@codemem/server 0.47.0-beta.3 → 0.47.0

package/dist/index.js

@@ -1,16 +1,19 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readCodememConfigFile, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, runSyncPass, schema, scopeAuthorizationFailureReason, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
+import { closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyLocalIdentitySwitch, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, assertNoLocalIdentityOverride, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, captureAccountOwnerProfilePins, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, completeLocalIdentitySwitch, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorAuthControllerReviewAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyDecisionCountsAsOwner, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, markLocalIdentitySwitchBound, markLocalIdentitySwitchNotCommitted, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeCoordinatorLegacyTeamCompletionManifest, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readAccountOwnerAssociation, readAccountOwnerAssociationRetainedAtMs, readCodememConfigFile, readCompletedLocalIdentitySwitches, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorResolvedAccountOwnerReceiptStatus, readCoordinatorResolvedAccountOwnerStatus, readCoordinatorSyncConfig, readOpenLocalIdentitySwitch, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordLocalIdentitySwitch, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, resumeDeviceRebind, runDeviceRebind, runSyncPass, schema, scopeAuthorizationFailureReason, searchPiSessions, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
-import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
+import { and, count, desc, eq, inArray, max, ne, sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { homedir, hostname, networkInterfaces } from "node:os";
 import * as z from "zod";
 import { chmod, link, mkdir, open, readFile, readdir, rm, stat } from "node:fs/promises";
+import "better-sqlite3";
+import "sqlite-vec";
+import { index, integer, primaryKey, real, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
 //#region src/routes/account.ts
 /** Mounted only alongside the account request middleware. */
 function accountRoutes(getSession) {
@@ -313,10 +316,31 @@ function safeFailure(error) {
 		default: return "request_failed";
 	}
 }
+function browserPath(intent) {
+	if (intent === "refresh" || intent === "disconnect") return "/auth/account/change/start";
+	if (intent === "sign_in") return "/auth/rebind/start";
+	return "/auth/link/start";
+}
+var REBIND_REFUSALS = {
+	account_not_linked: "account_not_linked",
+	already_this_identity: "already_this_identity",
+	current_identity_linked: "current_identity_linked",
+	device_already_bound: "device_already_bound",
+	daily_limit: "daily_limit"
+};
+/** Maps a rebind result to the operation's terminal state and failure. */
+function rebindOutcome(result) {
+	if (result.kind === "switched" || result.kind === "bound") return ["succeeded", null];
+	if (result.kind === "bind_unknown") return ["outcome_unknown", "bind_unconfirmed"];
+	if (result.kind === "pending") return ["outcome_unknown", "switch_pending"];
+	if (result.kind === "refused" && result.reason === "unavailable" && result.beforeBrowser) return ["failed", "sign_in_unavailable"];
+	if (result.kind === "refused") return ["failed", REBIND_REFUSALS[result.reason] ?? "request_failed"];
+	return ["failed", "request_failed"];
+}
 function validBrowserUrl(value, origin, intent) {
 	try {
 		const url = new URL(value);
-		return url.origin === origin && url.pathname === (intent === "refresh" || intent === "disconnect" ? "/auth/account/change/start" : "/auth/link/start") && !url.username && !url.password && !url.hash;
+		return url.origin === origin && url.pathname === browserPath(intent) && !url.username && !url.password && !url.hash;
 	} catch {
 		return false;
 	}
@@ -329,6 +353,7 @@ var InProcessAccountLinkRegistry = class {
 	#shuttingDown = false;
 	#closing = null;
 	#uncertainOwner = null;
+	#recoveryOwner = null;
 	constructor(options) {
 		this.#options = options;
 		this.#now = options.now ?? Date.now;
@@ -409,6 +434,7 @@ var InProcessAccountLinkRegistry = class {
 				onBrowserStart: (url) => this.#browserStart(job, url)
 			};
 			const intent = job.operation.intent ?? "connect";
+			if (intent === "sign_in") return await this.#runSignIn(job, options.onBrowserStart);
 			if (intent === "connect") await (this.#options.link ?? linkCoordinatorAccount)({
 				...options,
 				expectedAuthority
@@ -426,6 +452,25 @@ var InProcessAccountLinkRegistry = class {
 			this.#fail(job, error);
 		}
 	}
+	/** Sign-in may switch this device's Identity; its result maps to one terminal state. */
+	async #runSignIn(job, onBrowserStart) {
+		const rebind = this.#options.rebind;
+		if (!rebind) throw new CoordinatorAccountLinkError("invalid_options");
+		const [state, failure] = rebindOutcome(await rebind({
+			context: job.context,
+			signal: job.controller.signal,
+			onBrowserStart,
+			isCurrent: () => {
+				const current = this.#current(job.context);
+				if (!current) job.abortFailure = "context_changed";
+				return current;
+			}
+		}));
+		if (state !== "failed") this.#finish(job, state, failure);
+		else if (job.abortFailure) this.#finish(job, "failed", job.abortFailure);
+		else if (job.cancelled) this.#finish(job, "cancelled", "link_stopped");
+		else this.#finish(job, "failed", failure);
+	}
 	#fail(job, error) {
 		let failure = safeFailure(error);
 		if (job.abortFailure && (failure === "link_stopped" || failure === "request_failed")) failure = job.abortFailure;
@@ -480,10 +525,35 @@ var InProcessAccountLinkRegistry = class {
 		});
 		return { operation: this.#snapshot(job) };
 	}
+	supportsSignIn() {
+		if (!this.#options.rebind) return false;
+		try {
+			assertNoLocalIdentityOverride();
+			return true;
+		} catch {
+			return false;
+		}
+	}
 	lifecycleToken() {
 		busySlot.lifecycle ??= Symbol();
 		return busySlot.lifecycle;
 	}
+	tryReserveRecovery() {
+		if (this.#shuttingDown || this.#inProgress()) return null;
+		if (this.#shuttingDown || busySlot.owner) return null;
+		const owner = Symbol();
+		busySlot.owner = owner;
+		busySlot.lifecycle = Symbol();
+		this.#recoveryOwner = owner;
+		return {
+			isCurrent: () => !this.#shuttingDown && this.#recoveryOwner === owner && busySlot.owner === owner,
+			release: () => {
+				if (this.#recoveryOwner !== owner) return;
+				this.#recoveryOwner = null;
+				releaseBusyOwner(owner);
+			}
+		};
+	}
 	get(operationId) {
 		this.#cleanup();
 		const job = this.#jobs.get(operationId);
@@ -529,6 +599,10 @@ var InProcessAccountLinkRegistry = class {
 	close() {
 		if (this.#closing) return this.#closing;
 		this.#shuttingDown = true;
+		if (this.#recoveryOwner) {
+			releaseBusyOwner(this.#recoveryOwner);
+			this.#recoveryOwner = null;
+		}
 		for (const job of this.#jobs.values()) {
 			this.#clearUrl(job);
 			if (!terminal(job)) {
@@ -554,17 +628,200 @@ function createAccountLinkRegistry(options) {
