId }
+      );
+      return cap;
+    } catch (err) {
+      if (!(err instanceof ZasError) || err.serverCode !== "commit_pending") throw err;
+      if (attempt === COMMIT_ATTEMPTS - 1) break;
+      await sleep(COMMIT_RETRY_BASE_MS * 2 ** attempt);
+    }
   }
-  const at = statSync(dest, { throwIfNoEntry: false })?.isDirectory() ? join2(dest, base) : dest;
-  return { target: freeName(at) };
+  throw new ZasError("upload_failed", 409);
 }
-async function getItem(ctx, channel, id, dest) {
-  const grant = await readGrant(ctx, channel);
-  if (!ID_SEGMENT.test(id)) throw new ZasError("not_found", 404);
-  const channelKey = channelKeyOf(ctx.identity, grant);
-  const docs = await queryLinks(ctx, grant, {
-    from: [{ collectionId: "links" }],
-    where: {
-      fieldFilter: {
-        field: { fieldPath: "__name__" },
-        op: "EQUAL",
-        value: { referenceValue: linkPath(ctx.identity, grant, id) }
-      }
-    },
-    limit: 1
-  });
-  const row = docs.length > 0 ? rowOf(docs[0]) : null;
-  if (!row || !readable(row)) throw new ZasError("not_found", 404);
-  const manifest = openFor(channelKey, row);
-  if (!manifest) throw new ZasError("not_found", 404);
-  if (manifest.kind === "text") {
-    const text2 = manifest.text ?? "";
-    return { text: text2, bytes: new TextEncoder().encode(text2).length };
+async function uploadChunk(ctx, enc) {
+  const reserved = await ctx.client.api(
+    "POST",
+    `/blobs/${enc.blobId}/upload-url`,
+    { size: enc.ciphertext.length }
+  );
+  if (typeof reserved.url !== "string" || typeof reserved.upload_id !== "string") {
+    throw new ZasError("upload_failed", 0);
   }
-  if (manifest.chunks.length === 0) throw new ZasError("not_found", 404);
-  if (manifest.chunks.length > MAX_CHUNKS) throw new ZasError("not_found", 404);
-  let target;
-  let created;
-  let tmp;
-  let fd;
-  let written = 0;
+  const put = await putWithRetry(reserved.url, enc.ciphertext);
+  if (!put.ok) {
+    await put.body?.cancel().catch(() => void 0);
+    throw new ZasError("upload_failed", put.status);
+  }
+  return commitChunk(ctx, enc.blobId, reserved.upload_id);
+}
+async function proveChunk(ctx, enc, challenge) {
+  const samples = challenge.offsets.map((o) => enc.ciphertext.slice(o, o + challenge.sample_len));
   try {
-    const chosen = destinationOf(dest, manifest.name, row.id);
-    target = chosen.target;
-    created = chosen.created;
-    mkdirSync2(dirname(target), { recursive: true, mode: 448 });
-    tmp = `${target}.${randomBytes(6).toString("hex")}.tmp`;
-    fd = openSync(tmp, "wx", 384);
-    for (const chunk of manifest.chunks) {
-      written += writeSync(fd, await fetchChunk(ctx, chunk));
-    }
-    const size = typeof manifest.size === "number" ? manifest.size : 0;
-    if (size > 0 && written !== size) throw new ZasError("not_found", 404);
-    closeSync(fd);
-    fd = void 0;
-    renameSync2(tmp, target);
+    const { cap } = await ctx.client.api("POST", `/blobs/${enc.blobId}/prove`, {
+      challenge_id: challenge.challenge_id,
+      mac: bytesToHex(hmacSha256(b64ToBytes(challenge.nonce), concatBytes(...samples)))
+    });
+    return cap;
   } catch (err) {
-    if (err instanceof ZasError) throw err;
-    const failure = err;
-    if (typeof failure.syscall === "string" || typeof failure.errno === "number") {
-      throw new ZasError("write_failed", 0, failure.message);
-    }
-    throw new ZasError("network", 0, String(err?.message ?? err));
-  } finally {
-    if (fd !== void 0) try {
-      closeSync(fd);
-    } catch {
+    if (!(err instanceof ZasError) || err.serverCode !== "proof_failed") throw err;
+    return null;
+  }
+}
+async function placeSlice(ctx, slice, into, budget) {
+  const probe = await ctx.client.api("POST", "/blobs/probe", {
+    ids: slice.map((e) => e.blobId)
+  });
+  const results = probe.results ?? {};
+  const challenges = probe.challenges ?? {};
+  for (const enc of slice) {
+    if (results[enc.blobId] === "blocked") throw new ZasError("upload_failed", 451);
+  }
+  const provable = [];
+  const upload = [];
+  for (const enc of slice) {
+    if (results[enc.blobId] === "prove" && challenges[enc.blobId]) provable.push(enc);
+    else upload.push(enc);
+  }
+  let refused = budget.refusals >= MAX_REFUSALS_PER_SEND;
+  const prove = async (enc) => {
+    if (refused) {
+      upload.push(enc);
+      return;
     }
-    if (tmp !== void 0 && existsSync2(tmp)) try {
-      unlinkSync(tmp);
-    } catch {
+    const cap = await proveChunk(ctx, enc, challenges[enc.blobId]);
+    if (cap === null) {
+      refused = true;
+      budget.refusals += 1;
+      upload.push(enc);
+      return;
     }
-    if (created !== void 0) try {
-      rmdirSync(created);
-    } catch {
+    into.set(enc.blobId, { cap, proven: true });
+  };
+  if (provable.length > 0) await prove(provable[0]);
+  await mapLimit(provable.slice(1), UPLOAD_CONCURRENCY, prove);
+  await mapLimit(upload, UPLOAD_CONCURRENCY, async (enc) => {
+    into.set(enc.blobId, { cap: await uploadChunk(ctx, enc), proven: false });
+  });
+}
+async function placeChunks(ctx, encs) {
+  if (encs.length === 0) return [];
+  const distinct = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const enc of encs) {
+    if (seen.has(enc.blobId)) continue;
+    seen.add(enc.blobId);
+    distinct.push(enc);
+  }
+  const placements = /* @__PURE__ */ new Map();
+  const budget = { refusals: 0 };
+  for (const slice of batches(distinct, sliceSize(ctx))) await placeSlice(ctx, slice, placements, budget);
+  return encs.map((enc) => {
+    const placement = placements.get(enc.blobId);
+    if (!placement) throw new ZasError("upload_failed", 0);
+    return {
+      entry: {
+        blob_id: enc.blobId,
+        key: bytesToB64(enc.key),
+        nonce: bytesToB64(enc.nonce),
+        size: enc.ciphertext.length,
+        cap: placement.cap
+      },
+      proven: placement.proven
+    };
+  });
+}
+async function postLink(ctx, grant, manifest, placed, idempotencyKey) {
+  const channelKey = channelKeyOf(ctx.identity, grant);
+  const sealed = sealManifest(channelKey, manifest, grant.key_version);
+  const created = await ctx.client.api("POST", "/links", {
+    channel_id: grant.channel_id,
+    manifest_enc: bytesToB64(sealed),
+    caps: placed.map((p) => p.entry.cap).filter((cap) => typeof cap === "string"),
+    // Every chunk now arrives with a cap, proven or uploaded, so there is
+    // nothing left for the server to verify here. The field stays because the
+    // server reads it, and an absent array is not the same as an empty one.
+    proofs: [],
+    idempotency_key: idempotencyKey
+  });
+  const bound = created.caps ?? {};
+  let patched = false;
+  for (const p of placed) {
+    const cap = bound[p.entry.blob_id];
+    if (cap) {
+      p.entry.cap = cap;
+      patched = true;
     }
   }
-  return { path: target, bytes: written };
+  if (patched) {
+    await ctx.client.api("PATCH", `/links/${grant.channel_id}/${created.link_id}`, {
+      manifest_enc: bytesToB64(sealManifest(channelKey, manifest, grant.key_version))
+    });
+  }
+  return created.link_id;
+}
+async function sendFile(ctx, input, onPhase) {
+  const stat = await fsp.stat(input.path).catch(() => {
+    throw new ZasError("upload_failed", 400);
+  });
+  if (!stat.isFile()) throw new ZasError("upload_failed", 400);
+  if (stat.size > MAX_FILE_BYTES) throw new ZasError("file_too_big", 413);
+  const grant = await grantFor(ctx, input.channel);
+  const name = basename(input.path);
+  const title = input.title ?? name;
+  const file = await fsp.readFile(input.path);
+  if (file.byteLength > MAX_FILE_BYTES) throw new ZasError("file_too_big", 413);
+  const bytes = new Uint8Array(file.buffer, file.byteOffset, file.byteLength);
+  const contentHash = await blake3Hex(bytes);
+  const key = await receiptKey(ctx, grant.channel_id, contentHash, title);
+  const stored = receiptFor(ctx, key);
+  if (stored) {
+    return {
+      link_id: stored.link_id,
+      channel_id: grant.channel_id,
+      channel_name: channelNameOf(ctx.identity, grant),
+      bytes: stored.bytes,
+      chunks: stored.chunks,
+      deduplicated: stored.deduplicated,
+      replayed: true
+    };
+  }
+  onPhase?.("hashing");
+  const plains = [];
+  for await (const piece of chunkStream([bytes])) plains.push(piece);
+  const hashes = await Promise.all(plains.map((p) => blake3Bytes(p)));
+  const blinds = hashes.map((h) => oprfBlind(h));
+  const evaluated = [];
+  for (const slice of batches(blinds.map((b) => bytesToB64(b.blindedElement)), sliceSize(ctx))) {
+    const answers = await ctx.client.oprfEvaluate(slice);
+    if (answers.length !== slice.length) throw new ZasError("oprf_failed", 0);
+    for (const one of answers) evaluated.push(one);
+  }
+  onPhase?.("encrypting");
+  const encs = await Promise.all(plains.map(
+    (plain, i) => encryptChunk(oprfFinalize(hashes[i], blinds[i].blind, b64ToBytes(evaluated[i])), plain)
+  ));
+  onPhase?.("uploading");
+  const placed = await placeChunks(ctx, encs);
+  onPhase?.("finishing");
+  const mime = mimeFor(input.path);
+  const thumb = await thumbnailFor(bytes, mime);
+  const manifest = newManifest({
+    kind: "file",
+    name,
+    // Only when the caller chose one: absence means "show the file name", and
+    // writing the file name into `title` would make a rename look deliberate.
