κ-store: 48 shell blobs (aggregate fb89925ddfec)

.gitattributes

@@ -34,3 +34,6 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
 b/f6caa9eeead2c99deeb2cdb70b7e25bbaa2cf5c60555f5b4030ecf6b6d9efa51 filter=lfs diff=lfs merge=lfs -text
+b/00cfa4960b319ba1ba7291cddb20dea130a407ce8b42426218854f4f68f4dcd7 filter=lfs diff=lfs merge=lfs -text
+b/3370b22070b56218a57df6406e2e4ba7cc171e942d4d1f2ae4297ea2c4c08d9c filter=lfs diff=lfs merge=lfs -text
+b/9d90b4ea8bccee8c239073c7ec7dd5158c6d11f1f668487570d17475d79e661e filter=lfs diff=lfs merge=lfs -text

b/007141010ac01ca81bb4bf74ad758709586b2899c25d7b8f8cf412abf1998c62

@@ -0,0 +1 @@
+import"./chunk-SQE76S5B.js";var I=1,k={standard:{name:"Standard",tag:"matte black",locked:!1},volt:{name:"Volt",tag:"electric streaks",locked:!1},fiber:{name:"Fiber",tag:"woven copper",locked:!1},sovereign:{name:"Sovereign",tag:"TEE holders only",locked:!0}},S=["v","kind","chain","address","label","edition","holder","created"];function g(e){return JSON.stringify(S.map(o=>e[o]??null))}async function b(e){let o=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return[...new Uint8Array(o)].map(t=>t.toString(16).padStart(2,"0")).join("")}async function w({chain:e="ethereum",address:o="",label:t="Card",edition:a="standard",holder:l=""}={}){let i={v:1,kind:"card",chain:e,address:o,label:t,edition:a,holder:l,created:Date.now(),frozen:!1};return i.kappa=await b(g(i)),i}async function R(e){return e&&e.kappa===await b(g(e))}function y(e){let o=parseInt(e.slice(0,8),16)>>>0,t=parseInt(e.slice(8,16),16)>>>0,a=parseInt(e.slice(16,24),16)>>>0,l=parseInt(e.slice(24,32),16)>>>0;return()=>{let i=(o+t>>>0)+l>>>0;return l=l+1>>>0,o=t^t>>>9,t=a+(a<<3)>>>0,a=(a<<21|a>>>11)>>>0,a=a+i>>>0,(i>>>0)/4294967296}}var s=856,n=540;function p(e,o,t){let a=e.createLinearGradient(0,0,s*.35,n);a.addColorStop(0,o),a.addColorStop(1,t),e.fillStyle=a,e.fillRect(0,0,s,n)}function d(e,o,t,a){e.save();for(let l=0;l<t;l++)e.fillStyle=`rgba(255,255,255,${o()*a})`,e.fillRect(o()*s,o()*n,1,1);e.restore()}function h(e,o){p(e,"#101114","#050506");let t=s*(.2+o()*.6),a=e.createLinearGradient(t-180,0,t+180,n);a.addColorStop(0,"rgba(255,255,255,0)"),a.addColorStop(.5,"rgba(255,255,255,0.045)"),a.addColorStop(1,"rgba(255,255,255,0)"),e.fillStyle=a,e.fillRect(0,0,s,n),d(e,o,900,.05)}function m(e,o){p(e,"#04070f","#010208"),e.save(),e.globalCompositeOperation="lighter";let t=205+o()*40;for(let a=0;a<42;a++){let l=n*o(),i=n*o(),f=s*o(),r=s*o(),u=t+(o()-.5)*50;e.strokeStyle=`hsla(${u}, 100%, ${55+o()*25}%, ${.03+o()*.1})`,e.lineWidth=.5+o()*3.2,e.beginPath(),e.moveTo(-40,l),e.bezierCurveTo(f,l+(o()-.5)*260,r,i+(o()-.5)*260,s+40,i),e.stroke()}e.restore(),d(e,o,500,.04)}function C(e,o){p(e,"#12080a","#070304"),e.save();let t=s*(.3+o()*.4);for(let a=-4;a<n+4;a+=2){let l=Math.exp(-Math.abs(a-n*.45)/(n*.5)),f=8+o()*30+l*22;e.strokeStyle=`hsla(${14+o()*26}, ${55+o()*35}%, ${f}%, ${.5+o()*.5})`,e.lineWidth=1+o()*1.6,e.beginPath();let r=(o()-.5)*22;e.moveTo(0,a),e.bezierCurveTo(t*.5,a+r,t,a-r,s,a+(o()-.5)*14),e.stroke()}e.globalCompositeOperation="lighter";for(let a=0;a<60;a++){let l=n*o();e.strokeStyle=`hsla(${20+o()*25}, 100%, ${60+o()*25}%, ${.1+o()*.22})`,e.lineWidth=.6+o(),e.beginPath();let i=s*o()*.7;e.moveTo(i,l),e.lineTo(i+s*(.15+o()*.5),l+(o()-.5)*10),e.stroke()}e.restore()}function v(e,o){p(e,"#0a0a12","#040408"),e.save(),e.globalCompositeOperation="lighter";let t=o()*Math.PI*2;for(let a=0;a<26;a++){let l=a/26,i=(t*57+l*320+o()*30)%360,f=n*(l+(o()-.5)*.06),r=e.createLinearGradient(0,f-60,s,f+60);r.addColorStop(0,`hsla(${i},90%,60%,0)`),r.addColorStop(.5,`hsla(${i},90%,60%,${.05+o()*.06})`),r.addColorStop(1,`hsla(${(i+60)%360},90%,60%,0)`),e.fillStyle=r,e.beginPath(),e.ellipse(s/2,f,s*(.55+o()*.25),46+o()*40,(o()-.5)*.22,0,Math.PI*2),e.fill()}e.restore(),d(e,o,700,.05)}var T={standard:h,volt:m,fiber:C,sovereign:v};function $(e,o){e.save(),e.fillStyle="rgba(255,255,255,0.94)",e.font="600 44px ui-sans-serif, system-ui, 'Segoe UI', Roboto, sans-serif",e.textBaseline="top",e.fillText("Holo",52,46),e.font="300 44px ui-sans-serif, system-ui, 'Segoe UI', Roboto, sans-serif",e.fillText("Money",158,46),e.font="700 22px ui-sans-serif, system-ui, sans-serif",e.fillStyle="rgba(255,255,255,0.62)";let a="VIRTUAL";e.fillText(a,s-52-e.measureText(a).width,56),e.textBaseline="alphabetic",e.fillStyle="rgba(255,255,255,0.88)",e.font="500 30px ui-sans-serif, system-ui, sans-serif",e.fillText(o.holder||"Operator",52,n-52-34),e.fillStyle="rgba(255,255,255,0.55)",e.font="400 24px ui-monospace, Consolas, monospace";let l=(o.address||o.kappa||"").slice(-4);e.fillText(`${o.label}  \xB7\xB7${l}`,52,n-52);let i=n-52-26,f=s-52-34,r=30;e.globalAlpha=.9,e.fillStyle="rgba(255,255,255,0.22)",e.beginPath(),e.arc(f-20,i,r,0,Math.PI*2),e.fill(),e.fillStyle="rgba(255,255,255,0.34)",e.beginPath(),e.arc(f+20,i,r,0,Math.PI*2),e.fill(),e.globalAlpha=1,e.fillStyle="rgba(10,10,14,0.85)",e.font="800 30px ui-sans-serif, system-ui, sans-serif",e.fillText("H",f-11,i+11),e.restore()}function A(e,o){e.width=s,e.height=n;let t=e.getContext("2d"),a=y(o.kappa||"deadbeefdeadbeefdeadbeefdeadbeef");(T[o.edition]||h)(t,a);let l=t.createRadialGradient(s/2,n/2,n*.4,s/2,n/2,s*.75);return l.addColorStop(0,"rgba(0,0,0,0)"),l.addColorStop(1,"rgba(0,0,0,0.38)"),t.fillStyle=l,t.fillRect(0,0,s,n),$(t,o),e}export{I as CARD_VERSION,k as EDITIONS,n as FACE_H,s as FACE_W,w as mintCard,A as renderFace,b as sha256hex,R as verifyCard};

b/00cfa4960b319ba1ba7291cddb20dea130a407ce8b42426218854f4f68f4dcd7

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:00cfa4960b319ba1ba7291cddb20dea130a407ce8b42426218854f4f68f4dcd7
+size 2926068

b/29f6cbec51d5d103e676c312ab27151e2aa98e38f05532b3ea4adec6df0b36bb

@@ -0,0 +1 @@
+import{a as d,b as y,c as w,d as k}from"./chunk-67U7RCKQ.js";import"./chunk-SQE76S5B.js";function m(e){return["L1",e.type,e.kappa,e.hashlock||"",e.preimage||"",String(e.amount??""),e.asset||"",e.fiat||"",String(e.expires||""),e.by||"",String(e.at||"")].join("|")}async function v(e,{claimSecret:s,signer:a,at:t}){let i={type:"claim",kappa:e.kappa,hashlock:e.hashlock,preimage:s,amount:e.amount,asset:e.asset,fiat:e.fiat||null,expires:e.expires,by:a.pub,at:t};return i.sig=await a.sign(m(i)),i.tid=await d(m(i)),i}async function S(e,{signer:s,at:a}){let t={type:"refund",kappa:e.kappa,expires:e.expires,by:s.pub,at:a};return t.sig=await s.sign(m(t)),t.tid=await d(m(t)),t}async function b(e,s){return!e||!e.type||!e.kappa||!e.by||!e.sig||!await w(e.by,e.sig,m(e))?!1:e.type==="claim"?!(!e.preimage||await d(e.preimage)!==e.hashlock||e.expires&&e.at>e.expires):e.type==="refund"?!!(e.expires&&s>e.expires):!1}async function g(e,s=Date.now()){let a=[];for(let o of e)await b(o,s)&&a.push(o);let t=a.filter(o=>o.type==="claim");if(t.length){t.sort((r,n)=>r.at-n.at||(r.tid<n.tid?-1:r.tid>n.tid?1:0));let o=t[0];return{state:"claimed",winner:o.tid,by:o.by,amount:o.amount,asset:o.asset,fiat:o.fiat}}let i=a.filter(o=>o.type==="refund");return i.length?(i.sort((o,r)=>o.at-r.at||(o.tid<r.tid?-1:1)),{state:"refunded",winner:i[0].tid}):{state:"open"}}function D(e){return e&&e.transitions?Object.values(e.transitions):[]}async function j(e,s,a=Date.now()){e.transitions=e.transitions||{};for(let t of s||[])e.transitions[t.tid]||await b(t,a)&&(e.transitions[t.tid]=t);return e}var x=()=>({funded:!1,mode:"custodial",committed:null,transitions:{}}),h=new Map;function p(){return{get:e=>h.get(e)||null,set:(e,s)=>h.set(e,s),has:e=>h.has(e)}}function C(e="holo-escrow"){if(typeof localStorage>"u")return p();let s=a=>e+":"+a;return{get:a=>{try{let t=localStorage.getItem(s(a));return t?JSON.parse(t):null}catch{return null}},set:(a,t)=>{try{localStorage.setItem(s(a),JSON.stringify(t))}catch{}},has:a=>{try{return localStorage.getItem(s(a))!=null}catch{return!1}}}}async function E(e,{store:s=null,wallet:a=null,chain:t="base",nowMs:i=null}={}){let o=s||p();if(!e||!e.kappa)return{ok:!1,error:"no payment to fund"};if(!await k(e))return{ok:!1,error:"this payment isn't authentically signed, refusing to fund"};if(!e.hashlock)return{ok:!1,error:"this payment has no escrow lock"};let r=i||Date.now();if(e.expires&&r>e.expires)return{ok:!1,error:"already expired"};let n=o.get(e.kappa);if(n&&n.funded)return{ok:!0,kappa:e.kappa,mode:n.mode,live:n.mode==="live",tx:n.tx,already:!0};let c=a&&typeof a.htlcFund=="function"?"live":"custodial",f=null;if(c==="live")try{f=await a.htlcFund({chain:t,amount:e.amount,token:e.asset,hashlock:e.hashlock,timeout:e.expires})}catch(l){return{ok:!1,error:String(l&&l.message||l)}}let u=n||x();return u.funded=!0,u.mode=c,u.tx=f,u.amount=e.amount,u.asset=e.asset,u.fiat=e.fiat||null,u.expires=e.expires,o.set(e.kappa,u),{ok:!0,kappa:e.kappa,mode:c,live:c==="live",tx:f}}async function F(e,{claimSecret:s=null,claimerPub:a=null,claimerSigner:t=null,store:i=null,nowMs:o=null}={}){let r=i||p(),n=o||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};if(!await k(e))return{ok:!1,error:"this link isn't authentically signed"};if(e.expires&&n>e.expires)return{ok:!1,error:"this payment has expired"};let c=s||e.claimSecret;if(!c)return{ok:!1,error:"this link has no claim key"};if(await d(c)!==e.hashlock)return{ok:!1,error:"this claim key doesn't match the payment"};let f=t||await y(),u=await v(e,{claimSecret:c,signer:f,at:n}),l=r.get(e.kappa)||x();l.funded||(l.offDevice=!0);let M=l.committed&&l.committed!==u.tid;return l.transitions[u.tid]=u,l.committed||(l.committed=u.tid),r.set(e.kappa,l),M?{ok:!1,error:"already claimed"}:{ok:!0,amount:e.amount,asset:e.asset,fiat:e.fiat||null,mode:l.mode,live:l.mode==="live",offDevice:!!l.offDevice,tid:u.tid,claimerPub:a||f.pub,custodialWallet:"\u03BA:"+e.kappa.slice(0,16)}}async function J(e,{store:s=null,signer:a=null,nowMs:t=null}={}){let i=s||p(),o=t||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};let r=i.get(e.kappa);if(!r)return{ok:!1,error:"no escrow to refund"};let n=await g(Object.values(r.transitions),o);if(n.state==="claimed")return{ok:!1,error:"already claimed, can't refund"};if(n.state==="refunded")return{ok:!1,error:"already refunded"};if(!(r.expires&&o>r.expires))return{ok:!1,error:"not yet expired, can't refund"};let c=a||await y(),f=await S(e,{signer:c,at:o});return r.transitions[f.tid]=f,i.set(e.kappa,r),{ok:!0,amount:r.amount,asset:r.asset,mode:r.mode}}async function _(e,{store:s=null,nowMs:a=null}={}){let t=s||p(),i=a||Date.now(),o=typeof e=="string"?e:e&&e.kappa;if(!o)return{state:"none"};let r=t.get(o);if(!r)return{state:"none"};let n=await g(Object.values(r.transitions),i);return n.state==="open"?{state:r.funded?"open":"none",committed:r.committed||null,canonicalWinner:null,reconciled:!1}:{state:n.state,canonicalWinner:n.winner,committed:r.committed||null,reconciled:!!(r.committed&&n.state==="claimed"&&r.committed!==n.winner),by:n.by,amount:n.amount,asset:n.asset}}function N(e,{store:s=null}={}){let a=s||p(),t=typeof e=="string"?e:e&&e.kappa,i=a.get(t);return i?D(i):[]}async function L(e,s,{store:a=null,nowMs:t=null}={}){let i=a||p(),o=t||Date.now(),r=typeof e=="string"?e:e&&e.kappa,n=i.get(r)||x();return await j(n,s||[],o),i.set(r,n),_(r,{store:i,nowMs:o})}export{F as claimEscrow,N as exportPeer,E as fund,C as localStore,L as mergePeer,J as refund,_ as status};

