@codemem/core 0.39.0 → 0.40.0-alpha.1

package/dist/{coordinator-api-hZ1RVJUN.js → coordinator-api-Btb6CEhw.js}

@@ -1,13 +1,305 @@
 import { createHash as e } from "node:crypto";
+//#region src/coordinator-membership-effects.ts
+var t = "scope_membership_effect_conflict", n = {
+	device_not_enrolled: "device must be enrolled and enabled in the scope group.",
+	scope_group_mismatch: "membership groupId must match the scope groupId.",
+	scope_inactive: "scope is not active.",
+	scope_not_found: "scopeId must reference an existing scope."
+}, r = class extends Error {
+	code;
+	constructor(e) {
+		super(n[e]), this.name = "CoordinatorMembershipError", this.code = e;
+	}
+};
+function i(e) {
+	return e?.trim() || null;
+}
+function a(e) {
+	let t = i(e);
+	if (!t) throw Error("effectId is required.");
+	if (t.length > 512 || /[\p{Cc}\p{Cf}]/u.test(t)) throw Error("effectId is invalid.");
+	return t;
+}
+function o(e) {
+	return JSON.stringify({
+		scopeId: i(e.scopeId),
+		deviceId: i(e.deviceId),
+		role: i(e.role),
+		membershipEpoch: e.membershipEpoch ?? null,
+		coordinatorId: i(e.coordinatorId),
+		groupId: i(e.groupId),
+		manifestIssuerDeviceId: i(e.manifestIssuerDeviceId),
+		manifestHash: i(e.manifestHash),
+		signedManifestJson: i(e.signedManifestJson),
+		actorType: i(e.actorType),
+		actorId: i(e.actorId)
+	});
+}
+function s(e) {
+	return JSON.stringify({
+		scopeId: i(e.scopeId),
+		deviceId: i(e.deviceId),
+		groupId: i(e.groupId),
+		membershipEpoch: e.membershipEpoch ?? null,
+		manifestHash: i(e.manifestHash),
+		signedManifestJson: i(e.signedManifestJson),
+		actorType: i(e.actorType),
+		actorId: i(e.actorId)
+	});
+}
+function c(e, n, r) {
+	if (e.action !== n || e.request_json !== r) throw Error(t);
+}
+function l(e) {
+	if (e.action !== "grant" || e.outcome_applied !== 1 || e.role == null || e.status == null || e.membership_epoch == null || e.updated_at == null) throw Error("scope_membership_effect_receipt_invalid");
+	return {
+		scope_id: e.scope_id,
+		device_id: e.device_id,
+		role: e.role,
+		status: e.status,
+		membership_epoch: e.membership_epoch,
+		coordinator_id: e.coordinator_id,
+		group_id: e.group_id,
+		manifest_issuer_device_id: e.manifest_issuer_device_id,
+		manifest_hash: e.manifest_hash,
+		signed_manifest_json: e.signed_manifest_json,
+		updated_at: e.updated_at
+	};
+}
+//#endregion
 //#region src/coordinator-store-contract.ts
-function t(e) {
+function u(e) {
 	let t = e.trim(), n = new Date(t);
 	if (!t || Number.isNaN(n.getTime())) throw Error("expiresAt must be a valid date.");
 	return n.toISOString();
 }
+var d = /^identity:[A-Za-z0-9_-]{18,24}$/u;
+function f(e) {
+	return typeof e == "string" && e === e.trim() && d.test(e);
+}
+function p(e) {
+	return String(e.kind === "team_member" ? e.assigned_identity_id ?? "" : e.target_identity_id ?? "").trim();
+}
+//#endregion
+//#region src/project-invite-identity.ts
+var m = 120;
+function h(e, t) {
+	if ([...e].some((e) => /[\p{Cc}\p{Cf}]/u.test(e))) throw Error(`${t}_invalid`);
+	let n = e.replace(/\s+/gu, " ").trim();
+	if (!n) throw Error(`${t}_required`);
+	if ([...n].length > m) throw Error(`${t}_too_long`);
+	return n;
+}
+function g(e) {
+	let t = String(e ?? "").replace(/\.local$/iu, "");
+	return t.trim() ? h(t.replace(/[-_]+/gu, " "), "device_display_name") : null;
+}
+function _(e) {
+	for (let t of [
+		e.explicitName,
+		e.osName,
+		e.coordinatorName
+	]) {
+		let e = g(t);
+		if (e) return e;
+	}
+	let t = String(e.fallbackSeed ?? "").replace(/[^a-z0-9]/giu, "").slice(0, 6);
+	return t ? `Codemem device ${t}` : "Codemem device";
+}
+function v(e) {
+	if (!Array.isArray(e) || e.length === 0 || e.length > 100) throw Error("project_summaries_invalid");
+	return e.map((e) => {
+		if (!e || typeof e != "object" || Array.isArray(e)) throw Error("project_summaries_invalid");
+		let t = e;
+		if (!Number.isSafeInteger(t.existing_memory_count) || Number(t.existing_memory_count) < 0) throw Error("project_summaries_invalid");
+		return {
+			display_name: h(String(t.display_name ?? ""), "project_name"),
+			existing_memory_count: Number(t.existing_memory_count)
+		};
+	});
+}
+//#endregion
+//#region src/recipient-reviewed-intent.ts
+var y = 1, b = class extends Error {
+	code;
+	constructor(e) {
+		super(e), this.name = "RecipientReviewedIntentError", this.code = e;
+	}
+}, x = /[\p{Cc}\p{Cf}]/u, S = 100, C = 64 * 1024;
+function w() {
+	throw new b("recipient_reviewed_intent_invalid");
+}
+function T(e) {
+	return (!e || typeof e != "object" || Array.isArray(e)) && w(), e;
+}
+function E(e, t) {
+	Object.keys(e).some((e) => !t.includes(e)) && w();
+}
+function D(e, t) {
+	return (typeof e != "string" || !e || e !== e.trim() || e.length > t || x.test(e)) && w(), e;
+}
+function O(e) {
+	(typeof e != "string" || x.test(e)) && w();
+	let t = e.trim().replace(/\s+/gu, " ");
+	return (!t || t.length > 256) && w(), t;
+}
+function k(e) {
+	typeof e != "string" && w();
+	try {
+		return h(e, "identity_display_name");
+	} catch {
+		return w();
+	}
+}
+function A(e) {
+	return (typeof e != "number" || !Number.isSafeInteger(e) || e < 0) && w(), e;
+}
+function j(e, t) {
+	return e < t ? -1 : +(e > t);
+}
+function ee(e) {
+	return e.kind === "direct" ? "direct" : `team\u0000${e.teamId}`;
+}
+function te(e) {
+	let t = T(e);
+	return t.kind === "direct" ? (E(t, ["kind"]), { kind: "direct" }) : (t.kind !== "team" && w(), E(t, [
+		"kind",
+		"teamId",
+		"displayName"
+	]), {
+		kind: "team",
+		teamId: D(t.teamId, 256),
+		displayName: O(t.displayName)
+	});
+}
+function ne(e) {
+	let t = T(e);
+	E(t, [
+		"canonicalProjectIdentity",
+		"displayName",
+		"existingMemoryCount",
+		"futureMemoriesShared",
+		"sources"
+	]), (t.futureMemoriesShared !== !0 || !Array.isArray(t.sources) || !t.sources.length) && w();
+	let n = t.sources.map(te).toSorted((e, t) => j(ee(e), ee(t)));
+	return new Set(n.map(ee)).size !== n.length && w(), {
+		canonicalProjectIdentity: D(t.canonicalProjectIdentity, 512),
+		displayName: O(t.displayName),
+		existingMemoryCount: A(t.existingMemoryCount),
+		futureMemoriesShared: !0,
+		sources: n
+	};
+}
+function re(e) {
+	let t = T(e);
+	return E(t, [
+		"canonicalProjectIdentity",
+		"displayName",
+		"existingMemoryCount"
+	]), {
+		canonicalProjectIdentity: D(t.canonicalProjectIdentity, 512),
+		displayName: O(t.displayName),
+		existingMemoryCount: A(t.existingMemoryCount)
+	};
+}
+function ie(e) {
+	(!Array.isArray(e.projects) || !Array.isArray(e.excludedProjects) || e.projects.length > S) && w();
+	let t = e.projects.map(ne).toSorted((e, t) => j(e.canonicalProjectIdentity, t.canonicalProjectIdentity)), n = e.excludedProjects.map(re).toSorted((e, t) => j(e.canonicalProjectIdentity, t.canonicalProjectIdentity)), r = t.map((e) => e.canonicalProjectIdentity), i = n.map((e) => e.canonicalProjectIdentity);
+	return (new Set(r).size !== r.length || new Set(i).size !== i.length || i.some((e) => r.includes(e))) && w(), {
+		projects: t,
+		excludedProjects: n
+	};
+}
+function ae(e, t) {
+	if (!(e.journey === "team" && t.kind === "team_member" && e.team.teamId === t.policyTeamId || e.journey === "add_device" && t.kind === "add_device" && e.targetIdentity.identityId === t.targetIdentityId)) throw new b("recipient_invite_intent_mismatch");
+}
+function M(e, t) {
+	let n = T(e);
+	n.version !== 1 && w();
+	let r = ie(n), i;
+	if (n.journey === "team") {
+		E(n, [
+			"version",
+			"journey",
+			"team",
+			"projects",
+			"excludedProjects"
+		]);
+		let e = T(n.team);
+		E(e, [
+			"teamId",
+			"displayName",
+			"futureProjectsInherit"
+		]), e.futureProjectsInherit !== !0 && w(), i = {
+			version: 1,
+			journey: "team",
+			team: {
+				teamId: D(e.teamId, 256),
+				displayName: O(e.displayName),
+				futureProjectsInherit: !0
+			},
+			...r
+		};
+	} else if (n.journey === "add_device") {
+		E(n, [
+			"version",
+			"journey",
+			"targetIdentity",
+			"projects",
+			"excludedProjects"
+		]);
+		let e = T(n.targetIdentity);
+		E(e, ["identityId", "displayName"]), i = {
+			version: 1,
+			journey: "add_device",
+			targetIdentity: {
+				identityId: D(e.identityId, 256),
+				displayName: k(e.displayName)
+			},
+			...r
+		};
+	} else w();
+	return t && ae(i, t), new TextEncoder().encode(N(i)).byteLength > C && w(), i;
+}
+function N(e) {
+	return Array.isArray(e) ? `[${e.map(N).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).toSorted(([e], [t]) => j(e, t)).map(([e, t]) => `${JSON.stringify(e)}:${N(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
+}
+function oe(e, t) {
+	return N(M(e, t));
+}
+async function se(e, t) {
+	let n = oe(e, t), r = new TextEncoder().encode(`recipient-reviewed-intent-v1\n${n}`), i = await globalThis.crypto.subtle.digest("SHA-256", r);
+	return Array.from(new Uint8Array(i), (e) => e.toString(16).padStart(2, "0")).join("");
+}
+async function P(e, t) {
+	let n = M(e, t.target);
+	if (await se(n) !== t.digest) throw new b("recipient_invite_intent_mismatch");
+	return n;
+}
+async function ce(e, t) {
+	if (!e) throw Error("recipient_invite_review_unavailable");
+	let n;
+	try {
+		n = JSON.parse(e);
+	} catch {
+		throw Error("recipient_invite_review_unavailable");
+	}
+	try {
+		let r = M(n, t.target);
+		if (N(r) !== e) throw Error("recipient_invite_review_unavailable");
+		return await P(r, t);
+	} catch (e) {
+		throw e instanceof b && e.code === "recipient_invite_intent_mismatch" || e instanceof Error && e.message === "recipient_invite_review_unavailable" ? e : Error("recipient_invite_review_unavailable");
+	}
+}
+//#endregion
+//#region src/sync-fingerprint.ts
+function F(t) {
+	return e("sha256").update(t, "utf-8").digest("hex");
+}
 //#endregion
 //#region ../../node_modules/.pnpm/hono@4.12.26/node_modules/hono/dist/compose.js
-var n = (e, t, n) => (r, i) => {
+var le = (e, t, n) => (r, i) => {
 	let a = -1;
 	return o(0);
 	async function o(s) {
@@ -23,40 +315,40 @@ var n = (e, t, n) => (r, i) => {
 		else r.finalized === !1 && n && (c = await n(r));
 		return c && (r.finalized === !1 || l) && (r.res = c), r;
 	}
-}, r = /* @__PURE__ */ Symbol(), i = async (e, t = /* @__PURE__ */ Object.create(null)) => {
-	let { all: n = !1, dot: r = !1 } = t, i = (e instanceof E ? e.raw.headers : e.headers).get("Content-Type");
-	return i?.startsWith("multipart/form-data") || i?.startsWith("application/x-www-form-urlencoded") ? a(e, {
+}, ue = /* @__PURE__ */ Symbol(), de = async (e, t = /* @__PURE__ */ Object.create(null)) => {
+	let { all: n = !1, dot: r = !1 } = t, i = (e instanceof je ? e.raw.headers : e.headers).get("Content-Type");
+	return i?.startsWith("multipart/form-data") || i?.startsWith("application/x-www-form-urlencoded") ? fe(e, {
 		all: n,
 		dot: r
 	}) : {};
 };
-async function a(e, t) {
+async function fe(e, t) {
 	let n = await e.formData();
-	return n ? o(n, t) : {};
+	return n ? pe(n, t) : {};
 }
-function o(e, t) {
+function pe(e, t) {
 	let n = /* @__PURE__ */ Object.create(null);
 	return e.forEach((e, r) => {
-		t.all || r.endsWith("[]") ? s(n, r, e) : n[r] = e;
+		t.all || r.endsWith("[]") ? me(n, r, e) : n[r] = e;
 	}), t.dot && Object.entries(n).forEach(([e, t]) => {
-		e.includes(".") && (c(n, e, t), delete n[e]);
+		e.includes(".") && (he(n, e, t), delete n[e]);
 	}), n;
 }
-var s = (e, t, n) => {
+var me = (e, t, n) => {
 	e[t] === void 0 ? t.endsWith("[]") ? e[t] = [n] : e[t] = n : Array.isArray(e[t]) ? e[t].push(n) : e[t] = [e[t], n];
-}, c = (e, t, n) => {
+}, he = (e, t, n) => {
 	if (/(?:^|\.)__proto__\./.test(t)) return;
 	let r = e, i = t.split(".");
 	i.forEach((e, t) => {
 		t === i.length - 1 ? r[e] = n : ((!r[e] || typeof r[e] != "object" || Array.isArray(r[e]) || r[e] instanceof File) && (r[e] = /* @__PURE__ */ Object.create(null)), r = r[e]);
 	});
-}, l = (e) => {
+}, ge = (e) => {
 	let t = e.split("/");
 	return t[0] === "" && t.shift(), t;
-}, u = (e) => {
-	let { groups: t, path: n } = d(e);
-	return f(l(n), t);
-}, d = (e) => {
+}, _e = (e) => {
+	let { groups: t, path: n } = ve(e);
+	return ye(ge(n), t);
+}, ve = (e) => {
 	let t = [];
 	return e = e.replace(/\{[^}]+\}/g, (e, n) => {
 		let r = `@${n}`;
@@ -65,7 +357,7 @@ var s = (e, t, n) => {
 		groups: t,
 		path: e
 	};
-}, f = (e, t) => {
+}, ye = (e, t) => {
 	for (let n = t.length - 1; n >= 0; n--) {
 		let [r] = t[n];
 		for (let i = e.length - 1; i >= 0; i--) if (e[i].includes(r)) {
@@ -74,12 +366,12 @@ var s = (e, t, n) => {
 		}
 	}
 	return e;
-}, p = {}, m = (e, t) => {
+}, I = {}, be = (e, t) => {
