@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/{exe-key-V42G3NGO.js → exe-key-QJKU56WZ.js}

@@ -1,148 +1,149 @@
 #!/usr/bin/env node
 import {
   computeMcpSurfaceHash
-} from "./chunk-EOTZSAQL.js";
+} from "./chunk-WUCUDHKR.js";
 import "./chunk-WCGNCH3Q.js";
-import "./chunk-JJTPPAZY.js";
-import "./chunk-XSUALA32.js";
-import "./chunk-PL4CFSQ7.js";
+import "./chunk-2CUQHG6H.js";
+import "./chunk-DDYFNBYV.js";
+import "./chunk-NSXJOSH7.js";
+import "./chunk-OSIS7ZQW.js";
 import "./chunk-557C2IGL.js";
-import "./chunk-FVLNNNH6.js";
-import "./chunk-VF3BZOZK.js";
-import "./chunk-QFAFKEB5.js";
-import "./chunk-3B6FLNLV.js";
-import "./chunk-P3QQ52QK.js";
-import "./chunk-ZT4LFTUJ.js";
-import "./chunk-XUZK23V7.js";
-import "./chunk-I5XIW2BP.js";
-import "./chunk-E7C2WNR5.js";
-import "./chunk-DN3ZR3UE.js";
-import "./chunk-MB47DRF5.js";
-import "./chunk-PHUHIVD5.js";
-import "./chunk-APL7HUE3.js";
-import "./chunk-MKM6D7JM.js";
-import "./chunk-T5FEAQES.js";
-import "./chunk-U2D6PJ5T.js";
-import "./chunk-2KY7WZZF.js";
-import "./chunk-5MVKTNZP.js";
+import "./chunk-O45GBJEH.js";
+import "./chunk-BNI4LIU5.js";
+import "./chunk-X7HZHKY4.js";
+import "./chunk-5U6EOTZV.js";
+import "./chunk-LW3JCBXP.js";
+import "./chunk-XW2FW6LS.js";
+import "./chunk-RGUM474V.js";
+import "./chunk-AEIOFFFX.js";
+import "./chunk-CP7Z35MJ.js";
+import "./chunk-GP7CTIUK.js";
+import "./chunk-5QQJUO3F.js";
+import "./chunk-RWG7DLOG.js";
+import "./chunk-65G7ZTGE.js";
+import "./chunk-ZPA4R2UI.js";
+import "./chunk-SL4JWAMQ.js";
+import "./chunk-C6U7XWOC.js";
 import "./chunk-QPTSA4PP.js";
-import "./chunk-CH7BUBP3.js";
-import "./chunk-E3ZM32LF.js";
+import "./chunk-5TYJYGS5.js";
+import "./chunk-3ZL4MDQ6.js";
+import "./chunk-EVMOKRBC.js";
+import "./chunk-PAFLR7WD.js";
+import "./chunk-GOVGG7HU.js";
+import "./chunk-XWVHUDEK.js";
+import "./chunk-P22VFGFK.js";
 import "./chunk-X2X3IGZU.js";
 import "./chunk-XHU3KOKJ.js";
-import "./chunk-NVFNADTX.js";
-import "./chunk-BV2IET6B.js";
-import "./chunk-KILR4FBR.js";
-import "./chunk-IGJMS7C5.js";
-import "./chunk-VOVFUKEB.js";
-import "./chunk-ZAEUEDTN.js";
-import "./chunk-AJK2PVQW.js";
-import "./chunk-LR5O2XWZ.js";
-import "./chunk-YLFCH3VA.js";
-import "./chunk-DMUOTCDN.js";
-import "./chunk-6FIC57PH.js";
+import "./chunk-AIB2EWO2.js";
+import "./chunk-ZD6FZ3WL.js";
+import "./chunk-QXXEXGX3.js";
+import "./chunk-QUZYLDNJ.js";
+import "./chunk-FDWI3T6I.js";
+import "./chunk-E5CKRHIZ.js";
+import "./chunk-T4P2G3PO.js";
 import "./chunk-3FGBBJYM.js";
-import "./chunk-OBBO6EJR.js";
-import "./chunk-VF2KRROX.js";
-import "./chunk-KTKIFXIP.js";
-import "./chunk-NYLJQ2M2.js";
-import "./chunk-UXN4BICC.js";
-import "./chunk-PRDDPQLC.js";
-import "./chunk-LKTN22L6.js";
+import "./chunk-JQN3QGSF.js";
