@codemem/core 0.40.0-alpha.1 → 0.40.1

package/dist/coordinator-api-Btb6CEhw.js

@@ -1,2818 +0,0 @@
-import { createHash as e } from "node:crypto";
-//#region src/coordinator-membership-effects.ts
-var t = "scope_membership_effect_conflict", n = {
-	device_not_enrolled: "device must be enrolled and enabled in the scope group.",
-	scope_group_mismatch: "membership groupId must match the scope groupId.",
-	scope_inactive: "scope is not active.",
-	scope_not_found: "scopeId must reference an existing scope."
-}, r = class extends Error {
-	code;
-	constructor(e) {
-		super(n[e]), this.name = "CoordinatorMembershipError", this.code = e;
-	}
-};
-function i(e) {
-	return e?.trim() || null;
-}
-function a(e) {
-	let t = i(e);
-	if (!t) throw Error("effectId is required.");
-	if (t.length > 512 || /[\p{Cc}\p{Cf}]/u.test(t)) throw Error("effectId is invalid.");
-	return t;
-}
-function o(e) {
-	return JSON.stringify({
-		scopeId: i(e.scopeId),
-		deviceId: i(e.deviceId),
-		role: i(e.role),
-		membershipEpoch: e.membershipEpoch ?? null,
-		coordinatorId: i(e.coordinatorId),
-		groupId: i(e.groupId),
-		manifestIssuerDeviceId: i(e.manifestIssuerDeviceId),
-		manifestHash: i(e.manifestHash),
-		signedManifestJson: i(e.signedManifestJson),
-		actorType: i(e.actorType),
-		actorId: i(e.actorId)
-	});
-}
-function s(e) {
-	return JSON.stringify({
-		scopeId: i(e.scopeId),
-		deviceId: i(e.deviceId),
-		groupId: i(e.groupId),
-		membershipEpoch: e.membershipEpoch ?? null,
-		manifestHash: i(e.manifestHash),
-		signedManifestJson: i(e.signedManifestJson),
-		actorType: i(e.actorType),
-		actorId: i(e.actorId)
-	});
-}
-function c(e, n, r) {
-	if (e.action !== n || e.request_json !== r) throw Error(t);
-}
-function l(e) {
-	if (e.action !== "grant" || e.outcome_applied !== 1 || e.role == null || e.status == null || e.membership_epoch == null || e.updated_at == null) throw Error("scope_membership_effect_receipt_invalid");
-	return {
-		scope_id: e.scope_id,
-		device_id: e.device_id,
-		role: e.role,
-		status: e.status,
-		membership_epoch: e.membership_epoch,
-		coordinator_id: e.coordinator_id,
-		group_id: e.group_id,
-		manifest_issuer_device_id: e.manifest_issuer_device_id,
-		manifest_hash: e.manifest_hash,
-		signed_manifest_json: e.signed_manifest_json,
-		updated_at: e.updated_at
-	};
-}
-//#endregion
-//#region src/coordinator-store-contract.ts
-function u(e) {
-	let t = e.trim(), n = new Date(t);
-	if (!t || Number.isNaN(n.getTime())) throw Error("expiresAt must be a valid date.");
-	return n.toISOString();
-}
-var d = /^identity:[A-Za-z0-9_-]{18,24}$/u;
-function f(e) {
-	return typeof e == "string" && e === e.trim() && d.test(e);
-}
-function p(e) {
-	return String(e.kind === "team_member" ? e.assigned_identity_id ?? "" : e.target_identity_id ?? "").trim();
-}
-//#endregion
-//#region src/project-invite-identity.ts
-var m = 120;
-function h(e, t) {
-	if ([...e].some((e) => /[\p{Cc}\p{Cf}]/u.test(e))) throw Error(`${t}_invalid`);
-	let n = e.replace(/\s+/gu, " ").trim();
-	if (!n) throw Error(`${t}_required`);
-	if ([...n].length > m) throw Error(`${t}_too_long`);
-	return n;
-}
-function g(e) {
-	let t = String(e ?? "").replace(/\.local$/iu, "");
-	return t.trim() ? h(t.replace(/[-_]+/gu, " "), "device_display_name") : null;
-}
-function _(e) {
-	for (let t of [
-		e.explicitName,
-		e.osName,
-		e.coordinatorName
-	]) {
-		let e = g(t);
-		if (e) return e;
-	}
-	let t = String(e.fallbackSeed ?? "").replace(/[^a-z0-9]/giu, "").slice(0, 6);
-	return t ? `Codemem device ${t}` : "Codemem device";
-}
-function v(e) {
-	if (!Array.isArray(e) || e.length === 0 || e.length > 100) throw Error("project_summaries_invalid");
-	return e.map((e) => {
-		if (!e || typeof e != "object" || Array.isArray(e)) throw Error("project_summaries_invalid");
-		let t = e;
-		if (!Number.isSafeInteger(t.existing_memory_count) || Number(t.existing_memory_count) < 0) throw Error("project_summaries_invalid");
-		return {
-			display_name: h(String(t.display_name ?? ""), "project_name"),
-			existing_memory_count: Number(t.existing_memory_count)
-		};
-	});
-}
-//#endregion
-//#region src/recipient-reviewed-intent.ts
-var y = 1, b = class extends Error {
-	code;
-	constructor(e) {
-		super(e), this.name = "RecipientReviewedIntentError", this.code = e;
-	}
-}, x = /[\p{Cc}\p{Cf}]/u, S = 100, C = 64 * 1024;
-function w() {
-	throw new b("recipient_reviewed_intent_invalid");
-}
-function T(e) {
-	return (!e || typeof e != "object" || Array.isArray(e)) && w(), e;
-}
-function E(e, t) {
-	Object.keys(e).some((e) => !t.includes(e)) && w();
-}
-function D(e, t) {
-	return (typeof e != "string" || !e || e !== e.trim() || e.length > t || x.test(e)) && w(), e;
-}
-function O(e) {
-	(typeof e != "string" || x.test(e)) && w();
-	let t = e.trim().replace(/\s+/gu, " ");
-	return (!t || t.length > 256) && w(), t;
-}
-function k(e) {
-	typeof e != "string" && w();
-	try {
-		return h(e, "identity_display_name");
-	} catch {
-		return w();
-	}
-}
-function A(e) {
-	return (typeof e != "number" || !Number.isSafeInteger(e) || e < 0) && w(), e;
-}
-function j(e, t) {
-	return e < t ? -1 : +(e > t);
-}
-function ee(e) {
-	return e.kind === "direct" ? "direct" : `team\u0000${e.teamId}`;
-}
-function te(e) {
-	let t = T(e);
-	return t.kind === "direct" ? (E(t, ["kind"]), { kind: "direct" }) : (t.kind !== "team" && w(), E(t, [
-		"kind",
-		"teamId",
-		"displayName"
-	]), {
-		kind: "team",
-		teamId: D(t.teamId, 256),
-		displayName: O(t.displayName)
-	});
-}
-function ne(e) {
-	let t = T(e);
-	E(t, [
-		"canonicalProjectIdentity",
-		"displayName",
-		"existingMemoryCount",
-		"futureMemoriesShared",
-		"sources"
-	]), (t.futureMemoriesShared !== !0 || !Array.isArray(t.sources) || !t.sources.length) && w();
-	let n = t.sources.map(te).toSorted((e, t) => j(ee(e), ee(t)));
-	return new Set(n.map(ee)).size !== n.length && w(), {
-		canonicalProjectIdentity: D(t.canonicalProjectIdentity, 512),
-		displayName: O(t.displayName),
-		existingMemoryCount: A(t.existingMemoryCount),
-		futureMemoriesShared: !0,
-		sources: n
-	};
-}
-function re(e) {
-	let t = T(e);
-	return E(t, [
-		"canonicalProjectIdentity",
-		"displayName",
-		"existingMemoryCount"
-	]), {
-		canonicalProjectIdentity: D(t.canonicalProjectIdentity, 512),
-		displayName: O(t.displayName),
-		existingMemoryCount: A(t.existingMemoryCount)
-	};
-}
-function ie(e) {
-	(!Array.isArray(e.projects) || !Array.isArray(e.excludedProjects) || e.projects.length > S) && w();
-	let t = e.projects.map(ne).toSorted((e, t) => j(e.canonicalProjectIdentity, t.canonicalProjectIdentity)), n = e.excludedProjects.map(re).toSorted((e, t) => j(e.canonicalProjectIdentity, t.canonicalProjectIdentity)), r = t.map((e) => e.canonicalProjectIdentity), i = n.map((e) => e.canonicalProjectIdentity);
-	return (new Set(r).size !== r.length || new Set(i).size !== i.length || i.some((e) => r.includes(e))) && w(), {
-		projects: t,
-		excludedProjects: n
-	};
-}
-function ae(e, t) {
-	if (!(e.journey === "team" && t.kind === "team_member" && e.team.teamId === t.policyTeamId || e.journey === "add_device" && t.kind === "add_device" && e.targetIdentity.identityId === t.targetIdentityId)) throw new b("recipient_invite_intent_mismatch");
-}
-function M(e, t) {
-	let n = T(e);
-	n.version !== 1 && w();
-	let r = ie(n), i;
-	if (n.journey === "team") {
-		E(n, [
-			"version",
-			"journey",
-			"team",
-			"projects",
-			"excludedProjects"
-		]);
-		let e = T(n.team);
-		E(e, [
-			"teamId",
-			"displayName",
-			"futureProjectsInherit"
-		]), e.futureProjectsInherit !== !0 && w(), i = {
-			version: 1,
-			journey: "team",
-			team: {
-				teamId: D(e.teamId, 256),
-				displayName: O(e.displayName),
-				futureProjectsInherit: !0
-			},
-			...r
-		};
-	} else if (n.journey === "add_device") {
-		E(n, [
-			"version",
-			"journey",
-			"targetIdentity",
-			"projects",
-			"excludedProjects"
-		]);
-		let e = T(n.targetIdentity);
-		E(e, ["identityId", "displayName"]), i = {
-			version: 1,
-			journey: "add_device",
-			targetIdentity: {
-				identityId: D(e.identityId, 256),
-				displayName: k(e.displayName)
-			},
-			...r
-		};
-	} else w();
-	return t && ae(i, t), new TextEncoder().encode(N(i)).byteLength > C && w(), i;
-}
-function N(e) {
-	return Array.isArray(e) ? `[${e.map(N).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).toSorted(([e], [t]) => j(e, t)).map(([e, t]) => `${JSON.stringify(e)}:${N(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
-}
-function oe(e, t) {
-	return N(M(e, t));
-}
-async function se(e, t) {
-	let n = oe(e, t), r = new TextEncoder().encode(`recipient-reviewed-intent-v1\n${n}`), i = await globalThis.crypto.subtle.digest("SHA-256", r);
-	return Array.from(new Uint8Array(i), (e) => e.toString(16).padStart(2, "0")).join("");
-}
-async function P(e, t) {
-	let n = M(e, t.target);
-	if (await se(n) !== t.digest) throw new b("recipient_invite_intent_mismatch");
-	return n;
-}
-async function ce(e, t) {
-	if (!e) throw Error("recipient_invite_review_unavailable");
-	let n;
-	try {
-		n = JSON.parse(e);
-	} catch {
-		throw Error("recipient_invite_review_unavailable");
-	}
-	try {
-		let r = M(n, t.target);
-		if (N(r) !== e) throw Error("recipient_invite_review_unavailable");
-		return await P(r, t);
-	} catch (e) {
-		throw e instanceof b && e.code === "recipient_invite_intent_mismatch" || e instanceof Error && e.message === "recipient_invite_review_unavailable" ? e : Error("recipient_invite_review_unavailable");
-	}
-}
-//#endregion
-//#region src/sync-fingerprint.ts
-function F(t) {
-	return e("sha256").update(t, "utf-8").digest("hex");
-}
-//#endregion
-//#region ../../node_modules/.pnpm/hono@4.12.26/node_modules/hono/dist/compose.js
-var le = (e, t, n) => (r, i) => {
-	let a = -1;
-	return o(0);
-	async function o(s) {
-		if (s <= a) throw Error("next() called multiple times");
-		a = s;
-		let c, l = !1, u;
-		if (e[s] ? (u = e[s][0][0], r.req.routeIndex = s) : u = s === e.length && i || void 0, u) try {
-			c = await u(r, () => o(s + 1));
-		} catch (e) {
-			if (e instanceof Error && t) r.error = e, c = await t(e, r), l = !0;
-			else throw e;
-		}
-		else r.finalized === !1 && n && (c = await n(r));
-		return c && (r.finalized === !1 || l) && (r.res = c), r;
-	}
-}, ue = /* @__PURE__ */ Symbol(), de = async (e, t = /* @__PURE__ */ Object.create(null)) => {
-	let { all: n = !1, dot: r = !1 } = t, i = (e instanceof je ? e.raw.headers : e.headers).get("Content-Type");
-	return i?.startsWith("multipart/form-data") || i?.startsWith("application/x-www-form-urlencoded") ? fe(e, {
-		all: n,
-		dot: r
-	}) : {};
-};
-async function fe(e, t) {
-	let n = await e.formData();
-	return n ? pe(n, t) : {};
-}
-function pe(e, t) {
-	let n = /* @__PURE__ */ Object.create(null);
-	return e.forEach((e, r) => {
-		t.all || r.endsWith("[]") ? me(n, r, e) : n[r] = e;
-	}), t.dot && Object.entries(n).forEach(([e, t]) => {
-		e.includes(".") && (he(n, e, t), delete n[e]);
-	}), n;
-}
-var me = (e, t, n) => {
-	e[t] === void 0 ? t.endsWith("[]") ? e[t] = [n] : e[t] = n : Array.isArray(e[t]) ? e[t].push(n) : e[t] = [e[t], n];
-}, he = (e, t, n) => {
-	if (/(?:^|\.)__proto__\./.test(t)) return;
-	let r = e, i = t.split(".");
-	i.forEach((e, t) => {
-		t === i.length - 1 ? r[e] = n : ((!r[e] || typeof r[e] != "object" || Array.isArray(r[e]) || r[e] instanceof File) && (r[e] = /* @__PURE__ */ Object.create(null)), r = r[e]);
-	});
-}, ge = (e) => {
-	let t = e.split("/");
-	return t[0] === "" && t.shift(), t;
-}, _e = (e) => {
-	let { groups: t, path: n } = ve(e);
