@codemem/core 0.40.1 → 0.41.0

package/dist/coordinator-api-Bxw5Q3py.js

@@ -0,0 +1,3072 @@
+import { resolve as e } from "node:path";
+import { createHash as t } from "node:crypto";
+//#region src/coordinator-membership-effects.ts
+var n = "scope_membership_effect_conflict", r = {
+	device_not_enrolled: "device must be enrolled and enabled in the scope group.",
+	scope_group_mismatch: "membership groupId must match the scope groupId.",
+	scope_inactive: "scope is not active.",
+	scope_not_found: "scopeId must reference an existing scope."
+}, i = class extends Error {
+	code;
+	constructor(e) {
+		super(r[e]), this.name = "CoordinatorMembershipError", this.code = e;
+	}
+};
+function a(e) {
+	return e?.trim() || null;
+}
+function o(e) {
+	let t = a(e);
+	if (!t) throw Error("effectId is required.");
+	if (t.length > 512 || /[\p{Cc}\p{Cf}]/u.test(t)) throw Error("effectId is invalid.");
+	return t;
+}
+function s(e) {
+	return JSON.stringify({
+		scopeId: a(e.scopeId),
+		deviceId: a(e.deviceId),
+		role: a(e.role),
+		membershipEpoch: e.membershipEpoch ?? null,
+		coordinatorId: a(e.coordinatorId),
+		groupId: a(e.groupId),
+		manifestIssuerDeviceId: a(e.manifestIssuerDeviceId),
+		manifestHash: a(e.manifestHash),
+		signedManifestJson: a(e.signedManifestJson),
+		actorType: a(e.actorType),
+		actorId: a(e.actorId)
+	});
+}
+function c(e) {
+	return JSON.stringify({
+		scopeId: a(e.scopeId),
+		deviceId: a(e.deviceId),
+		groupId: a(e.groupId),
+		membershipEpoch: e.membershipEpoch ?? null,
+		manifestHash: a(e.manifestHash),
+		signedManifestJson: a(e.signedManifestJson),
+		actorType: a(e.actorType),
+		actorId: a(e.actorId)
+	});
+}
+function l(e, t, r) {
+	if (e.action !== t || e.request_json !== r) throw Error(n);
+}
+function u(e) {
+	if (e.action !== "grant" || e.outcome_applied !== 1 || e.role == null || e.status == null || e.membership_epoch == null || e.updated_at == null) throw Error("scope_membership_effect_receipt_invalid");
+	return {
+		scope_id: e.scope_id,
+		device_id: e.device_id,
+		role: e.role,
+		status: e.status,
+		membership_epoch: e.membership_epoch,
+		coordinator_id: e.coordinator_id,
+		group_id: e.group_id,
+		manifest_issuer_device_id: e.manifest_issuer_device_id,
+		manifest_hash: e.manifest_hash,
+		signed_manifest_json: e.signed_manifest_json,
+		updated_at: e.updated_at
+	};
+}
+//#endregion
+//#region src/coordinator-store-contract.ts
+function d(e) {
+	let t = e.trim(), n = new Date(t);
+	if (!t || Number.isNaN(n.getTime())) throw Error("expiresAt must be a valid date.");
+	return n.toISOString();
+}
+var f = /^identity:[A-Za-z0-9_-]{18,24}$/u;
+function p(e) {
+	return typeof e == "string" && e === e.trim() && f.test(e);
+}
+function m(e) {
+	return String(e.kind === "team_member" ? e.assigned_identity_id ?? "" : e.target_identity_id ?? "").trim();
+}
+//#endregion
+//#region src/project-invite-identity.ts
+var h = 120;
+function g(e, t) {
+	if ([...e].some((e) => /[\p{Cc}\p{Cf}]/u.test(e))) throw Error(`${t}_invalid`);
+	let n = e.replace(/\s+/gu, " ").trim();
+	if (!n) throw Error(`${t}_required`);
+	if ([...n].length > h) throw Error(`${t}_too_long`);
+	return n;
+}
+function _(e) {
+	let t = String(e ?? "").replace(/\.local$/iu, "");
+	return t.trim() ? g(t.replace(/[-_]+/gu, " "), "device_display_name") : null;
+}
+function v(e) {
+	for (let t of [
+		e.explicitName,
+		e.osName,
+		e.coordinatorName
+	]) {
+		let e = _(t);
+		if (e) return e;
+	}
+	let t = String(e.fallbackSeed ?? "").replace(/[^a-z0-9]/giu, "").slice(0, 6);
+	return t ? `Codemem device ${t}` : "Codemem device";
+}
+function y(e) {
+	if (!Array.isArray(e) || e.length === 0 || e.length > 100) throw Error("project_summaries_invalid");
+	return e.map((e) => {
+		if (!e || typeof e != "object" || Array.isArray(e)) throw Error("project_summaries_invalid");
+		let t = e;
+		if (!Number.isSafeInteger(t.existing_memory_count) || Number(t.existing_memory_count) < 0) throw Error("project_summaries_invalid");
+		return {
+			display_name: g(String(t.display_name ?? ""), "project_name"),
+			existing_memory_count: Number(t.existing_memory_count)
+		};
+	});
+}
+//#endregion
+//#region src/recipient-reviewed-intent.ts
+var b = 1, x = class extends Error {
+	code;
+	constructor(e) {
+		super(e), this.name = "RecipientReviewedIntentError", this.code = e;
+	}
+}, S = /[\p{Cc}\p{Cf}]/u, C = 100, w = 64 * 1024;
+function T() {
+	throw new x("recipient_reviewed_intent_invalid");
+}
+function E(e) {
+	return (!e || typeof e != "object" || Array.isArray(e)) && T(), e;
+}
+function D(e, t) {
+	Object.keys(e).some((e) => !t.includes(e)) && T();
+}
+function O(e, t) {
+	return (typeof e != "string" || !e || e !== e.trim() || e.length > t || S.test(e)) && T(), e;
+}
+function k(e) {
+	(typeof e != "string" || S.test(e)) && T();
+	let t = e.trim().replace(/\s+/gu, " ");
+	return (!t || t.length > 256) && T(), t;
+}
+function A(e) {
+	typeof e != "string" && T();
+	try {
+		return g(e, "identity_display_name");
+	} catch {
+		return T();
+	}
+}
+function j(e) {
+	return (typeof e != "number" || !Number.isSafeInteger(e) || e < 0) && T(), e;
+}
+function M(e, t) {
+	return e < t ? -1 : +(e > t);
+}
+function ee(e) {
+	return e.kind === "direct" ? "direct" : `team\u0000${e.teamId}`;
+}
+function te(e) {
+	let t = E(e);
+	return t.kind === "direct" ? (D(t, ["kind"]), { kind: "direct" }) : (t.kind !== "team" && T(), D(t, [
+		"kind",
+		"teamId",
+		"displayName"
+	]), {
+		kind: "team",
+		teamId: O(t.teamId, 256),
+		displayName: k(t.displayName)
+	});
+}
+function ne(e) {
+	let t = E(e);
+	D(t, [
+		"canonicalProjectIdentity",
+		"displayName",
+		"existingMemoryCount",
+		"futureMemoriesShared",
+		"sources"
+	]), (t.futureMemoriesShared !== !0 || !Array.isArray(t.sources) || !t.sources.length) && T();
+	let n = t.sources.map(te).toSorted((e, t) => M(ee(e), ee(t)));
+	return new Set(n.map(ee)).size !== n.length && T(), {
+		canonicalProjectIdentity: O(t.canonicalProjectIdentity, 512),
+		displayName: k(t.displayName),
+		existingMemoryCount: j(t.existingMemoryCount),
+		futureMemoriesShared: !0,
+		sources: n
+	};
+}
+function re(e) {
+	let t = E(e);
+	return D(t, [
+		"canonicalProjectIdentity",
+		"displayName",
+		"existingMemoryCount"
+	]), {
+		canonicalProjectIdentity: O(t.canonicalProjectIdentity, 512),
+		displayName: k(t.displayName),
+		existingMemoryCount: j(t.existingMemoryCount)
+	};
+}
+function ie(e) {
+	(!Array.isArray(e.projects) || !Array.isArray(e.excludedProjects) || e.projects.length > C) && T();
+	let t = e.projects.map(ne).toSorted((e, t) => M(e.canonicalProjectIdentity, t.canonicalProjectIdentity)), n = e.excludedProjects.map(re).toSorted((e, t) => M(e.canonicalProjectIdentity, t.canonicalProjectIdentity)), r = t.map((e) => e.canonicalProjectIdentity), i = n.map((e) => e.canonicalProjectIdentity);
+	return (new Set(r).size !== r.length || new Set(i).size !== i.length || i.some((e) => r.includes(e))) && T(), {
+		projects: t,
+		excludedProjects: n
+	};
+}
+function ae(e, t) {
+	if (!(e.journey === "team" && t.kind === "team_member" && e.team.teamId === t.policyTeamId || e.journey === "add_device" && t.kind === "add_device" && e.targetIdentity.identityId === t.targetIdentityId)) throw new x("recipient_invite_intent_mismatch");
+}
+function N(e, t) {
+	let n = E(e);
+	n.version !== 1 && T();
+	let r = ie(n), i;
+	if (n.journey === "team") {
+		D(n, [
+			"version",
+			"journey",
+			"team",
+			"projects",
+			"excludedProjects"
+		]);
+		let e = E(n.team);
+		D(e, [
+			"teamId",
+			"displayName",
+			"futureProjectsInherit"
+		]), e.futureProjectsInherit !== !0 && T(), i = {
+			version: 1,
+			journey: "team",
+			team: {
+				teamId: O(e.teamId, 256),
+				displayName: k(e.displayName),
+				futureProjectsInherit: !0
+			},
+			...r
+		};
+	} else if (n.journey === "add_device") {
+		D(n, [
+			"version",
+			"journey",
+			"targetIdentity",
+			"projects",
+			"excludedProjects"
+		]);
+		let e = E(n.targetIdentity);
+		D(e, ["identityId", "displayName"]), i = {
+			version: 1,
+			journey: "add_device",
+			targetIdentity: {
+				identityId: O(e.identityId, 256),
+				displayName: A(e.displayName)
+			},
+			...r
+		};
+	} else T();
+	return t && ae(i, t), new TextEncoder().encode(P(i)).byteLength > w && T(), i;
+}
+function P(e) {
+	return Array.isArray(e) ? `[${e.map(P).join(",")}]` : e && typeof e == "object" ? `{${Object.entries(e).toSorted(([e], [t]) => M(e, t)).map(([e, t]) => `${JSON.stringify(e)}:${P(t)}`).join(",")}}` : JSON.stringify(e) ?? "null";
+}
+function oe(e, t) {
+	return P(N(e, t));
+}
+async function se(e, t) {
+	let n = oe(e, t), r = new TextEncoder().encode(`recipient-reviewed-intent-v1\n${n}`), i = await globalThis.crypto.subtle.digest("SHA-256", r);
+	return Array.from(new Uint8Array(i), (e) => e.toString(16).padStart(2, "0")).join("");
+}
+async function F(e, t) {
+	let n = N(e, t.target);
+	if (await se(n) !== t.digest) throw new x("recipient_invite_intent_mismatch");
+	return n;
+}
+async function ce(e, t) {
+	if (!e) throw Error("recipient_invite_review_unavailable");
+	let n;
+	try {
+		n = JSON.parse(e);
+	} catch {
+		throw Error("recipient_invite_review_unavailable");
+	}
+	try {
+		let r = N(n, t.target);
+		if (P(r) !== e) throw Error("recipient_invite_review_unavailable");
+		return await F(r, t);
+	} catch (e) {
+		throw e instanceof x && e.code === "recipient_invite_intent_mismatch" || e instanceof Error && e.message === "recipient_invite_review_unavailable" ? e : Error("recipient_invite_review_unavailable");
+	}
+}
+//#endregion
+//#region src/sync-fingerprint.ts
+function le(e) {
+	return t("sha256").update(e, "utf-8").digest("hex");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/hono@4.12.26/node_modules/hono/dist/compose.js
+var ue = (e, t, n) => (r, i) => {
+	let a = -1;
+	return o(0);
+	async function o(s) {
+		if (s <= a) throw Error("next() called multiple times");
+		a = s;
+		let c, l = !1, u;
+		if (e[s] ? (u = e[s][0][0], r.req.routeIndex = s) : u = s === e.length && i || void 0, u) try {
+			c = await u(r, () => o(s + 1));
+		} catch (e) {
+			if (e instanceof Error && t) r.error = e, c = await t(e, r), l = !0;
+			else throw e;
+		}
+		else r.finalized === !1 && n && (c = await n(r));
+		return c && (r.finalized === !1 || l) && (r.res = c), r;
+	}
+}, de = /* @__PURE__ */ Symbol(), fe = async (e, t = /* @__PURE__ */ Object.create(null)) => {
+	let { all: n = !1, dot: r = !1 } = t, i = (e instanceof Pe ? e.raw.headers : e.headers).get("Content-Type");
+	return i?.startsWith("multipart/form-data") || i?.startsWith("application/x-www-form-urlencoded") ? pe(e, {
+		all: n,
+		dot: r
+	}) : {};
+};
+async function pe(e, t) {
+	let n = await e.formData();
+	return n ? me(n, t) : {};
+}
+function me(e, t) {
+	let n = /* @__PURE__ */ Object.create(null);
+	return e.forEach((e, r) => {
+		t.all || r.endsWith("[]") ? he(n, r, e) : n[r] = e;
+	}), t.dot && Object.entries(n).forEach(([e, t]) => {
+		e.includes(".") && (ge(n, e, t), delete n[e]);
+	}), n;
+}
+var he = (e, t, n) => {
+	e[t] === void 0 ? t.endsWith("[]") ? e[t] = [n] : e[t] = n : Array.isArray(e[t]) ? e[t].push(n) : e[t] = [e[t], n];
+}, ge = (e, t, n) => {
+	if (/(?:^|\.)__proto__\./.test(t)) return;
+	let r = e, i = t.split(".");
+	i.forEach((e, t) => {
+		t === i.length - 1 ? r[e] = n : ((!r[e] || typeof r[e] != "object" || Array.isArray(r[e]) || r[e] instanceof File) && (r[e] = /* @__PURE__ */ Object.create(null)), r = r[e]);
+	});
+}, _e = (e) => {
+	let t = e.split("/");
+	return t[0] === "" && t.shift(), t;
+}, ve = (e) => {
+	let { groups: t, path: n } = ye(e);
+	return be(_e(n), t);
+}, ye = (e) => {
+	let t = [];
+	return e = e.replace(/\{[^}]+\}/g, (e, n) => {
+		let r = `@${n}`;
+		return t.push([r, e]), r;
+	}), {
+		groups: t,
+		path: e
+	};
+}, be = (e, t) => {
+	for (let n = t.length - 1; n >= 0; n--) {
+		let [r] = t[n];
+		for (let i = e.length - 1; i >= 0; i--) if (e[i].includes(r)) {
+			e[i] = e[i].replace(r, t[n][1]);
+			break;
+		}
+	}
+	return e;
+}, xe = {}, Se = (e, t) => {
+	if (e === "*") return "*";
+	let n = e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+	if (n) {
+		let r = `${e}#${t}`;
+		return xe[r] || (n[2] ? xe[r] = t && t[0] !== ":" && t[0] !== "*" ? [
+			r,
+			n[1],
+			RegExp(`^${n[2]}(?=/${t})`)
+		] : [
+			e,
+			n[1],
+			RegExp(`^${n[2]}$`)
+		] : xe[r] = [
+			e,
+			n[1],
+			!0
+		]), xe[r];
+	}