+import "./chunk-754P2UXM.js";
+import "./chunk-B7FDRN7G.js";
+import "./chunk-7NEBFB3L.js";
+import "./chunk-XMX5J52Z.js";
+import "./chunk-QLXEQRHD.js";
+import "./chunk-VIP4LKLO.js";
 import "./chunk-S2YTU74T.js";
-import "./chunk-EGOEB42T.js";
-import "./chunk-PWC3C5ME.js";
-import "./chunk-R5E7WNAC.js";
-import "./chunk-P4PIZOL2.js";
-import "./chunk-P3UX5EH4.js";
-import "./chunk-B7AMNZTC.js";
-import "./chunk-CM7N5MBY.js";
-import "./chunk-MROSARM5.js";
+import "./chunk-AP2C4OGS.js";
+import "./chunk-FNJTCJGY.js";
+import "./chunk-4ESNDGMB.js";
+import "./chunk-JWYIH5DR.js";
+import "./chunk-RWKAHHIX.js";
+import "./chunk-UKBPEEEQ.js";
+import "./chunk-7FZG7WP4.js";
+import "./chunk-5BJBTFFQ.js";
 import "./chunk-3OEVDGIY.js";
-import "./chunk-4YNA3CM6.js";
-import "./chunk-YLB365YX.js";
-import "./chunk-3OX34OC3.js";
+import "./chunk-SSFS4NCH.js";
+import "./chunk-M5XHN4OM.js";
+import "./chunk-CUDNRHHT.js";
 import "./chunk-VPHJ2LUI.js";
 import "./chunk-SNHYZYGZ.js";
 import "./chunk-KM6XSFHP.js";
+import "./chunk-ZPPPHVSU.js";
 import "./chunk-YQGMSXT5.js";
-import "./chunk-MC4IM2CC.js";
+import "./chunk-TYD4F4XU.js";
 import "./chunk-SSC7EKY2.js";
-import "./chunk-MPZ2AVNS.js";
-import "./chunk-AZSTIAVL.js";
+import "./chunk-ATNV3BVZ.js";
+import "./chunk-VBPYYJPC.js";
 import "./chunk-U4GMOT4M.js";
 import "./chunk-CBPNZFSU.js";
-import "./chunk-6YDY6ZTD.js";
+import "./chunk-XTCXGWTV.js";
 import "./chunk-MMRUBN3I.js";
 import "./chunk-2XZ6X3PJ.js";
 import "./chunk-PMVVUIHH.js";
-import "./chunk-7J2ZQ4XN.js";
-import "./chunk-EYMFVITZ.js";
-import "./chunk-BQEZPRUC.js";
-import "./chunk-GIRD7O5X.js";
-import "./chunk-KXYKSLW4.js";
-import "./chunk-VROK4X2L.js";
+import "./chunk-4VQ3QR6B.js";
+import "./chunk-Z7I6NQMA.js";
+import "./chunk-IZWMWJZT.js";
+import "./chunk-MCWEW2SG.js";
+import "./chunk-TU4M757W.js";
+import "./chunk-SJP57MQM.js";
 import "./chunk-NEHOQ3P2.js";
-import "./chunk-JA3Y5TV6.js";
-import "./chunk-HU3VD4MQ.js";
+import "./chunk-GDLB6BPM.js";
+import "./chunk-2Q2GGYBX.js";
 import "./chunk-NPXIS2RY.js";
 import "./chunk-SKTAZGFI.js";
 import "./chunk-X2Z5GT3V.js";
-import "./chunk-FMIYFHLE.js";
-import "./chunk-S26CV7BE.js";
+import "./chunk-E2PRXEZK.js";
+import "./chunk-YA5LK6KB.js";
 import "./chunk-EIOGV75A.js";
-import "./chunk-3SUPEE6H.js";
-import "./chunk-46VSBDUW.js";
+import "./chunk-RDMBSHGG.js";
+import "./chunk-3DCBDG4T.js";
 import "./chunk-Z6BZQHP5.js";
 import "./chunk-GUMRIUI5.js";
 import "./chunk-VGMACSEV.js";
-import "./chunk-NKEFYE4R.js";
+import "./chunk-IPTUKX3N.js";
 import "./chunk-3OX5S7KZ.js";
-import "./chunk-FEU6QEEL.js";
-import "./chunk-MWEIBVBS.js";
+import "./chunk-ZM6EZAVY.js";
+import "./chunk-IJCWBYA5.js";
 import "./chunk-QGGH7LOU.js";
-import "./chunk-ZPP63JSQ.js";