 	return new InProcessAccountLinkRegistry(options);
 }
 //#endregion
+//#region src/account/owner-status.ts
+/** The coordinator ID comes from the first signed actor-status read, never the origin. */
+function readOwnerAssociation(context, coordinatorId) {
+	if (context.publicKeyHash === void 0) return null;
+	const before = statSync(context.dbPath, { bigint: true });
+	const device = readAccountLinkDevice(context.dbPath);
+	const profileFor = (actorId) => {
+		const profile = {
+			...context,
+			publicKey: device.publicKey,
+			actorId,
+			coordinatorId
+		};
+		return {
+			profile,
+			expectedProfilePins: captureAccountOwnerProfilePins(profile)
+		};
+	};
+	const association = readCurrentAssociation(context, {
+		generation: (actorId) => {
+			const { profile, expectedProfilePins } = profileFor(actorId);
+			return readAccountOwnerAssociation(profile, { expectedProfilePins });
+		},
+		generationRetainedAtMs: (actorId) => {
+			const { profile, expectedProfilePins } = profileFor(actorId);
+			return readAccountOwnerAssociationRetainedAtMs(profile, { expectedProfilePins });
+		},
+		legacy: (actorId) => readAccountOwnerAssociation(profileFor(actorId).profile),
+		legacyRetainedAtMs: (actorId) => readAccountOwnerAssociationRetainedAtMs(profileFor(actorId).profile)
+	});
+	const after = statSync(context.dbPath, { bigint: true });
+	if (!before.isFile() || before.dev !== after.dev || before.ino !== after.ino || after.dev.toString() !== context.fileIdentity.dev || after.ino.toString() !== context.fileIdentity.ino || device.deviceId !== context.deviceId || createHash("sha256").update(device.publicKey).digest("hex") !== context.publicKeyHash || device.fingerprint !== context.fingerprint) throw new Error("account_owner_association_invalid");
+	return association;
+}
+/** A switch away from `actorId` completed after evidence published at `retainedAtMs`. */
+function switchedAwayAfter(switches, actorId, retainedAtMs) {
+	return retainedAtMs !== null && switches.some((s) => s.previousIdentityId === actorId && s.completedAtMs > retainedAtMs);
+}
+/** The shared legacy file pins a previous Identity whose switch superseded it. */
+function legacySuperseded(evidence, switches) {
+	return [...new Set(switches.map((s) => s.previousIdentityId))].some((actorId) => {
+		try {
+			return evidence.legacy(actorId) !== null && switchedAwayAfter(switches, actorId, evidence.legacyRetainedAtMs(actorId));
+		} catch {
+			return false;
+		}
+	});
+}
+/**
+* A switch away from the pinned Identity, completed after the association was
+* published, supersedes it for good. Read failures are suppressed only for the
+* shared legacy file, and only when it pins such a superseded Identity; a
+* failing exact generation for the current Identity is always reported.
+*/
+function readCurrentAssociation(context, evidence) {
+	const current = context.identityId;
+	const generation = evidence.generation(current);
+	const switches = () => readCompletedLocalIdentitySwitches(context.dbPath);
+	if (generation) return switchedAwayAfter(switches(), current, evidence.generationRetainedAtMs(current)) ? null : generation;
+	let legacy;
+	try {
+		legacy = evidence.legacy(current);
+	} catch (error) {
+		if (legacySuperseded(evidence, switches())) return null;
+		throw error;
+	}
+	if (!legacy) return null;
+	return switchedAwayAfter(switches(), current, evidence.legacyRetainedAtMs(current)) ? null : legacy;
+}
+function ownerUnavailable(view, code) {
+	return {
+		...withoutOwnerCapabilities(view),
+		remote: {
+			kind: "unavailable",
+			code
+		},
+		canLink: false,
+		blockedReason: code === "context_changed" ? "status_unavailable" : "review_required"
+	};
+}
+function withoutOwnerCapabilities(view) {
+	const { managementActions, unlinkTarget, accountOwner, ownerProjection, ...local } = view;
+	return local;
+}
+function ownerProfile(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const source = value;
+	const profile = {};
+	for (const [field, limit] of [
+		["displayName", 256],
+		["email", 320],
+		["pictureUrl", 2048]
+	]) {
+		const text = source[field];
+		if (text === void 0) continue;
+		if (typeof text !== "string" || !text.trim() || text.length > limit || /[\p{Cc}\p{Cf}\p{Cs}]/u.test(text)) return null;
+		if (field === "pictureUrl" && !safeOwnerPicture(text)) return null;
+		profile[field] = text;
+	}
+	return profile;
+}
+function safeOwnerPicture(text) {
+	try {
+		const url = new URL(text);
+		return url.protocol === "https:" && url.hostname === "lh3.googleusercontent.com" && !url.username && !url.password && !url.port;
+	} catch {
+		return false;
+	}
+}
+function associatedOwnerView(view, context, association, remote) {
+	const contextId = createHash("sha256").update(JSON.stringify({
+		version: "account-owner-view-v1",
+		context,
+		association
+	})).digest("hex");
+	const base = {
+		...withoutOwnerCapabilities(view),
+		contextId
+	};
+	if (remote?.kind !== "owner_status" || !remote.status || remote.status.version !== 1 || remote.status.coordinatorId !== association.coordinatorId || remote.status.groupId !== context.groupId || remote.status.deviceId !== context.deviceId || remote.status.fingerprint !== context.fingerprint || remote.status.ownerIdentity !== association.ownerIdentityId || remote.status.state !== "owner_confirmed") return ownerUnavailable(base, "account_owner_association_invalid");
+	const status = remote.status;
+	const profile = status.profileState === "linked" ? ownerProfile(status.profile) : null;
+	if (status.profileState === "linked" && profile === null || status.profileState !== "linked" && (status.profileState !== "account_unlinked" && status.profileState !== "unavailable" || status.profile !== null)) return ownerUnavailable(base, "account_owner_association_invalid");
+	const subject = {
+		version: 1,
+		coordinatorId: status.coordinatorId,
+		groupId: status.groupId,
+		deviceId: status.deviceId,
+		fingerprint: status.fingerprint,
+		state: "owner_confirmed",
+		ownerIdentity: status.ownerIdentity
+	};
+	let confirmed;
+	if (status.profileState === "linked" && profile) confirmed = {
+		...subject,
+		profileState: "linked",
+		profile
+	};
+	else if (status.profileState === "account_unlinked" || status.profileState === "unavailable") confirmed = {
+		...subject,
+		profileState: status.profileState,
+		profile: null
+	};
+	else return ownerUnavailable(base, "account_owner_association_invalid");
+	return {
+		...base,
+		accountOwner: {
+			identityId: association.ownerIdentityId,
+			memoryActorId: context.identityId
+		},
+		remote: { kind: "not_checked" },
+		ownerProjection: {
+			kind: "resolved_account_owner",
+			status: confirmed
+		},
+		canLink: false,
+		blockedReason: profile ? "already_linked" : "status_unavailable"
+	};
+}
+//#endregion
 //#region src/account/status.ts
-function attachOperation(view, registry) {
-	const operation = view.contextId ? registry?.forContext(view.contextId) ?? null : null;
+/**
+* The owner-only state offers sign-in when the owner's Google account is
+* linked and this device's own Identity has none: signing in switches the
+* device to the owner's Identity.