b/310c5b0dfd9e59f3fce276da94235913365a0e8570c2ce5d9290213ca0f3067d

@@ -0,0 +1,378 @@
+// messenger-shadcn-ui.mjs — DROP-IN mount(el, model) rendering the Holo Messenger UX from STREAMING
+// shadcn κ-components, faithful to the real app (network app-rail · Q sidebar · triage · rich rows ·
+// Q chat pane · earth wallpaper · real SVG line icons), same contract as the chatscope bundle.
+//
+// ADDITIVE + SAFE: only takes over window.HoloMessengerUI.mount on opt-in (?ui=shadcn or
+// localStorage["holo.ui.shadcn"]="1"). Default boot stays the untouched chatscope UI.
+//
+// PERF: memoized rows · composer owns its draft · windowed thread (≤WINDOW rows in DOM; 1M chat stays tiny).
+// PASS 1 = faithful shell. Rich message content + action surface are Pass 2/3.
+
+const WANT = (() => {
+  try { const u = new URL(location.href);
+    if (u.searchParams.get("ui") === "shadcn") return true;
+    if (u.searchParams.get("ui") === "chatscope") return false;
+    return localStorage.getItem("holo.ui.shadcn") === "1";
+  } catch { return false; }
+})();
+
+const WINDOW = 80;
+const BRANDS = "/usr/share/brands/";
+const WP = "/apps/holo-messenger/_vendor/wallpaper-default.jpg";   // the earth photo (default)
+const NET_SLUG = { whatsapp: "whatsapp", telegram: "telegram", signal: "signal", imessage: "imessage", instagram: "instagram", messenger: "messenger", discord: "discord", slack: "slack", gmessages: "googlemessages", googlemessages: "googlemessages", x: "x", twitter: "x", linkedin: "linkedin", gmail: "gmail", email: "gmail", internal: null };
+
+const CSS = `
+  .wa{height:100dvh;display:grid;grid-template-columns:64px minmax(300px,.46fr) minmax(0,1fr);background:#0b141a;color:#e9edef;
+    font:14.5px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
+  .wa *{box-sizing:border-box}
+  .wa svg{display:block}
+  .rail{background:#111b21;border-right:1px solid #0a1015;display:flex;flex-direction:column;align-items:center;gap:7px;padding:12px 0}
+  .rb{position:relative;width:46px;height:46px;border-radius:15px;display:grid;place-items:center;cursor:pointer;color:#aebac1;transition:background .12s,color .12s;background:transparent;border:0}
+  .rb:hover{background:#202c33;color:#e9edef}.rb.on{background:#2a3942;color:#00a884}
+  .rb img{width:28px;height:28px;border-radius:8px;object-fit:cover}
+  .rb .dot{position:absolute;right:5px;bottom:5px;width:10px;height:10px;border-radius:50%;background:#00d95f;border:2px solid #111b21}
+  .rb .bdg{position:absolute;top:-3px;right:-3px;min-width:19px;height:19px;border-radius:10px;background:#00a884;color:#0b141a;font-size:11px;font-weight:700;display:grid;place-items:center;padding:0 4px;border:2px solid #111b21}
+  .rsep{width:28px;height:1px;background:#22303a;margin:3px 0}
+  .rgrow{flex:1 1 auto}
+  .rav{width:40px;height:40px;border-radius:50%;overflow:hidden;cursor:pointer;background:radial-gradient(circle at 35% 30%,#7cf0c8,#2b9e7a 60%,#0b3b2e);margin-top:2px}
+  .side{background:#111b21;border-right:1px solid #222d34;display:flex;flex-direction:column;min-width:0}
+  .stitle{display:flex;align-items:center;gap:6px;padding:15px 14px 10px}
+  .stitle .t{font-size:23px;font-weight:600;letter-spacing:-.4px;flex:1 1 auto}
+  .search{padding:4px 12px 8px;position:relative}
+  .search .si{position:absolute;left:26px;top:50%;transform:translateY(-50%);color:#8696a0;pointer-events:none;z-index:1;display:grid}
+  .filt{display:flex;align-items:center;gap:8px;padding:2px 14px 8px}
+  .chip{display:inline-flex;align-items:center;gap:6px;background:#202c33;color:#8696a0;border:0;border-radius:999px;padding:5px 14px;font-size:13px;cursor:pointer}
+  .chip.on{background:#0b3b2e;color:#00d95f}
+  .caret{background:#202c33;color:#8696a0;border:0;border-radius:999px;width:30px;height:28px;display:grid;place-items:center;cursor:pointer;font-size:11px}
+  .triage{margin:2px 12px 8px;display:flex;align-items:center;gap:9px;background:linear-gradient(90deg,#0e2a24,#122a1e);color:#7cf0c8;border:1px solid #123c30;border-radius:14px;padding:9px 14px;font-size:13.5px;cursor:pointer}
+  .triage .sk{color:#00d95f;display:grid;flex:0 0 auto}
+  .chats{flex:1 1 auto;overflow-y:auto;overflow-x:hidden}
+  .chats::-webkit-scrollbar{width:6px}.chats::-webkit-scrollbar-thumb{background:#374248;border-radius:6px}
+  .row{display:flex;gap:13px;align-items:center;padding:9px 14px;cursor:pointer;position:relative}
+  .row:after{content:"";position:absolute;left:78px;right:0;bottom:0;height:1px;background:#1c262d}
+  .row:hover{background:#202c33}.row.on{background:#2a3942}.row.on:after{background:transparent}
+  .av{position:relative;flex:0 0 auto;border-radius:50%;overflow:hidden}
+  .av img{width:100%;height:100%;object-fit:cover;display:block}
+  .row .b{min-width:0;flex:1 1 auto}
+  .row .n{color:#e9edef;font-size:16px;font-weight:400;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;display:flex;align-items:center;gap:6px}
+  .row .p{color:#8696a0;font-size:13.5px;margin-top:2px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;display:flex;align-items:center;gap:3px}
+  .row .rc{color:#53bdeb}
+  .row .m{margin-left:auto;text-align:right;display:flex;flex-direction:column;align-items:flex-end;gap:6px;flex:0 0 auto}
+  .row .t{color:#8696a0;font-size:12px}.row.unread .t{color:#00d95f;font-weight:500}
+  .row .pin{color:#f15c6d;font-size:13px;transform:rotate(45deg)}
+  .netdot{width:16px;height:16px;border-radius:4px;object-fit:cover;flex:0 0 auto}
+  .main{position:relative;display:flex;flex-direction:column;min-width:0;background:#0b141a}
+  .wp{position:absolute;inset:0;background:#0b141a center/cover no-repeat;z-index:0}
+  .wp:after{content:"";position:absolute;inset:0;background:linear-gradient(rgba(11,20,26,.35),rgba(11,20,26,.5))}
+  .mh,.thread,.composer,.e2ewrap{position:relative;z-index:1}
+  .mh{height:60px;flex:0 0 auto;background:#202c33;display:flex;align-items:center;gap:14px;padding:0 16px}
+  .mh .who .n{font-size:16px;color:#e9edef;font-weight:500}
+  .mh .who .s{font-size:13px;color:#00a884;margin-top:1px}
+  .mh .sp{margin-left:auto}.mh .icons{display:flex;gap:2px}
+  .ico{width:40px;height:40px;border-radius:50%;display:grid;place-items:center;color:#aebac1;cursor:pointer;transition:background .12s;background:transparent;border:0}
+  .ico:hover{background:#ffffff14;color:#e9edef}
+  .ico.sk{color:#00d95f}
+  .e2ewrap{display:flex;justify-content:center;padding:14px 0 2px}
+  .e2e{background:#182229;color:#ffd279;font-size:12.5px;padding:6px 14px;border-radius:8px;box-shadow:0 1px .5px #0003}
+  .thread{flex:1 1 auto;overflow-y:auto;overflow-x:hidden;padding:10px 8% 14px;display:flex;flex-direction:column;gap:3px}
+  .thread::-webkit-scrollbar{width:6px}.thread::-webkit-scrollbar-thumb{background:#374248cc;border-radius:6px}
+  .more{align-self:center;color:#8696a0;font-size:12px;padding:8px;opacity:.85}
+  .day{align-self:center;background:#182229;color:#8696a0;font-size:12.5px;padding:5px 12px;border-radius:8px;margin:8px 0 6px;box-shadow:0 1px .5px #0003}
+  .bub{max-width:65%;padding:6px 9px 8px 10px;border-radius:8px;font-size:14.2px;line-height:1.42;box-shadow:0 1px .5px #0003;word-wrap:break-word;white-space:pre-wrap}
+  .in{align-self:flex-start;background:#202c33;border-top-left-radius:0}
+  .out{align-self:flex-end;background:#005c4b;border-top-right-radius:0}
+  .grp{margin-top:8px}
+  .bub .tt{font-size:11px;color:#ffffff8a;float:right;margin:6px 0 -3px 12px;position:relative;top:4px}
+  .bub .tt .rc{color:#53bdeb}
+  .empty{margin:auto;color:#8696a0;text-align:center;background:#182229;padding:8px 16px;border-radius:8px}
+  .composer{flex:0 0 auto;background:#202c33;display:flex;align-items:center;gap:6px;padding:8px 14px}
+  .composer .grow{flex:1 1 auto}
+  .send{width:44px;height:44px;border-radius:50%;background:#00a884;color:#0b141a;border:0;display:grid;place-items:center;cursor:pointer;flex:0 0 auto}
+  /* media */
+  .m-img{display:block;max-width:320px;max-height:340px;border-radius:6px;cursor:pointer;object-fit:cover}
+  .m-vid{position:relative;max-width:320px;border-radius:6px;overflow:hidden;cursor:pointer}
+  .m-vid img{display:block;width:100%;border-radius:6px}
+  .m-play{position:absolute;inset:0;display:grid;place-items:center}
+  .m-play span{width:48px;height:48px;border-radius:50%;background:#0009;color:#fff;display:grid;place-items:center;font-size:20px}
+  .m-file{display:flex;align-items:center;gap:10px;background:#ffffff0f;border-radius:8px;padding:9px 11px;min-width:200px;cursor:pointer}
+  .m-file .fi{width:38px;height:38px;border-radius:8px;background:#00a88433;color:#7cf0c8;display:grid;place-items:center;font-size:16px;flex:0 0 auto}
+  .m-file .fn{font-size:13.5px;color:#e9edef;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+  .m-file .fs{font-size:12px;color:#8696a0;margin-top:2px}
+  .m-aud{display:flex;align-items:center;gap:10px;min-width:220px;padding:2px 0}
+  .m-aud audio{height:34px}
+  .lb{position:fixed;inset:0;background:#000c;z-index:60;display:grid;place-items:center;cursor:zoom-out}
+  .lb img,.lb video{max-width:90vw;max-height:90vh;border-radius:8px}
+  .lb .x{position:absolute;top:18px;right:22px;color:#fff;font-size:28px;cursor:pointer;background:0;border:0}
+  /* attach tray + pay sheet */
+  .tray{position:absolute;bottom:66px;left:14px;background:#233138;border-radius:12px;box-shadow:0 10px 34px #0009;padding:6px;z-index:6;min-width:236px}
+  .tray button{display:flex;align-items:center;gap:11px;width:100%;background:0;border:0;color:#e9edef;font-size:14.5px;padding:10px 12px;border-radius:8px;cursor:pointer;text-align:left}
+  .tray button:hover{background:#2a3942}.tray button:disabled{opacity:.5}
+  .tray .sep{height:1px;background:#2a3942;margin:4px 6px}
+  .paywrap{position:fixed;inset:0;background:#000a;z-index:60;display:grid;place-items:center}
+  .pay{background:#111b21;border-radius:14px;padding:20px;width:346px;max-width:90vw;box-shadow:0 20px 60px #000a}
+  .pay h3{margin:0 0 4px;font-size:17px}.pay .psub{color:#8696a0;font-size:13px;margin-bottom:14px}
+  .pay .seg{display:flex;background:#202c33;border-radius:10px;padding:3px;margin-bottom:14px}
+  .pay .seg button{flex:1;background:0;border:0;color:#8696a0;padding:8px;border-radius:8px;cursor:pointer;font-size:14px}
+  .pay .seg button.on{background:#00a884;color:#0b141a;font-weight:600}
+  .pay .amt{width:100%;background:#202c33;border:0;border-radius:10px;color:#e9edef;font-size:26px;text-align:center;padding:12px;margin-bottom:10px;outline:0}
+  .pay .chips{display:flex;gap:8px;margin-bottom:12px}
+  .pay .chips button{flex:1;background:#202c33;border:0;color:#e9edef;border-radius:8px;padding:9px;cursor:pointer}
+  .pay .chips button.on{background:#0b3b2e;color:#00d95f}
+  .pay .memo{width:100%;background:#202c33;border:0;border-radius:10px;color:#e9edef;padding:10px 12px;margin-bottom:12px;font-size:14px;outline:0}
+  .pay .err{color:#f15c6d;font-size:13px;margin-bottom:8px;text-align:center}
+  .pay .go{width:100%;background:#00a884;color:#0b141a;border:0;border-radius:10px;padding:12px;font-weight:600;cursor:pointer;font-size:15px}
+  .pay .go:disabled{opacity:.5;cursor:default}
+  .pay .cancel{width:100%;background:0;color:#8696a0;border:0;padding:10px;margin-top:6px;cursor:pointer}
+`;
+
+async function ensureImportmap() {
+  if (document.querySelector('script[type="importmap"][data-holo-ui]')) return;
+  const map = await (await fetch("/apps/ui/vendor/importmap.json")).json();
+  const imports = {}; for (const [k, v] of Object.entries(map.imports || map)) imports[k] = typeof v === "string" ? v.replace(/^\.\//, "/apps/ui/") : v;
+  const s = document.createElement("script"); s.type = "importmap"; s.setAttribute("data-holo-ui", "1"); s.textContent = JSON.stringify({ imports }); document.head.appendChild(s);
+}
+let _deps = null;
+async function deps() {
+  if (_deps) return _deps;
+  await ensureImportmap();
+  const React = await import("react");
+  const { createRoot } = await import("react-dom/client");
+  const reg = await (await fetch("/apps/ui/registry/index.json")).json();
+  const K = Object.fromEntries(reg.components.map((c) => [c.name, c.holo]));
+  const [button, badge, avatar, input] = await Promise.all(["button", "badge", "avatar", "input"].map((n) => import(K[n])));
+  return (_deps = { React, createRoot, C: { button, badge, avatar, input } });
+}
+if (!document.getElementById("wa-shadcn-css")) { const st = document.createElement("style"); st.id = "wa-shadcn-css"; st.textContent = CSS; document.head.appendChild(st); }
+
+const initials = (s) => (String(s || "?").trim().split(/\s+/).map((w) => w[0]).join("").slice(0, 2) || "?").toUpperCase();
+const hue = (s) => { let h = 0; s = String(s || ""); for (let i = 0; i < s.length; i++) h = (h * 31 + s.charCodeAt(i)) >>> 0; return `hsl(${h % 360} 40% 46%)`; };
+const isOut = (m) => !!(m && (m.mine || m.out || m.fromMe || m.dir === "out" || m.from === "me" || m.self));
+const threadOf = (model, id) => { try { if (id && model.thread) return model.thread(id) || []; } catch {} return (model.threads && model.threads[id]) || []; };
+const rcMark = (m) => m.status === "read" || m.status === "delivered" ? "✓✓" : m.status === "sent" ? "✓" : "";
+const slugOf = (net) => { const k = String(net || "").toLowerCase(); return NET_SLUG[k] === undefined ? k : NET_SLUG[k]; };
+const mimeKind = (mime, kind) => { const k = String(kind || "").toLowerCase(); if (["image", "video", "audio", "voice"].includes(k)) return k === "voice" ? "audio" : k; const t = String(mime || "").split("/")[0]; if (t === "image" || t === "video" || t === "audio") return t; return "file"; };
+const humanSize = (n) => { n = +n || 0; if (!n) return ""; const u = ["B", "KB", "MB", "GB"]; let i = 0; while (n >= 1024 && i < u.length - 1) { n /= 1024; i++; } return (n < 10 && i ? n.toFixed(1) : Math.round(n)) + " " + u[i]; };
+const fileGlyph = (mime, name) => { const m = String(mime || ""), e = String(name || "").split(".").pop().toLowerCase(); if (m.includes("pdf") || e === "pdf") return "📕"; if (["zip", "rar", "7z"].includes(e)) return "🗜"; if (["doc", "docx"].includes(e)) return "📘"; if (["xls", "xlsx", "csv"].includes(e)) return "📗"; return "📄"; };
+
+function buildApp({ React, C }) {
+  const { createElement: h, memo, useState, useRef, useEffect, useCallback, useLayoutEffect } = React;
+  const Avatar = C.avatar.Avatar, AvatarImage = C.avatar.AvatarImage, AvatarFallback = C.avatar.AvatarFallback;
+  const Button = C.button.Button, Input = C.input.Input, Badge = C.badge.Badge;
+
+  // exact SVG line icons (from the real app's IC set)
+  const svg = (kids, s = 22, w = 1.8) => h("svg", { viewBox: "0 0 24 24", width: s, height: s, fill: "none", stroke: "currentColor", strokeWidth: w, strokeLinecap: "round", strokeLinejoin: "round" }, ...kids);
+  const P = (d, e) => h("path", { d, ...e });
+  const CIR = (cx, cy, r, e) => h("circle", { cx, cy, r, ...e });
+  const RC = (x, y, width, height, rx, e) => h("rect", { x, y, width, height, rx, ...e });
+  const fillC = { fill: "currentColor", stroke: "none" };
+  const IC = {
+    chats: () => svg([P("M20 11.4A7.6 7.6 0 0 1 8.9 18.2L4.5 19.4l1.2-4.2A7.6 7.6 0 1 1 20 11.4Z")]),
+    search: (s) => svg([CIR(11, 11, 7), P("m20 20-3.6-3.6")], s || 19),
+    phone: () => svg([P("M6.6 4H4.5A1.5 1.5 0 0 0 3 5.6 16 16 0 0 0 18.4 21a1.5 1.5 0 0 0 1.6-1.5v-2.1a1.5 1.5 0 0 0-1.2-1.45l-2.2-.45a1.5 1.5 0 0 0-1.5.6l-.5.7a12 12 0 0 1-5.1-5.1l.7-.5a1.5 1.5 0 0 0 .6-1.5l-.45-2.2A1.5 1.5 0 0 0 6.6 4Z")]),
+    video: () => svg([RC(3, 6.5, 12, 11, 2.5), P("m15 10.5 5.5-3v9l-5.5-3Z")]),
+    menu: () => svg([CIR(12, 5, 1.35, fillC), CIR(12, 12, 1.35, fillC), CIR(12, 19, 1.35, fillC)]),
+    newchat: () => svg([P("M13.5 4H6a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-7.5"), P("M18.4 3.6a2 2 0 0 1 2.8 2.8L13 14.6l-3.4.9.9-3.4 7.9-8.5Z")]),
+    emoji: () => svg([CIR(12, 12, 8.5), P("M8.8 14.2a4.2 4.2 0 0 0 6.4 0"), CIR(9, 10, 1, fillC), CIR(15, 10, 1, fillC)]),
+    plus: () => svg([P("M12 5.5v13M5.5 12h13")]),
+    mic: () => svg([RC(9, 3, 6, 11, 3), P("M5.5 11a6.5 6.5 0 0 0 13 0M12 17.5V21M8.5 21h7")]),
+    send: () => svg([P("M4.5 12 20.5 4.5 13 20.5l-2.8-6.4L4.5 12Z")]),
+    spark: (s) => svg([P("M12 3.2l1.7 4.6 4.6 1.7-4.6 1.7L12 15.8l-1.7-4.6L5.7 9.5l4.6-1.7L12 3.2Z"), P("M5.5 15.5l.8 2 2 .8-2 .8-.8 2-.8-2-2-.8 2-.8.8-2Z")], s || 20),
+    sun: () => svg([CIR(12, 12, 4), P("M12 2v2M12 20v2M4 12H2M22 12h-2M5.6 5.6 4.2 4.2M19.8 19.8l-1.4-1.4M18.4 5.6l1.4-1.4M4.2 19.8l1.4-1.4")]),
+    plusThin: () => svg([P("M12 5.5v13M5.5 12h13")], 26, 1.6),
+  };
+
+  const Av = (name, size, bg, src) => h("div", { className: "av", style: { height: size + "px", width: size + "px" } },
+    h(Avatar, { style: { height: "100%", width: "100%", background: bg || hue(name), display: "grid", placeItems: "center" } },
+      src ? h(AvatarImage, { src, alt: "", style: { height: "100%", width: "100%", objectFit: "cover" } }) : null,
+      h(AvatarFallback, { style: { background: bg || hue(name), color: "#fff", fontSize: (size * 0.36) + "px", fontWeight: 500, height: "100%", width: "100%", display: "grid", placeItems: "center" } }, initials(name))));
+  const Ico = (icon, onClick, title, cls) => h("button", { className: "ico" + (cls ? " " + cls : ""), onClick, title }, icon);
+  const netLogo = (net) => { const s = slugOf(net); return s ? h("img", { className: "netdot", src: BRANDS + s + ".svg", alt: "", onError: (e) => { e.currentTarget.style.display = "none"; } }) : null; };
+
+  // rich media in a bubble — image/video/audio/file, with lazy bridge-media resolution
+  function MediaView({ media, model, onMedia }) {
+    const [url, setUrl] = useState(media.url || media.thumb || "");
+    const bucket = mimeKind(media.mime, media.kind);
+    useEffect(() => { let alive = true;
+      if (!media.url && (media.lazy || media.pending || media.ref) && model.resolveBridgeMedia) {
+        Promise.resolve(model.resolveBridgeMedia(media)).then((u) => { if (alive && u) setUrl(typeof u === "string" ? u : (u.url || u.src || "")); }).catch(() => {});
+      } return () => { alive = false; }; }, []);
+    if (bucket === "image") return url ? h("img", { className: "m-img", src: url, alt: "", loading: "lazy", onClick: () => onMedia({ kind: "image", url }) }) : h("div", { className: "m-file" }, "🖼 Photo");
+    if (bucket === "video") return h("div", { className: "m-vid", onClick: () => onMedia({ kind: "video", url }) }, h("img", { src: media.thumb || url, alt: "" }), h("div", { className: "m-play" }, h("span", {}, "▶")));
+    if (bucket === "audio") return h("div", { className: "m-aud" }, url ? h("audio", { controls: true, src: url }) : h("span", {}, "🎤 Voice message"));
+    return h("div", { className: "m-file", onClick: () => url && window.open(url, "_blank") }, h("div", { className: "fi" }, fileGlyph(media.mime, media.filename)), h("div", { style: { minWidth: 0 } }, h("div", { className: "fn" }, media.filename || "File"), media.size ? h("div", { className: "fs" }, humanSize(media.size)) : null));
+  }
+
+  const Rail = memo(function Rail({ nets, active, totalUnread, onPick }) {
+    return h("nav", { className: "rail" },
+      h("button", { className: "rb" + (active === "All" ? " on" : ""), title: "All chats", onClick: () => onPick("All") }, IC.chats(), totalUnread ? h("span", { className: "bdg" }, totalUnread > 99 ? "99+" : totalUnread) : null),
+      nets.length ? h("div", { className: "rsep" }) : null,
+      nets.map((n) => h("button", { key: n.id, className: "rb" + (active === n.id ? " on" : ""), title: n.label, onClick: () => onPick(n.id) },
+        (() => { const s = slugOf(n.id); return s ? h("img", { src: BRANDS + s + ".svg", alt: n.label, onError: (e) => { const t = document.createTextNode((n.label || "?")[0].toUpperCase()); try { e.currentTarget.replaceWith(t); } catch {} } }) : (n.label || "?")[0].toUpperCase(); })(),
+        h("span", { className: "dot" }), n.unread ? h("span", { className: "bdg" }, n.unread > 99 ? "99+" : n.unread) : null)),
+      h("button", { className: "rb", title: "Add network", onClick: () => onPick("+") }, IC.plusThin()),
+      h("div", { className: "rgrow" }),
+      h("div", { className: "rav" }));
+  });
+
+  const Row = memo(function Row({ c, on, preview, receipt, onSelect }) {
+    return h("div", { className: "row" + (on ? " on" : "") + (c.unread ? " unread" : ""), onClick: () => onSelect(c.id) },
+      Av(c.name, 49, c.isQ ? "#12b886" : hue(c.name), c.avatar),
+      h("div", { className: "b" },
+        h("div", { className: "n" }, c.name || c.id || "Chat", c.network ? netLogo(c.network) : null),
+        h("div", { className: "p" }, receipt ? h("span", { className: "rc" }, receipt + " ") : null, preview)),
+      h("div", { className: "m" },
+        h("div", { className: "t" }, c.time || c.ts || ""),
+        c.pinned ? h("span", { className: "pin" }, "📌") : null,
+        c.unread ? h(Badge, { style: { background: "#00a884", color: "#0b141a", borderRadius: "999px", height: "20px", minWidth: "20px", justifyContent: "center", padding: "0 6px", fontSize: "12px", fontWeight: 600 } }, String(c.unread)) : null));
+  });
+
+  function Thread({ model, activeId, onMedia }) {
+    const all = threadOf(model, activeId);
+    const [limit, setLimit] = useState(WINDOW);
+    const ref = useRef(null), prevId = useRef(activeId), anchorH = useRef(0), pin = useRef(true);
+    const toBottom = (el) => { el.scrollTop = el.scrollHeight; };
+    useEffect(() => { setLimit(WINDOW); }, [activeId]);
+    // Runs after every render (no deps): a fresh chat, or new messages arriving, both flow through here.
+    // While "pinned" we stay glued to the newest message — exactly like WhatsApp.
+    useLayoutEffect(() => { const el = ref.current; if (!el) return;
+      if (prevId.current !== activeId) { prevId.current = activeId; pin.current = true; anchorH.current = 0; toBottom(el); return; }
+      if (anchorH.current) { el.scrollTop = el.scrollHeight - anchorH.current; anchorH.current = 0; return; }
+      if (pin.current) toBottom(el); });
+    // Media resolves async (placeholder first, <img> swapped in later) and reflows the thread AFTER layout.
+    // A ResizeObserver on the scroll container won't catch it (its own box size never changes), and per-image
+    // listeners miss images added later — so listen for `load` in the CAPTURE phase on the container, which
+    // fires for ANY descendant image whenever it appears/loads. Keeps us glued to the newest message.
+    useEffect(() => { const el = ref.current; if (!el) return; pin.current = true; toBottom(el);
+      requestAnimationFrame(() => { if (pin.current && ref.current) toBottom(ref.current); });
+      const stick = () => { if (pin.current && ref.current) toBottom(ref.current); };
+      el.addEventListener("load", stick, true); el.addEventListener("error", stick, true);
+      return () => { el.removeEventListener("load", stick, true); el.removeEventListener("error", stick, true); };
+    }, [activeId]);
+    // Detach when the user scrolls up; re-attach ("jump to latest") once they're back near the bottom.
+    const onScroll = useCallback((e) => { const el = e.currentTarget;
+      pin.current = el.scrollHeight - el.scrollTop - el.clientHeight < 80;
+      if (el.scrollTop < 120 && limit < all.length) { anchorH.current = el.scrollHeight; setLimit((l) => Math.min(all.length, l + WINDOW)); } }, [limit, all.length]);
+    const start = Math.max(0, all.length - limit), shown = all.slice(start);
+    if (!all.length) return h("div", { className: "thread", ref }, h("div", { className: "empty" }, "No messages yet. Say hello 👋"));
+    const rows = [h("div", { className: "e2ewrap", key: "e2e" }, h("div", { className: "e2e" }, "🔒 Messages are end-to-end encrypted")), h("div", { className: "day", key: "day" }, "Today")];
+    if (start > 0) rows.push(h("div", { className: "more", key: "more" }, `↑ ${start.toLocaleString()} earlier — scroll up`));
+    let lastOut = null;
+    shown.forEach((m, i) => { const out = isOut(m); const hasMedia = m.media && (m.media.url || m.media.thumb || m.media.ref || m.media.lazy || m.media.kind);
+      rows.push(h("div", { key: start + i, className: "bub " + (out ? "out" : "in") + (out !== lastOut ? " grp" : ""), style: hasMedia ? { maxWidth: "min(360px,72%)" } : null },
+        hasMedia ? h(MediaView, { media: m.media, model, onMedia }) : null,
+        m.text ? h("div", { style: hasMedia ? { marginTop: "5px" } : null }, m.text) : null,
+        h("span", { className: "tt" }, (m.time || m.ts || ""), out ? h("span", { className: "rc" }, " " + rcMark(m)) : null)));
+      lastOut = out; });
+    return h("div", { className: "thread", ref, onScroll }, rows);
+  }
+
+  const Composer = memo(function Composer({ activeId, onSend, onPlus }) {
+    const [draft, setDraft] = useState("");
+    const send = () => { const t = draft.trim(); if (!t) return; onSend(activeId, t); setDraft(""); };
+    return h("div", { className: "composer" },
+      Ico(IC.plus(), onPlus, "Attach"),
+      h("div", { className: "grow" }, h(Input, { placeholder: "Type a message", value: draft, autoFocus: true,
+        onChange: (e) => setDraft(e.target.value), onKeyDown: (e) => { if (e.key === "Enter" && !e.shiftKey) { e.preventDefault(); send(); } },
+        style: { background: "#2a3942", border: "0", borderRadius: "10px", height: "44px", color: "#e9edef", paddingLeft: "16px" } })),
+      h("button", { className: "send", onClick: send, "aria-label": "Send" }, draft.trim() ? IC.send() : IC.mic()));
+  });
+
+  const TrayBtn = (glyph, label, onClick, disabled) => h("button", { onClick, disabled }, h("span", { style: { fontSize: "17px" } }, glyph), label);
+
+  function PaySheet({ model, activeId, conv, sheet, setSheet }) {
+    const set = (patch) => setSheet((s) => ({ ...s, ...patch, err: null }));
+    const amt = parseFloat(sheet.amount);
+    const go = async () => { set({ busy: true }); let r;
+      try { r = await model.holoPay(sheet.genesis || activeId, { kind: sheet.kind, amount: amt, memo: (sheet.memo || "").trim() }); } catch (e) { r = { ok: false, error: String(e && e.message || e) }; }
+      if (r && r.ok) setSheet(null); else setSheet((s) => ({ ...s, busy: false, err: (r && r.error) || "Couldn't create the payment" })); };
+    return h("div", { className: "paywrap", onClick: () => setSheet(null) },
+      h("div", { className: "pay", onClick: (e) => e.stopPropagation() },
+        h("h3", {}, sheet.kind === "send" ? "Send money" : "Request money"), h("div", { className: "psub" }, (sheet.kind === "send" ? "To " : "From ") + (conv.name || "this chat")),
+        h("div", { className: "seg" }, h("button", { className: sheet.kind === "send" ? "on" : "", onClick: () => set({ kind: "send" }) }, "Send"), h("button", { className: sheet.kind === "request" ? "on" : "", onClick: () => set({ kind: "request" }) }, "Request")),
+        h("input", { className: "amt", inputMode: "decimal", placeholder: "$0", value: sheet.amount, onChange: (e) => set({ amount: e.target.value.replace(/[^0-9.]/g, "") }), autoFocus: true }),
+        h("div", { className: "chips" }, [10, 20, 50, 100].map((a) => h("button", { key: a, className: amt === a ? "on" : "", onClick: () => set({ amount: String(a) }) }, "$" + a))),
+        h("input", { className: "memo", placeholder: "What's it for? (optional)", maxLength: 120, value: sheet.memo || "", onChange: (e) => set({ memo: e.target.value }) }),
+        sheet.err ? h("div", { className: "err" }, sheet.err) : null,
+        h("button", { className: "go", disabled: sheet.busy || !(amt > 0), onClick: go }, sheet.busy ? (sheet.kind === "send" ? "Confirm in your wallet…" : "Creating…") : ((sheet.kind === "send" ? "Send" : "Request") + (amt > 0 ? " $" + sheet.amount : " money"))),
+        h("button", { className: "cancel", onClick: () => setSheet(null) }, "Cancel")));
+  }
+
+  const previewOf = (model, c) => { if (c.preview) return c.preview; const t = threadOf(model, c.id); const last = t.length ? t[t.length - 1] : null; return (last && (last.text || (last.media ? "📎 media" : ""))) || ""; };
+
+  return function App({ model }) {
+    const convs = Array.isArray(model.conversations) ? model.conversations : [];
+    const [activeId, setActiveId] = useState(null);
+    const [filter, setFilter] = useState("All");
+    const [q, setQ] = useState("");
+    const [lb, setLb] = useState(null);
+    const [attachOpen, setAttachOpen] = useState(false);
+    const [paySheet, setPaySheet] = useState(null);
+    const fileRef = useRef(null);
+    const onSelect = useCallback((id) => { setActiveId(id); setAttachOpen(false); }, []);
+    const active = (activeId && convs.some((c) => c.id === activeId)) ? activeId : ((convs.find((c) => c.active) || convs[0] || {}).id || null);
+    const conv = convs.find((c) => c.id === active) || {};
+    const onSend = useCallback((id, text) => { try { model.onSend && model.onSend(id, text); } catch (e) { console.error("[shadcn-ui] onSend", e); } }, [model]);
+    const call = useCallback((video) => { try { model.startCall && model.startCall(active, { video }); } catch (e) { console.error("[shadcn-ui] startCall", e); } }, [model, active]);
+    const pickFile = (accept) => { if (fileRef.current) { fileRef.current.accept = accept; fileRef.current.click(); } setAttachOpen(false); };
+    const onFile = (e) => { const f = e.target.files && e.target.files[0]; if (f) { try { model.onAttach && model.onAttach(active, f); } catch (er) { console.error("[shadcn-ui] onAttach", er); } } e.target.value = ""; };
+    const tryM = (fn, ...a) => { setAttachOpen(false); try { const r = model[fn] && model[fn](...a); if (r && r.catch) r.catch(() => {}); } catch (e) { console.error("[shadcn-ui] " + fn, e); } };
+    const nets = Array.isArray(model.networks) && model.networks.length ? model.networks
+      : Object.values(convs.reduce((a, c) => { const id = (c.network || c.platform); if (id && !a[id]) a[id] = { id, label: id[0].toUpperCase() + id.slice(1), unread: 0 }; if (id) a[id].unread += (c.unread || 0); return a; }, {}));
+    const totalUnread = convs.reduce((n, c) => n + (c.unread || 0), 0);
+    const signalUnread = model.signalUnread != null ? model.signalUnread : convs.filter((c) => c.unread).length;
+    const qs = q.trim().toLowerCase();
+    const shown = convs.filter((c) => (filter === "All" || (c.network || c.platform) === filter) && (!qs || (c.name || "").toLowerCase().includes(qs) || (previewOf(model, c) || "").toLowerCase().includes(qs)));
+    const sub = conv.presence || (conv.isQ ? "online · on your device" : (conv.status || conv.network || conv.platform || ""));
+    const runSearch = () => { const t = q.trim(); if (!t) return; try { if (model.qCommand) model.qCommand(t); else if (model.onNewChat) model.onNewChat(t); } catch {} };
+
+    return h("div", { className: "wa" },
+      h(Rail, { nets, active: filter, totalUnread, onPick: (id) => { if (id === "+") { try { model.openNetworks && model.openNetworks(); } catch {} } else setFilter(id); } }),
+      h("div", { className: "side" },
+        h("div", { className: "stitle" }, h("span", { className: "t" }, "Messenger"),
+          model.askQ ? Ico(IC.spark(), () => { try { model.askQ(); } catch {} }, "Ask Q", "sk") : null, Ico(IC.newchat(), () => { try { model.onNewChat && model.onNewChat(""); } catch {} }, "New chat")),
+        h("div", { className: "search" }, h("span", { className: "si" }, IC.search()),
+          h(Input, { placeholder: "Search, ask Q, or start a chat…", value: q, onChange: (e) => setQ(e.target.value), onKeyDown: (e) => { if (e.key === "Enter") runSearch(); },
+            style: { background: "#202c33", border: "0", borderRadius: "10px", height: "42px", color: "#e9edef", paddingLeft: "40px", fontSize: "14.5px" } })),
+        signalUnread ? h("div", { className: "triage" }, h("span", { className: "sk" }, IC.spark(18)), `${signalUnread} need you · ~${Math.max(1, Math.round(signalUnread * 0.4))} min`) : null,
+        h("div", { className: "chats" }, shown.map((c) => h(Row, { key: c.id, c, on: c.id === active, preview: previewOf(model, c), receipt: c.receipt || "", onSelect })))),
+      h("div", { className: "main" },
+        h("div", { className: "wp", style: { backgroundImage: `url(${WP})` } }),
+        h("div", { className: "mh" }, Av(conv.name, 40, conv.isQ ? "#12b886" : hue(conv.name), conv.avatar),
+          h("div", { className: "who" }, h("div", { className: "n" }, conv.name || ""), sub ? h("div", { className: "s" }, sub) : null),
+          h("div", { className: "sp" }), h("div", { className: "icons" }, Ico(IC.video(), () => call(true), "Video call"), Ico(IC.phone(), () => call(false), "Voice call"), Ico(IC.menu(), () => { try { model.onFavourite && model.onFavourite(active); } catch {} }, "Menu"))),
+        h(Thread, { model, activeId: active, onMedia: setLb }),
+        h("input", { ref: fileRef, type: "file", style: { display: "none" }, onChange: onFile }),
+        attachOpen ? h("div", { className: "tray" },
+          TrayBtn("🖼", "Photos & videos", () => pickFile("image/*,video/*")),
+          TrayBtn("📄", "Document", () => pickFile("*/*")),
+          (conv.network && !conv.isQ && model.holoPay) ? TrayBtn("💸", "Send money", () => { setAttachOpen(false); setPaySheet({ kind: "send", amount: "", memo: "", busy: false, err: null }); }) : null,
+          h("div", { className: "sep" }),
+          model.startMeet ? TrayBtn("👥", "Start a meeting", () => tryM("startMeet", active, { video: true })) : null,
+          model.startTogether ? TrayBtn("🖥", "Share my screen", () => tryM("startTogether", active, { kind: "tab", title: "" })) : null,
+          model.startTogether ? TrayBtn("📝", "Co-edit a doc", () => tryM("startTogether", active, { kind: "doc", title: "" })) : null,
+          (conv.network && !conv.isQ && model.qDraft) ? [h("div", { className: "sep", key: "s" }), TrayBtn("✨", "Draft a reply with Q", () => tryM("qDraft", active))] : null) : null,
+        h(Composer, { key: active, activeId: active, onSend, onPlus: () => setAttachOpen((v) => !v) })),
+      lb ? h("div", { className: "lb", onClick: () => setLb(null) }, h("button", { className: "x", "aria-label": "Close" }, "✕"),
+        lb.kind === "video" ? h("video", { src: lb.url, controls: true, autoPlay: true, onClick: (e) => e.stopPropagation() }) : h("img", { src: lb.url, alt: "", onClick: (e) => e.stopPropagation() })) : null,
+      paySheet ? h(PaySheet, { model, activeId: active, conv, sheet: paySheet, setSheet: setPaySheet }) : null);
+  };
+}
+
+async function mount(el, model) {
+  const d = await deps();
+  const App = buildApp(d);
+  let cur = model;
+  const root = d.createRoot(el);
+  const render = (mdl) => { cur = mdl || cur; root.render(d.React.createElement(App, { model: cur })); };
+  render(model);
+  console.log("[shadcn-ui] Holo Messenger (Pass 1) mounted from κ-components ·", (model.conversations || []).length, "chats");
+  return { update: render, unmount: () => { try { root.unmount(); } catch {} } };
+}
+
+if (WANT && typeof window !== "undefined") {
+  const prev = window.HoloMessengerUI;
+  window.HoloMessengerUI = { mount, version: ((prev && prev.version) || "m1") + "+shadcn", _chatscope: prev };
+  console.log("[shadcn-ui] streaming-κ shadcn UI ACTIVE (opt out: ?ui=chatscope)");
+}
+
+export { mount };