+import "./chunk-CL3AB7Z2.js";
 import "./chunk-TWMWHDOY.js";
-import "./chunk-4AR5XKCH.js";
-import "./chunk-3RGTLZNO.js";
-import "./chunk-M4XY4JRK.js";
+import "./chunk-CL2MU3OX.js";
+import "./chunk-4GAKF7KR.js";
 import "./chunk-VMHZSZQJ.js";
-import "./chunk-UOPCVFVR.js";
-import "./chunk-AWWDKF22.js";
+import "./chunk-O53LTOXK.js";
+import "./chunk-5RK75SWH.js";
+import "./chunk-SFWNTO2F.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-VHHX4UCP.js";
-import "./chunk-2FKU4ZEO.js";
-import "./chunk-P2UY34XE.js";
-import "./chunk-XDVOGDBC.js";
-import "./chunk-CYCIX7AW.js";
-import "./chunk-OAFENIHN.js";
-import "./chunk-F4BBMIPG.js";
-import "./chunk-MUCNYSJP.js";
+import "./chunk-MDTWARSF.js";
+import "./chunk-QDBKMEYY.js";
+import "./chunk-D4C57S2H.js";
+import "./chunk-KBBWALJV.js";
+import "./chunk-4FLLIQRQ.js";
+import "./chunk-RJ67XAJU.js";
+import "./chunk-B4XJQBQB.js";
+import "./chunk-NRLJOV7M.js";
 import "./chunk-5MOYSU5A.js";
-import "./chunk-ELEGH4DX.js";
+import "./chunk-ZUGQPYUY.js";
 import "./chunk-76CJBM36.js";
 import "./chunk-QLZ46RCK.js";
-import "./chunk-7UHZBVP3.js";
-import "./chunk-6BJCDWSM.js";
-import "./chunk-JDDM6C57.js";
+import "./chunk-QDVLVLXP.js";
+import "./chunk-ZB4FS2EG.js";
+import "./chunk-Z3LXWCB7.js";
+import "./chunk-3X74IQBU.js";
 import "./chunk-ZKGWHT56.js";
-import "./chunk-QNZ4562V.js";
 import "./chunk-WT4RI36X.js";
+import "./chunk-EIKATSE4.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-TDF2XKLK.js";
-import "./chunk-EIKATSE4.js";
 import "./chunk-MJCSEIFI.js";
-import "./chunk-ALRHGEAJ.js";
-import "./chunk-PUBA5B4M.js";
+import "./chunk-637FL62O.js";
+import "./chunk-6L4VIYLZ.js";
 import "./chunk-VI4ATC6I.js";
 import "./chunk-A27Q27CT.js";
-import "./chunk-LSNBTGW4.js";
+import "./chunk-DPYZW42H.js";
 import "./chunk-T5SM4RXY.js";
-import "./chunk-VJEJ7JNB.js";
-import "./chunk-L5EPGGDP.js";
+import "./chunk-N32DVIKY.js";
+import "./chunk-GWAN2BDB.js";
 import "./chunk-AM7S2TY6.js";
-import "./chunk-BPVFZ6Q4.js";
+import "./chunk-B5EGDNG6.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-ANVHWV2X.js";
 import "./chunk-HME6ITKV.js";
@@ -156,11 +157,11 @@ import "./chunk-NLEW62VC.js";
 import "./chunk-IMYGYIAI.js";
 import "./chunk-3DAEZILW.js";
 import "./chunk-DRTJCG6B.js";
-import "./chunk-UX2EO653.js";
+import "./chunk-ZZWFZ46U.js";
 import "./chunk-HYZV25LY.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-GL57PO3K.js";
-import "./chunk-P2VVMGMI.js";
+import "./chunk-V4WH3FV7.js";
 import "./chunk-ML4S5SHZ.js";
 import "./chunk-MP2AFCGL.js";
 import "./chunk-YRUZK2QA.js";
@@ -169,7 +170,7 @@ import {
   ensureSchema,
   getClient,
   initDatabase
-} from "./chunk-GL47M7NY.js";
+} from "./chunk-3UD3OF3X.js";
 import "./chunk-BBMTVAE3.js";
 import {