-	return ye(ge(n), t);
-}, ve = (e) => {
-	let t = [];
-	return e = e.replace(/\{[^}]+\}/g, (e, n) => {
-		let r = `@${n}`;
-		return t.push([r, e]), r;
-	}), {
-		groups: t,
-		path: e
-	};
-}, ye = (e, t) => {
-	for (let n = t.length - 1; n >= 0; n--) {
-		let [r] = t[n];
-		for (let i = e.length - 1; i >= 0; i--) if (e[i].includes(r)) {
-			e[i] = e[i].replace(r, t[n][1]);
-			break;
-		}
-	}
-	return e;
-}, I = {}, be = (e, t) => {
-	if (e === "*") return "*";
-	let n = e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
-	if (n) {
-		let r = `${e}#${t}`;
-		return I[r] || (n[2] ? I[r] = t && t[0] !== ":" && t[0] !== "*" ? [
-			r,
-			n[1],
-			RegExp(`^${n[2]}(?=/${t})`)
-		] : [
-			e,
-			n[1],
-			RegExp(`^${n[2]}$`)
-		] : I[r] = [
-			e,
-			n[1],
-			!0
-		]), I[r];
-	}
-	return null;
-}, L = (e, t) => {
-	try {
-		return t(e);
-	} catch {
-		return e.replace(/(?:%[0-9A-Fa-f]{2})+/g, (e) => {
-			try {
-				return t(e);
-			} catch {
-				return e;
-			}
-		});
-	}
-}, xe = (e) => L(e, decodeURI), Se = (e) => {
-	let t = e.url, n = t.indexOf("/", t.indexOf(":") + 4), r = n;
-	for (; r < t.length; r++) {
-		let e = t.charCodeAt(r);
-		if (e === 37) {
-			let e = t.indexOf("?", r), i = t.indexOf("#", r), a = e === -1 ? i === -1 ? void 0 : i : i === -1 ? e : Math.min(e, i), o = t.slice(n, a);
-			return xe(o.includes("%25") ? o.replace(/%25/g, "%2525") : o);
-		} else if (e === 63 || e === 35) break;
-	}
-	return t.slice(n, r);
-}, Ce = (e) => {
-	let t = Se(e);
-	return t.length > 1 && t.at(-1) === "/" ? t.slice(0, -1) : t;
-}, R = (e, t, ...n) => (n.length && (t = R(t, ...n)), `${e?.[0] === "/" ? "" : "/"}${e}${t === "/" ? "" : `${e?.at(-1) === "/" ? "" : "/"}${t?.[0] === "/" ? t.slice(1) : t}`}`), we = (e) => {
-	if (e.charCodeAt(e.length - 1) !== 63 || !e.includes(":")) return null;
-	let t = e.split("/"), n = [], r = "";
-	return t.forEach((e) => {
-		if (e !== "" && !/\:/.test(e)) r += "/" + e;
-		else if (/\:/.test(e)) if (/\?/.test(e)) {
-			n.length === 0 && r === "" ? n.push("/") : n.push(r);
-			let t = e.replace("?", "");
-			r += "/" + t, n.push(r);
-		} else r += "/" + e;
-	}), n.filter((e, t, n) => n.indexOf(e) === t);
-}, Te = (e) => /[%+]/.test(e) ? (e.indexOf("+") !== -1 && (e = e.replace(/\+/g, " ")), e.indexOf("%") === -1 ? e : L(e, ke)) : e, Ee = (e, t, n) => {
-	let r;
-	if (!n && t && !/[%+]/.test(t)) {
-		let n = e.indexOf("?", 8);
-		if (n === -1) return;
-		for (e.startsWith(t, n + 1) || (n = e.indexOf(`&${t}`, n + 1)); n !== -1;) {
-			let r = e.charCodeAt(n + t.length + 1);
-			if (r === 61) {
-				let r = n + t.length + 2, i = e.indexOf("&", r);
-				return Te(e.slice(r, i === -1 ? void 0 : i));
-			} else if (r == 38 || isNaN(r)) return "";
-			n = e.indexOf(`&${t}`, n + 1);
-		}
-		if (r = /[%+]/.test(e), !r) return;
-	}
-	let i = {};
-	r ??= /[%+]/.test(e);
-	let a = e.indexOf("?", 8);
-	for (; a !== -1;) {
-		let t = e.indexOf("&", a + 1), o = e.indexOf("=", a);
-		o > t && t !== -1 && (o = -1);
-		let s = e.slice(a + 1, o === -1 ? t === -1 ? void 0 : t : o);
-		if (r && (s = Te(s)), a = t, s === "") continue;
-		let c;
-		o === -1 ? c = "" : (c = e.slice(o + 1, t === -1 ? void 0 : t), r && (c = Te(c))), n ? (i[s] && Array.isArray(i[s]) || (i[s] = []), i[s].push(c)) : i[s] ??= c;
-	}
-	return t ? i[t] : i;
-}, De = Ee, Oe = (e, t) => Ee(e, t, !0), ke = decodeURIComponent, Ae = (e) => L(e, ke), je = class {
-	raw;
-	#e;
-	#t;
-	routeIndex = 0;
-	path;
-	bodyCache = {};
-	constructor(e, t = "/", n = [[]]) {
-		this.raw = e, this.path = t, this.#t = n, this.#e = {};
-	}
-	param(e) {
-		return e ? this.#n(e) : this.#r();
-	}
-	#n(e) {
-		let t = this.#t[0][this.routeIndex][1][e], n = this.#i(t);
-		return n && /\%/.test(n) ? Ae(n) : n;
-	}
-	#r() {
-		let e = {}, t = Object.keys(this.#t[0][this.routeIndex][1]);
-		for (let n of t) {
-			let t = this.#i(this.#t[0][this.routeIndex][1][n]);
-			t !== void 0 && (e[n] = /\%/.test(t) ? Ae(t) : t);
-		}
-		return e;
-	}
-	#i(e) {
-		return this.#t[1] ? this.#t[1][e] : e;
-	}
-	query(e) {
-		return De(this.url, e);
-	}
-	queries(e) {
-		return Oe(this.url, e);
-	}
-	header(e) {
-		if (e) return this.raw.headers.get(e) ?? void 0;
-		let t = {};
-		return this.raw.headers.forEach((e, n) => {
-			t[n] = e;
-		}), t;
-	}
-	async parseBody(e) {
-		return de(this, e);
-	}
-	#a = (e) => {
-		let { bodyCache: t, raw: n } = this, r = t[e];
-		if (r) return r;
-		let i = Object.keys(t)[0];
-		return i ? t[i].then((t) => (i === "json" && (t = JSON.stringify(t)), new Response(t)[e]())) : t[e] = n[e]();
-	};
-	json() {
-		return this.#a("text").then((e) => JSON.parse(e));
-	}
-	text() {
-		return this.#a("text");
-	}
-	arrayBuffer() {
-		return this.#a("arrayBuffer");
-	}
-	bytes() {
-		return this.#a("arrayBuffer").then((e) => new Uint8Array(e));
-	}
-	blob() {
-		return this.#a("blob");
-	}
-	formData() {
-		return this.#a("formData");
-	}
-	addValidatedData(e, t) {
-		this.#e[e] = t;
-	}
-	valid(e) {
-		return this.#e[e];
-	}
-	get url() {
-		return this.raw.url;
-	}
-	get method() {
-		return this.raw.method;
-	}
-	get [ue]() {
-		return this.#t;
-	}
-	get matchedRoutes() {
-		return this.#t[0].map(([[, e]]) => e);
-	}
-	get routePath() {
-		return this.#t[0].map(([[, e]]) => e)[this.routeIndex].path;
-	}
-}, Me = {
-	Stringify: 1,
-	BeforeStream: 2,
-	Stream: 3
-}, Ne = (e, t) => {
-	let n = new String(e);
-	return n.isEscaped = !0, n.callbacks = t, n;
-}, Pe = async (e, t, n, r, i) => {
-	typeof e == "object" && !(e instanceof String) && (e instanceof Promise || (e = e.toString()), e instanceof Promise && (e = await e));
-	let a = e.callbacks;
-	if (!a?.length) return Promise.resolve(e);
-	i ? i[0] += e : i = [e];
-	let o = Promise.all(a.map((e) => e({
-		phase: t,
-		buffer: i,
-		context: r
-	}))).then((e) => Promise.all(e.filter(Boolean).map((e) => Pe(e, t, !1, r, i))).then(() => i[0]));
-	return n ? Ne(await o, a) : o;
-}, Fe = "text/plain; charset=UTF-8", Ie = (e, t) => ({
-	"Content-Type": e,
-	...t
-}), z = (e, t) => new Response(e, t), Le = class {
-	#e;
-	#t;
-	env = {};
-	#n;
-	finalized = !1;
-	error;
-	#r;
-	#i;
-	#a;
-	#o;
-	#s;
-	#c;
-	#l;
-	#u;
-	#d;
-	constructor(e, t) {
-		this.#e = e, t && (this.#i = t.executionCtx, this.env = t.env, this.#c = t.notFoundHandler, this.#d = t.path, this.#u = t.matchResult);
-	}
-	get req() {
-		return this.#t ??= new je(this.#e, this.#d, this.#u), this.#t;
-	}
-	get event() {
-		if (this.#i && "respondWith" in this.#i) return this.#i;
-		throw Error("This context has no FetchEvent");
-	}
-	get executionCtx() {
-		if (this.#i) return this.#i;
-		throw Error("This context has no ExecutionContext");
-	}
-	get res() {
-		return this.#a ||= z(null, { headers: this.#l ??= new Headers() });
-	}
-	set res(e) {
-		if (this.#a && e) {
-			e = z(e.body, e);
-			for (let [t, n] of this.#a.headers.entries()) if (t !== "content-type") if (t === "set-cookie") {
-				let t = this.#a.headers.getSetCookie();
-				e.headers.delete("set-cookie");
-				for (let n of t) e.headers.append("set-cookie", n);
-			} else e.headers.set(t, n);
-		}
-		this.#a = e, this.finalized = !0;
-	}
-	render = (...e) => (this.#s ??= (e) => this.html(e), this.#s(...e));
-	setLayout = (e) => this.#o = e;
-	getLayout = () => this.#o;
-	setRenderer = (e) => {
-		this.#s = e;
-	};
-	header = (e, t, n) => {
-		this.finalized && (this.#a = z(this.#a.body, this.#a));
-		let r = this.#a ? this.#a.headers : this.#l ??= new Headers();
-		t === void 0 ? r.delete(e) : n?.append ? r.append(e, t) : r.set(e, t);
-	};
-	status = (e) => {
-		this.#r = e;
-	};
-	set = (e, t) => {
-		this.#n ??= /* @__PURE__ */ new Map(), this.#n.set(e, t);
-	};
-	get = (e) => this.#n ? this.#n.get(e) : void 0;
-	get var() {
-		return this.#n ? Object.fromEntries(this.#n) : {};
-	}
-	#f(e, t, n) {
-		let r = this.#a ? new Headers(this.#a.headers) : this.#l ?? new Headers();
-		if (typeof t == "object" && "headers" in t) {
-			let e = t.headers instanceof Headers ? t.headers : new Headers(t.headers);
-			for (let [t, n] of e) t.toLowerCase() === "set-cookie" ? r.append(t, n) : r.set(t, n);
-		}
-		if (n) for (let [e, t] of Object.entries(n)) if (typeof t == "string") r.set(e, t);
-		else {
-			r.delete(e);
-			for (let n of t) r.append(e, n);
-		}
-		return z(e, {
-			status: typeof t == "number" ? t : t?.status ?? this.#r,
-			headers: r
-		});
-	}
-	newResponse = (...e) => this.#f(...e);
-	body = (e, t, n) => this.#f(e, t, n);
-	text = (e, t, n) => !this.#l && !this.#r && !t && !n && !this.finalized ? new Response(e) : this.#f(e, t, Ie(Fe, n));
-	json = (e, t, n) => this.#f(JSON.stringify(e), t, Ie("application/json", n));
-	html = (e, t, n) => {
-		let r = (e) => this.#f(e, t, Ie("text/html; charset=UTF-8", n));
-		return typeof e == "object" ? Pe(e, Me.Stringify, !1, {}).then(r) : r(e);
-	};
-	redirect = (e, t) => {
-		let n = String(e);
-		return this.header("Location", /[^\x00-\xFF]/.test(n) ? encodeURI(n) : n), this.newResponse(null, t ?? 302);
-	};
-	notFound = () => (this.#c ??= () => z(), this.#c(this));
-}, Re = [
-	"get",
-	"post",
-	"put",
-	"delete",
-	"options",
-	"patch"
-], ze = "Can not add a route since the matcher is already built.", Be = class extends Error {}, Ve = "__COMPOSED_HANDLER", He = (e) => e.text("404 Not Found", 404), Ue = (e, t) => {
-	if ("getResponse" in e) {
-		let n = e.getResponse();
-		return t.newResponse(n.body, n);
-	}
-	return console.error(e), t.text("Internal Server Error", 500);
-}, We = class e {
-	get;
-	post;
-	put;
-	delete;
-	options;
-	patch;
-	all;
-	on;
-	use;
-	router;
-	getPath;
-	_basePath = "/";
-	#e = "/";
-	routes = [];
-	constructor(e = {}) {
-		[...Re, "all"].forEach((e) => {
-			this[e] = (t, ...n) => (typeof t == "string" ? this.#e = t : this.#r(e, this.#e, t), n.forEach((t) => {
-				this.#r(e, this.#e, t);
-			}), this);
-		}), this.on = (e, t, ...n) => {
-			for (let r of [t].flat()) {
-				this.#e = r;
-				for (let t of [e].flat()) n.map((e) => {
-					this.#r(t.toUpperCase(), this.#e, e);
-				});
-			}
-			return this;
-		}, this.use = (e, ...t) => (typeof e == "string" ? this.#e = e : (this.#e = "*", t.unshift(e)), t.forEach((e) => {
-			this.#r("ALL", this.#e, e);
-		}), this);
-		let { strict: t, ...n } = e;
-		Object.assign(this, n), this.getPath = t ?? !0 ? e.getPath ?? Se : Ce;
-	}
-	#t() {
-		let t = new e({
-			router: this.router,
-			getPath: this.getPath
-		});
-		return t.errorHandler = this.errorHandler, t.#n = this.#n, t.routes = this.routes, t;
-	}
-	#n = He;
-	errorHandler = Ue;
-	route(e, t) {
-		let n = this.basePath(e);
-		return t.routes.map((e) => {
-			let r;
-			t.errorHandler === Ue ? r = e.handler : (r = async (n, r) => (await le([], t.errorHandler)(n, () => e.handler(n, r))).res, r[Ve] = e.handler), n.#r(e.method, e.path, r, e.basePath);
-		}), this;
-	}
-	basePath(e) {
-		let t = this.#t();
-		return t._basePath = R(this._basePath, e), t;
-	}
-	onError = (e) => (this.errorHandler = e, this);
-	notFound = (e) => (this.#n = e, this);
-	mount(e, t, n) {
-		let r, i;
-		n && (typeof n == "function" ? i = n : (i = n.optionHandler, r = n.replaceRequest === !1 ? (e) => e : n.replaceRequest));
-		let a = i ? (e) => {
-			let t = i(e);
-			return Array.isArray(t) ? t : [t];
-		} : (e) => {
-			let t;
-			try {
-				t = e.executionCtx;
-			} catch {}
-			return [e.env, t];
-		};
-		return r ||= (() => {
-			let t = R(this._basePath, e), n = t === "/" ? 0 : t.length;
-			return (e) => {
-				let t = new URL(e.url);
-				return t.pathname = this.getPath(e).slice(n) || "/", new Request(t, e);