+    ...input.title !== void 0 ? { title: input.title } : {},
+    mime,
+    size: bytes.length,
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...thumb ? { thumb_data: thumb } : {},
+    chunks: placed.map((p) => p.entry)
+  });
+  const linkId = await postLink(
+    ctx,
+    grant,
+    manifest,
+    placed,
+    agentSendIdempotencyKey(grant.channel_id, contentHash, title)
+  );
+  const deduplicated = placed.filter((p) => p.proven).length;
+  remember(ctx, key, {
+    link_id: linkId,
+    bytes: bytes.length,
+    chunks: placed.length,
+    deduplicated,
+    at: Date.now()
+  });
+  return {
+    link_id: linkId,
+    channel_id: grant.channel_id,
+    channel_name: channelNameOf(ctx.identity, grant),
+    bytes: bytes.length,
+    chunks: placed.length,
+    deduplicated,
+    replayed: false
+  };
+}
+function noteName(text2) {
+  return text2.split("\n", 1)[0].trim().slice(0, NOTE_NAME_MAX) || "nota";
+}
+async function sendNote(ctx, input) {
+  const grant = await grantFor(ctx, input.channel);
+  const name = input.title ?? noteName(input.text);
+  const encoded = new TextEncoder().encode(input.text);
+  const contentHash = await blake3Hex(new TextEncoder().encode(
+    `${input.lang ?? ""}\0${input.secret ? "1" : "0"}\0${input.text}`
+  ));
+  const key = await receiptKey(ctx, grant.channel_id, contentHash, name);
+  const stored = receiptFor(ctx, key);
+  if (stored) {
+    return {
+      link_id: stored.link_id,
+      channel_id: grant.channel_id,
+      channel_name: channelNameOf(ctx.identity, grant),
+      bytes: stored.bytes,
+      chunks: 0,
+      deduplicated: 0,
+      replayed: true
+    };
+  }
+  const manifest = newManifest({
+    kind: "text",
+    name,
+    ...input.title !== void 0 ? { title: input.title } : {},
+    mime: "text/plain",
+    size: encoded.length,
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    text: input.text,
+    ...input.lang ? { code: { lang: input.lang, auto: false } } : {},
+    // Only ever true or absent, exactly as the note cover is defined: absent is
+    // "the sender did not classify", which no receiver may read as safe.
+    ...input.secret ? { sensitive: true } : {},
+    chunks: []
+  });
+  const linkId = await postLink(
+    ctx,
+    grant,
+    manifest,
+    [],
+    agentSendIdempotencyKey(grant.channel_id, contentHash, name)
+  );
+  remember(ctx, key, {
+    link_id: linkId,
+    bytes: encoded.length,
+    chunks: 0,
+    deduplicated: 0,
+    at: Date.now()
+  });
+  return {
+    link_id: linkId,
+    channel_id: grant.channel_id,
+    channel_name: channelNameOf(ctx.identity, grant),
+    bytes: encoded.length,
+    chunks: 0,
+    deduplicated: 0,
+    replayed: false
+  };
 }
 
-// src/send.ts
-import { promises as fsp } from "node:fs";
-import { basename, extname as extname2 } from "node:path";
-
-// src/shared/chunker.ts
-import { blake3 as blake32 } from "hash-wasm";
-var gearPromise = null;
-function gearTable() {
-  if (!gearPromise) {
-    gearPromise = (async () => {
-      const table = new Uint32Array(256);
-      for (let i = 0; i < 256; i++) {
-        const hex = await blake32(new TextEncoder().encode(GEAR_SEED + i), 256);
-        table[i] = parseInt(hex.slice(0, 8), 16) >>> 0;
-      }
-      return table;
-    })();
+// src/direct.ts
+var OFFER_WAIT_MS = 9.5 * 60 * 1e3;
+var OFFER_POLL_MS = 1e3;
+var SIGNAL_POLL_MS = 400;
+var HEARTBEAT_MS = 4 * 60 * 1e3;
+var SIGNALS_FOR_SENDER = {
+  from: [{ collectionId: "signals" }],
+  where: { fieldFilter: { field: { fieldPath: "for" }, op: "EQUAL", value: { stringValue: "sender" } } }
+};
+var stringField = (doc, key) => doc?.fields?.[key]?.stringValue;
+var defaultSleep2 = (ms) => new Promise((resolve2) => {
+  setTimeout(resolve2, ms);
+});
+var newDeviceToken = () => randomBytes(16).toString("base64url");
+var webrtc = null;
+function installWebRtc() {
+  if (!webrtc) {
+    webrtc = import("node-datachannel/polyfill").then((poly) => {
+      const g = globalThis;
+      g.RTCPeerConnection ??= poly.RTCPeerConnection;
+      g.RTCIceCandidate ??= poly.RTCIceCandidate;
+      g.RTCSessionDescription ??= poly.RTCSessionDescription;
+      g.RTCDataChannel ??= poly.RTCDataChannel;
+    }, (error) => {
+      webrtc = null;
+      throw new ZasError("webrtc_unavailable", 0, String(error));
+    });
   }
-  return gearPromise;
+  return webrtc;
 }
-var AVG = 1 << CHUNK_AVG_BITS;
-var MASK_S = (1 << CHUNK_AVG_BITS + 2) - 1;
-var MASK_L = (1 << CHUNK_AVG_BITS - 2) - 1;
-function cutPoint(buf, gear, eof) {
-  const len = Math.min(buf.length, CHUNK_MAX);
-  if (buf.length < CHUNK_MAX && !eof) {
-    if (buf.length <= CHUNK_MIN) return null;
-  }
-  if (eof && len <= CHUNK_MIN) return len > 0 ? len : null;
-  let hash = 0;
-  const normal = Math.min(AVG, len);
-  let i = CHUNK_MIN;
-  for (; i < normal; i++) {
-    hash = (hash << 1 >>> 0) + gear[buf[i]] >>> 0;
-    if ((hash & MASK_S) === 0) return i + 1;
-  }
-  for (; i < len; i++) {
-    hash = (hash << 1 >>> 0) + gear[buf[i]] >>> 0;
-    if ((hash & MASK_L) === 0) return i + 1;
+async function directGrantFor(ctx, channel) {
+  const grant = resolveChannel(ctx.identity, await grantsFor(ctx.client, ctx.profile), channel);
+  if (!grant.send || grant.mode === "view") throw new ZasError("send_forbidden", 403);
+  if (!grant.direct_mode) throw new ZasError("not_direct_mode", 409);
+  return grant;
+}
+function channelLabel(ctx, grant) {
+  try {
+    return channelNameOf(ctx.identity, grant);
+  } catch {
+    return grant.channel_id;
   }
-  if (len === CHUNK_MAX) return CHUNK_MAX;
-  if (eof) return len > 0 ? len : null;
-  return null;
 }
-async function* chunkStream(source) {
-  const gear = await gearTable();
-  let pending = [];
-  let pendingLen = 0;
-  const compact = () => {
-    if (pending.length === 1) return pending[0];
-    const merged = new Uint8Array(pendingLen);
-    let off = 0;
-    for (const p of pending) {
-      merged.set(p, off);
-      off += p.length;
-    }
-    pending = [merged];
-    return merged;
+function sealer(key, keyVersion) {
+  return {
+    seal: (value) => bytesToB64(sealRaw(key, keyVersion, new TextEncoder().encode(JSON.stringify(value)))),
+    open: (enc) => JSON.parse(new TextDecoder().decode(openRaw(key, b64ToBytes(enc))))
   };
-  const drain = function* (eof) {
-    while (pendingLen > 0) {
-      const buf = compact();
-      const cut = cutPoint(buf, gear, eof);
-      if (cut === null) return;
-      yield buf.slice(0, cut);
-      pending = cut < buf.length ? [buf.slice(cut)] : [];
-      pendingLen = buf.length - cut;
+}
+async function sendDirect(ctx, input, report, deps = {}) {
+  const now = deps.now ?? (() => Date.now());
+  const sleep2 = deps.sleep ?? defaultSleep2;
+  const grant = await directGrantFor(ctx, input.channel);
+  const key = channelKeyOf(ctx.identity, grant);
+  const channelName = channelLabel(ctx, grant);
+  const file = await (deps.openFile ?? openAsBlob)(input.path).catch(() => {
+    throw new ZasError("upload_failed", 400);
+  });
+  if (file.size > DIRECT_FILE_MAX_BYTES) throw new ZasError("file_too_big", 413);
+  const name = basename2(input.path);
+  const cid = grant.channel_id;
+  const owner = ctx.identity.owner_uid;
+  const device = deps.device ?? newDeviceToken();
+  const { seal, open } = sealer(key, grant.key_version);
+  const stamp = { device, owner_uid: owner };
+  const startedAt = now();
+  report("offer");
+  const meta = { name, size: file.size, mime: mimeFor(input.path) };
+  const { id } = await ctx.client.api("POST", `/direct/${cid}`, {
+    meta_enc: seal(meta),
+    key_version: grant.key_version,
+    sender_label_enc: seal(ctx.identity.name),
+    size_bytes: file.size,
+    ...stamp
+  });
+  const route = `/direct/${cid}/${id}`;
+  const offerPath = `accounts/${owner}/channels/${cid}/direct/${id}`;
+  const setState = (state) => ctx.client.api("POST", `${route}/state`, { state, ...stamp }).then(() => void 0, () => void 0);
+  const claimBy = startedAt + (deps.offerWaitMs ?? OFFER_WAIT_MS);
+  for (; ; ) {
+    const doc = await ctx.client.firestoreGet(offerPath);
+    const state = doc === null ? "cancelled" : stringField(doc, "state") ?? "open";
+    if (state === "claimed") break;
+    if (state !== "open") throw new ZasError("direct_cancelled", 0);
+    if (now() >= claimBy) {
+      await setState("cancelled");
+      throw new ZasError("not_claimed", 0);
+    }
+    await sleep2(deps.offerPollMs ?? OFFER_POLL_MS);
+  }
+  await (deps.installWebRtc ?? installWebRtc)();
+  const fetchIce = async () => {
+    try {
+      const r = await ctx.client.api("POST", `${route}/ice`, stamp);