   assertValidDbPath
@@ -177,14 +178,16 @@ import {
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-LUA4SLJY.js";
+import "./chunk-5ONMHTNI.js";
+import "./chunk-RBQUXHYK.js";
 import "./chunk-YYB5PMTK.js";
-import "./chunk-L5CGXEZC.js";
+import "./chunk-WAAGVFFN.js";
 import "./chunk-QH5ZQ5SJ.js";
 import "./chunk-ZQEJ4IX2.js";
-import "./chunk-FXU7JOXK.js";
+import "./chunk-C7GHNJPW.js";
 import "./chunk-SO7KTH3Q.js";
-import "./chunk-WNBZJSQT.js";
+import "./chunk-3VW5ZP2F.js";
 import {
   exportMnemonic,
   getKeyStorageInfo,
@@ -192,13 +195,13 @@ import {
   importMnemonic,
   retireMasterKey,
   setMasterKey
-} from "./chunk-5U2IJBFV.js";
+} from "./chunk-TA3B4N24.js";
 import "./chunk-F55P3H4S.js";
 import "./chunk-B6TI3TZT.js";
 import "./chunk-FTZET5YX.js";
-import "./chunk-TNS63ATU.js";
+import "./chunk-FWRPDSO3.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-DZN7SDY2.js";
+import "./chunk-OSVTH3SG.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import {
@@ -769,6 +772,14 @@ async function acceptRotationWizard(argv) {
     await initStore({ lightweight: true });
     const result = await cloudSync({ apiKey: config.cloud.apiKey, endpoint: config.cloud.endpoint });
     await disposeStore();
+    if (result.pullIncomplete) {
+      console.error(`Cloud verification PARTIAL: remote memory history was not read to the end (${result.pullPartialReason ?? "unknown"}).`);
+      console.error("Refusing to accept the rotation on an unverified partial restore.");
+      console.error("Rolling back to the old key/local DB backup...");
+      await restoreOldState();
+      console.error("Rollback complete. The old key remains active on this machine. Re-run `exe-os key accept-rotation` once cloud sync can complete a full pull.");
+      return 1;
+    }
     console.log(`\u2713 Cloud verification succeeded: ${result.totalMemories.toLocaleString()} memories visible after sync`);
   } catch (err) {
     console.error(`Cloud verification failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/{exe-org-U4GLQ6OP.js → exe-org-SJXHLV6K.js}

@@ -31,8 +31,10 @@ Orchestration phase:
 
 AI Partner \u2014 joining an org (the member side):
   exe-os org join <invite-code>    Show the Org Key this install would pin
-  exe-os org join <invite-code> --confirm "<phrase>"
-                                   Redeem the invite and pin that exact Org Key
+  exe-os org join <invite-code> --confirm "<phrase>" --claim-passphrase "<passphrase>"
+                                   Redeem the invite and pin that exact Org Key. Both the phrase
+                                   and the claim passphrase are required \u2014 the invite code alone
+                                   does not claim a seat. Omit --claim-passphrase to be prompted.