-			};
-		})(), this.#r("ALL", R(e, "*"), async (e, n) => {
-			let i = await t(r(e.req.raw), ...a(e));
-			if (i) return i;
-			await n();
-		}), this;
-	}
-	#r(e, t, n, r) {
-		e = e.toUpperCase(), t = R(this._basePath, t);
-		let i = {
-			basePath: r === void 0 ? this._basePath : R(this._basePath, r),
-			path: t,
-			method: e,
-			handler: n
-		};
-		this.router.add(e, t, [n, i]), this.routes.push(i);
-	}
-	#i(e, t) {
-		if (e instanceof Error) return this.errorHandler(e, t);
-		throw e;
-	}
-	#a(e, t, n, r) {
-		if (r === "HEAD") return (async () => new Response(null, await this.#a(e, t, n, "GET")))();
-		let i = this.getPath(e, { env: n }), a = this.router.match(r, i), o = new Le(e, {
-			path: i,
-			matchResult: a,
-			env: n,
-			executionCtx: t,
-			notFoundHandler: this.#n
-		});
-		if (a[0].length === 1) {
-			let e;
-			try {
-				e = a[0][0][0][0](o, async () => {
-					o.res = await this.#n(o);
-				});
-			} catch (e) {
-				return this.#i(e, o);
-			}
-			return e instanceof Promise ? e.then((e) => e || (o.finalized ? o.res : this.#n(o))).catch((e) => this.#i(e, o)) : e ?? this.#n(o);
-		}
-		let s = le(a[0], this.errorHandler, this.#n);
-		return (async () => {
-			try {
-				let e = await s(o);
-				if (!e.finalized) throw Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
-				return e.res;
-			} catch (e) {
-				return this.#i(e, o);
-			}
-		})();
-	}
-	fetch = (e, ...t) => this.#a(e, t[1], t[0], e.method);
-	request = (e, t, n, r) => e instanceof Request ? this.fetch(t ? new Request(e, t) : e, n, r) : (e = e.toString(), this.fetch(new Request(/^https?:\/\//.test(e) ? e : `http://localhost${R("/", e)}`, t), n, r));
-	fire = () => {
-		addEventListener("fetch", (e) => {
-			e.respondWith(this.#a(e.request, e, void 0, e.request.method));
-		});
-	};
-}, Ge = [];
-function Ke(e, t) {
-	let n = this.buildAllMatchers(), r = ((e, t) => {
-		let r = n[e] || n.ALL, i = r[2][t];
-		if (i) return i;
-		let a = t.match(r[0]);
-		if (!a) return [[], Ge];
-		let o = a.indexOf("", 1);
-		return [r[1][o], a];
-	});
-	return this.match = r, r(e, t);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/hono@4.12.26/node_modules/hono/dist/router/reg-exp-router/node.js
-var B = "[^/]+", V = ".*", H = "(?:|/.*)", U = /* @__PURE__ */ Symbol(), qe = /* @__PURE__ */ new Set(".\\+*[^]$()");
-function Je(e, t) {
-	return e.length === 1 ? t.length === 1 ? e < t ? -1 : 1 : -1 : t.length === 1 || e === V || e === H ? 1 : t === V || t === H ? -1 : e === B ? 1 : t === B ? -1 : e.length === t.length ? e < t ? -1 : 1 : t.length - e.length;
-}
-var Ye = class e {
-	#e;
-	#t;
-	#n = /* @__PURE__ */ Object.create(null);
-	insert(t, n, r, i, a) {
-		if (t.length === 0) {
-			if (this.#e !== void 0) throw U;
-			if (a) return;
-			this.#e = n;
-			return;
-		}
-		let [o, ...s] = t, c = o === "*" ? s.length === 0 ? [
-			"",
-			"",
-			V
-		] : [
-			"",
-			"",
-			B
-		] : o === "/*" ? [
-			"",
-			"",
-			H
-		] : o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/), l;
-		if (c) {
-			let t = c[1], n = c[2] || B;
-			if (t && c[2] && (n === ".*" || (n = n.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:"), /\((?!\?:)/.test(n)))) throw U;
-			if (l = this.#n[n], !l) {
-				if (Object.keys(this.#n).some((e) => e !== V && e !== H)) throw U;
-				if (a) return;
-				l = this.#n[n] = new e(), t !== "" && (l.#t = i.varIndex++);
-			}
-			!a && t !== "" && r.push([t, l.#t]);
-		} else if (l = this.#n[o], !l) {
-			if (Object.keys(this.#n).some((e) => e.length > 1 && e !== V && e !== H)) throw U;
-			if (a) return;
-			l = this.#n[o] = new e();
-		}
-		l.insert(s, n, r, i, a);
-	}
-	buildRegExpStr() {
-		let e = Object.keys(this.#n).sort(Je).map((e) => {
-			let t = this.#n[e];
-			return (typeof t.#t == "number" ? `(${e})@${t.#t}` : qe.has(e) ? `\\${e}` : e) + t.buildRegExpStr();
-		});
-		return typeof this.#e == "number" && e.unshift(`#${this.#e}`), e.length === 0 ? "" : e.length === 1 ? e[0] : "(?:" + e.join("|") + ")";
-	}
-}, Xe = class {
-	#e = { varIndex: 0 };
-	#t = new Ye();
-	insert(e, t, n) {
-		let r = [], i = [];
-		for (let t = 0;;) {
-			let n = !1;
-			if (e = e.replace(/\{[^}]+\}/g, (e) => {
-				let r = `@\\${t}`;
-				return i[t] = [r, e], t++, n = !0, r;
-			}), !n) break;
-		}
-		let a = e.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
-		for (let e = i.length - 1; e >= 0; e--) {
-			let [t] = i[e];
-			for (let n = a.length - 1; n >= 0; n--) if (a[n].indexOf(t) !== -1) {
-				a[n] = a[n].replace(t, i[e][1]);
-				break;
-			}
-		}
-		return this.#t.insert(a, t, r, this.#e, n), r;
-	}
-	buildRegExp() {
-		let e = this.#t.buildRegExpStr();
-		if (e === "") return [
-			/^$/,
-			[],
-			[]
-		];
-		let t = 0, n = [], r = [];
-		return e = e.replace(/#(\d+)|@(\d+)|\.\*\$/g, (e, i, a) => i === void 0 ? (a === void 0 || (r[Number(a)] = ++t), "") : (n[++t] = Number(i), "$()")), [
-			RegExp(`^${e}`),
-			n,
-			r
-		];
-	}
-}, Ze = [
-	/^$/,
-	[],
-	/* @__PURE__ */ Object.create(null)
-], Qe = /* @__PURE__ */ Object.create(null);
-function $e(e) {
-	return Qe[e] ??= RegExp(e === "*" ? "" : `^${e.replace(/\/\*$|([.\\+*[^\]$()])/g, (e, t) => t ? `\\${t}` : "(?:|/.*)")}$`);
-}
-function et() {
-	Qe = /* @__PURE__ */ Object.create(null);
-}
-function tt(e) {
-	let t = new Xe(), n = [];
-	if (e.length === 0) return Ze;
-	let r = e.map((e) => [!/\*|\/:/.test(e[0]), ...e]).sort(([e, t], [n, r]) => e ? 1 : n ? -1 : t.length - r.length), i = /* @__PURE__ */ Object.create(null);
-	for (let e = 0, a = -1, o = r.length; e < o; e++) {
-		let [o, s, c] = r[e];
-		o ? i[s] = [c.map(([e]) => [e, /* @__PURE__ */ Object.create(null)]), Ge] : a++;
-		let l;
-		try {
-			l = t.insert(s, a, o);
-		} catch (e) {
-			throw e === U ? new Be(s) : e;
-		}
-		o || (n[a] = c.map(([e, t]) => {
-			let n = /* @__PURE__ */ Object.create(null);
-			for (--t; t >= 0; t--) {
-				let [e, r] = l[t];
-				n[e] = r;
-			}
-			return [e, n];
-		}));
-	}
-	let [a, o, s] = t.buildRegExp();
-	for (let e = 0, t = n.length; e < t; e++) for (let t = 0, r = n[e].length; t < r; t++) {
-		let r = n[e][t]?.[1];
-		if (!r) continue;
-		let i = Object.keys(r);
-		for (let e = 0, t = i.length; e < t; e++) r[i[e]] = s[r[i[e]]];
-	}
-	let c = [];
-	for (let e in o) c[e] = n[o[e]];
-	return [
-		a,
-		c,
-		i
-	];
-}
-function W(e, t) {
-	if (e) {
-		for (let n of Object.keys(e).sort((e, t) => t.length - e.length)) if ($e(n).test(t)) return [...e[n]];
-	}
-}
-var nt = class {
-	name = "RegExpRouter";
-	#e;
-	#t;
-	constructor() {
-		this.#e = { ALL: /* @__PURE__ */ Object.create(null) }, this.#t = { ALL: /* @__PURE__ */ Object.create(null) };
-	}
-	add(e, t, n) {
-		let r = this.#e, i = this.#t;
-		if (!r || !i) throw Error(ze);
-		r[e] || [r, i].forEach((t) => {
-			t[e] = /* @__PURE__ */ Object.create(null), Object.keys(t.ALL).forEach((n) => {
-				t[e][n] = [...t.ALL[n]];
-			});
-		}), t === "/*" && (t = "*");
-		let a = (t.match(/\/:/g) || []).length;
-		if (/\*$/.test(t)) {
-			let o = $e(t);
-			e === "ALL" ? Object.keys(r).forEach((e) => {
-				r[e][t] ||= W(r[e], t) || W(r.ALL, t) || [];
-			}) : r[e][t] ||= W(r[e], t) || W(r.ALL, t) || [], Object.keys(r).forEach((t) => {
-				(e === "ALL" || e === t) && Object.keys(r[t]).forEach((e) => {
-					o.test(e) && r[t][e].push([n, a]);
-				});
-			}), Object.keys(i).forEach((t) => {
-				(e === "ALL" || e === t) && Object.keys(i[t]).forEach((e) => o.test(e) && i[t][e].push([n, a]));
-			});
-			return;
-		}
-		let o = we(t) || [t];
-		for (let t = 0, s = o.length; t < s; t++) {
-			let c = o[t];
-			Object.keys(i).forEach((o) => {
-				(e === "ALL" || e === o) && (i[o][c] ||= [...W(r[o], c) || W(r.ALL, c) || []], i[o][c].push([n, a - s + t + 1]));
-			});
-		}
-	}
-	match = Ke;
-	buildAllMatchers() {
-		let e = /* @__PURE__ */ Object.create(null);
-		return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach((t) => {
-			e[t] ||= this.#n(t);
-		}), this.#e = this.#t = void 0, et(), e;
-	}
-	#n(e) {
-		let t = [], n = e === "ALL";
-		return [this.#e, this.#t].forEach((r) => {
-			let i = r[e] ? Object.keys(r[e]).map((t) => [t, r[e][t]]) : [];
-			i.length === 0 ? e !== "ALL" && t.push(...Object.keys(r.ALL).map((e) => [e, r.ALL[e]])) : (n ||= !0, t.push(...i));
-		}), n ? tt(t) : null;
-	}
-}, rt = class {
-	name = "SmartRouter";
-	#e = [];
-	#t = [];
-	constructor(e) {
-		this.#e = e.routers;
-	}
-	add(e, t, n) {
-		if (!this.#t) throw Error(ze);
-		this.#t.push([
-			e,
-			t,
-			n
-		]);
-	}
-	match(e, t) {
-		if (!this.#t) throw Error("Fatal error");
-		let n = this.#e, r = this.#t, i = n.length, a = 0, o;
-		for (; a < i; a++) {
-			let i = n[a];
-			try {
-				for (let e = 0, t = r.length; e < t; e++) i.add(...r[e]);
-				o = i.match(e, t);
-			} catch (e) {
-				if (e instanceof Be) continue;
-				throw e;
-			}
-			this.match = i.match.bind(i), this.#e = [i], this.#t = void 0;
-			break;
-		}
-		if (a === i) throw Error("Fatal error");
-		return this.name = `SmartRouter + ${this.activeRouter.name}`, o;
-	}
-	get activeRouter() {
-		if (this.#t || this.#e.length !== 1) throw Error("No active router has been determined yet.");
-		return this.#e[0];
-	}
-}, G = /* @__PURE__ */ Object.create(null), it = (e) => {
-	for (let t in e) return !0;
-	return !1;
-}, at = class e {
-	#e;
-	#t;
-	#n;
-	#r = 0;
-	#i = G;
-	constructor(e, t, n) {
-		if (this.#t = n || /* @__PURE__ */ Object.create(null), this.#e = [], e && t) {
-			let n = /* @__PURE__ */ Object.create(null);
-			n[e] = {
-				handler: t,
-				possibleKeys: [],
-				score: 0
-			}, this.#e = [n];
-		}
-		this.#n = [];
-	}
-	insert(t, n, r) {
-		this.#r = ++this.#r;
-		let i = this, a = _e(n), o = [];
-		for (let t = 0, n = a.length; t < n; t++) {
-			let n = a[t], r = a[t + 1], s = be(n, r), c = Array.isArray(s) ? s[0] : n;
-			if (c in i.#t) {
-				i = i.#t[c], s && o.push(s[1]);
-				continue;
-			}
-			i.#t[c] = new e(), s && (i.#n.push(s), o.push(s[1])), i = i.#t[c];
-		}
-		return i.#e.push({ [t]: {
-			handler: r,
-			possibleKeys: o.filter((e, t, n) => n.indexOf(e) === t),
-			score: this.#r
-		} }), i;
-	}
-	#a(e, t, n, r, i) {
-		for (let a = 0, o = t.#e.length; a < o; a++) {
-			let o = t.#e[a], s = o[n] || o.ALL, c = {};
-			if (s !== void 0 && (s.params = /* @__PURE__ */ Object.create(null), e.push(s), r !== G || i && i !== G)) for (let e = 0, t = s.possibleKeys.length; e < t; e++) {
-				let t = s.possibleKeys[e], n = c[s.score];
-				s.params[t] = i?.[t] && !n ? i[t] : r[t] ?? i?.[t], c[s.score] = !0;
-			}
-		}
-	}
-	search(e, t) {
-		let n = [];
-		this.#i = G;
-		let r = [this], i = ge(t), a = [], o = i.length, s = null;
-		for (let c = 0; c < o; c++) {
-			let l = i[c], u = c === o - 1, d = [];
-			for (let f = 0, p = r.length; f < p; f++) {
-				let p = r[f], m = p.#t[l];
-				m && (m.#i = p.#i, u ? (m.#t["*"] && this.#a(n, m.#t["*"], e, p.#i), this.#a(n, m, e, p.#i)) : d.push(m));
-				for (let r = 0, f = p.#n.length; r < f; r++) {
-					let f = p.#n[r], m = p.#i === G ? {} : { ...p.#i };
-					if (f === "*") {
-						let t = p.#t["*"];
-						t && (this.#a(n, t, e, p.#i), t.#i = m, d.push(t));
-						continue;
-					}
-					let [h, g, _] = f;
-					if (!l && !(_ instanceof RegExp)) continue;
-					let v = p.#t[h];
-					if (_ instanceof RegExp) {
-						if (s === null) {
-							s = Array(o);
-							let e = +(t[0] === "/");
-							for (let t = 0; t < o; t++) s[t] = e, e += i[t].length + 1;
-						}
-						let r = t.substring(s[c]), l = _.exec(r);
-						if (l) {
-							if (m[g] = l[0], this.#a(n, v, e, p.#i, m), it(v.#t)) {