 	if (e === "*") return "*";
 	let n = e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
 	if (n) {
 		let r = `${e}#${t}`;
-		return p[r] || (n[2] ? p[r] = t && t[0] !== ":" && t[0] !== "*" ? [
+		return I[r] || (n[2] ? I[r] = t && t[0] !== ":" && t[0] !== "*" ? [
 			r,
 			n[1],
 			RegExp(`^${n[2]}(?=/${t})`)
@@ -87,14 +379,14 @@ var s = (e, t, n) => {
 			e,
 			n[1],
 			RegExp(`^${n[2]}$`)
-		] : p[r] = [
+		] : I[r] = [
 			e,
 			n[1],
 			!0
-		]), p[r];
+		]), I[r];
 	}
 	return null;
-}, h = (e, t) => {
+}, L = (e, t) => {
 	try {
 		return t(e);
 	} catch {
@@ -106,20 +398,20 @@ var s = (e, t, n) => {
 			}
 		});
 	}
-}, g = (e) => h(e, decodeURI), _ = (e) => {
+}, xe = (e) => L(e, decodeURI), Se = (e) => {
 	let t = e.url, n = t.indexOf("/", t.indexOf(":") + 4), r = n;
 	for (; r < t.length; r++) {
 		let e = t.charCodeAt(r);
 		if (e === 37) {
 			let e = t.indexOf("?", r), i = t.indexOf("#", r), a = e === -1 ? i === -1 ? void 0 : i : i === -1 ? e : Math.min(e, i), o = t.slice(n, a);
-			return g(o.includes("%25") ? o.replace(/%25/g, "%2525") : o);
+			return xe(o.includes("%25") ? o.replace(/%25/g, "%2525") : o);
 		} else if (e === 63 || e === 35) break;
 	}
 	return t.slice(n, r);
-}, v = (e) => {
-	let t = _(e);
+}, Ce = (e) => {
+	let t = Se(e);
 	return t.length > 1 && t.at(-1) === "/" ? t.slice(0, -1) : t;
-}, y = (e, t, ...n) => (n.length && (t = y(t, ...n)), `${e?.[0] === "/" ? "" : "/"}${e}${t === "/" ? "" : `${e?.at(-1) === "/" ? "" : "/"}${t?.[0] === "/" ? t.slice(1) : t}`}`), b = (e) => {
+}, R = (e, t, ...n) => (n.length && (t = R(t, ...n)), `${e?.[0] === "/" ? "" : "/"}${e}${t === "/" ? "" : `${e?.at(-1) === "/" ? "" : "/"}${t?.[0] === "/" ? t.slice(1) : t}`}`), we = (e) => {
 	if (e.charCodeAt(e.length - 1) !== 63 || !e.includes(":")) return null;
 	let t = e.split("/"), n = [], r = "";
 	return t.forEach((e) => {
@@ -130,7 +422,7 @@ var s = (e, t, n) => {
 			r += "/" + t, n.push(r);
 		} else r += "/" + e;
 	}), n.filter((e, t, n) => n.indexOf(e) === t);
-}, x = (e) => /[%+]/.test(e) ? (e.indexOf("+") !== -1 && (e = e.replace(/\+/g, " ")), e.indexOf("%") === -1 ? e : h(e, w)) : e, S = (e, t, n) => {
+}, Te = (e) => /[%+]/.test(e) ? (e.indexOf("+") !== -1 && (e = e.replace(/\+/g, " ")), e.indexOf("%") === -1 ? e : L(e, ke)) : e, Ee = (e, t, n) => {
 	let r;
 	if (!n && t && !/[%+]/.test(t)) {
 		let n = e.indexOf("?", 8);
@@ -139,7 +431,7 @@ var s = (e, t, n) => {
 			let r = e.charCodeAt(n + t.length + 1);
 			if (r === 61) {
 				let r = n + t.length + 2, i = e.indexOf("&", r);
-				return x(e.slice(r, i === -1 ? void 0 : i));
+				return Te(e.slice(r, i === -1 ? void 0 : i));
 			} else if (r == 38 || isNaN(r)) return "";
 			n = e.indexOf(`&${t}`, n + 1);
 		}
@@ -152,12 +444,12 @@ var s = (e, t, n) => {
 		let t = e.indexOf("&", a + 1), o = e.indexOf("=", a);
 		o > t && t !== -1 && (o = -1);
 		let s = e.slice(a + 1, o === -1 ? t === -1 ? void 0 : t : o);
-		if (r && (s = x(s)), a = t, s === "") continue;
+		if (r && (s = Te(s)), a = t, s === "") continue;
 		let c;
-		o === -1 ? c = "" : (c = e.slice(o + 1, t === -1 ? void 0 : t), r && (c = x(c))), n ? (i[s] && Array.isArray(i[s]) || (i[s] = []), i[s].push(c)) : i[s] ??= c;
+		o === -1 ? c = "" : (c = e.slice(o + 1, t === -1 ? void 0 : t), r && (c = Te(c))), n ? (i[s] && Array.isArray(i[s]) || (i[s] = []), i[s].push(c)) : i[s] ??= c;
 	}
 	return t ? i[t] : i;
-}, C = S, ee = (e, t) => S(e, t, !0), w = decodeURIComponent, T = (e) => h(e, w), E = class {
+}, De = Ee, Oe = (e, t) => Ee(e, t, !0), ke = decodeURIComponent, Ae = (e) => L(e, ke), je = class {
 	raw;
 	#e;
 	#t;
@@ -172,13 +464,13 @@ var s = (e, t, n) => {
 	}
 	#n(e) {
 		let t = this.#t[0][this.routeIndex][1][e], n = this.#i(t);
-		return n && /\%/.test(n) ? T(n) : n;
+		return n && /\%/.test(n) ? Ae(n) : n;
 	}
 	#r() {
 		let e = {}, t = Object.keys(this.#t[0][this.routeIndex][1]);
 		for (let n of t) {
 			let t = this.#i(this.#t[0][this.routeIndex][1][n]);
-			t !== void 0 && (e[n] = /\%/.test(t) ? T(t) : t);
+			t !== void 0 && (e[n] = /\%/.test(t) ? Ae(t) : t);
 		}
 		return e;
 	}
@@ -186,10 +478,10 @@ var s = (e, t, n) => {
 		return this.#t[1] ? this.#t[1][e] : e;
 	}
 	query(e) {
-		return C(this.url, e);
+		return De(this.url, e);
 	}
 	queries(e) {
-		return ee(this.url, e);
+		return Oe(this.url, e);
 	}
 	header(e) {
 		if (e) return this.raw.headers.get(e) ?? void 0;
@@ -199,7 +491,7 @@ var s = (e, t, n) => {
 		}), t;
 	}
 	async parseBody(e) {
-		return i(this, e);
+		return de(this, e);
 	}
 	#a = (e) => {
 		let { bodyCache: t, raw: n } = this, r = t[e];
@@ -237,7 +529,7 @@ var s = (e, t, n) => {
 	get method() {
 		return this.raw.method;
 	}
-	get [r]() {
+	get [ue]() {
 		return this.#t;
 	}
 	get matchedRoutes() {
@@ -246,14 +538,14 @@ var s = (e, t, n) => {
 	get routePath() {
 		return this.#t[0].map(([[, e]]) => e)[this.routeIndex].path;
 	}
-}, te = {
+}, Me = {
 	Stringify: 1,
 	BeforeStream: 2,
 	Stream: 3
-}, ne = (e, t) => {
+}, Ne = (e, t) => {
 	let n = new String(e);
 	return n.isEscaped = !0, n.callbacks = t, n;
-}, D = async (e, t, n, r, i) => {
+}, Pe = async (e, t, n, r, i) => {
 	typeof e == "object" && !(e instanceof String) && (e instanceof Promise || (e = e.toString()), e instanceof Promise && (e = await e));
 	let a = e.callbacks;
 	if (!a?.length) return Promise.resolve(e);
@@ -262,12 +554,12 @@ var s = (e, t, n) => {
 		phase: t,
 		buffer: i,
 		context: r
-	}))).then((e) => Promise.all(e.filter(Boolean).map((e) => D(e, t, !1, r, i))).then(() => i[0]));
-	return n ? ne(await o, a) : o;
-}, re = "text/plain; charset=UTF-8", O = (e, t) => ({
+	}))).then((e) => Promise.all(e.filter(Boolean).map((e) => Pe(e, t, !1, r, i))).then(() => i[0]));
+	return n ? Ne(await o, a) : o;
+}, Fe = "text/plain; charset=UTF-8", Ie = (e, t) => ({
 	"Content-Type": e,
 	...t
-}), k = (e, t) => new Response(e, t), ie = class {
+}), z = (e, t) => new Response(e, t), Le = class {
 	#e;
 	#t;
 	env = {};
@@ -287,7 +579,7 @@ var s = (e, t, n) => {
 		this.#e = e, t && (this.#i = t.executionCtx, this.env = t.env, this.#c = t.notFoundHandler, this.#d = t.path, this.#u = t.matchResult);
 	}
 	get req() {
-		return this.#t ??= new E(this.#e, this.#d, this.#u), this.#t;
+		return this.#t ??= new je(this.#e, this.#d, this.#u), this.#t;
 	}
 	get event() {
 		if (this.#i && "respondWith" in this.#i) return this.#i;
@@ -298,11 +590,11 @@ var s = (e, t, n) => {
 		throw Error("This context has no ExecutionContext");
 	}
 	get res() {
-		return this.#a ||= k(null, { headers: this.#l ??= new Headers() });
+		return this.#a ||= z(null, { headers: this.#l ??= new Headers() });
 	}
 	set res(e) {
 		if (this.#a && e) {
-			e = k(e.body, e);
+			e = z(e.body, e);
 			for (let [t, n] of this.#a.headers.entries()) if (t !== "content-type") if (t === "set-cookie") {
 				let t = this.#a.headers.getSetCookie();
 				e.headers.delete("set-cookie");
@@ -318,7 +610,7 @@ var s = (e, t, n) => {
 		this.#s = e;
 	};
 	header = (e, t, n) => {
-		this.finalized && (this.#a = k(this.#a.body, this.#a));
+		this.finalized && (this.#a = z(this.#a.body, this.#a));
 		let r = this.#a ? this.#a.headers : this.#l ??= new Headers();
 		t === void 0 ? r.delete(e) : n?.append ? r.append(e, t) : r.set(e, t);
 	};
@@ -343,38 +635,38 @@ var s = (e, t, n) => {
 			r.delete(e);
 			for (let n of t) r.append(e, n);
 		}
-		return k(e, {
+		return z(e, {
 			status: typeof t == "number" ? t : t?.status ?? this.#r,
 			headers: r
 		});
 	}
 	newResponse = (...e) => this.#f(...e);
 	body = (e, t, n) => this.#f(e, t, n);
-	text = (e, t, n) => !this.#l && !this.#r && !t && !n && !this.finalized ? new Response(e) : this.#f(e, t, O(re, n));
-	json = (e, t, n) => this.#f(JSON.stringify(e), t, O("application/json", n));
+	text = (e, t, n) => !this.#l && !this.#r && !t && !n && !this.finalized ? new Response(e) : this.#f(e, t, Ie(Fe, n));
+	json = (e, t, n) => this.#f(JSON.stringify(e), t, Ie("application/json", n));
 	html = (e, t, n) => {
-		let r = (e) => this.#f(e, t, O("text/html; charset=UTF-8", n));
-		return typeof e == "object" ? D(e, te.Stringify, !1, {}).then(r) : r(e);
+		let r = (e) => this.#f(e, t, Ie("text/html; charset=UTF-8", n));
+		return typeof e == "object" ? Pe(e, Me.Stringify, !1, {}).then(r) : r(e);
 	};
 	redirect = (e, t) => {
 		let n = String(e);
 		return this.header("Location", /[^\x00-\xFF]/.test(n) ? encodeURI(n) : n), this.newResponse(null, t ?? 302);
 	};
-	notFound = () => (this.#c ??= () => k(), this.#c(this));
-}, ae = [
+	notFound = () => (this.#c ??= () => z(), this.#c(this));
+}, Re = [
 	"get",
 	"post",
 	"put",
 	"delete",
 	"options",
 	"patch"
-], A = "Can not add a route since the matcher is already built.", j = class extends Error {}, oe = "__COMPOSED_HANDLER", se = (e) => e.text("404 Not Found", 404), M = (e, t) => {
+], ze = "Can not add a route since the matcher is already built.", Be = class extends Error {}, Ve = "__COMPOSED_HANDLER", He = (e) => e.text("404 Not Found", 404), Ue = (e, t) => {
 	if ("getResponse" in e) {
 		let n = e.getResponse();
 		return t.newResponse(n.body, n);
 	}
 	return console.error(e), t.text("Internal Server Error", 500);
-}, ce = class e {
+}, We = class e {
 	get;
 	post;
 	put;
@@ -390,7 +682,7 @@ var s = (e, t, n) => {
 	#e = "/";
 	routes = [];
 	constructor(e = {}) {
-		[...ae, "all"].forEach((e) => {
+		[...Re, "all"].forEach((e) => {
 			this[e] = (t, ...n) => (typeof t == "string" ? this.#e = t : this.#r(e, this.#e, t), n.forEach((t) => {
 				this.#r(e, this.#e, t);
 			}), this);
@@ -406,7 +698,7 @@ var s = (e, t, n) => {
 			this.#r("ALL", this.#e, e);
 		}), this);
 		let { strict: t, ...n } = e;
-		Object.assign(this, n), this.getPath = t ?? !0 ? e.getPath ?? _ : v;
+		Object.assign(this, n), this.getPath = t ?? !0 ? e.getPath ?? Se : Ce;
 	}
 	#t() {
 		let t = new e({
@@ -415,18 +707,18 @@ var s = (e, t, n) => {
 		});
 		return t.errorHandler = this.errorHandler, t.#n = this.#n, t.routes = this.routes, t;
 	}
-	#n = se;
-	errorHandler = M;
+	#n = He;
+	errorHandler = Ue;
 	route(e, t) {
-		let r = this.basePath(e);
+		let n = this.basePath(e);
 		return t.routes.map((e) => {
-			let i;
-			t.errorHandler === M ? i = e.handler : (i = async (r, i) => (await n([], t.errorHandler)(r, () => e.handler(r, i))).res, i[oe] = e.handler), r.#r(e.method, e.path, i, e.basePath);
+			let r;
+			t.errorHandler === Ue ? r = e.handler : (r = async (n, r) => (await le([], t.errorHandler)(n, () => e.handler(n, r))).res, r[Ve] = e.handler), n.#r(e.method, e.path, r, e.basePath);
 		}), this;
 	}
 	basePath(e) {
 		let t = this.#t();
-		return t._basePath = y(this._basePath, e), t;
+		return t._basePath = R(this._basePath, e), t;
 	}
 	onError = (e) => (this.errorHandler = e, this);
 	notFound = (e) => (this.#n = e, this);
@@ -444,21 +736,21 @@ var s = (e, t, n) => {
 			return [e.env, t];
 		};
 		return r ||= (() => {
-			let t = y(this._basePath, e), n = t === "/" ? 0 : t.length;
+			let t = R(this._basePath, e), n = t === "/" ? 0 : t.length;
 			return (e) => {
 				let t = new URL(e.url);
 				return t.pathname = this.getPath(e).slice(n) || "/", new Request(t, e);
 			};
-		})(), this.#r("ALL", y(e, "*"), async (e, n) => {
+		})(), this.#r("ALL", R(e, "*"), async (e, n) => {
 			let i = await t(r(e.req.raw), ...a(e));
 			if (i) return i;
 			await n();
 		}), this;
 	}
 	#r(e, t, n, r) {
-		e = e.toUpperCase(), t = y(this._basePath, t);
+		e = e.toUpperCase(), t = R(this._basePath, t);
 		let i = {
-			basePath: r === void 0 ? this._basePath : y(this._basePath, r),
+			basePath: r === void 0 ? this._basePath : R(this._basePath, r),
 			path: t,
 			method: e,
 			handler: n
@@ -469,51 +761,51 @@ var s = (e, t, n) => {
 		if (e instanceof Error) return this.errorHandler(e, t);
 		throw e;
 	}
-	#a(e, t, r, i) {
-		if (i === "HEAD") return (async () => new Response(null, await this.#a(e, t, r, "GET")))();
-		let a = this.getPath(e, { env: r }), o = this.router.match(i, a), s = new ie(e, {
-			path: a,
-			matchResult: o,
-			env: r,
+	#a(e, t, n, r) {
+		if (r === "HEAD") return (async () => new Response(null, await this.#a(e, t, n, "GET")))();
+		let i = this.getPath(e, { env: n }), a = this.router.match(r, i), o = new Le(e, {
+			path: i,
+			matchResult: a,
+			env: n,
 			executionCtx: t,
 			notFoundHandler: this.#n
 		});
-		if (o[0].length === 1) {
+		if (a[0].length === 1) {
 			let e;
 			try {
-				e = o[0][0][0][0](s, async () => {
