@agent-team-foundation/first-tree-hub 0.10.7 → 0.10.9

package/dist/cli/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import "../observability-DPyf745N-BSc8QNcR.mjs";
-import { A as checkServerHealth, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, J as fail, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, Q as setJsonMode, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, Y as success, Z as print, _ as onboardCreate, a as declineUpdate, at as probeCapabilities, b as createApiNameResolver, c as COMMAND_VERSION, d as isInteractive, et as ClientOrgMismatchError, f as promptAddAgent, g as onboardCheck, h as loadOnboardState, i as createExecuteUpdate, it as cleanWorkspaces, j as checkServerReachable, k as checkServerConfig, l as reconcileLocalRuntimeProviders, m as formatCheckReport, nt as SdkError, o as promptUpdate, ot as applyClientLoggerConfig, p as promptMissingFields, q as resolveReplyToFromEnv, r as registerSaaSConnectCommand, rt as SessionRegistry, s as startServer, st as configureClientLoggerForService, tt as FirstTreeHubSDK, u as uploadClientCapabilities, v as saveOnboardState, w as checkBackgroundService, x as migrateLocalAgentDirs, y as runHomeMigration } from "../saas-connect-vLyx73kJ.mjs";
+import { $ as success, A as checkServerHealth, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as getClientServiceStatus, H as stopPostgres, I as installClientService, J as removeLocalAgent, K as findStaleAliases, L as isServiceSupported, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as reconcileAgentConfigs, Q as fail, S as runMigrations, T as checkClientConfig, U as ClientRuntime, W as handleClientOrgMismatch, Y as createOwner, Z as resolveReplyToFromEnv, _ as onboardCreate, a as declineUpdate, at as ClientUserMismatchError, b as createApiNameResolver, c as COMMAND_VERSION, ct as SessionRegistry, d as isInteractive, dt as applyClientLoggerConfig, f as promptAddAgent, ft as configureClientLoggerForService, g as onboardCheck, h as loadOnboardState, i as createExecuteUpdate, it as ClientOrgMismatchError, j as checkServerReachable, k as checkServerConfig, l as reconcileLocalRuntimeProviders, lt as cleanWorkspaces, m as formatCheckReport, nt as setJsonMode, o as promptUpdate, ot as FirstTreeHubSDK, p as promptMissingFields, q as formatStaleReason, r as registerSaaSConnectCommand, s as startServer, st as SdkError, tt as print, u as uploadClientCapabilities, ut as probeCapabilities, v as saveOnboardState, w as checkBackgroundService, x as migrateLocalAgentDirs, y as runHomeMigration } from "../saas-connect-CKQ15VLz.mjs";
 import "../logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { C as serverConfigSchema, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-jx5nN1qZ.mjs";
-import "../dist-CbX9mUVH.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-DvjRZMdZ.mjs";
-import "../invitation-BljIolbO-DLeHfURd.mjs";
+import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-jx5nN1qZ.mjs";
+import "../dist-DSr_I5Ia.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-eynC54km.mjs";
+import "../invitation-B1pjAyOz-BaCA9PII.mjs";
 import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { Command } from "commander";
 import { confirm, input, password, select } from "@inquirer/prompts";
 //#region src/commands/agent-config.ts
@@ -281,6 +281,21 @@ async function resolveAgent(serverUrl, adminToken, agentName) {
 	if (!found) fail("NOT_FOUND", `Agent "${agentName}" not found`, 1);
 	return found;
 }
+/**
+* Read the persisted `client.id` from `client.yaml`. Required by `agent
+* prune` to filter the user-scoped `listMyAgents` response down to "what
+* actually binds on THIS machine". `fail()` instead of throwing so the
+* "no client.yaml — run client connect first" path renders as a clean
+* CLI error rather than a stack trace.
+*/
+function readClientId() {
+	const id = resolveConfigReadonly({
+		schema: clientConfigSchema,
+		role: "client"
+	}).client?.id;