   exe-os org unpin <org-id> --confirm "<phrase>"
                                    Discard a pinned Org Key (a key rotation is a security event)
 
@@ -84,9 +86,7 @@ function flag(argv, name) {
 function has(argv, name) {
   return argv.includes(`--${name}`);
 }
-async function promptSecret(prompt) {
-  const fromEnv = process.env.EXE_CONSENT_PASSPHRASE;
-  if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+async function readSecretLine(prompt) {
   const stdin = process.stdin;
   process.stderr.write(prompt);
   return await new Promise((resolve) => {
@@ -124,19 +124,27 @@ async function promptSecret(prompt) {
     stdin.on("data", onData);
   });
 }
+async function promptSecret(prompt) {
+  const fromEnv = process.env.EXE_CONSENT_PASSPHRASE;
+  if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+  return await readSecretLine(prompt);
+}
+async function promptClaimSecret(prompt) {
+  return await readSecretLine(prompt);
+}
 async function printOrgSection() {
-  const { resolveOrgPartnerBindings, resolvePartnerIdentities } = await import("./org-partner-config-OP4NEUNF.js");
+  const { resolveOrgPartnerBindings, resolvePartnerIdentities } = await import("./org-partner-config-3FXSYPQA.js");
   const bindings = resolveOrgPartnerBindings();
   if (!bindings.orgMode) {
     console.log("Org membership: none \u2014 this is a personal install. The AI Partner org surface is inactive.");
     console.log("");
     return;
   }
-  const { orgPartnerRuntimeStatus } = await import("./org-partner-runtime-YNVUNT2R.js");
-  const { getStandingPolicies } = await import("./org-consent-policy-VGELJ7K7.js");
-  const { listTaskRequests } = await import("./task-request-inbox-QBZVU66E.js");
+  const { orgPartnerRuntimeStatus } = await import("./org-partner-runtime-TH3LMPII.js");
+  const { getStandingPolicies } = await import("./org-consent-policy-KFUP7QPG.js");
+  const { listTaskRequests } = await import("./task-request-inbox-PKJCYKJV.js");
   const { getMailboxOutboxStatus, listFailureNotices } = await import("./mailbox-outbox-OY4IU6S4.js");
-  const { getMailboxInboxState } = await import("./mailbox-inbox-MTAT4MXX.js");
+  const { getMailboxInboxState } = await import("./mailbox-inbox-BPZP4GIZ.js");
   const runtime = orgPartnerRuntimeStatus();
   console.log("Org membership: ACTIVE (org mode is latched on this machine)");
   if (bindings.readError) {
@@ -186,9 +194,9 @@ async function printOrgSection() {
   if (runtime.defects.length > 0) console.log("");
 }
 async function runReport(argv) {
-  const { assertOrgPartnerRuntimeReady } = await import("./org-partner-runtime-YNVUNT2R.js");
-  const { draftOrgUpBrief, sendOpenDraft } = await import("./org-brief-session-3PQ22UIX.js");
-  const { resolveOrgPartnerBindings } = await import("./org-partner-config-OP4NEUNF.js");
+  const { assertOrgPartnerRuntimeReady } = await import("./org-partner-runtime-TH3LMPII.js");
+  const { draftOrgUpBrief, sendOpenDraft } = await import("./org-brief-session-LQ2DBYVF.js");
+  const { resolveOrgPartnerBindings } = await import("./org-partner-config-3FXSYPQA.js");
   assertOrgPartnerRuntimeReady();
   let orgId = flag(argv, "org");
   if (!orgId) {
@@ -263,10 +271,10 @@ async function runReport(argv) {
   return 0;
 }
 async function runRequests(argv) {
-  const { assertOrgPartnerRuntimeReady } = await import("./org-partner-runtime-YNVUNT2R.js");
-  const { requireOrgPartnerBinding, resolveOrgPartnerBindings, resolvePartnerIdentities } = await import("./org-partner-config-OP4NEUNF.js");
-  const { listTaskRequests, getTaskRequest, acceptTaskRequest, declineTaskRequest } = await import("./task-request-inbox-QBZVU66E.js");
-  const { decideRequestManually } = await import("./org-consent-policy-VGELJ7K7.js");