-					s.res = await this.#n(s);
+				e = a[0][0][0][0](o, async () => {
+					o.res = await this.#n(o);
 				});
 			} catch (e) {
-				return this.#i(e, s);
+				return this.#i(e, o);
 			}
-			return e instanceof Promise ? e.then((e) => e || (s.finalized ? s.res : this.#n(s))).catch((e) => this.#i(e, s)) : e ?? this.#n(s);
+			return e instanceof Promise ? e.then((e) => e || (o.finalized ? o.res : this.#n(o))).catch((e) => this.#i(e, o)) : e ?? this.#n(o);
 		}
-		let c = n(o[0], this.errorHandler, this.#n);
+		let s = le(a[0], this.errorHandler, this.#n);
 		return (async () => {
 			try {
-				let e = await c(s);
+				let e = await s(o);
 				if (!e.finalized) throw Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
 				return e.res;
 			} catch (e) {
-				return this.#i(e, s);
+				return this.#i(e, o);
 			}
 		})();
 	}
 	fetch = (e, ...t) => this.#a(e, t[1], t[0], e.method);
-	request = (e, t, n, r) => e instanceof Request ? this.fetch(t ? new Request(e, t) : e, n, r) : (e = e.toString(), this.fetch(new Request(/^https?:\/\//.test(e) ? e : `http://localhost${y("/", e)}`, t), n, r));
+	request = (e, t, n, r) => e instanceof Request ? this.fetch(t ? new Request(e, t) : e, n, r) : (e = e.toString(), this.fetch(new Request(/^https?:\/\//.test(e) ? e : `http://localhost${R("/", e)}`, t), n, r));
 	fire = () => {
 		addEventListener("fetch", (e) => {
 			e.respondWith(this.#a(e.request, e, void 0, e.request.method));
 		});
 	};
-}, N = [];
-function le(e, t) {
+}, Ge = [];
+function Ke(e, t) {
 	let n = this.buildAllMatchers(), r = ((e, t) => {
 		let r = n[e] || n.ALL, i = r[2][t];
 		if (i) return i;
 		let a = t.match(r[0]);
-		if (!a) return [[], N];
+		if (!a) return [[], Ge];
 		let o = a.indexOf("", 1);
 		return [r[1][o], a];
 	});
@@ -521,17 +813,17 @@ function le(e, t) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/hono@4.12.26/node_modules/hono/dist/router/reg-exp-router/node.js
-var P = "[^/]+", F = ".*", I = "(?:|/.*)", L = /* @__PURE__ */ Symbol(), ue = /* @__PURE__ */ new Set(".\\+*[^]$()");
-function de(e, t) {
-	return e.length === 1 ? t.length === 1 ? e < t ? -1 : 1 : -1 : t.length === 1 || e === F || e === I ? 1 : t === F || t === I ? -1 : e === P ? 1 : t === P ? -1 : e.length === t.length ? e < t ? -1 : 1 : t.length - e.length;
+var B = "[^/]+", V = ".*", H = "(?:|/.*)", U = /* @__PURE__ */ Symbol(), qe = /* @__PURE__ */ new Set(".\\+*[^]$()");
+function Je(e, t) {
+	return e.length === 1 ? t.length === 1 ? e < t ? -1 : 1 : -1 : t.length === 1 || e === V || e === H ? 1 : t === V || t === H ? -1 : e === B ? 1 : t === B ? -1 : e.length === t.length ? e < t ? -1 : 1 : t.length - e.length;
 }
-var fe = class e {
+var Ye = class e {
 	#e;
 	#t;
 	#n = /* @__PURE__ */ Object.create(null);
 	insert(t, n, r, i, a) {
 		if (t.length === 0) {
-			if (this.#e !== void 0) throw L;
+			if (this.#e !== void 0) throw U;
 			if (a) return;
 			this.#e = n;
 			return;
@@ -539,42 +831,42 @@ var fe = class e {
 		let [o, ...s] = t, c = o === "*" ? s.length === 0 ? [
 			"",
 			"",
-			F
+			V
 		] : [
 			"",
 			"",
-			P
+			B
 		] : o === "/*" ? [
 			"",
 			"",
-			I
+			H
 		] : o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/), l;
 		if (c) {
-			let t = c[1], n = c[2] || P;
-			if (t && c[2] && (n === ".*" || (n = n.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:"), /\((?!\?:)/.test(n)))) throw L;
+			let t = c[1], n = c[2] || B;
+			if (t && c[2] && (n === ".*" || (n = n.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:"), /\((?!\?:)/.test(n)))) throw U;
 			if (l = this.#n[n], !l) {
-				if (Object.keys(this.#n).some((e) => e !== F && e !== I)) throw L;
+				if (Object.keys(this.#n).some((e) => e !== V && e !== H)) throw U;
 				if (a) return;
 				l = this.#n[n] = new e(), t !== "" && (l.#t = i.varIndex++);
 			}
 			!a && t !== "" && r.push([t, l.#t]);
 		} else if (l = this.#n[o], !l) {
-			if (Object.keys(this.#n).some((e) => e.length > 1 && e !== F && e !== I)) throw L;
+			if (Object.keys(this.#n).some((e) => e.length > 1 && e !== V && e !== H)) throw U;
 			if (a) return;
 			l = this.#n[o] = new e();
 		}
 		l.insert(s, n, r, i, a);
 	}
 	buildRegExpStr() {
-		let e = Object.keys(this.#n).sort(de).map((e) => {
+		let e = Object.keys(this.#n).sort(Je).map((e) => {
 			let t = this.#n[e];
-			return (typeof t.#t == "number" ? `(${e})@${t.#t}` : ue.has(e) ? `\\${e}` : e) + t.buildRegExpStr();
+			return (typeof t.#t == "number" ? `(${e})@${t.#t}` : qe.has(e) ? `\\${e}` : e) + t.buildRegExpStr();
 		});
 		return typeof this.#e == "number" && e.unshift(`#${this.#e}`), e.length === 0 ? "" : e.length === 1 ? e[0] : "(?:" + e.join("|") + ")";
 	}
-}, pe = class {
+}, Xe = class {
 	#e = { varIndex: 0 };
-	#t = new fe();
+	#t = new Ye();
 	insert(e, t, n) {
 		let r = [], i = [];
 		for (let t = 0;;) {
@@ -608,29 +900,29 @@ var fe = class e {
 			r
 		];
 	}
-}, me = [
+}, Ze = [
 	/^$/,
 	[],
 	/* @__PURE__ */ Object.create(null)
-], R = /* @__PURE__ */ Object.create(null);
-function z(e) {
-	return R[e] ??= RegExp(e === "*" ? "" : `^${e.replace(/\/\*$|([.\\+*[^\]$()])/g, (e, t) => t ? `\\${t}` : "(?:|/.*)")}$`);
+], Qe = /* @__PURE__ */ Object.create(null);
+function $e(e) {
+	return Qe[e] ??= RegExp(e === "*" ? "" : `^${e.replace(/\/\*$|([.\\+*[^\]$()])/g, (e, t) => t ? `\\${t}` : "(?:|/.*)")}$`);
 }
-function he() {
-	R = /* @__PURE__ */ Object.create(null);
+function et() {
+	Qe = /* @__PURE__ */ Object.create(null);
 }
-function ge(e) {
-	let t = new pe(), n = [];
-	if (e.length === 0) return me;
+function tt(e) {
+	let t = new Xe(), n = [];
+	if (e.length === 0) return Ze;
 	let r = e.map((e) => [!/\*|\/:/.test(e[0]), ...e]).sort(([e, t], [n, r]) => e ? 1 : n ? -1 : t.length - r.length), i = /* @__PURE__ */ Object.create(null);
 	for (let e = 0, a = -1, o = r.length; e < o; e++) {
 		let [o, s, c] = r[e];
-		o ? i[s] = [c.map(([e]) => [e, /* @__PURE__ */ Object.create(null)]), N] : a++;
+		o ? i[s] = [c.map(([e]) => [e, /* @__PURE__ */ Object.create(null)]), Ge] : a++;
 		let l;
 		try {
 			l = t.insert(s, a, o);
 		} catch (e) {
-			throw e === L ? new j(s) : e;
+			throw e === U ? new Be(s) : e;
 		}
 		o || (n[a] = c.map(([e, t]) => {
 			let n = /* @__PURE__ */ Object.create(null);
@@ -656,12 +948,12 @@ function ge(e) {
 		i
 	];
 }
-function B(e, t) {
+function W(e, t) {
 	if (e) {
-		for (let n of Object.keys(e).sort((e, t) => t.length - e.length)) if (z(n).test(t)) return [...e[n]];
+		for (let n of Object.keys(e).sort((e, t) => t.length - e.length)) if ($e(n).test(t)) return [...e[n]];
 	}
 }
-var _e = class {
+var nt = class {
 	name = "RegExpRouter";
 	#e;
 	#t;
@@ -670,7 +962,7 @@ var _e = class {
 	}
 	add(e, t, n) {
 		let r = this.#e, i = this.#t;
-		if (!r || !i) throw Error(A);
+		if (!r || !i) throw Error(ze);
 		r[e] || [r, i].forEach((t) => {
 			t[e] = /* @__PURE__ */ Object.create(null), Object.keys(t.ALL).forEach((n) => {
 				t[e][n] = [...t.ALL[n]];
@@ -678,10 +970,10 @@ var _e = class {
 		}), t === "/*" && (t = "*");
 		let a = (t.match(/\/:/g) || []).length;
 		if (/\*$/.test(t)) {
-			let o = z(t);
+			let o = $e(t);
 			e === "ALL" ? Object.keys(r).forEach((e) => {
-				r[e][t] ||= B(r[e], t) || B(r.ALL, t) || [];
-			}) : r[e][t] ||= B(r[e], t) || B(r.ALL, t) || [], Object.keys(r).forEach((t) => {
+				r[e][t] ||= W(r[e], t) || W(r.ALL, t) || [];
+			}) : r[e][t] ||= W(r[e], t) || W(r.ALL, t) || [], Object.keys(r).forEach((t) => {
 				(e === "ALL" || e === t) && Object.keys(r[t]).forEach((e) => {
 					o.test(e) && r[t][e].push([n, a]);
 				});
@@ -690,29 +982,29 @@ var _e = class {
 			});
 			return;
 		}
-		let o = b(t) || [t];
+		let o = we(t) || [t];
 		for (let t = 0, s = o.length; t < s; t++) {
 			let c = o[t];
 			Object.keys(i).forEach((o) => {
-				(e === "ALL" || e === o) && (i[o][c] ||= [...B(r[o], c) || B(r.ALL, c) || []], i[o][c].push([n, a - s + t + 1]));
+				(e === "ALL" || e === o) && (i[o][c] ||= [...W(r[o], c) || W(r.ALL, c) || []], i[o][c].push([n, a - s + t + 1]));
 			});
 		}
 	}
-	match = le;
+	match = Ke;
 	buildAllMatchers() {
 		let e = /* @__PURE__ */ Object.create(null);
 		return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach((t) => {
 			e[t] ||= this.#n(t);
-		}), this.#e = this.#t = void 0, he(), e;
+		}), this.#e = this.#t = void 0, et(), e;
 	}
 	#n(e) {
 		let t = [], n = e === "ALL";
 		return [this.#e, this.#t].forEach((r) => {
 			let i = r[e] ? Object.keys(r[e]).map((t) => [t, r[e][t]]) : [];
 			i.length === 0 ? e !== "ALL" && t.push(...Object.keys(r.ALL).map((e) => [e, r.ALL[e]])) : (n ||= !0, t.push(...i));
-		}), n ? ge(t) : null;
+		}), n ? tt(t) : null;
 	}
-}, ve = class {
+}, rt = class {
 	name = "SmartRouter";
 	#e = [];
 	#t = [];
@@ -720,7 +1012,7 @@ var _e = class {
 		this.#e = e.routers;
 	}
 	add(e, t, n) {
-		if (!this.#t) throw Error(A);
+		if (!this.#t) throw Error(ze);
 		this.#t.push([
 			e,
 			t,
@@ -736,7 +1028,7 @@ var _e = class {
 				for (let e = 0, t = r.length; e < t; e++) i.add(...r[e]);
 				o = i.match(e, t);
 			} catch (e) {
-				if (e instanceof j) continue;
+				if (e instanceof Be) continue;
 				throw e;
 			}
 			this.match = i.match.bind(i), this.#e = [i], this.#t = void 0;
@@ -749,15 +1041,15 @@ var _e = class {
 		if (this.#t || this.#e.length !== 1) throw Error("No active router has been determined yet.");
 		return this.#e[0];
 	}
-}, V = /* @__PURE__ */ Object.create(null), ye = (e) => {
+}, G = /* @__PURE__ */ Object.create(null), it = (e) => {
 	for (let t in e) return !0;
 	return !1;
-}, be = class e {
+}, at = class e {
 	#e;
 	#t;
 	#n;
 	#r = 0;
-	#i = V;
+	#i = G;
 	constructor(e, t, n) {
 		if (this.#t = n || /* @__PURE__ */ Object.create(null), this.#e = [], e && t) {
 			let n = /* @__PURE__ */ Object.create(null);
@@ -771,9 +1063,9 @@ var _e = class {
 	}
 	insert(t, n, r) {
 		this.#r = ++this.#r;
-		let i = this, a = u(n), o = [];
+		let i = this, a = _e(n), o = [];
 		for (let t = 0, n = a.length; t < n; t++) {
-			let n = a[t], r = a[t + 1], s = m(n, r), c = Array.isArray(s) ? s[0] : n;
+			let n = a[t], r = a[t + 1], s = be(n, r), c = Array.isArray(s) ? s[0] : n;
 			if (c in i.#t) {
 				i = i.#t[c], s && o.push(s[1]);
 				continue;
@@ -789,7 +1081,7 @@ var _e = class {
 	#a(e, t, n, r, i) {
 		for (let a = 0, o = t.#e.length; a < o; a++) {
 			let o = t.#e[a], s = o[n] || o.ALL, c = {};
-			if (s !== void 0 && (s.params = /* @__PURE__ */ Object.create(null), e.push(s), r !== V || i && i !== V)) for (let e = 0, t = s.possibleKeys.length; e < t; e++) {
+			if (s !== void 0 && (s.params = /* @__PURE__ */ Object.create(null), e.push(s), r !== G || i && i !== G)) for (let e = 0, t = s.possibleKeys.length; e < t; e++) {
 				let t = s.possibleKeys[e], n = c[s.score];
 				s.params[t] = i?.[t] && !n ? i[t] : r[t] ?? i?.[t], c[s.score] = !0;
 			}
@@ -797,15 +1089,15 @@ var _e = class {
 	}
 	search(e, t) {
 		let n = [];
-		this.#i = V;
-		let r = [this], i = l(t), a = [], o = i.length, s = null;
+		this.#i = G;
+		let r = [this], i = ge(t), a = [], o = i.length, s = null;
 		for (let c = 0; c < o; c++) {
 			let l = i[c], u = c === o - 1, d = [];
 			for (let f = 0, p = r.length; f < p; f++) {
 				let p = r[f], m = p.#t[l];
 				m && (m.#i = p.#i, u ? (m.#t["*"] && this.#a(n, m.#t["*"], e, p.#i), this.#a(n, m, e, p.#i)) : d.push(m));
 				for (let r = 0, f = p.#n.length; r < f; r++) {
-					let f = p.#n[r], m = p.#i === V ? {} : { ...p.#i };
+					let f = p.#n[r], m = p.#i === G ? {} : { ...p.#i };
 					if (f === "*") {
 						let t = p.#t["*"];
 						t && (this.#a(n, t, e, p.#i), t.#i = m, d.push(t));
@@ -822,7 +1114,7 @@ var _e = class {
 						}
 						let r = t.substring(s[c]), l = _.exec(r);
 						if (l) {
-							if (m[g] = l[0], this.#a(n, v, e, p.#i, m), ye(v.#t)) {
+							if (m[g] = l[0], this.#a(n, v, e, p.#i, m), it(v.#t)) {
 								v.#i = m;
 								let e = l[0].match(/\//)?.length ?? 0;
 								(a[e] ||= []).push(v);
@@ -838,14 +1130,14 @@ var _e = class {
 		}
 		return n.length > 1 && n.sort((e, t) => e.score - t.score), [n.map(({ handler: e, params: t }) => [e, t])];
 	}
-}, xe = class {
+}, ot = class {
 	name = "TrieRouter";
 	#e;
 	constructor() {
-		this.#e = new be();
+		this.#e = new at();
 	}
 	add(e, t, n) {
-		let r = b(t);
+		let r = we(t);
 		if (r) {
 			for (let t = 0, i = r.length; t < i; t++) this.#e.insert(e, r[t], n);
 			return;
@@ -855,43 +1147,43 @@ var _e = class {
 	match(e, t) {
 		return this.#e.search(e, t);
 	}
-}, Se = class extends ce {