+      return Array.isArray(r.ice) ? r.ice : [];
+    } catch {
+      return [];
     }
   };
-  for await (const piece of source) {
-    if (piece.length === 0) continue;
-    pending.push(piece);
-    pendingLen += piece.length;
-    if (pendingLen >= CHUNK_MAX) yield* drain(false);
+  const turn = await fetchIce();
+  report("connecting");
+  let resolveOutcome;
+  const outcome = new Promise((resolve2) => {
+    resolveOutcome = resolve2;
+  });
+  let diag;
+  let path;
+  let heartbeat;
+  const handle = (deps.engine ?? startSender)({
+    file,
+    name,
+    label: ctx.identity.name,
+    ice: [...DIRECT_ICE, ...turn],
+    refreshIce: async () => [...DIRECT_ICE, ...await fetchIce()],
+    send: (msg) => ctx.client.api("POST", `${route}/signal`, { payload_enc: seal(msg), for: "receiver", ...stamp }).then(() => void 0),
+    onPhase: (phase2) => {
+      if (phase2 === "flight") {
+        report("flight");
+        heartbeat ??= setInterval(() => {
+          void ctx.client.api("POST", `${route}/heartbeat`, stamp).catch(() => void 0);
+        }, deps.heartbeatMs ?? HEARTBEAT_MS);
+      }
+      if (phase2 === "done" || phase2 === "failed") resolveOutcome(phase2);
+    },
+    onPath: (p) => {
+      path = p;
+    },
+    onDiag: (d) => {
+      diag = d;
+    }
+  });
+  let over = false;
+  const pump = (async () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (!over) {
+      let rows = [];
+      try {
+        rows = await ctx.client.firestoreRunQuery(offerPath, SIGNALS_FOR_SENDER);
+      } catch {
+      }
+      for (const row of rows) {
+        if (!row?.name || seen.has(row.name)) continue;
+        seen.add(row.name);
+        const enc = stringField(row, "payload_enc");
+        if (!enc) continue;
+        try {
+          handle.accept(open(enc));
+        } catch {
+        }
+      }
+      if (!over) await Promise.race([outcome, sleep2(deps.signalPollMs ?? SIGNAL_POLL_MS)]);
+    }
+  })();
+  const phase = await outcome;
+  over = true;
+  clearInterval(heartbeat);
+  await pump;
+  report("finishing");
+  if (phase === "done") {
+    await setState("done");
+    return {
+      offer_id: id,
+      channel_id: cid,
+      channel_name: channelName,
+      bytes: file.size,
+      ...path ? { path } : {},
+      duration_ms: now() - startedAt
+    };
   }
-  yield* drain(true);
+  await setState("failed");
+  const reason = diag?.reason || "unknown";
+  deps.onFailed?.({
+    channel_id: cid,
+    channel_name: channelName,
+    offer_id: id,
+    owner_uid: owner,
+    device,
+    path: input.path,
+    name,
+    size: file.size,
+    key,
+    key_version: grant.key_version,
+    reason
+  });
+  throw new ZasError("direct_failed", 0, reason);
+}
+var fetchPut = async (url, bytes, signal, onLoaded) => {
+  const body = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+  const res = await fetch(url, { method: "PUT", body, signal });
+  await res.body?.cancel().catch(() => void 0);
+  if (!res.ok) throw new Error(`fallback_put_${res.status}`);
+  const etag = res.headers.get("etag");
+  if (!etag) throw new Error("fallback_etag_missing");
+  onLoaded(bytes.length);
+  return etag;
+};
+async function sendDirectFallback(ctx, record, report, deps = {}) {
+  const now = deps.now ?? (() => Date.now());
+  const startedAt = now();
+  const opened = await (deps.openFile ?? openAsBlob)(record.path).catch(() => {
+    throw new ZasError("upload_failed", 400);
+  });
+  if (opened.size !== record.size) throw new ZasError("file_changed", 0);
+  const file = new File([opened], record.name, { type: mimeFor(record.path) });
+  const { seal } = sealer(record.key, record.key_version);
+  const stamp = { device: record.device, owner_uid: record.owner_uid };
+  const base = `/direct/${record.channel_id}/${record.offer_id}/fallback`;
+  report("encrypting");
+  const meta = createFallbackMeta(file);
+  await ctx.client.api("POST", `${base}/start`, {
+    meta_enc: seal(meta),
+    plain_size: meta.size,
+    cipher_size: meta.cipher_size,
+    part_count: meta.part_count,
+    ...stamp
+  });
+  report("uploading");
+  let parts;
+  try {
+    parts = await uploadFallback({
+      file,
+      offerId: record.offer_id,
+      meta,
+      put: deps.put ?? fetchPut,
+      getUrls: async (from, count) => {
+        const r = await ctx.client.api(
+          "POST",
+          `${base}/parts`,
+          { from, count, ...stamp }
+        );
+        return r.urls;
+      }
+    });
+  } catch (error) {
+    await ctx.client.api("POST", `${base}/abort`, stamp).catch(() => void 0);
+    if (error instanceof ZasError) throw error;
+    throw new ZasError("upload_failed", 0, error instanceof Error ? error.message : String(error));
+  }
+  report("finishing");
+  await ctx.client.api("POST", `${base}/complete`, {
+    parts: parts.map((part) => ({ part_number: part.partNumber, etag: part.etag })),
+    ...stamp
+  });
+  return {
+    offer_id: record.offer_id,
+    channel_id: record.channel_id,
+    channel_name: record.channel_name,
+    bytes: record.size,
+    duration_ms: now() - startedAt,
+    parts: parts.length
+  };
 }
 
-// src/shared/oprf.ts
-import { RistrettoPoint } from "@noble/curves/ed25519";
-import { sha512 as sha5122 } from "@noble/hashes/sha2";
-import { invert, mod } from "@noble/curves/abstract/modular";
-var ORDER = 2n ** 252n + 27742317777372353535851937790883648493n;
-var te = new TextEncoder();
-function i2osp(value, length) {
-  const out = new Uint8Array(length);
-  for (let i = length - 1; i >= 0; i--) {
-    out[i] = value & 255;
-    value >>>= 8;
-  }
-  return out;
-}
-function expandMessageXmd(msg, dst, lenInBytes) {
-  const bInBytes = 64;
-  const rInBytes = 128;
-  const ell = Math.ceil(lenInBytes / bInBytes);
-  if (ell > 255) throw new Error("expand_message_xmd: ell too large");
-  const dstPrime = concatBytes(dst, i2osp(dst.length, 1));
-  const zPad = new Uint8Array(rInBytes);
-  const lIbStr = i2osp(lenInBytes, 2);
-  const msgPrime = concatBytes(zPad, msg, lIbStr, i2osp(0, 1), dstPrime);
-  const b0 = sha5122(msgPrime);
-  const b = [];
-  b[0] = sha5122(concatBytes(b0, i2osp(1, 1), dstPrime));
-  for (let i = 2; i <= ell; i++) {
-    const xored = new Uint8Array(bInBytes);
-    for (let j = 0; j < bInBytes; j++) xored[j] = b0[j] ^ b[i - 2][j];
-    b[i - 1] = sha5122(concatBytes(xored, i2osp(i, 1), dstPrime));
-  }
-  return concatBytes(...b).slice(0, lenInBytes);
-}
-function bytesToBigIntBE(bytes) {
-  let v = 0n;
-  for (const byte of bytes) v = v << 8n | BigInt(byte);
-  return v;
-}
-function hashToGroup(input) {
-  const dst = te.encode("HashToGroup-" + OPRF_CONTEXT);
-  const uniform = expandMessageXmd(input, dst, 64);
-  return RistrettoPoint.hashToCurve(uniform);
-}
-function randomScalar() {
-  const bytes = new Uint8Array(64);
-  crypto.getRandomValues(bytes);
-  const s = mod(bytesToBigIntBE(bytes), ORDER);
-  return s === 0n ? 1n : s;
-}
-function oprfBlind(input) {
-  const blind = randomScalar();
-  const P = hashToGroup(input);
-  return { blind, blindedElement: P.multiply(blind).toRawBytes() };
-}
-function oprfFinalize(input, blind, evaluatedElement) {
-  const E = RistrettoPoint.fromHex(evaluatedElement);
-  const N = E.multiply(invert(blind, ORDER));
-  const unblinded = N.toRawBytes();
-  const hashInput = concatBytes(
-    i2osp(input.length, 2),
-    input,
-    i2osp(unblinded.length, 2),
-    unblinded,
-    te.encode("Finalize")
-  );
-  return sha5122(hashInput);
+// src/receive.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import {
+  closeSync as closeSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  renameSync as renameSync3,
+  rmdirSync as rmdirSync2,
+  unlinkSync as unlinkSync2,
+  writeSync as writeSync2
+} from "node:fs";
+import { dirname as dirname2 } from "node:path";
+
+// src/read.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  mkdtempSync,
+  openSync,
+  renameSync as renameSync2,
+  rmdirSync,
+  statSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, extname as extname2, join as join2 } from "node:path";
+var DEFAULT_LIMIT = 20;
+var MAX_LIMIT = 50;
+var DOWNLOAD_PREFIX = "zas-agent-";
+var ID_SEGMENT = /^(?!__)[A-Za-z0-9_-]{1,128}$/;
+var MAX_CHUNKS = 8192;
+var MAX_DUPLICATES = 100;
+function stringOf(value) {
+  return typeof value?.stringValue === "string" ? value.stringValue : void 0;
 }
-
-// src/thumbnail.ts
-import { Jimp } from "jimp";
-var PREFIX = "data:image/jpeg;base64,";
-var READABLE = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/bmp", "image/gif", "image/tiff"]);
-var QUALITY_STEPS = [85, 70, 55, 40];
-var MAX_INPUT_BYTES = 80 * 1024 * 1024;
-function thumbnailable(mime) {