+*/
+function withOwnerSignIn(owner, own, context, remote) {
+	if (owner.ownerProjection?.status.profileState !== "linked" || own.canSignIn !== true || own.remote.kind !== "status" || own.remote.state !== "unlinked") return owner;
+	return {
+		...owner,
+		canSignIn: true,
+		signIn: {
+			contextId: context.contextId,
+			coordinatorId: remote.status.coordinatorId,
+			authority: remote.status.authority
+		}
+	};
+}
+function attachOperation(input, registry, operationContextId = input.contextId) {
+	const { canSignIn, signIn, ...rest } = input;
+	const view = registry?.supportsSignIn?.() ? input : rest;
+	const operation = operationContextId ? registry?.forContext(operationContextId) ?? null : null;
+	const operationContext = operation && operationContextId && operationContextId !== view.contextId ? { operationContextId } : {};
 	if (registry?.hasActive()) return {
 		...view,
+		...operationContext,
 		operation,
 		canLink: false,
+		..."canSignIn" in view ? { canSignIn: false } : {},
 		blockedReason: "operation_active"
 	};
 	return {
 		...view,
+		...operationContext,
 		operation
 	};
 }
@@ -586,6 +843,7 @@ function accountLocalView(result) {
 		} : null,
 		remote: { kind: "not_checked" },
 		canLink: false,
+		canSignIn: false,
 		blockedReason: "setup_incomplete",
 		operation: null,
 		checkedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -619,12 +877,84 @@ function applyRemote(view, remote) {
 			account: identityMatches && status.state === "linked" ? status.account : null
 		},
 		canLink: status.state === "unlinked" && identityMatches,
+		canSignIn: identityMatches && signInState(status),
 		blockedReason
 	};
 }
+/** Sign-in starts unlinked, or linked when this device has no proof of its own (a self-bind). */
+function signInState(status) {
+	return status.state === "unlinked" || status.state === "linked" && !status.account;
+}
 async function readAccountStatus(options, groupId, signal, readOptions = {}) {
 	const initial = options.readContext(groupId);
 	if ("error" in initial) return initial;
+	if (groupId === void 0 && readOptions.expectedContext === void 0 && initial.setup === "group_selection_required" && initial.groups.length > 0) return withPeopleNames(options, await readFirstUsableGroupStatus(options, initial.groups, signal));
+	return withPeopleNames(options, await readStatusFromContext(options, initial, groupId, signal, readOptions));
+}
+/**
+* Names come from the local People list at view time. They stay out of the
+* context, so renaming someone in Sharing cannot abort an account operation.
+*/
+function withPeopleNames(options, result) {
+	if ("error" in result) return result;
+	const name = (identityId) => {
+		try {
+			return options.identityName?.(identityId) || void 0;
+		} catch {
+			return;
+		}
+	};
+	let view = result;
+	const localName = view.local ? name(view.local.identityId) : void 0;
+	if (view.local && localName) view = {
+		...view,
+		local: {
+			...view.local,
+			identityLabel: localName
+		}
+	};
+	const ownerName = view.accountOwner ? name(view.accountOwner.identityId) : void 0;
+	if (view.accountOwner && ownerName) view = {
+		...view,
+		accountOwner: {
+			...view.accountOwner,
+			displayName: ownerName
+		}
+	};
+	return view;
+}
+/** 2: use this group. 1: review, keep looking. 0: this enrollment was refused. -1: stop. */
+function usableStatusRank(result) {
+	if ("error" in result) return -1;
+	if (result.ownerProjection) return 2;
+	if (result.remote.kind === "status") return result.remote.state === "review_required" ? 1 : 2;
+	if (result.remote.kind === "unavailable" && result.remote.code === "coordinator_rejected") return 0;
+	return -1;
+}
+/**
+* Account status is per coordinator, and the group only picks which enrollment
+* signs the request. Try configured groups in order and keep the first one
+* whose enrollment the coordinator accepts, preferring a decided status over
+* review. Each attempt is a full signed read with its own context checks.
+*/
+async function readFirstUsableGroupStatus(options, groups, signal) {
+	let best = null;
+	for (const groupId of groups) {
+		if (signal.aborted) break;
+		const result = await readGroupAccountStatus(options, groupId, signal);
+		const rank = usableStatusRank(result);
+		if (rank === 2) return result;
+		if (rank === -1) return best && usableStatusRank(best) === 1 ? best : result;
+		if (!best || rank > usableStatusRank(best)) best = result;
+	}
+	return best ?? readGroupAccountStatus(options, void 0, signal);
+}
+async function readGroupAccountStatus(options, groupId, signal) {
+	const initial = options.readContext(groupId);
+	if ("error" in initial) return initial;
+	return readStatusFromContext(options, initial, groupId, signal);
+}
+async function readStatusFromContext(options, initial, groupId, signal, readOptions = {}) {
 	const view = accountLocalView(initial);
 	if (initial.setup !== "ready" || !initial.context) return attachOperation(view, options.registry);
 	const snapshot = JSON.stringify(initial);
@@ -668,10 +998,66 @@ async function readAccountStatus(options, groupId, signal, readOptions = {}) {
 		},
 		blockedReason: "status_unavailable"
 	}, options.registry);
+	return finishAccountStatus(options, initial.context, fresh, remote, {
+		signal,
+		ownIdentityOnly: readOptions.ownIdentityOnly === true
+	});
+}
+async function finishAccountStatus(options, context, fresh, remote, read) {
+	const { signal } = read;
 	const currentView = applyRemote(accountLocalView(fresh), remote);
-	await attachManagementActions(options, initial.context, currentView, signal);
+	if (remote.kind === "status") {
+		const associated = await readAssociatedOwner(options, context, currentView, remote, signal);
+		if (associated) {
+			const owner = withOwnerSignIn(associated, currentView, context, remote);
+			if (read.ownIdentityOnly && owner.signIn?.contextId === context.contextId) return attachOperation(currentView, options.registry);
+			return attachOperation(owner, options.registry, context.contextId);
+		}
+	}
+	await attachManagementActions(options, context, currentView, signal);
+	if (remote.kind === "status") try {
+		if (readOwnerAssociation(context, remote.status.coordinatorId)) return attachOperation(ownerUnavailable(accountLocalView(fresh), "context_changed"), options.registry);
+	} catch {
+		return attachOperation(ownerUnavailable(accountLocalView(fresh), "account_owner_association_invalid"), options.registry);
+	}
 	return attachOperation(currentView, options.registry);
 }
+async function readAssociatedOwner(options, context, view, actorRemote, signal) {
+	const local = {
+		...view,
+		remote: { kind: "not_checked" },
+		canLink: false,
+		canSignIn: false
+	};
+	try {
+		const association = readOwnerAssociation(context, actorRemote.status.coordinatorId);
+		if (!association) return null;
+		const before = options.readContext(context.groupId);
+		if ("error" in before || !before.context || !sameAuthority(context, before.context)) return ownerUnavailable(local, "context_changed");
+		const { dbPath, keysDir, groupId, coordinatorUrl } = context;
+		let remote;
+		try {
+			remote = await (options.readRemoteOwnerStatus ?? readCoordinatorResolvedAccountOwnerStatus)({
+				dbPath,
+				keysDir,
+				groupId,
+				coordinatorUrl,
+				ownerIdentityId: association.ownerIdentityId,
+				signal
+			});
+		} catch {
+			remote = {
+				kind: "unavailable",
+				code: "coordinator_unreachable"
+			};
+		}
+		const after = options.readContext(context.groupId);
+		if (signal.aborted || JSON.stringify(before) !== JSON.stringify(after) || JSON.stringify(association) !== JSON.stringify(readOwnerAssociation(context, association.coordinatorId))) return ownerUnavailable(local, "context_changed");
+		return associatedOwnerView(local, context, association, remote);
+	} catch {
+		return ownerUnavailable(local, "account_owner_association_invalid");
+	}
+}
 async function attachManagementActions(options, context, view, signal) {
 	if (view.remote.kind !== "status" || view.remote.state !== "linked" || !view.remote.identityMatches) return;
 	const read = options.readRemoteCapabilities ?? (options.readRemoteStatus ? null : readCoordinatorAccountChangeCapabilities);