-								v.#i = m;
-								let e = l[0].match(/\//)?.length ?? 0;
-								(a[e] ||= []).push(v);
-							}
-							continue;
-						}
-					}
-					(_ === !0 || _.test(l)) && (m[g] = l, u ? (this.#a(n, v, e, m, p.#i), v.#t["*"] && this.#a(n, v.#t["*"], e, m, p.#i)) : (v.#i = m, d.push(v)));
-				}
-			}
-			let f = a.shift();
-			r = f ? d.concat(f) : d;
-		}
-		return n.length > 1 && n.sort((e, t) => e.score - t.score), [n.map(({ handler: e, params: t }) => [e, t])];
-	}
-}, ot = class {
-	name = "TrieRouter";
-	#e;
-	constructor() {
-		this.#e = new at();
-	}
-	add(e, t, n) {
-		let r = we(t);
-		if (r) {
-			for (let t = 0, i = r.length; t < i; t++) this.#e.insert(e, r[t], n);
-			return;
-		}
-		this.#e.insert(e, t, n);
-	}
-	match(e, t) {
-		return this.#e.search(e, t);
-	}
-}, st = class extends We {
-	constructor(e = {}) {
-		super(e), this.router = e.router ?? new rt({ routers: [new nt(), new ot()] });
-	}
-};
-//#endregion
-//#region src/coordinator-invites.ts
-function ct(e) {
-	let t = "";
-	for (let n of e) t += String.fromCharCode(n);
-	return btoa(t);
-}
-function lt(e) {
-	let t = atob(e), n = new Uint8Array(t.length);
-	for (let e = 0; e < t.length; e += 1) n[e] = t.charCodeAt(e);
-	return n;
-}
-function ut(e) {
-	return e.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function dt(e) {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/");
-	return t + "=".repeat((4 - t.length % 4) % 4);
-}
-function K(e) {
-	let t = JSON.stringify(e);
-	return ut(ct(new TextEncoder().encode(t)));
-}
-function ft(e) {
-	let t = new TextDecoder().decode(lt(dt(e))), n = JSON.parse(t);
-	if (typeof n != "object" || !n) throw Error("invalid invite payload");
-	return n;
-}
-function q(e) {
-	return `codemem://join?invite=${encodeURIComponent(e)}`;
-}
-function pt(e) {
-	let t = e.trim();
-	if (t.startsWith("codemem://")) {
-		let e = new URL(t).searchParams.get("invite") ?? "";
-		if (!e) throw Error("invite payload missing from link");
-		return e;
-	}
-	return t;
-}
-//#endregion
-//#region src/project-invite-acceptance.ts
-var mt = "pending_setup", ht = "project_sync_enablement_failed", gt = "Invitation was accepted, but sync could not be enabled. Make the codemem config writable, then retry.", _t = class extends Error {
-	code = ht;
-	detail = gt;
-	constructor(e) {
-		super(gt, e), this.name = "ProjectSyncEnablementError";
-	}
-};
-function vt(e) {
-	return typeof e == "object" && !!e && "code" in e && e.code === "project_sync_enablement_failed" && "detail" in e && e.detail === "Invitation was accepted, but sync could not be enabled. Make the codemem config writable, then retry.";
-}
-//#endregion
-//#region ../../node_modules/.pnpm/limiter@3.0.0/node_modules/limiter/dist/esm/clock.js
-function yt(e) {
-	let t = performance.now() * .001, n = Math.floor(t), r = Math.floor(t % 1 * 1e9);
-	return e != null && (n -= e[0], r -= e[1], r < 0 && (n--, r += 1e9)), [n, r];
-}
-function J() {
-	let [e, t] = yt();
-	return e * 1e3 + Math.floor(t / 1e6);
-}
-function bt(e) {
-	return new Promise((t) => setTimeout(t, e));
-}
-//#endregion
-//#region ../../node_modules/.pnpm/limiter@3.0.0/node_modules/limiter/dist/esm/TokenBucket.js
-var xt = class {
-	bucketSize;
-	tokensPerInterval;
-	interval;
-	parentBucket;
-	content;
-	lastDrip;
-	constructor({ bucketSize: e, tokensPerInterval: t, interval: n, parentBucket: r }) {
-		if (this.bucketSize = e, this.tokensPerInterval = t, typeof n == "string") switch (n) {
-			case "sec":
-			case "second":
-				this.interval = 1e3;
-				break;
-			case "min":
-			case "minute":
-				this.interval = 1e3 * 60;
-				break;
-			case "hr":
-			case "hour":
-				this.interval = 1e3 * 60 * 60;
-				break;
-			case "day":
-				this.interval = 1e3 * 60 * 60 * 24;
-				break;
-			default: throw Error("Invalid interval " + n);
-		}
-		else this.interval = n;
-		this.parentBucket = r, this.content = 0, this.lastDrip = J();
-	}
-	async removeTokens(e) {
-		if (this.bucketSize === 0) return Infinity;
-		if (e > this.bucketSize) throw Error(`Requested tokens ${e} exceeds bucket size ${this.bucketSize}`);
-		this.drip();
-		let t = async () => (await bt(Math.ceil((e - this.content) * (this.interval / this.tokensPerInterval))), this.removeTokens(e));
-		if (e > this.content) return t();
-		if (this.parentBucket != null) {
-			let n = await this.parentBucket.removeTokens(e);
-			return e > this.content ? t() : (this.content -= e, Math.min(n, this.content));
-		} else return this.content -= e, this.content;
-	}
-	tryRemoveTokens(e) {
-		return this.bucketSize ? e > this.bucketSize || (this.drip(), e > this.content) || this.parentBucket && !this.parentBucket.tryRemoveTokens(e) ? !1 : (this.content -= e, !0) : !0;
-	}
-	drip() {
-		if (this.tokensPerInterval === 0) {
-			let e = this.content;
-			return this.content = this.bucketSize, this.content > e;
-		}
-		let e = J(), t = Math.max(e - this.lastDrip, 0);
-		this.lastDrip = e;
-		let n = t * (this.tokensPerInterval / this.interval), r = this.content;
-		return this.content = Math.min(this.content + n, this.bucketSize), Math.floor(this.content) > Math.floor(r);
-	}
-}, St = class {
-	tokenBucket;
-	curIntervalStart;
-	tokensThisInterval;
-	fireImmediately;
-	constructor({ tokensPerInterval: e, interval: t, fireImmediately: n }) {
-		this.tokenBucket = new xt({
-			bucketSize: e,
-			tokensPerInterval: e,
-			interval: t
-		}), this.tokenBucket.content = e, this.curIntervalStart = J(), this.tokensThisInterval = 0, this.fireImmediately = n ?? !1;
-	}
-	async removeTokens(e) {
-		if (e > this.tokenBucket.bucketSize) throw Error(`Requested tokens ${e} exceeds maximum tokens per interval ${this.tokenBucket.bucketSize}`);
-		let t = J();
-		if ((t < this.curIntervalStart || t - this.curIntervalStart >= this.tokenBucket.interval) && (this.curIntervalStart = t, this.tokensThisInterval = 0), e > this.tokenBucket.tokensPerInterval - this.tokensThisInterval) {
-			if (this.fireImmediately) return -1;
-			{
-				await bt(Math.ceil(this.curIntervalStart + this.tokenBucket.interval - t));
-				let n = await this.tokenBucket.removeTokens(e);
-				return this.tokensThisInterval += e, n;
-			}
-		}
-		let n = await this.tokenBucket.removeTokens(e);
-		return this.tokensThisInterval += e, n;
-	}
-	tryRemoveTokens(e) {
-		if (e > this.tokenBucket.bucketSize) return !1;
-		let t = J();
-		if ((t < this.curIntervalStart || t - this.curIntervalStart >= this.tokenBucket.interval) && (this.curIntervalStart = t, this.tokensThisInterval = 0), e > this.tokenBucket.tokensPerInterval - this.tokensThisInterval) return !1;
-		let n = this.tokenBucket.tryRemoveTokens(e);
-		return n && (this.tokensThisInterval += e), n;
-	}
-	getTokensRemaining() {
-		return this.tokenBucket.drip(), this.tokenBucket.content;
-	}
-};
-//#endregion
-//#region src/request-rate-limit.ts
-function Ct(e = {}) {
-	let t = Math.max(1e3, Math.trunc(e.windowMs ?? 6e4)), n = e.now ?? (() => Date.now()), r = /* @__PURE__ */ new Map(), i = 0;
-	function a(e) {
-		return Math.max(1, Math.ceil(t / Math.max(1, e) / 1e3));
-	}
-	function o(e) {
-		if (r.size < 64 || i % 64 != 0) return;
-		let n = e - t * 10;
-		for (let [e, t] of r) t.lastUsedAt < n && r.delete(e);
-	}
-	return { check(e, s) {
-		let c = Math.max(1, Math.trunc(s));
-		i += 1;
-		let l = n();
-		o(l);
-		let u = `${c}:${e}`, d = r.get(u);
-		return d || (d = {
-			limiter: new St({
-				tokensPerInterval: c,
-				interval: t,
-				fireImmediately: !0
-			}),
-			lastUsedAt: l
-		}, r.set(u, d)), d.lastUsedAt = l, d.limiter.tryRemoveTokens(1) ? {
-			allowed: !0,
-			retryAfterS: 0
-		} : {
-			allowed: !1,
-			retryAfterS: a(c)
-		};
-	} };
-}
-//#endregion
-//#region src/scope-membership-semantics.ts
-var wt = "Revocation blocks future sync for this Space. It does not remove data already copied to the revoked device; offline devices, backups, copied databases, malicious peers, or old versions may retain data.";
-function Tt(e) {
-	let t = Number.isFinite(e.membershipEpoch) ? Number(e.membershipEpoch) : null, n = Number.isFinite(e.requiredEpoch) ? Number(e.requiredEpoch) : null;
-	return t == null || n == null ? {
-		membership_epoch: t,
-		required_epoch: n,
-		stale: !1,
-		reason: "unknown_epoch"
-	} : {
-		membership_epoch: t,
-		required_epoch: n,
-		stale: t < n,
-		reason: t < n ? "stale_epoch" : "current"
-	};
-}
-function Et(e) {
-	return {
-		scope_id: e.scopeId,
-		device_id: e.deviceId,
-		membership_epoch: Number.isFinite(e.membershipEpoch) ? Number(e.membershipEpoch) : null,
-		prevents_future_sync: !0,
-		deletes_already_copied_data: !1,
-		message: wt
-	};
-}
-//#endregion
-//#region src/sync-auth-constants.ts
-var Dt = 300, Y = 64 * 1024, X = "X-Codemem-Coordinator-Admin", Ot = "X-Codemem-Coordinator-Admin-Actor", kt = 120, At = 30;
-function Z(e, t) {
-	let n = t.adminSecret();
-	if (!n) return {
-		ok: !1,
-		error: "admin_not_configured"
-	};
-	let r = (e ?? "").trim();
-	return r ? r === n ? {
-		ok: !0,
-		error: "ok"
-	} : {
-		ok: !1,
-		error: "invalid_admin_secret"
-	} : {
-		ok: !1,
-		error: "missing_admin_header"
-	};
-}
-function jt(e) {
-	let t = new URL(e);
-	return t.search ? `${t.pathname}${t.search}` : t.pathname;
-}
-async function Mt(e, t, n, r) {
-	return await e.recordNonce(t, n, r);
-}
-async function Nt(e, t) {
-	await e.cleanupNonces(t);
-}
-async function Q(e, t, n, r) {
-	let { deviceId: i, signature: a, timestamp: o, nonce: s } = r;
-	if (!i || !a || !o || !s) return {
-		ok: !1,
-		error: "missing_headers",
-		enrollment: null
-	};
-	let c = await e.getEnrollment(r.groupId, i, !0);
-	if (!c) return {
-		ok: !1,
-		error: "unknown_device",
-		enrollment: null
-	};
-	if (c.enabled !== 1) return {
-		ok: !1,
-		error: "device_disabled",
-		enrollment: null
-	};
-	let l = await e.getGroup(r.groupId);
-	if (!l) return {
-		ok: !1,
-		error: "group_not_found",
-		enrollment: null
-	};
-	if (l.archived_at) return {
-		ok: !1,
-		error: "group_archived",
-		enrollment: null
-	};
-	let u;
-	try {
-		u = await n({
-			method: r.method,
-			pathWithQuery: jt(r.url),
-			bodyBytes: r.body,
-			timestamp: o,
-			nonce: s,
-			signature: a,
-			publicKey: String(c.public_key),
-			deviceId: i
-		});
-	} catch {
-		return {
-			ok: !1,
-			error: "signature_verification_error",
-			enrollment: null
-		};
-	}
-	if (!u) return {
-		ok: !1,
-		error: "invalid_signature",
-		enrollment: null
-	};
-	let d = t.now();
-	return await Mt(e, i, s, d) ? (await Nt(e, (/* @__PURE__ */ new Date(new Date(d).getTime() - 300 * 2 * 1e3)).toISOString()), {
-		ok: !0,
-		error: "ok",
-		enrollment: c
-	}) : {
-		ok: !1,
-		error: "nonce_replay",
-		enrollment: null
-	};
-}
-function $(e) {
-	return e === "device_disabled" ? 403 : e === "group_archived" ? 409 : 401;
-}
-function Pt(e) {
-	if (!e?.storeFactory || !e.runtime || !e.requestVerifier) throw Error("createCoordinatorApp requires storeFactory, runtime, and requestVerifier.");
-	let t = e.runtime, n = e.storeFactory, i = e.requestVerifier, a = e.requestRateLimit ?? {}, o = a.limiter ?? Ct(), s = Math.max(1, Math.trunc(a.readLimit ?? kt)), c = Math.max(1, Math.trunc(a.mutationLimit ?? At)), l = Math.max(1, Math.trunc(a.unauthenticatedReadLimit ?? Math.min(20, s))), u = Math.max(1, Math.trunc(a.unauthenticatedMutationLimit ?? Math.min(10, c))), d = new st(), f = new TextDecoder();
-	function p(e, t, n) {
-		let r = e.req.method === "GET" || e.req.method === "HEAD" || e.req.method === "OPTIONS", i = o.check(`${e.req.method}:${n ? "auth" : "anon"}:${t}`, n ? r ? s : c : r ? l : u);