+}, st = class extends We {
 	constructor(e = {}) {
-		super(e), this.router = e.router ?? new ve({ routers: [new _e(), new xe()] });
+		super(e), this.router = e.router ?? new rt({ routers: [new nt(), new ot()] });
 	}
 };
 //#endregion
 //#region src/coordinator-invites.ts
-function Ce(e) {
+function ct(e) {
 	let t = "";
 	for (let n of e) t += String.fromCharCode(n);
 	return btoa(t);
 }
-function we(e) {
+function lt(e) {
 	let t = atob(e), n = new Uint8Array(t.length);
 	for (let e = 0; e < t.length; e += 1) n[e] = t.charCodeAt(e);
 	return n;
 }
-function Te(e) {
+function ut(e) {
 	return e.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function Ee(e) {
+function dt(e) {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/");
 	return t + "=".repeat((4 - t.length % 4) % 4);
 }
-function H(e) {
+function K(e) {
 	let t = JSON.stringify(e);
-	return Te(Ce(new TextEncoder().encode(t)));
+	return ut(ct(new TextEncoder().encode(t)));
 }
-function De(e) {
-	let t = new TextDecoder().decode(we(Ee(e))), n = JSON.parse(t);
+function ft(e) {
+	let t = new TextDecoder().decode(lt(dt(e))), n = JSON.parse(t);
 	if (typeof n != "object" || !n) throw Error("invalid invite payload");
 	return n;
 }
-function U(e) {
+function q(e) {
 	return `codemem://join?invite=${encodeURIComponent(e)}`;
 }
-function Oe(e) {
+function pt(e) {
 	let t = e.trim();
 	if (t.startsWith("codemem://")) {
 		let e = new URL(t).searchParams.get("invite") ?? "";
@@ -901,21 +1193,33 @@ function Oe(e) {
 	return t;
 }
 //#endregion
+//#region src/project-invite-acceptance.ts
+var mt = "pending_setup", ht = "project_sync_enablement_failed", gt = "Invitation was accepted, but sync could not be enabled. Make the codemem config writable, then retry.", _t = class extends Error {
+	code = ht;
+	detail = gt;
+	constructor(e) {
+		super(gt, e), this.name = "ProjectSyncEnablementError";
+	}
+};
+function vt(e) {
+	return typeof e == "object" && !!e && "code" in e && e.code === "project_sync_enablement_failed" && "detail" in e && e.detail === "Invitation was accepted, but sync could not be enabled. Make the codemem config writable, then retry.";
+}
+//#endregion
 //#region ../../node_modules/.pnpm/limiter@3.0.0/node_modules/limiter/dist/esm/clock.js
-function ke(e) {
+function yt(e) {
 	let t = performance.now() * .001, n = Math.floor(t), r = Math.floor(t % 1 * 1e9);
 	return e != null && (n -= e[0], r -= e[1], r < 0 && (n--, r += 1e9)), [n, r];
 }
-function W() {
-	let [e, t] = ke();
+function J() {
+	let [e, t] = yt();
 	return e * 1e3 + Math.floor(t / 1e6);
 }
-function G(e) {
+function bt(e) {
 	return new Promise((t) => setTimeout(t, e));
 }
 //#endregion
 //#region ../../node_modules/.pnpm/limiter@3.0.0/node_modules/limiter/dist/esm/TokenBucket.js
-var Ae = class {
+var xt = class {
 	bucketSize;
 	tokensPerInterval;
 	interval;
@@ -942,13 +1246,13 @@ var Ae = class {
 			default: throw Error("Invalid interval " + n);
 		}
 		else this.interval = n;
-		this.parentBucket = r, this.content = 0, this.lastDrip = W();
+		this.parentBucket = r, this.content = 0, this.lastDrip = J();
 	}
 	async removeTokens(e) {
 		if (this.bucketSize === 0) return Infinity;
 		if (e > this.bucketSize) throw Error(`Requested tokens ${e} exceeds bucket size ${this.bucketSize}`);
 		this.drip();
-		let t = async () => (await G(Math.ceil((e - this.content) * (this.interval / this.tokensPerInterval))), this.removeTokens(e));
+		let t = async () => (await bt(Math.ceil((e - this.content) * (this.interval / this.tokensPerInterval))), this.removeTokens(e));
 		if (e > this.content) return t();
 		if (this.parentBucket != null) {
 			let n = await this.parentBucket.removeTokens(e);
@@ -963,30 +1267,30 @@ var Ae = class {
 			let e = this.content;
 			return this.content = this.bucketSize, this.content > e;
 		}
-		let e = W(), t = Math.max(e - this.lastDrip, 0);
+		let e = J(), t = Math.max(e - this.lastDrip, 0);
 		this.lastDrip = e;
 		let n = t * (this.tokensPerInterval / this.interval), r = this.content;
 		return this.content = Math.min(this.content + n, this.bucketSize), Math.floor(this.content) > Math.floor(r);
 	}
-}, je = class {
+}, St = class {
 	tokenBucket;
 	curIntervalStart;
 	tokensThisInterval;
 	fireImmediately;
 	constructor({ tokensPerInterval: e, interval: t, fireImmediately: n }) {
-		this.tokenBucket = new Ae({
+		this.tokenBucket = new xt({
 			bucketSize: e,
 			tokensPerInterval: e,
 			interval: t
-		}), this.tokenBucket.content = e, this.curIntervalStart = W(), this.tokensThisInterval = 0, this.fireImmediately = n ?? !1;
+		}), this.tokenBucket.content = e, this.curIntervalStart = J(), this.tokensThisInterval = 0, this.fireImmediately = n ?? !1;
 	}
 	async removeTokens(e) {
 		if (e > this.tokenBucket.bucketSize) throw Error(`Requested tokens ${e} exceeds maximum tokens per interval ${this.tokenBucket.bucketSize}`);
-		let t = W();
+		let t = J();
 		if ((t < this.curIntervalStart || t - this.curIntervalStart >= this.tokenBucket.interval) && (this.curIntervalStart = t, this.tokensThisInterval = 0), e > this.tokenBucket.tokensPerInterval - this.tokensThisInterval) {
 			if (this.fireImmediately) return -1;
 			{
-				await G(Math.ceil(this.curIntervalStart + this.tokenBucket.interval - t));
+				await bt(Math.ceil(this.curIntervalStart + this.tokenBucket.interval - t));
 				let n = await this.tokenBucket.removeTokens(e);
 				return this.tokensThisInterval += e, n;
 			}
@@ -996,7 +1300,7 @@ var Ae = class {
 	}
 	tryRemoveTokens(e) {
 		if (e > this.tokenBucket.bucketSize) return !1;
-		let t = W();
+		let t = J();
 		if ((t < this.curIntervalStart || t - this.curIntervalStart >= this.tokenBucket.interval) && (this.curIntervalStart = t, this.tokensThisInterval = 0), e > this.tokenBucket.tokensPerInterval - this.tokensThisInterval) return !1;
 		let n = this.tokenBucket.tryRemoveTokens(e);
 		return n && (this.tokensThisInterval += e), n;
@@ -1007,7 +1311,7 @@ var Ae = class {
 };
 //#endregion
 //#region src/request-rate-limit.ts
-function Me(e = {}) {
+function Ct(e = {}) {
 	let t = Math.max(1e3, Math.trunc(e.windowMs ?? 6e4)), n = e.now ?? (() => Date.now()), r = /* @__PURE__ */ new Map(), i = 0;
 	function a(e) {
 		return Math.max(1, Math.ceil(t / Math.max(1, e) / 1e3));
@@ -1024,7 +1328,7 @@ function Me(e = {}) {
 		o(l);
 		let u = `${c}:${e}`, d = r.get(u);
 		return d || (d = {
-			limiter: new je({
+			limiter: new St({
 				tokensPerInterval: c,
 				interval: t,
 				fireImmediately: !0
@@ -1041,8 +1345,8 @@ function Me(e = {}) {
 }
 //#endregion
 //#region src/scope-membership-semantics.ts
-var K = "Revocation blocks future sync for this Space. It does not remove data already copied to the revoked device; offline devices, backups, copied databases, malicious peers, or old versions may retain data.";
-function Ne(e) {
+var wt = "Revocation blocks future sync for this Space. It does not remove data already copied to the revoked device; offline devices, backups, copied databases, malicious peers, or old versions may retain data.";
+function Tt(e) {
 	let t = Number.isFinite(e.membershipEpoch) ? Number(e.membershipEpoch) : null, n = Number.isFinite(e.requiredEpoch) ? Number(e.requiredEpoch) : null;
 	return t == null || n == null ? {
 		membership_epoch: t,
@@ -1056,28 +1360,20 @@ function Ne(e) {
 		reason: t < n ? "stale_epoch" : "current"
 	};
 }
-function q(e) {
+function Et(e) {
 	return {
 		scope_id: e.scopeId,
 		device_id: e.deviceId,
 		membership_epoch: Number.isFinite(e.membershipEpoch) ? Number(e.membershipEpoch) : null,
 		prevents_future_sync: !0,
 		deletes_already_copied_data: !1,
-		message: K
+		message: wt
 	};
 }
 //#endregion
 //#region src/sync-auth-constants.ts
-var Pe = 300;
-//#endregion
-//#region src/sync-fingerprint.ts
-function J(t) {
-	return e("sha256").update(t, "utf-8").digest("hex");
-}
-//#endregion
-//#region src/coordinator-api.ts
-var Y = 64 * 1024, X = "X-Codemem-Coordinator-Admin", Z = "X-Codemem-Coordinator-Admin-Actor", Fe = 120, Ie = 30;
-function Q(e, t) {
+var Dt = 300, Y = 64 * 1024, X = "X-Codemem-Coordinator-Admin", Ot = "X-Codemem-Coordinator-Admin-Actor", kt = 120, At = 30;
+function Z(e, t) {
 	let n = t.adminSecret();
 	if (!n) return {
 		ok: !1,
@@ -1095,29 +1391,34 @@ function Q(e, t) {
 		error: "missing_admin_header"
 	};
 }
-function Le(e) {
+function jt(e) {
 	let t = new URL(e);
 	return t.search ? `${t.pathname}${t.search}` : t.pathname;
 }
-async function Re(e, t, n, r) {
+async function Mt(e, t, n, r) {
 	return await e.recordNonce(t, n, r);
 }
-async function ze(e, t) {
+async function Nt(e, t) {
 	await e.cleanupNonces(t);
 }
-async function $(e, t, n, r) {
+async function Q(e, t, n, r) {
 	let { deviceId: i, signature: a, timestamp: o, nonce: s } = r;
 	if (!i || !a || !o || !s) return {
 		ok: !1,
 		error: "missing_headers",
 		enrollment: null
 	};
-	let c = await e.getEnrollment(r.groupId, i);
+	let c = await e.getEnrollment(r.groupId, i, !0);
 	if (!c) return {
 		ok: !1,
 		error: "unknown_device",
 		enrollment: null
 	};
+	if (c.enabled !== 1) return {
+		ok: !1,
+		error: "device_disabled",
+		enrollment: null
+	};
 	let l = await e.getGroup(r.groupId);
 	if (!l) return {
 		ok: !1,
@@ -1133,7 +1434,7 @@ async function $(e, t, n, r) {
 	try {
 		u = await n({
 			method: r.method,
-			pathWithQuery: Le(r.url),
+			pathWithQuery: jt(r.url),
 			bodyBytes: r.body,
 			timestamp: o,
 			nonce: s,
@@ -1154,7 +1455,7 @@ async function $(e, t, n, r) {
 		enrollment: null
 	};
 	let d = t.now();
-	return await Re(e, i, s, d) ? (await ze(e, (/* @__PURE__ */ new Date(new Date(d).getTime() - 300 * 2 * 1e3)).toISOString()), {
+	return await Mt(e, i, s, d) ? (await Nt(e, (/* @__PURE__ */ new Date(new Date(d).getTime() - 300 * 2 * 1e3)).toISOString()), {
 		ok: !0,
 		error: "ok",
 		enrollment: c
@@ -1164,17 +1465,20 @@ async function $(e, t, n, r) {
 		enrollment: null
 	};
 }
-function Be(e) {
+function $(e) {
+	return e === "device_disabled" ? 403 : e === "group_archived" ? 409 : 401;
+}
+function Pt(e) {
 	if (!e?.storeFactory || !e.runtime || !e.requestVerifier) throw Error("createCoordinatorApp requires storeFactory, runtime, and requestVerifier.");
-	let t = e.runtime, n = e.storeFactory, r = e.requestVerifier, i = e.requestRateLimit ?? {}, a = i.limiter ?? Me(), o = Math.max(1, Math.trunc(i.readLimit ?? Fe)), s = Math.max(1, Math.trunc(i.mutationLimit ?? Ie)), c = Math.max(1, Math.trunc(i.unauthenticatedReadLimit ?? Math.min(20, o))), l = Math.max(1, Math.trunc(i.unauthenticatedMutationLimit ?? Math.min(10, s))), u = new Se(), d = new TextDecoder();
-	function f(e, t, n) {
-		let r = e.req.method === "GET" || e.req.method === "HEAD" || e.req.method === "OPTIONS", i = a.check(`${e.req.method}:${n ? "auth" : "anon"}:${t}`, n ? r ? o : s : r ? c : l);
+	let t = e.runtime, n = e.storeFactory, i = e.requestVerifier, a = e.requestRateLimit ?? {}, o = a.limiter ?? Ct(), s = Math.max(1, Math.trunc(a.readLimit ?? kt)), c = Math.max(1, Math.trunc(a.mutationLimit ?? At)), l = Math.max(1, Math.trunc(a.unauthenticatedReadLimit ?? Math.min(20, s))), u = Math.max(1, Math.trunc(a.unauthenticatedMutationLimit ?? Math.min(10, c))), d = new st(), f = new TextDecoder();
+	function p(e, t, n) {
+		let r = e.req.method === "GET" || e.req.method === "HEAD" || e.req.method === "OPTIONS", i = o.check(`${e.req.method}:${n ? "auth" : "anon"}:${t}`, n ? r ? s : c : r ? l : u);
 		return i.allowed ? null : (e.header("Retry-After", String(i.retryAfterS)), e.json({
 			error: "rate_limited",
 			retry_after_s: i.retryAfterS
 		}, 429));
 	}
-	async function p(e) {
+	async function m(e) {
 		let t = Number.parseInt(e.req.header("content-length") ?? "", 10);
 		if (Number.isFinite(t) && t > Y) return null;
 		let n = e.req.raw.body;
@@ -1196,22 +1500,22 @@ function Be(e) {
 		for (let e of i) o.set(e, s), s += e.byteLength;
 		return o;
 	}
-	function m(e) {
+	function g(e) {
 		try {
-			let t = JSON.parse(d.decode(e));
+			let t = JSON.parse(f.decode(e));
 			return typeof t != "object" || !t || Array.isArray(t) ? null : t;
 		} catch {
 			return null;
 		}
 	}
-	function h(e, t) {
+	function _(e, t) {
 		let n = e[t];
 		return n == null ? null : String(n).trim() || null;
 	}
-	function g(e) {
+	function y(e) {
 		return e?.trim() || null;
 	}
-	function _(e, t) {
+	function x(e, t) {
 		let n = e[t];
 		if (n == null || n === "") return null;
 		if (typeof n != "number" && typeof n != "string") return NaN;
@@ -1224,20 +1528,41 @@ function Be(e) {