+	if (typeof id !== "string" || id.length === 0) fail("MISSING_CLIENT_ID", "No client.id found in client.yaml. Run `first-tree-hub connect <token>` first.", 2);
+	return id;
+}
 function registerAgentCommands(program) {
 	const agent = program.command("agent").description("Agent management — config, bindings, messaging");
 	registerAgentConfigCommands(agent);
@@ -307,36 +322,103 @@ function registerAgentCommands(program) {
 		}
 	});
 	agent.command("remove <name>").description("Remove an agent from this client and delete its local runtime data (config dir, workspace, session state)").action((name) => {
-		const agentDir = join(DEFAULT_CONFIG_DIR, "agents", name);
-		if (!existsSync(agentDir)) {
+		if (!existsSync(join(DEFAULT_CONFIG_DIR, "agents", name))) {
 			print.line(`  Agent "${name}" not found.\n`);
 			process.exit(1);
 		}
-		rmSync(agentDir, {
-			recursive: true,
-			force: true
-		});
-		rmSync(join(DEFAULT_DATA_DIR, "workspaces", name), {
-			recursive: true,
-			force: true
-		});
-		rmSync(join(DEFAULT_DATA_DIR, "sessions", `${name}.json`), { force: true });
+		removeLocalAgent(name);
 		print.line(`  Agent "${name}" removed.\n`);
 	});
-	agent.command("list").description("List locally-configured agents").action(() => {
-		const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+	agent.command("prune").description("Remove local agent aliases that won't bind on this client (unowned, pinned elsewhere, or unreadable)").option("--yes", "Skip the interactive confirmation prompt").option("--dry-run", "Only list what would be removed; don't touch the filesystem").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
-			const agents = loadAgents({
-				schema: agentConfigSchema,
-				agentsDir
+			const serverUrl = resolveServerUrl(options.server);
+			const clientId = readClientId();
+			const sdk = new FirstTreeHubSDK({
+				serverUrl,
+				getAccessToken: () => ensureFreshAccessToken()
 			});
-			if (agents.size === 0) {
+			const stale = await findStaleAliases({
+				clientId,
+				listPinnedAgents: () => sdk.listMyAgents()
+			});
+			if (stale.length === 0) {
+				print.line("\n  ✓ No stale agent aliases. Local config matches the server.\n\n");
+				return;
+			}
+			print.line(`\n  ${stale.length} stale ${stale.length === 1 ? "alias" : "aliases"}:\n\n`);
+			for (const s of stale) {
+				const id = s.agentId ?? "—";
+				print.line(`    - ${s.name.padEnd(30)} ${id.padEnd(38)} ${formatStaleReason(s.reason)}\n`);
+			}
+			print.line("\n");
+			if (options.dryRun) {
+				print.line("  Dry run — no files removed. Re-run without --dry-run to delete.\n\n");
+				return;
+			}
+			if (!options.yes) {
+				if (!await confirm({
+					message: `Remove the ${stale.length} stale ${stale.length === 1 ? "alias" : "aliases"} above (config + workspace + session state)?`,
+					default: false
+				}).catch(() => false)) {
+					print.line("  Cancelled.\n\n");
+					return;
+				}
+			}
+			let removed = 0;
+			let failed = 0;
+			for (const s of stale) try {
+				removeLocalAgent(s.name);
+				print.line(`  ✓ removed ${s.name}\n`);
+				removed++;
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				print.line(`  ✗ ${s.name} (${msg.slice(0, 80)})\n`);
+				failed++;
+			}
+			print.line(`\n  ${removed} pruned${failed > 0 ? `, ${failed} failed (re-run to retry)` : ""}.\n\n`);
+			if (failed > 0) process.exitCode = 1;
+		} catch (error) {
+			fail("PRUNE_ERROR", error instanceof Error ? error.message : String(error));
+		}
+	});
+	agent.command("list").description("List agents — locally-configured by default, or every agent you manage with --remote").option("--remote", "List every agent you manage on the Hub server (cross-org)").option("--org <id>", "When listing remote, restrict to a single organization id").option("--server <url>", "Hub server URL").action(async (options) => {
+		if (!(options.remote === true || typeof options.org === "string")) {
+			const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+			try {
+				const agents = loadAgents({
+					schema: agentConfigSchema,
+					agentsDir
+				});
+				if (agents.size === 0) {