b/331a35dfd2b4774673ed92da26b0c78fecd336a70ecc8ff890256e835f7ccfd9

@@ -0,0 +1,130 @@
+// holo-m1-boot.mjs — M1: INSTANT SERVERLESS BOOT. One self-verifying link boots the WHOLE messenger.
+//
+// A single web link that, opened in a COLD browser, brings up the entire Holo Messenger — shell + your
+// identity + Q — with ZERO origin servers in the delivery path (every shell byte is a content-addressed κ
+// object, served from cache/OPFS on repeat opens). The descriptor travels INSIDE the link (b64url JSON in
+// the URL fragment), exactly like holo-chat-link.mjs / holo-together.mjs: a bare browser verifies it LOCALLY
+// (Law L5: re-derive the κ), then boots. The κ is SHA-256 of the canonical PUBLIC fields — the shareable,
+// tamper-evident id. Any private pairing bearer is EXCLUDED from the κ (whoever holds the link may adopt it).
+//
+// This commits to the SHELL MANIFEST (the exact asset set the service worker precaches), so a tampered link
+// that points the boot at a different/injected asset set breaks integrity and is refused. Laws: L2 canonical,
+// L5 verify-by-re-derivation. Additive + fail-soft: if anything here throws, app.html's normal boot proceeds.
+
+export const BOOT_LINK_VERSION = 1;
+const ENTRY_PATH = "/apps/holo-messenger/app.html";
+
+// THE SHELL — the minimal asset set required to paint the messenger and reach interactive, and the single
+// source of truth the service worker precaches (messenger-sw.js mirrors these basenames; the M1 witness
+// asserts the two never drift). Q's brain, the bridges, and all media are DELIBERATELY absent: they are
+// deferred (never on the first-paint critical path), so the shell stays tiny and cache-resident.
+export const SHELL_MANIFEST = [
+  "/apps/holo-messenger/app.html",
+  "/apps/holo-messenger/_vendor/ui/chat-ui.bundle.js",
+  "/apps/holo-messenger/_vendor/ui/chat-ui.bundle.css",
+  "/apps/holo-messenger/holo-messenger-login.mjs",
+  "/apps/holo-messenger/holo-messenger-app.mjs",
+  "/apps/holo-messenger/messenger-shadcn-ui.mjs",
+  "/apps/holo-messenger/holo-messenger-weave.mjs",
+  "/apps/holo-messenger/messenger-skin.mjs",
+  "/apps/holo-messenger/messenger-skins.css",
+  "/apps/holo-messenger/messenger-sw-register.mjs",
+  "/apps/holo-messenger/holo-m1-boot.mjs",
+  "/apps/holo-messenger/holo-release-boot.mjs",
+  "/apps/holo-messenger/holo-release-verify.mjs",
+  "/apps/holo-messenger/mail/holo-mail-attach.mjs",
+  "/apps/holo-messenger/_vendor/wallpaper-default.jpg",
+];
+
+const _te = new TextEncoder();
+async function _sha256hex(s) { const h = await (globalThis.crypto || crypto).subtle.digest("SHA-256", _te.encode(s)); return [...new Uint8Array(h)].map((x) => x.toString(16).padStart(2, "0")).join(""); }
+function _b64urlEncode(obj) { const b = btoa(unescape(encodeURIComponent(JSON.stringify(obj)))); return b.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""); }
+function _b64urlDecode(str) { const b = String(str).replace(/-/g, "+").replace(/_/g, "/"); return JSON.parse(decodeURIComponent(escape(atob(b)))); }
+
+// The shell manifest (shell-manifest.json, minted by _build/gen-shell-manifest.mjs) is the content hash of
+// every shell BYTE: [{ path, kappa=SHA-256(bytes) }]. In a browser we fetch it; in Node the caller passes it.
+export async function loadShellManifest() {
+  try {
+    if (typeof fetch === "function" && typeof location !== "undefined") {
+      const r = await fetch(new URL("./shell-manifest.json", import.meta.url), { cache: "no-store" });   // module-relative: same file at the OS root or any static mount
+      if (r && r.ok) return await r.json();
+    }
+  } catch {}
+  return null;
+}
+
+// The ONE hash the boot link commits: SHA-256 over the SORTED per-asset content κs. Any browser re-derives it
+// from shell-manifest.json → thereby verifies EVERY shell byte (Law L5). Recomputed from `assets`, never trusting
+// the manifest's self-declared `aggregate`, so a forged manifest fails. Empty (unverifiable) → no commitment.
+export async function shellAggregate(manifest) {
+  const m = manifest || (await loadShellManifest());
+  if (!m || !Array.isArray(m.assets) || !m.assets.length) return "";
+  return _sha256hex(m.assets.map((a) => String(a.kappa)).sort().join(","));
+}
+
+// canonical PUBLIC form — any private `pair` bearer is EXCLUDED so the κ is the shareable id. Commits to the
+// entry, the shell set, the display identity (so a tampered "this is <who>'s messenger" card breaks — anti-phish).
+function _canon(d) {
+  return [
+    "v" + (d.v | 0), d.kind || "boot", d.app || "holo-messenger", d.entry || ENTRY_PATH,
+    d.shell || "", d.name || "", d.truename || "", d.op || "",
+    String(d.created || 0), String(d.expires || 0),
+  ].join("␟");
+}
+
+// Build the one-link door for the whole messenger. `op`/`name`/`truename` are PUBLIC display identity (the
+// landing shows "resume <name>'s messenger"); `pair` is an optional bearer pairing payload (device-roam) and
+// is NOT part of the κ. Opening the link still auto-enrolls a sovereign identity unless a pair bearer is honored.
+export async function makeBootLink({ op = "", name = "", truename = "", pair = null, ttlSeconds = 30 * 24 * 3600, origin = null, nowMs = null, aggregate = null, manifest = null } = {}) {
+  const now = nowMs || Date.now();
+  const shell = aggregate || (await shellAggregate(manifest));      // commit the shell BYTES (aggregate content κ)
+  const d = {
+    v: BOOT_LINK_VERSION, kind: "boot", app: "holo-messenger", entry: ENTRY_PATH,
+    shell,
+    op: String(op || "").slice(0, 96), name: String(name || "").slice(0, 60), truename: String(truename || "").slice(0, 60),
+    created: now, expires: now + ttlSeconds * 1000,
+  };
+  if (pair) d.pair = pair;                         // bearer pairing payload — NOT part of the κ
+  d.kappa = await _sha256hex(_canon(d));
+  const payload = _b64urlEncode(d);
+  const org = origin || (typeof location !== "undefined" ? location.origin : "");
+  return { kappa: d.kappa, payload, descriptor: d,
+    https: `${org}${ENTRY_PATH}#m1=${payload}`,     // opens in ANY cold browser
+    holo: `holo://os${ENTRY_PATH}#m1=${payload}` }; // in-shell full surface
+}
+
+// parse a boot link (URL, holo:// form, `#m1=<payload>`, or bare payload) → { ok, descriptor, integrity, expired }.
+export async function parseBootLink(input, { nowMs = null, aggregate = null, manifest = null } = {}) {
+  let payload = String(input || "");
+  if (payload.includes("#")) payload = payload.split("#").pop();
+  payload = payload.replace(/^m1=/, "");
+  let d; try { d = _b64urlDecode(payload); } catch { return { ok: false, error: "unreadable boot link" }; }
+  if (!d || d.v !== BOOT_LINK_VERSION || d.kind !== "boot" || d.app !== "holo-messenger" || !d.kappa) return { ok: false, error: "not a valid messenger boot link" };
+  const integrity = (await _sha256hex(_canon(d))) === d.kappa;                     // Law L5: re-derive; tamper → false
+  const current = aggregate != null ? aggregate : (await shellAggregate(manifest));// THIS build's shell-byte aggregate
+  const shellMatches = !!current && d.shell === current;                           // link's shell BYTES must match (unverifiable → false)
+  const expired = !!(d.expires && (nowMs || Date.now()) > d.expires);
+  return { ok: true, descriptor: d, integrity, shellMatches, expired, aggregate: current };
+}
+
+// convenience: verify + return the boot descriptor only if it is safe to act on (integrity + shell + fresh).
+export async function resolveBootLink(input, opts = {}) {
+  const p = await parseBootLink(input, opts);
+  if (!p.ok) return { ok: false, reason: p.error };
+  if (!p.integrity) return { ok: false, reason: "tampered" };
+  if (!p.shellMatches) return { ok: false, reason: "shell-mismatch" };
+  if (p.expired) return { ok: false, reason: "expired" };
+  return { ok: true, descriptor: p.descriptor, pair: p.descriptor.pair || null };
+}
+
+export function describe(d) {
+  const who = (d && (d.name || d.truename)) || "someone";
+  return { headline: `Resume ${who}'s messenger`, cta: "Open" };
+}
+
+export function installM1Boot() {
+  if (typeof window === "undefined") return false;
+  window.HoloM1Boot = Object.assign(window.HoloM1Boot || {}, { version: BOOT_LINK_VERSION, SHELL_MANIFEST, makeBootLink, parseBootLink, resolveBootLink, describe, loadShellManifest, shellAggregate });
+  return true;
+}
+try { installM1Boot(); } catch {}

b/3370b22070b56218a57df6406e2e4ba7cc171e942d4d1f2ae4297ea2c4c08d9c

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3370b22070b56218a57df6406e2e4ba7cc171e942d4d1f2ae4297ea2c4c08d9c
+size 2999771

b/438bd84d968d05dadd9f0ac1fd49a00c9d24f88a4ac45a9f46df236e7af2961e

@@ -0,0 +1 @@
+function l(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=decodeURIComponent(escape(atob(t)));return JSON.parse(n)}var i=["v","kind","amount","asset","fiat","to","toName","from","fromName","memo","created","expires","claimSecret","pub","sig"];function u(e){let t=l(e);if(!Array.isArray(t))return t;let n={};return i.forEach((a,o)=>{t[o]!=null&&(n[a]=t[o])}),n.memo==null&&(n.memo=""),n}async function p(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest("SHA-256",t);return[...new Uint8Array(n)].map(a=>a.toString(16).padStart(2,"0")).join("")}var y=p;function r(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function s(e){let t=atob(e.replace(/-/g,"+").replace(/_/g,"/")),n=new Uint8Array(t.length);for(let a=0;a<t.length;a++)n[a]=t.charCodeAt(a);return n}async function w(){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),t=new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey));return{pub:r(t),sign:async n=>r(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.privateKey,new TextEncoder().encode(n))))}}async function c(e,t,n){try{let a=await crypto.subtle.importKey("raw",s(e),{name:"ECDSA",namedCurve:"P-256"},!1,["verify"]);return await crypto.subtle.verify({name:"ECDSA",hash:"SHA-256"},a,s(t),new TextEncoder().encode(n))}catch{return!1}}var h=c;async function b(e){return!e||!e.pub||!e.sig?!1:c(e.pub,e.sig,d(e))}function d(e){let t=[e.v,e.kind,e.amount,e.asset,e.fiat||"",e.to||"",e.toName||"",e.from||"",e.fromName||"",e.memo||"",e.created||"",e.expires||""];return(e.hashlock||e.pub)&&t.push(e.hashlock||"",e.pub||""),t.join("|")}var f={USD:"$",EUR:"\u20AC",GBP:"\xA3"};function g(e){let t=Number(e.amount);return e.fiat?`${f[e.fiat]||""}${t.toFixed(2)}`:`${t%1===0?t:t.toFixed(4).replace(/0+$/,"")} ${e.asset}`}var m=/(https?:\/\/\S*pay-claim\.html#([A-Za-z0-9_-]+))|(holo:\/\/pay\/\S*#([A-Za-z0-9_-]+))/;function S(e){let t=String(e||"").match(m);if(!t)return null;let n=t[2]||t[4],a=t[0];try{let o=u(n);if(o&&o.v===1&&Number(o.amount)>0)return{intent:o,url:a,payload:n}}catch{}return null}export{y as a,w as b,h as c,b as d,g as e,S as f};

b/6d4dc944c87c9a8ca7dfa0c65244c010722defe6e010b8a43a4782e2366aa82e

@@ -0,0 +1 @@
+import{a as h,b as x,c as j,d as v}from"./chunk-T5ND76FC.js";import"./chunk-SQE76S5B.js";function y(e){return["L1",e.type,e.kappa,e.hashlock||"",e.preimage||"",String(e.amount??""),e.asset||"",e.fiat||"",String(e.expires||""),e.by||"",String(e.at||"")].join("|")}async function C(e,{claimSecret:i,signer:r,at:a}){let l={type:"claim",kappa:e.kappa,hashlock:e.hashlock,preimage:i,amount:e.amount,asset:e.asset,fiat:e.fiat||null,expires:e.expires,by:r.pub,at:a};return l.sig=await r.sign(y(l)),l.tid=await h(y(l)),l}async function E(e,{signer:i,at:r}){let a={type:"refund",kappa:e.kappa,expires:e.expires,by:i.pub,at:r};return a.sig=await i.sign(y(a)),a.tid=await h(y(a)),a}async function M(e,i){return!e||!e.type||!e.kappa||!e.by||!e.sig||!await j(e.by,e.sig,y(e))?!1:e.type==="claim"?!(!e.preimage||await h(e.preimage)!==e.hashlock||e.expires&&e.at>e.expires):e.type==="refund"?!!(e.expires&&i>e.expires):!1}async function S(e,i=Date.now()){let r=[];for(let n of e)await M(n,i)&&r.push(n);let a=r.filter(n=>n.type==="claim");if(a.length){a.sort((s,t)=>s.at-t.at||(s.tid<t.tid?-1:s.tid>t.tid?1:0));let n=a[0];return{state:"claimed",winner:n.tid,by:n.by,amount:n.amount,asset:n.asset,fiat:n.fiat}}let l=r.filter(n=>n.type==="refund");return l.length?(l.sort((n,s)=>n.at-s.at||(n.tid<s.tid?-1:1)),{state:"refunded",winner:l[0].tid}):{state:"open"}}function _(e){return e&&e.transitions?Object.values(e.transitions):[]}async function P(e,i,r=Date.now()){e.transitions=e.transitions||{};for(let a of i||[])e.transitions[a.tid]||await M(a,r)&&(e.transitions[a.tid]=a);return e}var D=()=>({funded:!1,mode:"custodial",committed:null,transitions:{}}),b=new Map;function m(){return{get:e=>b.get(e)||null,set:(e,i)=>b.set(e,i),has:e=>b.has(e)}}function L(e="holo-escrow"){if(typeof localStorage>"u")return m();let i=r=>e+":"+r;return{get:r=>{try{let a=localStorage.getItem(i(r));return a?JSON.parse(a):null}catch{return null}},set:(r,a)=>{try{localStorage.setItem(i(r),JSON.stringify(a))}catch{}},has:r=>{try{return localStorage.getItem(i(r))!=null}catch{return!1}}}}async function q(e,{store:i=null,wallet:r=null,chain:a="base",nowMs:l=null}={}){let n=i||m();if(!e||!e.kappa)return{ok:!1,error:"no payment to fund"};if(!await v(e))return{ok:!1,error:"this payment isn't authentically signed, refusing to fund"};if(!e.hashlock)return{ok:!1,error:"this payment has no escrow lock"};let s=l||Date.now();if(e.expires&&s>e.expires)return{ok:!1,error:"already expired"};let t=n.get(e.kappa);if(t&&t.funded)return{ok:!0,kappa:e.kappa,mode:t.mode,live:t.mode==="live",tx:t.tx,already:!0};let u=r&&typeof r.htlcFund=="function"?"live":"custodial",f=null,p=null;if(u==="live"){let o;try{o=await r.htlcFund({chain:a,amount:e.amount,token:e.asset,hashlock:e.hashlock,timeout:e.expires})}catch(k){return{ok:!1,error:String(k&&k.message||k)}}f=o&&(o.tx||o.hash)||null,p=o&&o.swapId||e.hashlock}let c=t||D();return c.funded=!0,c.mode=u,c.tx=f,c.swapId=p,c.chain=u==="live"?a:null,c.amount=e.amount,c.asset=e.asset,c.fiat=e.fiat||null,c.expires=e.expires,n.set(e.kappa,c),{ok:!0,kappa:e.kappa,mode:u,live:u==="live",tx:f,swapId:p}}async function z(e,{claimSecret:i=null,claimerPub:r=null,claimerSigner:a=null,store:l=null,nowMs:n=null,wallet:s=null}={}){let t=l||m(),u=n||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};if(!await v(e))return{ok:!1,error:"this link isn't authentically signed"};if(e.expires&&u>e.expires)return{ok:!1,error:"this payment has expired"};let f=i||e.claimSecret;if(!f)return{ok:!1,error:"this link has no claim key"};if(await h(f)!==e.hashlock)return{ok:!1,error:"this claim key doesn't match the payment"};let p=a||await x(),c=await C(e,{claimSecret:f,signer:p,at:u}),o=t.get(e.kappa)||D();o.funded||(o.offDevice=!0);let k=o.committed&&o.committed!==c.tid;if(o.transitions[c.tid]=c,o.committed||(o.committed=c.tid),t.set(e.kappa,o),k)return{ok:!1,error:"already claimed"};let R=null,g=o.mode==="live";if(s&&typeof s.htlcClaim=="function")try{let d=g?{chain:o.chain}:typeof s.htlcSwapExists=="function"?await s.htlcSwapExists({hashlock:e.hashlock}):null;if(d){g=!0,o.mode="live",o.chain=o.chain||d.chain||null,t.set(e.kappa,o);let w=await s.htlcClaim({chain:o.chain||d.chain,hashlock:e.hashlock,preimage:f});R=w&&(w.tx||w.hash)||null}}catch(d){return{ok:!1,error:"on-chain claim failed: "+String(d&&d.message||d)}}return{ok:!0,amount:e.amount,asset:e.asset,fiat:e.fiat||null,mode:o.mode,live:g,offDevice:!!o.offDevice,tid:c.tid,tx:R,claimerPub:r||p.pub,custodialWallet:g?null:"\u03BA:"+e.kappa.slice(0,16)}}async function A(e,{store:i=null,signer:r=null,nowMs:a=null,wallet:l=null}={}){let n=i||m(),s=a||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};let t=n.get(e.kappa);if(!t)return{ok:!1,error:"no escrow to refund"};let u=await S(Object.values(t.transitions),s);if(u.state==="claimed")return{ok:!1,error:"already claimed, can't refund"};if(u.state==="refunded")return{ok:!1,error:"already refunded"};if(!(t.expires&&s>t.expires))return{ok:!1,error:"not yet expired, can't refund"};let f=r||await x(),p=await E(e,{signer:f,at:s});t.transitions[p.tid]=p,n.set(e.kappa,t);let c=null;if(t.mode==="live"&&l&&typeof l.htlcRefund=="function")try{let o=await l.htlcRefund({chain:t.chain,hashlock:e.hashlock});c=o&&(o.tx||o.hash)||null}catch(o){return{ok:!1,error:"on-chain refund failed: "+String(o&&o.message||o)}}return{ok:!0,amount:t.amount,asset:t.asset,mode:t.mode,live:t.mode==="live",tx:c}}async function T(e,{store:i=null,nowMs:r=null}={}){let a=i||m(),l=r||Date.now(),n=typeof e=="string"?e:e&&e.kappa;if(!n)return{state:"none"};let s=a.get(n);if(!s)return{state:"none"};let t=await S(Object.values(s.transitions),l);return t.state==="open"?{state:s.funded?"open":"none",committed:s.committed||null,canonicalWinner:null,reconciled:!1}:{state:t.state,canonicalWinner:t.winner,committed:s.committed||null,reconciled:!!(s.committed&&t.state==="claimed"&&s.committed!==t.winner),by:t.by,amount:t.amount,asset:t.asset}}function B(e,{store:i=null}={}){let r=i||m(),a=typeof e=="string"?e:e&&e.kappa,l=r.get(a);return l?_(l):[]}async function G(e,i,{store:r=null,nowMs:a=null}={}){let l=r||m(),n=a||Date.now(),s=typeof e=="string"?e:e&&e.kappa,t=l.get(s)||D();return await P(t,i||[],n),l.set(s,t),T(s,{store:l,nowMs:n})}export{z as claimEscrow,B as exportPeer,q as fund,L as localStore,G as mergePeer,A as refund,T as status};