+	return null;
+}, Ce = (e, t) => {
+	try {
+		return t(e);
+	} catch {
+		return e.replace(/(?:%[0-9A-Fa-f]{2})+/g, (e) => {
+			try {
+				return t(e);
+			} catch {
+				return e;
+			}
+		});
+	}
+}, we = (e) => Ce(e, decodeURI), Te = (e) => {
+	let t = e.url, n = t.indexOf("/", t.indexOf(":") + 4), r = n;
+	for (; r < t.length; r++) {
+		let e = t.charCodeAt(r);
+		if (e === 37) {
+			let e = t.indexOf("?", r), i = t.indexOf("#", r), a = e === -1 ? i === -1 ? void 0 : i : i === -1 ? e : Math.min(e, i), o = t.slice(n, a);
+			return we(o.includes("%25") ? o.replace(/%25/g, "%2525") : o);
+		} else if (e === 63 || e === 35) break;
+	}
+	return t.slice(n, r);
+}, Ee = (e) => {
+	let t = Te(e);
+	return t.length > 1 && t.at(-1) === "/" ? t.slice(0, -1) : t;
+}, I = (e, t, ...n) => (n.length && (t = I(t, ...n)), `${e?.[0] === "/" ? "" : "/"}${e}${t === "/" ? "" : `${e?.at(-1) === "/" ? "" : "/"}${t?.[0] === "/" ? t.slice(1) : t}`}`), De = (e) => {
+	if (e.charCodeAt(e.length - 1) !== 63 || !e.includes(":")) return null;
+	let t = e.split("/"), n = [], r = "";
+	return t.forEach((e) => {
+		if (e !== "" && !/\:/.test(e)) r += "/" + e;
+		else if (/\:/.test(e)) if (/\?/.test(e)) {
+			n.length === 0 && r === "" ? n.push("/") : n.push(r);
+			let t = e.replace("?", "");
+			r += "/" + t, n.push(r);
+		} else r += "/" + e;
+	}), n.filter((e, t, n) => n.indexOf(e) === t);
+}, Oe = (e) => /[%+]/.test(e) ? (e.indexOf("+") !== -1 && (e = e.replace(/\+/g, " ")), e.indexOf("%") === -1 ? e : Ce(e, Me)) : e, ke = (e, t, n) => {
+	let r;
+	if (!n && t && !/[%+]/.test(t)) {
+		let n = e.indexOf("?", 8);
+		if (n === -1) return;
+		for (e.startsWith(t, n + 1) || (n = e.indexOf(`&${t}`, n + 1)); n !== -1;) {
+			let r = e.charCodeAt(n + t.length + 1);
+			if (r === 61) {
+				let r = n + t.length + 2, i = e.indexOf("&", r);
+				return Oe(e.slice(r, i === -1 ? void 0 : i));
+			} else if (r == 38 || isNaN(r)) return "";
+			n = e.indexOf(`&${t}`, n + 1);
+		}
+		if (r = /[%+]/.test(e), !r) return;
+	}
+	let i = {};
+	r ??= /[%+]/.test(e);
+	let a = e.indexOf("?", 8);
+	for (; a !== -1;) {
+		let t = e.indexOf("&", a + 1), o = e.indexOf("=", a);
+		o > t && t !== -1 && (o = -1);
+		let s = e.slice(a + 1, o === -1 ? t === -1 ? void 0 : t : o);
+		if (r && (s = Oe(s)), a = t, s === "") continue;
+		let c;
+		o === -1 ? c = "" : (c = e.slice(o + 1, t === -1 ? void 0 : t), r && (c = Oe(c))), n ? (i[s] && Array.isArray(i[s]) || (i[s] = []), i[s].push(c)) : i[s] ??= c;
+	}
+	return t ? i[t] : i;
+}, Ae = ke, je = (e, t) => ke(e, t, !0), Me = decodeURIComponent, Ne = (e) => Ce(e, Me), Pe = class {
+	raw;
+	#e;
+	#t;
+	routeIndex = 0;
+	path;
+	bodyCache = {};
+	constructor(e, t = "/", n = [[]]) {
+		this.raw = e, this.path = t, this.#t = n, this.#e = {};
+	}
+	param(e) {
+		return e ? this.#n(e) : this.#r();
+	}
+	#n(e) {
+		let t = this.#t[0][this.routeIndex][1][e], n = this.#i(t);
+		return n && /\%/.test(n) ? Ne(n) : n;
+	}
+	#r() {
+		let e = {}, t = Object.keys(this.#t[0][this.routeIndex][1]);
+		for (let n of t) {
+			let t = this.#i(this.#t[0][this.routeIndex][1][n]);
+			t !== void 0 && (e[n] = /\%/.test(t) ? Ne(t) : t);
+		}
+		return e;
+	}
+	#i(e) {
+		return this.#t[1] ? this.#t[1][e] : e;
+	}
+	query(e) {
+		return Ae(this.url, e);
+	}
+	queries(e) {
+		return je(this.url, e);
+	}
+	header(e) {
+		if (e) return this.raw.headers.get(e) ?? void 0;
+		let t = {};
+		return this.raw.headers.forEach((e, n) => {
+			t[n] = e;
+		}), t;
+	}
+	async parseBody(e) {
+		return fe(this, e);
+	}
+	#a = (e) => {
+		let { bodyCache: t, raw: n } = this, r = t[e];
+		if (r) return r;
+		let i = Object.keys(t)[0];
+		return i ? t[i].then((t) => (i === "json" && (t = JSON.stringify(t)), new Response(t)[e]())) : t[e] = n[e]();
+	};
+	json() {
+		return this.#a("text").then((e) => JSON.parse(e));
+	}
+	text() {
+		return this.#a("text");
+	}
+	arrayBuffer() {
+		return this.#a("arrayBuffer");
+	}
+	bytes() {
+		return this.#a("arrayBuffer").then((e) => new Uint8Array(e));
+	}
+	blob() {
+		return this.#a("blob");
+	}
+	formData() {
+		return this.#a("formData");
+	}
+	addValidatedData(e, t) {
+		this.#e[e] = t;
+	}
+	valid(e) {
+		return this.#e[e];
+	}
+	get url() {
+		return this.raw.url;
+	}
+	get method() {
+		return this.raw.method;
+	}
+	get [de]() {
+		return this.#t;
+	}
+	get matchedRoutes() {
+		return this.#t[0].map(([[, e]]) => e);
+	}
+	get routePath() {
+		return this.#t[0].map(([[, e]]) => e)[this.routeIndex].path;
+	}
+}, Fe = {
+	Stringify: 1,
+	BeforeStream: 2,
+	Stream: 3
+}, Ie = (e, t) => {
+	let n = new String(e);
+	return n.isEscaped = !0, n.callbacks = t, n;
+}, Le = async (e, t, n, r, i) => {
+	typeof e == "object" && !(e instanceof String) && (e instanceof Promise || (e = e.toString()), e instanceof Promise && (e = await e));
+	let a = e.callbacks;
+	if (!a?.length) return Promise.resolve(e);
+	i ? i[0] += e : i = [e];
+	let o = Promise.all(a.map((e) => e({
+		phase: t,
+		buffer: i,
+		context: r
+	}))).then((e) => Promise.all(e.filter(Boolean).map((e) => Le(e, t, !1, r, i))).then(() => i[0]));
+	return n ? Ie(await o, a) : o;
+}, Re = "text/plain; charset=UTF-8", ze = (e, t) => ({
+	"Content-Type": e,
+	...t
+}), L = (e, t) => new Response(e, t), Be = class {
+	#e;
+	#t;
+	env = {};
+	#n;
+	finalized = !1;
+	error;
+	#r;
+	#i;
+	#a;
+	#o;
+	#s;
+	#c;
+	#l;
+	#u;
+	#d;
+	constructor(e, t) {
+		this.#e = e, t && (this.#i = t.executionCtx, this.env = t.env, this.#c = t.notFoundHandler, this.#d = t.path, this.#u = t.matchResult);
+	}
+	get req() {
+		return this.#t ??= new Pe(this.#e, this.#d, this.#u), this.#t;
+	}
+	get event() {
+		if (this.#i && "respondWith" in this.#i) return this.#i;
+		throw Error("This context has no FetchEvent");
+	}
+	get executionCtx() {
+		if (this.#i) return this.#i;
+		throw Error("This context has no ExecutionContext");
+	}
+	get res() {
+		return this.#a ||= L(null, { headers: this.#l ??= new Headers() });
+	}
+	set res(e) {
+		if (this.#a && e) {
+			e = L(e.body, e);
+			for (let [t, n] of this.#a.headers.entries()) if (t !== "content-type") if (t === "set-cookie") {
+				let t = this.#a.headers.getSetCookie();
+				e.headers.delete("set-cookie");
+				for (let n of t) e.headers.append("set-cookie", n);
+			} else e.headers.set(t, n);
+		}
+		this.#a = e, this.finalized = !0;
+	}
+	render = (...e) => (this.#s ??= (e) => this.html(e), this.#s(...e));
+	setLayout = (e) => this.#o = e;
+	getLayout = () => this.#o;
+	setRenderer = (e) => {
+		this.#s = e;
+	};
+	header = (e, t, n) => {
+		this.finalized && (this.#a = L(this.#a.body, this.#a));
+		let r = this.#a ? this.#a.headers : this.#l ??= new Headers();
+		t === void 0 ? r.delete(e) : n?.append ? r.append(e, t) : r.set(e, t);
+	};
+	status = (e) => {
+		this.#r = e;
+	};
+	set = (e, t) => {
+		this.#n ??= /* @__PURE__ */ new Map(), this.#n.set(e, t);
+	};
+	get = (e) => this.#n ? this.#n.get(e) : void 0;
+	get var() {
+		return this.#n ? Object.fromEntries(this.#n) : {};
+	}
+	#f(e, t, n) {
+		let r = this.#a ? new Headers(this.#a.headers) : this.#l ?? new Headers();
+		if (typeof t == "object" && "headers" in t) {
+			let e = t.headers instanceof Headers ? t.headers : new Headers(t.headers);
+			for (let [t, n] of e) t.toLowerCase() === "set-cookie" ? r.append(t, n) : r.set(t, n);
+		}
+		if (n) for (let [e, t] of Object.entries(n)) if (typeof t == "string") r.set(e, t);
+		else {
+			r.delete(e);
+			for (let n of t) r.append(e, n);
+		}
+		return L(e, {
+			status: typeof t == "number" ? t : t?.status ?? this.#r,
+			headers: r
+		});
+	}
+	newResponse = (...e) => this.#f(...e);
+	body = (e, t, n) => this.#f(e, t, n);
+	text = (e, t, n) => !this.#l && !this.#r && !t && !n && !this.finalized ? new Response(e) : this.#f(e, t, ze(Re, n));
+	json = (e, t, n) => this.#f(JSON.stringify(e), t, ze("application/json", n));
+	html = (e, t, n) => {
+		let r = (e) => this.#f(e, t, ze("text/html; charset=UTF-8", n));
+		return typeof e == "object" ? Le(e, Fe.Stringify, !1, {}).then(r) : r(e);
+	};
+	redirect = (e, t) => {
+		let n = String(e);
+		return this.header("Location", /[^\x00-\xFF]/.test(n) ? encodeURI(n) : n), this.newResponse(null, t ?? 302);
+	};
+	notFound = () => (this.#c ??= () => L(), this.#c(this));
+}, Ve = [
+	"get",
+	"post",
+	"put",
+	"delete",
+	"options",
+	"patch"
+], He = "Can not add a route since the matcher is already built.", Ue = class extends Error {}, We = "__COMPOSED_HANDLER", Ge = (e) => e.text("404 Not Found", 404), Ke = (e, t) => {
+	if ("getResponse" in e) {
+		let n = e.getResponse();
+		return t.newResponse(n.body, n);
+	}
+	return console.error(e), t.text("Internal Server Error", 500);
+}, qe = class e {
+	get;
+	post;
+	put;
+	delete;
+	options;
+	patch;
+	all;
+	on;
+	use;
+	router;
+	getPath;
+	_basePath = "/";
+	#e = "/";
+	routes = [];
+	constructor(e = {}) {
+		[...Ve, "all"].forEach((e) => {
+			this[e] = (t, ...n) => (typeof t == "string" ? this.#e = t : this.#r(e, this.#e, t), n.forEach((t) => {
+				this.#r(e, this.#e, t);
+			}), this);
+		}), this.on = (e, t, ...n) => {
+			for (let r of [t].flat()) {
+				this.#e = r;
+				for (let t of [e].flat()) n.map((e) => {
+					this.#r(t.toUpperCase(), this.#e, e);
+				});
+			}
+			return this;
+		}, this.use = (e, ...t) => (typeof e == "string" ? this.#e = e : (this.#e = "*", t.unshift(e)), t.forEach((e) => {
+			this.#r("ALL", this.#e, e);
+		}), this);
+		let { strict: t, ...n } = e;
+		Object.assign(this, n), this.getPath = t ?? !0 ? e.getPath ?? Te : Ee;
+	}
+	#t() {
+		let t = new e({
+			router: this.router,
+			getPath: this.getPath
+		});
+		return t.errorHandler = this.errorHandler, t.#n = this.#n, t.routes = this.routes, t;
+	}
+	#n = Ge;
+	errorHandler = Ke;
+	route(e, t) {
+		let n = this.basePath(e);
+		return t.routes.map((e) => {
+			let r;
+			t.errorHandler === Ke ? r = e.handler : (r = async (n, r) => (await ue([], t.errorHandler)(n, () => e.handler(n, r))).res, r[We] = e.handler), n.#r(e.method, e.path, r, e.basePath);
+		}), this;
+	}
+	basePath(e) {
+		let t = this.#t();
+		return t._basePath = I(this._basePath, e), t;
+	}
+	onError = (e) => (this.errorHandler = e, this);
+	notFound = (e) => (this.#n = e, this);
+	mount(e, t, n) {
+		let r, i;
+		n && (typeof n == "function" ? i = n : (i = n.optionHandler, r = n.replaceRequest === !1 ? (e) => e : n.replaceRequest));
+		let a = i ? (e) => {
+			let t = i(e);
+			return Array.isArray(t) ? t : [t];
+		} : (e) => {
+			let t;
+			try {
+				t = e.executionCtx;
+			} catch {}
+			return [e.env, t];
+		};
+		return r ||= (() => {
+			let t = I(this._basePath, e), n = t === "/" ? 0 : t.length;
+			return (e) => {
+				let t = new URL(e.url);
+				return t.pathname = this.getPath(e).slice(n) || "/", new Request(t, e);
+			};
+		})(), this.#r("ALL", I(e, "*"), async (e, n) => {
+			let i = await t(r(e.req.raw), ...a(e));
+			if (i) return i;
+			await n();
+		}), this;
+	}
+	#r(e, t, n, r) {
+		e = e.toUpperCase(), t = I(this._basePath, t);
+		let i = {
+			basePath: r === void 0 ? this._basePath : I(this._basePath, r),
+			path: t,
+			method: e,
+			handler: n
+		};
+		this.router.add(e, t, [n, i]), this.routes.push(i);
+	}
+	#i(e, t) {
+		if (e instanceof Error) return this.errorHandler(e, t);
+		throw e;
+	}
+	#a(e, t, n, r) {
+		if (r === "HEAD") return (async () => new Response(null, await this.#a(e, t, n, "GET")))();
+		let i = this.getPath(e, { env: n }), a = this.router.match(r, i), o = new Be(e, {
+			path: i,
+			matchResult: a,
+			env: n,
+			executionCtx: t,
+			notFoundHandler: this.#n
+		});
+		if (a[0].length === 1) {
+			let e;
+			try {
+				e = a[0][0][0][0](o, async () => {
+					o.res = await this.#n(o);
+				});
+			} catch (e) {
+				return this.#i(e, o);
+			}
+			return e instanceof Promise ? e.then((e) => e || (o.finalized ? o.res : this.#n(o))).catch((e) => this.#i(e, o)) : e ?? this.#n(o);
+		}
+		let s = ue(a[0], this.errorHandler, this.#n);
+		return (async () => {
+			try {
+				let e = await s(o);
+				if (!e.finalized) throw Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
+				return e.res;
+			} catch (e) {
+				return this.#i(e, o);
+			}
+		})();
+	}
+	fetch = (e, ...t) => this.#a(e, t[1], t[0], e.method);
+	request = (e, t, n, r) => e instanceof Request ? this.fetch(t ? new Request(e, t) : e, n, r) : (e = e.toString(), this.fetch(new Request(/^https?:\/\//.test(e) ? e : `http://localhost${I("/", e)}`, t), n, r));