+					print.line("  No agents configured.\n");
+					return;
+				}
+				for (const [name, config] of agents) print.line(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} uuid: ${config.agentId}\n`);
+			} catch {
 				print.line("  No agents configured.\n");
+			}
+			return;
+		}
+		try {
+			const serverUrl = resolveServerUrl(options.server);
+			const token = await ensureFreshAccessToken();
+			const res = await fetch(`${serverUrl}/api/v1/me/managed-agents`, {
+				headers: { Authorization: `Bearer ${token}` },
+				signal: AbortSignal.timeout(1e4)
+			});
+			if (!res.ok) fail("LIST_ERROR", `Server returned ${res.status}`, 1);
+			const agents = await res.json();
+			const filtered = options.org ? agents.filter((a) => a.organizationId === options.org) : agents;
+			if (filtered.length === 0) {
+				print.line("  No agents found.\n");
 				return;
 			}
-			for (const [name, config] of agents) print.line(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} uuid: ${config.agentId}\n`);
-		} catch {
-			print.line("  No agents configured.\n");
+			const header = `  ${"NAME".padEnd(24)} ${"TYPE".padEnd(20)} ${"RUNTIME".padEnd(14)} ${"ORG".padEnd(40)} CLIENT`;
+			print.line(`${header}\n`);
+			print.line(`  ${"─".repeat(header.length - 2)}\n`);
+			for (const a of filtered) print.line(`  ${(a.name ?? a.uuid).padEnd(24)} ${a.type.padEnd(20)} ${a.runtimeProvider.padEnd(14)} ${a.organizationId.padEnd(40)} ${a.clientId ?? "—"}\n`);
+		} catch (error) {
+			fail("LIST_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
 	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub client connect` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--server <url>", "Hub server URL").action(async (name, options) => {
@@ -972,6 +1054,14 @@ function registerConnectCommand(parent) {
 				print.line("\n  Cancelled.\n");
 				return;
 			}
+			if (error instanceof ClientUserMismatchError) {
+				print.line("\n");
+				print.line("  ⚠️  This client.yaml is owned by a different user.\n");
+				print.line("  Run `first-tree-hub client claim --confirm` to transfer ownership\n");
+				print.line("  to your account. The previous owner's agents will be unpinned\n");
+				print.line("  from this machine.\n\n");
+				process.exit(1);
+			}
 			if (error instanceof ClientOrgMismatchError) await handleClientOrgMismatch(error, {
 				managed: false,
 				configDir: DEFAULT_CONFIG_DIR,
@@ -1069,6 +1159,14 @@ function registerClientCommands(program) {
 			process.on("SIGTERM", () => void shutdown());
 			await new Promise(() => {});
 		} catch (error) {
+			if (error instanceof ClientUserMismatchError) {
+				print.line("\n");
+				print.line("  ⚠️  This client.yaml is owned by a different user.\n");
+				print.line("  Run `first-tree-hub client claim --confirm` to transfer ownership\n");
+				print.line("  to your account. The previous owner's agents will be unpinned\n");
+				print.line("  from this machine.\n\n");
+				process.exit(1);
+			}
 			if (error instanceof ClientOrgMismatchError) await handleClientOrgMismatch(error, {
 				managed: options.interactive === false,
 				configDir: DEFAULT_CONFIG_DIR,
@@ -1084,11 +1182,32 @@ function registerClientCommands(program) {
 	});
 	client.command("doctor").description("Check client environment readiness").action(async () => {
 		print.line("\n  First Tree Hub Client Doctor\n\n");
+		let agentCheck;
+		try {
+			const serverUrl = resolveServerUrl();
+			const cfg = await initConfig({
+				schema: clientConfigSchema,
+				role: "client"
+			});
+			const sdk = new FirstTreeHubSDK({
+				serverUrl,
+				getAccessToken: () => ensureFreshAccessToken()
+			});
+			agentCheck = await reconcileAgentConfigs({
+				clientId: cfg.client.id,
+				listPinnedAgents: () => sdk.listMyAgents()
+			});
+		} catch {
+			agentCheck = checkAgentConfigs();
+		} finally {
+			resetConfig();
+			resetConfigMeta();
+		}
 		printResults([
 			checkNodeVersion(),
 			checkClientConfig(),
 			await checkServerReachable(),
-			checkAgentConfigs(),