@@ -711,7 +1097,7 @@ async function attachManagementActions(options, context, view, signal) {
 }
 //#endregion
 //#region src/routes/account-operations.ts
-var ROOT = "/api/account/link-operations";
+var ROOT$1 = "/api/account/link-operations";
 function validString(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
 }
@@ -720,7 +1106,7 @@ function noBody(request) {
 	return request.body === null && (length === null || length === "0") && !request.headers.has("Transfer-Encoding");
 }
 /** Cap both bytes and elapsed time; cancellation must not wait on an uncooperative stream. */
-async function readBody(request, keys, optional = []) {
+async function readBody$1(request, keys, optional = []) {
 	if (!/^application\/json(?:\s*;\s*charset\s*=\s*(?:utf-8|"utf-8"))?\s*$/i.test(request.headers.get("Content-Type") ?? "")) return null;
 	const reader = request.body?.getReader();
 	if (!reader) return null;
@@ -761,13 +1147,13 @@ function isCurrent(options, operation) {
 	return !("error" in fresh) && fresh.setup === "ready" && fresh.context?.groupId === operation.groupId && fresh.context.contextId === operation.contextId;
 }
 function validStartBody(body) {
-	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect") && (body.authority === "controller_attestation" || body.authority === "device_claim");
+	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect" || body.intent === "sign_in") && (body.authority === "controller_attestation" || body.authority === "device_claim");
 }
 function unlinkTargetChanged(body, view) {
 	return body.intent === "disconnect" && body.expectedLinkId !== view.unlinkTarget;
 }
 async function startOperation(c, options) {
-	const body = await readBody(c.req.raw, [
+	const body = await readBody$1(c.req.raw, [
 		"groupId",
 		"contextId",
 		"authority",
@@ -779,7 +1165,10 @@ async function startOperation(c, options) {
 	if ("error" in initial || initial.setup !== "ready" || !initial.context || initial.context?.contextId !== body.contextId) return c.json({ error: "account_context_changed" }, 409);
 	const checkedContext = structuredClone(initial.context);
 	const expectedLifecycleToken = options.registry.lifecycleToken();
-	const view = await readAccountStatus(options, body.groupId, c.req.raw.signal, { expectedContext: checkedContext });
+	const view = await readAccountStatus(options, body.groupId, c.req.raw.signal, {
+		expectedContext: checkedContext,
+		ownIdentityOnly: body.intent === "sign_in"
+	});
 	if ("error" in view || view.setup !== "ready" || view.contextId !== body.contextId || view.remote.kind === "unavailable" && view.remote.code === "context_changed") return c.json({ error: "account_context_changed" }, 409);
 	if (view.operation && view.operation.finishedAt === null) return c.json({
 		error: "account_link_in_progress",
@@ -799,6 +1188,7 @@ async function startOperation(c, options) {
 }
 function actionAllowed(view, intent = "connect") {
 	if (intent === "connect") return view.canLink;
+	if (intent === "sign_in") return view.canSignIn === true;
 	if (intent === "refresh" || intent === "disconnect") return view.managementActions?.[intent] === true;
 	return false;
 }
@@ -823,7 +1213,7 @@ function beginCurrentOperation(c, options, body, view, expectedCoordinatorId, ch
 }
 async function performOperation(c, options) {
 	const { id, action } = c.req.param();
-	if (!validString(id) || action !== "browser-url" && action !== "cancel" || !await readBody(c.req.raw, [])) return c.json({ error: "account_invalid_request" }, 400);
+	if (!validString(id) || action !== "browser-url" && action !== "cancel" || !await readBody$1(c.req.raw, [])) return c.json({ error: "account_invalid_request" }, 400);
 	const operation = options.registry.get(id);
 	if (!operation) return c.json({ error: "account_operation_not_found" }, 404);
 	if (action === "cancel") {
@@ -849,10 +1239,10 @@ function accountOperationRoutes(options) {
 		if ([...new URL(c.req.url).searchParams].length) return c.json({ error: "account_invalid_request" }, 400);
 		await next();
 	};
-	app.use(ROOT, rejectQuery);
-	app.use(`${ROOT}/*`, rejectQuery);
-	app.post(ROOT, (c) => startOperation(c, options));
-	app.get(`${ROOT}/:id`, (c) => {
+	app.use(ROOT$1, rejectQuery);
+	app.use(`${ROOT$1}/*`, rejectQuery);
+	app.post(ROOT$1, (c) => startOperation(c, options));
+	app.get(`${ROOT$1}/:id`, (c) => {
 		if (!noBody(c.req.raw) || !validString(c.req.param("id"))) return c.json({ error: "account_invalid_request" }, 400);
 		const operation = options.registry.get(c.req.param("id"));
 		if (!operation) return c.json({ error: "account_operation_not_found" }, 404);
@@ -862,7 +1252,338 @@ function accountOperationRoutes(options) {
 			current: isCurrent(options, operation)
 		});
 	});
-	app.post(`${ROOT}/:id/:action`, (c) => performOperation(c, options));
+	app.post(`${ROOT$1}/:id/:action`, (c) => performOperation(c, options));
+	return app;
+}
+//#endregion
+//#region src/account/owner-recovery-evidence.ts
+var RECOVERY_SCOPE = "historical_included_owner_labels_only";
+var RECOVERY_REASON = /^[a-z][a-z0-9_]{0,119}(?:: [\x20-\x7e]{1,240})?$/;
+var AccountOwnerRecoveryError = class extends Error {
+	code;
+	constructor(code = "invalid") {
+		super("account_owner_recovery_invalid");
+		this.code = code;
+	}
+};
+function requireRecovery(condition, code = "invalid") {
+	if (!condition) throw new AccountOwnerRecoveryError(code);
+}
+function recoveryId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+function recoveryHash(value) {
+	return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function recoveryRecord(value) {
+	requireRecovery(value && typeof value === "object" && !Array.isArray(value));
+	return value;
+}
+function exactRecoveryFields(row, fields) {
+	requireRecovery(Object.keys(row).length === fields.length && fields.every((key) => Object.hasOwn(row, key)));
+}
+function timestamp(value) {
+	return typeof value === "string" && Number.isFinite(Date.parse(value));
+}
+function readWeakLabel(value) {
+	const row = recoveryRecord(value);
+	exactRecoveryFields(row, [
+		"label",
+		"kind",
+		"group_id",
+		"device_id",
+		"evidence_ref",
+		"effect"
+	]);
+	requireRecovery(recoveryId(row.label) && recoveryId(row.group_id) && recoveryId(row.device_id) && recoveryId(row.evidence_ref));
+	requireRecovery(row.kind === "legacy_included_owner_label" || row.kind === "consumed_project_actor_label");
+	requireRecovery(row.effect === "account_owner_display_only");
+	return {
+		label: row.label,
+		kind: row.kind,
+		group_id: row.group_id,
+		device_id: row.device_id,
+		evidence_ref: row.evidence_ref,
+		effect: row.effect
+	};
+}
+function historyRows$1(value, selection, labels) {
+	const row = recoveryRecord(value);
+	requireRecovery(recoveryId(row.group_id) && recoveryId(row.candidate_ref) && timestamp(row.created_at));
+	const manifest = normalizeCoordinatorLegacyTeamCompletionManifest(row.manifest);
+	requireRecovery(manifest.coordinator_id === selection.profile.coordinatorId && manifest.candidate_ref === row.candidate_ref && manifest.version === row.manifest_version && manifest.completed_at === row.completed_at && legacyTeamCandidateId(manifest.coordinator_id, row.group_id) === manifest.candidate_ref && canonicalCoordinatorLegacyTeamCompletionManifestJson(manifest) === row.manifest_json);
+	const groupId = row.group_id;
+	return manifest.device_decisions.map((decision) => {
+		let relation = "other";
+		if (decision.device_id === selection.profile.deviceId) relation = "exact_subject";
+		else if (labels.some((label) => label.kind === "legacy_included_owner_label" && label.group_id === groupId && label.device_id === decision.device_id && label.label === decision.identity_id && label.evidence_ref === manifest.source_digest)) relation = "alias";
+		return {
+			id: `${manifest.candidate_ref}:${decision.device_id}`,
+			groupId,
+			deviceId: decision.device_id,
+			fingerprint: decision.key_fingerprint,
+			identityId: decision.identity_id ?? "",
+			assignment: decision.decision,
+			relation,
+			reason: legacyDecisionCountsAsOwner(decision) ? "Recorded in Team history." : "Guessed by another device in Team history."