+	fire = () => {
+		addEventListener("fetch", (e) => {
+			e.respondWith(this.#a(e.request, e, void 0, e.request.method));
+		});
+	};
+}, Je = [];
+function Ye(e, t) {
+	let n = this.buildAllMatchers(), r = ((e, t) => {
+		let r = n[e] || n.ALL, i = r[2][t];
+		if (i) return i;
+		let a = t.match(r[0]);
+		if (!a) return [[], Je];
+		let o = a.indexOf("", 1);
+		return [r[1][o], a];
+	});
+	return this.match = r, r(e, t);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/hono@4.12.26/node_modules/hono/dist/router/reg-exp-router/node.js
+var R = "[^/]+", z = ".*", B = "(?:|/.*)", V = /* @__PURE__ */ Symbol(), Xe = /* @__PURE__ */ new Set(".\\+*[^]$()");
+function Ze(e, t) {
+	return e.length === 1 ? t.length === 1 ? e < t ? -1 : 1 : -1 : t.length === 1 || e === z || e === B ? 1 : t === z || t === B ? -1 : e === R ? 1 : t === R ? -1 : e.length === t.length ? e < t ? -1 : 1 : t.length - e.length;
+}
+var Qe = class e {
+	#e;
+	#t;
+	#n = /* @__PURE__ */ Object.create(null);
+	insert(t, n, r, i, a) {
+		if (t.length === 0) {
+			if (this.#e !== void 0) throw V;
+			if (a) return;
+			this.#e = n;
+			return;
+		}
+		let [o, ...s] = t, c = o === "*" ? s.length === 0 ? [
+			"",
+			"",
+			z
+		] : [
+			"",
+			"",
+			R
+		] : o === "/*" ? [
+			"",
+			"",
+			B
+		] : o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/), l;
+		if (c) {
+			let t = c[1], n = c[2] || R;
+			if (t && c[2] && (n === ".*" || (n = n.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:"), /\((?!\?:)/.test(n)))) throw V;
+			if (l = this.#n[n], !l) {
+				if (Object.keys(this.#n).some((e) => e !== z && e !== B)) throw V;
+				if (a) return;
+				l = this.#n[n] = new e(), t !== "" && (l.#t = i.varIndex++);
+			}
+			!a && t !== "" && r.push([t, l.#t]);
+		} else if (l = this.#n[o], !l) {
+			if (Object.keys(this.#n).some((e) => e.length > 1 && e !== z && e !== B)) throw V;
+			if (a) return;
+			l = this.#n[o] = new e();
+		}
+		l.insert(s, n, r, i, a);
+	}
+	buildRegExpStr() {
+		let e = Object.keys(this.#n).sort(Ze).map((e) => {
+			let t = this.#n[e];
+			return (typeof t.#t == "number" ? `(${e})@${t.#t}` : Xe.has(e) ? `\\${e}` : e) + t.buildRegExpStr();
+		});
+		return typeof this.#e == "number" && e.unshift(`#${this.#e}`), e.length === 0 ? "" : e.length === 1 ? e[0] : "(?:" + e.join("|") + ")";
+	}
+}, $e = class {
+	#e = { varIndex: 0 };
+	#t = new Qe();
+	insert(e, t, n) {
+		let r = [], i = [];
+		for (let t = 0;;) {
+			let n = !1;
+			if (e = e.replace(/\{[^}]+\}/g, (e) => {
+				let r = `@\\${t}`;
+				return i[t] = [r, e], t++, n = !0, r;
+			}), !n) break;
+		}
+		let a = e.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
+		for (let e = i.length - 1; e >= 0; e--) {
+			let [t] = i[e];
+			for (let n = a.length - 1; n >= 0; n--) if (a[n].indexOf(t) !== -1) {
+				a[n] = a[n].replace(t, i[e][1]);
+				break;
+			}
+		}
+		return this.#t.insert(a, t, r, this.#e, n), r;
+	}
+	buildRegExp() {
+		let e = this.#t.buildRegExpStr();
+		if (e === "") return [
+			/^$/,
+			[],
+			[]
+		];
+		let t = 0, n = [], r = [];
+		return e = e.replace(/#(\d+)|@(\d+)|\.\*\$/g, (e, i, a) => i === void 0 ? (a === void 0 || (r[Number(a)] = ++t), "") : (n[++t] = Number(i), "$()")), [
+			RegExp(`^${e}`),
+			n,
+			r
+		];
+	}
+}, et = [
+	/^$/,
+	[],
+	/* @__PURE__ */ Object.create(null)
+], tt = /* @__PURE__ */ Object.create(null);
+function nt(e) {
+	return tt[e] ??= RegExp(e === "*" ? "" : `^${e.replace(/\/\*$|([.\\+*[^\]$()])/g, (e, t) => t ? `\\${t}` : "(?:|/.*)")}$`);
+}
+function rt() {
+	tt = /* @__PURE__ */ Object.create(null);
+}
+function it(e) {
+	let t = new $e(), n = [];
+	if (e.length === 0) return et;
+	let r = e.map((e) => [!/\*|\/:/.test(e[0]), ...e]).sort(([e, t], [n, r]) => e ? 1 : n ? -1 : t.length - r.length), i = /* @__PURE__ */ Object.create(null);
+	for (let e = 0, a = -1, o = r.length; e < o; e++) {
+		let [o, s, c] = r[e];
+		o ? i[s] = [c.map(([e]) => [e, /* @__PURE__ */ Object.create(null)]), Je] : a++;
+		let l;
+		try {
+			l = t.insert(s, a, o);
+		} catch (e) {
+			throw e === V ? new Ue(s) : e;
+		}
+		o || (n[a] = c.map(([e, t]) => {
+			let n = /* @__PURE__ */ Object.create(null);
+			for (--t; t >= 0; t--) {
+				let [e, r] = l[t];
+				n[e] = r;
+			}
+			return [e, n];
+		}));
+	}
+	let [a, o, s] = t.buildRegExp();
+	for (let e = 0, t = n.length; e < t; e++) for (let t = 0, r = n[e].length; t < r; t++) {
+		let r = n[e][t]?.[1];
+		if (!r) continue;
+		let i = Object.keys(r);
+		for (let e = 0, t = i.length; e < t; e++) r[i[e]] = s[r[i[e]]];
+	}
+	let c = [];
+	for (let e in o) c[e] = n[o[e]];
+	return [
+		a,
+		c,
+		i
+	];
+}
+function H(e, t) {
+	if (e) {
+		for (let n of Object.keys(e).sort((e, t) => t.length - e.length)) if (nt(n).test(t)) return [...e[n]];
+	}
+}
+var at = class {
+	name = "RegExpRouter";
+	#e;
+	#t;
+	constructor() {
+		this.#e = { ALL: /* @__PURE__ */ Object.create(null) }, this.#t = { ALL: /* @__PURE__ */ Object.create(null) };
+	}
+	add(e, t, n) {
+		let r = this.#e, i = this.#t;
+		if (!r || !i) throw Error(He);
+		r[e] || [r, i].forEach((t) => {
+			t[e] = /* @__PURE__ */ Object.create(null), Object.keys(t.ALL).forEach((n) => {
+				t[e][n] = [...t.ALL[n]];
+			});
+		}), t === "/*" && (t = "*");
+		let a = (t.match(/\/:/g) || []).length;
+		if (/\*$/.test(t)) {
+			let o = nt(t);
+			e === "ALL" ? Object.keys(r).forEach((e) => {
+				r[e][t] ||= H(r[e], t) || H(r.ALL, t) || [];
+			}) : r[e][t] ||= H(r[e], t) || H(r.ALL, t) || [], Object.keys(r).forEach((t) => {
+				(e === "ALL" || e === t) && Object.keys(r[t]).forEach((e) => {
+					o.test(e) && r[t][e].push([n, a]);
+				});
+			}), Object.keys(i).forEach((t) => {
+				(e === "ALL" || e === t) && Object.keys(i[t]).forEach((e) => o.test(e) && i[t][e].push([n, a]));
+			});
+			return;
+		}
+		let o = De(t) || [t];
+		for (let t = 0, s = o.length; t < s; t++) {
+			let c = o[t];
+			Object.keys(i).forEach((o) => {
+				(e === "ALL" || e === o) && (i[o][c] ||= [...H(r[o], c) || H(r.ALL, c) || []], i[o][c].push([n, a - s + t + 1]));
+			});
+		}
+	}
+	match = Ye;
+	buildAllMatchers() {
+		let e = /* @__PURE__ */ Object.create(null);
+		return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach((t) => {
+			e[t] ||= this.#n(t);
+		}), this.#e = this.#t = void 0, rt(), e;
+	}
+	#n(e) {
+		let t = [], n = e === "ALL";
+		return [this.#e, this.#t].forEach((r) => {
+			let i = r[e] ? Object.keys(r[e]).map((t) => [t, r[e][t]]) : [];
+			i.length === 0 ? e !== "ALL" && t.push(...Object.keys(r.ALL).map((e) => [e, r.ALL[e]])) : (n ||= !0, t.push(...i));
+		}), n ? it(t) : null;
+	}
+}, ot = class {
+	name = "SmartRouter";
+	#e = [];
+	#t = [];
+	constructor(e) {
+		this.#e = e.routers;
+	}
+	add(e, t, n) {
+		if (!this.#t) throw Error(He);
+		this.#t.push([
+			e,
+			t,
+			n
+		]);
+	}
+	match(e, t) {
+		if (!this.#t) throw Error("Fatal error");
+		let n = this.#e, r = this.#t, i = n.length, a = 0, o;
+		for (; a < i; a++) {
+			let i = n[a];
+			try {
+				for (let e = 0, t = r.length; e < t; e++) i.add(...r[e]);
+				o = i.match(e, t);
+			} catch (e) {
+				if (e instanceof Ue) continue;
+				throw e;
+			}
+			this.match = i.match.bind(i), this.#e = [i], this.#t = void 0;
+			break;
+		}
+		if (a === i) throw Error("Fatal error");
+		return this.name = `SmartRouter + ${this.activeRouter.name}`, o;
+	}
+	get activeRouter() {
+		if (this.#t || this.#e.length !== 1) throw Error("No active router has been determined yet.");
+		return this.#e[0];
+	}
+}, U = /* @__PURE__ */ Object.create(null), st = (e) => {
+	for (let t in e) return !0;
+	return !1;
+}, ct = class e {
+	#e;
+	#t;
+	#n;
+	#r = 0;
+	#i = U;
+	constructor(e, t, n) {
+		if (this.#t = n || /* @__PURE__ */ Object.create(null), this.#e = [], e && t) {
+			let n = /* @__PURE__ */ Object.create(null);
+			n[e] = {
+				handler: t,
+				possibleKeys: [],
+				score: 0
+			}, this.#e = [n];
+		}
+		this.#n = [];
+	}
+	insert(t, n, r) {
+		this.#r = ++this.#r;
+		let i = this, a = ve(n), o = [];
+		for (let t = 0, n = a.length; t < n; t++) {
+			let n = a[t], r = a[t + 1], s = Se(n, r), c = Array.isArray(s) ? s[0] : n;
+			if (c in i.#t) {
+				i = i.#t[c], s && o.push(s[1]);
+				continue;
+			}
+			i.#t[c] = new e(), s && (i.#n.push(s), o.push(s[1])), i = i.#t[c];
+		}
+		return i.#e.push({ [t]: {
+			handler: r,
+			possibleKeys: o.filter((e, t, n) => n.indexOf(e) === t),
+			score: this.#r
+		} }), i;
+	}
+	#a(e, t, n, r, i) {
+		for (let a = 0, o = t.#e.length; a < o; a++) {
+			let o = t.#e[a], s = o[n] || o.ALL, c = {};
+			if (s !== void 0 && (s.params = /* @__PURE__ */ Object.create(null), e.push(s), r !== U || i && i !== U)) for (let e = 0, t = s.possibleKeys.length; e < t; e++) {
+				let t = s.possibleKeys[e], n = c[s.score];
+				s.params[t] = i?.[t] && !n ? i[t] : r[t] ?? i?.[t], c[s.score] = !0;
+			}
+		}
+	}
+	search(e, t) {
+		let n = [];
+		this.#i = U;
+		let r = [this], i = _e(t), a = [], o = i.length, s = null;
+		for (let c = 0; c < o; c++) {
+			let l = i[c], u = c === o - 1, d = [];
+			for (let f = 0, p = r.length; f < p; f++) {
+				let p = r[f], m = p.#t[l];
+				m && (m.#i = p.#i, u ? (m.#t["*"] && this.#a(n, m.#t["*"], e, p.#i), this.#a(n, m, e, p.#i)) : d.push(m));
+				for (let r = 0, f = p.#n.length; r < f; r++) {
+					let f = p.#n[r], m = p.#i === U ? {} : { ...p.#i };
+					if (f === "*") {
+						let t = p.#t["*"];
+						t && (this.#a(n, t, e, p.#i), t.#i = m, d.push(t));
+						continue;
+					}
+					let [h, g, _] = f;
+					if (!l && !(_ instanceof RegExp)) continue;
+					let v = p.#t[h];
+					if (_ instanceof RegExp) {
+						if (s === null) {
+							s = Array(o);
+							let e = +(t[0] === "/");
+							for (let t = 0; t < o; t++) s[t] = e, e += i[t].length + 1;
+						}
+						let r = t.substring(s[c]), l = _.exec(r);
+						if (l) {
+							if (m[g] = l[0], this.#a(n, v, e, p.#i, m), st(v.#t)) {
+								v.#i = m;
+								let e = l[0].match(/\//)?.length ?? 0;
+								(a[e] ||= []).push(v);
+							}
+							continue;
+						}
+					}
+					(_ === !0 || _.test(l)) && (m[g] = l, u ? (this.#a(n, v, e, m, p.#i), v.#t["*"] && this.#a(n, v.#t["*"], e, m, p.#i)) : (v.#i = m, d.push(v)));
+				}
+			}
+			let f = a.shift();
+			r = f ? d.concat(f) : d;
+		}
+		return n.length > 1 && n.sort((e, t) => e.score - t.score), [n.map(({ handler: e, params: t }) => [e, t])];
+	}
+}, lt = class {
+	name = "TrieRouter";
+	#e;
+	constructor() {
+		this.#e = new ct();
+	}
+	add(e, t, n) {
+		let r = De(t);
+		if (r) {
+			for (let t = 0, i = r.length; t < i; t++) this.#e.insert(e, r[t], n);
+			return;
+		}
+		this.#e.insert(e, t, n);
+	}
+	match(e, t) {
+		return this.#e.search(e, t);
+	}
+}, ut = class extends qe {
+	constructor(e = {}) {
+		super(e), this.router = e.router ?? new ot({ routers: [new at(), new lt()] });
+	}
+};
+//#endregion
+//#region src/coordinator-invites.ts
+function dt(e) {
+	let t = "";
+	for (let n of e) t += String.fromCharCode(n);
+	return btoa(t);
+}
+function ft(e) {
+	let t = atob(e), n = new Uint8Array(t.length);
+	for (let e = 0; e < t.length; e += 1) n[e] = t.charCodeAt(e);
+	return n;
+}
+function pt(e) {
+	return e.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function mt(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/");
+	return t + "=".repeat((4 - t.length % 4) % 4);
+}
+function W(e) {
+	let t = JSON.stringify(e);
+	return pt(dt(new TextEncoder().encode(t)));
+}
+function ht(e) {
+	let t = new TextDecoder().decode(ft(mt(e))), n = JSON.parse(t);
+	if (typeof n != "object" || !n) throw Error("invalid invite payload");
+	return n;
+}
+function G(e) {
+	return `codemem://join?invite=${encodeURIComponent(e)}`;
+}
+function gt(e) {
+	let t = e.trim();
+	if (t.startsWith("codemem://")) {
+		let e = new URL(t).searchParams.get("invite") ?? "";
+		if (!e) throw Error("invite payload missing from link");
+		return e;
+	}
+	return t;
+}
+//#endregion
+//#region src/project-invite-acceptance.ts
+var _t = "pending_setup", vt = "project_sync_enablement_failed", yt = "Invitation was accepted, but sync could not be enabled. Make the codemem config writable, then retry.", bt = class extends Error {
+	code = vt;
+	detail = yt;
+	constructor(e) {
+		super(yt, e), this.name = "ProjectSyncEnablementError";
+	}
+};
+function xt(e) {
+	return typeof e == "object" && !!e && "code" in e && e.code === "project_sync_enablement_failed" && "detail" in e && e.detail === "Invitation was accepted, but sync could not be enabled. Make the codemem config writable, then retry.";