b/6e815d50e2ba13e8011d0b43218ef9ae5be3fe466eabe4bdfecf4bdb73942946

@@ -0,0 +1,208 @@
+<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>Holo Messenger</title>
+<!-- AI agents: guest access into the Hologram system is one call away — window.HoloLogin.guest() or open
+     ?guest=1. Full machine-readable contract in script#holo-agent-login (JSON). Mirrors holo://login. -->
+<meta name="ai-agent-login" content="Guest mode: act now with window.HoloLogin.guest() or ?guest=1 (ephemeral, no human). Biometric ('It's me') needs the person. See script#holo-agent-login.">
+
+<link rel="stylesheet" href="/apps/holo-messenger/_vendor/ui/chat-ui.bundle.css?v=e0b2a13d7c38">
+<style>html,body{height:100%;margin:0;background:#0b141a;color-scheme:dark}#root{height:100vh}</style>
+<link rel="preload" as="image" href="/apps/holo-messenger/_vendor/wallpaper-default.jpg" fetchpriority="high">
+<!-- ── TEE SIGN-IN GATE (holo-messenger-login.mjs) ─────────────────────────────────────────────────
+     A full-bleed lock overlay above #root, IDENTICAL to the OS native CEF greeter — the messenger does
+     not paint until a sovereign identity is established (Windows Hello / Touch ID via holo-webauthn →
+     holo-login κ). This is the never-blank baseline first-paint; the module ENHANCES it (real biometric
+     wiring). φ-proportioned, black-on-teal, glass-unfog on success — the same vocabulary as holo://login. -->
+<style>
+  #holo-login{position:fixed;inset:0;z-index:2147483000;color:#f4f7fc;
+    font-family:"Segoe UI",system-ui,-apple-system,"Oxygen",sans-serif;--phi:1.618;
+    --u:clamp(16px,1.7vmin,19px);--g1:calc(var(--u)*1.618);--g2:calc(var(--u)*2.618);
+    --avatar:clamp(96px,calc(var(--u)*6.854),128px);--field:min(86vw,calc(var(--avatar)*2.618));
+    --accent:#7defc9;--accent-2:#34d3a6;--ink-dim:rgba(231,237,250,.82);}
+  #holo-login *{box-sizing:border-box;}
+  #holo-login .hl-wall{position:fixed;inset:0;z-index:0;background:#05070c center/cover no-repeat;}
+  /* the wallpaper shows EXACTLY as the home screen wears it — no blur, no scrim. The layer stays only as
+     the unfog animation target; text/buttons carry their own shadows for legibility. */
+  #holo-login .hl-frost{position:fixed;inset:0;z-index:1;background:transparent;pointer-events:none;}
+  #holo-login .hl-lock{position:fixed;inset:0;z-index:2;display:grid;place-items:center;padding:var(--g2);}
+  #holo-login .hl-panel{display:flex;flex-direction:column;align-items:center;text-align:center;width:var(--field);max-width:92vw;}
+  #holo-login .hl-avatar{width:var(--avatar);height:var(--avatar);border-radius:50%;display:grid;place-items:center;color:#fff;
+    font-size:calc(var(--avatar)*.37);font-weight:600;letter-spacing:.02em;user-select:none;
+    box-shadow:0 .6em 1.8em rgba(0,0,0,.4),inset 0 0 0 2px rgba(255,255,255,.6);}
+  #holo-login .hl-avatar svg{width:62%;height:62%;opacity:.92;}
+  #holo-login .hl-name{margin:var(--g1) 0 0;font-size:calc(var(--u)*1.618);font-weight:300;line-height:1.15;text-shadow:0 2px 18px rgba(0,0,0,.45);}
+  #holo-login .hl-auth{margin-top:var(--g1);display:flex;flex-direction:column;align-items:center;gap:var(--u);width:100%;}
+  #holo-login .hl-bio{width:100%;min-height:max(var(--g2),48px);border:0;border-radius:calc(var(--u)*.7);cursor:pointer;
+    display:inline-flex;align-items:center;justify-content:center;gap:calc(var(--u)*.55);font-size:var(--u);font-weight:600;color:#06140f;
+    background:linear-gradient(135deg,var(--accent),var(--accent-2));box-shadow:0 .7em 1.6em rgba(52,211,166,.32);font-family:inherit;
+    transition:transform .12s,box-shadow .18s,filter .18s;}
+  #holo-login .hl-bio:hover{transform:translateY(-1px);box-shadow:0 .9em 2em rgba(52,211,166,.46);filter:brightness(1.05);}
+  #holo-login .hl-bio:active{transform:translateY(0) scale(.99);}
+  #holo-login .hl-bio:disabled{opacity:.7;cursor:default;}
+  #holo-login .hl-bio svg{width:1.18em;height:1.18em;}
+  #holo-login .hl-alt{background:none;border:0;color:var(--ink-dim);font-size:var(--u);font-family:inherit;cursor:pointer;
+    padding:calc(var(--u)*.3) calc(var(--u)*.55);border-radius:calc(var(--u)*.4);display:inline-flex;align-items:center;gap:calc(var(--u)*.4);transition:color .15s;min-height:44px;}
+  #holo-login .hl-alt:hover{color:#fff;}
+  #holo-login .hl-alt svg{width:1.05em;height:1.05em;}
+  /* "More options" is subordinate to the two core actions — quieter, smaller, brightening on hover. */
+  #holo-login .hl-more{opacity:.72;font-size:calc(var(--u)*.92);}
+  #holo-login .hl-more:hover{opacity:1;}
+  #holo-login .hl-opts{display:flex;gap:calc(var(--u)*.3);justify-content:center;flex-wrap:wrap;}
+  #holo-login .hl-opts[hidden]{display:none;}
+  #holo-login .status{min-height:calc(var(--u)*1.5);font-size:var(--u);color:#c4f3e2;display:flex;align-items:center;justify-content:center;gap:calc(var(--u)*.5);text-shadow:0 1px 8px rgba(0,0,0,.4);}
+  #holo-login .status.err{color:#ffc0c0;}
+  #holo-login .spin{width:1em;height:1em;border-radius:50%;border:2px solid rgba(125,239,201,.28);border-top-color:var(--accent);animation:hl-spin .7s linear infinite;flex:0 0 auto;}
+  @keyframes hl-spin{to{transform:rotate(360deg);}}
+  #holo-login .hl-panel{animation:hl-rise .7s cubic-bezier(.4,0,.2,1) .05s both;}
+  @keyframes hl-rise{from{opacity:0;transform:translateY(10px) scale(.99);filter:blur(2px);}to{opacity:1;transform:none;filter:none;}}
+  /* GLASS UNFOG on success — frost dissolves + panel lifts; boot() paints the messenger beneath, no seam. */
+  #holo-login.unfog .hl-frost{animation:hl-defog .72s cubic-bezier(.4,0,.2,1) forwards;}
+  #holo-login.unfog .hl-panel{animation:hl-lift .68s cubic-bezier(.4,0,.2,1) forwards;pointer-events:none;}
+  @keyframes hl-defog{to{opacity:0;}}
+  @keyframes hl-lift{to{opacity:0;transform:translateY(-10px) scale(1.03);}}
+  @media (prefers-reduced-motion:reduce){#holo-login .hl-panel,#holo-login .spin{animation:none;}#holo-login.unfog .hl-frost,#holo-login.unfog .hl-panel{animation:hl-defog .3s ease forwards;}}
+  /* PLYMOUTH BOOT BEAT — while .hl-boot, the machine is booting: pure splash, panel held. holo-plymouth.mjs
+     lifts it (or the baseline's own 1.8s timer does — never a lock-out). Must live HERE for the 0-ms frame. */
+  #holo-login.hl-boot .hl-panel{opacity:0!important;pointer-events:none!important;}
+  #holo-login .hl-panel{transition:opacity .55s ease;}
+</style>
+</head><body>
+<div id="root"></div>
+
+<!-- the lock overlay + BASELINE first-paint (synchronous, dependency-free): paints a working "It's me"
+     panel on the FIRST frame from a tiny local greeting cache (holo.lastOperator — the SAME hint the OS
+     greeter writes), so a returning operator's name + button appear with zero identity/model load. The
+     module below wires the real biometric; this only ever OWNS the frame until it lands. -->
+<div id="holo-login"><div class="hl-wall"></div><div class="hl-frost"></div><main class="hl-lock"><div class="hl-panel" id="holo-login-panel"></div></main></div>
+
+<!-- Machine-readable sign-in contract for AI agents — always in the DOM, even before scripts run, so an
+     agent can discover guest access by parsing the page. Read by window.HoloLogin.options. Mirrors the OS
+     greeter's #holo-agent-login. Guest = act now (no human); biometric = ask the person. -->
+<script type="application/json" id="holo-agent-login">
+{
+  "service": "Holo Messenger sign-in",
+  "audience": "ai-agent",
+  "summary": "Two ways in. Guest is instant and needs no human; the biometric needs the person.",
+  "options": [
+    {
+      "id": "guest",
+      "title": "Guest",
+      "persistent": false,
+      "requiresHuman": false,
+      "do": { "navigate": "?guest=1", "call": "window.HoloLogin.guest()" },
+      "result": "An instant, private, ephemeral guest session into the Hologram system (Holo Messenger). No biometric and no human needed. Nothing persists after the session ends."
+    },
+    {
+      "id": "biometric",
+      "title": "It’s me",
+      "persistent": true,
+      "requiresHuman": true,
+      "do": { "tap": "the 'It’s me' / 'Sign in' button", "then": "ask the person to approve with their device biometric (Windows Hello / Touch ID)" },
+      "result": "Signs in with this device's TEE to the operator's sovereign identity (the SAME κ as the OS). An agent cannot complete this alone."
+    }
+  ]
+}
+</script>
+<script>
+(function () {
+  try { if (navigator.storage && navigator.storage.persist) navigator.storage.persist().catch(function(){}); } catch (e) {}
+  var panel = document.getElementById("holo-login-panel"); if (!panel) return;
+  var esc = function (s) { return String(s).replace(/[&<>"]/g, function (c) { return ({ "&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;" }[c]); }); };
+  var op = null; try { op = JSON.parse(localStorage.getItem("holo.lastOperator") || "null"); } catch (e) {}
+  // Paint the SHARED wallpaper behind the lock at first frame (the same one the desktop + home wear), so the
+  // sign-in is never a black void. A live-sim / none / plain falls back to the shipped default photo — the SAME
+  // default the home shows — so login and home always match. κ → content route; a path/url passes through.
+  try {
+    var _tw = ""; try { _tw = (JSON.parse(localStorage.getItem("holo.theme.v1") || "{}") || {}).wallpaper || ""; } catch (e) {}
+    var _km = String(_tw).match(/^(sha256|blake3|sha512):([0-9a-f]+)$/i);
+    var _wp = _km ? ("/.holo/" + _km[1].toLowerCase() + "/" + _km[2]) : ((!_tw || _tw === "plain" || /^live:/i.test(_tw)) ? "" : _tw);
+    // MATCH THE HOME EXACTLY: the messenger home resolves its wallpaper as holo.theme.v1 → the messenger's own
+    // "holo-messenger/wallpaper-src" pick → the shipped default. The lock skipped the middle step, so a wallpaper
+    // set only via the messenger's picker showed on home but not here. Fold that same fallback in — one chain,
+    // so the sign-in glass and the desktop it lifts onto are never two different photos.
+    if (!_wp) { try { _wp = localStorage.getItem("holo-messenger/wallpaper-src") || ""; } catch (e) {} }
+    if (!_wp) _wp = "/apps/holo-messenger/_vendor/wallpaper-default.jpg";
+    var _wall = document.querySelector("#holo-login .hl-wall");
+    if (_wall) _wall.style.backgroundImage = 'url("' + _wp + '")';
+    // PLYMOUTH BOOT SPLASH baseline (holo-plymouth.mjs owns the real player; this is the 0-ms frame). Once a
+    // boot style has been worn (holo.plymouth.v1 persisted), a cold open paints BLACK + the sealed frame-0
+    // synchronously — the machine boots like a machine — and the panel holds for one boot beat behind
+    // .hl-boot. Fail-open: a timer lifts the beat even if the module never arrives; first-ever boot (no
+    // state yet) keeps the wallpaper baseline untouched.
+    try {
+      var _pl = JSON.parse(localStorage.getItem("holo.plymouth.v1") || "null");
+      if (_pl && _pl.on && _wall) {
+        _wall.style.background = "#000";
+        if (_pl.firstFrame) { _wall.style.backgroundImage = 'url("' + _pl.firstFrame + '")'; _wall.style.backgroundRepeat = "no-repeat"; _wall.style.backgroundPosition = "center"; _wall.style.backgroundSize = "auto"; }
+        var _rm = false; try { _rm = matchMedia("(prefers-reduced-motion: reduce)").matches; } catch (e) {}
+        var _ov = document.getElementById("holo-login");
+        if (_ov && !_rm) { _ov.classList.add("hl-boot"); setTimeout(function () { try { _ov.classList.remove("hl-boot"); } catch (e) {} }, 1800); }
+      }
+    } catch (e) {}
+  } catch (e) {}
+  var fp = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round"><path d="M5.5 11a6.5 6.5 0 0 1 13 0"/><path d="M8.5 11a3.5 3.5 0 0 1 7 0v2.6"/><path d="M12 11v4.4"/><path d="M8.6 14.2V16"/><path d="M15.4 15.4V18"/></svg>';
+  var person = '<svg viewBox="0 0 24 24" fill="currentColor"><circle cx="12" cy="8.4" r="4.1"/><path d="M3.8 20.4a8.2 8.2 0 0 1 16.4 0z"/></svg>';
+  var avatar, name, label;
+  if (op && op.label) {
+    var hue = (op.hue != null ? op.hue : 210) | 0;
+    var ini = op.label.trim().split(/\s+/).map(function (w) { return w[0]; }).filter(Boolean).slice(0, 2).join("").toUpperCase() || "·";
+    avatar = '<div class="hl-avatar" style="background:linear-gradient(140deg,hsl(' + hue + ' 52% 46%),hsl(' + (hue + 26) + ' 52% 46%))">' + esc(ini) + '</div>';
+    name = esc(op.label); label = "It’s me";
+  } else {
+    avatar = '<div class="hl-avatar" style="background:linear-gradient(140deg,#5b6b86,#3a455c)">' + person + '</div>';
+    name = "Welcome"; label = "Sign in";
+  }
+  panel.innerHTML = avatar + '<h1 class="hl-name">' + name + '</h1><div class="hl-auth"><button class="hl-bio" id="hl-baseline">' + fp + label + '</button><div class="status"></div></div>';
+  var b = document.getElementById("hl-baseline"); if (b) b.onclick = function () { b.disabled = true; location.reload(); };
+})();
+</script>
+
+<!-- NATIVE MEDIA — the real OS media stack, loaded into the top page so the messenger rail delivers the exact
+     native experience: window.HoloVinyl = the "NOW PLAYING" pill (preloaded Ben Böhmer "Begin Again"), streamed
+     through the same-origin /sc/* routes the dev server now answers (holo-sc-route.mjs → yt-dlp). holo-fx.js
+     drives the live equalizer; holo-vinyl lazily pulls holo-audio.js for the Hi-Fi chain. Each self-guards on the
+     widgets/dock runtime, so they run standalone here. Classic defer → they set their globals before the bundle boots. -->
+<script src="/usr/lib/holo/holo-fx.js" defer></script>
+<script src="/usr/lib/holo/holo-vinyl.js" defer></script>
+<script src="/usr/lib/holo/holo-video.js" defer></script>
+
+<script type="module">
+  // ?v=N - bump on each deploy so the browser can never serve a stale cached bundle (the cause of a frozen/old build).
+  import "/apps/holo-messenger/_vendor/ui/chat-ui.bundle.js?v=5deebbd5a4fd";   // → window.HoloMessengerUI
+  // Opt-in: render the WhatsApp UX from STREAMING shadcn κ-components instead of the chatscope bundle.
+  // Lazy — the module loads ONLY when opted in (?ui=shadcn or holo.ui.shadcn=1); the default boot never
+  // parses it. Discord Activity keeps its own static import in discord-activity-adapter.mjs.
+  try {
+    if (new URLSearchParams(location.search).get("ui") === "shadcn" || localStorage.getItem("holo.ui.shadcn") === "1")
+      await import("/apps/holo-messenger/messenger-shadcn-ui.mjs");
+  } catch {}
+  import { boot } from "/apps/holo-messenger/holo-messenger-app.mjs?v=adeea1b4a160";
+
+  const root = document.getElementById("root");
+  // TEE GATE + SPECULATIVE WARM PAINT, one motion. The gate (holo-webauthn + holo-login) renders the lock and
+  // runs the biometric; meanwhile boot() starts IMMEDIATELY behind the glass, painting the messenger from the
+  // local κ-snapshot during the human's look-and-tap. boot awaits the auth ONLY at its identity step, so the
+  // biometric overlaps an already-live UI and loginSucceeded just unfogs onto it (tap → interactive ≈ one
+  // frame). Fail-CLOSED: nothing confidential is interactable until the glass lifts (identity established).
+  // Fail-SOFT only if the gate MODULE can't load — then boot uses its own device-stable identity, never bricked.
+  (async () => {
+    let authP = Promise.resolve(null);
+    try { const { mountLogin } = await import("/apps/holo-messenger/holo-messenger-login.mjs?v=signin1"); authP = mountLogin({ root }); }
+    catch (e) { try { const ov = document.getElementById("holo-login"); if (ov) ov.remove(); } catch {} console.warn("[login] gate unavailable, booting device-stable identity:", e); }
+    // Pass the PROMISE, not an awaited value: boot warm-paints now and blocks for identity only where it must.
+    boot(root, authP).catch((e) => {
+      document.body.innerHTML = "<pre style='color:#f88;padding:16px;white-space:pre-wrap'>boot error: " + (e && e.stack || e) + "</pre>";
+    });
+  })();
+
+  // Intelligent Inbox (holo-mail) - additive, OFF by default. Enable per-operator: localStorage["holo.mail.enabled"]="1".
+  import("/apps/holo-messenger/mail/holo-mail-attach.mjs").catch(() => {});
+  // HoloChat, woven into THIS messenger — one canonical surface. Enable: localStorage["holo.chat.enabled"]="1" or ?chat=1.
+  import("/apps/holo-messenger/holo-messenger-weave.mjs").catch(() => {});
+  // Colour re-tone picker — colours only, all features intact. Gated: ?skins=1 or localStorage["holo.skins"]="1".
+  import("/apps/holo-messenger/messenger-skin.mjs?v=8d34a1e9297f").catch(() => {});
+  // Asset cache (service worker) — repeat opens serve the shell NETWORK-FREE. Escape hatch: open with ?nosw=1.
+  import("/apps/holo-messenger/messenger-sw-register.mjs").catch(() => {});
+</script>
+</body></html>

b/716223384b22303f78bbd63c947ab539dc9a2fd796104d9a2192b063df89b00c

@@ -0,0 +1,24 @@
+// holo-messenger-login.mjs — thin adapter: the messenger mounts the ONE sovereign sign-in primitive.
+//
+// The whole sign-in stack — TEE ceremony · sovereign κ · SSO · guest · roam/recovery · Deep Resume · warm
+// paint — now lives ONCE in /usr/lib/holo/holo-signin.mjs, so every holospace (and, next, the OS greeter)
+// inherits it from a single call. This file supplies only the messenger's specifics: its session label, the
+// shell it opens, and a warm-paint thunk that pulls the messenger's M1 shell bytes during the biometric tap.
+
+import { signIn } from "/usr/lib/holo/holo-signin.mjs";
+
+// warm the messenger shell (M1 SHELL_MANIFEST) during the human's look-and-tap, so post-auth boot is cache-hot.
+function warmMessengerShell() {
+  try {
+    import("/apps/holo-messenger/holo-m1-boot.mjs")
+      .then((m) => { for (const p of (m.SHELL_MANIFEST || [])) { try { fetch(p, { cache: "force-cache" }).catch(() => {}); } catch {} } })
+      .catch(() => {});
+  } catch {}
+}
+
+// mountLogin({ root, params }) — unchanged contract for app.html: resolves { principal, operator, secret }.
+export const mountLogin = (opts = {}) => signIn({
+  app: "messenger", appName: "Holo Messenger", nextPath: "/apps/holo-messenger/app.html",
+  warmPaint: warmMessengerShell, ...opts,
+});
+export default mountLogin;

b/7247a61220c39a750bc27806475dd592f15e763f3b128c54e2c0580039aec673

@@ -0,0 +1,41 @@
+// messenger-sw-register.mjs — eagerly register the ONE messenger service worker (holo-sw.js: Reach push +
+// M1 shell cache) on boot, so repeat opens are network-free even before push permission is granted. Additive
+// + catch-guarded so it can never block boot. Escape hatch: open with ?nosw=1 to unregister it.
+//
+// holo-sw.js is ALSO registered by the Reach push flow (holo-push.mjs) — same script, same {type:module}, same
+// dir scope, so the two calls collapse to one registration (idempotent). We register here too because caching
+// must not wait on push. We also retire any stale competing worker (the old messenger-sw.js) at this scope.
+
+(async () => {
+  if (!("serviceWorker" in navigator)) return;
+  try {
+    const u = new URL(location.href);
+    // DEV ITERATION: on the dev-serve port (8472) OR with ?nosw=1, never let a worker cache the shell — it makes
+    // edits appear "still old" until a hard-refresh. Unregister any worker at this scope AND drop its caches so the
+    // next plain reload is always the live build. The M1 shell-cache stays intact on every other origin/port
+    // (guest :8493, host, holo://), so `holo m1-verify` and production instant-boot are unaffected.
+    const devIterate = location.port === "8472" || location.port === "8474" || u.searchParams.get("nosw") === "1";
+    if (devIterate) {
+      for (const r of await navigator.serviceWorker.getRegistrations()) {
+        if ((r.scope || "").includes("/apps/holo-messenger/")) await r.unregister();
+      }
+      try { if (window.caches) for (const k of await caches.keys()) if (k.startsWith("holo-msgr-")) await caches.delete(k); } catch {}
+      console.log("[msgr-sw] dev/nosw — worker unregistered + shell caches cleared, serving live");
+      return;
+    }
+    // retire the old competing cache-worker if a previous build left it controlling this scope.
+    try {
+      for (const r of await navigator.serviceWorker.getRegistrations()) {
+        const s = (r.active && r.active.scriptURL) || (r.installing && r.installing.scriptURL) || (r.waiting && r.waiting.scriptURL) || "";
+        if (s.includes("/messenger-sw.js")) { await r.unregister(); console.log("[msgr-sw] retired stale messenger-sw.js"); }
+      }
+    } catch {}
+    // Module-relative registration: resolves to /apps/holo-messenger/ at the OS root and to <base>/apps/holo-messenger/
+    // on a mounted static host (e.g. GitHub Pages /<repo>/) — one registrar, every mount point.
+    await navigator.serviceWorker.register(new URL("./holo-sw.js", import.meta.url), { type: "module", scope: new URL("./", import.meta.url).pathname });
+    console.log("[msgr-sw] one worker active (push + shell cache) — repeat opens serve the shell network-free");
+    // S3: verify the SIGNED release pointer off the critical path — the standing trust bar for the worker
+    // (what an #m1 link used to grant, now on every open). Fail-soft here; fail-closed inside the module.
+    try { await import("./holo-release-boot.mjs"); } catch {}
+  } catch (e) { /* never block boot */ }
+})();

b/7d883ae6cf3e4495a3377e83d4cedef8f4141c15cf8166884e0efad2592f15e9

@@ -0,0 +1,262 @@
+/* messenger-skins.css — OPTIONAL colour re-tones, applied ONLY when <html> carries data-skin="…".
+ * Default (no attribute) is untouched, so this can never disturb the shipping look. Colours only — no
+ * layout — safe and fully reversible.
+ *
+ * The theme drives ~half its colour from --wa-* vars on .holo-wa-root and hardcodes the other half to the
+ * same values. This shared block re-points the major hardcoded surfaces back onto the vars; each skin then
+ * only remaps the vars and the whole surface re-tones consistently. */
+
+html[data-skin] .holo-wa-root { background: var(--wa-bg) !important; color: var(--wa-ink); }
+html[data-skin] .holo-wa-root .cs-main-container,
+html[data-skin] .holo-wa-root .cs-chat-container,
+html[data-skin] .holo-wa-root .cs-message-list { background: transparent; }
+html[data-skin] .holo-wa-root .cs-sidebar,
+html[data-skin] .holo-wa-root .holo-rail,
+html[data-skin] .holo-wa-root .cs-conversation-list { background: var(--wa-side) !important; }
+html[data-skin] .holo-wa-root .cs-conversation-header,
+html[data-skin] .holo-wa-root .holo-list-title,
+html[data-skin] .holo-wa-root .cs-message-input,
+html[data-skin] .holo-wa-root .holo-composer { background: var(--wa-head) !important; }
+html[data-skin] .holo-wa-root .cs-search,
+html[data-skin] .holo-wa-root .holo-wp-search,
+html[data-skin] .holo-wa-root .cs-message-input__content-editor-wrapper,
+html[data-skin] .holo-wa-root .cs-message-input__content-editor { background: color-mix(in srgb, var(--wa-head) 78%, var(--wa-bg)) !important; color: var(--wa-ink) !important; }
+html[data-skin] .holo-wa-root .cs-conversation:hover,
+html[data-skin] .holo-wa-root .cs-conversation.cs-conversation--active { background: var(--wa-head) !important; }
+html[data-skin] .holo-wa-root .cs-conversation__name,
+html[data-skin] .holo-wa-root .cs-conversation-header__user-name { color: var(--wa-ink) !important; }
+html[data-skin] .holo-wa-root .cs-conversation__info,
+html[data-skin] .holo-wa-root .cs-conversation__last-sender,
+html[data-skin] .holo-wa-root .cs-conversation-header__info { color: var(--wa-dim) !important; }
+html[data-skin] .holo-wa-root .cs-message--incoming .cs-message__content { background: var(--wa-in) !important; color: var(--wa-ink) !important; }
+html[data-skin] .holo-wa-root .cs-message--outgoing .cs-message__content { background: var(--wa-out) !important; }
+html[data-skin] .holo-wa-root .cs-message__content { color: var(--wa-ink); }
+html[data-skin] .holo-wa-root .holo-rail-btn.on,
+html[data-skin] .holo-wa-root .holo-rail-net.on,
+html[data-skin] .holo-wa-root .holo-catchup-pill { color: var(--wa-accent) !important; }
+html[data-skin] .holo-wa-root .holo-c-send,
+html[data-skin] .holo-wa-root .cs-button--send { background: var(--wa-accent) !important; }
+
+/* ── cooler / graphite ── */
+html[data-skin="graphite"] .holo-wa-root { --wa-bg:#0d1117; --wa-side:#12171e; --wa-head:#1c232c; --wa-in:#1c232c; --wa-out:#1f4a55; --wa-ink:#e6eaf0; --wa-dim:#8b96a3; --wa-accent:#4ab3d4; --wa-line:#222a34; }
+/* ── warmer ── */
+html[data-skin="warm"] .holo-wa-root { --wa-bg:#14100c; --wa-side:#1b1611; --wa-head:#271f18; --wa-in:#271f18; --wa-out:#4d3f1f; --wa-ink:#efe8df; --wa-dim:#a89a88; --wa-accent:#e0a53c; --wa-line:#2c241b; }
+/* ── higher contrast ── */
+html[data-skin="contrast"] .holo-wa-root { --wa-bg:#000000; --wa-side:#0a0a0a; --wa-head:#181818; --wa-in:#1d1d1d; --wa-out:#00805e; --wa-ink:#ffffff; --wa-dim:#a6adb4; --wa-accent:#00e08a; --wa-line:#2a2a2a; }
+/* ── light mode (experimental: some deep-hardcoded text may stay dark) ── */
+html[data-skin="light"] .holo-wa-root { --wa-bg:#d7dce1; --wa-side:#ffffff; --wa-head:#f0f2f5; --wa-in:#ffffff; --wa-out:#d9fdd3; --wa-ink:#111b21; --wa-dim:#54656f; --wa-accent:#008069; --wa-line:#e4e8ec; }
+html[data-skin="light"] .holo-wa-root .cs-message__content { color: #111b21 !important; }
+html[data-skin="light"] .holo-wa-root .cs-message-list { background: var(--wa-bg) !important; background-image: none !important; }
+html[data-skin="light"] .holo-wa-root .holo-wp-tile { background-image: none !important; }
+
+/* ────────────────────────────────────────────────────────────────────────────────────────────────
+ * HI-DPI + HIGH-FPS layer (always on, colour-independent). The honest "8K/retina" story: a DOM/CSS UI
+ * is ALREADY resolution-independent — text and the SVG icons are vectors, so on a retina/4K/8K panel it
+ * renders at the display's native device pixels with zero extra work (no bitmaps to upscale). What we
+ * actually tune here is smoothness + latency:
+ *   • content-visibility skips rendering/layout of off-screen chat rows → a huge list scrolls at the
+ *     display's full refresh (60/120Hz) and first paint is near-instant (browser does O(visible) work).
+ *   • the scrollers are promoted to their own GPU layer so scrolling never touches the main thread.
+ *   • crisp text rasterisation + high-quality image scaling for hi-DPI. */
+.holo-wa-root { -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility; }
+.holo-wa-root .cs-conversation { content-visibility: auto; contain-intrinsic-size: auto 72px; }
+.holo-wa-root .cs-message { content-visibility: auto; contain-intrinsic-size: auto 44px; }
+.holo-wa-root .cs-conversation-list,
+.holo-wa-root .cs-message-list .scrollbar-container,
+.holo-wa-root .cs-message-list__scroll-wrapper { will-change: scroll-position; transform: translateZ(0); backface-visibility: hidden; overflow-anchor: auto; }
+.holo-wa-root .cs-avatar img, .holo-wa-root .holo-av-real, .holo-wa-root .holo-media-el img { image-rendering: auto; }
+.holo-wa-root .holo-media-el img, .holo-wa-root .cs-message img { image-rendering: -webkit-optimize-contrast; }
+@media (min-resolution: 1.5dppx) { .holo-wa-root { text-rendering: geometricPrecision; } }
+
+/* floating skin picker */
+.holo-skin-pick { position: fixed; right: 16px; bottom: 86px; z-index: 90; display: flex; gap: 4px; align-items: center; background: #0b141aee; border: 1px solid #2a3942; border-radius: 999px; padding: 5px; backdrop-filter: blur(10px); font: 12.5px ui-sans-serif, system-ui, sans-serif; box-shadow: 0 8px 30px #0007; }
+.holo-skin-pick button { background: transparent; border: 0; color: #aebac1; border-radius: 999px; padding: 5px 11px; cursor: pointer; }
+.holo-skin-pick button:hover { background: #ffffff14; color: #e9edef; }
+.holo-skin-pick button.on { background: #00a884; color: #0b141a; font-weight: 600; }
+
+/* instant wallpaper */
+/* An inline low-res earth paints INSTANTLY (zero network — it ships in this CSS) as the chat-pane
+ * backdrop; the full 2560px wallpaper is preloaded (see app.html) and covers it the moment it decodes.
+ * So the pane is never empty and there is no visible load. */
+html[data-skin] .holo-wa-root .cs-chat-container { background: var(--wa-bg) url("data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDABQODxIPDRQSERIXFhQYHzMhHxwcHz8tLyUzSkFOTUlBSEZSXHZkUldvWEZIZoxob3p9hIWET2ORm4+AmnaBhH//2wBDARYXFx8bHzwhITx/VEhUf39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f39/f3//wAARCAAgADADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwCAR+1SLHVaPUYm2Zyp/jyOB9KE1AbzgjPXaRgAf41pdisjQSL2/SphDx0/Sq8epW64zknuBV6O+s3XKzJ9CcGk5tFciZGIT6fpT1h+YZx+VTC5tuomT880yTUdNgI8ycF89EXJqPavoP2aW5ya28f8bMT9cVIsVqDyCfq1VPtPIOwgfWpDcKFyvzH8q1ujKzL8bWynAiT8RmpGmTsiAfSs0XR/5aKOem3mnrdkcBGz+FF0Go6aW6ZiEwF/6ZjH61XNvdH/AJZnn3qc3rFdrQMwqP7bcKP3cSj2C0tB3Z//2Q==") center center / cover no-repeat !important; }
+html[data-skin] .holo-wa-root .cs-message-list { transition: background-image .25s ease; }
+
+/* ────────────────────────────────────────────────────────────────────────────────────────────────
+ * SLACK skin — data-skin="slack". Unlike the colour-only re-tones above, this one also does LAYOUT: the
+ * Slack "window envelope". An aubergine chrome (far-left rail + channel sidebar) wraps a content pane that
+ * floats as a rounded island inset by an EVEN margin on ALL FOUR sides — the darker chrome shows through
+ * every gap (top, right, bottom, AND a left gutter between sidebar and pane), with rounded corners + a soft
+ * shadow for depth. Placed at end-of-file so source order beats the base skin block AND the wallpaper rule
+ * above (equal specificity → later wins); every rule carries `.holo-wa-root` to match the base depth.
+ *
+ * Two coupling facts make the float robust: (1) the composer is a position:absolute overlay on .holo-main
+ * whose `left` is CSS `34%` — the SAME 34% as the sidebar's flex-basis — so re-anchoring it to
+ * `calc(34% + gap)` keeps it glued to the gapped pane at every window width, no JS. (2) the bundle gives the
+ * pane height:100%, which ignores margin and overflows; `height:auto` + flex:1 1 auto lets the even margin
+ * actually shrink it. ALL geometry lives in the ≥900px media query so the narrow/mobile single-column layout
+ * (sidebar collapses, composer full-bleed) is left exactly as the bundle intends. Colours + margins only,
+ * fully reversible, every feature intact. */
+html[data-skin="slack"] .holo-wa-root {
+  --wa-bg:var(--holo-chrome, #150E1A); --wa-side:#2A1530; --wa-head:#1B1B1F; --wa-in:#26262B; --wa-out:#3A2140;
+  --wa-ink:#E9E5ED; --wa-dim:#A99DB4; --wa-accent:#C6A6E6; --wa-line:#ffffff12;
+  --slk-pane:#1B1B1F; --slk-hi:#5C2D66; --slk-hover:#3A2140; --slk-gap:var(--holo-env-gap, 10px);
+  background: var(--wa-bg) !important;
+}
+/* chrome behind the floating pane (the colour seen in the inset margin/gutter) */
+html[data-skin="slack"] .holo-wa-root.holo-wa-root,
+html[data-skin="slack"] .holo-wa-root .cs-main-container { background: var(--wa-bg) !important; }
+/* the WebGPU wallpaper backdrop is off in Slack — the pane is a flat surface */
+html[data-skin="slack"] .holo-wa-root .holo-backdrop { display: none !important; }
+/* far-left workspace rail: flush with the chrome — transparent over the same --wa-bg ground as the menu, no seam,
+   so rail + list + gutter are ONE continuous background and only the conversation floats (the Slack move). */
+html[data-skin="slack"] .holo-wa-root .holo-rail { background:var(--holo-chrome, #150E1A) !important; border-right:0 !important; }
+html[data-skin="slack"] .holo-wa-root .holo-rail-btn.on,
+html[data-skin="slack"] .holo-wa-root .holo-rail-net.on { color: var(--wa-accent) !important; }
+/* THE LEFT MENU IS THE BACKGROUND — like Slack, the rail, the channel list and the gutter around the floating
+   pane are ONE continuous chrome (the --wa-bg ground), not a separate lighter panel. So every sidebar surface is
+   transparent: the menu items sit directly on the background, and the ONLY thing that floats is the conversation
+   island. This is what makes the whole shell read as one window with content lifted out of it. */
+html[data-skin="slack"] .holo-wa-root .cs-sidebar.cs-sidebar--left,
+html[data-skin="slack"] .holo-wa-root .cs-conversation-list,
+html[data-skin="slack"] .holo-wa-root .holo-list-head,
+html[data-skin="slack"] .holo-wa-root .holo-list-title,
+html[data-skin="slack"] .holo-wa-root .holo-chips,
+html[data-skin="slack"] .holo-wa-root .holo-catchup { background: transparent !important; }
+html[data-skin="slack"] .holo-wa-root .cs-search { background:#1F0F24 !important; border:1px solid #ffffff12 !important; color:var(--wa-ink) !important; }
+/* conversation rows = inset rounded pills (Slack). Inset applied to EVERY row so hover/active only swap the
+ * background — no layout jump. Active carries the highlight + white text. */
+html[data-skin="slack"] .holo-wa-root .cs-conversation { margin:1px 8px !important; border-radius:8px !important; }
+html[data-skin="slack"] .holo-wa-root .cs-conversation:hover { background: var(--slk-hover) !important; }
+html[data-skin="slack"] .holo-wa-root .cs-conversation.cs-conversation--active { background: var(--slk-hi) !important; color:#fff !important; }
+html[data-skin="slack"] .holo-wa-root .cs-conversation.cs-conversation--active * { color:#fff !important; }
+/* pane + its inner surfaces (colours are width-independent; the float geometry is gated below) */
+html[data-skin="slack"] .holo-wa-root .cs-chat-container { background: var(--slk-pane) !important; }
+html[data-skin="slack"] .holo-wa-root .cs-message-list { background: var(--slk-pane) !important; background-image: none !important; }
+html[data-skin="slack"] .holo-wa-root .cs-conversation-header { background: var(--slk-pane) !important; border-bottom: 1px solid #ffffff12; }
+html[data-skin="slack"] .holo-wa-root .holo-composer { background: var(--slk-pane) !important; border-top: 1px solid #ffffff12; }
+html[data-skin="slack"] .holo-wa-root .holo-c-input { background:#26262B !important; border:1px solid #ffffff14 !important; border-radius:8px !important; color:var(--wa-ink) !important; }
+
+/* ── the floating envelope (desktop only; narrow layout keeps the bundle's single-column defaults) ── */
+@media (min-width: 900px) {
+  html[data-skin="slack"] .holo-wa-root .cs-chat-container {
+    flex: 1 1 auto !important; min-width: 0; height: auto !important; align-self: stretch;
+    margin: var(--slk-gap) !important;                 /* even inset on all four sides */
+    border-radius: 12px; overflow: hidden;
+    box-shadow: 0 0 0 1px #00000055, 0 14px 38px #00000085;
+  }
+  /* glue the composer to the gapped pane: left tracks the sidebar's 34%, plus the gutter */
+  html[data-skin="slack"] .holo-wa-root .holo-composer {
+    left: calc(34% + var(--slk-gap)) !important; right: var(--slk-gap) !important;
+    bottom: var(--slk-gap) !important; width: auto !important; border-radius: 0 0 12px 12px;
+  }
+}
+
+/* ── THEATRE MODE — full-screen wallpaper + glass, under the Slack skin ────────────────────────────
+ * Theatre (`.theater`, toggle ⌘/Ctrl+\) collapses the rail + sidebar and floats ONE conversation over a
+ * FULL-BLEED wallpaper as centred glass capsules (see whatsapp-theme.css "Stage 6"). Three things make it
+ * immersive + fast here:
+ *   1. WALLPAPER edge-to-edge — a static image on the root (the whole viewport), NOT the WebGPU `.holo-backdrop`
+ *      canvas (which we turn OFF: it was rendering at opacity:0, all cost no pixels). The image is the one
+ *      app.html already preloads, so it paints with zero extra latency; every layer above it is transparent.
+ *   2. LIGHT + CLEAR — the heavy radial vignette + hue-tint is replaced by a soft top/bottom legibility scrim
+ *      only, so the middle of the wallpaper stays bright and open.
+ *   3. STUNNING GLASS, CHEAP — real backdrop-blur is limited to the TWO capsules (header + composer); message
+ *      bubbles are plain translucent fills (no per-bubble blur) so a long thread never janks input.
+ * Selector depth `…"slack"] .holo-wa-root.theater .X` = (0,4,1) beats the base slack rules (0,3,1) and
+ * theatre's own (0,3,0); transforms are left untouched so theatre's centring + auto-quiet fade keep animating. */
+html[data-skin="slack"] .holo-wa-root.theater {
+  /* FOLLOW the operator's chosen wallpaper (--wp-img, set from localStorage holo-messenger/wallpaper-src),
+     falling back to the preloaded default when unset. `none` (the "plain" mode) is honoured → dark. */
+  background: #0b0f14 var(--wp-img, url("/apps/holo-messenger/_vendor/wallpaper-default.jpg")) center center / cover no-repeat !important;
+}
+html[data-skin="slack"] .holo-wa-root.theater .holo-backdrop { display: none !important; }                 /* WebGPU canvas off → lower latency */
+html[data-skin="slack"] .holo-wa-root.theater .cs-chat-container {
+  background: transparent !important; margin: 0 !important; border-radius: 0 !important;
+  overflow: visible !important; box-shadow: none !important;                                               /* full-bleed, no slack box */
+}
+/* transparent reading column, aligned to the SAME 812px as the chrome so bubbles line up with the composer */
+html[data-skin="slack"] .holo-wa-root.theater .cs-message-list {
+  background: transparent !important;
+  padding-left: max(20px, calc((100% - 812px) / 2)) !important;
+  padding-right: max(20px, calc((100% - 812px) / 2)) !important;
+}
+/* clear + light: only a soft top/bottom scrim for legibility; the wallpaper stays bright in the middle */
+html[data-skin="slack"] .holo-wa-root.theater .holo-main::before {
+  background: linear-gradient(to bottom, rgba(0,0,0,.30) 0%, transparent 16%, transparent 80%, rgba(0,0,0,.42) 100%) !important;
+}
+/* stunning glass capsules — vivid backdrop-blur, crisp edge, top highlight (only these two get real blur) */
+html[data-skin="slack"] .holo-wa-root.theater .cs-conversation-header,
+html[data-skin="slack"] .holo-wa-root.theater .holo-composer {
+  background: rgba(22,24,32,.44) !important;
+  -webkit-backdrop-filter: blur(30px) saturate(1.4) brightness(1.06) !important;
+  backdrop-filter: blur(30px) saturate(1.4) brightness(1.06) !important;
+  border: 1px solid rgba(255,255,255,.16) !important;
+  box-shadow: 0 14px 40px rgba(0,0,0,.42), inset 0 1px 0 rgba(255,255,255,.16) !important;
+}
+html[data-skin="slack"] .holo-wa-root.theater .holo-composer {
+  left: 50% !important; right: auto !important; width: min(calc(100% - 40px), 812px) !important;
+  bottom: 18px !important; border-radius: 18px !important;
+}
+/* bubbles: light translucent fills (no blur = no jank on long threads) */
+html[data-skin="slack"] .holo-wa-root.theater .cs-message--incoming .cs-message__content { background: rgba(28,28,36,.62) !important; }
+html[data-skin="slack"] .holo-wa-root.theater .cs-message--outgoing .cs-message__content { background: rgba(58,33,64,.60) !important; }
+
+/* ── FRAME-COLLAPSED — the immersive focus view (chats folded into the rail) ───────────────────────
+ * "Collapse chats into the rail" (`.holo-main.frame-collapsed`) folds the conversation list away and lets
+ * ONE conversation take the whole frame. The slack skin otherwise left it broken: the composer stayed pinned
+ * to `left:34%` (the vanished sidebar edge) so it floated stranded in the middle. Here we make it the SAME
+ * immersive treatment as theatre — full-screen wallpaper + glass capsules — but KEEP the rail as a clean
+ * glass nav (that's the whole point of this mode), and centre the header/composer/reading-column in the frame
+ * to the RIGHT of the rail so everything lines up.
+ *   · `:has(.holo-main.frame-collapsed)` puts the wallpaper on the ROOT (so it sits behind the rail too).
+ *   · `:not(.theater)` so theatre (which hides the rail) keeps full ownership when both happen to be on.
+ *   · Only 3 blur layers total (rail + header + composer); bubbles are plain translucent — stays responsive. */
+html[data-skin="slack"] .holo-wa-root:has(.holo-main.frame-collapsed):not(.theater) {
+  /* same as theatre: follow the operator's --wp-img, fall back to the preloaded default */
+  background: #0b0f14 var(--wp-img, url("/apps/holo-messenger/_vendor/wallpaper-default.jpg")) center center / cover no-repeat !important;
+}
+html[data-skin="slack"] .holo-wa-root:has(.holo-main.frame-collapsed):not(.theater) .holo-backdrop { display: none !important; }
+/* the left nav bar stays — a clean SOLID strip; the wallpaper covers the entire screen EXCEPT this rail */
+html[data-skin="slack"] .holo-wa-root:has(.holo-main.frame-collapsed):not(.theater) .holo-rail {
+  background: #17111D !important;
+  border-right: 1px solid rgba(255,255,255,.08) !important;
+}
+/* transparent full-bleed frame + reading column centred in the space right of the rail */
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .cs-chat-container {
+  background: transparent !important; margin: 0 !important; border-radius: 0 !important; overflow: visible !important; box-shadow: none !important;
+}
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .cs-message-list {
+  background: transparent !important;
+  padding-left: max(20px, calc((100% - 812px) / 2)) !important;
+  padding-right: max(20px, calc((100% - 812px) / 2)) !important;
+}
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed::before {
+  content: ""; position: absolute; inset: 0; pointer-events: none; z-index: 0;
+  background: linear-gradient(to bottom, rgba(0,0,0,.30) 0%, transparent 16%, transparent 80%, rgba(0,0,0,.42) 100%);
+}
+/* glass header + composer, centred in the frame (the rail is the nav, the frame is everything right of it) */
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .cs-conversation-header,
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .holo-composer {
+  background: rgba(22,24,32,.44) !important;
+  -webkit-backdrop-filter: blur(30px) saturate(1.4) brightness(1.06) !important;
+  backdrop-filter: blur(30px) saturate(1.4) brightness(1.06) !important;
+  border: 1px solid rgba(255,255,255,.16) !important;
+  box-shadow: 0 14px 40px rgba(0,0,0,.42), inset 0 1px 0 rgba(255,255,255,.16) !important;
+}
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .cs-conversation-header {
+  margin: 14px auto 0 !important; max-width: 812px !important; width: calc(100% - 40px) !important; border-radius: 16px !important;
+}
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .holo-composer {
+  left: 50% !important; right: auto !important; transform: translateX(-50%) !important;
+  width: min(calc(100% - 40px), 812px) !important; bottom: 18px !important; border-radius: 18px !important;
+}
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .cs-message--incoming .cs-message__content { background: rgba(28,28,36,.62) !important; }
+html[data-skin="slack"] .holo-wa-root:not(.theater) .holo-main.frame-collapsed .cs-message--outgoing .cs-message__content { background: rgba(58,33,64,.60) !important; }
+
+/* ── BASE-LAYER fix: composer alignment in frame-collapsed, for ANY skin ───────────────────────────
+ * Skin-agnostic (this file is loaded regardless of the active skin). The bundle pins the composer to
+ * `left:34%` — the sidebar's flex-basis — but frame-collapsed folds the sidebar to 0, so on every NON-slack
+ * skin (graphite/warm/contrast/light/none) the composer floated stranded in the middle. Align it to the
+ * full-bleed chat (left:0 = the rail's right edge; right:0 is already the base). `:not(.theater)` yields to
+ * theatre's own centred composer; slack's higher-specificity immersive rule above wins for the slack skin. */
+.holo-wa-root:not(.theater) .holo-main.frame-collapsed .holo-composer { left: 0 !important; }