+		};
+	});
+}
+function receiptPart(value, idField) {
+	const row = recoveryRecord(value);
+	exactRecoveryFields(row, [
+		"disposition",
+		idField,
+		"evidence_digest",
+		"created_at"
+	]);
+	const id = row[idField];
+	requireRecovery(recoveryId(id) && recoveryHash(row.evidence_digest) && timestamp(row.created_at) && (row.disposition === "created" || row.disposition === "reused"));
+	return {
+		id,
+		digest: row.evidence_digest
+	};
+}
+function reviewReceipt(row) {
+	requireRecovery(recoveryId(row.attestation_id));
+	const source = receiptPart(row.recovery_receipt, "review_receipt_id");
+	const resolution = receiptPart(row.owner_resolution, "resolution_id");
+	return {
+		attestationId: row.attestation_id,
+		reviewReceiptId: source.id,
+		reviewEvidenceDigest: source.digest,
+		resolutionId: resolution.id,
+		resolutionEvidenceDigest: resolution.digest
+	};
+}
+function validateRecoveryReview(value, selection, groupId) {
+	const row = recoveryRecord(value);
+	const profile = selection.profile;
+	requireRecovery(row.purpose === "existing_account_owner" && row.resolution_scope === "historical_included_owner_labels_only" && row.coordinator_id === profile.coordinatorId && row.group_id === groupId && row.device_id === profile.deviceId && row.fingerprint === profile.fingerprint && row.identity_id === selection.existingOwnerId);
+	requireRecovery(Array.isArray(row.legacy_history) && row.legacy_history.length <= 500 && Array.isArray(row.reviewed_weak_labels) && row.reviewed_weak_labels.length <= 256 && Array.isArray(row.reasons) && row.reasons.every((reason) => typeof reason === "string"));
+	const labels = row.reviewed_weak_labels.map(readWeakLabel);
+	requireRecovery(new Set(labels.map((label) => JSON.stringify(label))).size === labels.length);
+	const rows = row.legacy_history.flatMap((history) => historyRows$1(history, selection, labels));
+	requireRecovery(row.reasons.length <= 8 && row.reasons.every((reason) => typeof reason === "string" && RECOVERY_REASON.test(reason)));
+	const reasons = row.reasons;
+	if (row.state === "needs_review") {
+		requireRecovery(row.reasons.length > 0 && !Object.hasOwn(row, "owner_resolution_digest"));
+		return {
+			state: row.state,
+			rows,
+			labels,
+			reasons
+		};
+	}
+	requireRecovery((row.state === "ready" || row.state === "restored") && recoveryHash(row.owner_resolution_digest) && row.reasons.length === 0);
+	const target = recoveryRecord(row.account_owner_target);
+	requireRecovery(target.identity_id === selection.existingOwnerId && recoveryId(target.link_id) && recoveryId(target.auth_config_revision) && typeof target.created_at_ms === "number" && Number.isSafeInteger(target.created_at_ms));
+	let receipt;
+	if (row.state === "restored" || Object.hasOwn(row, "owner_resolution")) receipt = reviewReceipt(row);
+	return {
+		state: row.state,
+		digest: row.owner_resolution_digest,
+		receipt,
+		rows,
+		labels,
+		reasons
+	};
+}
+function replyGroups(row, selection) {
+	exactRecoveryFields(row, [
+		"version",
+		"purpose",
+		"scope",
+		"coordinatorOrigin",
+		"coordinatorId",
+		"deviceId",
+		"fingerprint",
+		"ownerIdentityId",
+		"groups"
+	]);
+	const p = selection.profile;
+	requireRecovery(row.version === 1 && row.purpose === "existing_account_owner" && row.scope === "historical_included_owner_labels_only" && row.coordinatorOrigin === p.coordinatorOrigin && row.coordinatorId === p.coordinatorId && row.deviceId === p.deviceId && row.fingerprint === p.fingerprint && row.ownerIdentityId === selection.existingOwnerId && Array.isArray(row.groups) && row.groups.length === selection.groups.length);
+	return row.groups;
+}
+function parseRecoveryReply(text, selection) {
+	requireRecovery(typeof text === "string" && Buffer.byteLength(text) <= 32768);
+	const groups = replyGroups(recoveryRecord(JSON.parse(text)), selection);
+	const receipts = /* @__PURE__ */ new Map();
+	for (const input of groups) {
+		const group = recoveryRecord(input);
+		exactRecoveryFields(group, [
+			"groupId",
+			"attestationId",
+			"reviewReceiptId",
+			"reviewEvidenceDigest",
+			"resolutionId",
+			"resolutionEvidenceDigest"
+		]);
+		requireRecovery(typeof group.groupId === "string" && selection.groups.includes(group.groupId) && !receipts.has(group.groupId));
+		requireRecovery(recoveryId(group.attestationId) && recoveryId(group.reviewReceiptId) && recoveryId(group.resolutionId) && recoveryHash(group.reviewEvidenceDigest) && recoveryHash(group.resolutionEvidenceDigest));
+		receipts.set(group.groupId, {
+			attestationId: group.attestationId,
+			reviewReceiptId: group.reviewReceiptId,
+			reviewEvidenceDigest: group.reviewEvidenceDigest,
+			resolutionId: group.resolutionId,
+			resolutionEvidenceDigest: group.resolutionEvidenceDigest
+		});
+	}
+	return receipts;
+}
+//#endregion
+//#region src/routes/account-owner-recovery.ts
+var ROOT = "/api/account/owner-recovery";
+var LIMITS = {
+	preview: 65536,
+	confirm: 1048576,
+	import: 65536
+};
+function bodyLength(request) {
+	requireRecovery(!request.headers.has("Transfer-Encoding"));
+	const length = request.headers.get("Content-Length");
+	if (length === null) return null;
+	requireRecovery(/^(0|[1-9][0-9]*)$/.test(length));
+	const parsed = Number(length);
+	requireRecovery(Number.isSafeInteger(parsed));
+	return parsed;
+}
+/** Limit actual UTF-8 bytes and elapsed time, regardless of transport metadata. */
+async function readBody(request, cap) {
+	const declared = bodyLength(request);
+	requireRecovery(declared === null || declared <= cap);
+	requireRecovery(/^application\/json(?:\s*;\s*charset\s*=\s*(?:utf-8|"utf-8"))?\s*$/i.test(request.headers.get("Content-Type") ?? ""));
+	const reader = request.body?.getReader();
+	requireRecovery(reader);
+	let timer;
+	let stop = () => {};
+	try {
+		const expired = new Promise((_, reject) => {
+			stop = () => reject(new AccountOwnerRecoveryError());
+			timer = setTimeout(stop, 1e4);
+			request.signal.addEventListener("abort", stop, { once: true });
+			if (request.signal.aborted) stop();