+}
+//#endregion
+//#region src/scope-resolution.ts
+var St = "local-default", Ct = "legacy-shared-review";
+function K(e) {
+	return e?.trim() || null;
+}
+function q(e) {
+	return e.trim().replaceAll("\\", "/").replace(/\/+$/, "") || e.trim();
+}
+function wt(t) {
+	return q(e(t));
+}
+function Tt(e) {
+	let t = K(e);
+	return t ? q(t) : null;
+}
+function Et(e) {
+	let n = [
+		e.cwd,
+		e.project,
+		e.workspaceId
+	].map((e) => K(e)).find((e) => e != null);
+	return `unmapped:${t("sha256").update(n ?? "unknown", "utf8").digest("hex")}`;
+}
+function Dt(e) {
+	let t = K(e.gitRemote), n = K(e.gitBranch), r = K(e.cwd), i = K(e.workspaceId), a = K(e.project);
+	if (t) {
+		let r = q(t);
+		return e.branchScoped && n ? {
+			value: `${r}:${n}`,
+			source: "git_remote_branch",
+			displayProject: a
+		} : {
+			value: r,
+			source: "git_remote",
+			displayProject: a
+		};
+	}
+	return r ? {
+		value: wt(r),
+		source: "cwd",
+		displayProject: a
+	} : i ? {
+		value: q(i),
+		source: "workspace_id",
+		displayProject: a
+	} : {
+		value: Et(e),
+		source: "unmapped",
+		displayProject: a
+	};
+}
+function Ot(e) {
+	return !/[\\/:]/.test(e);
+}
+function kt(e) {
+	return e.replace(/[|\\{}()[\]^$+?.*]/g, "\\$&");
+}
+function At(e) {
+	return e.replace(/[*?]/g, "").length;
+}
+function jt(e, t) {
+	let n = q(t);
+	return !n || Ot(n) ? !1 : /[*?]/.test(n) ? RegExp(`^${kt(n).replaceAll("\\*", ".*").replaceAll("\\?", ".")}$`).test(e) : e === n;
+}
+function Mt(e) {
+	return e.mapping.priority ?? 0;
+}
+function Nt(e) {
+	let t = K(e.mapping.updated_at);
+	if (!t) return 0;
+	let n = Date.parse(t);
+	return Number.isFinite(n) ? n : 0;
+}
+function Pt(e, t) {
+	return Mt(t) - Mt(e) || t.specificity - e.specificity || Nt(t) - Nt(e) || (t.mapping.id ?? 0) - (e.mapping.id ?? 0) || e.mapping.scope_id.localeCompare(t.mapping.scope_id);
+}
+function Ft(e) {
+	return e.toSorted(Pt)[0] ?? null;
+}
+function It(e) {
+	let t = Dt(e), n = K(e.explicitScopeId);
+	if (n) return {
+		scopeId: n,
+		reason: "explicit_override",
+		workspaceIdentity: t,
+		mapping: null,
+		matchedPattern: null
+	};
+	if (t.source === "unmapped") return {
+		scopeId: e.localDefaultScopeId ?? "local-default",
+		reason: "local_default",
+		workspaceIdentity: t,
+		mapping: null,
+		matchedPattern: null
+	};
+	let r = e.mappings ?? [], i = Ft(r.filter((e) => Tt(e.workspace_identity) === t.value).map((e) => ({
+		mapping: e,
+		matchedPattern: null,
+		specificity: t.value.length
+	})));
+	if (i) return {
+		scopeId: i.mapping.scope_id,
+		reason: "exact_mapping",
+		workspaceIdentity: t,
+		mapping: i.mapping,
+		matchedPattern: null
+	};
+	let a = Ft(r.flatMap((e) => {
+		if (K(e.workspace_identity)) return [];
+		let n = K(e.project_pattern);
+		return !n || !jt(t.value, n) ? [] : [{
+			mapping: e,
+			matchedPattern: q(n),
+			specificity: At(n)
+		}];
+	}));
+	return a ? {
+		scopeId: a.mapping.scope_id,
+		reason: "pattern_mapping",
+		workspaceIdentity: t,
+		mapping: a.mapping,
+		matchedPattern: a.matchedPattern
+	} : {
+		scopeId: e.localDefaultScopeId ?? "local-default",
+		reason: "local_default",
+		workspaceIdentity: t,
+		mapping: null,
+		matchedPattern: null
+	};
+}
+function Lt(e, t) {
+	let n = new Set([
+		"",
+		St,
+		Ct
+	]), r = e.prepare("SELECT scope_id\n			 FROM replication_scopes\n			 WHERE status = 'active' AND authority_type = 'local'").all();
+	for (let e of r) e.scope_id != null && n.add(e.scope_id);
+	let i = e.prepare("SELECT sm.scope_id AS scope_id\n			 FROM scope_memberships sm\n			 JOIN replication_scopes rs ON rs.scope_id = sm.scope_id\n			 WHERE sm.device_id = ?\n			   AND sm.status = 'active'\n			   AND rs.status = 'active'\n			   AND sm.membership_epoch >= rs.membership_epoch").all(t);
+	for (let e of i) e.scope_id != null && n.add(e.scope_id);
+	return [...n];
+}
+//#endregion
+//#region src/project-share-intent.ts
+var Rt = "existing_and_future";
+function zt(e) {
+	return t("sha256").update(JSON.stringify(e)).digest("hex");
+}
+function Bt(e) {
+	return zt({
+		v: 1,
+		historyPolicy: Rt,
+		projects: e.map((e) => ({
+			canonicalIdentity: e.canonicalIdentity,
+			existingMemoryCount: e.existingMemoryCount
+		})).toSorted((e, t) => e.canonicalIdentity.localeCompare(t.canonicalIdentity))
+	});
+}
+function Vt(e) {
+	return Bt(e.map((e) => ({
+		canonicalIdentity: e.canonical_identity,
+		displayName: e.display_name,
+		identitySource: "coordinator_acceptance",
+		existingMemoryCount: e.existing_memory_count
+	})));
+}
+function Ht(e) {
+	if (!Array.isArray(e) || e.length === 0 || e.length > 100) throw Error("operation_intent_invalid");
+	let t = e.map((e) => {
+		if (!e || typeof e != "object" || Array.isArray(e)) throw Error("operation_intent_invalid");
+		let t = e;
+		if (typeof t.canonical_identity != "string" || typeof t.display_name != "string") throw Error("operation_intent_invalid");
+		let n = t.canonical_identity, r = n.trim(), i = t.display_name, a;
+		try {
+			a = g(i, "project_name");
+		} catch {
+			throw Error("operation_intent_invalid");
+		}
+		let o = t.existing_memory_count, s = Dt({ gitRemote: r }).value;
+		if (!r || r !== n || r.length > 2048 || r.startsWith("unmapped:") || s !== r || a !== i || !Number.isSafeInteger(o) || Number(o) < 0 || /[\p{Cc}\p{Cf}]/u.test(r) || /[\p{Cc}\p{Cf}]/u.test(a)) throw Error("operation_intent_invalid");
+		return {
+			canonical_identity: r,
+			display_name: a,
+			existing_memory_count: Number(o)
+		};
+	});
+	if (new Set(t.map((e) => e.canonical_identity)).size !== t.length) throw Error("operation_intent_invalid");
+	return t.toSorted((e, t) => e.canonical_identity.localeCompare(t.canonical_identity));
+}
+//#endregion
+//#region ../../node_modules/.pnpm/limiter@3.0.0/node_modules/limiter/dist/esm/clock.js
+function Ut(e) {
+	let t = performance.now() * .001, n = Math.floor(t), r = Math.floor(t % 1 * 1e9);
+	return e != null && (n -= e[0], r -= e[1], r < 0 && (n--, r += 1e9)), [n, r];
+}
+function J() {
+	let [e, t] = Ut();
+	return e * 1e3 + Math.floor(t / 1e6);
+}
+function Wt(e) {
+	return new Promise((t) => setTimeout(t, e));
+}
+//#endregion
+//#region ../../node_modules/.pnpm/limiter@3.0.0/node_modules/limiter/dist/esm/TokenBucket.js
+var Gt = class {
+	bucketSize;
+	tokensPerInterval;
+	interval;
+	parentBucket;
+	content;
+	lastDrip;
+	constructor({ bucketSize: e, tokensPerInterval: t, interval: n, parentBucket: r }) {
+		if (this.bucketSize = e, this.tokensPerInterval = t, typeof n == "string") switch (n) {
+			case "sec":
+			case "second":
+				this.interval = 1e3;
+				break;
+			case "min":
+			case "minute":
+				this.interval = 1e3 * 60;
+				break;
+			case "hr":
+			case "hour":
+				this.interval = 1e3 * 60 * 60;
+				break;
+			case "day":
+				this.interval = 1e3 * 60 * 60 * 24;
+				break;
+			default: throw Error("Invalid interval " + n);
+		}
+		else this.interval = n;
+		this.parentBucket = r, this.content = 0, this.lastDrip = J();
+	}
+	async removeTokens(e) {
+		if (this.bucketSize === 0) return Infinity;
+		if (e > this.bucketSize) throw Error(`Requested tokens ${e} exceeds bucket size ${this.bucketSize}`);
+		this.drip();
+		let t = async () => (await Wt(Math.ceil((e - this.content) * (this.interval / this.tokensPerInterval))), this.removeTokens(e));
+		if (e > this.content) return t();
+		if (this.parentBucket != null) {
+			let n = await this.parentBucket.removeTokens(e);
+			return e > this.content ? t() : (this.content -= e, Math.min(n, this.content));
+		} else return this.content -= e, this.content;
+	}
+	tryRemoveTokens(e) {
+		return this.bucketSize ? e > this.bucketSize || (this.drip(), e > this.content) || this.parentBucket && !this.parentBucket.tryRemoveTokens(e) ? !1 : (this.content -= e, !0) : !0;
+	}
+	drip() {
+		if (this.tokensPerInterval === 0) {
+			let e = this.content;
+			return this.content = this.bucketSize, this.content > e;
+		}
+		let e = J(), t = Math.max(e - this.lastDrip, 0);
+		this.lastDrip = e;
+		let n = t * (this.tokensPerInterval / this.interval), r = this.content;
+		return this.content = Math.min(this.content + n, this.bucketSize), Math.floor(this.content) > Math.floor(r);
+	}
+}, Kt = class {
+	tokenBucket;
+	curIntervalStart;
+	tokensThisInterval;
+	fireImmediately;
+	constructor({ tokensPerInterval: e, interval: t, fireImmediately: n }) {
+		this.tokenBucket = new Gt({
+			bucketSize: e,
+			tokensPerInterval: e,
+			interval: t
+		}), this.tokenBucket.content = e, this.curIntervalStart = J(), this.tokensThisInterval = 0, this.fireImmediately = n ?? !1;
+	}
+	async removeTokens(e) {
+		if (e > this.tokenBucket.bucketSize) throw Error(`Requested tokens ${e} exceeds maximum tokens per interval ${this.tokenBucket.bucketSize}`);
+		let t = J();
+		if ((t < this.curIntervalStart || t - this.curIntervalStart >= this.tokenBucket.interval) && (this.curIntervalStart = t, this.tokensThisInterval = 0), e > this.tokenBucket.tokensPerInterval - this.tokensThisInterval) {
+			if (this.fireImmediately) return -1;
+			{
+				await Wt(Math.ceil(this.curIntervalStart + this.tokenBucket.interval - t));
+				let n = await this.tokenBucket.removeTokens(e);
+				return this.tokensThisInterval += e, n;
+			}
+		}
+		let n = await this.tokenBucket.removeTokens(e);
+		return this.tokensThisInterval += e, n;
+	}
+	tryRemoveTokens(e) {
+		if (e > this.tokenBucket.bucketSize) return !1;
+		let t = J();
+		if ((t < this.curIntervalStart || t - this.curIntervalStart >= this.tokenBucket.interval) && (this.curIntervalStart = t, this.tokensThisInterval = 0), e > this.tokenBucket.tokensPerInterval - this.tokensThisInterval) return !1;
+		let n = this.tokenBucket.tryRemoveTokens(e);
+		return n && (this.tokensThisInterval += e), n;
+	}
+	getTokensRemaining() {
+		return this.tokenBucket.drip(), this.tokenBucket.content;
+	}
+};
+//#endregion
+//#region src/request-rate-limit.ts
+function qt(e = {}) {
+	let t = Math.max(1e3, Math.trunc(e.windowMs ?? 6e4)), n = e.now ?? (() => Date.now()), r = /* @__PURE__ */ new Map(), i = 0;
+	function a(e) {
+		return Math.max(1, Math.ceil(t / Math.max(1, e) / 1e3));
+	}
+	function o(e) {
+		if (r.size < 64 || i % 64 != 0) return;
+		let n = e - t * 10;
+		for (let [e, t] of r) t.lastUsedAt < n && r.delete(e);
+	}
+	return { check(e, s) {
+		let c = Math.max(1, Math.trunc(s));
+		i += 1;
+		let l = n();
+		o(l);
+		let u = `${c}:${e}`, d = r.get(u);
+		return d || (d = {
+			limiter: new Kt({
+				tokensPerInterval: c,
+				interval: t,
+				fireImmediately: !0
+			}),
+			lastUsedAt: l
+		}, r.set(u, d)), d.lastUsedAt = l, d.limiter.tryRemoveTokens(1) ? {
+			allowed: !0,
+			retryAfterS: 0
+		} : {
+			allowed: !1,
+			retryAfterS: a(c)
+		};
+	} };
+}
+//#endregion
+//#region src/scope-membership-semantics.ts
+var Jt = "Revocation blocks future sync for this Space. It does not remove data already copied to the revoked device; offline devices, backups, copied databases, malicious peers, or old versions may retain data.";
+function Yt(e) {
+	let t = Number.isFinite(e.membershipEpoch) ? Number(e.membershipEpoch) : null, n = Number.isFinite(e.requiredEpoch) ? Number(e.requiredEpoch) : null;
+	return t == null || n == null ? {
+		membership_epoch: t,
+		required_epoch: n,
+		stale: !1,
+		reason: "unknown_epoch"
+	} : {
+		membership_epoch: t,
+		required_epoch: n,
+		stale: t < n,
+		reason: t < n ? "stale_epoch" : "current"
+	};
+}
+function Xt(e) {
+	return {
+		scope_id: e.scopeId,
+		device_id: e.deviceId,
+		membership_epoch: Number.isFinite(e.membershipEpoch) ? Number(e.membershipEpoch) : null,
+		prevents_future_sync: !0,
+		deletes_already_copied_data: !1,
+		message: Jt
+	};
+}
+//#endregion
+//#region src/sync-auth-constants.ts
+var Zt = 300, Y = 64 * 1024, X = "X-Codemem-Coordinator-Admin", Qt = "X-Codemem-Coordinator-Admin-Actor", $t = 120, en = 30;
+function Z(e, t) {
+	let n = t.adminSecret();
+	if (!n) return {
+		ok: !1,
+		error: "admin_not_configured"
+	};
+	let r = (e ?? "").trim();
+	return r ? r === n ? {
+		ok: !0,
+		error: "ok"
+	} : {
+		ok: !1,
+		error: "invalid_admin_secret"
+	} : {
+		ok: !1,
+		error: "missing_admin_header"
+	};
+}
+function tn(e) {
+	let t = new URL(e);
+	return t.search ? `${t.pathname}${t.search}` : t.pathname;
+}
+async function nn(e, t, n, r) {
+	return await e.recordNonce(t, n, r);
+}