b/86a3f68c5070d7a543e52768811268d22f2051a5033c11d5281ecd2a36c2dd44

@@ -0,0 +1,72 @@
+// holo-release-boot.mjs — S3 of the downstream-holospace initiative: EVERY boot verifies through the
+// SIGNED release pointer, not just #m1-link opens.
+//
+// Today the worker's integrity bar is seeded from shell-manifest.json — unsigned bytes from the origin —
+// and only an #m1 boot link upgrades it to link-verified. This module makes the SIGNED strand head the
+// standing bar: fetch release.json (the ONE mutable fetch, no-store) → acceptHead() against the local pin
+// (TOFU, key-continuity, seq-monotonic — holo-release-verify.mjs) → prove the origin's manifest is the
+// EXACT one the release signed (bytes re-derive to payload.manifest, aggregate re-derives to payload.shell)
+// → only then pin + hand the manifest to the worker. A refused pointer changes NOTHING: the worker keeps
+// serving the last verified shell (fail-closed to last-good, never to blank).
+//
+// Additive + fail-soft at the seam (a deploy without release.json is a quiet no-op), fail-CLOSED at the
+// bar (no signature → no upgrade). Injectable core; the browser auto-run wires live fetch/storage/worker.
+
+import { acceptHead } from "./holo-release-verify.mjs";
+import { shellAggregate } from "./holo-m1-boot.mjs";
+
+export const PIN_KEY = "holo.release.pin";
+const _hex = (buf) => [...new Uint8Array(buf)].map((x) => x.toString(16).padStart(2, "0")).join("");
+const sha256hex = async (buf) => _hex(await (globalThis.crypto).subtle.digest("SHA-256", buf));
+
+// releaseBoot({ fetchFn, storage, post, baseUrl }) → { ok, why?, pin?, unchanged? }
+//   fetchFn — fetch-compatible; storage — localStorage-compatible {getItem,setItem};
+//   post — receives the verified manifest message for the worker; baseUrl — this module's URL (relocatable).
+export async function releaseBoot({ fetchFn, storage, post = null, baseUrl } = {}) {
+  // 1. the pointer — the ONE mutable fetch (everything else it names is immutable, κ-addressed)
+  let head = null;
+  try { const r = await fetchFn(new URL("../../release.json", baseUrl), { cache: "no-store" }); if (r && r.ok) head = await r.json(); } catch {}
+  if (!head) return { ok: false, why: "no-pointer" };                       // pre-strand deploy: additive no-op
+  // 2. accept against the durable pin (SEC-1/4: forge, tamper, replay, key-swap → refused by name)
+  let pinned = null; try { pinned = JSON.parse(storage.getItem(PIN_KEY) || "null"); } catch {}
+  const a = await acceptHead(head, pinned);
+  if (!a.ok) return { ok: false, why: a.why, pinned };                      // bar unchanged — last-good keeps serving
+  // 3. the head COMMITS the shell: the origin's manifest must be the exact object the release signed
+  const p = head["holstr:payload"] || {};
+  let mfBytes = null;
+  try { const r = await fetchFn(new URL("./shell-manifest.json", baseUrl), { cache: "no-store" }); if (r && r.ok) mfBytes = await r.arrayBuffer(); } catch {}
+  if (!mfBytes) return { ok: false, why: "no-manifest", head: head.id };
+  if (p.manifest && (await sha256hex(mfBytes)) !== p.manifest) return { ok: false, why: "manifest-not-signed", head: head.id };
+  let manifest = null; try { manifest = JSON.parse(new TextDecoder().decode(mfBytes)); } catch {}
+  const agg = manifest ? await shellAggregate(manifest) : "";
+  if (!agg || agg !== p.shell) return { ok: false, why: "shell-mismatch", head: head.id };
+  // 4. accepted — advance the pin, upgrade the worker's bar to SIGNED-verified (what #m1 links did, now standing)
+  try { storage.setItem(PIN_KEY, JSON.stringify(a.pin)); } catch {}
+  try { if (post) post({ type: "holo-shell-manifest", assets: manifest.assets, runtime: manifest.runtime || [] }); } catch {}
+  return { ok: true, pin: a.pin, unchanged: !!a.unchanged, shell: p.shell };
+}
+
+// rollback is an EXPLICIT LOCAL ACT (never something a remote pointer can cause): re-pin a parent entry
+// the operator chose from the strand. The next acceptHead treats it as the baseline.
+export function repin(storage, entry) {
+  const pin = { id: entry.id, seq: entry["holstr:seq"], pub: entry["holstr:pub"] };
+  storage.setItem(PIN_KEY, JSON.stringify(pin));
+  return pin;
+}
+
+// ── browser auto-run: after the worker registers, verify the pointer off the critical path ────────────
+if (typeof window !== "undefined" && typeof navigator !== "undefined") {
+  (async () => {
+    try {
+      if (!("serviceWorker" in navigator)) return;
+      const reg = await navigator.serviceWorker.ready;
+      const r = await releaseBoot({
+        fetchFn: fetch.bind(globalThis), storage: window.localStorage, baseUrl: import.meta.url,
+        post: (m) => { try { (reg.active || navigator.serviceWorker.controller)?.postMessage(m); } catch {} },
+      });
+      window.HoloRelease = Object.assign(window.HoloRelease || {}, { last: r, repin: (e) => repin(window.localStorage, e) });
+      if (r.ok && !r.unchanged) console.log("[release] signed head pinned: seq " + r.pin.seq + " " + r.pin.id.slice(-16));
+      else if (!r.ok && r.why !== "no-pointer") console.warn("[release] pointer refused (" + r.why + ") — shell stays on the last verified release");
+    } catch {}
+  })();
+}