-  return READABLE.has(mime.split(";")[0].trim().toLowerCase());
+function timeOf(value) {
+  const parsed = typeof value?.timestampValue === "string" ? Date.parse(value.timestampValue) : NaN;
+  return Number.isFinite(parsed) ? parsed : null;
 }
-async function thumbnailFor(bytes, mime) {
-  if (!thumbnailable(mime)) return void 0;
-  if (bytes.length > MAX_INPUT_BYTES) return void 0;
+function rowOf(doc) {
+  const document = doc ?? {};
+  const name = typeof document.name === "string" ? document.name : "";
+  const fields = document.fields && typeof document.fields === "object" ? document.fields : {};
+  return {
+    id: name.slice(name.lastIndexOf("/") + 1),
+    manifestEnc: stringOf(fields.manifest_enc),
+    agent: stringOf(fields.agent),
+    createdAt: timeOf(fields.created_at),
+    expiresAt: timeOf(fields.expires_at),
+    bar: fields.bar?.booleanValue === true
+  };
+}
+function readable(row) {
+  if (!row.id || row.bar || !row.manifestEnc) return false;
+  return row.expiresAt === null || row.expiresAt > Date.now();
+}
+function openFor(channelKey, row) {
   try {
-    const image = await Jimp.read(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength));
-    if (Math.max(image.width, image.height) > THUMBNAIL_MAX_EDGE) {
-      image.scaleToFit({ w: THUMBNAIL_MAX_EDGE, h: THUMBNAIL_MAX_EDGE });
-    }
-    for (const quality of QUALITY_STEPS) {
-      const jpeg = await image.getBuffer("image/jpeg", { quality });
-      const uri = PREFIX + Buffer.from(jpeg).toString("base64");
-      if (uri.length <= THUMBNAIL_MAX_BYTES) return uri;
-    }
-    return void 0;
+    return openManifest(channelKey, b64ToBytes(row.manifestEnc));
   } catch {
-    return void 0;
+    return null;
   }
 }
-
-// src/send.ts
-var MAX_FILE_BYTES = 5 * 1024 * 1024 * 1024;
-var REPLAY_WINDOW_MS = 10 * 60 * 1e3;
-var UPLOAD_CONCURRENCY = 4;
-var OPRF_PROBE_BATCH = 200;
-var MAX_REFUSALS_PER_SEND = 8;
-var NOTE_NAME_MAX = 40;
-function batches(items, size) {
-  const out = [];
-  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
-  return out;
-}
-function sliceSize(ctx) {
-  return Math.max(1, Math.floor(ctx.batch ?? OPRF_PROBE_BATCH));
-}
-var MIME = new Map(Object.entries({
-  jpg: "image/jpeg",
-  jpeg: "image/jpeg",
-  png: "image/png",
-  gif: "image/gif",
-  webp: "image/webp",
-  bmp: "image/bmp",
-  tif: "image/tiff",
-  tiff: "image/tiff",
-  svg: "image/svg+xml",
-  pdf: "application/pdf",
-  txt: "text/plain",
-  md: "text/markdown",
-  csv: "text/csv",
-  json: "application/json",
-  html: "text/html",
-  zip: "application/zip",
-  gz: "application/gzip",
-  tar: "application/x-tar",
-  mp4: "video/mp4",
-  mov: "video/quicktime",
-  mp3: "audio/mpeg",
-  wav: "audio/wav",
-  doc: "application/msword",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  xls: "application/vnd.ms-excel",
-  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ppt: "application/vnd.ms-powerpoint",
-  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  ts: "text/typescript",
-  js: "text/javascript",
-  py: "text/x-python",
-  go: "text/x-go",
-  rs: "text/x-rust",
-  java: "text/x-java",
-  c: "text/x-c",
-  h: "text/x-c",
-  cpp: "text/x-c++",
-  sh: "application/x-sh",
-  yml: "application/yaml",
-  yaml: "application/yaml",
-  toml: "application/toml",
-  xml: "application/xml"
-}));
-function mimeFor(path) {
-  return MIME.get(extname2(path).slice(1).toLowerCase()) ?? "application/octet-stream";
-}
-async function mapLimit(items, limit, work) {
-  const out = new Array(items.length);
-  let next = 0;
-  const runner = async () => {
-    for (; ; ) {
-      const index = next++;
-      if (index >= items.length) return;
-      out[index] = await work(items[index], index);
-    }
+function summaryOf(row, manifest) {
+  const kind = manifest.kind === "text" ? "text" : "file";
+  const name = typeof manifest.name === "string" ? manifest.name : "";
+  return {
+    id: row.id,
+    kind,
+    // Absence means "show the file name": the sender chose no title.
+    title: manifest.title ?? name,
+    name,
+    mime: typeof manifest.mime === "string" ? manifest.mime : "application/octet-stream",
+    size: typeof manifest.size === "number" ? manifest.size : 0,
+    // The sealed time is the sender's own; the row's is the server's, and it
+    // only answers for a manifest that carries none.
+    created_at: typeof manifest.created_at === "string" && manifest.created_at ? manifest.created_at : row.createdAt !== null ? new Date(row.createdAt).toISOString() : "",
+    by_agent: row.agent !== void 0,
+    ...kind === "text" ? { text: manifest.text ?? "" } : {}
   };
-  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, runner));
-  return out;
 }
-async function grantFor(ctx, channel) {
+async function readGrant(ctx, channel) {
   const grant = resolveChannel(ctx.identity, await grantsFor(ctx.client, ctx.profile), channel);
-  if (!grant.send || grant.mode === "view") throw new ZasError("send_forbidden", 403);
-  if (grant.direct_mode) throw new ZasError("direct_mode", 409);
+  if (!grant.read) throw new ZasError("read_forbidden", 403);
   return grant;
 }
-async function receiptKey(ctx, channelId, contentHash, title) {
-  const raw = `${ctx.identity.agent_uid}\0${channelId}\0${contentHash}\0${title}`;
-  return blake3Hex(new TextEncoder().encode(raw));
+function nameFrom(channelKey, grant) {
+  try {
+    return decryptChannelName(channelKey, b64ToBytes(grant.name_enc));
+  } catch {
+    throw new ZasError("key_stale", 0);
+  }
 }
-function receiptFor(ctx, key) {
-  const entries = loadFingerprints(ctx.profile).entries;
-  if (!Object.prototype.hasOwnProperty.call(entries, key)) return void 0;
-  const entry = entries[key];
-  if (!entry || typeof entry.at !== "number" || Date.now() - entry.at >= REPLAY_WINDOW_MS) return void 0;
-  return entry;
+function linksParent(identity, grant) {
+  return `accounts/${identity.owner_uid}/channels/${grant.channel_id}`;
 }
-function remember(ctx, key, receipt) {
-  const cutoff = Date.now() - REPLAY_WINDOW_MS;
-  const entries = {};
-  for (const [k, v] of Object.entries(loadFingerprints(ctx.profile).entries)) {
-    if (v && typeof v.at === "number" && v.at >= cutoff) entries[k] = v;
+function linkPath(identity, grant, id) {
+  return `projects/${identity.firestore_project}/databases/(default)/documents/${linksParent(identity, grant)}/links/${id}`;
+}
+async function queryLinks(ctx, grant, query) {
+  try {
+    return await ctx.client.firestoreRunQuery(linksParent(ctx.identity, grant), query);
+  } catch (err) {
+    if (err instanceof ZasError && err.status === 403) throw new ZasError("read_forbidden", 403);
+    throw err;
   }
-  entries[key] = receipt;
-  saveFingerprints(ctx.profile, { entries });
 }
-function sleep(ms) {
-  return new Promise((resolve2) => {
-    setTimeout(resolve2, ms);
+function clampLimit(limit) {
+  if (limit === void 0 || !Number.isFinite(limit)) return DEFAULT_LIMIT;
+  return Math.min(MAX_LIMIT, Math.max(1, Math.trunc(limit)));
+}
+async function listItems(ctx, channel, limit) {
+  const grant = await readGrant(ctx, channel);
+  const channelKey = channelKeyOf(ctx.identity, grant);
+  const docs = await queryLinks(ctx, grant, {
+    from: [{ collectionId: "links" }],
+    orderBy: [{ field: { fieldPath: "created_at" }, direction: "DESCENDING" }],
+    limit: clampLimit(limit)
   });
+  const items = [];
+  for (const doc of docs) {
+    const row = rowOf(doc);
+    if (!readable(row)) continue;
+    const manifest = openFor(channelKey, row);
+    if (!manifest) continue;
+    items.push(summaryOf(row, manifest));
+  }
+  return {
+    channel_id: grant.channel_id,
+    channel_name: nameFrom(channelKey, grant),
+    items
+  };
 }
-var CHUNK_PUT_RETRY_DELAY_MS = 1e3;
-async function putWithRetry(url, body) {
-  for (let attempt = 0; ; attempt++) {
-    let res;
-    try {
-      res = await fetch(url, { method: "PUT", body });
-    } catch {
-      if (attempt > 0) throw new ZasError("upload_failed", 0);
-      await sleep(CHUNK_PUT_RETRY_DELAY_MS);
-      continue;
-    }
-    if (res.ok || res.status < 500 || attempt > 0) return res;
+function redeemFailure(status) {
+  if (status === 429) return new ZasError("rate_limited", 429);
+  if (status >= 500) return new ZasError("network", status);
+  return new ZasError("invalid_cap", 403);
+}
+async function fetchChunk(ctx, chunk) {
+  if (typeof chunk.cap !== "string" || chunk.cap === "") throw new ZasError("invalid_cap", 403);
+  let headers = {};
+  try {
+    headers = { Authorization: `Bearer ${await ctx.client.idToken()}` };
+  } catch {
+    headers = {};
+  }
+  let url;