-		return i.allowed ? null : (e.header("Retry-After", String(i.retryAfterS)), e.json({
-			error: "rate_limited",
-			retry_after_s: i.retryAfterS
-		}, 429));
-	}
-	async function m(e) {
-		let t = Number.parseInt(e.req.header("content-length") ?? "", 10);
-		if (Number.isFinite(t) && t > Y) return null;
-		let n = e.req.raw.body;
-		if (!n) return new Uint8Array();
-		let r = n.getReader(), i = [], a = 0;
-		try {
-			for (;;) {
-				let { done: e, value: t } = await r.read();
-				if (e) break;
-				if (t) {
-					if (a += t.byteLength, a > Y) return await r.cancel(), null;
-					i.push(t);
-				}
-			}
-		} finally {
-			r.releaseLock();
-		}
-		let o = new Uint8Array(a), s = 0;
-		for (let e of i) o.set(e, s), s += e.byteLength;
-		return o;
-	}
-	function g(e) {
-		try {
-			let t = JSON.parse(f.decode(e));
-			return typeof t != "object" || !t || Array.isArray(t) ? null : t;
-		} catch {
-			return null;
-		}
-	}
-	function _(e, t) {
-		let n = e[t];
-		return n == null ? null : String(n).trim() || null;
-	}
-	function y(e) {
-		return e?.trim() || null;
-	}
-	function x(e, t) {
-		let n = e[t];
-		if (n == null || n === "") return null;
-		if (typeof n != "number" && typeof n != "string") return NaN;
-		if (typeof n == "string") {
-			let e = n.trim();
-			if (!e) return NaN;
-			let t = Number(e);
-			return Number.isFinite(t) ? Math.trunc(t) : NaN;
-		}
-		let r = n;
-		return Number.isFinite(r) ? Math.trunc(r) : NaN;
-	}
-	function S(e) {
-		return [
-			"1",
-			"true",
-			"yes"
-		].includes(String(e ?? "").trim().toLowerCase());
-	}
-	function C(e) {
-		try {
-			let t = JSON.parse(e ?? "");
-			if (!Array.isArray(t) || t.length === 0 || t.length > 100) throw Error("operation_intent_invalid");
-			return t.map((e) => {
-				if (!e || typeof e != "object" || Array.isArray(e)) throw Error("operation_intent_invalid");
-				let t = e;
-				if (!String(t.canonical_identity ?? "").trim() || !String(t.display_name ?? "").trim() || !Number.isSafeInteger(t.existing_memory_count)) throw Error("operation_intent_invalid");
-				return t;
-			});
-		} catch {
-			throw Error("operation_intent_invalid");
-		}
-	}
-	function w(e) {
-		try {
-			return v(JSON.parse(e ?? ""));
-		} catch {
-			throw Error("operation_intent_invalid");
-		}
-	}
-	async function T(e, t, n) {
-		if (!t) return n.json({ error: "group_id_required" }, 400);
-		let r = await e.getGroup(t);
-		return r ? r.archived_at ? n.json({ error: "group_archived" }, 409) : null : n.json({ error: "group_not_found" }, 404);
-	}
-	async function E(e, t, n, r) {
-		let i = await T(e, t, r);
-		if (i) return {
-			scope: null,
-			response: i
-		};
-		if (!n) return {
-			scope: null,
-			response: r.json({ error: "scope_id_required" }, 400)
-		};
-		let a = (await e.listScopes({
-			groupId: t,
-			includeInactive: !0
-		})).find((e) => e.scope_id === n) ?? null;
-		return a ? {
-			scope: a,
-			response: null
-		} : {
-			scope: null,
-			response: r.json({ error: "scope_not_found" }, 404)
-		};
-	}
-	async function D(e, n, r) {
-		let a = await Q(e, t, i, {
-			method: r.req.method,
-			url: r.req.url,
-			groupId: n,
-			body: new Uint8Array(),
-			deviceId: r.req.header("X-Opencode-Device") ?? null,
-			signature: r.req.header("X-Opencode-Signature") ?? null,
-			timestamp: r.req.header("X-Opencode-Timestamp") ?? null,
-			nonce: r.req.header("X-Opencode-Nonce") ?? null
-		});
-		return !a.ok || !a.enrollment ? {
-			auth: a,
-			response: p(r, r.req.path, !1) ?? r.json({ error: a.error }, $(a.error))
-		} : {
-			auth: a,
-			response: p(r, String(a.enrollment.device_id), !0)
-		};
-	}
-	function O(e, t) {
-		return e.status === "active" && e.membership_epoch >= t.membership_epoch;
-	}
-	async function k(e, t, n) {
-		return (await e.listScopeMemberships(t.scope_id, !1)).some((e) => e.device_id === n && O(e, t));
-	}
-	return d.post("/v1/presence", async (e) => {
-		let r = await m(e);
-		if (r == null) return e.json({ error: "body_too_large" }, 413);
-		let a = g(r);
-		if (!a) return e.json({ error: "invalid_json" }, 400);
-		let o = String(a.group_id ?? "").trim();
-		if (!o) return e.json({ error: "group_id_required" }, 400);
-		let s = n();
-		try {
-			let n = await Q(s, t, i, {
-				method: e.req.method,
-				url: e.req.url,
-				groupId: o,
-				body: r,
-				deviceId: e.req.header("X-Opencode-Device") ?? null,
-				signature: e.req.header("X-Opencode-Signature") ?? null,
-				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
-				nonce: e.req.header("X-Opencode-Nonce") ?? null
-			});
-			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) || e.json({ error: n.error }, $(n.error));
-			let c = p(e, String(n.enrollment.device_id), !0);
-			if (c) return c;
-			if (a.fingerprint && String(a.fingerprint) !== String(n.enrollment.fingerprint)) return e.json({ error: "fingerprint_mismatch" }, 401);
-			let l = a.addresses ?? [];
-			if (!Array.isArray(l) || !l.every((e) => typeof e == "string")) return e.json({ error: "addresses_must_be_list_of_strings" }, 400);
-			let u;
-			try {
-				if (u = Math.max(1, Number.parseInt(String(a.ttl_s ?? 180), 10)), Number.isNaN(u)) return e.json({ error: "ttl_s_must_be_int" }, 400);
-			} catch {
-				return e.json({ error: "ttl_s_must_be_int" }, 400);
-			}
-			let d = await s.upsertPresence({
-				groupId: o,
-				deviceId: String(n.enrollment.device_id),
-				addresses: l,
-				ttlS: u,
-				capabilities: typeof a.capabilities == "object" && a.capabilities !== null && !Array.isArray(a.capabilities) ? a.capabilities : void 0
-			});
-			return e.json({
-				ok: !0,
-				...d
-			});
-		} finally {
-			await s.close();
-		}
-	}), d.get("/v1/peers", async (e) => {
-		let r = (e.req.query("group_id") ?? "").trim();
-		if (!r) return e.json({ error: "group_id_required" }, 400);
-		let a = n();
-		try {
-			let n = await Q(a, t, i, {
-				method: e.req.method,
-				url: e.req.url,
-				groupId: r,
-				body: new Uint8Array(),
-				deviceId: e.req.header("X-Opencode-Device") ?? null,
-				signature: e.req.header("X-Opencode-Signature") ?? null,
-				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
-				nonce: e.req.header("X-Opencode-Nonce") ?? null
-			});
-			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) || e.json({ error: n.error }, $(n.error));
-			let o = p(e, String(n.enrollment.device_id), !0);
-			if (o) return o;
-			let s = await a.listGroupPeers(r, String(n.enrollment.device_id));
-			return e.json({ items: s });
-		} finally {
-			await a.close();
-		}
-	}), d.get("/v1/scopes", async (e) => {
-		let t = (e.req.query("group_id") ?? "").trim();
-		if (!t) return e.json({ error: "group_id_required" }, 400);
-		let r = n();
-		try {
-			let { auth: n, response: i } = await D(r, t, e);
-			if (i) return i;
-			if (!n.enrollment) return e.json({ error: "unknown_device" }, 401);
-			let a = await r.listScopes({
-				groupId: t,
-				includeInactive: !1
-			}), o = [];
-			for (let e of a) e.status === "active" && await k(r, e, String(n.enrollment.device_id)) && o.push(e);
-			return e.json({ items: o });
-		} finally {
-			await r.close();
-		}
-	}), d.get("/v1/scopes/:scope_id/members", async (e) => {
-		let t = (e.req.query("group_id") ?? "").trim(), r = String(e.req.param("scope_id") ?? "").trim();
-		if (!t) return e.json({ error: "group_id_required" }, 400);
-		if (!r) return e.json({ error: "scope_id_required" }, 400);
-		let i = n();
-		try {
-			let { auth: n, response: a } = await D(i, t, e);
-			if (a) return a;
-			if (!n.enrollment) return e.json({ error: "unknown_device" }, 401);
-			let o = (await i.listScopes({
-				groupId: t,
-				includeInactive: !1
-			})).find((e) => e.scope_id === r) ?? null;
-			if (o?.status !== "active") return e.json({ error: "scope_not_found" }, 404);
-			let s = await i.listScopeMemberships(r, !1);
-			return s.some((e) => e.device_id === String(n.enrollment?.device_id) && O(e, o)) ? e.json({ items: s.filter((e) => O(e, o)) }) : e.json({ error: "scope_not_authorized" }, 403);
-		} finally {
-			await i.close();
-		}
-	}), d.get("/v1/reciprocal-approvals", async (e) => {
-		let r = (e.req.query("group_id") ?? "").trim(), a = (e.req.query("direction") ?? "incoming").trim(), o = (e.req.query("status") ?? "pending").trim() || "pending";
-		if (!r) return e.json({ error: "group_id_required" }, 400);
-		if (!["incoming", "outgoing"].includes(a)) return e.json({ error: "direction_must_be_incoming_or_outgoing" }, 400);
-		let s = n();
-		try {
-			let n = await Q(s, t, i, {
-				method: e.req.method,
-				url: e.req.url,
-				groupId: r,
-				body: new Uint8Array(),
-				deviceId: e.req.header("X-Opencode-Device") ?? null,
-				signature: e.req.header("X-Opencode-Signature") ?? null,
-				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
-				nonce: e.req.header("X-Opencode-Nonce") ?? null
-			});
-			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
-			let c = p(e, String(n.enrollment.device_id), !0);
-			if (c) return c;
-			let l = await s.listReciprocalApprovals({
-				groupId: r,
-				deviceId: String(n.enrollment.device_id),
-				direction: a,
-				status: o
-			});
-			return e.json({ items: l });
-		} finally {
-			await s.close();
-		}
-	}), d.post("/v1/reciprocal-approvals", async (e) => {
-		let r = await m(e);
-		if (r == null) return e.json({ error: "body_too_large" }, 413);
-		let a = g(r);
-		if (!a) return e.json({ error: "invalid_json" }, 400);
-		let o = String(a.group_id ?? "").trim(), s = String(a.requested_device_id ?? "").trim();
-		if (!o || !s) return e.json({ error: "group_id_and_requested_device_id_required" }, 400);
-		let c = n();
-		try {
-			let n = await Q(c, t, i, {
-				method: e.req.method,
-				url: e.req.url,
-				groupId: o,
-				body: r,
-				deviceId: e.req.header("X-Opencode-Device") ?? null,
-				signature: e.req.header("X-Opencode-Signature") ?? null,
-				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
-				nonce: e.req.header("X-Opencode-Nonce") ?? null
-			});
-			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
-			let a = p(e, String(n.enrollment.device_id), !0);
-			if (a) return a;
-			if (s === String(n.enrollment.device_id)) return e.json({ error: "requested_device_must_differ" }, 400);
-			if (!await c.getEnrollment(o, s)) return e.json({ error: "requested_device_not_found" }, 404);
-			let l = await c.createReciprocalApproval({
-				groupId: o,
-				requestingDeviceId: String(n.enrollment.device_id),
-				requestedDeviceId: s
-			});
-			return e.json({
-				ok: !0,
-				request: l
-			});
-		} finally {
-			await c.close();
-		}
-	}), d.post("/v1/invites/add-device", async (e) => {
-		let r = await m(e);
-		if (r == null) return e.json({ error: "body_too_large" }, 413);
-		let a = g(r);
-		if (!a) return e.json({ error: "invalid_json" }, 400);
-		let o = new Set([
-			"group_id",
-			"expires_at",
-			"reviewed_preview_digest",
-			"reviewed_intent"
-		]);
-		if (Object.keys(a).some((e) => !o.has(e))) return e.json({ error: "unexpected_add_device_invite_fields" }, 400);
-		let s = String(a.group_id ?? "").trim(), c = String(a.expires_at ?? "").trim(), l = String(a.reviewed_preview_digest ?? "").trim();
-		if (!s || !c) return e.json({ error: "group_id_and_expires_at_required" }, 400);
-		if (Number.isNaN(new Date(c).getTime())) return e.json({ error: "invalid_expires_at" }, 400);
-		if (!/^[a-f0-9]{64}$/u.test(l)) return e.json({ error: "reviewed_preview_digest_invalid" }, 400);
-		if (a.reviewed_intent == null) return e.json({ error: "recipient_invite_review_unavailable" }, 400);
-		let u = n();
-		try {
-			let n = await Q(u, t, i, {