 		let r = n;
 		return Number.isFinite(r) ? Math.trunc(r) : NaN;
 	}
-	function v(e) {
+	function S(e) {
 		return [
 			"1",
 			"true",
 			"yes"
 		].includes(String(e ?? "").trim().toLowerCase());
 	}
-	async function y(e, t, n) {
+	function C(e) {
+		try {
+			let t = JSON.parse(e ?? "");
+			if (!Array.isArray(t) || t.length === 0 || t.length > 100) throw Error("operation_intent_invalid");
+			return t.map((e) => {
+				if (!e || typeof e != "object" || Array.isArray(e)) throw Error("operation_intent_invalid");
+				let t = e;
+				if (!String(t.canonical_identity ?? "").trim() || !String(t.display_name ?? "").trim() || !Number.isSafeInteger(t.existing_memory_count)) throw Error("operation_intent_invalid");
+				return t;
+			});
+		} catch {
+			throw Error("operation_intent_invalid");
+		}
+	}
+	function w(e) {
+		try {
+			return v(JSON.parse(e ?? ""));
+		} catch {
+			throw Error("operation_intent_invalid");
+		}
+	}
+	async function T(e, t, n) {
 		if (!t) return n.json({ error: "group_id_required" }, 400);
 		let r = await e.getGroup(t);
 		return r ? r.archived_at ? n.json({ error: "group_archived" }, 409) : null : n.json({ error: "group_not_found" }, 404);
 	}
-	async function b(e, t, n, r) {
-		let i = await y(e, t, r);
+	async function E(e, t, n, r) {
+		let i = await T(e, t, r);
 		if (i) return {
 			scope: null,
 			response: i
@@ -1258,52 +1583,52 @@ function Be(e) {
 			response: r.json({ error: "scope_not_found" }, 404)
 		};
 	}
-	async function x(e, n, i) {
-		let a = await $(e, t, r, {
-			method: i.req.method,
-			url: i.req.url,
+	async function D(e, n, r) {
+		let a = await Q(e, t, i, {
+			method: r.req.method,
+			url: r.req.url,
 			groupId: n,
 			body: new Uint8Array(),
-			deviceId: i.req.header("X-Opencode-Device") ?? null,
-			signature: i.req.header("X-Opencode-Signature") ?? null,
-			timestamp: i.req.header("X-Opencode-Timestamp") ?? null,
-			nonce: i.req.header("X-Opencode-Nonce") ?? null
+			deviceId: r.req.header("X-Opencode-Device") ?? null,
+			signature: r.req.header("X-Opencode-Signature") ?? null,
+			timestamp: r.req.header("X-Opencode-Timestamp") ?? null,
+			nonce: r.req.header("X-Opencode-Nonce") ?? null
 		});
 		return !a.ok || !a.enrollment ? {
 			auth: a,
-			response: f(i, i.req.path, !1) ?? i.json({ error: a.error }, a.error === "group_archived" ? 409 : 401)
+			response: p(r, r.req.path, !1) ?? r.json({ error: a.error }, $(a.error))
 		} : {
 			auth: a,
-			response: f(i, String(a.enrollment.device_id), !0)
+			response: p(r, String(a.enrollment.device_id), !0)
 		};
 	}
-	function S(e, t) {
+	function O(e, t) {
 		return e.status === "active" && e.membership_epoch >= t.membership_epoch;
 	}
-	async function C(e, t, n) {
-		return (await e.listScopeMemberships(t.scope_id, !1)).some((e) => e.device_id === n && S(e, t));
+	async function k(e, t, n) {
+		return (await e.listScopeMemberships(t.scope_id, !1)).some((e) => e.device_id === n && O(e, t));
 	}
-	return u.post("/v1/presence", async (e) => {
-		let i = await p(e);
-		if (i == null) return e.json({ error: "body_too_large" }, 413);
-		let a = m(i);
+	return d.post("/v1/presence", async (e) => {
+		let r = await m(e);
+		if (r == null) return e.json({ error: "body_too_large" }, 413);
+		let a = g(r);
 		if (!a) return e.json({ error: "invalid_json" }, 400);
 		let o = String(a.group_id ?? "").trim();
 		if (!o) return e.json({ error: "group_id_required" }, 400);
 		let s = n();
 		try {
-			let n = await $(s, t, r, {
+			let n = await Q(s, t, i, {
 				method: e.req.method,
 				url: e.req.url,
 				groupId: o,
-				body: i,
+				body: r,
 				deviceId: e.req.header("X-Opencode-Device") ?? null,
 				signature: e.req.header("X-Opencode-Signature") ?? null,
 				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
 				nonce: e.req.header("X-Opencode-Nonce") ?? null
 			});
-			if (!n.ok || !n.enrollment) return f(e, e.req.path, !1) || e.json({ error: n.error }, n.error === "group_archived" ? 409 : 401);
-			let c = f(e, String(n.enrollment.device_id), !0);
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) || e.json({ error: n.error }, $(n.error));
+			let c = p(e, String(n.enrollment.device_id), !0);
 			if (c) return c;
 			if (a.fingerprint && String(a.fingerprint) !== String(n.enrollment.fingerprint)) return e.json({ error: "fingerprint_mismatch" }, 401);
 			let l = a.addresses ?? [];
@@ -1328,53 +1653,53 @@ function Be(e) {
 		} finally {
 			await s.close();
 		}
-	}), u.get("/v1/peers", async (e) => {
-		let i = (e.req.query("group_id") ?? "").trim();
-		if (!i) return e.json({ error: "group_id_required" }, 400);
+	}), d.get("/v1/peers", async (e) => {
+		let r = (e.req.query("group_id") ?? "").trim();
+		if (!r) return e.json({ error: "group_id_required" }, 400);
 		let a = n();
 		try {
-			let n = await $(a, t, r, {
+			let n = await Q(a, t, i, {
 				method: e.req.method,
 				url: e.req.url,
-				groupId: i,
+				groupId: r,
 				body: new Uint8Array(),
 				deviceId: e.req.header("X-Opencode-Device") ?? null,
 				signature: e.req.header("X-Opencode-Signature") ?? null,
 				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
 				nonce: e.req.header("X-Opencode-Nonce") ?? null
 			});
-			if (!n.ok || !n.enrollment) return f(e, e.req.path, !1) || e.json({ error: n.error }, n.error === "group_archived" ? 409 : 401);
-			let o = f(e, String(n.enrollment.device_id), !0);
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) || e.json({ error: n.error }, $(n.error));
+			let o = p(e, String(n.enrollment.device_id), !0);
 			if (o) return o;
-			let s = await a.listGroupPeers(i, String(n.enrollment.device_id));
+			let s = await a.listGroupPeers(r, String(n.enrollment.device_id));
 			return e.json({ items: s });
 		} finally {
 			await a.close();
 		}
-	}), u.get("/v1/scopes", async (e) => {
+	}), d.get("/v1/scopes", async (e) => {
 		let t = (e.req.query("group_id") ?? "").trim();
 		if (!t) return e.json({ error: "group_id_required" }, 400);
 		let r = n();
 		try {
-			let { auth: n, response: i } = await x(r, t, e);
+			let { auth: n, response: i } = await D(r, t, e);
 			if (i) return i;
 			if (!n.enrollment) return e.json({ error: "unknown_device" }, 401);
 			let a = await r.listScopes({
 				groupId: t,
 				includeInactive: !1
 			}), o = [];
-			for (let e of a) e.status === "active" && await C(r, e, String(n.enrollment.device_id)) && o.push(e);
+			for (let e of a) e.status === "active" && await k(r, e, String(n.enrollment.device_id)) && o.push(e);
 			return e.json({ items: o });
 		} finally {
 			await r.close();
 		}
-	}), u.get("/v1/scopes/:scope_id/members", async (e) => {
+	}), d.get("/v1/scopes/:scope_id/members", async (e) => {
 		let t = (e.req.query("group_id") ?? "").trim(), r = String(e.req.param("scope_id") ?? "").trim();
 		if (!t) return e.json({ error: "group_id_required" }, 400);
 		if (!r) return e.json({ error: "scope_id_required" }, 400);
 		let i = n();
 		try {
-			let { auth: n, response: a } = await x(i, t, e);
+			let { auth: n, response: a } = await D(i, t, e);
 			if (a) return a;
 			if (!n.enrollment) return e.json({ error: "unknown_device" }, 401);
 			let o = (await i.listScopes({
@@ -1383,31 +1708,31 @@ function Be(e) {
 			})).find((e) => e.scope_id === r) ?? null;
 			if (o?.status !== "active") return e.json({ error: "scope_not_found" }, 404);
 			let s = await i.listScopeMemberships(r, !1);
-			return s.some((e) => e.device_id === String(n.enrollment?.device_id) && S(e, o)) ? e.json({ items: s.filter((e) => S(e, o)) }) : e.json({ error: "scope_not_authorized" }, 403);
+			return s.some((e) => e.device_id === String(n.enrollment?.device_id) && O(e, o)) ? e.json({ items: s.filter((e) => O(e, o)) }) : e.json({ error: "scope_not_authorized" }, 403);
 		} finally {
 			await i.close();
 		}
-	}), u.get("/v1/reciprocal-approvals", async (e) => {
-		let i = (e.req.query("group_id") ?? "").trim(), a = (e.req.query("direction") ?? "incoming").trim(), o = (e.req.query("status") ?? "pending").trim() || "pending";
-		if (!i) return e.json({ error: "group_id_required" }, 400);
+	}), d.get("/v1/reciprocal-approvals", async (e) => {
+		let r = (e.req.query("group_id") ?? "").trim(), a = (e.req.query("direction") ?? "incoming").trim(), o = (e.req.query("status") ?? "pending").trim() || "pending";
+		if (!r) return e.json({ error: "group_id_required" }, 400);
 		if (!["incoming", "outgoing"].includes(a)) return e.json({ error: "direction_must_be_incoming_or_outgoing" }, 400);
 		let s = n();
 		try {
-			let n = await $(s, t, r, {
+			let n = await Q(s, t, i, {
 				method: e.req.method,
 				url: e.req.url,
-				groupId: i,
+				groupId: r,
 				body: new Uint8Array(),
 				deviceId: e.req.header("X-Opencode-Device") ?? null,
 				signature: e.req.header("X-Opencode-Signature") ?? null,
 				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
 				nonce: e.req.header("X-Opencode-Nonce") ?? null
 			});
-			if (!n.ok || !n.enrollment) return f(e, e.req.path, !1) ?? e.json({ error: n.error }, 401);
-			let c = f(e, String(n.enrollment.device_id), !0);
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let c = p(e, String(n.enrollment.device_id), !0);
 			if (c) return c;
 			let l = await s.listReciprocalApprovals({
-				groupId: i,
+				groupId: r,
 				deviceId: String(n.enrollment.device_id),
 				direction: a,
 				status: o
@@ -1416,27 +1741,27 @@ function Be(e) {
 		} finally {
 			await s.close();
 		}
-	}), u.post("/v1/reciprocal-approvals", async (e) => {
-		let i = await p(e);
-		if (i == null) return e.json({ error: "body_too_large" }, 413);
-		let a = m(i);
+	}), d.post("/v1/reciprocal-approvals", async (e) => {
+		let r = await m(e);
+		if (r == null) return e.json({ error: "body_too_large" }, 413);
+		let a = g(r);
 		if (!a) return e.json({ error: "invalid_json" }, 400);
 		let o = String(a.group_id ?? "").trim(), s = String(a.requested_device_id ?? "").trim();
 		if (!o || !s) return e.json({ error: "group_id_and_requested_device_id_required" }, 400);
 		let c = n();
 		try {
-			let n = await $(c, t, r, {
+			let n = await Q(c, t, i, {
 				method: e.req.method,
 				url: e.req.url,
 				groupId: o,
-				body: i,
+				body: r,
 				deviceId: e.req.header("X-Opencode-Device") ?? null,
 				signature: e.req.header("X-Opencode-Signature") ?? null,
 				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
 				nonce: e.req.header("X-Opencode-Nonce") ?? null
 			});
-			if (!n.ok || !n.enrollment) return f(e, e.req.path, !1) ?? e.json({ error: n.error }, 401);
-			let a = f(e, String(n.enrollment.device_id), !0);
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let a = p(e, String(n.enrollment.device_id), !0);
 			if (a) return a;
 			if (s === String(n.enrollment.device_id)) return e.json({ error: "requested_device_must_differ" }, 400);
 			if (!await c.getEnrollment(o, s)) return e.json({ error: "requested_device_not_found" }, 404);
@@ -1452,34 +1777,111 @@ function Be(e) {
 		} finally {
 			await c.close();
 		}
-	}), u.post("/v1/admin/devices", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/invites/add-device", async (e) => {
+		let r = await m(e);
+		if (r == null) return e.json({ error: "body_too_large" }, 413);
+		let a = g(r);
+		if (!a) return e.json({ error: "invalid_json" }, 400);
+		let o = new Set([
+			"group_id",
+			"expires_at",
+			"reviewed_preview_digest",
+			"reviewed_intent"
+		]);
+		if (Object.keys(a).some((e) => !o.has(e))) return e.json({ error: "unexpected_add_device_invite_fields" }, 400);
+		let s = String(a.group_id ?? "").trim(), c = String(a.expires_at ?? "").trim(), l = String(a.reviewed_preview_digest ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_expires_at_required" }, 400);
+		if (Number.isNaN(new Date(c).getTime())) return e.json({ error: "invalid_expires_at" }, 400);
+		if (!/^[a-f0-9]{64}$/u.test(l)) return e.json({ error: "reviewed_preview_digest_invalid" }, 400);
+		if (a.reviewed_intent == null) return e.json({ error: "recipient_invite_review_unavailable" }, 400);
+		let u = n();
+		try {
+			let n = await Q(u, t, i, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: s,
+				body: r,
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let o = p(e, String(n.enrollment.device_id), !0);
+			if (o) return o;
+			let d = n.enrollment.identity_id;
+			if (!d || d !== d.trim() || d.length > 256 || /[\p{Cc}\p{Cf}]/u.test(d)) return e.json({ error: "identity_binding_required" }, 403);
+			let f;
+			try {