+			agentCheck,
 			await checkWebSocket(),
 			checkBackgroundService()
 		]);
@@ -1142,6 +1261,93 @@ function registerClientCommands(program) {
 			fail("CLIENT_LIST_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
+	client.command("claim").description("Transfer ownership of this machine to your account (unpins the previous owner's agents from this machine)").option("--confirm", "Skip confirmation prompts (claim + auto-prune stale aliases)").option("--server <url>", "Hub server URL").action(async (options) => {
+		try {
+			const config = await initConfig({
+				schema: clientConfigSchema,
+				role: "client"
+			});
+			const serverUrl = resolveServerUrl(options.server) ?? config.server.url;
+			const clientId = config.client.id;
+			print.line("\n");
+			print.line("  Transferring ownership of this machine to your account.\n");
+			print.line("  This will unpin the previous owner's agents from this client.\n\n");
+			print.status("client.id", clientId);
+			print.status("server", serverUrl);
+			print.line("\n");
+			if (!options.confirm) {
+				if (!await confirm({
+					message: "Proceed with ownership transfer?",
+					default: false
+				}).catch(() => false)) {
+					print.line("  Cancelled.\n\n");
+					return;
+				}
+			}
+			const token = await ensureFreshAccessToken();
+			const response = await fetch(`${serverUrl}/api/v1/me/clients/${clientId}/claim`, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json"
+				},
+				body: "{}",
+				signal: AbortSignal.timeout(1e4)
+			});
+			if (!response.ok) {
+				const body = await response.text();
+				fail("CLAIM_ERROR", `Server returned ${response.status}: ${body}`, 1);
+			}
+			const result = await response.json();
+			print.line(`  ✓ Ownership transferred. ${result.unpinnedAgentCount} agent(s) unpinned.\n`);
+			try {
+				const sdk = new FirstTreeHubSDK({
+					serverUrl,
+					getAccessToken: () => ensureFreshAccessToken()
+				});
+				const stale = await findStaleAliases({
+					clientId,
+					listPinnedAgents: () => sdk.listMyAgents()
+				});
+				if (stale.length === 0) print.line("  No stale local aliases — local config already matches the server.\n");
+				else {
+					print.line(`\n  ${stale.length} local ${stale.length === 1 ? "alias" : "aliases"} won't bind on this client:\n\n`);
+					for (const s of stale) {
+						const id = s.agentId ?? "—";
+						print.line(`    - ${s.name.padEnd(30)} ${id.padEnd(38)} ${formatStaleReason(s.reason)}\n`);
+					}
+					print.line("\n");
+					if (options.confirm === true ? true : await confirm({
+						message: `Remove the ${stale.length} stale ${stale.length === 1 ? "alias" : "aliases"} above (config + workspace + session state)?`,
+						default: true
+					}).catch(() => false)) {
+						let removed = 0;
+						let failed = 0;
+						for (const s of stale) try {
+							removeLocalAgent(s.name);
+							print.line(`  ✓ removed ${s.name}\n`);
+							removed++;
+						} catch (err) {
+							const msg = err instanceof Error ? err.message : String(err);
+							print.line(`  ✗ ${s.name} (${msg.slice(0, 80)})\n`);
+							failed++;
+						}
+						print.line(`\n  ${removed} pruned${failed > 0 ? `, ${failed} failed (re-run \`agent prune\` to retry)` : ""}.\n`);
+					} else print.line("  Skipped. Run `first-tree-hub agent prune` later to clean up.\n");
+				}
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				print.line(`  (Could not check for stale aliases: ${msg.slice(0, 100)})\n`);
+				print.line("  Run `first-tree-hub agent prune` after reconnecting.\n");
+			}
+			print.line("\n  Run `first-tree-hub client start` to reconnect.\n\n");
+		} catch (error) {
+			fail("CLAIM_ERROR", error instanceof Error ? error.message : String(error));
+		} finally {
+			resetConfig();
+			resetConfigMeta();
+		}
+	});
 	client.command("hub-disconnect <clientId>").description("Force-disconnect a client from the Hub server").option("--server <url>", "Hub server URL").action(async (clientId, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);