-				method: e.req.method,
-				url: e.req.url,
-				groupId: s,
-				body: r,
-				deviceId: e.req.header("X-Opencode-Device") ?? null,
-				signature: e.req.header("X-Opencode-Signature") ?? null,
-				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
-				nonce: e.req.header("X-Opencode-Nonce") ?? null
-			});
-			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
-			let o = p(e, String(n.enrollment.device_id), !0);
-			if (o) return o;
-			let d = n.enrollment.identity_id;
-			if (!d || d !== d.trim() || d.length > 256 || /[\p{Cc}\p{Cf}]/u.test(d)) return e.json({ error: "identity_binding_required" }, 403);
-			let f;
-			try {
-				f = await P(a.reviewed_intent, {
-					target: {
-						kind: "add_device",
-						targetIdentityId: d
-					},
-					digest: l
-				});
-			} catch (t) {
-				return t instanceof b && t.code === "recipient_invite_intent_mismatch" ? e.json({ error: t.code }, 409) : e.json({ error: "recipient_invite_review_unavailable" }, 400);
-			}
-			let m = await u.createInvite({
-				groupId: s,
-				policy: "auto_admit",
-				expiresAt: c,
-				createdBy: d,
-				inviteKind: "add_device",
-				targetIdentityId: d,
-				reviewedPreviewDigest: l,
-				reviewedIntent: f
-			}), h = {
-				v: 1,
-				kind: "add_device",
-				coordinator_url: new URL(e.req.url).origin,
-				group_id: s,
-				policy: m.policy,
-				token: String(m.token ?? ""),
-				expires_at: m.expires_at,
-				team_name: m.team_name_snapshot ?? null,
-				target_identity_id: m.target_identity_id ?? void 0,
-				reviewed_preview_digest: m.reviewed_preview_digest ?? void 0
-			}, g = K(h), { token: _, ...v } = m;
-			return e.json({
-				ok: !0,
-				invite: v,
-				payload: h,
-				encoded: g,
-				link: q(g)
-			});
-		} finally {
-			await u.close();
-		}
-	}), d.post("/v1/admin/devices", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim(), l = String(o.fingerprint ?? "").trim(), u = String(o.public_key ?? "").trim(), d = String(o.display_name ?? "").trim() || null;
-		if (!s || !c || !l || !u) return e.json({ error: "group_id_device_id_fingerprint_public_key_required" }, 400);
-		if (F(u) !== l) return e.json({ error: "fingerprint_mismatch" }, 400);
-		let f = n();
-		try {
-			await f.createGroup(s), await f.enrollDevice(s, {
-				deviceId: c,
-				fingerprint: l,
-				publicKey: u,
-				displayName: d
-			});
-		} finally {
-			await f.close();
-		}
-		return e.json({ ok: !0 });
-	}), d.get("/v1/admin/groups", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = [
-			"1",
-			"true",
-			"yes"
-		].includes((e.req.query("include_archived") ?? "0").trim().toLowerCase()), o = n();
-		try {
-			return e.json({ items: await o.listGroups(a) });
-		} finally {
-			await o.close();
-		}
-	}), d.post("/v1/admin/groups", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.display_name ?? "").trim() || null;
-		if (!s) return e.json({ error: "group_id_required" }, 400);
-		let l = n();
-		try {
-			return await l.createGroup(s, c), e.json({
-				ok: !0,
-				group: await l.getGroup(s)
-			});
-		} finally {
-			await l.close();
-		}
-	}), d.post("/v1/admin/groups/rename", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.display_name ?? "").trim();
-		if (!s || !c) return e.json({ error: "group_id_and_display_name_required" }, 400);
-		let l = n();
-		try {
-			return await l.renameGroup(s, c) ? e.json({
-				ok: !0,
-				group: await l.getGroup(s)
-			}) : e.json({ error: "group_not_found" }, 404);
-		} finally {
-			await l.close();
-		}
-	}), d.post("/v1/admin/groups/archive", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim();
-		if (!s) return e.json({ error: "group_id_required" }, 400);
-		let c = n();
-		try {
-			return await c.archiveGroup(s, t.now()) ? e.json({
-				ok: !0,
-				group: await c.getGroup(s)
-			}) : e.json({ error: "group_not_found_or_already_archived" }, 404);
-		} finally {
-			await c.close();
-		}
-	}), d.post("/v1/admin/groups/unarchive", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim();
-		if (!s) return e.json({ error: "group_id_required" }, 400);
-		let c = n();
-		try {
-			return await c.unarchiveGroup(s) ? e.json({
-				ok: !0,
-				group: await c.getGroup(s)
-			}) : e.json({ error: "group_not_found_or_not_archived" }, 404);
-		} finally {
-			await c.close();
-		}
-	}), d.get("/v1/admin/groups/:group_id/scopes", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = String(e.req.param("group_id") ?? "").trim(), o = n();
-		try {
-			let t = await T(o, a, e);
-			if (t) return t;
-			let n = S(e.req.query("include_inactive"));
-			return e.json({ items: await o.listScopes({
-				groupId: a,
-				includeInactive: n
-			}) });
-		} finally {
-			await o.close();
-		}
-	}), d.post("/v1/admin/groups/:group_id/scopes", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(e.req.param("group_id") ?? "").trim(), c = _(o, "scope_id"), l = _(o, "label"), u = x(o, "membership_epoch");
-		if (!c || !l) return e.json({ error: "scope_id_and_label_required" }, 400);
-		if (Number.isNaN(u)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
-		let d = n();
-		try {
-			let t = await T(d, s, e);
-			if (t) return t;
-			let n = await d.createScope({
-				scopeId: c,
-				label: l,
-				kind: _(o, "kind"),
-				authorityType: _(o, "authority_type"),
-				coordinatorId: _(o, "coordinator_id"),
-				groupId: s,
-				manifestIssuerDeviceId: _(o, "manifest_issuer_device_id"),
-				membershipEpoch: u,
-				manifestHash: _(o, "manifest_hash"),
-				status: _(o, "status")
-			});
-			return e.json({
-				ok: !0,
-				scope: n
-			}, 201);
-		} catch (t) {
-			return e.json({ error: t instanceof Error ? t.message : String(t) }, 400);
-		} finally {
-			await d.close();
-		}
-	}), d.patch("/v1/admin/groups/:group_id/scopes/:scope_id", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(e.req.param("group_id") ?? "").trim(), c = String(e.req.param("scope_id") ?? "").trim(), l = x(o, "membership_epoch");
-		if (!c) return e.json({ error: "scope_id_required" }, 400);
-		if (Number.isNaN(l)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
-		let u = n();
-		try {
-			let t = await E(u, s, c, e);
-			if (t.response) return t.response;
-			let n = await u.updateScope({
-				scopeId: c,
-				label: o.label === void 0 ? void 0 : _(o, "label"),
-				kind: o.kind === void 0 ? void 0 : _(o, "kind"),
-				authorityType: o.authority_type === void 0 ? void 0 : _(o, "authority_type"),
-				coordinatorId: o.coordinator_id === void 0 ? void 0 : _(o, "coordinator_id"),
-				groupId: s,
-				manifestIssuerDeviceId: o.manifest_issuer_device_id === void 0 ? void 0 : _(o, "manifest_issuer_device_id"),
-				membershipEpoch: l,
-				manifestHash: o.manifest_hash === void 0 ? void 0 : _(o, "manifest_hash"),
-				status: o.status === void 0 ? void 0 : _(o, "status")
-			});
-			return n ? e.json({
-				ok: !0,
-				scope: n
-			}) : e.json({ error: "scope_not_found" }, 404);
-		} catch (t) {
-			return e.json({ error: t instanceof Error ? t.message : String(t) }, 400);
-		} finally {
-			await u.close();
-		}
-	}), d.get("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = String(e.req.param("group_id") ?? "").trim(), o = String(e.req.param("scope_id") ?? "").trim(), s = n();
-		try {
-			let t = await E(s, a, o, e);
-			return t.response ? t.response : e.json({ items: await s.listScopeMemberships(o, S(e.req.query("include_revoked"))) });
-		} finally {
-			await s.close();
-		}
-	}), d.post("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
-		let i = Z(e.req.header(X), t);
-		if (!i.ok) return p(e, e.req.path, !1) ?? e.json({ error: i.error }, 401);
-		let a = p(e, "admin", !0);
-		if (a) return a;
-		let o = await m(e);
-		if (o == null) return e.json({ error: "body_too_large" }, 413);
-		let s = g(o);
-		if (!s) return e.json({ error: "invalid_json" }, 400);
-		let c = String(e.req.param("group_id") ?? "").trim(), l = String(e.req.param("scope_id") ?? "").trim(), u = _(s, "effect_id"), d = _(s, "device_id"), f = x(s, "membership_epoch");
-		if (!u) return e.json({ error: "effect_id_required" }, 400);
-		if (!d) return e.json({ error: "device_id_required" }, 400);
-		if (Number.isNaN(f)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
-		let h = n();
-		try {
-			let t = await E(h, c, l, e);
-			if (t.response) return t.response;
-			let n = await h.grantScopeMembership({
-				effectId: u,
-				scopeId: l,
-				deviceId: d,
-				role: _(s, "role"),
-				membershipEpoch: f,
-				coordinatorId: _(s, "coordinator_id"),
-				groupId: c,
-				manifestIssuerDeviceId: _(s, "manifest_issuer_device_id"),
-				manifestHash: _(s, "manifest_hash"),
-				signedManifestJson: _(s, "signed_manifest_json"),
-				actorType: "admin",
-				actorId: y(e.req.header(Ot))
-			});
-			return e.json({
-				ok: !0,
-				membership: n
-			}, 201);
-		} catch (t) {
-			let n = t instanceof Error ? t.message : String(t);
-			if (t instanceof r && (t.code === "scope_not_found" || t.code === "scope_group_mismatch")) return e.json({ error: "scope_not_found" }, 404);
-			if (t instanceof r && t.code === "device_not_enrolled") return e.json({ error: "device_not_enrolled_for_scope_group" }, 404);
-			let i = t instanceof r && t.code === "scope_inactive";
-			return e.json({ error: i ? "scope_not_active" : n }, n === "scope_membership_effect_conflict" || i ? 409 : 400);
-		} finally {
-			await h.close();
-		}
-	}), d.post("/v1/admin/groups/:group_id/scopes/:scope_id/members/:device_id/revoke", async (e) => {
-		let i = Z(e.req.header(X), t);
-		if (!i.ok) return p(e, e.req.path, !1) ?? e.json({ error: i.error }, 401);
-		let a = p(e, "admin", !0);
-		if (a) return a;
-		let o = await m(e);
-		if (o == null) return e.json({ error: "body_too_large" }, 413);
-		let s = o.byteLength > 0 ? g(o) : {};
-		if (!s) return e.json({ error: "invalid_json" }, 400);
-		let c = String(e.req.param("group_id") ?? "").trim(), l = String(e.req.param("scope_id") ?? "").trim(), u = String(e.req.param("device_id") ?? "").trim(), d = _(s, "effect_id"), f = x(s, "membership_epoch");
-		if (!d) return e.json({ error: "effect_id_required" }, 400);
-		if (!u) return e.json({ error: "device_id_required" }, 400);
-		if (Number.isNaN(f)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
-		let h = n();
-		try {
-			let t = await E(h, c, l, e);
-			if (t.response) return t.response;
-			if (!await h.revokeScopeMembership({
-				effectId: d,
-				scopeId: l,
-				deviceId: u,
-				groupId: c,
-				membershipEpoch: f,
-				manifestHash: _(s, "manifest_hash"),
-				signedManifestJson: _(s, "signed_manifest_json"),
-				actorType: "admin",
-				actorId: y(e.req.header(Ot))
-			})) return e.json({ error: "membership_not_found" }, 404);
-			let n;
-			try {
-				n = (await h.listScopeMemberships(l, !0)).find((e) => e.device_id === u);
-			} catch {
-				n = void 0;
-			}
-			return e.json({
-				ok: !0,
-				scope_id: l,
-				device_id: u,
-				revocation: Et({
-					scopeId: l,
-					deviceId: u,
-					membershipEpoch: n?.membership_epoch ?? f
-				})
-			});
-		} catch (t) {
-			let n = t instanceof Error ? t.message : String(t);
-			return t instanceof r && t.code === "scope_group_mismatch" ? e.json({ error: "scope_not_found" }, 404) : e.json({ error: n }, n === "scope_membership_effect_conflict" ? 409 : 400);
-		} finally {
-			await h.close();
-		}
-	}), d.get("/v1/admin/devices", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = (e.req.query("group_id") ?? "").trim();
-		if (!a) return e.json({ error: "group_id_required" }, 400);
-		let o = [
-			"1",
-			"true",
-			"yes"