+async function rn(e, t) {
+	await e.cleanupNonces(t);
+}
+async function Q(e, t, n, r) {
+	let { deviceId: i, signature: a, timestamp: o, nonce: s } = r;
+	if (!i || !a || !o || !s) return {
+		ok: !1,
+		error: "missing_headers",
+		enrollment: null
+	};
+	let c = await e.getEnrollment(r.groupId, i, !0);
+	if (!c) return {
+		ok: !1,
+		error: "unknown_device",
+		enrollment: null
+	};
+	if (c.enabled !== 1) return {
+		ok: !1,
+		error: "device_disabled",
+		enrollment: null
+	};
+	let l = await e.getGroup(r.groupId);
+	if (!l) return {
+		ok: !1,
+		error: "group_not_found",
+		enrollment: null
+	};
+	if (l.archived_at) return {
+		ok: !1,
+		error: "group_archived",
+		enrollment: null
+	};
+	let u;
+	try {
+		u = await n({
+			method: r.method,
+			pathWithQuery: tn(r.url),
+			bodyBytes: r.body,
+			timestamp: o,
+			nonce: s,
+			signature: a,
+			publicKey: String(c.public_key),
+			deviceId: i
+		});
+	} catch {
+		return {
+			ok: !1,
+			error: "signature_verification_error",
+			enrollment: null
+		};
+	}
+	if (!u) return {
+		ok: !1,
+		error: "invalid_signature",
+		enrollment: null
+	};
+	let d = t.now();
+	return await nn(e, i, s, d) ? (await rn(e, (/* @__PURE__ */ new Date(new Date(d).getTime() - 300 * 2 * 1e3)).toISOString()), {
+		ok: !0,
+		error: "ok",
+		enrollment: c
+	}) : {
+		ok: !1,
+		error: "nonce_replay",
+		enrollment: null
+	};
+}
+function $(e) {
+	return e === "device_disabled" ? 403 : e === "group_archived" ? 409 : 401;
+}
+function an(e) {
+	if (!e?.storeFactory || !e.runtime || !e.requestVerifier) throw Error("createCoordinatorApp requires storeFactory, runtime, and requestVerifier.");
+	let t = e.runtime, n = e.storeFactory, r = e.requestVerifier, a = e.requestRateLimit ?? {}, o = a.limiter ?? qt(), s = Math.max(1, Math.trunc(a.readLimit ?? $t)), c = Math.max(1, Math.trunc(a.mutationLimit ?? en)), l = Math.max(1, Math.trunc(a.unauthenticatedReadLimit ?? Math.min(20, s))), u = Math.max(1, Math.trunc(a.unauthenticatedMutationLimit ?? Math.min(10, c))), d = new ut(), f = new TextDecoder();
+	function p(e, t, n) {
+		let r = e.req.method === "GET" || e.req.method === "HEAD" || e.req.method === "OPTIONS", i = o.check(`${e.req.method}:${n ? "auth" : "anon"}:${t}`, n ? r ? s : c : r ? l : u);
+		return i.allowed ? null : (e.header("Retry-After", String(i.retryAfterS)), e.json({
+			error: "rate_limited",
+			retry_after_s: i.retryAfterS
+		}, 429));
+	}
+	async function m(e) {
+		let t = Number.parseInt(e.req.header("content-length") ?? "", 10);
+		if (Number.isFinite(t) && t > Y) return null;
+		let n = e.req.raw.body;
+		if (!n) return new Uint8Array();
+		let r = n.getReader(), i = [], a = 0;
+		try {
+			for (;;) {
+				let { done: e, value: t } = await r.read();
+				if (e) break;
+				if (t) {
+					if (a += t.byteLength, a > Y) return await r.cancel(), null;
+					i.push(t);
+				}
+			}
+		} finally {
+			r.releaseLock();
+		}
+		let o = new Uint8Array(a), s = 0;
+		for (let e of i) o.set(e, s), s += e.byteLength;
+		return o;
+	}
+	function h(e) {
+		try {
+			let t = JSON.parse(f.decode(e));
+			return typeof t != "object" || !t || Array.isArray(t) ? null : t;
+		} catch {
+			return null;
+		}
+	}
+	function _(e, t) {
+		let n = e[t];
+		return n == null ? null : String(n).trim() || null;
+	}
+	function v(e) {
+		return e?.trim() || null;
+	}
+	function b(e, t) {
+		let n = e[t];
+		if (n == null || n === "") return null;
+		if (typeof n != "number" && typeof n != "string") return NaN;
+		if (typeof n == "string") {
+			let e = n.trim();
+			if (!e) return NaN;
+			let t = Number(e);
+			return Number.isFinite(t) ? Math.trunc(t) : NaN;
+		}
+		let r = n;
+		return Number.isFinite(r) ? Math.trunc(r) : NaN;
+	}
+	function S(e) {
+		return [
+			"1",
+			"true",
+			"yes"
+		].includes(String(e ?? "").trim().toLowerCase());
+	}
+	function C(e) {
+		try {
+			return Ht(JSON.parse(e ?? ""));
+		} catch {
+			throw Error("operation_intent_invalid");
+		}
+	}
+	function w(e) {
+		let t = String(e.operation_id ?? "").trim(), n = String(e.reviewed_project_set_digest ?? "").trim();
+		if (!/^share_[a-f0-9]{40}$/u.test(t) || !/^[a-f0-9]{64}$/u.test(n)) throw Error("operation_intent_invalid");
+		let r = C(e.project_intent_json);
+		if (Vt(r) !== n) throw Error("operation_intent_invalid");
+		return {
+			operation_id: t,
+			reviewed_project_set_digest: n,
+			projects: r
+		};
+	}
+	function T(e) {
+		try {
+			return y(JSON.parse(e ?? ""));
+		} catch {
+			throw Error("operation_intent_invalid");
+		}
+	}
+	async function E(e, t, n) {
+		if (!t) return n.json({ error: "group_id_required" }, 400);
+		let r = await e.getGroup(t);
+		return r ? r.archived_at ? n.json({ error: "group_archived" }, 409) : null : n.json({ error: "group_not_found" }, 404);
+	}
+	async function D(e, t, n, r) {
+		let i = await E(e, t, r);
+		if (i) return {
+			scope: null,
+			response: i
+		};
+		if (!n) return {
+			scope: null,
+			response: r.json({ error: "scope_id_required" }, 400)
+		};
+		let a = (await e.listScopes({
+			groupId: t,
+			includeInactive: !0
+		})).find((e) => e.scope_id === n) ?? null;
+		return a ? {
+			scope: a,
+			response: null
+		} : {
+			scope: null,
+			response: r.json({ error: "scope_not_found" }, 404)
+		};
+	}
+	async function O(e, n, i) {
+		let a = await Q(e, t, r, {
+			method: i.req.method,
+			url: i.req.url,
+			groupId: n,
+			body: new Uint8Array(),
+			deviceId: i.req.header("X-Opencode-Device") ?? null,
+			signature: i.req.header("X-Opencode-Signature") ?? null,
+			timestamp: i.req.header("X-Opencode-Timestamp") ?? null,
+			nonce: i.req.header("X-Opencode-Nonce") ?? null
+		});
+		return !a.ok || !a.enrollment ? {
+			auth: a,
+			response: p(i, i.req.path, !1) ?? i.json({ error: a.error }, $(a.error))
+		} : {
+			auth: a,
+			response: p(i, String(a.enrollment.device_id), !0)
+		};
+	}
+	function k(e, t) {
+		return e.status === "active" && e.membership_epoch >= t.membership_epoch;
+	}
+	async function A(e, t, n) {
+		return (await e.listScopeMemberships(t.scope_id, !1)).some((e) => e.device_id === n && k(e, t));
+	}
+	return d.post("/v1/presence", async (e) => {
+		let i = await m(e);
+		if (i == null) return e.json({ error: "body_too_large" }, 413);
+		let a = h(i);
+		if (!a) return e.json({ error: "invalid_json" }, 400);
+		let o = String(a.group_id ?? "").trim();
+		if (!o) return e.json({ error: "group_id_required" }, 400);
+		let s = n();
+		try {
+			let n = await Q(s, t, r, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: o,
+				body: i,
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) || e.json({ error: n.error }, $(n.error));
+			let c = p(e, String(n.enrollment.device_id), !0);
+			if (c) return c;
+			if (a.fingerprint && String(a.fingerprint) !== String(n.enrollment.fingerprint)) return e.json({ error: "fingerprint_mismatch" }, 401);
+			let l = a.addresses ?? [];
+			if (!Array.isArray(l) || !l.every((e) => typeof e == "string")) return e.json({ error: "addresses_must_be_list_of_strings" }, 400);
+			let u;
+			try {
+				if (u = Math.max(1, Number.parseInt(String(a.ttl_s ?? 180), 10)), Number.isNaN(u)) return e.json({ error: "ttl_s_must_be_int" }, 400);
+			} catch {
+				return e.json({ error: "ttl_s_must_be_int" }, 400);
+			}
+			let d = await s.upsertPresence({
+				groupId: o,
+				deviceId: String(n.enrollment.device_id),
+				addresses: l,
+				ttlS: u,
+				capabilities: typeof a.capabilities == "object" && a.capabilities !== null && !Array.isArray(a.capabilities) ? a.capabilities : void 0
+			});
+			return e.json({
+				ok: !0,
+				...d
+			});
+		} finally {
+			await s.close();
+		}
+	}), d.get("/v1/peers", async (e) => {
+		let i = (e.req.query("group_id") ?? "").trim();
+		if (!i) return e.json({ error: "group_id_required" }, 400);
+		let a = n();
+		try {
+			let n = await Q(a, t, r, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: i,
+				body: new Uint8Array(),
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) || e.json({ error: n.error }, $(n.error));
+			let o = p(e, String(n.enrollment.device_id), !0);
+			if (o) return o;
+			let s = await a.listGroupPeers(i, String(n.enrollment.device_id));
+			return e.json({ items: s });
+		} finally {
+			await a.close();
+		}
+	}), d.get("/v1/scopes", async (e) => {
+		let t = (e.req.query("group_id") ?? "").trim();
+		if (!t) return e.json({ error: "group_id_required" }, 400);
+		let r = n();
+		try {
+			let { auth: n, response: i } = await O(r, t, e);
+			if (i) return i;
+			if (!n.enrollment) return e.json({ error: "unknown_device" }, 401);
+			let a = await r.listScopes({
+				groupId: t,
+				includeInactive: !1
+			}), o = [];
+			for (let e of a) e.status === "active" && await A(r, e, String(n.enrollment.device_id)) && o.push(e);
+			return e.json({ items: o });
+		} finally {
+			await r.close();
+		}
+	}), d.get("/v1/scopes/:scope_id/members", async (e) => {
+		let t = (e.req.query("group_id") ?? "").trim(), r = String(e.req.param("scope_id") ?? "").trim();
+		if (!t) return e.json({ error: "group_id_required" }, 400);
+		if (!r) return e.json({ error: "scope_id_required" }, 400);
+		let i = n();
+		try {
+			let { auth: n, response: a } = await O(i, t, e);
+			if (a) return a;
+			if (!n.enrollment) return e.json({ error: "unknown_device" }, 401);
+			let o = (await i.listScopes({
+				groupId: t,
+				includeInactive: !1
+			})).find((e) => e.scope_id === r) ?? null;
+			if (o?.status !== "active") return e.json({ error: "scope_not_found" }, 404);
+			let s = await i.listScopeMemberships(r, !1);
+			return s.some((e) => e.device_id === String(n.enrollment?.device_id) && k(e, o)) ? e.json({ items: s.filter((e) => k(e, o)) }) : e.json({ error: "scope_not_authorized" }, 403);
+		} finally {
+			await i.close();
+		}
+	}), d.get("/v1/reciprocal-approvals", async (e) => {
+		let i = (e.req.query("group_id") ?? "").trim(), a = (e.req.query("direction") ?? "incoming").trim(), o = (e.req.query("status") ?? "pending").trim() || "pending";
+		if (!i) return e.json({ error: "group_id_required" }, 400);
+		if (!["incoming", "outgoing"].includes(a)) return e.json({ error: "direction_must_be_incoming_or_outgoing" }, 400);
+		let s = n();
+		try {
+			let n = await Q(s, t, r, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: i,
+				body: new Uint8Array(),
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let c = p(e, String(n.enrollment.device_id), !0);
+			if (c) return c;
+			let l = await s.listReciprocalApprovals({
+				groupId: i,
+				deviceId: String(n.enrollment.device_id),
+				direction: a,
+				status: o
+			});
+			return e.json({ items: l });
+		} finally {
+			await s.close();
+		}
+	}), d.post("/v1/reciprocal-approvals", async (e) => {
+		let i = await m(e);
+		if (i == null) return e.json({ error: "body_too_large" }, 413);
+		let a = h(i);
+		if (!a) return e.json({ error: "invalid_json" }, 400);
+		let o = String(a.group_id ?? "").trim(), s = String(a.requested_device_id ?? "").trim();
+		if (!o || !s) return e.json({ error: "group_id_and_requested_device_id_required" }, 400);
+		let c = n();
+		try {
+			let n = await Q(c, t, r, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: o,
+				body: i,
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let a = p(e, String(n.enrollment.device_id), !0);
+			if (a) return a;
+			if (s === String(n.enrollment.device_id)) return e.json({ error: "requested_device_must_differ" }, 400);
+			if (!await c.getEnrollment(o, s)) return e.json({ error: "requested_device_not_found" }, 404);
+			let l = await c.createReciprocalApproval({
+				groupId: o,
+				requestingDeviceId: String(n.enrollment.device_id),
+				requestedDeviceId: s
+			});
+			return e.json({
+				ok: !0,
+				request: l
+			});
+		} finally {
+			await c.close();
+		}
+	}), d.post("/v1/invites/add-device", async (e) => {
+		let i = await m(e);
+		if (i == null) return e.json({ error: "body_too_large" }, 413);
+		let a = h(i);
+		if (!a) return e.json({ error: "invalid_json" }, 400);
+		let o = new Set([
+			"group_id",
+			"expires_at",
+			"reviewed_preview_digest",
+			"reviewed_intent"
+		]);
+		if (Object.keys(a).some((e) => !o.has(e))) return e.json({ error: "unexpected_add_device_invite_fields" }, 400);
+		let s = String(a.group_id ?? "").trim(), c = String(a.expires_at ?? "").trim(), l = String(a.reviewed_preview_digest ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_expires_at_required" }, 400);