package/dist/{dist-CbX9mUVH.mjs → dist-DSr_I5Ia.mjs}

@@ -613,6 +613,11 @@ const clientRegisterSchema = z.object({
 	sdkVersion: z.string().max(50).optional(),
 	wireCapabilities: clientWireCapabilitiesSchema.optional()
 });
+z.object({
+	clientId: z.string(),
+	previousUserId: z.string().nullable(),
+	unpinnedAgentCount: z.number().int().nonnegative()
+});
 const capabilityStateSchema = z.enum([
 	"ok",
 	"missing",
@@ -874,6 +879,13 @@ const createOrgFromMeSchema = z.object({
 });
 /** Body for `POST /auth/switch-org`. */
 const switchOrgSchema = z.object({ organizationId: z.string().min(1) });
+z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	organizationName: z.string(),
+	role: z.enum(["admin", "member"]),
+	agentId: z.string()
+});
 const memberRoleSchema = z.enum(["admin", "member"]);
 const memberSchema = z.object({
 	id: z.string(),

package/dist/{feishu-DvjRZMdZ.mjs → feishu-eynC54km.mjs}

@@ -1,5 +1,5 @@
 import { d as __exportAll } from "./esm-CYu4tXXn.mjs";
-import { r as AGENT_SELECTOR_HEADER } from "./dist-CbX9mUVH.mjs";
+import { r as AGENT_SELECTOR_HEADER } from "./dist-DSr_I5Ia.mjs";
 //#region src/core/feishu.ts
 var feishu_exports = /* @__PURE__ */ __exportAll({
 	bindFeishuBot: () => bindFeishuBot,

package/dist/index.mjs

@@ -1,8 +1,8 @@
 import "./observability-DPyf745N-BSc8QNcR.mjs";
-import { $ as status, A as checkServerHealth, B as isDockerAvailable, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, K as hasUser, L as resolveCliInvocation, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, R as uninstallClientService, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, W as rotateClientIdWithBackup, X as blank, _ as onboardCreate, d as isInteractive, f as promptAddAgent, g as onboardCheck, j as checkServerReachable, k as checkServerConfig, m as formatCheckReport, n as deriveHubUrlFromToken, nt as SdkError, p as promptMissingFields, s as startServer, t as HubUrlDerivationError, tt as FirstTreeHubSDK, y as runHomeMigration, z as ensurePostgres } from "./saas-connect-vLyx73kJ.mjs";
+import { A as checkServerHealth, B as ensurePostgres, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as getClientServiceStatus, G as rotateClientIdWithBackup, H as stopPostgres, I as installClientService, L as isServiceSupported, M as checkWebSocket, N as printResults, O as checkNodeVersion, R as resolveCliInvocation, S as runMigrations, T as checkClientConfig, U as ClientRuntime, V as isDockerAvailable, W as handleClientOrgMismatch, X as hasUser, Y as createOwner, _ as onboardCreate, d as isInteractive, et as blank, f as promptAddAgent, g as onboardCheck, j as checkServerReachable, k as checkServerConfig, m as formatCheckReport, n as deriveHubUrlFromToken, ot as FirstTreeHubSDK, p as promptMissingFields, rt as status, s as startServer, st as SdkError, t as HubUrlDerivationError, y as runHomeMigration, z as uninstallClientService } from "./saas-connect-CKQ15VLz.mjs";
 import "./logger-core-BTmvdflj-DjW8FM4T.mjs";
 import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-jx5nN1qZ.mjs";
-import "./dist-CbX9mUVH.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-DvjRZMdZ.mjs";
-import "./invitation-BljIolbO-DLeHfURd.mjs";
+import "./dist-DSr_I5Ia.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-eynC54km.mjs";
+import "./invitation-B1pjAyOz-BaCA9PII.mjs";
 export { ClientRuntime, FirstTreeHubSDK, HubUrlDerivationError, SdkError, bindFeishuBot, bindFeishuUser, blank, checkAgentConfigs, checkClientConfig, checkDatabase, checkDocker, checkNodeVersion, checkServerConfig, checkServerHealth, checkServerReachable, checkWebSocket, createOwner, deriveHubUrlFromToken, ensureFreshAccessToken, ensureFreshAdminToken, ensurePostgres, formatCheckReport, getClientServiceStatus, handleClientOrgMismatch, hasUser, installClientService, isDockerAvailable, isInteractive, isServiceSupported, onboardCheck, onboardCreate, printResults, promptAddAgent, promptMissingFields, resolveAccessToken, resolveCliInvocation, resolveServerUrl, rotateClientIdWithBackup, runHomeMigration, runMigrations, startServer, status, stopPostgres, uninstallClientService };