+		});
+		const bytes = new Uint8Array(cap);
+		let length = 0;
+		while (true) {
+			const chunk = await Promise.race([reader.read(), expired]);
+			if (chunk.done) break;
+			requireRecovery(length + chunk.value.byteLength <= cap);
+			bytes.set(chunk.value, length);
+			length += chunk.value.byteLength;
+		}
+		requireRecovery(!request.signal.aborted && (declared === null || declared === length));
+		return recoveryRecord(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length))));
+	} catch {
+		throw new AccountOwnerRecoveryError();
+	} finally {
+		clearTimeout(timer);
+		request.signal.removeEventListener("abort", stop);
+		reader.cancel().catch(() => {});
+		reader.releaseLock();
+	}
+}
+function stringList(value) {
+	requireRecovery(Array.isArray(value) && value.every(recoveryId));
+	return value;
+}
+function profile(value) {
+	const row = recoveryRecord(value);
+	exactRecoveryFields(row, [
+		"contextId",
+		"memoryActorId",
+		"deviceId",
+		"fingerprint",
+		"coordinatorOrigin",
+		"coordinatorId",
+		"configuredGroups"
+	]);
+	const { contextId, memoryActorId, deviceId, fingerprint, coordinatorOrigin, coordinatorId } = row;
+	requireRecovery(recoveryId(contextId) && recoveryId(memoryActorId) && recoveryId(deviceId) && recoveryId(fingerprint) && recoveryId(coordinatorOrigin) && recoveryId(coordinatorId));
+	return {
+		contextId,
+		memoryActorId,
+		deviceId,
+		fingerprint,
+		coordinatorOrigin,
+		coordinatorId,
+		configuredGroups: stringList(row.configuredGroups)
+	};
+}
+function selection(row) {
+	requireRecovery(recoveryId(row.existingOwnerId));
+	return {
+		profile: profile(row.profile),
+		existingOwnerId: row.existingOwnerId,
+		groups: stringList(row.groups)
+	};
+}
+async function dispatch(c, service) {
+	const request = c.req.raw;
+	requireRecovery(!new URL(request.url).search && !request.signal.aborted);
+	if (c.req.path === ROOT && request.method === "GET") {
+		const length = bodyLength(request);
+		requireRecovery(request.body === null && (length === null || length === 0));
+		return c.json(await service.getProfile());
+	}
+	if (request.method !== "POST") return c.json({ error: "account_owner_recovery_invalid" }, 405);
+	if (c.req.path === `${ROOT}/preview`) {
+		const body = await readBody(request, LIMITS.preview);
+		exactRecoveryFields(body, [
+			"profile",
+			"existingOwnerId",
+			"groups",
+			"requestId",
+			"purpose"
+		]);
+		requireRecovery(recoveryId(body.requestId) && (body.purpose === "review" || body.purpose === "check_status"));
+		return c.json(await service.preview({
+			...selection(body),
+			requestId: body.requestId,
+			purpose: body.purpose
+		}));
+	}
+	if (c.req.path === `${ROOT}/confirm`) {
+		const body = await readBody(request, LIMITS.confirm);
+		exactRecoveryFields(body, ["preview", "approvalDigest"]);
+		requireRecovery(recoveryId(body.approvalDigest));
+		return c.json(await service.confirm({
+			preview: body.preview,
+			approvalDigest: body.approvalDigest
+		}));
+	}
+	if (c.req.path === `${ROOT}/import`) {
+		const body = await readBody(request, LIMITS.import);
+		exactRecoveryFields(body, ["selection", "replyText"]);
+		const selected = recoveryRecord(body.selection);
+		exactRecoveryFields(selected, [
+			"profile",
+			"existingOwnerId",
+			"groups"
+		]);
+		requireRecovery(typeof body.replyText === "string");
+		return c.json(await service.importReply({
+			selection: selection(selected),
+			replyText: body.replyText
+		}));
+	}
+	return c.json({ error: "account_owner_recovery_invalid" }, 404);
+}
+/** Mount only after createAccountGuard: this router grants no independent authority. */
+function accountOwnerRecoveryRoutes(service) {
+	const app = new Hono();
+	app.onError((error, c) => {
+		if (!(error instanceof AccountOwnerRecoveryError)) return c.json({ error: "account_owner_recovery_unavailable" }, 503);
+		return c.json({ error: `account_owner_recovery_${error.code}` }, {
+			invalid: 400,
+			busy: 409,
+			context_changed: 409,
+			unavailable: 503
+		}[error.code]);
+	});
+	app.all(ROOT, (c) => dispatch(c, service));
+	app.all(`${ROOT}/*`, (c) => dispatch(c, service));
 	return app;
 }
 //#endregion
@@ -2306,6 +3027,23 @@ function queryMemoryPage(store, options) {
 	const ownedBySelf = store.buildOwnershipPredicate();
 	return rows.map((row) => serializeMemoryRow(ownedBySelf, row));
 }
+async function handleLegacyPackRequest(c, getStore) {
+	const store = getStore();
+	const context = c.req.query("context") || "";
+	if (!context) return c.json({ error: "context required" }, 400);
+	const limit = queryInt(c.req.query("limit"), 10);
+	const tokenBudgetStr = c.req.query("token_budget");
+	let tokenBudget;
+	if (tokenBudgetStr) {
+		tokenBudget = parseStrictInteger(tokenBudgetStr) ?? void 0;
+		if (tokenBudget === void 0) return c.json({ error: "token_budget must be int" }, 400);
+	}
+	const project = c.req.query("project") || void 0;
+	const filters = {};
+	if (project) filters.project = project;
+	const pack = await store.buildMemoryPackAsync(context, limit, tokenBudget ?? null, filters, void 0, void 0, { signal: c.req.raw.signal });
+	return c.json(pack);
+}
 function memoryRoutes(getStore) {
 	const app = new Hono();
 	app.get("/api/sessions", (c) => {
@@ -2431,25 +3169,7 @@ function memoryRoutes(getStore) {
 			});
 		}
 	});
-	app.get("/api/pack", async (c) => {
-		const store = getStore();
-		{
-			const context = c.req.query("context") || "";
-			if (!context) return c.json({ error: "context required" }, 400);
-			const limit = queryInt(c.req.query("limit"), 10);
-			const tokenBudgetStr = c.req.query("token_budget");
-			let tokenBudget;
-			if (tokenBudgetStr) {
-				tokenBudget = parseStrictInteger(tokenBudgetStr) ?? void 0;
-				if (tokenBudget === void 0) return c.json({ error: "token_budget must be int" }, 400);
-			}
-			const project = c.req.query("project") || void 0;
-			const filters = {};
-			if (project) filters.project = project;