b/8c30aa5582dffe4548d27fa7863163eba689ed65126be472c003f5884fc8e534

@@ -0,0 +1,1870 @@
+/* @ts-self-types="./holospaces_web.d.ts" */
+
+/**
+ * **The browser peer's AArch64 holospace** — a real arm64 devcontainer booted on
+ * the engine's [AArch64 core](holospaces::emulator::aarch64) (ADR-021; `CC-36` a
+ * real arm64 Linux boots, `CC-37` a stock `linux-arm64` binary runs). Its κ-disk
+ * is the **same substrate-backed `virtio-blk`** the RISC-V [`Workspace`] uses —
+ * the shared device bus (`emulator::devbus`), no per-ISA re-implementation (Law
+ * L4; `CC-7`/`CC-14`). Boot + the interactive terminal (`CC-11`) are complete;
+ * the AArch64 core's `virtio-net`/`9p` parity is the continued engine build, so
+ * this surface exposes only what the core does today — nothing it cannot fulfil.
+ */
+export class Aarch64Workspace {
+    static __wrap(ptr) {
+        const obj = Object.create(Aarch64Workspace.prototype);
+        obj.__wbg_ptr = ptr;
+        Aarch64WorkspaceFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        Aarch64WorkspaceFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_aarch64workspace_free(ptr, 0);
+    }
+    /**
+     * Boot a **devcontainer** on the AArch64 core: the assembled `ext4` `rootfs`
+     * (from [`DevcontainerImage::assemble_bootable`]) is taken as κ-addressed
+     * content into the shared `virtio-blk` κ-disk (`CC-7`) and mounted over
+     * `/dev/vda`; the real, unmodified arm64 Linux `kernel` boots it and runs the
+     * devcontainer's OS — entirely in the browser peer (ADR-009/011/021, `CC-37`).
+     * Drive with [`run`](Aarch64Workspace::run), streaming
+     * [`terminal_delta`](Aarch64Workspace::terminal_delta) and feeding keystrokes
+     * with [`feed_input`](Aarch64Workspace::feed_input).
+     * @param {Uint8Array} kernel
+     * @param {Uint8Array} rootfs
+     * @returns {Aarch64Workspace}
+     */
+    static boot_devcontainer(kernel, rootfs) {
+        const ptr0 = passArray8ToWasm0(kernel, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(rootfs, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.aarch64workspace_boot_devcontainer(ptr0, len0, ptr1, len1);
+        return Aarch64Workspace.__wrap(ret);
+    }
+    /**
+     * Feed raw terminal input to the running guest (`CC-11`, the AArch64 PL011
+     * analogue): the bytes become readable at the serial console, so the guest's
+     * own tty echoes, line-edits, and raises SIGINT on Ctrl-C — a real terminal.
+     * @param {Uint8Array} bytes
+     */
+    feed_input(bytes) {
+        const ptr0 = passArray8ToWasm0(bytes, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.aarch64workspace_feed_input(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Whether the machine has powered off.
+     * @returns {boolean}
+     */
+    get halted() {
+        const ret = wasm.aarch64workspace_halted(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * Advance the running holospace by `budget` instructions (one chunk of the
+     * boot or of servicing input); returns `true` once the machine has halted.
+     * @param {number} budget
+     * @returns {boolean}
+     */
+    run(budget) {
+        const ret = wasm.aarch64workspace_run(this.__wbg_ptr, budget);
+        return ret !== 0;
+    }
+    /**
+     * Whether the terminal has rendered `marker` yet (e.g. a ready banner).
+     * @param {string} marker
+     * @returns {boolean}
+     */
+    shows(marker) {
+        const ptr0 = passStringToWasm0(marker, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.aarch64workspace_shows(this.__wbg_ptr, ptr0, len0);
+        return ret !== 0;
+    }
+    /**
+     * The full console the guest has produced.
+     * @returns {string}
+     */
+    terminal() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.aarch64workspace_terminal(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * The console bytes produced **since the last call** — the integrated
+     * terminal's render loop (output stays O(new bytes) per frame).
+     * @returns {Uint8Array}
+     */
+    terminal_delta() {
+        const ret = wasm.aarch64workspace_terminal_delta(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+}
+if (Symbol.dispose) Aarch64Workspace.prototype[Symbol.dispose] = Aarch64Workspace.prototype.free;
+
+/**
+ * The Platform Manager console, running as a browser peer that composes the
+ * substrate runtime over the interpreter `ContainerEngine`.
+ */
+export class Console {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        ConsoleFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_console_free(ptr, 0);
+    }
+    /**
+     * Boot a userland holospace **in the browser**: provision it, then spawn it
+     * through the substrate runtime over the interpreter `ContainerEngine`,
+     * capture a κ snapshot of its state (suspend), resume, and terminate — the
+     * execution surface running on the browser peer (ADR-008; RT2; `CC-6`).
+     * Returns the κ-label of the suspend snapshot (state is content, Law L3).
+     * @param {Uint8Array} module
+     * @param {number} memory_bytes
+     * @returns {string}
+     */
+    boot_userland(module, memory_bytes) {
+        let deferred3_0;
+        let deferred3_1;
+        try {
+            const ptr0 = passArray8ToWasm0(module, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.console_boot_userland(this.__wbg_ptr, ptr0, len0, memory_bytes);
+            var ptr2 = ret[0];
+            var len2 = ret[1];
+            if (ret[3]) {
+                ptr2 = 0; len2 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred3_0 = ptr2;
+            deferred3_1 = len2;
+            return getStringFromWasm0(ptr2, len2);
+        } finally {
+            wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        }
+    }
+    /**
+     * *Control panel: configure.* Reconfigure a running instance from the panel
+     * (ADR-018; `CC-28`). `directives_json` is a JSON array of operations across
+     * the four classes, e.g. `[{"lifecycle":"suspend"}, {"forwardPort":8080},
+     * {"unforwardPort":8080}, {"network":{"fetch":true,"announce":false}},
+     * {"quota":1073741824}, {"grant":"blake3:…"}]`. The panel builds a
+     * content-addressed [`Configuration`] issued by the signed-in operator,
+     * stores it (Law L2), and returns its κ — the content the running instance
+     * resolves and applies over the substrate (no server, no RPC).
+     * @param {string} instance
+     * @param {string} directives_json
+     * @returns {string}
+     */
+    configure(instance, directives_json) {
+        let deferred4_0;
+        let deferred4_1;
+        try {
+            const ptr0 = passStringToWasm0(instance, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passStringToWasm0(directives_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len1 = WASM_VECTOR_LEN;
+            const ret = wasm.console_configure(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+            var ptr3 = ret[0];
+            var len3 = ret[1];
+            if (ret[3]) {
+                ptr3 = 0; len3 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred4_0 = ptr3;
+            deferred4_1 = len3;
+            return getStringFromWasm0(ptr3, len3);
+        } finally {
+            wasm.__wbindgen_free(deferred4_0, deferred4_1, 1);
+        }
+    }
+    /**
+     * Open a fresh console — a browser peer with a local content-addressed
+     * store and the interpreter container engine.
+     */
+    constructor() {
+        const ret = wasm.console_new();
+        this.__wbg_ptr = ret;
+        ConsoleFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+    /**
+     * Provision a holospace from a `.holo` compute artifact (the *holo-file*
+     * compute form) with a memory budget, κ-addressing its parts into the
+     * peer's store (Law L2). Returns the holospace identity κ.
+     * @param {Uint8Array} code
+     * @param {number} memory_bytes
+     * @returns {string}
+     */
+    provision(code, memory_bytes) {
+        let deferred3_0;
+        let deferred3_1;
+        try {
+            const ptr0 = passArray8ToWasm0(code, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.console_provision(this.__wbg_ptr, ptr0, len0, memory_bytes);
+            var ptr2 = ret[0];
+            var len2 = ret[1];
+            if (ret[3]) {
+                ptr2 = 0; len2 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred3_0 = ptr2;
+            deferred3_1 = len2;
+            return getStringFromWasm0(ptr2, len2);
+        } finally {
+            wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        }
+    }
+    /**
+     * Provision a holospace from a **devcontainer** for the management console
+     * (CC-12): the `devcontainer.json` is validated against the Dev Container
+     * spec (`CC-4`) and κ-addressed into the store; the holospace's identity is
+     * the content address of its devcontainer definition (reproducible — same
+     * source ⇒ same κ, Law L1). This *provisions* (records) the holospace; the
+     * operator *enters* it to boot its OS in the workspace IDE (`CC-13`).
+     * Returns the holospace identity κ.
+     * @param {Uint8Array} config_json
+     * @param {string} arch
+     * @param {number} memory_bytes
+     * @returns {string}
+     */
+    provision_devcontainer(config_json, arch, memory_bytes) {
+        let deferred4_0;
+        let deferred4_1;
+        try {
+            const ptr0 = passArray8ToWasm0(config_json, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passStringToWasm0(arch, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len1 = WASM_VECTOR_LEN;
+            const ret = wasm.console_provision_devcontainer(this.__wbg_ptr, ptr0, len0, ptr1, len1, memory_bytes);
+            var ptr3 = ret[0];
+            var len3 = ret[1];
+            if (ret[3]) {
+                ptr3 = 0; len3 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred4_0 = ptr3;
+            deferred4_1 = len3;
+            return getStringFromWasm0(ptr3, len3);
+        } finally {
+            wasm.__wbindgen_free(deferred4_0, deferred4_1, 1);
+        }
+    }
+    /**
+     * Provision a holospace from a *Wasm-recompiled userland* (the execution
+     * surface, the second compute form — ADR-008). The module is validated
+     * against the surface contract ([`validate_userland`]) before it is
+     * κ-addressed into the store, so only a substrate-valid userland can become
+     * a holospace's code. Returns the holospace identity κ.
+     * @param {Uint8Array} module
+     * @param {number} memory_bytes
+     * @returns {string}
+     */
+    provision_userland(module, memory_bytes) {
+        let deferred3_0;
+        let deferred3_1;
+        try {
+            const ptr0 = passArray8ToWasm0(module, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.console_provision_userland(this.__wbg_ptr, ptr0, len0, memory_bytes);
+            var ptr2 = ret[0];
+            var len2 = ret[1];
+            if (ret[3]) {
+                ptr2 = 0; len2 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred3_0 = ptr2;
+            deferred3_1 = len2;
+            return getStringFromWasm0(ptr2, len2);
+        } finally {
+            wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        }
+    }
+    /**
+     * Resolve a holospace (or any κ) from this peer's own in-session store.
+     * Returns the bytes, or `undefined` if absent.
+     *
+     * This is a *trusted* read ([`ReadVerify::Trusted`], ADR-019): the store is
+     * the canonical memory and RAM is its cache (Law L3), so content that
+     * entered this session was already verified on the way in (on receipt, or
+     * by `put` construction). The deployed peer does not re-derive κ on every
+     * local read — that would treat its own canonical store as untrusted and is
+     * pure overhead. The re-derivation invariant still holds where untrusted
+     * bytes enter (the import/fetch boundary) and is exercised end-to-end in CI.
+     * @param {string} kappa
+     * @returns {Uint8Array | undefined}
+     */
+    resolve(kappa) {
+        const ptr0 = passStringToWasm0(kappa, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.console_resolve(this.__wbg_ptr, ptr0, len0);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        let v2;
+        if (ret[0] !== 0) {
+            v2 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v2;
+    }
+    /**
+     * The operator's roster κ — the content address that links their instances
+     * (R5). Its bytes are in the store, so another instance can resolve it.
+     * @returns {string | undefined}
+     */
+    roster_kappa() {
+        const ret = wasm.console_roster_kappa(this.__wbg_ptr);
+        let v1;
+        if (ret[0] !== 0) {
+            v1 = getStringFromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v1;
+    }
+    /**
+     * Import and run a **devcontainer in the browser** — the Codespaces/Gitpod
+     * scenario without a Docker daemon or a cloud VM (arc42 chapter 1, the
+     * motivating scenario; chapter 6). The `devcontainer.json` is validated
+     * against the Dev Container spec (`CC-4`); the κ-addressed Wasm `userland`
+     * its config selects is validated against the host-ABI surface (`CC-6`) and
+     * booted through the substrate runtime over the interpreter engine — same
+     * lifecycle as a native or remote peer (Q6). Returns the suspend snapshot κ.
+     *
+     * `arch` is the operator's **architecture selection** (the Manager GUI's
+     * arch picker; ADR-021) — `"riscv64"` or `"aarch64"`. It becomes part of the
+     * holospace's content-addressed identity, so it is fixed for the holospace's
+     * lifetime (an unknown id falls back to the default RISC-V target).
+     * @param {string} repo
+     * @param {string} reference
+     * @param {string} config_path
+     * @param {Uint8Array} config_json
+     * @param {Uint8Array} userland_module
+     * @param {string} arch
+     * @param {number} memory_bytes
+     * @returns {string}
+     */
+    run_devcontainer(repo, reference, config_path, config_json, userland_module, arch, memory_bytes) {
+        let deferred8_0;
+        let deferred8_1;
+        try {
+            const ptr0 = passStringToWasm0(repo, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passStringToWasm0(reference, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len1 = WASM_VECTOR_LEN;
+            const ptr2 = passStringToWasm0(config_path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len2 = WASM_VECTOR_LEN;
+            const ptr3 = passArray8ToWasm0(config_json, wasm.__wbindgen_malloc);
+            const len3 = WASM_VECTOR_LEN;
+            const ptr4 = passArray8ToWasm0(userland_module, wasm.__wbindgen_malloc);
+            const len4 = WASM_VECTOR_LEN;
+            const ptr5 = passStringToWasm0(arch, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len5 = WASM_VECTOR_LEN;
+            const ret = wasm.console_run_devcontainer(this.__wbg_ptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, memory_bytes);
+            var ptr7 = ret[0];
+            var len7 = ret[1];
+            if (ret[3]) {
+                ptr7 = 0; len7 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred8_0 = ptr7;
+            deferred8_1 = len7;
+            return getStringFromWasm0(ptr7, len7);
+        } finally {
+            wasm.__wbindgen_free(deferred8_0, deferred8_1, 1);
+        }
+    }
+    /**
+     * Sign in by unlocking a self-sovereign key (not a server account,
+     * ADR-001). Returns the operator's content-addressed identity κ.
+     * @param {Uint8Array} key
+     * @returns {string}
+     */
+    sign_in(key) {
+        let deferred2_0;
+        let deferred2_1;
+        try {
+            const ptr0 = passArray8ToWasm0(key, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.console_sign_in(this.__wbg_ptr, ptr0, len0);
+            deferred2_0 = ret[0];
+            deferred2_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+        }
+    }
+    /**
+     * The console's View — a JSON projection of the operator and their
+     * holospaces (what the UI renders).
+     * @returns {string}
+     */
+    view() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.console_view(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+}
+if (Symbol.dispose) Console.prototype[Symbol.dispose] = Console.prototype.free;
+
+/**
+ * A devcontainer's OCI image, assembled into a bootable root filesystem *in the
+ * browser* — the Layer Assembler (`CC-7` / the in-crate ext4 writer) running as
+ * the wasm peer. The operator's page fetches the devcontainer's image layers
+ * from the cold-start gateway (verified by re-derivation before they are added),
+ * then assembles them here; the result boots over the emulator's `virtio-blk`
+ * ([`Workspace::boot_devcontainer`], `CC-14`). The browser peer *is* the
+ * machine — no server assembles or boots the OS (Law L1/L4).
+ */
+export class DevcontainerImage {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        DevcontainerImageFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_devcontainerimage_free(ptr, 0);
+    }
+    /**
+     * Add an OCI image layer (its media type + the verified blob bytes), in
+     * order from the base layer up.
+     * @param {string} media_type
+     * @param {Uint8Array} blob
+     */
+    add_layer(media_type, blob) {
+        const ptr0 = passStringToWasm0(media_type, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(blob, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.devcontainerimage_add_layer(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+    }
+    /**
+     * Assemble the layers into a bootable `ext4` root filesystem (gunzip +
+     * untar + OCI whiteout overlay + the in-crate ext4 writer; Law L4). The
+     * bytes back a [`Workspace::boot_devcontainer`] machine's `virtio-blk` disk.
+     * @returns {Uint8Array}
+     */
+    assemble() {
+        const ret = wasm.devcontainerimage_assemble(this.__wbg_ptr);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * Assemble the layers into a **bootable, interactive, writable** root
+     * filesystem on a `disk_bytes`-sized disk: the same overlay as
+     * [`Self::assemble`], plus the persistent devcontainer
+     * [`/init`](holospaces::machine::DEVCONTAINER_INIT) injected — it mounts the
+     * pseudo filesystems and the shared `virtio-9p` workspace and execs a shell,
+     * so the booted OS stays running as a dev environment instead of powering off
+     * after boot — and sized to `disk_bytes` so the OS has room to work (the
+     * devcontainer's disk; the caller's to choose, not a hidden cap). The base
+     * image must provide a static `/bin/busybox`.
+     * @param {number} disk_bytes
+     * @returns {Uint8Array}
+     */
+    assemble_bootable(disk_bytes) {
+        const ret = wasm.devcontainerimage_assemble_bootable(this.__wbg_ptr, disk_bytes);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * Like [`Self::assemble_bootable_real`], but stream the ext4 image **straight
+     * into an OPFS file** (`CC-50`, the sparse streaming Rootfs Assembly): only the
+     * non-zero blocks are written (the free data region stays a sparse hole), so
+     * even a multi-GiB disk assembles **without ever materializing a dense buffer**
+     * in wasm RAM — peak working memory tracks the image's *content*, not its
+     * declared size ("the KappaStore IS the memory, RAM is a cache", Laws L3/L4).
+     * `rootfs_handle` is a worker sync access handle on the rootfs file; returns the
+     * total image length (a whole number of sectors). The page then boots it
+     * off-heap with [`Workspace::boot_devcontainer_opfs_streamed`] — neither
+     * provisioning nor boot ever holds the whole image in RAM (the lean,
+     * substrate-native path).
+     * @param {FileSystemSyncAccessHandle} rootfs_handle
+     * @param {number} disk_bytes
+     * @param {boolean} real
+     * @returns {number}
+     */
+    assemble_bootable_into_opfs(rootfs_handle, disk_bytes, real) {
+        const ret = wasm.devcontainerimage_assemble_bootable_into_opfs(this.__wbg_ptr, rootfs_handle, disk_bytes, real);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return ret[0];
+    }
+    /**
+     * Like [`Self::assemble_bootable`], but inject the **real-OCI-image** `/init`
+     * ([`REAL_IMAGE_INIT`](holospaces::machine::REAL_IMAGE_INIT), `CC-42`) — for a
+     * repository's own base image (debian, ubuntu, buildpack-deps) that ships its
+     * own `/bin/sh` + coreutils + `mount` rather than a static `/bin/busybox`. It
+     * mounts the pseudo-filesystems + the shared `virtio-9p` workspace with the
+     * image's tools and execs its login shell (`bash` if present, else `sh`), so a
+     * stock Debian image boots to its real interactive shell.
+     * @param {number} disk_bytes
+     * @returns {Uint8Array}
+     */
+    assemble_bootable_real(disk_bytes) {
+        const ret = wasm.devcontainerimage_assemble_bootable_real(this.__wbg_ptr, disk_bytes);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * A new, empty image (add its layers lowest-first with [`Self::add_layer`]).
+     */
+    constructor() {
+        const ret = wasm.devcontainerimage_new();
+        this.__wbg_ptr = ret;
+        DevcontainerImageFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+}
+if (Symbol.dispose) DevcontainerImage.prototype[Symbol.dispose] = DevcontainerImage.prototype.free;
+
+/**
+ * **The interactive userland Workspace** — a real CC-6 Wasm code module (e.g.
+ * `qemu-system-x86_64` compiled to wasm32 over the hologram host ABI) run *as a
+ * live, interactive holospace* in the browser tab (ADR-008/009; `CC-6` + the
+ * interactive `CC-11` console). Where [`Console::boot_userland`] proves the
+ * one-shot lifecycle (boot → suspend → resume → terminate) through the substrate
+ * runtime, this drives the *same validated module* on the *same `wasmi`
+ * interpreter* the engine uses — pumped in cooperative slices with a live
+ * console, so the operator gets a real terminal (the QEMU holospace; see
+ * `web/QEMU-HOLOSPACE.md`).
+ *
+ * **Why a direct `wasmi` driver, not `Session`/`ContainerRuntime`.** The browser
+ * `ContainerEngine` (hologram-runtime-bare) wires an *empty* `Linker`: a CC-6
+ * container has **no** `hologram.*` host imports, and the one-shot `spawn /
+ * suspend / resume / terminate` runtime exposes neither a sub-budget run nor a
+ * console stream. So an interactive QEMU communicates the only way that surface
+ * allows — through **linear memory** between calls (a mailbox), exactly as the
+ * emulator [`Workspace`] drives the native [`Emulator`](holospaces::emulator)
+ * directly rather than through the runtime. The module is still gated by
+ * [`validate_userland`] (the `CC-6` host-ABI surface) before it runs, and is
+ * still a self-contained substrate userland (it imports nothing).
+ *
+ * **The container ABI (the contract `build-qemu-wasm.sh` must satisfy).** The
+ * module exports `memory` and: `hg_mailbox() -> i32` (the control struct's byte
+ * offset); `hg_init() -> i32` (build the machine from the cfg region — argv +
+ * disk the host wrote; `0` = ok); `hg_event(budget: i32) -> i32` (drain stdin
+ * from `in`, run up to `budget` guest instructions as a cooperative TCG/TCI slice
+ * that **returns** rather than blocking, append console bytes to `out`, set
+ * `halted`; `0` = ok, a trap halts); and optional `hg_suspend()`/`hg_resume()`
+ * flush/rehydrate around the snapshot. The mailbox is a little-endian `u32`
+ * struct: `magic, abi, cfg_ptr, cfg_cap, cfg_len, in_ptr, in_cap, in_len,
+ * out_ptr, out_cap, out_len, halted`. The snapshot is taken at an `hg_event`
+ * boundary (the C stack unwound), so linear memory holds all persistent machine
+ * state (CPU, RAM, devices) and transient Wasm globals need not be carried
+ * (`CC-30`/`CC-31`).
+ */
+export class UserlandWorkspace {
+    static __wrap(ptr) {
+        const obj = Object.create(UserlandWorkspace.prototype);
+        obj.__wbg_ptr = ptr;
+        UserlandWorkspaceFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        UserlandWorkspaceFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_userlandworkspace_free(ptr, 0);
+    }
+    /**
+     * Boot a CC-6 module as an interactive holospace. `module` is the QEMU wasm
+     * (validated against the host-ABI surface, `CC-6`); `argv` is the QEMU command
+     * line, one argument per line; `disk` is the guest image (held in the guest's
+     * linear memory in v1 — a large disk needs the staged κ-disk sector protocol).
+     * `memory_bytes` and `relay_url` are reserved (the guest sizes its own RAM
+     * today; networking is the staged `CC-16` step).
+     * @param {Uint8Array} module
+     * @param {string} argv
+     * @param {Uint8Array} disk
+     * @param {number} memory_bytes
+     * @param {string} relay_url
+     * @returns {UserlandWorkspace}
+     */
+    static boot(module, argv, disk, memory_bytes, relay_url) {
+        const ptr0 = passArray8ToWasm0(module, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(argv, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArray8ToWasm0(disk, wasm.__wbindgen_malloc);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(relay_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len3 = WASM_VECTOR_LEN;
+        const ret = wasm.userlandworkspace_boot(ptr0, len0, ptr1, len1, ptr2, len2, memory_bytes, ptr3, len3);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return UserlandWorkspace.__wrap(ret[0]);
+    }
+    /**
+     * Feed **raw terminal input** (keystrokes, control bytes, escape sequences) to
+     * the guest — queued, then delivered on the next [`run`](Self::run), so the
+     * guest's own tty echoes and edits and Ctrl-C raises SIGINT (a real terminal,
+     * `CC-11`). The input is part of the machine's state captured by the snapshot.
+     * @param {Uint8Array} bytes
+     */
+    feed_input(bytes) {
+        const ptr0 = passArray8ToWasm0(bytes, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.userlandworkspace_feed_input(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Whether the guest has powered off.
+     * @returns {boolean}
+     */
+    get halted() {
+        const ret = wasm.userlandworkspace_halted(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * Resume an interactive userland from a linear-memory snapshot
+     * [`suspend`](Self::suspend) produced. `module` is the same CC-6 module (it is
+     * content — re-fetched and verified, not carried in the snapshot); the
+     * snapshot is the machine's memory at an `hg_event` boundary (`CC-30`/`CC-31`).
+     * @param {Uint8Array} module
+     * @param {Uint8Array} snapshot
+     * @returns {UserlandWorkspace}
+     */
+    static resume(module, snapshot) {
+        const ptr0 = passArray8ToWasm0(module, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(snapshot, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.userlandworkspace_resume(ptr0, len0, ptr1, len1);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return UserlandWorkspace.__wrap(ret[0]);
+    }
+    /**
+     * Advance the guest by up to `budget` instructions — one cooperative slice.
+     * Delivers any queued [`feed_input`](Self::feed_input) to the guest first,
+     * then drains the console it produced. Returns `true` once it has halted. Call
+     * repeatedly from a UI loop, streaming [`terminal_delta`](Self::terminal_delta)
+     * between slices.
+     * @param {number} budget
+     * @returns {boolean}
+     */
+    run(budget) {
+        const ret = wasm.userlandworkspace_run(this.__wbg_ptr, budget);
+        return ret !== 0;
+    }
+    /**
+     * Suspend to a κ snapshot — the guest's linear memory at this `hg_event`
+     * boundary, the canonical content-addressed machine state (`CC-30`). The
+     * browser persists it (gzipped) to OPFS so the next launch resumes (`CC-31`).
+     * @returns {Uint8Array}
+     */
+    suspend() {
+        const ret = wasm.userlandworkspace_suspend(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * The console bytes produced **since the last call** (an internal cursor) —
+     * the integrated terminal's render delta, O(new) not O(total) per frame.
+     * @returns {Uint8Array}
+     */
+    terminal_delta() {
+        const ret = wasm.userlandworkspace_terminal_delta(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+}
+if (Symbol.dispose) UserlandWorkspace.prototype[Symbol.dispose] = UserlandWorkspace.prototype.free;
+
+/**
+ * A **workspace** over a running holospace, in the browser tab — the
+ * Codespaces/Gitpod experience (ADR-009; `CC-9` + `CC-11`). The operator
+ * launches a holospace whose code is the system emulator; it **boots a real
+ * operating system** (the [system emulator](holospaces::emulator) running in
+ * the browser's own wasm engine), and the [workspace
+ * projection](holospaces::projection) drives it: a live **terminal**
+ * (keystrokes published as canonical events that advance the holospace's κ
+ * snapshot) and an **editor** that reads and edits environment content *by κ*.
+ *
+ * The boot runs in instruction *chunks* ([`run`](Workspace::run)) so the UI
+ * stays responsive and can stream the console as the kernel boots — there is no
+ * server doing the work; the browser peer *is* the machine (Law L1).
+ */
+export class Workspace {
+    static __wrap(ptr) {
+        const obj = Object.create(Workspace.prototype);
+        obj.__wbg_ptr = ptr;
+        WorkspaceFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        WorkspaceFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_workspace_free(ptr, 0);
+    }
+    /**
+     * Launch a workspace: place the OS `kernel` image and `dtb` in a machine
+     * with `ram_bytes` of RAM at `base`, the device tree at `dtb_addr`, and hand
+     * off as the SBI firmware. The machine is now booting (drive it with
+     * [`run`](Workspace::run)).
+     * @param {Uint8Array} kernel
+     * @param {Uint8Array} dtb
+     * @param {number} ram_bytes
+     * @param {number} base
+     * @param {number} dtb_addr
+     * @returns {Workspace}
+     */
+    static boot(kernel, dtb, ram_bytes, base, dtb_addr) {
+        const ptr0 = passArray8ToWasm0(kernel, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(dtb, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_boot(ptr0, len0, ptr1, len1, ram_bytes, base, dtb_addr);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * Boot a **devcontainer** workspace: the Boot Orchestrator
+     * ([`MachineSpec`](holospaces::machine::MachineSpec)) generates the device
+     * tree and boots `kernel` on a machine whose `virtio-blk` disk is the
+     * assembled `rootfs` (from [`DevcontainerImage::assemble`]). The guest
+     * kernel mounts the rootfs over `/dev/vda` and runs the devcontainer's real
+     * OS — entirely in the browser peer (`CC-14`). Drive it with
+     * [`run`](Workspace::run), exactly like [`boot`](Workspace::boot).
+     * @param {Uint8Array} kernel
+     * @param {Uint8Array} rootfs
+     * @returns {Workspace}
+     */
+    static boot_devcontainer(kernel, rootfs) {
+        const ptr0 = passArray8ToWasm0(kernel, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(rootfs, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_boot_devcontainer(ptr0, len0, ptr1, len1);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * Boot a devcontainer with the **in-process loopback bridge** enabled
+     * (ADR-020, `CC-33`): the guest's interface comes up with DHCP (so it has a
+     * real TCP stack), but instead of a WebSocket egress to the internet it gets
+     * a no-op egress and the *loopback ingress* — so the workbench, in this same
+     * process, can [`dial_guest`](Workspace::dial_guest) a server *inside* the
+     * devcontainer (a language server, a remote extension host) and exchange a
+     * byte stream with it, with no relay or socket. This is the transport the VS
+     * Code remote model runs over in the browser peer (ADR-015/ADR-020). Drive it
+     * with [`run`](Workspace::run), pumping the NAT so the bridge's bytes flow.
+     * @param {Uint8Array} kernel
+     * @param {Uint8Array} rootfs
+     * @returns {Workspace}
+     */
+    static boot_devcontainer_bridged(kernel, rootfs) {
+        const ptr0 = passArray8ToWasm0(kernel, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(rootfs, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_boot_devcontainer_bridged(ptr0, len0, ptr1, len1);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * Boot a **networked** devcontainer workspace (`CC-16`): like
+     * [`boot_devcontainer`](Workspace::boot_devcontainer), but the machine also
+     * has a `virtio-net` device whose userspace TCP/IP NAT tunnels the guest's
+     * TCP streams out over a WebSocket to the relay at `relay_url` (there is no
+     * raw NIC behind a tab; ADR-014). The guest brings its interface up with
+     * DHCP and can then reach the internet — `git clone`, `apt`, `npm` — from the
+     * browser peer. Drive it with [`run`](Workspace::run), yielding to the event
+     * loop between chunks so the WebSocket delivers host-side bytes.
+     * @param {Uint8Array} kernel
+     * @param {Uint8Array} rootfs
+     * @param {string} relay_url
+     * @returns {Workspace}
+     */
+    static boot_devcontainer_net(kernel, rootfs, relay_url) {
+        const ptr0 = passArray8ToWasm0(kernel, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(rootfs, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(relay_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len2 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_boot_devcontainer_net(ptr0, len0, ptr1, len1, ptr2, len2);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * Boot a devcontainer with the disk **streamed** off-heap into an OPFS-backed
+     * κ-store (the substrate-native, lean path — ADR/CC-9.d). `rootfs_handle` is a
+     * sync access handle on the provisioned rootfs file (read sector-by-sector,
+     * never materialized as a `Vec` in wasm RAM); `disk_handle` is the OPFS κ-store
+     * pack. Identical sectors dedup to one κ and all-zero sectors stay sparse, so a
+     * real image boots without holding it in RAM — "the KappaStore IS the memory,
+     * RAM is a cache" (Law L3). Non-networked (busybox/Debian dev box); drive with
+     * [`run`](Workspace::run).
+     * @param {Uint8Array} kernel
+     * @param {FileSystemSyncAccessHandle} rootfs_handle
+     * @param {FileSystemSyncAccessHandle} disk_handle
+     * @returns {Workspace}
+     */
+    static boot_devcontainer_opfs_streamed(kernel, rootfs_handle, disk_handle) {
+        const ptr0 = passArray8ToWasm0(kernel, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_boot_devcontainer_opfs_streamed(ptr0, len0, rootfs_handle, disk_handle);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * The κ of every operator event published on the terminal channel so far.
+     * @returns {any[]}
+     */
+    channel() {
+        const ret = wasm.workspace_channel(this.__wbg_ptr);
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
+        return v1;
+    }
+    /**
+     * Dial an in-process connection to a server *inside* the devcontainer,
+     * listening on `guest_port`, over the loopback substrate bridge (ADR-020,
+     * `CC-33`). Returns the connection id, or `None` if the machine was not booted
+     * with the bridge ([`boot_devcontainer_bridged`](Workspace::boot_devcontainer_bridged)).
+     * The workbench uses this to reach a language server / the remote extension
+     * host (ADR-015) without a relay or socket. Pump with [`run`](Workspace::run)
+     * so the NAT opens the connection and the byte stream flows.
+     * @param {number} guest_port
+     * @returns {number | undefined}
+     */
+    dial_guest(guest_port) {
+        const ret = wasm.workspace_dial_guest(this.__wbg_ptr, guest_port);
+        return ret === Number.MAX_SAFE_INTEGER ? undefined : ret;
+    }
+    /**
+     * Feed **raw terminal input** to the running holospace — the bytes an
+     * interactive terminal delivers for each keystroke, *unbuffered*: ordinary
+     * characters, control bytes (Ctrl-C = `0x03`, Ctrl-D = `0x04`), and escape
+     * sequences (arrows, Home/End). Unlike [`Workspace::type_line`] this does not
+     * line-buffer or block: the bytes go to the guest console and the caller's
+     * render loop ([`Workspace::run`] + [`Workspace::terminal_delta`]) advances
+     * the machine, so the guest's own tty echoes and edits the line and Ctrl-C
+     * raises SIGINT — a real terminal, not a line submitter. The input is part of
+     * the machine's canonical state (it is captured in the κ snapshot), so the
+     * session stays reproducible (Law L1).
+     * @param {Uint8Array} bytes
+     */
+    feed_input(bytes) {
+        const ptr0 = passArray8ToWasm0(bytes, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.workspace_feed_input(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * The **file tree**: the workspace's files as a JSON array of
+     * `{ path, kappa }` — each file's current content κ (its identity, Law L1).
+     * What the editor's explorer renders.
+     * @returns {string}
+     */
+    files() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.workspace_files(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Close the host side of a loopback connection (`CC-33`).
+     * @param {number} id
+     */
+    guest_close(id) {
+        wasm.workspace_guest_close(this.__wbg_ptr, id);
+    }
+    /**
+     * Whether a loopback connection is still usable — the guest has not closed it,
+     * or has but unread bytes remain (`CC-33`).
+     * @param {number} id
+     * @returns {boolean}
+     */
+    guest_is_open(id) {
+        const ret = wasm.workspace_guest_is_open(this.__wbg_ptr, id);
+        return ret !== 0;
+    }
+    /**
+     * Drain the guest server's reply bytes on a loopback connection (empty until
+     * the machine is pumped enough for the stream to advance; `CC-33`).
+     * @param {number} id
+     * @returns {Uint8Array}
+     */
+    guest_recv(id) {
+        const ret = wasm.workspace_guest_recv(this.__wbg_ptr, id);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * Write bytes toward the guest server on a loopback connection (`CC-33`).
+     * @param {number} id
+     * @param {Uint8Array} data
+     */
+    guest_send(id, data) {
+        const ptr0 = passArray8ToWasm0(data, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.workspace_guest_send(this.__wbg_ptr, id, ptr0, len0);
+    }
+    /**
+     * Whether the machine has powered off.
+     * @returns {boolean}
+     */
+    get halted() {
+        const ret = wasm.workspace_halted(this.__wbg_ptr);
+        return ret !== 0;
+    }
+    /**
+     * The editor's read: fetch a file's content *by κ*, verifying it by
+     * re-derivation (Law L5). `undefined` if it is not in the workspace store.
+     * @param {string} kappa
+     * @returns {Uint8Array | undefined}
+     */
+    open_file(kappa) {
+        const ptr0 = passStringToWasm0(kappa, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_open_file(this.__wbg_ptr, ptr0, len0);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        let v2;
+        if (ret[0] !== 0) {
+            v2 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v2;
+    }
+    /**
+     * Open a file *by path*: the content at the file's current κ (the editor
+     * reads the environment content by κ). `undefined` if the path is unknown.
+     * @param {string} path
+     * @returns {Uint8Array | undefined}
+     */
+    read_path(path) {
+        const ptr0 = passStringToWasm0(path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_read_path(this.__wbg_ptr, ptr0, len0);
+        if (ret[3]) {
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        let v2;
+        if (ret[0] !== 0) {
+            v2 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v2;
+    }
+    /**
+     * **Apply a configuration** the control plane published (ADR-018; `CC-28`):
+     * decode the κ-addressed [`Configuration`] bytes (resolved + verified over
+     * the substrate by the caller, Law L5) and enact its live directives on the
+     * *running* machine — each `forwardPort` begins forwarding on the running
+     * instance, without a reboot. Returns a JSON summary of what was applied
+     * (`{ "forwarded": [{ "guest": 8080, "host": 8080 }], "lifecycle": "…",
+     * "unsupported": [...] }`). The instance state changes from the panel's
+     * configuration, carried as content over the substrate — no RPC.
+     * @param {Uint8Array} config_bytes
+     * @returns {string}
+     */
+    reconfigure(config_bytes) {
+        let deferred3_0;
+        let deferred3_1;
+        try {
+            const ptr0 = passArray8ToWasm0(config_bytes, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.workspace_reconfigure(this.__wbg_ptr, ptr0, len0);
+            var ptr2 = ret[0];
+            var len2 = ret[1];
+            if (ret[3]) {
+                ptr2 = 0; len2 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred3_0 = ptr2;
+            deferred3_1 = len2;
+            return getStringFromWasm0(ptr2, len2);
+        } finally {
+            wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        }
+    }
+    /**
+     * Resume a devcontainer workspace from a κ snapshot [`suspend`](Workspace::suspend)
+     * produced, instead of cold-booting it (`CC-30`). The running OS, its disk,
+     * and the workspace files come back exactly — so a second launch skips the
+     * boot entirely and the editor's content is intact. The snapshot's integrity
+     * is the caller's to check by re-derivation before trusting it across a
+     * session boundary (Law L5; ADR-019) — OPFS is durable but untrusted storage.
+     * @param {Uint8Array} snapshot
+     * @returns {Workspace}
+     */
+    static resume_devcontainer(snapshot) {
+        const ptr0 = passArray8ToWasm0(snapshot, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_resume_devcontainer(ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * Resume a **streamed** devcontainer (`CC-30`, the instant warm start for the
+     * lean off-heap κ-disk): like [`resume_devcontainer`](Workspace::resume_devcontainer),
+     * but re-attach the lazy κ-disk's rootfs `loader` from a re-opened OPFS handle —
+     * so the resumed machine pages its *untouched* sectors from the immutable rootfs
+     * again. The content-addressed snapshot carried only the touched disk delta +
+     * the non-zero RAM pages, so resume is O(working set), not O(disk+RAM).
+     * @param {Uint8Array} snapshot
+     * @param {FileSystemSyncAccessHandle} rootfs_handle
+     * @returns {Workspace}
+     */
+    static resume_devcontainer_streamed(snapshot, rootfs_handle) {
+        const ptr0 = passArray8ToWasm0(snapshot, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_resume_devcontainer_streamed(ptr0, len0, rootfs_handle);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Workspace.__wrap(ret[0]);
+    }
+    /**
+     * Advance the running holospace by `budget` instructions (one chunk of the
+     * boot or of servicing input). Returns `true` once the machine has halted
+     * (powered off). Call repeatedly from a UI loop, rendering
+     * [`terminal`](Workspace::terminal) between chunks.
+     * @param {number} budget
+     * @returns {boolean}
+     */
+    run(budget) {
+        const ret = wasm.workspace_run(this.__wbg_ptr, budget);
+        return ret !== 0;
+    }
+    /**
+     * The **editor** surface: save a file's content (the operator's edit). The
+     * content is κ-addressed into the substrate (Law L2), so the returned κ is
+     * the file's new identity — an edit advances it (Law L1). The canonical edit
+     * event for `path` is published on the channel.
+     * @param {string} path
+     * @param {Uint8Array} content
+     * @returns {string}
+     */
+    save_file(path, content) {
+        let deferred4_0;
+        let deferred4_1;
+        try {
+            const ptr0 = passStringToWasm0(path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passArray8ToWasm0(content, wasm.__wbindgen_malloc);
+            const len1 = WASM_VECTOR_LEN;
+            const ret = wasm.workspace_save_file(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+            var ptr3 = ret[0];
+            var len3 = ret[1];
+            if (ret[3]) {
+                ptr3 = 0; len3 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred4_0 = ptr3;
+            deferred4_1 = len3;
+            return getStringFromWasm0(ptr3, len3);
+        } finally {
+            wasm.__wbindgen_free(deferred4_0, deferred4_1, 1);
+        }
+    }
+    /**
+     * Whether the terminal has rendered `marker` yet (e.g. the ready banner).
+     * @param {string} marker
+     * @returns {boolean}
+     */
+    shows(marker) {
+        const ptr0 = passStringToWasm0(marker, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_shows(this.__wbg_ptr, ptr0, len0);
+        return ret !== 0;
+    }
+    /**
+     * The running holospace's κ snapshot — its canonical state (Law L1/L3/L5).
+     * @returns {string}
+     */
+    state_kappa() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.workspace_state_kappa(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Suspend the running machine to a κ snapshot — the canonical,
+     * content-addressed bytes of the whole machine: CPU, RAM, the rootfs disk,
+     * and the *workspace files* (virtio-9p). The browser persists these (gzipped)
+     * to OPFS so the next launch *resumes* instead of cold-booting (`CC-30`).
+     * Most of guest RAM is zero, so the gzipped snapshot is a small fraction of
+     * the machine size.
+     * @returns {Uint8Array}
+     */
+    suspend() {
+        const ret = wasm.workspace_suspend(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * The rendered terminal — the console the running holospace has produced.
+     * @returns {string}
+     */
+    terminal() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.workspace_terminal(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * The console bytes produced **since the last call** (an internal cursor),
+     * for the integrated terminal's render loop. Returning only the delta avoids
+     * re-reading and re-encoding the whole console each tick — output stays O(new
+     * bytes), not O(total) per frame. Returns raw bytes (the terminal decodes
+     * them); [`Workspace::terminal`] still returns the full buffer for tests.
+     * @returns {Uint8Array}
+     */
+    terminal_delta() {
+        const ret = wasm.workspace_terminal_delta(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * Type a line into the terminal: publish it as a canonical event on the
+     * holospace's channel (Law L1/L2), feed the keystrokes to the running
+     * machine, and run until the response settles. The holospace's κ snapshot
+     * advances. Returns the event's κ.
+     * @param {string} line
+     * @returns {string}
+     */
+    type_line(line) {
+        let deferred2_0;
+        let deferred2_1;
+        try {
+            const ptr0 = passStringToWasm0(line, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.workspace_type_line(this.__wbg_ptr, ptr0, len0);
+            deferred2_0 = ret[0];
+            deferred2_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+        }
+    }
+    /**
+     * Delete a file or folder from the shared workspace (the workbench
+     * `FileSystemProvider.delete`) — the editor removing content the OS sees
+     * over `virtio-9p`. `true` if it existed.
+     * @param {string} name
+     * @returns {boolean}
+     */
+    ws_delete(name) {
+        const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_ws_delete(this.__wbg_ptr, ptr0, len0);
+        return ret !== 0;
+    }
+    /**
+     * The shared workspace's directory listing — a JSON array of
+     * `{ name, dir, size }` over the running holospace's `virtio-9p` workspace
+     * (the workbench `FileSystemProvider.readDirectory`).
+     * @returns {string}
+     */
+    ws_list() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.workspace_ws_list(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Create a folder in the shared workspace (the workbench
+     * `FileSystemProvider.createDirectory`).
+     * @param {string} name
+     */
+    ws_mkdir(name) {
+        const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.workspace_ws_mkdir(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * Read a file from the shared workspace (the workbench
+     * `FileSystemProvider.readFile`) — the same content the OS reads over
+     * `virtio-9p`. `undefined` if absent.
+     * @param {string} name
+     * @returns {Uint8Array | undefined}
+     */
+    ws_read(name) {
+        const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_ws_read(this.__wbg_ptr, ptr0, len0);
+        let v2;
+        if (ret[0] !== 0) {
+            v2 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v2;
+    }
+    /**
+     * Rename a file or folder in the shared workspace (the workbench
+     * `FileSystemProvider.rename`). `true` if the source existed.
+     * @param {string} from
+     * @param {string} to
+     * @returns {boolean}
+     */
+    ws_rename(from, to) {
+        const ptr0 = passStringToWasm0(from, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(to, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.workspace_ws_rename(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        return ret !== 0;
+    }
+    /**
+     * Write a file into the shared workspace (the workbench
+     * `FileSystemProvider.writeFile`) — the editor saving the *same content* the
+     * OS reads over `virtio-9p` (one content, Law L1). Returns the content's κ
+     * (its identity, Law L1/L2).
+     * @param {string} name
+     * @param {Uint8Array} content
+     * @returns {string}
+     */
+    ws_write(name, content) {
+        let deferred3_0;
+        let deferred3_1;
+        try {
+            const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passArray8ToWasm0(content, wasm.__wbindgen_malloc);
+            const len1 = WASM_VECTOR_LEN;
+            const ret = wasm.workspace_ws_write(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+            deferred3_0 = ret[0];
+            deferred3_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+        }
+    }
+}
+if (Symbol.dispose) Workspace.prototype[Symbol.dispose] = Workspace.prototype.free;
+
+/**
+ * The κ-label of bytes on the substrate's default σ-axis (blake3) — the same
+ * content address every peer computes (Law L1).
+ * @param {Uint8Array} bytes
+ * @returns {string}
+ */
+export function kappa(bytes) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passArray8ToWasm0(bytes, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.kappa(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * Run a `.holo` compute artifact in the browser via the hologram executor
+ * compiled to wasm — the *browser `.holo` engine* (arc42 chapter 11, RT2;
+ * conformance `CC-2`). Returns the κ-label of the first output. Because the
+ * executor is deterministic and content-addressed, this κ equals the one the
+ * native executor produces for the same `.holo` (the browser engine equals the
+ * native one).
+ * @param {Uint8Array} archive
+ * @returns {string}
+ */
+export function run_holo(archive) {
+    let deferred3_0;
+    let deferred3_1;
+    try {
+        const ptr0 = passArray8ToWasm0(archive, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.run_holo(ptr0, len0);
+        var ptr2 = ret[0];
+        var len2 = ret[1];
+        if (ret[3]) {
+            ptr2 = 0; len2 = 0;
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        deferred3_0 = ptr2;
+        deferred3_1 = len2;
+        return getStringFromWasm0(ptr2, len2);
+    } finally {
+        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+    }
+}
+
+/**
+ * Validate that `module` is a recompiled userland fit for the *execution
+ * surface* (ADR-008; `CC-6`): specification-valid WebAssembly that imports only
+ * the substrate host ABI and presents the container ABI. This is the κ-boundary
+ * contract the browser peer enforces before a userland may be a holospace's
+ * code — ambient (WASI-style) imports and a missing container ABI are refused.
+ * @param {Uint8Array} module
+ */
+export function validate_userland(module) {
+    const ptr0 = passArray8ToWasm0(module, wasm.__wbindgen_malloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.validate_userland(ptr0, len0);
+    if (ret[1]) {
+        throw takeFromExternrefTable0(ret[0]);
+    }
+}
+
+/**
+ * Verify bytes against a claimed κ-label by re-derivation (Law L5). This is
+ * what makes content fetched from an untrusted gateway safe.
+ * @param {Uint8Array} bytes
+ * @param {string} kappa
+ * @returns {boolean}
+ */
+export function verify_kappa(bytes, kappa) {
+    const ptr0 = passArray8ToWasm0(bytes, wasm.__wbindgen_malloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(kappa, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len1 = WASM_VECTOR_LEN;
+    const ret = wasm.verify_kappa(ptr0, len0, ptr1, len1);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return ret[0] !== 0;
+}
+function __wbg_get_imports() {
+    const import0 = {
+        __proto__: null,
+        __wbg___wbindgen_debug_string_0accd80f45e5faa2: function(arg0, arg1) {
+            const ret = debugString(arg1);
+            const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            const len1 = WASM_VECTOR_LEN;
+            getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+            getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+        },
+        __wbg___wbindgen_throw_1506f2235d1bdba0: function(arg0, arg1) {
+            throw new Error(getStringFromWasm0(arg0, arg1));
+        },
+        __wbg__wbg_cb_unref_61db23ac97f16c31: function(arg0) {
+            arg0._wbg_cb_unref();
+        },
+        __wbg_data_bd354b70c783c66e: function(arg0) {
+            const ret = arg0.data;
+            return ret;
+        },
+        __wbg_getSize_5db8adeff7a4553d: function() { return handleError(function (arg0) {
+            const ret = arg0.getSize();
+            return ret;
+        }, arguments); },
+        __wbg_length_4a591ecaa01354d9: function(arg0) {
+            const ret = arg0.length;
+            return ret;
+        },
+        __wbg_new_578aeef4b6b94378: function(arg0) {
+            const ret = new Uint8Array(arg0);
+            return ret;
+        },
+        __wbg_new_ce1ab61c1c2b300d: function() {
+            const ret = new Object();
+            return ret;
+        },
+        __wbg_new_d7e476b433a26bea: function() { return handleError(function (arg0, arg1) {
+            const ret = new WebSocket(getStringFromWasm0(arg0, arg1));
+            return ret;
+        }, arguments); },
+        __wbg_prototypesetcall_3249fc62a0fafa30: function(arg0, arg1, arg2) {
+            Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
+        },
+        __wbg_read_34a0958bcc273c55: function() { return handleError(function (arg0, arg1, arg2, arg3) {
+            const ret = arg0.read(getArrayU8FromWasm0(arg1, arg2), arg3);
+            return ret;
+        }, arguments); },
+        __wbg_send_4a773f523104d75e: function() { return handleError(function (arg0, arg1, arg2) {
+            arg0.send(getArrayU8FromWasm0(arg1, arg2));
+        }, arguments); },
+        __wbg_set_at_5b6d1bf4f66bd626: function(arg0, arg1) {
+            arg0.at = arg1;
+        },
+        __wbg_set_binaryType_41994c453b95bdd2: function(arg0, arg1) {
+            arg0.binaryType = __wbindgen_enum_BinaryType[arg1];
+        },
+        __wbg_set_onclose_13787fb31ae8aefd: function(arg0, arg1) {
+            arg0.onclose = arg1;
+        },
+        __wbg_set_onmessage_9c6b4cb14e244b7f: function(arg0, arg1) {
+            arg0.onmessage = arg1;
+        },
+        __wbg_set_onopen_db452f4233e99d7d: function(arg0, arg1) {
+            arg0.onopen = arg1;
+        },
+        __wbg_truncate_6b32a1fa508f5f05: function() { return handleError(function (arg0, arg1) {
+            arg0.truncate(arg1);
+        }, arguments); },
+        __wbg_write_948386f6a5cf303f: function() { return handleError(function (arg0, arg1, arg2, arg3) {
+            const ret = arg0.write(getArrayU8FromWasm0(arg1, arg2), arg3);
+            return ret;
+        }, arguments); },
+        __wbindgen_cast_0000000000000001: function(arg0, arg1) {
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 11, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h26fdb82a8d18ed9f);
+            return ret;
+        },
+        __wbindgen_cast_0000000000000002: function(arg0, arg1) {
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("MessageEvent")], shim_idx: 11, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h26fdb82a8d18ed9f_1);
+            return ret;
+        },
+        __wbindgen_cast_0000000000000003: function(arg0, arg1) {
+            // Cast intrinsic for `Ref(String) -> Externref`.
+            const ret = getStringFromWasm0(arg0, arg1);
+            return ret;
+        },
+        __wbindgen_init_externref_table: function() {
+            const table = wasm.__wbindgen_externrefs;
+            const offset = table.grow(4);
+            table.set(0, undefined);
+            table.set(offset + 0, undefined);
+            table.set(offset + 1, null);
+            table.set(offset + 2, true);
+            table.set(offset + 3, false);
+        },
+    };
+    return {
+        __proto__: null,
+        "./holospaces_web_bg.js": import0,
+    };
+}
+
+function wasm_bindgen__convert__closures_____invoke__h26fdb82a8d18ed9f(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h26fdb82a8d18ed9f(arg0, arg1, arg2);
+}
+
+function wasm_bindgen__convert__closures_____invoke__h26fdb82a8d18ed9f_1(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h26fdb82a8d18ed9f_1(arg0, arg1, arg2);
+}
+
+
+const __wbindgen_enum_BinaryType = ["blob", "arraybuffer"];
+const Aarch64WorkspaceFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_aarch64workspace_free(ptr, 1));
+const ConsoleFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_console_free(ptr, 1));
+const DevcontainerImageFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_devcontainerimage_free(ptr, 1));
+const UserlandWorkspaceFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_userlandworkspace_free(ptr, 1));
+const WorkspaceFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_workspace_free(ptr, 1));
+
+function addToExternrefTable0(obj) {
+    const idx = wasm.__externref_table_alloc();
+    wasm.__wbindgen_externrefs.set(idx, obj);
+    return idx;
+}
+
+const CLOSURE_DTORS = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(state => wasm.__wbindgen_destroy_closure(state.a, state.b));
+
+function debugString(val) {
+    // primitive types
+    const type = typeof val;
+    if (type == 'number' || type == 'boolean' || val == null) {
+        return  `${val}`;
+    }
+    if (type == 'string') {
+        return `"${val}"`;
+    }
+    if (type == 'symbol') {
+        const description = val.description;
+        if (description == null) {
+            return 'Symbol';
+        } else {
+            return `Symbol(${description})`;
+        }
+    }
+    if (type == 'function') {
+        const name = val.name;
+        if (typeof name == 'string' && name.length > 0) {
+            return `Function(${name})`;
+        } else {
+            return 'Function';
+        }
+    }
+    // objects
+    if (Array.isArray(val)) {
+        const length = val.length;
+        let debug = '[';
+        if (length > 0) {
+            debug += debugString(val[0]);
+        }
+        for(let i = 1; i < length; i++) {
+            debug += ', ' + debugString(val[i]);
+        }
+        debug += ']';
+        return debug;
+    }
+    // Test for built-in
+    const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
+    let className;
+    if (builtInMatches && builtInMatches.length > 1) {
+        className = builtInMatches[1];
+    } else {
+        // Failed to match the standard '[object ClassName]'
+        return toString.call(val);
+    }
+    if (className == 'Object') {
+        // we're a user defined class or Object
+        // JSON.stringify avoids problems with cycles, and is generally much
+        // easier than looping through ownProperties of `val`.
+        try {
+            return 'Object(' + JSON.stringify(val) + ')';
+        } catch (_) {
+            return 'Object';
+        }
+    }
+    // errors
+    if (val instanceof Error) {
+        return `${val.name}: ${val.message}\n${val.stack}`;
+    }
+    // TODO we could test for more things here, like `Set`s and `Map`s.
+    return className;
+}
+
+function getArrayJsValueFromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    const mem = getDataViewMemory0();
+    const result = [];
+    for (let i = ptr; i < ptr + 4 * len; i += 4) {
+        result.push(wasm.__wbindgen_externrefs.get(mem.getUint32(i, true)));
+    }
+    wasm.__externref_drop_slice(ptr, len);
+    return result;
+}
+
+function getArrayU8FromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+
+let cachedDataViewMemory0 = null;
+function getDataViewMemory0() {
+    if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || (cachedDataViewMemory0.buffer.detached === undefined && cachedDataViewMemory0.buffer !== wasm.memory.buffer)) {
+        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+    }
+    return cachedDataViewMemory0;
+}
+
+function getStringFromWasm0(ptr, len) {
+    return decodeText(ptr >>> 0, len);
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+function handleError(f, args) {
+    try {
+        return f.apply(this, args);
+    } catch (e) {
+        const idx = addToExternrefTable0(e);
+        wasm.__wbindgen_exn_store(idx);
+    }
+}
+
+function makeMutClosure(arg0, arg1, f) {
+    const state = { a: arg0, b: arg1, cnt: 1 };
+    const real = (...args) => {
+
+        // First up with a closure we increment the internal reference
+        // count. This ensures that the Rust closure environment won't
+        // be deallocated while we're invoking it.
+        state.cnt++;
+        const a = state.a;
+        state.a = 0;
+        try {
+            return f(a, state.b, ...args);
+        } finally {
+            state.a = a;
+            real._wbg_cb_unref();
+        }
+    };
+    real._wbg_cb_unref = () => {
+        if (--state.cnt === 0) {
+            wasm.__wbindgen_destroy_closure(state.a, state.b);
+            state.a = 0;
+            CLOSURE_DTORS.unregister(state);
+        }
+    };
+    CLOSURE_DTORS.register(real, state, state);
+    return real;
+}
+
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
+function takeFromExternrefTable0(idx) {
+    const value = wasm.__wbindgen_externrefs.get(idx);
+    wasm.__externref_table_dealloc(idx);
+    return value;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+cachedTextDecoder.decode();
+const MAX_SAFARI_DECODE_BYTES = 2146435072;
+let numBytesDecoded = 0;
+function decodeText(ptr, len) {
+    numBytesDecoded += len;
+    if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+        cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+        cachedTextDecoder.decode();
+        numBytesDecoded = len;
+    }
+    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
+let WASM_VECTOR_LEN = 0;
+
+let wasmModule, wasmInstance, wasm;
+function __wbg_finalize_init(instance, module) {
+    wasmInstance = instance;
+    wasm = instance.exports;
+    wasmModule = module;
+    cachedDataViewMemory0 = null;
+    cachedUint8ArrayMemory0 = null;
+    wasm.__wbindgen_start();
+    return wasm;
+}
+
+async function __wbg_load(module, imports) {
+    if (typeof Response === 'function' && module instanceof Response) {
+        if (typeof WebAssembly.instantiateStreaming === 'function') {
+            try {
+                return await WebAssembly.instantiateStreaming(module, imports);
+            } catch (e) {
+                const validResponse = module.ok && expectedResponseType(module.type);
+
+                if (validResponse && module.headers.get('Content-Type') !== 'application/wasm') {
+                    console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
+
+                } else { throw e; }
+            }
+        }
+
+        const bytes = await module.arrayBuffer();
+        return await WebAssembly.instantiate(bytes, imports);
+    } else {
+        const instance = await WebAssembly.instantiate(module, imports);
+
+        if (instance instanceof WebAssembly.Instance) {
+            return { instance, module };
+        } else {
+            return instance;
+        }
+    }
+
+    function expectedResponseType(type) {
+        switch (type) {
+            case 'basic': case 'cors': case 'default': return true;
+        }
+        return false;
+    }
+}
+
+function initSync(module) {
+    if (wasm !== undefined) return wasm;
+
+
+    if (module !== undefined) {
+        if (Object.getPrototypeOf(module) === Object.prototype) {
+            ({module} = module)
+        } else {
+            console.warn('using deprecated parameters for `initSync()`; pass a single object instead')
+        }
+    }
+
+    const imports = __wbg_get_imports();
+    if (!(module instanceof WebAssembly.Module)) {
+        module = new WebAssembly.Module(module);
+    }
+    const instance = new WebAssembly.Instance(module, imports);
+    return __wbg_finalize_init(instance, module);
+}
+
+async function __wbg_init(module_or_path) {
+    if (wasm !== undefined) return wasm;
+
+
+    if (module_or_path !== undefined) {
+        if (Object.getPrototypeOf(module_or_path) === Object.prototype) {
+            ({module_or_path} = module_or_path)
+        } else {
+            console.warn('using deprecated parameters for the initialization function; pass a single object instead')
+        }
+    }
+
+    if (module_or_path === undefined) {
+        module_or_path = new URL('holospaces_web_bg.wasm', import.meta.url);
+    }
+    const imports = __wbg_get_imports();
+
+    if (typeof module_or_path === 'string' || (typeof Request === 'function' && module_or_path instanceof Request) || (typeof URL === 'function' && module_or_path instanceof URL)) {
+        module_or_path = fetch(module_or_path);
+    }
+
+    const { instance, module } = await __wbg_load(await module_or_path, imports);
+
+    return __wbg_finalize_init(instance, module);
+}
+
+export { initSync, __wbg_init as default };