-		].includes((e.req.query("include_disabled") ?? "0").trim().toLowerCase()), s = n();
-		try {
-			return e.json({ items: await s.listEnrolledDevices(a, o) });
-		} finally {
-			await s.close();
-		}
-	}), d.post("/v1/admin/devices/rename", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim(), l = String(o.display_name ?? "").trim();
-		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
-		if (!l) return e.json({ error: "display_name_required" }, 400);
-		let u = n();
-		try {
-			if (!await u.renameDevice(s, c, l)) return e.json({ error: "device_not_found" }, 404);
-			let t = await u.getEnrollment(s, c);
-			return e.json({
-				ok: !0,
-				device: t
-			});
-		} finally {
-			await u.close();
-		}
-	}), d.post("/v1/admin/devices/disable", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
-		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
-		let l = n();
-		try {
-			return await l.setDeviceEnabled(s, c, !1) ? e.json({ ok: !0 }) : e.json({ error: "device_not_found" }, 404);
-		} finally {
-			await l.close();
-		}
-	}), d.post("/v1/admin/devices/enable", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
-		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
-		let l = n();
-		try {
-			return await l.setDeviceEnabled(s, c, !0) ? e.json({ ok: !0 }) : e.json({ error: "device_not_found" }, 404);
-		} finally {
-			await l.close();
-		}
-	}), d.post("/v1/admin/devices/remove", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
-		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
-		let l = n();
-		try {
-			return await l.removeDevice(s, c) ? e.json({ ok: !0 }) : e.json({ error: "device_not_found" }, 404);
-		} finally {
-			await l.close();
-		}
-	}), d.post("/v1/admin/invites", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.group_id ?? "").trim(), c = String(o.policy ?? "auto_admit").trim(), l = String(o.expires_at ?? "").trim(), u = String(o.created_by ?? "").trim() || null, d = String(o.operation_id ?? "").trim() || null, f = String(o.reviewed_project_set_digest ?? "").trim() || null, _ = String(o.inviter_actor_id ?? "").trim() || null, y = String(o.inviter_display_name ?? "").trim() || null, x = String(o.inviter_device_id ?? "").trim() || null, S = String(o.pending_person_id ?? "").trim() || null, C = String(o.invite_kind ?? o.kind ?? "").trim(), w = String(o.policy_team_id ?? "").trim() || null, T = String(o.target_identity_id ?? "").trim() || null, E = String(o.reviewed_preview_digest ?? "").trim() || null, D, O = null, k = null;
-		if (!s || !["auto_admit", "approval_required"].includes(c) || !l) return e.json({ error: "group_id_policy_and_expires_at_required" }, 400);
-		if (Object.hasOwn(o, "assigned_identity_id")) return e.json({ error: "assigned_identity_id_forbidden" }, 400);
-		if (Number.isNaN(new Date(l).getTime())) return e.json({ error: "invalid_expires_at" }, 400);
-		if (!!d != !!f) return e.json({ error: "operation_intent_reference_incomplete" }, 400);
-		let A = C || (d ? "project_share" : "legacy_enrollment");
-		if (![
-			"legacy_enrollment",
-			"project_share",
-			"team_member",
-			"add_device"
-		].includes(A)) return e.json({ error: "invite_kind_invalid" }, 400);
-		if (A === "project_share" ? !d : d) return e.json({ error: "invite_kind_intent_mismatch" }, 400);
-		if (E && !/^[a-f0-9]{64}$/u.test(E)) return e.json({ error: "reviewed_preview_digest_invalid" }, 400);
-		if (A === "team_member" && (!w || !E || T) || A === "add_device" && (!T || !E || w) || !["team_member", "add_device"].includes(A) && (w || T || E)) return e.json({ error: "recipient_invite_metadata_invalid" }, 400);
-		if ([w, T].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) return e.json({ error: "recipient_invite_identifier_invalid" }, 400);
-		if (A === "team_member" || A === "add_device") {
-			if (o.reviewed_intent == null) return e.json({ error: "recipient_invite_review_unavailable" }, 400);
-			try {
-				D = await P(o.reviewed_intent, {
-					target: A === "team_member" ? {
-						kind: "team_member",
-						policyTeamId: String(w)
-					} : {
-						kind: "add_device",
-						targetIdentityId: String(T)
-					},
-					digest: String(E)
-				});
-			} catch (t) {
-				return t instanceof b && t.code === "recipient_invite_intent_mismatch" ? e.json({ error: t.code }, 409) : e.json({ error: "recipient_invite_review_unavailable" }, 400);
-			}
-		} else if (o.reviewed_intent != null) return e.json({ error: "recipient_invite_metadata_invalid" }, 400);
-		if (d && !/^share_[a-f0-9]{40}$/u.test(d) || f && !/^[a-f0-9]{64}$/u.test(f)) return e.json({ error: "operation_intent_reference_invalid" }, 400);
-		if (d) {
-			if (!_ || !y || !x || !S) return e.json({ error: "project_invite_identity_context_required" }, 400);
-			if ([
-				_,
-				x,
-				S
-			].some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) return e.json({ error: "project_invite_identity_context_invalid" }, 400);
-			try {
-				if (h(y, "inviter_display_name"), O = v(o.project_summaries), !Array.isArray(o.project_intent) || o.project_intent.length !== O.length || (k = o.project_intent.map((e, t) => {
-					if (!e || typeof e != "object" || Array.isArray(e)) throw Error("project_intent_invalid");
-					let n = e, r = String(n.canonical_identity ?? "").trim(), i = O?.[t];
-					if (!r || r.length > 2048 || /[\p{Cc}\p{Cf}]/u.test(r) || !i || n.display_name !== i.display_name || n.existing_memory_count !== i.existing_memory_count) throw Error("project_intent_invalid");
-					return {
-						canonical_identity: r,
-						...i
-					};
-				}), new Set(k.map((e) => e.canonical_identity)).size !== k.length)) throw Error("project_intent_invalid");
-			} catch (t) {
-				return e.json({ error: t instanceof Error ? t.message : "project_invite_invalid" }, 400);
-			}
-		}
-		let j = n();
-		try {
-			let t = await j.getGroup(s);
-			if (!t) return e.json({ error: "group_not_found" }, 404);
-			if (t.archived_at) return e.json({ error: "group_archived" }, 409);
-			let n = await j.createInvite({
-				groupId: s,
-				policy: c,
-				expiresAt: l,
-				createdBy: u,
-				operationId: d,
-				reviewedProjectSetDigest: f,
-				inviterActorId: _,
-				inviterDisplayName: y,
-				inviterDeviceId: x,
-				pendingPersonId: S,
-				projectSummaries: O,
-				projectIntent: k,
-				inviteKind: A,
-				policyTeamId: w,
-				targetIdentityId: T,
-				reviewedPreviewDigest: E,
-				reviewedIntent: D
-			}), r = {
-				v: 1,
-				kind: n.invite_kind === "team_member" || n.invite_kind === "add_device" ? n.invite_kind : "coordinator_team_invite",
-				coordinator_url: String(o.coordinator_url ?? "").trim(),
-				group_id: s,
-				policy: n.policy,
-				token: String(n.token ?? ""),
-				expires_at: n.expires_at,
-				team_name: n.team_name_snapshot ?? null,
-				...n.operation_id ? {
-					operation_id: n.operation_id,
-					inviter_name: n.inviter_display_name ?? null,
-					project_summaries: O ?? []
-				} : {},
-				...n.invite_kind === "team_member" ? {
-					policy_team_id: n.policy_team_id ?? void 0,
-					assigned_identity_id: n.assigned_identity_id ?? void 0,
-					reviewed_preview_digest: n.reviewed_preview_digest ?? void 0
-				} : {},
-				...n.invite_kind === "add_device" ? {
-					target_identity_id: n.target_identity_id ?? void 0,
-					reviewed_preview_digest: n.reviewed_preview_digest ?? void 0
-				} : {}
-			}, i = K(r), { token: a, ...p } = n;
-			return e.json({
-				ok: !0,
-				invite: p,
-				payload: r,
-				encoded: i,
-				link: q(i)
-			});
-		} catch (t) {
-			if (t instanceof Error && t.message === "invite_operation_intent_conflict") return e.json({ error: "invite_operation_intent_conflict" }, 409);
-			if (t instanceof Error && t.message === "invite_already_bound") return e.json({ error: "invite_already_bound" }, 409);
-			throw t;
-		} finally {
-			await j.close();
-		}
-	}), d.post("/v1/invites/inspect", async (e) => {
-		let r = await m(e);
-		if (r == null) return e.json({ error: "body_too_large" }, 413);
-		let i = g(r);
-		if (!i) return e.json({ error: "invalid_json" }, 400);
-		let a = String(i.token ?? "").trim();
-		if (!a) return e.json({ error: "invite_invalid" }, 404);
-		let o = n();
-		try {
-			let n = await o.getInviteByTokenForInspection(a);
-			if (!n || n.revoked_at) return e.json({ error: "invite_invalid" }, 404);
-			if (n.invite_kind === "team_member" || n.invite_kind === "add_device") try {
-				let n = await o.inspectRecipientInvite({
-					token: a,
-					now: t.now()
-				});
-				return n ? e.json(n.kind === "team_member" ? {
-					kind: n.kind,
-					policy_team_id: n.policy_team_id,
-					assigned_identity_id: n.assigned_identity_id,
-					reviewed_preview_digest: n.reviewed_preview_digest,
-					reviewed_intent: n.reviewed_intent,
-					bound: n.bound
-				} : {
-					kind: n.kind,
-					target_identity_id: n.target_identity_id,
-					reviewed_preview_digest: n.reviewed_preview_digest,
-					reviewed_intent: n.reviewed_intent,
-					bound: n.bound
-				}) : e.json({ error: "invite_invalid" }, 404);
-			} catch (t) {
-				let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
-				return e.json({ error: n }, r);
-			}
-			let r = !!(n.operation_id || n.reviewed_project_set_digest);
-			if (new Date(n.expires_at) <= new Date(t.now()) && (!r || !n.consumed_at)) return e.json({ error: "invite_expired" }, 410);
-			if (!n.operation_id) return e.json({
-				kind: "legacy_team_invite",
-				team_name: n.team_name_snapshot
-			});
-			if (!n.project_intent_json || !n.project_summaries_json) return e.json({ error: "invite_invalid" }, 404);
-			let i;
-			try {
-				i = w(n.project_summaries_json);
-			} catch {
-				return e.json({ error: "invite_invalid" }, 409);
-			}
-			return e.json({
-				kind: "project_share_invite",
-				operation_id: n.operation_id,
-				inviter_name: n.inviter_display_name,
-				team_name: n.team_name_snapshot,
-				projects: i,
-				bound: !!n.consumed_at
-			});
-		} finally {
-			await o.close();
-		}
-	}), d.get("/v1/admin/invites", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = (e.req.query("group_id") ?? "").trim();
-		if (!a) return e.json({ error: "group_id_required" }, 400);
-		let o = n();
-		try {
-			let t = (await o.listInvites(a)).map(({ token: e, ...t }) => t);
-			return e.json({ items: t });
-		} finally {
-			await o.close();
-		}
-	}), d.get("/v1/admin/project-invites/:operationId", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return e.json({ error: r.error }, 401);
-		let i = String(e.req.param("operationId") ?? "").trim(), a = String(e.req.query("group_id") ?? "").trim();
-		if (!i || !a) return e.json({ error: "operation_id_and_group_id_required" }, 400);
-		let o = n();
-		try {
-			let n = (await o.listInvites(a)).find((e) => e.operation_id === i);
-			if (!n) return e.json({ error: "operation_not_found" }, 404);
-			let r;
-			try {
-				r = C(n.project_intent_json);
-			} catch {
-				return e.json({ error: "operation_intent_invalid" }, 409);
-			}
-			let s = null;
-			if (!n.consumed_at && !n.revoked_at && new Date(n.expires_at) > new Date(t.now()) && n.token && !n.token.startsWith("consumed:")) {
-				let t = r.map((e) => ({
-					display_name: String(e.display_name ?? ""),
-					existing_memory_count: Number(e.existing_memory_count ?? 0)
-				}));
-				s = q(K({
-					v: 1,
-					kind: "coordinator_team_invite",
-					coordinator_url: new URL(e.req.url).origin,
-					group_id: n.group_id,
-					policy: n.policy,
-					token: n.token,
-					expires_at: n.expires_at,
-					team_name: n.team_name_snapshot,
-					operation_id: i,