+  try {
+    const redeemed = await apiPublic(
+      ctx.identity.api_base,
+      "POST",
+      "/v1/blobs/redeem",
+      { cap: chunk.cap },
+      headers
+    );
+    url = typeof redeemed.url === "string" ? redeemed.url : "";
+  } catch (err) {
+    if (err instanceof ZasError) throw redeemFailure(err.status);
+    throw err;
+  }
+  if (url === "") throw new ZasError("invalid_cap", 403);
+  const res = await fetch(url);
+  if (!res.ok) {
     await res.body?.cancel().catch(() => void 0);
-    await sleep(CHUNK_PUT_RETRY_DELAY_MS);
+    throw res.status >= 500 ? new ZasError("network", res.status) : new ZasError("invalid_cap", 403);
+  }
+  const ciphertext = new Uint8Array(await res.arrayBuffer());
+  try {
+    return decryptChunk(b64ToBytes(chunk.key), b64ToBytes(chunk.nonce), ciphertext);
+  } catch {
+    throw new ZasError("invalid_cap", 403);
   }
 }
-var COMMIT_ATTEMPTS = 4;
-var COMMIT_RETRY_BASE_MS = 250;
-async function commitChunk(ctx, blobId, uploadId) {
-  for (let attempt = 0; attempt < COMMIT_ATTEMPTS; attempt++) {
-    try {
-      const { cap } = await ctx.client.api(
-        "POST",
-        `/blobs/${blobId}/commit`,
-        { upload_id: uploadId }
-      );
-      return cap;
-    } catch (err) {
-      if (!(err instanceof ZasError) || err.serverCode !== "commit_pending") throw err;
-      if (attempt === COMMIT_ATTEMPTS - 1) break;
-      await sleep(COMMIT_RETRY_BASE_MS * 2 ** attempt);
-    }
-  }
-  throw new ZasError("upload_failed", 409);
+function safeName(name, fallback) {
+  const base = (typeof name === "string" ? name : "").split(/[\\/]/).pop() ?? "";
+  return base.replace(/^\.+/, "").trim() || fallback;
 }
-async function uploadChunk(ctx, enc) {
-  const reserved = await ctx.client.api(
-    "POST",
-    `/blobs/${enc.blobId}/upload-url`,
-    { size: enc.ciphertext.length }
-  );
-  if (typeof reserved.url !== "string" || typeof reserved.upload_id !== "string") {
-    throw new ZasError("upload_failed", 0);
-  }
-  const put = await putWithRetry(reserved.url, enc.ciphertext);
-  if (!put.ok) {
-    await put.body?.cancel().catch(() => void 0);
-    throw new ZasError("upload_failed", put.status);
+function freeName(target) {
+  if (!existsSync2(target)) return target;
+  const ext = extname2(target);
+  const stem = target.slice(0, target.length - ext.length);
+  for (let n = 1; n <= MAX_DUPLICATES; n++) {
+    const candidate = `${stem} (${n})${ext}`;
+    if (!existsSync2(candidate)) return candidate;
   }
-  return commitChunk(ctx, enc.blobId, reserved.upload_id);
+  throw new ZasError("write_failed", 0, target);
 }
-async function proveChunk(ctx, enc, challenge) {
-  const samples = challenge.offsets.map((o) => enc.ciphertext.slice(o, o + challenge.sample_len));
-  try {
-    const { cap } = await ctx.client.api("POST", `/blobs/${enc.blobId}/prove`, {
-      challenge_id: challenge.challenge_id,
-      mac: bytesToHex(hmacSha256(b64ToBytes(challenge.nonce), concatBytes(...samples)))
-    });
-    return cap;
-  } catch (err) {
-    if (!(err instanceof ZasError) || err.serverCode !== "proof_failed") throw err;
-    return null;
+function destinationOf(dest, name, fallback) {
+  const base = safeName(name, fallback);
+  if (dest === void 0) {
+    const created = mkdtempSync(join2(tmpdir(), DOWNLOAD_PREFIX));
+    return { target: freeName(join2(created, base)), created };
   }
+  const at = statSync(dest, { throwIfNoEntry: false })?.isDirectory() ? join2(dest, base) : dest;
+  return { target: freeName(at) };
 }
-async function placeSlice(ctx, slice, into, budget) {
-  const probe = await ctx.client.api("POST", "/blobs/probe", {
-    ids: slice.map((e) => e.blobId)
+async function getItem(ctx, channel, id, dest) {
+  const grant = await readGrant(ctx, channel);
+  if (!ID_SEGMENT.test(id)) throw new ZasError("not_found", 404);
+  const channelKey = channelKeyOf(ctx.identity, grant);
+  const docs = await queryLinks(ctx, grant, {
+    from: [{ collectionId: "links" }],
+    where: {
+      fieldFilter: {
+        field: { fieldPath: "__name__" },
+        op: "EQUAL",
+        value: { referenceValue: linkPath(ctx.identity, grant, id) }
+      }
+    },
+    limit: 1
   });
-  const results = probe.results ?? {};
-  const challenges = probe.challenges ?? {};
-  for (const enc of slice) {
-    if (results[enc.blobId] === "blocked") throw new ZasError("upload_failed", 451);
-  }
-  const provable = [];
-  const upload = [];
-  for (const enc of slice) {
-    if (results[enc.blobId] === "prove" && challenges[enc.blobId]) provable.push(enc);
-    else upload.push(enc);
+  const row = docs.length > 0 ? rowOf(docs[0]) : null;
+  if (!row || !readable(row)) throw new ZasError("not_found", 404);
+  const manifest = openFor(channelKey, row);
+  if (!manifest) throw new ZasError("not_found", 404);
+  if (manifest.kind === "text") {
+    const text2 = manifest.text ?? "";
+    return { text: text2, bytes: new TextEncoder().encode(text2).length };
   }
-  let refused = budget.refusals >= MAX_REFUSALS_PER_SEND;
-  const prove = async (enc) => {
-    if (refused) {
-      upload.push(enc);
-      return;
+  if (manifest.chunks.length === 0) throw new ZasError("not_found", 404);
+  if (manifest.chunks.length > MAX_CHUNKS) throw new ZasError("not_found", 404);
+  let target;
+  let created;
+  let tmp;
+  let fd;
+  let written = 0;
+  try {
+    const chosen = destinationOf(dest, manifest.name, row.id);
+    target = chosen.target;
+    created = chosen.created;
+    mkdirSync2(dirname(target), { recursive: true, mode: 448 });
+    tmp = `${target}.${randomBytes2(6).toString("hex")}.tmp`;
+    fd = openSync(tmp, "wx", 384);
+    for (const chunk of manifest.chunks) {
+      written += writeSync(fd, await fetchChunk(ctx, chunk));
     }
-    const cap = await proveChunk(ctx, enc, challenges[enc.blobId]);
-    if (cap === null) {
-      refused = true;
-      budget.refusals += 1;
-      upload.push(enc);
-      return;
+    const size = typeof manifest.size === "number" ? manifest.size : 0;
+    if (size > 0 && written !== size) throw new ZasError("not_found", 404);
+    closeSync(fd);
+    fd = void 0;
+    renameSync2(tmp, target);
+  } catch (err) {
+    if (err instanceof ZasError) throw err;
+    const failure = err;
+    if (typeof failure.syscall === "string" || typeof failure.errno === "number") {
+      throw new ZasError("write_failed", 0, failure.message);
+    }
+    throw new ZasError("network", 0, String(err?.message ?? err));
+  } finally {
+    if (fd !== void 0) try {
+      closeSync(fd);
+    } catch {
+    }
+    if (tmp !== void 0 && existsSync2(tmp)) try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    if (created !== void 0) try {
+      rmdirSync(created);
+    } catch {
     }
-    into.set(enc.blobId, { cap, proven: true });
-  };
-  if (provable.length > 0) await prove(provable[0]);
-  await mapLimit(provable.slice(1), UPLOAD_CONCURRENCY, prove);
-  await mapLimit(upload, UPLOAD_CONCURRENCY, async (enc) => {
-    into.set(enc.blobId, { cap: await uploadChunk(ctx, enc), proven: false });
-  });
-}
-async function placeChunks(ctx, encs) {
-  if (encs.length === 0) return [];
-  const distinct = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const enc of encs) {
-    if (seen.has(enc.blobId)) continue;
-    seen.add(enc.blobId);
-    distinct.push(enc);
   }
-  const placements = /* @__PURE__ */ new Map();
-  const budget = { refusals: 0 };
-  for (const slice of batches(distinct, sliceSize(ctx))) await placeSlice(ctx, slice, placements, budget);
-  return encs.map((enc) => {
-    const placement = placements.get(enc.blobId);
-    if (!placement) throw new ZasError("upload_failed", 0);
-    return {
-      entry: {
-        blob_id: enc.blobId,
-        key: bytesToB64(enc.key),
-        nonce: bytesToB64(enc.nonce),
-        size: enc.ciphertext.length,
-        cap: placement.cap
-      },
-      proven: placement.proven
-    };
-  });
+  return { path: target, bytes: written };
 }
-async function postLink(ctx, grant, manifest, placed, idempotencyKey) {
-  const channelKey = channelKeyOf(ctx.identity, grant);
-  const sealed = sealManifest(channelKey, manifest, grant.key_version);
-  const created = await ctx.client.api("POST", "/links", {
-    channel_id: grant.channel_id,
-    manifest_enc: bytesToB64(sealed),
-    caps: placed.map((p) => p.entry.cap).filter((cap) => typeof cap === "string"),
-    // Every chunk now arrives with a cap, proven or uploaded, so there is
-    // nothing left for the server to verify here. The field stays because the
-    // server reads it, and an absent array is not the same as an empty one.