+				f = await P(a.reviewed_intent, {
+					target: {
+						kind: "add_device",
+						targetIdentityId: d
+					},
+					digest: l
+				});
+			} catch (t) {
+				return t instanceof b && t.code === "recipient_invite_intent_mismatch" ? e.json({ error: t.code }, 409) : e.json({ error: "recipient_invite_review_unavailable" }, 400);
+			}
+			let m = await u.createInvite({
+				groupId: s,
+				policy: "auto_admit",
+				expiresAt: c,
+				createdBy: d,
+				inviteKind: "add_device",
+				targetIdentityId: d,
+				reviewedPreviewDigest: l,
+				reviewedIntent: f
+			}), h = {
+				v: 1,
+				kind: "add_device",
+				coordinator_url: new URL(e.req.url).origin,
+				group_id: s,
+				policy: m.policy,
+				token: String(m.token ?? ""),
+				expires_at: m.expires_at,
+				team_name: m.team_name_snapshot ?? null,
+				target_identity_id: m.target_identity_id ?? void 0,
+				reviewed_preview_digest: m.reviewed_preview_digest ?? void 0
+			}, g = K(h), { token: _, ...v } = m;
+			return e.json({
+				ok: !0,
+				invite: v,
+				payload: h,
+				encoded: g,
+				link: q(g)
+			});
+		} finally {
+			await u.close();
+		}
+	}), d.post("/v1/admin/devices", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim(), l = String(o.fingerprint ?? "").trim(), u = String(o.public_key ?? "").trim(), d = String(o.display_name ?? "").trim() || null;
 		if (!s || !c || !l || !u) return e.json({ error: "group_id_device_id_fingerprint_public_key_required" }, 400);
-		if (J(u) !== l) return e.json({ error: "fingerprint_mismatch" }, 400);
-		let h = n();
+		if (F(u) !== l) return e.json({ error: "fingerprint_mismatch" }, 400);
+		let f = n();
 		try {
-			await h.createGroup(s), await h.enrollDevice(s, {
+			await f.createGroup(s), await f.enrollDevice(s, {
 				deviceId: c,
 				fingerprint: l,
 				publicKey: u,
 				displayName: d
 			});
 		} finally {
-			await h.close();
+			await f.close();
 		}
 		return e.json({ ok: !0 });
-	}), u.get("/v1/admin/groups", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/groups", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = [
 			"1",
@@ -1491,14 +1893,14 @@ function Be(e) {
 		} finally {
 			await o.close();
 		}
-	}), u.post("/v1/admin/groups", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/groups", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.display_name ?? "").trim() || null;
 		if (!s) return e.json({ error: "group_id_required" }, 400);
@@ -1511,14 +1913,14 @@ function Be(e) {
 		} finally {
 			await l.close();
 		}
-	}), u.post("/v1/admin/groups/rename", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/groups/rename", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.display_name ?? "").trim();
 		if (!s || !c) return e.json({ error: "group_id_and_display_name_required" }, 400);
@@ -1531,14 +1933,14 @@ function Be(e) {
 		} finally {
 			await l.close();
 		}
-	}), u.post("/v1/admin/groups/archive", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/groups/archive", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim();
 		if (!s) return e.json({ error: "group_id_required" }, 400);
@@ -1551,14 +1953,14 @@ function Be(e) {
 		} finally {
 			await c.close();
 		}
-	}), u.post("/v1/admin/groups/unarchive", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/groups/unarchive", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim();
 		if (!s) return e.json({ error: "group_id_required" }, 400);
@@ -1571,16 +1973,16 @@ function Be(e) {
 		} finally {
 			await c.close();
 		}
-	}), u.get("/v1/admin/groups/:group_id/scopes", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/groups/:group_id/scopes", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = String(e.req.param("group_id") ?? "").trim(), o = n();
 		try {
-			let t = await y(o, a, e);
+			let t = await T(o, a, e);
 			if (t) return t;
-			let n = v(e.req.query("include_inactive"));
+			let n = S(e.req.query("include_inactive"));
 			return e.json({ items: await o.listScopes({
 				groupId: a,
 				includeInactive: n
@@ -1588,33 +1990,33 @@ function Be(e) {
 		} finally {
 			await o.close();
 		}
-	}), u.post("/v1/admin/groups/:group_id/scopes", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/groups/:group_id/scopes", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(e.req.param("group_id") ?? "").trim(), c = h(o, "scope_id"), l = h(o, "label"), u = _(o, "membership_epoch");
+		let s = String(e.req.param("group_id") ?? "").trim(), c = _(o, "scope_id"), l = _(o, "label"), u = x(o, "membership_epoch");
 		if (!c || !l) return e.json({ error: "scope_id_and_label_required" }, 400);
 		if (Number.isNaN(u)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
 		let d = n();
 		try {
-			let t = await y(d, s, e);
+			let t = await T(d, s, e);
 			if (t) return t;
 			let n = await d.createScope({
 				scopeId: c,
 				label: l,
-				kind: h(o, "kind"),
-				authorityType: h(o, "authority_type"),
-				coordinatorId: h(o, "coordinator_id"),
+				kind: _(o, "kind"),
+				authorityType: _(o, "authority_type"),
+				coordinatorId: _(o, "coordinator_id"),
 				groupId: s,
-				manifestIssuerDeviceId: h(o, "manifest_issuer_device_id"),
+				manifestIssuerDeviceId: _(o, "manifest_issuer_device_id"),
 				membershipEpoch: u,
-				manifestHash: h(o, "manifest_hash"),
-				status: h(o, "status")
+				manifestHash: _(o, "manifest_hash"),
+				status: _(o, "status")
 			});
 			return e.json({
 				ok: !0,
@@ -1625,33 +2027,33 @@ function Be(e) {
 		} finally {
 			await d.close();
 		}
-	}), u.patch("/v1/admin/groups/:group_id/scopes/:scope_id", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.patch("/v1/admin/groups/:group_id/scopes/:scope_id", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(e.req.param("group_id") ?? "").trim(), c = String(e.req.param("scope_id") ?? "").trim(), l = _(o, "membership_epoch");
+		let s = String(e.req.param("group_id") ?? "").trim(), c = String(e.req.param("scope_id") ?? "").trim(), l = x(o, "membership_epoch");
 		if (!c) return e.json({ error: "scope_id_required" }, 400);
 		if (Number.isNaN(l)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
 		let u = n();
 		try {
-			let t = await b(u, s, c, e);
+			let t = await E(u, s, c, e);
 			if (t.response) return t.response;
 			let n = await u.updateScope({
 				scopeId: c,
-				label: o.label === void 0 ? void 0 : h(o, "label"),
-				kind: o.kind === void 0 ? void 0 : h(o, "kind"),
-				authorityType: o.authority_type === void 0 ? void 0 : h(o, "authority_type"),
-				coordinatorId: o.coordinator_id === void 0 ? void 0 : h(o, "coordinator_id"),
+				label: o.label === void 0 ? void 0 : _(o, "label"),
+				kind: o.kind === void 0 ? void 0 : _(o, "kind"),
+				authorityType: o.authority_type === void 0 ? void 0 : _(o, "authority_type"),
+				coordinatorId: o.coordinator_id === void 0 ? void 0 : _(o, "coordinator_id"),
 				groupId: s,
-				manifestIssuerDeviceId: o.manifest_issuer_device_id === void 0 ? void 0 : h(o, "manifest_issuer_device_id"),
+				manifestIssuerDeviceId: o.manifest_issuer_device_id === void 0 ? void 0 : _(o, "manifest_issuer_device_id"),
 				membershipEpoch: l,
-				manifestHash: o.manifest_hash === void 0 ? void 0 : h(o, "manifest_hash"),
-				status: o.status === void 0 ? void 0 : h(o, "status")
+				manifestHash: o.manifest_hash === void 0 ? void 0 : _(o, "manifest_hash"),
+				status: o.status === void 0 ? void 0 : _(o, "status")
 			});
 			return n ? e.json({
 				ok: !0,
@@ -1662,108 +2064,116 @@ function Be(e) {
 		} finally {
 			await u.close();
 		}
-	}), u.get("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = String(e.req.param("group_id") ?? "").trim(), o = String(e.req.param("scope_id") ?? "").trim(), s = n();
 		try {
-			let t = await b(s, a, o, e);
-			return t.response ? t.response : e.json({ items: await s.listScopeMemberships(o, v(e.req.query("include_revoked"))) });
+			let t = await E(s, a, o, e);
+			return t.response ? t.response : e.json({ items: await s.listScopeMemberships(o, S(e.req.query("include_revoked"))) });
 		} finally {
 			await s.close();
 		}
-	}), u.post("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
-		if (i) return i;
-		let a = await p(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(e.req.param("group_id") ?? "").trim(), c = String(e.req.param("scope_id") ?? "").trim(), l = h(o, "device_id"), u = _(o, "membership_epoch");
-		if (!l) return e.json({ error: "device_id_required" }, 400);
-		if (Number.isNaN(u)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
-		let d = n();
+	}), d.post("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
+		let i = Z(e.req.header(X), t);
+		if (!i.ok) return p(e, e.req.path, !1) ?? e.json({ error: i.error }, 401);
+		let a = p(e, "admin", !0);
+		if (a) return a;
+		let o = await m(e);
+		if (o == null) return e.json({ error: "body_too_large" }, 413);
+		let s = g(o);
+		if (!s) return e.json({ error: "invalid_json" }, 400);
+		let c = String(e.req.param("group_id") ?? "").trim(), l = String(e.req.param("scope_id") ?? "").trim(), u = _(s, "effect_id"), d = _(s, "device_id"), f = x(s, "membership_epoch");
+		if (!u) return e.json({ error: "effect_id_required" }, 400);
+		if (!d) return e.json({ error: "device_id_required" }, 400);
+		if (Number.isNaN(f)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
+		let h = n();
 		try {
-			let t = await b(d, s, c, e);
+			let t = await E(h, c, l, e);
 			if (t.response) return t.response;
-			if (t.scope?.status !== "active") return e.json({ error: "scope_not_active" }, 409);
-			if (!await d.getEnrollment(s, l)) return e.json({ error: "device_not_enrolled_for_scope_group" }, 404);
-			let n = await d.grantScopeMembership({
-				scopeId: c,
-				deviceId: l,
-				role: h(o, "role"),
-				membershipEpoch: u,
-				coordinatorId: h(o, "coordinator_id"),
-				groupId: s,
-				manifestIssuerDeviceId: h(o, "manifest_issuer_device_id"),
-				manifestHash: h(o, "manifest_hash"),
-				signedManifestJson: h(o, "signed_manifest_json"),
+			let n = await h.grantScopeMembership({
+				effectId: u,
+				scopeId: l,
+				deviceId: d,
+				role: _(s, "role"),
+				membershipEpoch: f,
+				coordinatorId: _(s, "coordinator_id"),
+				groupId: c,
+				manifestIssuerDeviceId: _(s, "manifest_issuer_device_id"),
+				manifestHash: _(s, "manifest_hash"),
+				signedManifestJson: _(s, "signed_manifest_json"),
 				actorType: "admin",
-				actorId: g(e.req.header(Z))
+				actorId: y(e.req.header(Ot))
 			});
 			return e.json({
 				ok: !0,
 				membership: n
 			}, 201);
 		} catch (t) {
-			return e.json({ error: t instanceof Error ? t.message : String(t) }, 400);
+			let n = t instanceof Error ? t.message : String(t);
+			if (t instanceof r && (t.code === "scope_not_found" || t.code === "scope_group_mismatch")) return e.json({ error: "scope_not_found" }, 404);
+			if (t instanceof r && t.code === "device_not_enrolled") return e.json({ error: "device_not_enrolled_for_scope_group" }, 404);
+			let i = t instanceof r && t.code === "scope_inactive";
+			return e.json({ error: i ? "scope_not_active" : n }, n === "scope_membership_effect_conflict" || i ? 409 : 400);
 		} finally {
-			await d.close();
+			await h.close();
 		}
-	}), u.post("/v1/admin/groups/:group_id/scopes/:scope_id/members/:device_id/revoke", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
-		if (i) return i;
-		let a = await p(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = a.byteLength > 0 ? m(a) : {};
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(e.req.param("group_id") ?? "").trim(), c = String(e.req.param("scope_id") ?? "").trim(), l = String(e.req.param("device_id") ?? "").trim(), u = _(o, "membership_epoch");
-		if (!l) return e.json({ error: "device_id_required" }, 400);
-		if (Number.isNaN(u)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
-		let d = n();
+	}), d.post("/v1/admin/groups/:group_id/scopes/:scope_id/members/:device_id/revoke", async (e) => {
+		let i = Z(e.req.header(X), t);
+		if (!i.ok) return p(e, e.req.path, !1) ?? e.json({ error: i.error }, 401);
+		let a = p(e, "admin", !0);
+		if (a) return a;
+		let o = await m(e);
+		if (o == null) return e.json({ error: "body_too_large" }, 413);
+		let s = o.byteLength > 0 ? g(o) : {};
+		if (!s) return e.json({ error: "invalid_json" }, 400);
+		let c = String(e.req.param("group_id") ?? "").trim(), l = String(e.req.param("scope_id") ?? "").trim(), u = String(e.req.param("device_id") ?? "").trim(), d = _(s, "effect_id"), f = x(s, "membership_epoch");