-			const pack = await store.buildMemoryPackAsync(context, limit, tokenBudget ?? null, filters);
-			return c.json(pack);
-		}
-	});
+	app.get("/api/pack", (c) => handleLegacyPackRequest(c, getStore));
 	app.post("/api/pack/trace", async (c) => {
 		const store = getStore();
 		const parsed = await c.req.json().catch(() => Symbol.for("invalid-json"));
@@ -2471,7 +3191,11 @@ function memoryRoutes(getStore) {
 		const filters = {};
 		if (project) filters.project = project;
 		if (workingSetFiles.length > 0) filters.working_set_paths = workingSetFiles;
-		const trace = await store.buildMemoryPackTraceAsync(context, limit, tokenBudget, filters);
+		const trace = await store.buildMemoryPackTraceAsync(context, limit, tokenBudget, filters, ...[
+			void 0,
+			void 0,
+			{ signal: c.req.raw.signal }
+		]);
 		return c.json(trace);
 	});
 	app.get("/api/memory", (c) => {
@@ -2893,6 +3617,22 @@ function expandMemories(store, args) {
 		}
 	};
 }
+function piSessionSearchRoutes(getStore) {
+	const searchApp = new Hono();
+	searchApp.get("/api/pi/sessions/search", (c) => {
+		const store = getStore();
+		const query = c.req.query("query") ?? "";
+		if (!query.trim()) return c.json({ error: "query required" }, 400);
+		const result = searchPiSessions(store.db, query, {
+			project: c.req.query("project"),
+			session_id: c.req.query("session_id"),
+			limit: queryInt(c.req.query("limit"), 10),
+			snippet_chars: queryInt(c.req.query("snippet_chars"), 1200)
+		});
+		return c.json(result);
+	});
+	return searchApp;
+}
 function memoryToolRoutes(getStore) {
 	const app = new Hono();
 	app.post("/api/memories/remember", async (c) => {
@@ -3091,7 +3831,7 @@ function memoryToolRoutes(getStore) {
 			return c.json({ error: msg }, 400);
 		}
 	});
-	return app;
+	return app.route("/", piSessionSearchRoutes(getStore));
 }
 //#endregion
 //#region src/routes/observer-status.ts
@@ -3333,14 +4073,15 @@ function packRenderOptions(value) {
 		...value.compact_detail_count != null ? { compactDetailCount: value.compact_detail_count } : {}
 	};
 }
-function packRequestArgs(request) {
+function packRequestArgs(request, signal) {
 	return [
 		request.context,
 		request.limit,
 		request.tokenBudget,
 		request.filters,
 		request.renderOptions,
-		request.automaticContext
+		request.automaticContext,
+		{ signal }
 	];
 }
 function packSchemaError(error) {
@@ -3528,11 +4269,9 @@ function packTransportRoutes(getStore) {
 			const store = getStore();
 			const target = validateViewerTarget(store, parsed, { requireCurrentIdentity: true });
 			if (!target.ok) return c.json(target.body, target.status);
-			if (!request.attempt) {
-				const pack = await store.buildMemoryPackAsync(...packRequestArgs(request));
-				return c.json(pack);
-			}
-			const artifacts = await store.buildMemoryPackWithTraceAsync(...packRequestArgs(request));
+			if (!request.attempt) return await handleUntracedPackRequest(c, store, request);
+			const artifacts = await store.buildMemoryPackWithTraceAsync(...packRequestArgs(request, c.req.raw.signal));
+			c.req.raw.signal.throwIfAborted();
 			let ledgerArtifactFingerprint;
 			try {
 				ledgerArtifactFingerprint = promptPackArtifactFingerprint(store.db, request.context, request.filters, artifacts);
@@ -3556,6 +4295,11 @@ function packTransportRoutes(getStore) {
 	app.post("/api/prompt-pack-ledger", (c) => handleLedgerRequest(c, getStore));
 	return app;
 }
+async function handleUntracedPackRequest(c, store, request) {
+	const pack = await store.buildMemoryPackAsync(...packRequestArgs(request, c.req.raw.signal));
+	c.req.raw.signal.throwIfAborted();
+	return c.json(pack);
+}
 //#endregion
 //#region src/raw-event-processing.ts
 function nudgeRawEventSessions(sweeper, sessions) {
@@ -3643,7 +4387,7 @@ async function writeDurableFile(path, contents) {
 		await handle.close();
 	}
 }
-async function syncDirectory(path) {
+async function syncDirectory$1(path) {
 	let handle;
 	try {
 		handle = await open(path, "r");
@@ -3671,7 +4415,7 @@ async function ensurePrivateDirectory(path) {
 	const boundary = dirname(firstCreated);
 	let current = path;
 	while (true) {
-		await syncDirectory(current);
+		await syncDirectory$1(current);
 		if (current === boundary) return;
 		current = dirname(current);
 	}
@@ -3751,7 +4495,7 @@ var FileRawEventInbox = class {
 			const existingName = parseInboxFileName(existingEntry.name);
 			if (entryContentId(parsedExisting.entry) !== id || existingName?.enqueueOrder !== parsedExisting.enqueueOrder) throw new Error("raw-event inbox entry conflict");
 			await chmod(join(this.directory, existingEntry.name), 384);
-			await syncDirectory(this.directory);
+			await syncDirectory$1(this.directory);
 			this.scheduleDrain();
 			return;
 		}
@@ -3777,7 +4521,7 @@ var FileRawEventInbox = class {
 		} finally {
 			await rm(temporary, { force: true }).catch(() => {});
 		}
-		await syncDirectory(this.directory);
+		await syncDirectory$1(this.directory);
 		this.scheduleDrain();
 	}
 	async allocateEnqueueOrder(entries) {
@@ -6267,6 +7011,24 @@ function projectMappingChoices(store) {
 		sourceDisplayName: candidate.display_project
 	}));
 }
+function viewerSafeDevice(candidateRef, device) {
+	return {
+		deviceRef: device.deviceRef,
+		displayName: device.displayName,
+		enabled: device.enabled,
+		existingIdentityRef: identityRef(candidateRef, device.existingIdentityId),
+		suggestedIdentityRef: identityRef(candidateRef, device.suggestedIdentityId),
+		verifiedEvidenceKind: device.verifiedEvidenceKind,
+		identityEvidence: device.identityEvidence,
+		decision: device.decision,
+		targetIdentityRef: identityRef(candidateRef, device.targetIdentityId),
+		expectation: device.expectation.kind === "existing" ? {
+			kind: "existing",
+			assignmentVersion: device.expectation.assignmentVersion,
+			identityRef: requiredIdentityRef(candidateRef, device.expectation.identityId)
+		} : { kind: "absent" }
+	};
+}
 function viewerSafeDraft(store, draft) {
 	if (draft.devices.length > MAX_DEVICES || draft.projects.length > MAX_PROJECTS) throw new Error("legacy_team_setup_roster_too_large");