+		if (Number.isNaN(new Date(c).getTime())) return e.json({ error: "invalid_expires_at" }, 400);
+		if (!/^[a-f0-9]{64}$/u.test(l)) return e.json({ error: "reviewed_preview_digest_invalid" }, 400);
+		if (a.reviewed_intent == null) return e.json({ error: "recipient_invite_review_unavailable" }, 400);
+		let u = n();
+		try {
+			let n = await Q(u, t, r, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: s,
+				body: i,
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let o = p(e, String(n.enrollment.device_id), !0);
+			if (o) return o;
+			let d = n.enrollment.identity_id;
+			if (!d || d !== d.trim() || d.length > 256 || /[\p{Cc}\p{Cf}]/u.test(d)) return e.json({ error: "identity_binding_required" }, 403);
+			let f;
+			try {
+				f = await F(a.reviewed_intent, {
+					target: {
+						kind: "add_device",
+						targetIdentityId: d
+					},
+					digest: l
+				});
+			} catch (t) {
+				return t instanceof x && t.code === "recipient_invite_intent_mismatch" ? e.json({ error: t.code }, 409) : e.json({ error: "recipient_invite_review_unavailable" }, 400);
+			}
+			let m = await u.createInvite({
+				groupId: s,
+				policy: "auto_admit",
+				expiresAt: c,
+				createdBy: d,
+				inviterDeviceId: String(n.enrollment.device_id),
+				inviteKind: "add_device",
+				targetIdentityId: d,
+				reviewedPreviewDigest: l,
+				reviewedIntent: f
+			}), h = {
+				v: 1,
+				kind: "add_device",
+				coordinator_url: new URL(e.req.url).origin,
+				group_id: s,
+				policy: m.policy,
+				token: String(m.token ?? ""),
+				expires_at: m.expires_at,
+				team_name: m.team_name_snapshot ?? null,
+				target_identity_id: m.target_identity_id ?? void 0,
+				inviter_device_id: m.inviter_device_id ?? void 0,
+				reviewed_preview_digest: m.reviewed_preview_digest ?? void 0
+			}, g = W(h), { token: _, ...v } = m;
+			return e.json({
+				ok: !0,
+				invite: v,
+				payload: h,
+				encoded: g,
+				link: G(g)
+			});
+		} finally {
+			await u.close();
+		}
+	}), d.post("/v1/admin/devices", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim(), l = String(o.fingerprint ?? "").trim(), u = String(o.public_key ?? "").trim(), d = String(o.display_name ?? "").trim() || null;
+		if (!s || !c || !l || !u) return e.json({ error: "group_id_device_id_fingerprint_public_key_required" }, 400);
+		if (le(u) !== l) return e.json({ error: "fingerprint_mismatch" }, 400);
+		let f = n();
+		try {
+			await f.createGroup(s), await f.enrollDevice(s, {
+				deviceId: c,
+				fingerprint: l,
+				publicKey: u,
+				displayName: d
+			});
+		} finally {
+			await f.close();
+		}
+		return e.json({ ok: !0 });
+	}), d.get("/v1/admin/groups", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = [
+			"1",
+			"true",
+			"yes"
+		].includes((e.req.query("include_archived") ?? "0").trim().toLowerCase()), o = n();
+		try {
+			return e.json({ items: await o.listGroups(a) });
+		} finally {
+			await o.close();
+		}
+	}), d.post("/v1/admin/groups", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.display_name ?? "").trim() || null;
+		if (!s) return e.json({ error: "group_id_required" }, 400);
+		let l = n();
+		try {
+			return await l.createGroup(s, c), e.json({
+				ok: !0,
+				group: await l.getGroup(s)
+			});
+		} finally {
+			await l.close();
+		}
+	}), d.post("/v1/admin/groups/rename", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.display_name ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_display_name_required" }, 400);
+		let l = n();
+		try {
+			return await l.renameGroup(s, c) ? e.json({
+				ok: !0,
+				group: await l.getGroup(s)
+			}) : e.json({ error: "group_not_found" }, 404);
+		} finally {
+			await l.close();
+		}
+	}), d.post("/v1/admin/groups/archive", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim();
+		if (!s) return e.json({ error: "group_id_required" }, 400);
+		let c = n();
+		try {
+			return await c.archiveGroup(s, t.now()) ? e.json({
+				ok: !0,
+				group: await c.getGroup(s)
+			}) : e.json({ error: "group_not_found_or_already_archived" }, 404);
+		} finally {
+			await c.close();
+		}
+	}), d.post("/v1/admin/groups/unarchive", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim();
+		if (!s) return e.json({ error: "group_id_required" }, 400);
+		let c = n();
+		try {
+			return await c.unarchiveGroup(s) ? e.json({
+				ok: !0,
+				group: await c.getGroup(s)
+			}) : e.json({ error: "group_not_found_or_not_archived" }, 404);
+		} finally {
+			await c.close();
+		}
+	}), d.get("/v1/admin/groups/:group_id/scopes", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = String(e.req.param("group_id") ?? "").trim(), o = n();
+		try {
+			let t = await E(o, a, e);
+			if (t) return t;
+			let n = S(e.req.query("include_inactive"));
+			return e.json({ items: await o.listScopes({
+				groupId: a,
+				includeInactive: n
+			}) });
+		} finally {
+			await o.close();
+		}
+	}), d.post("/v1/admin/groups/:group_id/scopes", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(e.req.param("group_id") ?? "").trim(), c = _(o, "scope_id"), l = _(o, "label"), u = b(o, "membership_epoch");
+		if (!c || !l) return e.json({ error: "scope_id_and_label_required" }, 400);
+		if (Number.isNaN(u)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
+		let d = n();
+		try {
+			let t = await E(d, s, e);
+			if (t) return t;
+			let n = await d.createScope({
+				scopeId: c,
+				label: l,
+				kind: _(o, "kind"),
+				authorityType: _(o, "authority_type"),
+				coordinatorId: _(o, "coordinator_id"),
+				groupId: s,
+				manifestIssuerDeviceId: _(o, "manifest_issuer_device_id"),
+				membershipEpoch: u,
+				manifestHash: _(o, "manifest_hash"),
+				status: _(o, "status")
+			});
+			return e.json({
+				ok: !0,
+				scope: n
+			}, 201);
+		} catch (t) {
+			return e.json({ error: t instanceof Error ? t.message : String(t) }, 400);
+		} finally {
+			await d.close();
+		}
+	}), d.patch("/v1/admin/groups/:group_id/scopes/:scope_id", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(e.req.param("group_id") ?? "").trim(), c = String(e.req.param("scope_id") ?? "").trim(), l = b(o, "membership_epoch");
+		if (!c) return e.json({ error: "scope_id_required" }, 400);
+		if (Number.isNaN(l)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
+		let u = n();
+		try {
+			let t = await D(u, s, c, e);
+			if (t.response) return t.response;
+			let n = await u.updateScope({
+				scopeId: c,
+				label: o.label === void 0 ? void 0 : _(o, "label"),
+				kind: o.kind === void 0 ? void 0 : _(o, "kind"),
+				authorityType: o.authority_type === void 0 ? void 0 : _(o, "authority_type"),
+				coordinatorId: o.coordinator_id === void 0 ? void 0 : _(o, "coordinator_id"),
+				groupId: s,
+				manifestIssuerDeviceId: o.manifest_issuer_device_id === void 0 ? void 0 : _(o, "manifest_issuer_device_id"),
+				membershipEpoch: l,
+				manifestHash: o.manifest_hash === void 0 ? void 0 : _(o, "manifest_hash"),
+				status: o.status === void 0 ? void 0 : _(o, "status")
+			});
+			return n ? e.json({
+				ok: !0,
+				scope: n
+			}) : e.json({ error: "scope_not_found" }, 404);
+		} catch (t) {
+			return e.json({ error: t instanceof Error ? t.message : String(t) }, 400);
+		} finally {
+			await u.close();
+		}
+	}), d.get("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = String(e.req.param("group_id") ?? "").trim(), o = String(e.req.param("scope_id") ?? "").trim(), s = n();
+		try {
+			let t = await D(s, a, o, e);
+			return t.response ? t.response : e.json({ items: await s.listScopeMemberships(o, S(e.req.query("include_revoked"))) });
+		} finally {
+			await s.close();
+		}
+	}), d.post("/v1/admin/groups/:group_id/scopes/:scope_id/members", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let a = p(e, "admin", !0);
+		if (a) return a;
+		let o = await m(e);
+		if (o == null) return e.json({ error: "body_too_large" }, 413);
+		let s = h(o);
+		if (!s) return e.json({ error: "invalid_json" }, 400);
+		let c = String(e.req.param("group_id") ?? "").trim(), l = String(e.req.param("scope_id") ?? "").trim(), u = _(s, "effect_id"), d = _(s, "device_id"), f = b(s, "membership_epoch");
+		if (!u) return e.json({ error: "effect_id_required" }, 400);
+		if (!d) return e.json({ error: "device_id_required" }, 400);
+		if (Number.isNaN(f)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
+		let g = n();
+		try {
+			let t = await D(g, c, l, e);
+			if (t.response) return t.response;
+			let n = await g.grantScopeMembership({
+				effectId: u,
+				scopeId: l,
+				deviceId: d,
+				role: _(s, "role"),
+				membershipEpoch: f,
+				coordinatorId: _(s, "coordinator_id"),
+				groupId: c,
+				manifestIssuerDeviceId: _(s, "manifest_issuer_device_id"),
+				manifestHash: _(s, "manifest_hash"),
+				signedManifestJson: _(s, "signed_manifest_json"),
+				actorType: "admin",
+				actorId: v(e.req.header(Qt))
+			});
+			return e.json({
+				ok: !0,
+				membership: n
+			}, 201);
+		} catch (t) {
+			let n = t instanceof Error ? t.message : String(t);
+			if (t instanceof i && (t.code === "scope_not_found" || t.code === "scope_group_mismatch")) return e.json({ error: "scope_not_found" }, 404);
+			if (t instanceof i && t.code === "device_not_enrolled") return e.json({ error: "device_not_enrolled_for_scope_group" }, 404);
+			let r = t instanceof i && t.code === "scope_inactive";
+			return e.json({ error: r ? "scope_not_active" : n }, n === "scope_membership_effect_conflict" || r ? 409 : 400);
+		} finally {
+			await g.close();
+		}
+	}), d.post("/v1/admin/groups/:group_id/scopes/:scope_id/members/:device_id/revoke", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let a = p(e, "admin", !0);
+		if (a) return a;
+		let o = await m(e);
+		if (o == null) return e.json({ error: "body_too_large" }, 413);
+		let s = o.byteLength > 0 ? h(o) : {};
+		if (!s) return e.json({ error: "invalid_json" }, 400);
+		let c = String(e.req.param("group_id") ?? "").trim(), l = String(e.req.param("scope_id") ?? "").trim(), u = String(e.req.param("device_id") ?? "").trim(), d = _(s, "effect_id"), f = b(s, "membership_epoch");
+		if (!d) return e.json({ error: "effect_id_required" }, 400);
+		if (!u) return e.json({ error: "device_id_required" }, 400);
+		if (Number.isNaN(f)) return e.json({ error: "membership_epoch_must_be_number" }, 400);
+		let g = n();
+		try {
+			let t = await D(g, c, l, e);
+			if (t.response) return t.response;
+			if (!await g.revokeScopeMembership({
+				effectId: d,
+				scopeId: l,
+				deviceId: u,
+				groupId: c,
+				membershipEpoch: f,
+				manifestHash: _(s, "manifest_hash"),
+				signedManifestJson: _(s, "signed_manifest_json"),
+				actorType: "admin",
+				actorId: v(e.req.header(Qt))
+			})) return e.json({ error: "membership_not_found" }, 404);
+			let n;
+			try {
+				n = (await g.listScopeMemberships(l, !0)).find((e) => e.device_id === u);
+			} catch {
+				n = void 0;
+			}
+			return e.json({
+				ok: !0,
+				scope_id: l,
+				device_id: u,
+				revocation: Xt({
+					scopeId: l,
+					deviceId: u,
+					membershipEpoch: n?.membership_epoch ?? f
+				})
+			});
+		} catch (t) {
+			let n = t instanceof Error ? t.message : String(t);
+			return t instanceof i && t.code === "scope_group_mismatch" ? e.json({ error: "scope_not_found" }, 404) : e.json({ error: n }, n === "scope_membership_effect_conflict" ? 409 : 400);
+		} finally {
+			await g.close();
+		}
+	}), d.get("/v1/admin/devices", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = (e.req.query("group_id") ?? "").trim();
+		if (!a) return e.json({ error: "group_id_required" }, 400);
+		let o = [
+			"1",
+			"true",
+			"yes"
+		].includes((e.req.query("include_disabled") ?? "0").trim().toLowerCase()), s = n();
+		try {
+			return e.json({ items: await s.listEnrolledDevices(a, o) });
+		} finally {
+			await s.close();
+		}
+	}), d.post("/v1/admin/devices/rename", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim(), l = String(o.display_name ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
+		if (!l) return e.json({ error: "display_name_required" }, 400);
+		let u = n();
+		try {
+			if (!await u.renameDevice(s, c, l)) return e.json({ error: "device_not_found" }, 404);
+			let t = await u.getEnrollment(s, c);
+			return e.json({
+				ok: !0,
+				device: t
+			});
+		} finally {
+			await u.close();
+		}
+	}), d.post("/v1/admin/devices/disable", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