-    proofs: [],
-    idempotency_key: idempotencyKey
-  });
-  const bound = created.caps ?? {};
-  let patched = false;
-  for (const p of placed) {
-    const cap = bound[p.entry.blob_id];
-    if (cap) {
-      p.entry.cap = cap;
-      patched = true;
+
+// src/receive.ts
+var OFFER_WAIT_MS2 = 9.5 * 60 * 1e3;
+var OFFER_POLL_MS2 = 1e3;
+var SIGNAL_POLL_MS2 = 400;
+var OFFER_PAGE = 10;
+var OPEN_OFFERS = {
+  from: [{ collectionId: "direct" }],
+  orderBy: [{ field: { fieldPath: "created_at" }, direction: "DESCENDING" }],
+  limit: OFFER_PAGE
+};
+var SIGNALS_FOR_RECEIVER = {
+  from: [{ collectionId: "signals" }],
+  where: { fieldFilter: { field: { fieldPath: "for" }, op: "EQUAL", value: { stringValue: "receiver" } } }
+};
+var stringField2 = (doc, key) => doc?.fields?.[key]?.stringValue;
+var idOf = (doc) => (doc.name ?? "").split("/").pop() ?? "";
+async function receiveGrantFor(ctx, channel) {
+  const grant = resolveChannel(ctx.identity, await grantsFor(ctx.client, ctx.profile), channel);
+  if (!grant.read) throw new ZasError("read_forbidden", 403);
+  if (!grant.direct_mode) throw new ZasError("not_direct_mode", 409);
+  return grant;
+}
+var DiskSink = class {
+  constructor(dest, fallbackName) {
+    this.dest = dest;
+    this.fallbackName = fallbackName;
+  }
+  /** Where the bytes will be once `close` has run. */
+  target;
+  written = 0;
+  /** A filesystem refusal, kept so the run can answer `write_failed` rather
+   *  than reporting the engine's generic sink failure. */
+  failure;
+  created;
+  tmp;
+  fd;
+  open(meta) {
+    try {
+      const chosen = destinationOf(this.dest, meta.name, this.fallbackName);
+      this.target = chosen.target;
+      this.created = chosen.created;
+      mkdirSync3(dirname2(this.target), { recursive: true, mode: 448 });
+      this.tmp = `${this.target}.${randomBytes3(6).toString("hex")}.tmp`;
+      this.fd = openSync2(this.tmp, "wx", 384);
+    } catch (error) {
+      throw this.remember(error);
     }
   }
-  if (patched) {
-    await ctx.client.api("PATCH", `/links/${grant.channel_id}/${created.link_id}`, {
-      manifest_enc: bytesToB64(sealManifest(channelKey, manifest, grant.key_version))
-    });
+  write(bytes) {
+    try {
+      if (this.fd === void 0) throw new Error("sink_closed");
+      this.written += writeSync2(this.fd, bytes);
+    } catch (error) {
+      throw this.remember(error);
+    }
   }
-  return created.link_id;
-}
-async function sendFile(ctx, input, onPhase) {
-  const stat = await fsp.stat(input.path).catch(() => {
-    throw new ZasError("upload_failed", 400);
-  });
-  if (!stat.isFile()) throw new ZasError("upload_failed", 400);
-  if (stat.size > MAX_FILE_BYTES) throw new ZasError("file_too_big", 413);
-  const grant = await grantFor(ctx, input.channel);
-  const name = basename(input.path);
-  const title = input.title ?? name;
-  const file = await fsp.readFile(input.path);
-  if (file.byteLength > MAX_FILE_BYTES) throw new ZasError("file_too_big", 413);
-  const bytes = new Uint8Array(file.buffer, file.byteOffset, file.byteLength);
-  const contentHash = await blake3Hex(bytes);
-  const key = await receiptKey(ctx, grant.channel_id, contentHash, title);
-  const stored = receiptFor(ctx, key);
-  if (stored) {
-    return {
-      link_id: stored.link_id,
-      channel_id: grant.channel_id,
-      channel_name: channelNameOf(ctx.identity, grant),
-      bytes: stored.bytes,
-      chunks: stored.chunks,
-      deduplicated: stored.deduplicated,
-      replayed: true
-    };
+  close() {
+    try {
+      if (this.fd === void 0) return;
+      closeSync2(this.fd);
+      this.fd = void 0;
+      renameSync3(this.tmp, this.target);
+      this.tmp = void 0;
+    } catch (error) {
+      throw this.remember(error);
+    }
   }
-  onPhase?.("hashing");
-  const plains = [];
-  for await (const piece of chunkStream([bytes])) plains.push(piece);
-  const hashes = await Promise.all(plains.map((p) => blake3Bytes(p)));
-  const blinds = hashes.map((h) => oprfBlind(h));
-  const evaluated = [];
-  for (const slice of batches(blinds.map((b) => bytesToB64(b.blindedElement)), sliceSize(ctx))) {
-    const answers = await ctx.client.oprfEvaluate(slice);
-    if (answers.length !== slice.length) throw new ZasError("oprf_failed", 0);
-    for (const one of answers) evaluated.push(one);
+  /** Best effort, and safe to call twice: the engine aborts on every failure
+   *  path of its own, and the job aborts again on the way out. */
+  abort() {
+    if (this.fd !== void 0) {
+      try {
+        closeSync2(this.fd);
+      } catch {
+      }
+      this.fd = void 0;
+    }
+    if (this.tmp !== void 0) {
+      if (existsSync3(this.tmp)) try {
+        unlinkSync2(this.tmp);
+      } catch {
+      }
+      this.tmp = void 0;
+    }
+    if (this.created !== void 0) {
+      try {
+        rmdirSync2(this.created);
+      } catch {
+      }
+      this.created = void 0;
+    }
   }
-  onPhase?.("encrypting");
-  const encs = await Promise.all(plains.map(
-    (plain, i) => encryptChunk(oprfFinalize(hashes[i], blinds[i].blind, b64ToBytes(evaluated[i])), plain)
-  ));
-  onPhase?.("uploading");
-  const placed = await placeChunks(ctx, encs);
-  onPhase?.("finishing");
-  const mime = mimeFor(input.path);
-  const thumb = await thumbnailFor(bytes, mime);
-  const manifest = newManifest({
-    kind: "file",
-    name,
-    // Only when the caller chose one: absence means "show the file name", and
-    // writing the file name into `title` would make a rename look deliberate.