+		if (!d) return e.json({ error: "effect_id_required" }, 400);
+		if (!u) return e.json({ error: "device_id_required" }, 400);
+		if (Number.isNaN(f)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
+		let h = n();
 		try {
-			let t = await b(d, s, c, e);
+			let t = await E(h, c, l, e);
 			if (t.response) return t.response;
-			if (!await d.revokeScopeMembership({
-				scopeId: c,
-				deviceId: l,
-				membershipEpoch: u,
-				manifestHash: h(o, "manifest_hash"),
-				signedManifestJson: h(o, "signed_manifest_json"),
+			if (!await h.revokeScopeMembership({
+				effectId: d,
+				scopeId: l,
+				deviceId: u,
+				groupId: c,
+				membershipEpoch: f,
+				manifestHash: _(s, "manifest_hash"),
+				signedManifestJson: _(s, "signed_manifest_json"),
 				actorType: "admin",
-				actorId: g(e.req.header(Z))
+				actorId: y(e.req.header(Ot))
 			})) return e.json({ error: "membership_not_found" }, 404);
 			let n;
 			try {
-				n = (await d.listScopeMemberships(c, !0)).find((e) => e.device_id === l);
+				n = (await h.listScopeMemberships(l, !0)).find((e) => e.device_id === u);
 			} catch {
 				n = void 0;
 			}
 			return e.json({
 				ok: !0,
-				scope_id: c,
-				device_id: l,
-				revocation: q({
-					scopeId: c,
-					deviceId: l,
-					membershipEpoch: n?.membership_epoch ?? u
+				scope_id: l,
+				device_id: u,
+				revocation: Et({
+					scopeId: l,
+					deviceId: u,
+					membershipEpoch: n?.membership_epoch ?? f
 				})
 			});
 		} catch (t) {
-			return e.json({ error: t instanceof Error ? t.message : String(t) }, 400);
+			let n = t instanceof Error ? t.message : String(t);
+			return t instanceof r && t.code === "scope_group_mismatch" ? e.json({ error: "scope_not_found" }, 404) : e.json({ error: n }, n === "scope_membership_effect_conflict" ? 409 : 400);
 		} finally {
-			await d.close();
+			await h.close();
 		}
-	}), u.get("/v1/admin/devices", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/devices", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = (e.req.query("group_id") ?? "").trim();
 		if (!a) return e.json({ error: "group_id_required" }, 400);
@@ -1777,14 +2187,14 @@ function Be(e) {
 		} finally {
 			await s.close();
 		}
-	}), u.post("/v1/admin/devices/rename", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/devices/rename", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim(), l = String(o.display_name ?? "").trim();
 		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
@@ -1800,14 +2210,14 @@ function Be(e) {
 		} finally {
 			await u.close();
 		}
-	}), u.post("/v1/admin/devices/disable", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/devices/disable", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
 		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
@@ -1817,14 +2227,14 @@ function Be(e) {
 		} finally {
 			await l.close();
 		}
-	}), u.post("/v1/admin/devices/enable", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/devices/enable", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
 		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
@@ -1834,14 +2244,14 @@ function Be(e) {
 		} finally {
 			await l.close();
 		}
-	}), u.post("/v1/admin/devices/remove", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/devices/remove", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
 		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
@@ -1851,52 +2261,193 @@ function Be(e) {
 		} finally {
 			await l.close();
 		}
-	}), u.post("/v1/admin/invites", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/invites", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.policy ?? "auto_admit").trim(), l = String(o.expires_at ?? "").trim(), u = String(o.created_by ?? "").trim() || null;
+		let s = String(o.group_id ?? "").trim(), c = String(o.policy ?? "auto_admit").trim(), l = String(o.expires_at ?? "").trim(), u = String(o.created_by ?? "").trim() || null, d = String(o.operation_id ?? "").trim() || null, f = String(o.reviewed_project_set_digest ?? "").trim() || null, _ = String(o.inviter_actor_id ?? "").trim() || null, y = String(o.inviter_display_name ?? "").trim() || null, x = String(o.inviter_device_id ?? "").trim() || null, S = String(o.pending_person_id ?? "").trim() || null, C = String(o.invite_kind ?? o.kind ?? "").trim(), w = String(o.policy_team_id ?? "").trim() || null, T = String(o.target_identity_id ?? "").trim() || null, E = String(o.reviewed_preview_digest ?? "").trim() || null, D, O = null, k = null;
 		if (!s || !["auto_admit", "approval_required"].includes(c) || !l) return e.json({ error: "group_id_policy_and_expires_at_required" }, 400);
+		if (Object.hasOwn(o, "assigned_identity_id")) return e.json({ error: "assigned_identity_id_forbidden" }, 400);
 		if (Number.isNaN(new Date(l).getTime())) return e.json({ error: "invalid_expires_at" }, 400);
-		let d = n();
+		if (!!d != !!f) return e.json({ error: "operation_intent_reference_incomplete" }, 400);
+		let A = C || (d ? "project_share" : "legacy_enrollment");
+		if (![
+			"legacy_enrollment",
+			"project_share",
+			"team_member",
+			"add_device"
+		].includes(A)) return e.json({ error: "invite_kind_invalid" }, 400);
+		if (A === "project_share" ? !d : d) return e.json({ error: "invite_kind_intent_mismatch" }, 400);
+		if (E && !/^[a-f0-9]{64}$/u.test(E)) return e.json({ error: "reviewed_preview_digest_invalid" }, 400);
+		if (A === "team_member" && (!w || !E || T) || A === "add_device" && (!T || !E || w) || !["team_member", "add_device"].includes(A) && (w || T || E)) return e.json({ error: "recipient_invite_metadata_invalid" }, 400);
+		if ([w, T].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) return e.json({ error: "recipient_invite_identifier_invalid" }, 400);
+		if (A === "team_member" || A === "add_device") {
+			if (o.reviewed_intent == null) return e.json({ error: "recipient_invite_review_unavailable" }, 400);
+			try {
+				D = await P(o.reviewed_intent, {
+					target: A === "team_member" ? {
+						kind: "team_member",
+						policyTeamId: String(w)
+					} : {
+						kind: "add_device",
+						targetIdentityId: String(T)
+					},
+					digest: String(E)
+				});
+			} catch (t) {
+				return t instanceof b && t.code === "recipient_invite_intent_mismatch" ? e.json({ error: t.code }, 409) : e.json({ error: "recipient_invite_review_unavailable" }, 400);
+			}
+		} else if (o.reviewed_intent != null) return e.json({ error: "recipient_invite_metadata_invalid" }, 400);
+		if (d && !/^share_[a-f0-9]{40}$/u.test(d) || f && !/^[a-f0-9]{64}$/u.test(f)) return e.json({ error: "operation_intent_reference_invalid" }, 400);
+		if (d) {
+			if (!_ || !y || !x || !S) return e.json({ error: "project_invite_identity_context_required" }, 400);
+			if ([
+				_,
+				x,
+				S
+			].some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) return e.json({ error: "project_invite_identity_context_invalid" }, 400);
+			try {
+				if (h(y, "inviter_display_name"), O = v(o.project_summaries), !Array.isArray(o.project_intent) || o.project_intent.length !== O.length || (k = o.project_intent.map((e, t) => {
+					if (!e || typeof e != "object" || Array.isArray(e)) throw Error("project_intent_invalid");
+					let n = e, r = String(n.canonical_identity ?? "").trim(), i = O?.[t];
+					if (!r || r.length > 2048 || /[\p{Cc}\p{Cf}]/u.test(r) || !i || n.display_name !== i.display_name || n.existing_memory_count !== i.existing_memory_count) throw Error("project_intent_invalid");
+					return {
+						canonical_identity: r,
+						...i
+					};
+				}), new Set(k.map((e) => e.canonical_identity)).size !== k.length)) throw Error("project_intent_invalid");
+			} catch (t) {
+				return e.json({ error: t instanceof Error ? t.message : "project_invite_invalid" }, 400);
+			}
+		}
+		let j = n();
 		try {
-			let t = await d.getGroup(s);
+			let t = await j.getGroup(s);
 			if (!t) return e.json({ error: "group_not_found" }, 404);
 			if (t.archived_at) return e.json({ error: "group_archived" }, 409);
-			let n = await d.createInvite({
+			let n = await j.createInvite({
 				groupId: s,
 				policy: c,
 				expiresAt: l,
-				createdBy: u
+				createdBy: u,
+				operationId: d,
+				reviewedProjectSetDigest: f,
+				inviterActorId: _,
+				inviterDisplayName: y,
+				inviterDeviceId: x,
+				pendingPersonId: S,
+				projectSummaries: O,
+				projectIntent: k,
+				inviteKind: A,
+				policyTeamId: w,
+				targetIdentityId: T,
+				reviewedPreviewDigest: E,
+				reviewedIntent: D
 			}), r = {
 				v: 1,
-				kind: "coordinator_team_invite",
+				kind: n.invite_kind === "team_member" || n.invite_kind === "add_device" ? n.invite_kind : "coordinator_team_invite",
 				coordinator_url: String(o.coordinator_url ?? "").trim(),
 				group_id: s,
-				policy: c,
+				policy: n.policy,
 				token: String(n.token ?? ""),
-				expires_at: l,
-				team_name: n.team_name_snapshot ?? null
-			}, i = H(r), { token: a, ...f } = n;
+				expires_at: n.expires_at,
+				team_name: n.team_name_snapshot ?? null,
+				...n.operation_id ? {
+					operation_id: n.operation_id,
+					inviter_name: n.inviter_display_name ?? null,
+					project_summaries: O ?? []
+				} : {},
+				...n.invite_kind === "team_member" ? {
+					policy_team_id: n.policy_team_id ?? void 0,
+					assigned_identity_id: n.assigned_identity_id ?? void 0,
+					reviewed_preview_digest: n.reviewed_preview_digest ?? void 0
+				} : {},
+				...n.invite_kind === "add_device" ? {
+					target_identity_id: n.target_identity_id ?? void 0,
+					reviewed_preview_digest: n.reviewed_preview_digest ?? void 0
+				} : {}
+			}, i = K(r), { token: a, ...p } = n;
 			return e.json({
 				ok: !0,
-				invite: f,
+				invite: p,
 				payload: r,
 				encoded: i,
-				link: U(i)
+				link: q(i)
 			});
+		} catch (t) {
+			if (t instanceof Error && t.message === "invite_operation_intent_conflict") return e.json({ error: "invite_operation_intent_conflict" }, 409);
+			if (t instanceof Error && t.message === "invite_already_bound") return e.json({ error: "invite_already_bound" }, 409);
+			throw t;
 		} finally {
-			await d.close();
+			await j.close();
+		}
+	}), d.post("/v1/invites/inspect", async (e) => {
+		let r = await m(e);
+		if (r == null) return e.json({ error: "body_too_large" }, 413);
+		let i = g(r);
+		if (!i) return e.json({ error: "invalid_json" }, 400);
+		let a = String(i.token ?? "").trim();
+		if (!a) return e.json({ error: "invite_invalid" }, 404);
+		let o = n();
+		try {
+			let n = await o.getInviteByTokenForInspection(a);
+			if (!n || n.revoked_at) return e.json({ error: "invite_invalid" }, 404);
+			if (n.invite_kind === "team_member" || n.invite_kind === "add_device") try {
+				let n = await o.inspectRecipientInvite({
+					token: a,
+					now: t.now()
+				});
+				return n ? e.json(n.kind === "team_member" ? {
+					kind: n.kind,
+					policy_team_id: n.policy_team_id,
+					assigned_identity_id: n.assigned_identity_id,
+					reviewed_preview_digest: n.reviewed_preview_digest,
+					reviewed_intent: n.reviewed_intent,
+					bound: n.bound
+				} : {
+					kind: n.kind,
+					target_identity_id: n.target_identity_id,
+					reviewed_preview_digest: n.reviewed_preview_digest,
+					reviewed_intent: n.reviewed_intent,
+					bound: n.bound
+				}) : e.json({ error: "invite_invalid" }, 404);
+			} catch (t) {
+				let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
+				return e.json({ error: n }, r);
+			}
+			let r = !!(n.operation_id || n.reviewed_project_set_digest);
+			if (new Date(n.expires_at) <= new Date(t.now()) && (!r || !n.consumed_at)) return e.json({ error: "invite_expired" }, 410);
+			if (!n.operation_id) return e.json({
+				kind: "legacy_team_invite",
+				team_name: n.team_name_snapshot
+			});
+			if (!n.project_intent_json || !n.project_summaries_json) return e.json({ error: "invite_invalid" }, 404);
+			let i;
+			try {
+				i = w(n.project_summaries_json);
+			} catch {
+				return e.json({ error: "invite_invalid" }, 409);
+			}
+			return e.json({
+				kind: "project_share_invite",
+				operation_id: n.operation_id,
+				inviter_name: n.inviter_display_name,
+				team_name: n.team_name_snapshot,
+				projects: i,
+				bound: !!n.consumed_at
+			});
+		} finally {
+			await o.close();
 		}
-	}), u.get("/v1/admin/invites", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/invites", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = (e.req.query("group_id") ?? "").trim();
 		if (!a) return e.json({ error: "group_id_required" }, 400);
@@ -1907,10 +2458,66 @@ function Be(e) {