-					inviter_name: n.inviter_display_name ?? null,
-					project_summaries: t
-				}));
-			}
-			return e.json({
-				operation_id: n.operation_id,
-				group_id: n.group_id,
-				reviewed_project_set_digest: n.reviewed_project_set_digest,
-				state: n.consumed_at ? "accepted" : "waiting_for_acceptance",
-				pending_person_id: n.pending_person_id,
-				recipient_actor_id: n.recipient_actor_id,
-				recipient_display_name: n.recipient_display_name,
-				recipient_device_id: n.bound_device_id,
-				recipient_device_display_name: n.recipient_device_display_name,
-				recipient_public_key: n.bound_public_key,
-				recipient_fingerprint: n.bound_fingerprint,
-				consumed_at: n.consumed_at,
-				bootstrap_grant_id: n.bootstrap_grant_id,
-				trust_state: n.trust_state,
-				projects: r,
-				invite_link: s
-			});
-		} finally {
-			await o.close();
-		}
-	}), d.get("/v1/admin/bootstrap-grants/:grantId", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = String(e.req.param("grantId") ?? "").trim();
-		if (!a) return e.json({ error: "grant_id_required" }, 400);
-		let o = n();
-		try {
-			let t = await o.getBootstrapGrant(a);
-			if (!t) return e.json({ error: "grant_not_found" }, 404);
-			let n = await o.getEnrollment(t.group_id, t.worker_device_id);
-			if (!n) return e.json({ error: "worker_enrollment_not_found" }, 404);
-			let r = {
-				grant: t,
-				worker_enrollment: n
-			};
-			return e.json(r);
-		} finally {
-			await o.close();
-		}
-	}), d.get("/v1/admin/bootstrap-grants", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = (e.req.query("group_id") ?? "").trim();
-		if (!a) return e.json({ error: "group_id_required" }, 400);
-		let o = n();
-		try {
-			return e.json({ items: await o.listBootstrapGrants(a) });
-		} finally {
-			await o.close();
-		}
-	}), d.post("/v1/admin/bootstrap-grants/revoke", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = await m(e);
-		if (a == null) return e.json({ error: "body_too_large" }, 413);
-		let o = g(a);
-		if (!o) return e.json({ error: "invalid_json" }, 400);
-		let s = String(o.grant_id ?? "").trim();
-		if (!s) return e.json({ error: "grant_id_required" }, 400);
-		let c = n();
-		try {
-			return await c.revokeBootstrapGrant(s, t.now()) ? e.json({
-				ok: !0,
-				grant_id: s
-			}) : e.json({ error: "grant_not_found" }, 404);
-		} finally {
-			await c.close();
-		}
-	}), d.post("/v1/admin/join-requests/approve", async (e) => Ft(e, !0, {
-		createStore: n,
-		runtime: t,
-		rateLimitedResponse: p
-	})), d.post("/v1/admin/join-requests/deny", async (e) => Ft(e, !1, {
-		createStore: n,
-		runtime: t,
-		rateLimitedResponse: p
-	})), d.get("/v1/admin/join-requests", async (e) => {
-		let r = Z(e.req.header(X), t);
-		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-		let i = p(e, "admin", !0);
-		if (i) return i;
-		let a = (e.req.query("group_id") ?? "").trim();
-		if (!a) return e.json({ error: "group_id_required" }, 400);
-		let o = n();
-		try {
-			return e.json({ items: await o.listJoinRequests(a) });
-		} finally {
-			await o.close();
-		}
-	}), d.post("/v1/join", async (e) => {
-		let r = await m(e);
-		if (r == null) return e.json({ error: "body_too_large" }, 413);
-		let i = g(r);
-		if (!i) return e.json({ error: "invalid_json" }, 400);
-		let a = String(i.token ?? "").trim(), o = String(i.device_id ?? "").trim(), s = String(i.fingerprint ?? "").trim(), c = String(i.public_key ?? "").trim(), l = String(i.display_name ?? "").trim() || null, u = String(i.operation_id ?? "").trim(), d = String(i.recipient_actor_id ?? "").trim(), f = String(i.recipient_display_name ?? "").trim(), p = String(i.device_display_name ?? "").trim();
-		if (!a || !o || !s || !c) return e.json({ error: "token_device_id_fingerprint_public_key_required" }, 400);
-		if (F(c) !== s) return e.json({ error: "fingerprint_mismatch" }, 400);
-		let _ = n();
-		try {
-			let n = await _.getInviteByTokenForInspection(a);
-			if (!n) return e.json({ error: "invite_invalid" }, 404);
-			let r = !!(n.operation_id || n.reviewed_project_set_digest), m = n.invite_kind === "team_member" || n.invite_kind === "add_device";
-			if (n.revoked_at) return e.json({ error: r || m ? "invite_invalid" : "revoked_token" }, 400);
-			if (!n.consumed_at && new Date(n.expires_at) <= new Date(t.now())) return e.json({ error: r || m ? "invite_expired" : "expired_token" }, 410);
-			if (m) {
-				let r = new Set([
-					"token",
-					"invite_kind",
-					"kind",
-					"identity_id",
-					"device_id",
-					"public_key",
-					"fingerprint"
-				]);
-				if (Object.keys(i).some((e) => !r.has(e))) return e.json({ error: "unexpected_recipient_invite_fields" }, 400);
-				let l = String(i.invite_kind ?? i.kind ?? "").trim(), u = String(i.identity_id ?? "").trim();
-				if (!u || l !== n.invite_kind) return e.json({ error: "recipient_invite_binding_required" }, 400);
-				if (u.length > 256 || /[\p{Cc}\p{Cf}]/u.test(u)) return e.json({ error: "identity_id_invalid" }, 400);
-				try {
-					let r = await _.consumeRecipientInvite({
-						token: a,
-						inviteKind: n.invite_kind,
-						identityId: u,
-						deviceId: o,
-						publicKey: c,
-						fingerprint: s,
-						now: t.now()
-					});
-					return e.json({
-						ok: !0,
-						status: r.status,
-						kind: r.invite.invite_kind,
-						group_id: r.invite.group_id,
-						identity_id: r.invite.recipient_actor_id,
-						policy_team_id: r.invite.policy_team_id ?? null,
-						target_identity_id: r.invite.target_identity_id ?? null,
-						assigned_identity_id: r.invite.assigned_identity_id ?? null,
-						reviewed_preview_digest: r.invite.reviewed_preview_digest,
-						reviewed_intent: r.reviewed_intent
-					});
-				} catch (t) {
-					let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
-					return e.json({ error: n }, r);
-				}
-			}
-			if (n.operation_id || n.reviewed_project_set_digest) {
-				let r = new Set([
-					"token",
-					"operation_id",
-					"device_id",
-					"public_key",
-					"fingerprint",
-					"display_name",
-					"recipient_actor_id",
-					"recipient_display_name",
-					"device_display_name"
-				]);
-				if (Object.keys(i).some((e) => !r.has(e))) return e.json({ error: "unexpected_project_invite_fields" }, 400);
-				if (!u || !d || !f || !p) return e.json({ error: "project_invite_identity_required" }, 400);
-				if (String(n.inviter_device_id ?? "").trim() === o) return e.json({ error: "project_invite_self_acceptance_forbidden" }, 409);
-				if (d.length > 256 || /[\p{Cc}\p{Cf}]/u.test(d)) return e.json({ error: "recipient_actor_id_invalid" }, 400);
-				let l, m;
-				try {
-					l = h(f, "recipient_display_name"), m = h(p, "device_display_name");
-				} catch (t) {
-					return e.json({ error: t instanceof Error ? t.message : "project_invite_identity_invalid" }, 400);
-				}
-				try {
-					let n = await _.consumeProjectInvite({
-						token: a,
-						operationId: u,
-						deviceId: o,
-						publicKey: c,
-						fingerprint: s,
-						recipientActorId: d,
-						recipientDisplayName: l,
-						deviceDisplayName: m,
-						now: t.now()
-					});
-					return e.json({
-						ok: !0,
-						status: mt,
-						group_id: n.invite.group_id,
-						operation_id: n.invite.operation_id,
-						trust_state: n.invite.trust_state,
-						bootstrap_grant_id: n.bootstrap_grant?.grant_id ?? null,
-						inviter_device: n.seed_enrollment ? {
-							device_id: n.seed_enrollment.device_id,
-							public_key: n.seed_enrollment.public_key,
-							fingerprint: n.seed_enrollment.fingerprint,
-							display_name: n.seed_enrollment.display_name
-						} : null
-					});
-				} catch (t) {
-					let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
-					return e.json({ error: n }, r);
-				}
-			}
-			if ([
-				"operation_id",
-				"recipient_actor_id",
-				"recipient_display_name",
-				"device_display_name"
-			].some((e) => Object.hasOwn(i, e))) return e.json({ error: "unexpected_project_invite_fields" }, 400);
-			let g = await _.getGroup(String(n.group_id));
-			if (!g) return e.json({ error: "group_not_found" }, 404);
-			if (g.archived_at) return e.json({ error: "group_archived" }, 409);
-			let v = String(n.group_id);
-			if (await _.getEnrollment(v, o)) return e.json({
-				ok: !0,
-				status: "already_enrolled",
-				group_id: n.group_id,
-				policy: n.policy
-			});
-			let y = String(n.policy);
-			if (!["auto_admit", "approval_required"].includes(y)) return e.json({ error: `unknown invite policy: ${y}` }, 400);
-			if (y === "approval_required") {
-				let t = await _.createJoinRequest({
-					groupId: v,
-					deviceId: o,
-					publicKey: c,
-					fingerprint: s,
-					displayName: l,
-					token: a
-				});
-				return e.json({
-					ok: !0,
-					status: "pending",
-					group_id: n.group_id,
-					policy: n.policy,
-					request_id: t.request_id
-				});
-			}
-			return await _.enrollDevice(v, {
-				deviceId: o,
-				fingerprint: s,
-				publicKey: c,
-				displayName: l
-			}), e.json({
-				ok: !0,
-				status: "enrolled",
-				group_id: n.group_id,
-				policy: n.policy
-			});
-		} finally {
-			await _.close();
-		}
-	}), d;
-}
-async function Ft(e, t, n) {
-	let r = Z(e.req.header(X), n.runtime);
-	if (!r.ok) return n.rateLimitedResponse(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
-	let i = n.rateLimitedResponse(e, "admin", !0);
-	if (i) return i;
-	let a = await (async () => {
-		let t = Number.parseInt(e.req.header("content-length") ?? "", 10);
-		if (Number.isFinite(t) && t > Y) return null;
-		let n = e.req.raw.body;
-		if (!n) return new Uint8Array();
-		let r = n.getReader(), i = [], a = 0;
-		try {
-			for (;;) {
-				let { done: e, value: t } = await r.read();
-				if (e) break;
-				if (t) {
-					if (a += t.byteLength, a > Y) return await r.cancel(), null;
-					i.push(t);
-				}
-			}
-		} finally {
-			r.releaseLock();
-		}
-		let o = new Uint8Array(a), s = 0;
-		for (let e of i) o.set(e, s), s += e.byteLength;
-		return o;
-	})();
-	if (a == null) return e.json({ error: "body_too_large" }, 413);
-	let o;
-	try {
-		let e = new TextDecoder(), t = JSON.parse(e.decode(a));
-		o = typeof t == "object" && t && !Array.isArray(t) ? t : null;
-	} catch {
-		o = null;
-	}
-	if (!o) return e.json({ error: "invalid_json" }, 400);
-	let s = String(o.request_id ?? "").trim(), c = String(o.reviewed_by ?? "").trim() || null, l = String(o.bootstrap_grant_seed_device_id ?? "").trim(), u = String(o.bootstrap_grant_expires_at ?? "").trim();
-	if (!s) return e.json({ error: "request_id_required" }, 400);
-	let d = [l, u].filter(Boolean).length;
-	if (d > 0 && d < 2) return e.json({ error: "bootstrap_grant_seed_device_id_and_expires_at_required_together" }, 400);
-	let f = n.createStore();
-	try {
-		let n = await f.reviewJoinRequest({
-			requestId: s,
-			approved: t,
-			reviewedBy: c,
-			bootstrapGrant: t && l && u ? {
-				seedDeviceId: l,
-				expiresAt: u,
-				createdBy: c
-			} : null
-		});
-		return n ? n._no_transition ? e.json({
-			error: "request_not_pending",
-			status: n.status
-		}, 409) : e.json({
-			ok: !0,
-			request: n
-		}) : e.json({ error: "request_not_found" }, 404);
-	} finally {
-		await f.close();
-	}
-}
-//#endregion
-export { r as A, _ as C, f as D, v as E, s as F, o as M, l as N, u as O, a as P, P as S, h as T, b as _, Tt as a, ce as b, gt as c, ft as d, K as f, y as g, F as h, Et as i, c as j, p as k, _t as l, q as m, Dt as n, mt as o, pt as p, wt as r, ht as s, Pt as t, vt as u, oe as v, g as w, se as x, M as y };
-
-//# sourceMappingURL=coordinator-api-Btb6CEhw.js.map