package/dist/{invitation-BljIolbO-DLeHfURd.mjs → invitation-B1pjAyOz-BaCA9PII.mjs}

@@ -1,7 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { and, desc, eq, gt, isNull, or } from "drizzle-orm";
 import { index, integer, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-//#region ../server/dist/invitation-BljIolbO.mjs
+//#region ../server/dist/invitation-B1pjAyOz.mjs
 /** Organization entity. Agents and chats belong to exactly one organization. */
 const organizations = pgTable("organizations", {
 	id: text("id").primaryKey(),
@@ -63,10 +63,11 @@ var BadRequestError = class extends AppError {
 };
 /**
 * Thrown when an operation targets a client whose organization does not match
-* the caller's authenticated organization. A client is bound to exactly one
-* org for its lifetime; re-registering or operating under a different org's
-* credentials is refused. CLI consumers recognize the `code` field and
-* respond by abandoning the local clientId to register a fresh one.
+* the caller's authenticated organization. Retained for wire compatibility:
+* the read paths that produced this error were retired in
+* decouple-client-from-identity §4.1, so the server itself no longer raises
+* it. SDK consumers may still pattern-match the `code` field on legacy
+* payloads.
 */
 var ClientOrgMismatchError = class extends AppError {
 	code = "CLIENT_ORG_MISMATCH";
@@ -75,6 +76,19 @@ var ClientOrgMismatchError = class extends AppError {
 		this.name = "ClientOrgMismatchError";
 	}
 };
+/**
+* Thrown when a client.yaml is presented with a JWT whose user_id does not
+* match the row's owner. The CLI responds by guiding the operator through
+* `first-tree-hub client claim --confirm` to take over ownership, which
+* unpins the previous owner's agents from this machine.
+*/
+var ClientUserMismatchError = class extends AppError {
+	code = "CLIENT_USER_MISMATCH";
+	constructor(message = "Client belongs to a different user") {
+		super(403, message);
+		this.name = "ClientUserMismatchError";
+	}
+};
 /** Generate a UUID v7 (time-ordered). No external dependency. */
 function uuidv7() {
 	const now = BigInt(Date.now());
@@ -256,4 +270,4 @@ function buildInviteUrl(publicUrl, token) {
 	return `${publicUrl.replace(/\/+$/, "")}/invite/${token}`;
 }
 //#endregion
-export { rotateInvitation as _, ForbiddenError as a, buildInviteUrl as c, getActiveInvitation as d, invitationRedemptions as f, recordRedemption as g, previewInvitation as h, ConflictError as i, ensureActiveInvitation as l, organizations as m, BadRequestError as n, NotFoundError as o, invitations as p, ClientOrgMismatchError as r, UnauthorizedError as s, AppError as t, findActiveByToken as u, users as v, uuidv7 as y };
+export { recordRedemption as _, ConflictError as a, uuidv7 as b, UnauthorizedError as c, findActiveByToken as d, getActiveInvitation as f, previewInvitation as g, organizations as h, ClientUserMismatchError as i, buildInviteUrl as l, invitations as m, BadRequestError as n, ForbiddenError as o, invitationRedemptions as p, ClientOrgMismatchError as r, NotFoundError as s, AppError as t, ensureActiveInvitation as u, rotateInvitation as v, users as y };

package/dist/invitation-CBnQyB7o-DVOpS_Ts.mjs

@@ -0,0 +1,3 @@
+import "./dist-DSr_I5Ia.mjs";
+import { g as previewInvitation, v as rotateInvitation } from "./invitation-B1pjAyOz-BaCA9PII.mjs";
+export { previewInvitation, rotateInvitation };