+  const { assertOrgPartnerRuntimeReady } = await import("./org-partner-runtime-TH3LMPII.js");
+  const { requireOrgPartnerBinding, resolveOrgPartnerBindings, resolvePartnerIdentities } = await import("./org-partner-config-3FXSYPQA.js");
+  const { listTaskRequests, getTaskRequest, acceptTaskRequest, declineTaskRequest } = await import("./task-request-inbox-PKJCYKJV.js");
+  const { decideRequestManually } = await import("./org-consent-policy-KFUP7QPG.js");
   assertOrgPartnerRuntimeReady();
   let orgId = flag(argv, "org");
   if (!orgId) {
@@ -345,8 +353,8 @@ async function runRequests(argv) {
   return 0;
 }
 async function runConsent(argv) {
-  const { resolveOrgPartnerBindings } = await import("./org-partner-config-OP4NEUNF.js");
-  const { setConsentPassphrase, clearConsentPassphrase, consentPassphraseIsSet, MIN_CONSENT_PASSPHRASE_LENGTH } = await import("./consent-passphrase-5ZBDJ5G7.js");
+  const { resolveOrgPartnerBindings } = await import("./org-partner-config-3FXSYPQA.js");
+  const { setConsentPassphrase, clearConsentPassphrase, consentPassphraseIsSet, MIN_CONSENT_PASSPHRASE_LENGTH } = await import("./consent-passphrase-65W3DJIJ.js");
   const sub = argv[0];
   let orgId = flag(argv, "org");
   if (!orgId) {
@@ -401,12 +409,10 @@ async function runJoin(argv) {
     console.error('exe-os org join <invite-code> [--confirm "<phrase>"]');
     return 1;
   }
-  const { fetchInviteOffer, completeOrgJoin, orgKeyPinConfirmation } = await import("./org-join-6TO5ZYUZ.js");
-  const { readOrgKeyPin, orgKeyUnpinConfirmation } = await import("./org-key-pin-TTTYGTQL.js");
-  const { resolvePartnerIdentities } = await import("./org-partner-config-OP4NEUNF.js");
-  const offer = await fetchInviteOffer(code, {
-    ...flag(argv, "endpoint") ? { endpoint: flag(argv, "endpoint") } : {}
-  });
+  const { fetchInviteOffer, completeOrgJoin, orgKeyPinConfirmation } = await import("./org-join-MXZCIQWX.js");
+  const { readOrgKeyPin, orgKeyUnpinConfirmation } = await import("./org-key-pin-ZOX4OM3O.js");
+  const { resolvePartnerIdentities } = await import("./org-partner-config-3FXSYPQA.js");
+  const offer = await fetchInviteOffer(code, {});
   console.log(`Invite for org ${offer.orgId}${offer.orgName ? ` (${offer.orgName})` : ""}`);
   console.log("");
   console.log("You are about to PIN this organization's Org Key on this machine.");
@@ -446,17 +452,26 @@ async function runJoin(argv) {
   if (supplied !== phrase) {
     console.log("Compare that fingerprint with your org over a channel the relay does not control.");
     console.log("");
-    console.log("Then re-run with the exact phrase:");
-    console.log(`  exe-os org join ${code} --confirm "${phrase}"`);
+    console.log("You will also need the claim passphrase your org gave you alongside the invite code");
+    console.log("(a SEPARATE value from this fingerprint) \u2014 the invite code alone does not claim a");
+    console.log("seat, for a member seat or an admin seat.");
+    console.log("");
+    console.log("Then re-run with the exact phrase and --claim-passphrase:");
+    console.log(`  exe-os org join ${code} --confirm "${phrase}" --claim-passphrase "<passphrase>"`);
     console.log("");
     console.log("Nothing was pinned and nothing was joined.");
     return 1;
   }
+  const claimPassphrase = flag(argv, "claim-passphrase") ?? await promptClaimSecret("Claim passphrase: ");
+  if (!claimPassphrase) {
+    console.error("A claim passphrase is required. The invite code alone does not claim a seat.");
+    return 1;
+  }
   const result = await completeOrgJoin({
     code,
     offer,
     confirmation: supplied,
-    ...flag(argv, "endpoint") ? { endpoint: flag(argv, "endpoint") } : {}
+    claimPassphrase
   });
   console.log(