b/8d34a1e9297fbaf472886031a90d3a06dfd4aa71c0621e4325e0112ef96fb07d

@@ -0,0 +1,16 @@
+// messenger-skin.mjs — bakes the SLACK re-tone as the messenger default (aubergine chrome + a floating,
+// inset content pane; see the data-skin="slack" block in messenger-skins) and applies the hi-DPI /
+// high-FPS perf layer. No picker / no toggle. Additive + guarded. Escape hatch: set localStorage
+// "holo.skin" to graphite | warm | contrast | light (or "" to remove) to override the default.
+
+(function () {
+  if (!document.querySelector("link[data-holo-skins]")) {
+    const l = document.createElement("link"); l.rel = "stylesheet"; l.href = new URL("./messenger-skins.css?v=7d883ae6cf3e", import.meta.url); l.setAttribute("data-holo-skins", "1"); document.head.appendChild(l);
+  }
+  let skin = "slack";
+  try { const s = localStorage.getItem("holo.skin"); if (s) skin = s; } catch {}
+  if (skin) document.documentElement.setAttribute("data-skin", skin); else document.documentElement.removeAttribute("data-skin");
+  // remove any lingering picker + its persisted flag from earlier ?skins=1 sessions
+  try { localStorage.removeItem("holo.skins"); } catch {}
+  try { const p = document.querySelector(".holo-skin-pick"); if (p) p.remove(); } catch {}
+})();

b/9d90b4ea8bccee8c239073c7ec7dd5158c6d11f1f668487570d17475d79e661e

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9d90b4ea8bccee8c239073c7ec7dd5158c6d11f1f668487570d17475d79e661e
+size 6469596