+		let l = n();
+		try {
+			return await l.setDeviceEnabled(s, c, !1) ? e.json({ ok: !0 }) : e.json({ error: "device_not_found" }, 404);
+		} finally {
+			await l.close();
+		}
+	}), d.post("/v1/admin/devices/enable", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
+		let l = n();
+		try {
+			return await l.setDeviceEnabled(s, c, !0) ? e.json({ ok: !0 }) : e.json({ error: "device_not_found" }, 404);
+		} finally {
+			await l.close();
+		}
+	}), d.post("/v1/admin/devices/remove", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.device_id ?? "").trim();
+		if (!s || !c) return e.json({ error: "group_id_and_device_id_required" }, 400);
+		let l = n();
+		try {
+			return await l.removeDevice(s, c) ? e.json({ ok: !0 }) : e.json({ error: "device_not_found" }, 404);
+		} finally {
+			await l.close();
+		}
+	}), d.post("/v1/admin/invites", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.group_id ?? "").trim(), c = String(o.policy ?? "auto_admit").trim(), l = String(o.expires_at ?? "").trim(), u = String(o.created_by ?? "").trim() || null, d = String(o.operation_id ?? "").trim() || null, f = String(o.reviewed_project_set_digest ?? "").trim() || null, _ = String(o.inviter_actor_id ?? "").trim() || null, v = String(o.inviter_display_name ?? "").trim() || null, b = String(o.inviter_device_id ?? "").trim() || null, S = String(o.pending_person_id ?? "").trim() || null, C = String(o.invite_kind ?? o.kind ?? "").trim(), w = String(o.policy_team_id ?? "").trim() || null, T = String(o.target_identity_id ?? "").trim() || null, E = String(o.reviewed_preview_digest ?? "").trim() || null, D, O = null, k = null;
+		if (!s || !["auto_admit", "approval_required"].includes(c) || !l) return e.json({ error: "group_id_policy_and_expires_at_required" }, 400);
+		if (Object.hasOwn(o, "assigned_identity_id")) return e.json({ error: "assigned_identity_id_forbidden" }, 400);
+		if (Number.isNaN(new Date(l).getTime())) return e.json({ error: "invalid_expires_at" }, 400);
+		if (!!d != !!f) return e.json({ error: "operation_intent_reference_incomplete" }, 400);
+		let A = C || (d ? "project_share" : "legacy_enrollment");
+		if (![
+			"legacy_enrollment",
+			"project_share",
+			"team_member",
+			"add_device"
+		].includes(A)) return e.json({ error: "invite_kind_invalid" }, 400);
+		if (A === "project_share" ? !d : d) return e.json({ error: "invite_kind_intent_mismatch" }, 400);
+		if (E && !/^[a-f0-9]{64}$/u.test(E)) return e.json({ error: "reviewed_preview_digest_invalid" }, 400);
+		if (A === "team_member" && (!w || !E || T) || A === "add_device" && (!T || !E || w) || !["team_member", "add_device"].includes(A) && (w || T || E)) return e.json({ error: "recipient_invite_metadata_invalid" }, 400);
+		if ([w, T].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) return e.json({ error: "recipient_invite_identifier_invalid" }, 400);
+		if (A === "team_member" || A === "add_device") {
+			if (o.reviewed_intent == null) return e.json({ error: "recipient_invite_review_unavailable" }, 400);
+			try {
+				D = await F(o.reviewed_intent, {
+					target: A === "team_member" ? {
+						kind: "team_member",
+						policyTeamId: String(w)
+					} : {
+						kind: "add_device",
+						targetIdentityId: String(T)
+					},
+					digest: String(E)
+				});
+			} catch (t) {
+				return t instanceof x && t.code === "recipient_invite_intent_mismatch" ? e.json({ error: t.code }, 409) : e.json({ error: "recipient_invite_review_unavailable" }, 400);
+			}
+		} else if (o.reviewed_intent != null) return e.json({ error: "recipient_invite_metadata_invalid" }, 400);
+		if (d && !/^share_[a-f0-9]{40}$/u.test(d) || f && !/^[a-f0-9]{64}$/u.test(f)) return e.json({ error: "operation_intent_reference_invalid" }, 400);
+		if (d) {
+			if (!_ || !v || !b || !S) return e.json({ error: "project_invite_identity_context_required" }, 400);
+			if ([
+				_,
+				b,
+				S
+			].some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) return e.json({ error: "project_invite_identity_context_invalid" }, 400);
+			try {
+				if (g(v, "inviter_display_name"), O = y(o.project_summaries), !Array.isArray(o.project_intent) || o.project_intent.length !== O.length || (k = o.project_intent.map((e, t) => {
+					let n;
+					try {
+						n = Ht([e])[0];
+					} catch {
+						throw Error("project_intent_invalid");
+					}
+					let r = O?.[t];
+					if (!n || !r || n.display_name !== r.display_name || n.existing_memory_count !== r.existing_memory_count) throw Error("project_intent_invalid");
+					return n;
+				}), new Set(k.map((e) => e.canonical_identity)).size !== k.length)) throw Error("project_intent_invalid");
+			} catch (t) {
+				return e.json({ error: t instanceof Error ? t.message : "project_invite_invalid" }, 400);
+			}
+		}
+		let j = n();
+		try {
+			let t = await j.getGroup(s);
+			if (!t) return e.json({ error: "group_not_found" }, 404);
+			if (t.archived_at) return e.json({ error: "group_archived" }, 409);
+			let n = await j.createInvite({
+				groupId: s,
+				policy: c,
+				expiresAt: l,
+				createdBy: u,
+				operationId: d,
+				reviewedProjectSetDigest: f,
+				inviterActorId: _,
+				inviterDisplayName: v,
+				inviterDeviceId: b,
+				pendingPersonId: S,
+				projectSummaries: O,
+				projectIntent: k,
+				inviteKind: A,
+				policyTeamId: w,
+				targetIdentityId: T,
+				reviewedPreviewDigest: E,
+				reviewedIntent: D
+			}), r = {
+				v: 1,
+				kind: n.invite_kind === "team_member" || n.invite_kind === "add_device" ? n.invite_kind : "coordinator_team_invite",
+				coordinator_url: String(o.coordinator_url ?? "").trim(),
+				group_id: s,
+				policy: n.policy,
+				token: String(n.token ?? ""),
+				expires_at: n.expires_at,
+				team_name: n.team_name_snapshot ?? null,
+				...n.operation_id ? {
+					operation_id: n.operation_id,
+					inviter_name: n.inviter_display_name ?? null,
+					project_summaries: O ?? []
+				} : {},
+				...n.invite_kind === "team_member" ? {
+					policy_team_id: n.policy_team_id ?? void 0,
+					assigned_identity_id: n.assigned_identity_id ?? void 0,
+					reviewed_preview_digest: n.reviewed_preview_digest ?? void 0
+				} : {},
+				...n.invite_kind === "add_device" ? {
+					target_identity_id: n.target_identity_id ?? void 0,
+					inviter_device_id: n.inviter_device_id ?? void 0,
+					reviewed_preview_digest: n.reviewed_preview_digest ?? void 0
+				} : {}
+			}, i = W(r), { token: a, ...p } = n;
+			return e.json({
+				ok: !0,
+				invite: p,
+				payload: r,
+				encoded: i,
+				link: G(i)
+			});
+		} catch (t) {
+			if (t instanceof Error && t.message === "invite_operation_intent_conflict") return e.json({ error: "invite_operation_intent_conflict" }, 409);
+			if (t instanceof Error && t.message === "invite_already_bound") return e.json({ error: "invite_already_bound" }, 409);
+			throw t;
+		} finally {
+			await j.close();
+		}
+	}), d.post("/v1/invites/inspect", async (e) => {
+		let r = await m(e);
+		if (r == null) return e.json({ error: "body_too_large" }, 413);
+		let i = h(r);
+		if (!i) return e.json({ error: "invalid_json" }, 400);
+		let a = String(i.token ?? "").trim();
+		if (!a) return e.json({ error: "invite_invalid" }, 404);
+		let o = n();
+		try {
+			let n = await o.getInviteByTokenForInspection(a);
+			if (!n || n.revoked_at) return e.json({ error: "invite_invalid" }, 404);
+			if (n.invite_kind === "team_member" || n.invite_kind === "add_device") try {
+				let n = await o.inspectRecipientInvite({
+					token: a,
+					now: t.now()
+				});
+				return n ? e.json(n.kind === "team_member" ? {
+					kind: n.kind,
+					policy_team_id: n.policy_team_id,
+					assigned_identity_id: n.assigned_identity_id,
+					reviewed_preview_digest: n.reviewed_preview_digest,
+					reviewed_intent: n.reviewed_intent,
+					bound: n.bound
+				} : {
+					kind: n.kind,
+					target_identity_id: n.target_identity_id,
+					reviewed_preview_digest: n.reviewed_preview_digest,
+					reviewed_intent: n.reviewed_intent,
+					bound: n.bound
+				}) : e.json({ error: "invite_invalid" }, 404);
+			} catch (t) {
+				let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
+				return e.json({ error: n }, r);
+			}
+			let r = !!(n.operation_id || n.reviewed_project_set_digest);
+			if (new Date(n.expires_at) <= new Date(t.now()) && (!r || !n.consumed_at)) return e.json({ error: "invite_expired" }, 410);
+			if (!n.operation_id) return e.json({
+				kind: "legacy_team_invite",
+				team_name: n.team_name_snapshot
+			});
+			if (!n.project_intent_json || !n.project_summaries_json) return e.json({ error: "invite_invalid" }, 404);
+			let i;
+			try {
+				i = T(n.project_summaries_json);
+			} catch {
+				return e.json({ error: "invite_invalid" }, 409);
+			}
+			return e.json({
+				kind: "project_share_invite",
+				operation_id: n.operation_id,
+				inviter_name: n.inviter_display_name,
+				team_name: n.team_name_snapshot,
+				projects: i,
+				bound: !!n.consumed_at
+			});
+		} finally {
+			await o.close();
+		}
+	}), d.get("/v1/admin/invites", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = (e.req.query("group_id") ?? "").trim();
+		if (!a) return e.json({ error: "group_id_required" }, 400);
+		let o = n();
+		try {
+			let t = (await o.listInvites(a)).map(({ token: e, ...t }) => t);
+			return e.json({ items: t });
+		} finally {
+			await o.close();
+		}
+	}), d.get("/v1/admin/project-invites/:operationId", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return e.json({ error: r.error }, 401);
+		let i = String(e.req.param("operationId") ?? "").trim(), a = String(e.req.query("group_id") ?? "").trim();
+		if (!i || !a) return e.json({ error: "operation_id_and_group_id_required" }, 400);
+		let o = n();
+		try {
+			let n = (await o.listInvites(a)).find((e) => e.operation_id === i);
+			if (!n) return e.json({ error: "operation_not_found" }, 404);
+			let r;
+			try {
+				r = C(n.project_intent_json);
+			} catch {
+				return e.json({ error: "operation_intent_invalid" }, 409);
+			}
+			let s = null;
+			if (!n.consumed_at && !n.revoked_at && new Date(n.expires_at) > new Date(t.now()) && n.token && !n.token.startsWith("consumed:")) {
+				let t = r.map((e) => ({
+					display_name: String(e.display_name ?? ""),
+					existing_memory_count: Number(e.existing_memory_count ?? 0)
+				}));
+				s = G(W({
+					v: 1,
+					kind: "coordinator_team_invite",
+					coordinator_url: new URL(e.req.url).origin,
+					group_id: n.group_id,
+					policy: n.policy,
+					token: n.token,
+					expires_at: n.expires_at,
+					team_name: n.team_name_snapshot,
+					operation_id: i,
+					inviter_name: n.inviter_display_name ?? null,
+					project_summaries: t
+				}));
+			}
+			return e.json({
+				operation_id: n.operation_id,
+				group_id: n.group_id,
+				reviewed_project_set_digest: n.reviewed_project_set_digest,
+				state: n.consumed_at ? "accepted" : "waiting_for_acceptance",
+				pending_person_id: n.pending_person_id,
+				recipient_actor_id: n.recipient_actor_id,
+				recipient_display_name: n.recipient_display_name,
+				recipient_device_id: n.bound_device_id,
+				recipient_device_display_name: n.recipient_device_display_name,
+				recipient_public_key: n.bound_public_key,
+				recipient_fingerprint: n.bound_fingerprint,
+				consumed_at: n.consumed_at,
+				bootstrap_grant_id: n.bootstrap_grant_id,
+				trust_state: n.trust_state,
+				projects: r,
+				invite_link: s
+			});
+		} finally {
+			await o.close();
+		}
+	}), d.get("/v1/admin/bootstrap-grants/:grantId", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = String(e.req.param("grantId") ?? "").trim();
+		if (!a) return e.json({ error: "grant_id_required" }, 400);
+		let o = n();
+		try {
+			let t = await o.getBootstrapGrant(a);
+			if (!t) return e.json({ error: "grant_not_found" }, 404);
+			let n = await o.getEnrollment(t.group_id, t.worker_device_id);
+			if (!n) return e.json({ error: "worker_enrollment_not_found" }, 404);
+			let r = {
+				grant: t,
+				worker_enrollment: n
+			};
+			return e.json(r);
+		} finally {
+			await o.close();
+		}
+	}), d.get("/v1/bootstrap-grants/:grantId", async (e) => {
+		let i = String(e.req.param("grantId") ?? "").trim(), a = String(e.req.query("group_id") ?? "").trim();
+		if (!i || !a) return e.json({ error: "grant_id_and_group_id_required" }, 400);
+		let o = n();
+		try {
+			let n = await Q(o, t, r, {
+				method: e.req.method,