     result.pinCreated ? `Pinned ${result.pin.org_key_sign_fp.slice(0, 16)} as the Org Key for ${result.offer.orgId}.` : `That identity was already pinned for ${result.offer.orgId} \u2014 re-joined, nothing re-pinned.`
@@ -484,10 +499,9 @@ async function runCreate(argv) {
     console.error("before it is sent and refused by the database if it ever arrives uncanonical.");
     return 1;
   }
-  const { createOrg } = await import("./org-key-admin-XHYVRRAZ.js");
+  const { createOrg } = await import("./org-key-admin-4UK6QUT7.js");
   const created = await createOrg({
-    orgId,
-    ...flag(argv, "endpoint") ? { endpoint: flag(argv, "endpoint") } : {}
+    orgId
   });
   console.log(`Created ${created.orgId}. You are its first admin.`);
   console.log("");
@@ -520,10 +534,9 @@ async function runPublishKey(argv) {
     console.error("without publishing again.");
     return 1;
   }
-  const { publishOrgKey, readMyPinnedOrgKey, describeRotation } = await import("./org-key-admin-XHYVRRAZ.js");
-  const transport = flag(argv, "endpoint") ? { endpoint: flag(argv, "endpoint") } : {};
-  const existing = await readMyPinnedOrgKey({ orgId, ...transport });
-  const { resolvePartnerIdentities } = await import("./org-partner-config-OP4NEUNF.js");
+  const { publishOrgKey, readMyPinnedOrgKey, describeRotation } = await import("./org-key-admin-4UK6QUT7.js");
+  const existing = await readMyPinnedOrgKey({ orgId });
+  const { resolvePartnerIdentities } = await import("./org-partner-config-3FXSYPQA.js");
   const mine = await resolvePartnerIdentities(orgId);
   const myFp = mine.sign.fingerprint.toString("hex").slice(0, 16);
   if (existing && existing.fingerprint !== myFp && !has(argv, "rotate")) {
@@ -533,7 +546,7 @@ async function runPublishKey(argv) {
     console.error(`  exe-os org publish-key --org ${orgId} --mailbox ${mailboxId} --rotate`);
     return 1;
   }
-  const published = await publishOrgKey({ orgId, mailboxId, ...transport });
+  const published = await publishOrgKey({ orgId, mailboxId });
   if (published.rotated && published.previousFingerprint) {
     console.log(describeRotation(orgId, published.previousFingerprint, published.fingerprint));
     console.log("");
@@ -576,12 +589,11 @@ async function runInvite(argv) {
     console.error("directory entry. Try `engineer.03` or `support.lead`.");
     return 1;
   }
-  const { issueSeatInvite } = await import("./org-key-admin-XHYVRRAZ.js");
+  const { issueSeatInvite } = await import("./org-key-admin-4UK6QUT7.js");
   const invite = await issueSeatInvite({
     orgId,
     seatRef,
-    ...has(argv, "admin") ? { isAdmin: true } : {},
-    ...flag(argv, "endpoint") ? { endpoint: flag(argv, "endpoint") } : {}
+    ...has(argv, "admin") ? { isAdmin: true } : {}
   });
   const { adminInviteDisclosureText } = await import("./seat-benefit-VDQJYJOB.js");
   console.log(adminInviteDisclosureText({
@@ -594,26 +606,39 @@ async function runInvite(argv) {
   console.log("");
   console.log(`Invite for seat "${invite.seatRef}" in ${invite.orgId}${invite.isAdmin ? " (ORG ADMIN)" : ""}.`);
   console.log("");
-  console.log("  \u2500\u2500 SHOWN ONCE. Only its hash is stored; this is the only copy. \u2500\u2500");
+  console.log("  \u2500\u2500 SHOWN ONCE. Only their hashes are stored; this is the only copy. \u2500\u2500");
   console.log("");
   console.log(`  invite code          ${invite.inviteToken}`);
+  console.log(`  claim passphrase     ${invite.claimPassphrase}`);
   console.log(`  Org Key fingerprint  ${invite.fingerprint}`);
   console.log(`  expires              ${invite.expiresAt}`);
   console.log("");
-  console.log("SEND BOTH. The joiner must present that fingerprint when they redeem, and the");
-  console.log("database refuses the join if it disagrees \u2014 so an invite code alone is useless to");