-    ...input.title !== void 0 ? { title: input.title } : {},
-    mime,
-    size: bytes.length,
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    ...thumb ? { thumb_data: thumb } : {},
-    chunks: placed.map((p) => p.entry)
+  /** A `ZasError` says what happened already. An errno does not, so it is kept
+   *  and turned into one sentence by the caller — recognised by the shape Node
+   *  puts on it (`syscall`/`errno`) rather than by `code`, which `ZasError`
+   *  also carries. */
+  remember(error) {
+    const failure = error;
+    if (typeof failure?.syscall === "string" || typeof failure?.errno === "number") this.failure = failure;
+    return error;
+  }
+};
+async function receiveDirect(ctx, input, report, deps = {}) {
+  const now = deps.now ?? (() => Date.now());
+  const sleep2 = deps.sleep ?? defaultSleep2;
+  const grant = await receiveGrantFor(ctx, input.channel);
+  const key = channelKeyOf(ctx.identity, grant);
+  const channelName = channelLabel(ctx, grant);
+  const cid = grant.channel_id;
+  const owner = ctx.identity.owner_uid;
+  const device = deps.device ?? newDeviceToken();
+  const { seal, open } = sealer(key, grant.key_version);
+  const stamp = { device, owner_uid: owner };
+  const startedAt = now();
+  const channelPath = `accounts/${owner}/channels/${cid}`;
+  report("waiting");
+  const waitUntil = startedAt + (deps.offerWaitMs ?? OFFER_WAIT_MS2);
+  let id;
+  let meta;
+  while (id === void 0) {
+    const rows = await ctx.client.firestoreRunQuery(channelPath, OPEN_OFFERS).catch(() => []);
+    for (const row of rows) {
+      if (stringField2(row, "state") !== "open") continue;
+      if (stringField2(row, "sender") === ctx.identity.agent_uid) continue;
+      const enc = stringField2(row, "meta_enc");
+      if (enc === void 0) continue;
+      let candidate;
+      try {
+        candidate = open(enc);
+      } catch {
+        continue;
+      }
+      if (typeof candidate?.name !== "string" || typeof candidate?.size !== "number") continue;
+      if (candidate.size > DIRECT_FILE_MAX_BYTES) throw new ZasError("file_too_big", 413);
+      const offerId2 = idOf(row);
+      if (offerId2 === "") continue;
+      try {
+        await ctx.client.api("POST", `/direct/${cid}/${offerId2}/claim`, { size_bytes: candidate.size, ...stamp });
+      } catch (error) {
+        const word = error instanceof ZasError ? error.serverCode ?? error.code : "";
+        if (word === "claimed") throw new ZasError("offer_taken", 409);
+        if (word === "expired" || word === "own_offer" || word === "not_found") continue;
+        throw error;
+      }
+      id = offerId2;
+      meta = candidate;
+      break;
+    }
+    if (id !== void 0) break;
+    if (now() >= waitUntil) throw new ZasError("no_offer", 0);
+    await sleep2(deps.offerPollMs ?? OFFER_POLL_MS2);
+  }
+  const offered = meta;
+  const offerId = id;
+  const route = `/direct/${cid}/${offerId}`;
+  const offerPath = `${channelPath}/direct/${offerId}`;
+  const setState = (state) => ctx.client.api("POST", `${route}/state`, { state, ...stamp }).then(() => void 0, () => void 0);
+  await (deps.installWebRtc ?? installWebRtc)();
+  const fetchIce = async () => {
+    try {
+      const r = await ctx.client.api("POST", `${route}/ice`, stamp);
+      return Array.isArray(r.ice) ? r.ice : [];
+    } catch {
+      return [];
+    }
+  };
+  const turn = await fetchIce();
+  report("connecting");
+  const sink = new DiskSink(input.dest, offerId);
+  let resolveOutcome;
+  const outcome = new Promise((resolve2) => {
+    resolveOutcome = resolve2;
   });
-  const linkId = await postLink(
-    ctx,
-    grant,
-    manifest,
-    placed,
-    agentSendIdempotencyKey(grant.channel_id, contentHash, title)
-  );
-  const deduplicated = placed.filter((p) => p.proven).length;
-  remember(ctx, key, {
-    link_id: linkId,
-    bytes: bytes.length,
-    chunks: placed.length,
-    deduplicated,
-    at: Date.now()
+  let diag;
+  let via;
+  const handle = (deps.engine ?? startReceiver)({
+    ice: [...DIRECT_ICE, ...turn],
+    refreshIce: async () => [...DIRECT_ICE, ...await fetchIce()],
+    // The name and size this end read off the offer. The engine refuses a
+    // sender that announces anything else.
+    expectedMeta: offered,
+    send: (msg) => ctx.client.api("POST", `${route}/signal`, { payload_enc: seal(msg), for: "sender", ...stamp }).then(() => void 0),
+    onPhase: (phase2) => {
+      if (phase2 === "flight") report("flight");
+      if (phase2 === "done" || phase2 === "failed") resolveOutcome(phase2);
+    },
+    onPath: (p) => {
+      via = p;
+    },
+    onDiag: (d) => {
+      diag = d;
+    },
+    sink: async (m) => {
+      sink.open(m);
+      return sink;
+    }
   });
-  return {
-    link_id: linkId,
-    channel_id: grant.channel_id,
-    channel_name: channelNameOf(ctx.identity, grant),
-    bytes: bytes.length,
-    chunks: placed.length,
-    deduplicated,
-    replayed: false
-  };
-}
-function noteName(text2) {
-  return text2.split("\n", 1)[0].trim().slice(0, NOTE_NAME_MAX) || "nota";
-}
-async function sendNote(ctx, input) {
-  const grant = await grantFor(ctx, input.channel);
-  const name = input.title ?? noteName(input.text);
-  const encoded = new TextEncoder().encode(input.text);
-  const contentHash = await blake3Hex(new TextEncoder().encode(
-    `${input.lang ?? ""}\0${input.secret ? "1" : "0"}\0${input.text}`
-  ));
-  const key = await receiptKey(ctx, grant.channel_id, contentHash, name);
-  const stored = receiptFor(ctx, key);
-  if (stored) {
+  let over = false;
+  const pump = (async () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (!over) {
+      let rows = [];
+      try {
+        rows = await ctx.client.firestoreRunQuery(offerPath, SIGNALS_FOR_RECEIVER);
+      } catch {
+      }
+      for (const row of rows) {
+        if (!row?.name || seen.has(row.name)) continue;
+        seen.add(row.name);
+        const enc = stringField2(row, "payload_enc");
+        if (!enc) continue;
+        try {
+          handle.accept(open(enc));
+        } catch {
+        }
+      }
+      if (!over) await Promise.race([outcome, sleep2(deps.signalPollMs ?? SIGNAL_POLL_MS2)]);
+    }
+  })();
+  const phase = await outcome;
+  over = true;
+  await pump;
+  report("finishing");
+  if (phase === "done") {
+    await setState("done");
     return {
-      link_id: stored.link_id,
-      channel_id: grant.channel_id,
-      channel_name: channelNameOf(ctx.identity, grant),
-      bytes: stored.bytes,
-      chunks: 0,
-      deduplicated: 0,
-      replayed: true
+      offer_id: offerId,
+      channel_id: cid,
+      channel_name: channelName,
+      name: offered.name,
+      bytes: sink.written,
+      path: sink.target,
+      ...via ? { via } : {},
+      duration_ms: now() - startedAt
     };
   }
-  const manifest = newManifest({
-    kind: "text",
-    name,
-    ...input.title !== void 0 ? { title: input.title } : {},
-    mime: "text/plain",
-    size: encoded.length,
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    text: input.text,
-    ...input.lang ? { code: { lang: input.lang, auto: false } } : {},
-    // Only ever true or absent, exactly as the note cover is defined: absent is
-    // "the sender did not classify", which no receiver may read as safe.
-    ...input.secret ? { sensitive: true } : {},
-    chunks: []
-  });
-  const linkId = await postLink(
-    ctx,
-    grant,
-    manifest,
-    [],
-    agentSendIdempotencyKey(grant.channel_id, contentHash, name)
-  );
-  remember(ctx, key, {
-    link_id: linkId,
-    bytes: encoded.length,
-    chunks: 0,
-    deduplicated: 0,
-    at: Date.now()
+  sink.abort();
+  const doc = await ctx.client.firestoreGet(offerPath).catch(() => null);
+  const withdrawn = doc === null || stringField2(doc, "state") === "cancelled";
+  await setState("failed");
+  if (sink.failure) throw new ZasError("write_failed", 0, sink.failure.message);
+  if (withdrawn) throw new ZasError("direct_cancelled", 0);
+  const reason = diag?.reason || "unknown";
+  deps.onFailed?.({
+    channel_id: cid,
+    channel_name: channelName,
+    offer_id: offerId,
+    owner_uid: owner,
+    device,
+    ...input.dest !== void 0 ? { dest: input.dest } : {},
+    meta: offered,
+    key,
+    key_version: grant.key_version,
+    reason
   });
+  throw new ZasError("direct_failed", 0, reason);
+}
+async function receiveDirectFallback(ctx, record, report, deps = {}) {
+  const now = deps.now ?? (() => Date.now());
+  const startedAt = now();
+  const { open } = sealer(record.key, record.key_version);
+  const stamp = { device: record.device, owner_uid: record.owner_uid };
+  const base = `/direct/${record.channel_id}/${record.offer_id}/fallback`;
+  const offerPath = `accounts/${record.owner_uid}/channels/${record.channel_id}/direct/${record.offer_id}`;
+  const doc = await ctx.client.firestoreGet(offerPath);
+  const enc = stringField2(doc, "fallback_meta_enc");
+  let meta;
+  if (enc !== void 0) {
+    try {
+      meta = fallbackMetaOf(open(enc));
+    } catch {
+      meta = void 0;
+    }
+  }
+  if (!meta) throw new ZasError("fallback_unavailable", 409);
+  if (meta.name !== record.meta.name || meta.size !== record.meta.size || meta.mime !== record.meta.mime) {
+    throw new ZasError("file_changed", 0);
+  }
+  const sink = new DiskSink(record.dest, record.offer_id);
+  report("downloading");
+  try {
+    sink.open(meta);
+    await downloadFallback({
+      offerId: record.offer_id,
+      meta,
+      sink,
+      getUrl: async () => (await ctx.client.api("POST", `${base}/download`, stamp)).url,
+      ...deps.fetcher ? { fetcher: deps.fetcher } : {}
+    });
+  } catch (error) {
+    sink.abort();
+    if (sink.failure) throw new ZasError("write_failed", 0, sink.failure.message);
+    if (error instanceof ZasError) throw error;
+    throw new ZasError("network", 0, error instanceof Error ? error.message : String(error));
+  }
+  report("finishing");
+  await ctx.client.api("POST", `${base}/received`, stamp);
   return {
-    link_id: linkId,
-    channel_id: grant.channel_id,
-    channel_name: channelNameOf(ctx.identity, grant),
-    bytes: encoded.length,
-    chunks: 0,
-    deduplicated: 0,
-    replayed: false
+    offer_id: record.offer_id,
+    channel_id: record.channel_id,