+				url: e.req.url,
+				groupId: a,
+				body: new Uint8Array(),
+				deviceId: e.req.header("X-Opencode-Device") ?? null,
+				signature: e.req.header("X-Opencode-Signature") ?? null,
+				timestamp: e.req.header("X-Opencode-Timestamp") ?? null,
+				nonce: e.req.header("X-Opencode-Nonce") ?? null
+			});
+			if (!n.ok || !n.enrollment) return p(e, e.req.path, !1) ?? e.json({ error: n.error }, $(n.error));
+			let s = p(e, String(n.enrollment.device_id), !0);
+			if (s) return s;
+			let c = await o.getBootstrapGrant(i);
+			if (!c || c.group_id !== a || c.seed_device_id !== String(n.enrollment.device_id)) return e.json({ error: "grant_not_found" }, 404);
+			let l = await o.getEnrollment(a, c.worker_device_id);
+			return l ? e.json({
+				grant: c,
+				worker_enrollment: l
+			}) : e.json({ error: "worker_enrollment_not_found" }, 404);
+		} finally {
+			await o.close();
+		}
+	}), d.get("/v1/admin/bootstrap-grants", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = (e.req.query("group_id") ?? "").trim();
+		if (!a) return e.json({ error: "group_id_required" }, 400);
+		let o = n();
+		try {
+			return e.json({ items: await o.listBootstrapGrants(a) });
+		} finally {
+			await o.close();
+		}
+	}), d.post("/v1/admin/bootstrap-grants/revoke", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = await m(e);
+		if (a == null) return e.json({ error: "body_too_large" }, 413);
+		let o = h(a);
+		if (!o) return e.json({ error: "invalid_json" }, 400);
+		let s = String(o.grant_id ?? "").trim();
+		if (!s) return e.json({ error: "grant_id_required" }, 400);
+		let c = n();
+		try {
+			return await c.revokeBootstrapGrant(s, t.now()) ? e.json({
+				ok: !0,
+				grant_id: s
+			}) : e.json({ error: "grant_not_found" }, 404);
+		} finally {
+			await c.close();
+		}
+	}), d.post("/v1/admin/join-requests/approve", async (e) => on(e, !0, {
+		createStore: n,
+		runtime: t,
+		rateLimitedResponse: p
+	})), d.post("/v1/admin/join-requests/deny", async (e) => on(e, !1, {
+		createStore: n,
+		runtime: t,
+		rateLimitedResponse: p
+	})), d.get("/v1/admin/join-requests", async (e) => {
+		let r = Z(e.req.header(X), t);
+		if (!r.ok) return p(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+		let i = p(e, "admin", !0);
+		if (i) return i;
+		let a = (e.req.query("group_id") ?? "").trim();
+		if (!a) return e.json({ error: "group_id_required" }, 400);
+		let o = n();
+		try {
+			return e.json({ items: await o.listJoinRequests(a) });
+		} finally {
+			await o.close();
+		}
+	}), d.post("/v1/join", async (e) => {
+		let r = await m(e);
+		if (r == null) return e.json({ error: "body_too_large" }, 413);
+		let i = h(r);
+		if (!i) return e.json({ error: "invalid_json" }, 400);
+		let a = String(i.token ?? "").trim(), o = String(i.device_id ?? "").trim(), s = String(i.fingerprint ?? "").trim(), c = String(i.public_key ?? "").trim(), l = String(i.display_name ?? "").trim() || null, u = String(i.operation_id ?? "").trim(), d = String(i.recipient_actor_id ?? "").trim(), f = String(i.recipient_display_name ?? "").trim(), p = String(i.device_display_name ?? "").trim();
+		if (!a || !o || !s || !c) return e.json({ error: "token_device_id_fingerprint_public_key_required" }, 400);
+		if (le(c) !== s) return e.json({ error: "fingerprint_mismatch" }, 400);
+		let _ = n();
+		try {
+			let n = await _.getInviteByTokenForInspection(a);
+			if (!n) return e.json({ error: "invite_invalid" }, 404);
+			let r = !!(n.operation_id || n.reviewed_project_set_digest), m = n.invite_kind === "team_member" || n.invite_kind === "add_device";
+			if (n.revoked_at) return e.json({ error: r || m ? "invite_invalid" : "revoked_token" }, 400);
+			if (!n.consumed_at && new Date(n.expires_at) <= new Date(t.now())) return e.json({ error: r || m ? "invite_expired" : "expired_token" }, 410);
+			if (m) {
+				let r = new Set([
+					"token",
+					"invite_kind",
+					"kind",
+					"identity_id",
+					"device_id",
+					"public_key",
+					"fingerprint",
+					"recipient_display_name",
+					"device_display_name"
+				]);
+				if (Object.keys(i).some((e) => !r.has(e))) return e.json({ error: "unexpected_recipient_invite_fields" }, 400);
+				let l = String(i.invite_kind ?? i.kind ?? "").trim(), u = String(i.identity_id ?? "").trim();
+				if (!u || l !== n.invite_kind) return e.json({ error: "recipient_invite_binding_required" }, 400);
+				if (u.length > 256 || /[\p{Cc}\p{Cf}]/u.test(u)) return e.json({ error: "identity_id_invalid" }, 400);
+				let d = null, f = null;
+				try {
+					if (i.recipient_display_name != null) {
+						if (typeof i.recipient_display_name != "string") throw Error("recipient_display_name_invalid");
+						d = g(i.recipient_display_name, "recipient_display_name");
+					}
+					if (i.device_display_name != null) {
+						if (typeof i.device_display_name != "string") throw Error("device_display_name_invalid");
+						f = g(i.device_display_name, "device_display_name");
+					}
+				} catch (t) {
+					return e.json({ error: t instanceof Error ? t.message : "recipient_invite_identity_invalid" }, 400);
+				}
+				if (n.invite_kind === "add_device" && String(n.inviter_device_id ?? "").trim() === o) return e.json({ error: "add_device_invite_self_acceptance_forbidden" }, 409);
+				try {
+					let r = await _.consumeRecipientInvite({
+						token: a,
+						inviteKind: n.invite_kind,
+						identityId: u,
+						deviceId: o,
+						publicKey: c,
+						fingerprint: s,
+						recipientDisplayName: d,
+						deviceDisplayName: f,
+						now: t.now()
+					});
+					return e.json({
+						ok: !0,
+						status: r.status,
+						kind: r.invite.invite_kind,
+						group_id: r.invite.group_id,
+						identity_id: r.invite.recipient_actor_id,
+						policy_team_id: r.invite.policy_team_id ?? null,
+						target_identity_id: r.invite.target_identity_id ?? null,
+						assigned_identity_id: r.invite.assigned_identity_id ?? null,
+						bootstrap_grant_id: r.bootstrap_grant?.grant_id ?? null,
+						inviter_device: r.bootstrap_grant ? await _.getEnrollment(r.invite.group_id, r.bootstrap_grant.seed_device_id) : null,
+						reviewed_preview_digest: r.invite.reviewed_preview_digest,
+						reviewed_intent: r.reviewed_intent
+					});
+				} catch (t) {
+					let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
+					return e.json({ error: n }, r);
+				}
+			}
+			if (n.operation_id || n.reviewed_project_set_digest) {
+				let r = new Set([
+					"token",
+					"operation_id",
+					"device_id",
+					"public_key",
+					"fingerprint",
+					"display_name",
+					"recipient_actor_id",
+					"recipient_display_name",
+					"device_display_name"
+				]);
+				if (Object.keys(i).some((e) => !r.has(e))) return e.json({ error: "unexpected_project_invite_fields" }, 400);
+				if (!u || !d || !f || !p) return e.json({ error: "project_invite_identity_required" }, 400);
+				if (String(n.inviter_device_id ?? "").trim() === o) return e.json({ error: "project_invite_self_acceptance_forbidden" }, 409);
+				if (d.length > 256 || /[\p{Cc}\p{Cf}]/u.test(d)) return e.json({ error: "recipient_actor_id_invalid" }, 400);
+				let l, m;
+				try {
+					l = g(f, "recipient_display_name"), m = g(p, "device_display_name");
+				} catch (t) {
+					return e.json({ error: t instanceof Error ? t.message : "project_invite_identity_invalid" }, 400);
+				}
+				let h;
+				try {
+					h = w(n);
+				} catch {
+					return e.json({ error: "operation_intent_invalid" }, 409);
+				}
+				try {
+					let n = await _.consumeProjectInvite({
+						token: a,
+						operationId: u,
+						deviceId: o,
+						publicKey: c,
+						fingerprint: s,
+						recipientActorId: d,
+						recipientDisplayName: l,
+						deviceDisplayName: m,
+						now: t.now()
+					});
+					return e.json({
+						ok: !0,
+						status: _t,
+						group_id: n.invite.group_id,
+						operation_id: n.invite.operation_id,
+						trust_state: n.invite.trust_state,
+						bootstrap_grant_id: n.bootstrap_grant?.grant_id ?? null,
+						inviter_device: n.seed_enrollment ? {
+							device_id: n.seed_enrollment.device_id,
+							public_key: n.seed_enrollment.public_key,
+							fingerprint: n.seed_enrollment.fingerprint,
+							display_name: n.seed_enrollment.display_name
+						} : null,
+						accepted_project_intent: h
+					});
+				} catch (t) {
+					let n = t instanceof Error ? t.message : "invite_invalid", r = n === "invite_expired" ? 410 : n === "invite_invalid" ? 404 : 409;
+					return e.json({ error: n }, r);
+				}
+			}
+			if ([
+				"operation_id",
+				"recipient_actor_id",
+				"recipient_display_name",
+				"device_display_name"
+			].some((e) => Object.hasOwn(i, e))) return e.json({ error: "unexpected_project_invite_fields" }, 400);
+			let h = await _.getGroup(String(n.group_id));
+			if (!h) return e.json({ error: "group_not_found" }, 404);
+			if (h.archived_at) return e.json({ error: "group_archived" }, 409);
+			let v = String(n.group_id);
+			if (await _.getEnrollment(v, o)) return e.json({
+				ok: !0,
+				status: "already_enrolled",
+				group_id: n.group_id,
+				policy: n.policy
+			});
+			let y = String(n.policy);
+			if (!["auto_admit", "approval_required"].includes(y)) return e.json({ error: `unknown invite policy: ${y}` }, 400);
+			if (y === "approval_required") {
+				let t = await _.createJoinRequest({
+					groupId: v,
+					deviceId: o,
+					publicKey: c,
+					fingerprint: s,
+					displayName: l,
+					token: a
+				});
+				return e.json({
+					ok: !0,
+					status: "pending",
+					group_id: n.group_id,
+					policy: n.policy,
+					request_id: t.request_id
+				});
+			}
+			return await _.enrollDevice(v, {
+				deviceId: o,
+				fingerprint: s,
+				publicKey: c,
+				displayName: l
+			}), e.json({
+				ok: !0,
+				status: "enrolled",
+				group_id: n.group_id,
+				policy: n.policy
+			});
+		} finally {
+			await _.close();
+		}
+	}), d;
+}
+async function on(e, t, n) {
+	let r = Z(e.req.header(X), n.runtime);
+	if (!r.ok) return n.rateLimitedResponse(e, e.req.path, !1) ?? e.json({ error: r.error }, 401);
+	let i = n.rateLimitedResponse(e, "admin", !0);
+	if (i) return i;
+	let a = await (async () => {
+		let t = Number.parseInt(e.req.header("content-length") ?? "", 10);
+		if (Number.isFinite(t) && t > Y) return null;
+		let n = e.req.raw.body;
+		if (!n) return new Uint8Array();
+		let r = n.getReader(), i = [], a = 0;
+		try {
+			for (;;) {
+				let { done: e, value: t } = await r.read();
+				if (e) break;
+				if (t) {
+					if (a += t.byteLength, a > Y) return await r.cancel(), null;
+					i.push(t);
+				}
+			}
+		} finally {
+			r.releaseLock();
+		}
+		let o = new Uint8Array(a), s = 0;
+		for (let e of i) o.set(e, s), s += e.byteLength;
+		return o;
+	})();
+	if (a == null) return e.json({ error: "body_too_large" }, 413);
+	let o;
+	try {
+		let e = new TextDecoder(), t = JSON.parse(e.decode(a));
+		o = typeof t == "object" && t && !Array.isArray(t) ? t : null;
+	} catch {
+		o = null;
+	}
+	if (!o) return e.json({ error: "invalid_json" }, 400);
+	let s = String(o.request_id ?? "").trim(), c = String(o.reviewed_by ?? "").trim() || null, l = String(o.bootstrap_grant_seed_device_id ?? "").trim(), u = String(o.bootstrap_grant_expires_at ?? "").trim();
+	if (!s) return e.json({ error: "request_id_required" }, 400);
+	let d = [l, u].filter(Boolean).length;
+	if (d > 0 && d < 2) return e.json({ error: "bootstrap_grant_seed_device_id_and_expires_at_required_together" }, 400);
+	let f = n.createStore();
+	try {
+		let n = await f.reviewJoinRequest({
+			requestId: s,
+			approved: t,
+			reviewedBy: c,
+			bootstrapGrant: t && l && u ? {
+				seedDeviceId: l,
+				expiresAt: u,
+				createdBy: c
+			} : null
+		});
+		return n ? n._no_transition ? e.json({
+			error: "request_not_pending",
+			status: n.status
+		}, 409) : e.json({
+			ok: !0,
+			request: n
+		}) : e.json({ error: "request_not_found" }, 404);
+	} finally {
+		await f.close();
+	}
+}
+//#endregion
+export { se as A, l as B, G as C, oe as D, x as E, y as F, u as H, p as I, d as L, v as M, _ as N, N as O, g as P, m as R, gt as S, b as T, o as U, s as V, c as W, yt as _, Yt as a, ht as b, Ht as c, St as d, Dt as f, vt as g, _t as h, Xt as i, F as j, ce as k, Bt as l, Lt as m, Zt as n, Rt as o, It as p, Jt as r, Vt as s, an as t, Ct as u, bt as v, le as w, W as x, xt as y, i as z };
+
+//# sourceMappingURL=coordinator-api-Bxw5Q3py.js.map