 		} finally {
 			await o.close();
 		}
-	}), u.get("/v1/admin/bootstrap-grants/:grantId", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/project-invites/:operationId", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return e.json({ error: r.error }, 401);
+		let i = String(e.req.param("operationId") ?? "").trim(), a = String(e.req.query("group_id") ?? "").trim();
+		if (!i || !a) return e.json({ error: "operation_id_and_group_id_required" }, 400);
+		let o = n();
+		try {
+			let n = (await o.listInvites(a)).find((e) => e.operation_id === i);
+			if (!n) return e.json({ error: "operation_not_found" }, 404);
+			let r;
+			try {
+				r = C(n.project_intent_json);
+			} catch {
+				return e.json({ error: "operation_intent_invalid" }, 409);
+			}
+			let s = null;
+			if (!n.consumed_at && !n.revoked_at && new Date(n.expires_at) > new Date(t.now()) && n.token && !n.token.startsWith("consumed:")) {
+				let t = r.map((e) => ({
+					display_name: String(e.display_name ?? ""),
+					existing_memory_count: Number(e.existing_memory_count ?? 0)
+				}));
+				s = q(K({
+					v: 1,
+					kind: "coordinator_team_invite",
+					coordinator_url: new URL(e.req.url).origin,
+					group_id: n.group_id,
+					policy: n.policy,
+					token: n.token,
+					expires_at: n.expires_at,
+					team_name: n.team_name_snapshot,
+					operation_id: i,
+					inviter_name: n.inviter_display_name ?? null,
+					project_summaries: t
+				}));
+			}
+			return e.json({
+				operation_id: n.operation_id,
+				group_id: n.group_id,
+				reviewed_project_set_digest: n.reviewed_project_set_digest,
+				state: n.consumed_at ? "accepted" : "waiting_for_acceptance",
+				pending_person_id: n.pending_person_id,
+				recipient_actor_id: n.recipient_actor_id,
+				recipient_display_name: n.recipient_display_name,
+				recipient_device_id: n.bound_device_id,
+				recipient_device_display_name: n.recipient_device_display_name,
+				recipient_public_key: n.bound_public_key,
+				recipient_fingerprint: n.bound_fingerprint,
+				consumed_at: n.consumed_at,
+				bootstrap_grant_id: n.bootstrap_grant_id,
+				trust_state: n.trust_state,
+				projects: r,
+				invite_link: s
+			});
+		} finally {
+			await o.close();
+		}
+	}), d.get("/v1/admin/bootstrap-grants/:grantId", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = String(e.req.param("grantId") ?? "").trim();
 		if (!a) return e.json({ error: "grant_id_required" }, 400);
@@ -1928,10 +2535,10 @@ function Be(e) {
 		} finally {
 			await o.close();
 		}
-	}), u.get("/v1/admin/bootstrap-grants", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.get("/v1/admin/bootstrap-grants", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = (e.req.query("group_id") ?? "").trim();
 		if (!a) return e.json({ error: "group_id_required" }, 400);
@@ -1941,14 +2548,14 @@ function Be(e) {
 		} finally {
 			await o.close();
 		}
-	}), u.post("/v1/admin/bootstrap-grants/revoke", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+	}), d.post("/v1/admin/bootstrap-grants/revoke", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
-		let a = await p(e);
+		let a = await m(e);
 		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = m(a);
+		let o = g(a);
 		if (!o) return e.json({ error: "invalid_json" }, 400);
 		let s = String(o.grant_id ?? "").trim();
 		if (!s) return e.json({ error: "grant_id_required" }, 400);
@@ -1961,18 +2568,18 @@ function Be(e) {
 		} finally {
 			await c.close();
 		}
-	}), u.post("/v1/admin/join-requests/approve", async (e) => Ve(e, !0, {
+	}), d.post("/v1/admin/join-requests/approve", async (e) => Ft(e, !0, {
 		createStore: n,
 		runtime: t,
-		rateLimitedResponse: f
-	})), u.post("/v1/admin/join-requests/deny", async (e) => Ve(e, !1, {
+		rateLimitedResponse: p
+	})), d.post("/v1/admin/join-requests/deny", async (e) => Ft(e, !1, {
 		createStore: n,
 		runtime: t,
-		rateLimitedResponse: f
-	})), u.get("/v1/admin/join-requests", async (e) => {
-		let r = Q(e.req.header(X), t);
-		if (!r.ok) return f(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = f(e, "admin", !0);
+		rateLimitedResponse: p
+	})), d.get("/v1/admin/join-requests", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
 		if (i) return i;
 		let a = (e.req.query("group_id") ?? "").trim();
 		if (!a) return e.json({ error: "group_id_required" }, 400);
@@ -1982,36 +2589,136 @@ function Be(e) {
 		} finally {
 			await o.close();
 		}
-	}), u.post("/v1/join", async (e) => {
-		let r = await p(e);
+	}), d.post("/v1/join", async (e) => {
+		let r = await m(e);
 		if (r == null) return e.json({ error: "body_too_large" }, 413);
-		let i = m(r);
+		let i = g(r);
 		if (!i) return e.json({ error: "invalid_json" }, 400);
-		let a = String(i.token ?? "").trim(), o = String(i.device_id ?? "").trim(), s = String(i.fingerprint ?? "").trim(), c = String(i.public_key ?? "").trim(), l = String(i.display_name ?? "").trim() || null;
+		let a = String(i.token ?? "").trim(), o = String(i.device_id ?? "").trim(), s = String(i.fingerprint ?? "").trim(), c = String(i.public_key ?? "").trim(), l = String(i.display_name ?? "").trim() || null, u = String(i.operation_id ?? "").trim(), d = String(i.recipient_actor_id ?? "").trim(), f = String(i.recipient_display_name ?? "").trim(), p = String(i.device_display_name ?? "").trim();
 		if (!a || !o || !s || !c) return e.json({ error: "token_device_id_fingerprint_public_key_required" }, 400);
-		if (J(c) !== s) return e.json({ error: "fingerprint_mismatch" }, 400);
-		let u = n();
+		if (F(c) !== s) return e.json({ error: "fingerprint_mismatch" }, 400);
+		let _ = n();
 		try {
-			let n = await u.getInviteByToken(a);
-			if (!n) return e.json({ error: "invalid_token" }, 404);
-			let r = await u.getGroup(String(n.group_id));
-			if (!r) return e.json({ error: "group_not_found" }, 404);
-			if (r.archived_at) return e.json({ error: "group_archived" }, 409);
-			if (n.revoked_at) return e.json({ error: "revoked_token" }, 400);
-			let i = String(n.expires_at ?? "");
-			if (i && new Date(i.replace("Z", "+00:00")) <= new Date(t.now())) return e.json({ error: "expired_token" }, 400);
-			let d = String(n.group_id);
-			if (await u.getEnrollment(d, o)) return e.json({
+			let n = await _.getInviteByTokenForInspection(a);
+			if (!n) return e.json({ error: "invite_invalid" }, 404);
+			let r = !!(n.operation_id || n.reviewed_project_set_digest), m = n.invite_kind === "team_member" || n.invite_kind === "add_device";
+			if (n.revoked_at) return e.json({ error: r || m ? "invite_invalid" : "revoked_token" }, 400);
+			if (!n.consumed_at && new Date(n.expires_at) <= new Date(t.now())) return e.json({ error: r || m ? "invite_expired" : "expired_token" }, 410);
+			if (m) {
+				let r = new Set([
+					"token",
+					"invite_kind",
+					"kind",
+					"identity_id",
+					"device_id",
+					"public_key",
+					"fingerprint"
+				]);
+				if (Object.keys(i).some((e) => !r.has(e))) return e.json({ error: "unexpected_recipient_invite_fields" }, 400);
+				let l = String(i.invite_kind ?? i.kind ?? "").trim(), u = String(i.identity_id ?? "").trim();
+				if (!u || l !== n.invite_kind) return e.json({ error: "recipient_invite_binding_required" }, 400);
+				if (u.length > 256 || /[\p{Cc}\p{Cf}]/u.test(u)) return e.json({ error: "identity_id_invalid" }, 400);
+				try {
+					let r = await _.consumeRecipientInvite({
+						token: a,
+						inviteKind: n.invite_kind,
+						identityId: u,
+						deviceId: o,
+						publicKey: c,
+						fingerprint: s,
+						now: t.now()
+					});
+					return e.json({
+						ok: !0,
+						status: r.status,
+						kind: r.invite.invite_kind,
+						group_id: r.invite.group_id,
+						identity_id: r.invite.recipient_actor_id,
+						policy_team_id: r.invite.policy_team_id ?? null,
+						target_identity_id: r.invite.target_identity_id ?? null,
+						assigned_identity_id: r.invite.assigned_identity_id ?? null,
+						reviewed_preview_digest: r.invite.reviewed_preview_digest,
+						reviewed_intent: r.reviewed_intent
+					});
+				} catch (t) {
+					let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
+					return e.json({ error: n }, r);
+				}
+			}
+			if (n.operation_id || n.reviewed_project_set_digest) {
+				let r = new Set([
+					"token",
+					"operation_id",
+					"device_id",
+					"public_key",
+					"fingerprint",
+					"display_name",
+					"recipient_actor_id",
+					"recipient_display_name",
+					"device_display_name"
+				]);
+				if (Object.keys(i).some((e) => !r.has(e))) return e.json({ error: "unexpected_project_invite_fields" }, 400);
+				if (!u || !d || !f || !p) return e.json({ error: "project_invite_identity_required" }, 400);
+				if (String(n.inviter_device_id ?? "").trim() === o) return e.json({ error: "project_invite_self_acceptance_forbidden" }, 409);
+				if (d.length > 256 || /[\p{Cc}\p{Cf}]/u.test(d)) return e.json({ error: "recipient_actor_id_invalid" }, 400);
+				let l, m;
+				try {
+					l = h(f, "recipient_display_name"), m = h(p, "device_display_name");
+				} catch (t) {
+					return e.json({ error: t instanceof Error ? t.message : "project_invite_identity_invalid" }, 400);
+				}
+				try {
+					let n = await _.consumeProjectInvite({
+						token: a,
+						operationId: u,
+						deviceId: o,
+						publicKey: c,
+						fingerprint: s,
+						recipientActorId: d,
+						recipientDisplayName: l,
+						deviceDisplayName: m,
+						now: t.now()
+					});
+					return e.json({
+						ok: !0,
+						status: mt,
+						group_id: n.invite.group_id,
+						operation_id: n.invite.operation_id,
+						trust_state: n.invite.trust_state,
+						bootstrap_grant_id: n.bootstrap_grant?.grant_id ?? null,
+						inviter_device: n.seed_enrollment ? {
+							device_id: n.seed_enrollment.device_id,
+							public_key: n.seed_enrollment.public_key,
+							fingerprint: n.seed_enrollment.fingerprint,
+							display_name: n.seed_enrollment.display_name
+						} : null
+					});
+				} catch (t) {
+					let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
+					return e.json({ error: n }, r);
+				}
+			}
+			if ([
+				"operation_id",
+				"recipient_actor_id",
+				"recipient_display_name",
+				"device_display_name"
+			].some((e) => Object.hasOwn(i, e))) return e.json({ error: "unexpected_project_invite_fields" }, 400);
+			let g = await _.getGroup(String(n.group_id));
+			if (!g) return e.json({ error: "group_not_found" }, 404);
+			if (g.archived_at) return e.json({ error: "group_archived" }, 409);
+			let v = String(n.group_id);
+			if (await _.getEnrollment(v, o)) return e.json({
 				ok: !0,
 				status: "already_enrolled",
 				group_id: n.group_id,
 				policy: n.policy
 			});
-			let f = String(n.policy);
-			if (!["auto_admit", "approval_required"].includes(f)) return e.json({ error: `unknown invite policy: ${f}` }, 400);
-			if (f === "approval_required") {
-				let t = await u.createJoinRequest({
-					groupId: d,
+			let y = String(n.policy);
+			if (!["auto_admit", "approval_required"].includes(y)) return e.json({ error: `unknown invite policy: ${y}` }, 400);
+			if (y === "approval_required") {
+				let t = await _.createJoinRequest({
+					groupId: v,
 					deviceId: o,
 					publicKey: c,
 					fingerprint: s,
@@ -2026,7 +2733,7 @@ function Be(e) {
 					request_id: t.request_id
 				});
 			}
-			return await u.enrollDevice(d, {
+			return await _.enrollDevice(v, {
 				deviceId: o,
 				fingerprint: s,
 				publicKey: c,
@@ -2038,12 +2745,12 @@ function Be(e) {
 				policy: n.policy
 			});
 		} finally {
-			await u.close();
+			await _.close();
 		}
-	}), u;
+	}), d;
 }
-async function Ve(e, t, n) {
-	let r = Q(e.req.header(X), n.runtime);
+async function Ft(e, t, n) {
+	let r = Z(e.req.header(X), n.runtime);
 	if (!r.ok) return n.rateLimitedResponse(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
 	let i = n.rateLimitedResponse(e, "admin", !0);
 	if (i) return i;
@@ -2106,6 +2813,6 @@ async function Ve(e, t, n) {
 	}
 }
 //#endregion
-export { q as a, H as c, t as d, K as i, Oe as l, J as n, Ne as o, Pe as r, De as s, Be as t, U as u };
+export { r as A, _ as C, f as D, v as E, s as F, o as M, l as N, u as O, a as P, P as S, h as T, b as _, Tt as a, ce as b, gt as c, ft as d, K as f, y as g, F as h, Et as i, c as j, p as k, _t as l, q as m, Dt as n, mt as o, pt as p, wt as r, ht as s, Pt as t, vt as u, oe as v, g as w, se as x, M as y };
 
-//# sourceMappingURL=coordinator-api-hZ1RVJUN.js.map
+//# sourceMappingURL=coordinator-api-Btb6CEhw.js.map