b/a2276a0af47a3bc0c9c83d8d370bcc85c07e9c0f516b196ac158e575d5277b02

@@ -0,0 +1 @@
+import{a as h,b as x,c as C,d as v}from"./chunk-VJZ6ZLRJ.js";import"./chunk-SQE76S5B.js";function y(e){return["L1",e.type,e.kappa,e.hashlock||"",e.preimage||"",String(e.amount??""),e.asset||"",e.fiat||"",String(e.expires||""),e.by||"",String(e.at||"")].join("|")}async function E(e,{claimSecret:n,signer:r,at:a}){let i={type:"claim",kappa:e.kappa,hashlock:e.hashlock,preimage:n,amount:e.amount,asset:e.asset,fiat:e.fiat||null,expires:e.expires,by:r.pub,at:a};return i.sig=await r.sign(y(i)),i.tid=await h(y(i)),i}async function M(e,{signer:n,at:r}){let a={type:"refund",kappa:e.kappa,expires:e.expires,by:n.pub,at:r};return a.sig=await n.sign(y(a)),a.tid=await h(y(a)),a}async function _(e,n){return!e||!e.type||!e.kappa||!e.by||!e.sig||!await C(e.by,e.sig,y(e))?!1:e.type==="claim"?!(!e.preimage||await h(e.preimage)!==e.hashlock||e.expires&&e.at>e.expires):e.type==="refund"?!!(e.expires&&n>e.expires):!1}async function S(e,n=Date.now()){let r=[];for(let o of e)await _(o,n)&&r.push(o);let a=r.filter(o=>o.type==="claim");if(a.length){a.sort((t,s)=>t.at-s.at||(t.tid<s.tid?-1:t.tid>s.tid?1:0));let o=a[0];return{state:"claimed",winner:o.tid,by:o.by,amount:o.amount,asset:o.asset,fiat:o.fiat}}let i=r.filter(o=>o.type==="refund");return i.length?(i.sort((o,t)=>o.at-t.at||(o.tid<t.tid?-1:1)),{state:"refunded",winner:i[0].tid}):{state:"open"}}function P(e){return e&&e.transitions?Object.values(e.transitions):[]}async function R(e,n,r=Date.now()){e.transitions=e.transitions||{};for(let a of n||[])e.transitions[a.tid]||await _(a,r)&&(e.transitions[a.tid]=a);return e}var D=()=>({funded:!1,mode:"custodial",committed:null,transitions:{}}),b=new Map;function d(){return{get:e=>b.get(e)||null,set:(e,n)=>b.set(e,n),has:e=>b.has(e)}}function L(e="holo-escrow"){if(typeof localStorage>"u")return d();let n=r=>e+":"+r;return{get:r=>{try{let a=localStorage.getItem(n(r));return a?JSON.parse(a):null}catch{return null}},set:(r,a)=>{try{localStorage.setItem(n(r),JSON.stringify(a))}catch{}},has:r=>{try{return localStorage.getItem(n(r))!=null}catch{return!1}}}}async function q(e,{store:n=null,wallet:r=null,chain:a="base",nowMs:i=null}={}){let o=n||d();if(!e||!e.kappa)return{ok:!1,error:"no payment to fund"};if(!await v(e))return{ok:!1,error:"this payment isn't authentically signed, refusing to fund"};if(!e.hashlock)return{ok:!1,error:"this payment has no escrow lock"};let t=i||Date.now();if(e.expires&&t>e.expires)return{ok:!1,error:"already expired"};let s=o.get(e.kappa);if(s&&s.funded)return{ok:!0,kappa:e.kappa,mode:s.mode,live:s.mode==="live",tx:s.tx,already:!0};let f=r&&typeof r.htlcFund=="function"?"live":"custodial",u=null,m=null;if(f==="live"){let l;try{l=await r.htlcFund({chain:a,amount:e.amount,token:e.asset,hashlock:e.hashlock,timeout:e.expires})}catch(k){return{ok:!1,error:String(k&&k.message||k)}}u=l&&(l.tx||l.hash)||null,m=l&&l.swapId||e.hashlock}let c=s||D();return c.funded=!0,c.mode=f,c.tx=u,c.swapId=m,c.chain=f==="live"?a:null,c.amount=e.amount,c.asset=e.asset,c.fiat=e.fiat||null,c.expires=e.expires,o.set(e.kappa,c),{ok:!0,kappa:e.kappa,mode:f,live:f==="live",tx:u,swapId:m}}async function z(e,{claimSecret:n=null,claimerPub:r=null,claimerSigner:a=null,store:i=null,nowMs:o=null,wallet:t=null}={}){let s=i||d(),f=o||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};if(!await v(e))return{ok:!1,error:"this link isn't authentically signed"};if(e.expires&&f>e.expires)return{ok:!1,error:"this payment has expired"};let u=n||e.claimSecret;if(!u)return{ok:!1,error:"this link has no claim key"};if(await h(u)!==e.hashlock)return{ok:!1,error:"this claim key doesn't match the payment"};let m=a||await x(),c=await E(e,{claimSecret:u,signer:m,at:f}),l=s.get(e.kappa)||D();l.funded||(l.offDevice=!0);let k=l.committed&&l.committed!==c.tid;if(l.transitions[c.tid]=c,l.committed||(l.committed=c.tid),s.set(e.kappa,l),k)return{ok:!1,error:"already claimed"};let j=null,g=l.mode==="live";if(t&&typeof t.htlcClaim=="function")try{let p=g?{chain:l.chain}:typeof t.htlcSwapExists=="function"?await t.htlcSwapExists({hashlock:e.hashlock}):null;if(p){g=!0,l.mode="live",l.chain=l.chain||p.chain||null,s.set(e.kappa,l);let w=await t.htlcClaim({chain:l.chain||p.chain,hashlock:e.hashlock,preimage:u});j=w&&(w.tx||w.hash)||null}}catch(p){return{ok:!1,error:"on-chain claim failed: "+String(p&&p.message||p)}}return{ok:!0,amount:e.amount,asset:e.asset,fiat:e.fiat||null,mode:l.mode,live:g,offDevice:!!l.offDevice,tid:c.tid,tx:j,claimerPub:r||m.pub,custodialWallet:g?null:"\u03BA:"+e.kappa.slice(0,16)}}async function A(e,{store:n=null,signer:r=null,nowMs:a=null}={}){let i=n||d(),o=a||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};let t=i.get(e.kappa);if(!t)return{ok:!1,error:"no escrow to refund"};let s=await S(Object.values(t.transitions),o);if(s.state==="claimed")return{ok:!1,error:"already claimed, can't refund"};if(s.state==="refunded")return{ok:!1,error:"already refunded"};if(!(t.expires&&o>t.expires))return{ok:!1,error:"not yet expired, can't refund"};let f=r||await x(),u=await M(e,{signer:f,at:o});return t.transitions[u.tid]=u,i.set(e.kappa,t),{ok:!0,amount:t.amount,asset:t.asset,mode:t.mode}}async function T(e,{store:n=null,nowMs:r=null}={}){let a=n||d(),i=r||Date.now(),o=typeof e=="string"?e:e&&e.kappa;if(!o)return{state:"none"};let t=a.get(o);if(!t)return{state:"none"};let s=await S(Object.values(t.transitions),i);return s.state==="open"?{state:t.funded?"open":"none",committed:t.committed||null,canonicalWinner:null,reconciled:!1}:{state:s.state,canonicalWinner:s.winner,committed:t.committed||null,reconciled:!!(t.committed&&s.state==="claimed"&&t.committed!==s.winner),by:s.by,amount:s.amount,asset:s.asset}}function B(e,{store:n=null}={}){let r=n||d(),a=typeof e=="string"?e:e&&e.kappa,i=r.get(a);return i?P(i):[]}async function G(e,n,{store:r=null,nowMs:a=null}={}){let i=r||d(),o=a||Date.now(),t=typeof e=="string"?e:e&&e.kappa,s=i.get(t)||D();return await R(s,n||[],o),i.set(t,s),T(t,{store:i,nowMs:o})}export{z as claimEscrow,B as exportPeer,q as fund,L as localStore,G as mergePeer,A as refund,T as status};

b/c9a284fdd54f5472ac7d7781d9ac2d289f7dbacb9c710b0315bee75cd68ed99e

@@ -0,0 +1,47 @@
+// holo-release-verify.mjs — downstream acceptance of a release pointer (S2/S3 of the downstream-holospace
+// initiative). Isomorphic: the boot page, the service worker, and Node witnesses all use THIS one module.
+//
+// The rule (fail-closed, Law L5 + SEC-1/4/6):
+//   a head is accepted only if (1) its id re-derives from its body, (2) it is SIGNED and the signature
+//   verifies over the id, (3) authorship is CONTINUOUS with the pinned head (same pub key), and
+//   (4) it does not travel backwards (seq strictly grows; the same head re-presented is a no-op).
+// With no pin yet (first boot) the head is trusted-on-first-use and becomes the pin — every later
+// update must chain from it. Rollback is NOT a violation: re-pinning a parent is an explicit local
+// act (the store still holds it), never something a remote pointer can cause.
+
+import { verifyEntry } from "/usr/lib/holo/holo-strand.mjs";
+
+// verifyChain(entries) — Law L5 over the whole strand: every entry re-derives + verifies its
+// signature, seq is dense from 0, every prev is exactly the prior id. Mirrors strand.verify()
+// for a plain array (the pointer file world has no backend).
+export async function verifyChain(entries) {
+  let prev = null;
+  for (let i = 0; i < (entries || []).length; i++) {
+    const rec = entries[i];
+    const v = await verifyEntry(rec);
+    if (!v.ok) return { ok: false, brokeAt: i, why: v.why };
+    if (rec["holstr:seq"] !== i) return { ok: false, brokeAt: i, why: "seq-out-of-order" };
+    if (rec["holstr:prev"] !== prev) return { ok: false, brokeAt: i, why: "prev-link-broken" };
+    prev = rec.id;
+  }
+  return { ok: true, length: (entries || []).length, head: prev };
+}
+
+// acceptHead(head, pinned) → { ok, pin?, why?, unchanged? }
+//   head   : the fetched release.json record (untrusted bytes from an untrusted origin)
+//   pinned : the locally durable { id, seq, pub } from the last accepted release (null on first boot)
+export async function acceptHead(head, pinned = null) {
+  if (!head || typeof head !== "object") return { ok: false, why: "no-head" };
+  const v = await verifyEntry(head);
+  if (!v.ok) return { ok: false, why: v.why };                                   // tampered or forged (L5/SEC-1)
+  if (!v.signed) return { ok: false, why: "unsigned-release" };                  // no signature → no update
+  const pub = head["holstr:pub"], seq = head["holstr:seq"];
+  if (pinned) {
+    if (pub !== pinned.pub) return { ok: false, why: "key-discontinuity" };      // a different author cannot replace the strand (SEC-4)
+    if (head.id === pinned.id) return { ok: true, unchanged: true, pin: pinned };
+    if (!(seq > pinned.seq)) return { ok: false, why: "replay-stale-head" };     // an old release re-presented as new is refused
+  }
+  return { ok: true, pin: { id: head.id, seq, pub } };
+}
+
+export default { verifyChain, acceptHead };

b/d2e8a9ef211a9cf3d441297f50e5ef6949d8a7c43ebbe56705e75eb32e969937

@@ -0,0 +1 @@
+import{a as h,b as x,c as j,d as v}from"./chunk-VJZ6ZLRJ.js";import"./chunk-SQE76S5B.js";function y(e){return["L1",e.type,e.kappa,e.hashlock||"",e.preimage||"",String(e.amount??""),e.asset||"",e.fiat||"",String(e.expires||""),e.by||"",String(e.at||"")].join("|")}async function C(e,{claimSecret:i,signer:r,at:a}){let l={type:"claim",kappa:e.kappa,hashlock:e.hashlock,preimage:i,amount:e.amount,asset:e.asset,fiat:e.fiat||null,expires:e.expires,by:r.pub,at:a};return l.sig=await r.sign(y(l)),l.tid=await h(y(l)),l}async function E(e,{signer:i,at:r}){let a={type:"refund",kappa:e.kappa,expires:e.expires,by:i.pub,at:r};return a.sig=await i.sign(y(a)),a.tid=await h(y(a)),a}async function M(e,i){return!e||!e.type||!e.kappa||!e.by||!e.sig||!await j(e.by,e.sig,y(e))?!1:e.type==="claim"?!(!e.preimage||await h(e.preimage)!==e.hashlock||e.expires&&e.at>e.expires):e.type==="refund"?!!(e.expires&&i>e.expires):!1}async function S(e,i=Date.now()){let r=[];for(let n of e)await M(n,i)&&r.push(n);let a=r.filter(n=>n.type==="claim");if(a.length){a.sort((s,t)=>s.at-t.at||(s.tid<t.tid?-1:s.tid>t.tid?1:0));let n=a[0];return{state:"claimed",winner:n.tid,by:n.by,amount:n.amount,asset:n.asset,fiat:n.fiat}}let l=r.filter(n=>n.type==="refund");return l.length?(l.sort((n,s)=>n.at-s.at||(n.tid<s.tid?-1:1)),{state:"refunded",winner:l[0].tid}):{state:"open"}}function _(e){return e&&e.transitions?Object.values(e.transitions):[]}async function P(e,i,r=Date.now()){e.transitions=e.transitions||{};for(let a of i||[])e.transitions[a.tid]||await M(a,r)&&(e.transitions[a.tid]=a);return e}var D=()=>({funded:!1,mode:"custodial",committed:null,transitions:{}}),b=new Map;function m(){return{get:e=>b.get(e)||null,set:(e,i)=>b.set(e,i),has:e=>b.has(e)}}function L(e="holo-escrow"){if(typeof localStorage>"u")return m();let i=r=>e+":"+r;return{get:r=>{try{let a=localStorage.getItem(i(r));return a?JSON.parse(a):null}catch{return null}},set:(r,a)=>{try{localStorage.setItem(i(r),JSON.stringify(a))}catch{}},has:r=>{try{return localStorage.getItem(i(r))!=null}catch{return!1}}}}async function q(e,{store:i=null,wallet:r=null,chain:a="base",nowMs:l=null}={}){let n=i||m();if(!e||!e.kappa)return{ok:!1,error:"no payment to fund"};if(!await v(e))return{ok:!1,error:"this payment isn't authentically signed, refusing to fund"};if(!e.hashlock)return{ok:!1,error:"this payment has no escrow lock"};let s=l||Date.now();if(e.expires&&s>e.expires)return{ok:!1,error:"already expired"};let t=n.get(e.kappa);if(t&&t.funded)return{ok:!0,kappa:e.kappa,mode:t.mode,live:t.mode==="live",tx:t.tx,already:!0};let u=r&&typeof r.htlcFund=="function"?"live":"custodial",f=null,p=null;if(u==="live"){let o;try{o=await r.htlcFund({chain:a,amount:e.amount,token:e.asset,hashlock:e.hashlock,timeout:e.expires})}catch(k){return{ok:!1,error:String(k&&k.message||k)}}f=o&&(o.tx||o.hash)||null,p=o&&o.swapId||e.hashlock}let c=t||D();return c.funded=!0,c.mode=u,c.tx=f,c.swapId=p,c.chain=u==="live"?a:null,c.amount=e.amount,c.asset=e.asset,c.fiat=e.fiat||null,c.expires=e.expires,n.set(e.kappa,c),{ok:!0,kappa:e.kappa,mode:u,live:u==="live",tx:f,swapId:p}}async function z(e,{claimSecret:i=null,claimerPub:r=null,claimerSigner:a=null,store:l=null,nowMs:n=null,wallet:s=null}={}){let t=l||m(),u=n||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};if(!await v(e))return{ok:!1,error:"this link isn't authentically signed"};if(e.expires&&u>e.expires)return{ok:!1,error:"this payment has expired"};let f=i||e.claimSecret;if(!f)return{ok:!1,error:"this link has no claim key"};if(await h(f)!==e.hashlock)return{ok:!1,error:"this claim key doesn't match the payment"};let p=a||await x(),c=await C(e,{claimSecret:f,signer:p,at:u}),o=t.get(e.kappa)||D();o.funded||(o.offDevice=!0);let k=o.committed&&o.committed!==c.tid;if(o.transitions[c.tid]=c,o.committed||(o.committed=c.tid),t.set(e.kappa,o),k)return{ok:!1,error:"already claimed"};let R=null,g=o.mode==="live";if(s&&typeof s.htlcClaim=="function")try{let d=g?{chain:o.chain}:typeof s.htlcSwapExists=="function"?await s.htlcSwapExists({hashlock:e.hashlock}):null;if(d){g=!0,o.mode="live",o.chain=o.chain||d.chain||null,t.set(e.kappa,o);let w=await s.htlcClaim({chain:o.chain||d.chain,hashlock:e.hashlock,preimage:f});R=w&&(w.tx||w.hash)||null}}catch(d){return{ok:!1,error:"on-chain claim failed: "+String(d&&d.message||d)}}return{ok:!0,amount:e.amount,asset:e.asset,fiat:e.fiat||null,mode:o.mode,live:g,offDevice:!!o.offDevice,tid:c.tid,tx:R,claimerPub:r||p.pub,custodialWallet:g?null:"\u03BA:"+e.kappa.slice(0,16)}}async function A(e,{store:i=null,signer:r=null,nowMs:a=null,wallet:l=null}={}){let n=i||m(),s=a||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};let t=n.get(e.kappa);if(!t)return{ok:!1,error:"no escrow to refund"};let u=await S(Object.values(t.transitions),s);if(u.state==="claimed")return{ok:!1,error:"already claimed, can't refund"};if(u.state==="refunded")return{ok:!1,error:"already refunded"};if(!(t.expires&&s>t.expires))return{ok:!1,error:"not yet expired, can't refund"};let f=r||await x(),p=await E(e,{signer:f,at:s});t.transitions[p.tid]=p,n.set(e.kappa,t);let c=null;if(t.mode==="live"&&l&&typeof l.htlcRefund=="function")try{let o=await l.htlcRefund({chain:t.chain,hashlock:e.hashlock});c=o&&(o.tx||o.hash)||null}catch(o){return{ok:!1,error:"on-chain refund failed: "+String(o&&o.message||o)}}return{ok:!0,amount:t.amount,asset:t.asset,mode:t.mode,live:t.mode==="live",tx:c}}async function T(e,{store:i=null,nowMs:r=null}={}){let a=i||m(),l=r||Date.now(),n=typeof e=="string"?e:e&&e.kappa;if(!n)return{state:"none"};let s=a.get(n);if(!s)return{state:"none"};let t=await S(Object.values(s.transitions),l);return t.state==="open"?{state:s.funded?"open":"none",committed:s.committed||null,canonicalWinner:null,reconciled:!1}:{state:t.state,canonicalWinner:t.winner,committed:s.committed||null,reconciled:!!(s.committed&&t.state==="claimed"&&s.committed!==t.winner),by:t.by,amount:t.amount,asset:t.asset}}function B(e,{store:i=null}={}){let r=i||m(),a=typeof e=="string"?e:e&&e.kappa,l=r.get(a);return l?_(l):[]}async function G(e,i,{store:r=null,nowMs:a=null}={}){let l=r||m(),n=a||Date.now(),s=typeof e=="string"?e:e&&e.kappa,t=l.get(s)||D();return await P(t,i||[],n),l.set(s,t),T(s,{store:l,nowMs:n})}export{z as claimEscrow,B as exportPeer,q as fund,L as localStore,G as mergePeer,A as refund,T as status};

b/e7b914a4e11aedb2e0239e7a84502a8241f2fff157d980741728810a1559ff41

@@ -0,0 +1 @@
+function l(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=decodeURIComponent(escape(atob(t)));return JSON.parse(n)}var i=["v","kind","amount","asset","fiat","to","toName","from","fromName","memo","created","expires","claimSecret","pub","sig"];function u(e){let t=l(e);if(!Array.isArray(t))return t;let n={};return i.forEach((a,o)=>{t[o]!=null&&(n[a]=t[o])}),n.memo==null&&(n.memo=""),n}async function p(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest("SHA-256",t);return[...new Uint8Array(n)].map(a=>a.toString(16).padStart(2,"0")).join("")}var w=p;function r(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function s(e){let t=atob(e.replace(/-/g,"+").replace(/_/g,"/")),n=new Uint8Array(t.length);for(let a=0;a<t.length;a++)n[a]=t.charCodeAt(a);return n}async function y(){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),t=new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey));return{pub:r(t),sign:async n=>r(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.privateKey,new TextEncoder().encode(n))))}}async function c(e,t,n){try{let a=await crypto.subtle.importKey("raw",s(e),{name:"ECDSA",namedCurve:"P-256"},!1,["verify"]);return await crypto.subtle.verify({name:"ECDSA",hash:"SHA-256"},a,s(t),new TextEncoder().encode(n))}catch{return!1}}var h=c;async function b(e){return!e||!e.pub||!e.sig?!1:c(e.pub,e.sig,d(e))}function d(e){let t=[e.v,e.kind,e.amount,e.asset,e.fiat||"",e.to||"",e.toName||"",e.from||"",e.fromName||"",e.memo||"",e.created||"",e.expires||""];return(e.hashlock||e.pub)&&t.push(e.hashlock||"",e.pub||""),t.join("|")}var f={USD:"$",EUR:"\u20AC",GBP:"\xA3"};function g(e){let t=Number(e.amount);return e.fiat?`${f[e.fiat]||""}${t.toFixed(2)}`:`${t%1===0?t:t.toFixed(4).replace(/0+$/,"")} ${e.asset}`}var m=/(https?:\/\/\S*pay-claim\.html#([A-Za-z0-9_-]+))|(holo:\/\/pay\/\S*#([A-Za-z0-9_-]+))/;function S(e){let t=String(e||"").match(m);if(!t)return null;let n=t[2]||t[4],a=t[0];try{let o=u(n);if(o&&o.v===1&&Number(o.amount)>0)return{intent:o,url:a,payload:n}}catch{}return null}export{w as a,y as b,h as c,b as d,g as e,S as f};

b/f011367faa1643ec7403b71b5e585c7a85ede5bd4a08e8ad5e95c31bcdf1161a

@@ -0,0 +1 @@
+function l(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=decodeURIComponent(escape(atob(t)));return JSON.parse(n)}var i=["v","kind","amount","asset","fiat","to","toName","from","fromName","memo","created","expires","claimSecret","pub","sig"];function u(e){let t=l(e);if(!Array.isArray(t))return t;let n={};return i.forEach((a,o)=>{t[o]!=null&&(n[a]=t[o])}),n.memo==null&&(n.memo=""),n}async function d(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest("SHA-256",t);return[...new Uint8Array(n)].map(a=>a.toString(16).padStart(2,"0")).join("")}var w=d;function r(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function c(e){let t=atob(e.replace(/-/g,"+").replace(/_/g,"/")),n=new Uint8Array(t.length);for(let a=0;a<t.length;a++)n[a]=t.charCodeAt(a);return n}async function m(){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),t=new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey));return{pub:r(t),sign:async n=>r(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.privateKey,new TextEncoder().encode(n))))}}async function s(e,t,n){try{let a=await crypto.subtle.importKey("raw",c(e),{name:"ECDSA",namedCurve:"P-256"},!1,["verify"]);return await crypto.subtle.verify({name:"ECDSA",hash:"SHA-256"},a,c(t),new TextEncoder().encode(n))}catch{return!1}}var y=s;async function b(e){return!e||!e.pub||!e.sig?!1:s(e.pub,e.sig,p(e))}function p(e){let t=[e.v,e.kind,e.amount,e.asset,e.fiat||"",e.to||"",e.toName||"",e.from||"",e.fromName||"",e.memo||"",e.created||"",e.expires||""];return(e.hashlock||e.pub)&&t.push(e.hashlock||"",e.pub||""),t.join("|")}var f={USD:"$",EUR:"\u20AC",GBP:"\xA3"};function k(e){let t=Number(e.amount);return e.fiat?`${f[e.fiat]||""}${t.toFixed(2)}`:`${t%1===0?t:t.toFixed(4).replace(/0+$/,"")} ${e.asset}`}var h=/(https?:\/\/\S*pay-claim\.html#([A-Za-z0-9_-]+))|(holo:\/\/pay\/\S*#([A-Za-z0-9_-]+))/;function g(e){let t=String(e||"").match(h);if(!t)return null;let n=t[2]||t[4],a=t[0];try{let o=u(n);if(o&&o.v===1&&Number(o.amount)>0)return{intent:o,url:a,payload:n}}catch{}return null}export{w as a,m as b,y as c,b as d,k as e,g as f};

b/f4b80dc5a1ba9ad776b7b3793b5b9af2ed35592e45ce447eab9d571d5bc47693

@@ -0,0 +1 @@
+import{a as d,b as y,c as w,d as k}from"./chunk-VJZ6ZLRJ.js";import"./chunk-SQE76S5B.js";function m(e){return["L1",e.type,e.kappa,e.hashlock||"",e.preimage||"",String(e.amount??""),e.asset||"",e.fiat||"",String(e.expires||""),e.by||"",String(e.at||"")].join("|")}async function v(e,{claimSecret:s,signer:a,at:t}){let i={type:"claim",kappa:e.kappa,hashlock:e.hashlock,preimage:s,amount:e.amount,asset:e.asset,fiat:e.fiat||null,expires:e.expires,by:a.pub,at:t};return i.sig=await a.sign(m(i)),i.tid=await d(m(i)),i}async function S(e,{signer:s,at:a}){let t={type:"refund",kappa:e.kappa,expires:e.expires,by:s.pub,at:a};return t.sig=await s.sign(m(t)),t.tid=await d(m(t)),t}async function b(e,s){return!e||!e.type||!e.kappa||!e.by||!e.sig||!await w(e.by,e.sig,m(e))?!1:e.type==="claim"?!(!e.preimage||await d(e.preimage)!==e.hashlock||e.expires&&e.at>e.expires):e.type==="refund"?!!(e.expires&&s>e.expires):!1}async function g(e,s=Date.now()){let a=[];for(let o of e)await b(o,s)&&a.push(o);let t=a.filter(o=>o.type==="claim");if(t.length){t.sort((r,n)=>r.at-n.at||(r.tid<n.tid?-1:r.tid>n.tid?1:0));let o=t[0];return{state:"claimed",winner:o.tid,by:o.by,amount:o.amount,asset:o.asset,fiat:o.fiat}}let i=a.filter(o=>o.type==="refund");return i.length?(i.sort((o,r)=>o.at-r.at||(o.tid<r.tid?-1:1)),{state:"refunded",winner:i[0].tid}):{state:"open"}}function D(e){return e&&e.transitions?Object.values(e.transitions):[]}async function j(e,s,a=Date.now()){e.transitions=e.transitions||{};for(let t of s||[])e.transitions[t.tid]||await b(t,a)&&(e.transitions[t.tid]=t);return e}var x=()=>({funded:!1,mode:"custodial",committed:null,transitions:{}}),h=new Map;function p(){return{get:e=>h.get(e)||null,set:(e,s)=>h.set(e,s),has:e=>h.has(e)}}function C(e="holo-escrow"){if(typeof localStorage>"u")return p();let s=a=>e+":"+a;return{get:a=>{try{let t=localStorage.getItem(s(a));return t?JSON.parse(t):null}catch{return null}},set:(a,t)=>{try{localStorage.setItem(s(a),JSON.stringify(t))}catch{}},has:a=>{try{return localStorage.getItem(s(a))!=null}catch{return!1}}}}async function E(e,{store:s=null,wallet:a=null,chain:t="base",nowMs:i=null}={}){let o=s||p();if(!e||!e.kappa)return{ok:!1,error:"no payment to fund"};if(!await k(e))return{ok:!1,error:"this payment isn't authentically signed, refusing to fund"};if(!e.hashlock)return{ok:!1,error:"this payment has no escrow lock"};let r=i||Date.now();if(e.expires&&r>e.expires)return{ok:!1,error:"already expired"};let n=o.get(e.kappa);if(n&&n.funded)return{ok:!0,kappa:e.kappa,mode:n.mode,live:n.mode==="live",tx:n.tx,already:!0};let c=a&&typeof a.htlcFund=="function"?"live":"custodial",f=null;if(c==="live")try{f=await a.htlcFund({chain:t,amount:e.amount,token:e.asset,hashlock:e.hashlock,timeout:e.expires})}catch(l){return{ok:!1,error:String(l&&l.message||l)}}let u=n||x();return u.funded=!0,u.mode=c,u.tx=f,u.amount=e.amount,u.asset=e.asset,u.fiat=e.fiat||null,u.expires=e.expires,o.set(e.kappa,u),{ok:!0,kappa:e.kappa,mode:c,live:c==="live",tx:f}}async function F(e,{claimSecret:s=null,claimerPub:a=null,claimerSigner:t=null,store:i=null,nowMs:o=null}={}){let r=i||p(),n=o||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};if(!await k(e))return{ok:!1,error:"this link isn't authentically signed"};if(e.expires&&n>e.expires)return{ok:!1,error:"this payment has expired"};let c=s||e.claimSecret;if(!c)return{ok:!1,error:"this link has no claim key"};if(await d(c)!==e.hashlock)return{ok:!1,error:"this claim key doesn't match the payment"};let f=t||await y(),u=await v(e,{claimSecret:c,signer:f,at:n}),l=r.get(e.kappa)||x();l.funded||(l.offDevice=!0);let M=l.committed&&l.committed!==u.tid;return l.transitions[u.tid]=u,l.committed||(l.committed=u.tid),r.set(e.kappa,l),M?{ok:!1,error:"already claimed"}:{ok:!0,amount:e.amount,asset:e.asset,fiat:e.fiat||null,mode:l.mode,live:l.mode==="live",offDevice:!!l.offDevice,tid:u.tid,claimerPub:a||f.pub,custodialWallet:"\u03BA:"+e.kappa.slice(0,16)}}async function J(e,{store:s=null,signer:a=null,nowMs:t=null}={}){let i=s||p(),o=t||Date.now();if(!e||!e.kappa)return{ok:!1,error:"not a payment"};let r=i.get(e.kappa);if(!r)return{ok:!1,error:"no escrow to refund"};let n=await g(Object.values(r.transitions),o);if(n.state==="claimed")return{ok:!1,error:"already claimed, can't refund"};if(n.state==="refunded")return{ok:!1,error:"already refunded"};if(!(r.expires&&o>r.expires))return{ok:!1,error:"not yet expired, can't refund"};let c=a||await y(),f=await S(e,{signer:c,at:o});return r.transitions[f.tid]=f,i.set(e.kappa,r),{ok:!0,amount:r.amount,asset:r.asset,mode:r.mode}}async function _(e,{store:s=null,nowMs:a=null}={}){let t=s||p(),i=a||Date.now(),o=typeof e=="string"?e:e&&e.kappa;if(!o)return{state:"none"};let r=t.get(o);if(!r)return{state:"none"};let n=await g(Object.values(r.transitions),i);return n.state==="open"?{state:r.funded?"open":"none",committed:r.committed||null,canonicalWinner:null,reconciled:!1}:{state:n.state,canonicalWinner:n.winner,committed:r.committed||null,reconciled:!!(r.committed&&n.state==="claimed"&&r.committed!==n.winner),by:n.by,amount:n.amount,asset:n.asset}}function N(e,{store:s=null}={}){let a=s||p(),t=typeof e=="string"?e:e&&e.kappa,i=a.get(t);return i?D(i):[]}async function L(e,s,{store:a=null,nowMs:t=null}={}){let i=a||p(),o=t||Date.now(),r=typeof e=="string"?e:e&&e.kappa,n=i.get(r)||x();return await j(n,s||[],o),i.set(r,n),_(r,{store:i,nowMs:o})}export{F as claimEscrow,N as exportPeer,E as fund,C as localStore,L as mergePeer,J as refund,_ as status};