-  console.log("whoever it leaks to, and a substituted key is a hard refusal rather than a silent");
-  console.log("re-point.");
+  console.log("THREE VALUES, AND THE FIRST TWO ARE NOT INTERCHANGEABLE WITH THE THIRD. The invite");
+  console.log("code and the claim passphrase are BOTH required to claim this seat \u2014 an invite code");
+  console.log("by itself claims nothing, for this seat or any seat, admin included.");
+  console.log("");
+  console.log("That was not always true, and it is worth being precise about why: the Org Key");
+  console.log("fingerprint looks like a second factor, but it is SHA-256(org_key_sign_pub), and the");
+  console.log("join server hands org_key_sign_pub back to anyone who merely presents the invite code");
+  console.log("(the non-consuming preview). Holding only the code was always enough to compute the");
+  console.log("fingerprint. The claim passphrase is the thing that actually gates redemption: it is");
+  console.log("checked entirely server-side, it is never returned by the preview, and there is");
+  console.log("nothing a joiner's Partner can compute to produce it.");
   console.log("");
-  console.log("Send the fingerprint over a channel that is NOT the one carrying the code, and");
-  console.log("ideally not one this relay controls. Reading it aloud is best: an attacker who has");
-  console.log("both channels defeats this, and one who has only the code defeats nothing.");
+  console.log("SEND THE CODE AND THE PASSPHRASE OVER DIFFERENT CHANNELS FROM EACH OTHER. The same");
+  console.log("message carrying both is one secret wearing two labels. Send the Org Key fingerprint");
+  console.log("out of band too, for its own, separate reason: it protects the JOINER from being");
+  console.log("pointed at a substituted Org Key, and a substituted key is a hard refusal at redeem");
+  console.log("rather than a silent re-point \u2014 but that protection has nothing to do with keeping");
+  console.log("this invite from being claimed by whoever it leaks to. Keep invite code and claim");
+  console.log("passphrase as secret as the seat they jointly grant.");
   console.log("");
   console.log("What they run \u2014 or say to their Partner:");
   console.log(`  exe-os org join ${invite.inviteToken}`);
-  console.log("  \u2026then re-run with the --confirm phrase it prints.");
+  console.log("  \u2026then re-run with the --confirm phrase it prints AND --claim-passphrase.");
   console.log("");
-  console.log("Single use. It expires in 24 hours. If it is not redeemed, issue another.");
+  console.log("Single use. Both expire in 24 hours. If they are not redeemed, issue another invite \u2014");
+  console.log("a fresh code always comes with a fresh passphrase.");
   return 0;
 }
 async function runUnpin(argv) {
@@ -622,7 +647,7 @@ async function runUnpin(argv) {
     console.error('exe-os org unpin <org-id> --confirm "<phrase>"');
     return 1;
   }
-  const { readOrgKeyPin, unpinOrgKey, orgKeyUnpinConfirmation } = await import("./org-key-pin-TTTYGTQL.js");
+  const { readOrgKeyPin, unpinOrgKey, orgKeyUnpinConfirmation } = await import("./org-key-pin-ZOX4OM3O.js");
   const pin = readOrgKeyPin(orgId);
   if (!pin) {
     console.error(`No pinned Org Key for org "${orgId}".`);
@@ -646,7 +671,7 @@ async function runUnpin(argv) {
   return 0;
 }
 async function runLeave(argv) {
-  const { clearOrgModeSticky, ORG_MODE_CLEAR_CONFIRMATION, orgMembershipPresent } = await import("./org-membership-Y7T2BS57.js");
+  const { clearOrgModeSticky, ORG_MODE_CLEAR_CONFIRMATION, orgMembershipPresent } = await import("./org-membership-D5TPN45F.js");
   if (!orgMembershipPresent()) {
     console.log("This install is not an org member \u2014 nothing to leave.");
     return 0;