+    channel_name: record.channel_name,
+    name: meta.name,
+    bytes: sink.written,
+    path: sink.target,
+    duration_ms: now() - startedAt
   };
 }
 
+// src/jobs.ts
+import { randomUUID } from "node:crypto";
+var DEFAULT_WAIT_MS = 6e4;
+var HISTORY = 50;
+var JobRunner = class {
+  now;
+  waitMs;
+  /** Newest first, and trimmed. */
+  jobs = [];
+  /** Keyed on the job object, not its id, so a caller holding a job that has
+   *  already aged out of the list can still wait for it to finish. */
+  settled = /* @__PURE__ */ new WeakMap();
+  constructor(opts = {}) {
+    this.now = opts.now ?? (() => Date.now());
+    this.waitMs = opts.waitMs ?? DEFAULT_WAIT_MS;
+  }
+  start(kind, title, channel, work) {
+    const job = {
+      id: randomUUID(),
+      kind,
+      title,
+      channel,
+      started_at: this.now(),
+      phase: null,
+      status: "running"
+    };
+    this.jobs.unshift(job);
+    this.jobs.length = Math.min(this.jobs.length, HISTORY);
+    const report = (phase) => {
+      if (job.status === "running") job.phase = phase;
+    };
+    this.settled.set(job, work(report).then(
+      (result) => {
+        job.status = "done";
+        job.result = result;
+        return job;
+      },
+      (error) => {
+        job.status = "failed";
+        job.error = error instanceof ZasError ? {
+          code: error.code,
+          status: error.status,
+          sentence: humanSentence(error),
+          message: error.message,
+          ...error.retryAfterMs !== void 0 ? { retryAfterMs: error.retryAfterMs } : {},
+          ...error.serverCode !== void 0 ? { serverCode: error.serverCode } : {}
+        } : { code: "upload_failed", status: 0, sentence: humanSentence(new ZasError("upload_failed", 0)) };
+        return job;
+      }
+    ));
+    return job;
+  }
+  /** Resolves when the work settles, or when the wait runs out — the same job
+   *  object either way, so the caller reads `status` rather than guessing. */
+  async wait(job) {
+    const settled = this.settled.get(job);
+    if (!settled) return job;
+    let timer;
+    const deadline = new Promise((resolve2) => {
+      timer = setTimeout(() => resolve2(job), this.waitMs);
+    });
+    try {
+      return await Promise.race([settled, deadline]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  list() {
+    return this.jobs.slice(0, HISTORY);
+  }
+  get(id) {
+    return this.jobs.find((job) => job.id === id);
+  }
+};
+
 // src/server.ts
 function agentVersion() {
-  return true ? "0.3.0" : "0.0.0-dev";
+  return true ? "0.5.0" : "0.0.0-dev";
 }
 var AGENT_CUE = " The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.";
 var PAIR_ANNOUNCE_MS = 15e3;
@@ -1886,8 +3337,8 @@ var delay = (ms) => new Promise((resolve2) => {
 });
 function rightsOf(grant) {
   const rights = [];
-  if (grant.send && grant.mode !== "view" && !grant.direct_mode) rights.push("send");
-  if (grant.read) rights.push("read");
+  if (grant.send && grant.mode !== "view") rights.push(grant.direct_mode ? "send (Directo)" : "send");
+  if (grant.read) rights.push(grant.direct_mode ? "receive (Directo)" : "read");
   return rights.length > 0 ? rights.join(" \xB7 ") : "no access";
 }
 function buildServer(profile, deps = {}) {
@@ -2021,7 +3472,7 @@ function buildServer(profile, deps = {}) {
     return text2(["pending", ...pairing.logs].join("\n"));
   });
   server.registerTool("zas_send_file", {
-    description: "Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials." + AGENT_CUE,
+    description: "Send a file from this machine into one of the owner's Zas channels. Returns the item id, or a job id when the upload takes longer than a minute. A channel in Directo mode refuses this tool: use zas_send_direct there. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials." + AGENT_CUE,
     inputSchema: {
       path: z.string().describe("Absolute or relative path of the file to send."),
       channel: z.string().optional().describe("Channel name or id. Optional when the agent holds exactly one channel."),
@@ -2041,6 +3492,110 @@ function buildServer(profile, deps = {}) {
       return failed(e);
     }
   });
+  const failedDirects = /* @__PURE__ */ new Map();
+  const rememberFailed = (jobId, record) => {
+    failedDirects.set(jobId, record);
+    if (failedDirects.size > 50) failedDirects.delete(failedDirects.keys().next().value);
+  };
+  server.registerTool("zas_send_direct", {
+    description: "Send a file from this machine through Directo: a live, device-to-device transfer into one of the owner's channels that is in Directo mode. Nothing is stored. The owner has to press Receive on another device within ten minutes; the call waits a minute and then returns a job id to check with zas_jobs. Returns the transfer result, or a job id. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials." + AGENT_CUE,
+    inputSchema: {
+      path: z.string().describe("Absolute or relative path of the file to send."),
+      channel: z.string().optional().describe("Channel name or id. Optional when the agent holds exactly one channel.")
+    }
+  }, async (input) => {
+    try {
+      const c = ctx();
+      let job;
+      job = runner.start(
+        "direct",
+        input.path,
+        input.channel ?? "",
+        (report) => sendDirect(c, input, report, {
+          ...deps.direct ?? {},
+          onFailed: (record) => rememberFailed(job.id, record)
+        })
+      );
+      return settled(await runner.wait(job));
+    } catch (e) {
+      return failed(e);
+    }
+  });
+  server.registerTool("zas_send_direct_fallback", {
+    description: "After a zas_send_direct job failed in flight, deliver the same file through reliable delivery instead. Zas encrypts the file on this machine and stores only that encrypted copy in Cloudflare R2 for up to 24 hours; it uses none of the owner's space, and the device that claimed the offer can download it later. This stops being Directo: the encrypted bytes pass through storage. Ask the owner before you use it; it is their choice. Pass the failed job's id." + AGENT_CUE,
+    inputSchema: {
+      job: z.string().describe("The job id zas_send_direct or zas_jobs reported for the Directo send that failed.")
+    }
+  }, async (input) => {
+    try {
+      const c = ctx();
+      const record = failedDirects.get(input.job);
+      if (!record) return failed(new ZasError("direct_not_failed", 0));
+      const job = runner.start(
+        "fallback",
+        record.name,
+        record.channel_name,
+        (report) => sendDirectFallback(c, record, report, deps.direct)
+      );
+      const outcome = await runner.wait(job);
+      if (outcome.status === "done") failedDirects.delete(input.job);
+      return settled(outcome);
+    } catch (e) {
+      return failed(e);
+    }
+  });
+  const failedReceives = /* @__PURE__ */ new Map();
+  const rememberFailedReceive = (jobId, record) => {
+    failedReceives.set(jobId, record);
+    if (failedReceives.size > 50) failedReceives.delete(failedReceives.keys().next().value);
+  };
+  server.registerTool("zas_receive_direct", {
+    description: "Receive a file the owner sends through Directo, straight onto this machine. Call it when the owner says they are sending you something: it waits for the offer, takes it, and writes the file to disk. Nothing is stored anywhere. Only for a channel in Directo mode, and only with a grant that includes reading. The call waits a minute and then returns a job id to check with zas_jobs; the wait for an offer alone can take ten minutes. Returns the path written; it never overwrites an existing file." + AGENT_CUE,
+    inputSchema: {
+      channel: z.string().optional().describe("Channel name or id. Optional when the agent holds exactly one channel."),
+      dest: z.string().optional().describe('Where to write the file. A directory means "inside it". Defaults to a fresh temporary directory.')
+    }
+  }, async (input) => {
+    try {
+      const c = ctx();
+      let job;
+      job = runner.start(
+        "receive",
+        input.dest ?? "Directo",
+        input.channel ?? "",
+        (report) => receiveDirect(c, input, report, {
+          ...deps.receive ?? {},
+          onFailed: (record) => rememberFailedReceive(job.id, record)
+        })
+      );
+      return settled(await runner.wait(job));
+    } catch (e) {
+      return failed(e);
+    }
+  });
+  server.registerTool("zas_receive_direct_fallback", {
+    description: "After a zas_receive_direct job failed in flight, download the encrypted copy the sender chose to store instead. It works only if the person who was sending picked reliable delivery for that transfer. The file is decrypted on this machine and written to the same destination. Pass the failed job\u2019s id." + AGENT_CUE,
+    inputSchema: {
+      job: z.string().describe("The job id zas_receive_direct or zas_jobs reported for the receive that failed.")
+    }
+  }, async (input) => {
+    try {
+      const c = ctx();
+      const record = failedReceives.get(input.job);
+      if (!record) return failed(new ZasError("direct_not_failed", 0));
+      const job = runner.start(
+        "fallback",
+        record.meta.name,
+        record.channel_name,
+        (report) => receiveDirectFallback(c, record, report, deps.receive)
+      );
+      const outcome = await runner.wait(job);
+      if (outcome.status === "done") failedReceives.delete(input.job);
+      return settled(outcome);
+    } catch (e) {
+      return failed(e);
+    }
+  });
   server.registerTool("zas_send_note", {
     description: "Send a note \u2014 plain text, or a code snippet with its language \u2014 into one of the owner's Zas channels." + AGENT_CUE,
     inputSchema: {
@@ -2092,7 +3647,7 @@ function buildServer(profile, deps = {}) {
     }
   });
   server.registerTool("zas_jobs", {
-    description: "List the sends this server started, newest first, with the phase each one reached and how it ended \u2014 including any `job_id` a send returned; a finished job keeps its result here." + AGENT_CUE
+    description: "List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended \u2014 including any `job_id` a send returned; a finished job keeps its result here." + AGENT_CUE
   }, async () => text2(runner.list()));
   return server;
 }