 	const completed = draft.state === "completed";
@@ -6276,21 +7038,7 @@ function viewerSafeDraft(store, draft) {
 	requireCompleteMappingChoices(mappableProjectCount, mappingChoices.length);
 	const mappingChoiceIdentities = mappingChoices.map((choice) => choice.projectIdentity);
 	return {
-		devices: draft.devices.map((device) => ({
-			deviceRef: device.deviceRef,
-			displayName: device.displayName,
-			enabled: device.enabled,
-			existingIdentityRef: identityRef(draft.candidateRef, device.existingIdentityId),
-			suggestedIdentityRef: identityRef(draft.candidateRef, device.suggestedIdentityId),
-			verifiedEvidenceKind: device.verifiedEvidenceKind,
-			decision: device.decision,
-			targetIdentityRef: identityRef(draft.candidateRef, device.targetIdentityId),
-			expectation: device.expectation.kind === "existing" ? {
-				kind: "existing",
-				assignmentVersion: device.expectation.assignmentVersion,
-				identityRef: requiredIdentityRef(draft.candidateRef, device.expectation.identityId)
-			} : { kind: "absent" }
-		})),
+		devices: draft.devices.map((device) => viewerSafeDevice(draft.candidateRef, device)),
 		projects: draft.projects.map((project) => ({
 			projectRef: project.projectRef,
 			displayName: project.displayName,
@@ -9262,6 +10010,7 @@ function isPendingCaptureActorConflict(error) {
 /** False leaves the conflict untouched; callers must check before claiming or merging identity. */
 function ensureLocalActorRecord(store) {
 	return store.db.transaction(() => {
+		store.assertLocalIdentityCurrent();
 		try {
 			store.assertPendingLocalCaptureAdoptionActors();
 		} catch (error) {
@@ -13628,6 +14377,7 @@ function readyContext(options, groupId, coordinatorUrl, raw, groups) {
 		groupId,
 		deviceId: device.deviceId,
 		fingerprint: device.fingerprint,
+		publicKeyHash: createHash("sha256").update(device.publicKey).digest("hex"),
 		identityId: actor,
 		identityLabel: label(profile.identityLabel),
 		deviceLabel: label(profile.deviceLabel),
@@ -13707,28 +14457,2340 @@ function createAccountContextReader(options) {
 	};
 }
 //#endregion
-//#region src/index.ts
+//#region ../core/src/coordinator-ed25519-key-id.ts
+function decodeWire(encoded) {
+	try {
+		const binary = atob(encoded);
+		return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+	} catch {
+		return null;
+	}
+}
+function readRawKey(wire) {
+	if (wire.length < 4) return null;
+	const view = new DataView(wire.buffer, wire.byteOffset, wire.byteLength);
+	const typeEnd = 4 + view.getUint32(0);
+	if (wire.length < typeEnd + 4) return null;
+	const keyLength = view.getUint32(typeEnd);
+	const keyStart = typeEnd + 4;
+	if (keyLength !== 32 || wire.length < keyStart + keyLength) return null;
+	return wire.subarray(keyStart, keyStart + keyLength);
+}
+function canonicalBlob(rawKey) {
+	const blob = /* @__PURE__ */ new Uint8Array(51);
+	const view = new DataView(blob.buffer);
+	view.setUint32(0, 11);
+	blob.set(new TextEncoder().encode("ssh-ed25519"), 4);
+	view.setUint32(15, 32);
+	blob.set(rawKey, 19);
+	return blob;
+}
 /**
-* @codemem/server — HTTP server (viewer, sync, API).
-*
-* Single HTTP server handling viewer routes and sync daemon.
-* Shares one better-sqlite3 connection between viewer and sync.
-* Embedding inference runs in a worker_thread (lazy-started).
+* Internal string contract, not an authentication acceptance check. Like the
+* Worker verifier, skip the inner type bytes and ignore trailing wire bytes.
+* atob rejects some encodings accepted by Node's Buffer base64 decoder.
+*/
+function parseSshEd25519PublicKey(publicKey) {
+	return parseSshEd25519PublicKeyWithDecoder(publicKey, decodeWire);
+}
+/** Internal trusted decoder seam; callers must not use it to decide authentication acceptance. */
+function parseSshEd25519PublicKeyWithDecoder(publicKey, decode) {
+	if (typeof publicKey !== "string") return { kind: "other" };
+	const [keyType, keyData] = publicKey.trim().split(/\s+/);
+	if (keyType !== "ssh-ed25519") return { kind: "other" };
+	if (!keyData) return { kind: "malformed_ed25519" };
+	let wire;
+	try {
+		wire = decode(keyData);
+	} catch {
+		return { kind: "malformed_ed25519" };
+	}
+	if (!wire) return { kind: "malformed_ed25519" };
+	const rawKey = readRawKey(wire);
+	if (!rawKey) return { kind: "malformed_ed25519" };
+	return {
+		kind: "ed25519",
+		blob: canonicalBlob(rawKey)
+	};
+}
+//#endregion
+//#region ../core/src/coordinator-auth-controller-history.ts
+var MAX_BYTES = 75e4;
+var CONTROLLER_HISTORY_CTE = `history_input AS MATERIALIZED (
+ SELECT json_extract(value, '$.legacyHistory') AS value FROM snapshot
+), history_key_sources AS NOT MATERIALIZED (
+ SELECT public_key, fingerprint FROM enrolled_devices
+ UNION
+ SELECT a.public_key, a.fingerprint FROM coordinator_auth_controller_attestations a
+ CROSS JOIN history_input h
+ WHERE a.coordinator_id = json_extract(h.value, '$.coordinatorId')
+), history_rows AS NOT MATERIALIZED (
+ SELECT c.*, CASE WHEN json_valid(c.manifest_json) THEN c.manifest_json ELSE '{}' END AS parsed
+ FROM coordinator_legacy_team_completions c
+), live_history AS MATERIALIZED (
+ SELECT c.group_id, c.candidate_ref, c.manifest_version, c.completed_at, c.created_at,
+ CASE WHEN length(CAST(c.manifest_json AS BLOB)) <= ${MAX_BYTES} THEN c.manifest_json ELSE NULL END AS manifest_json
+ FROM history_rows c CROSS JOIN history_input h
+ WHERE h.value IS NOT NULL
+ AND (json_extract(c.parsed, '$.coordinator_id') = json_extract(h.value, '$.coordinatorId')
+      OR json_extract(c.parsed, '$.coordinator_id') IS NULL)
+ AND (EXISTS (
+  SELECT 1 FROM json_each(c.parsed, '$.device_decisions') d
+  WHERE json_extract(CASE WHEN d.type = 'object' THEN d.value ELSE '{}' END, '$.device_id') = json_extract(h.value, '$.deviceId')
+    OR json_extract(CASE WHEN d.type = 'object' THEN d.value ELSE '{}' END, '$.key_fingerprint')
+       IN (SELECT value FROM json_each(h.value, '$.fingerprints'))
+    OR ((d.type <> 'object'
+      OR json_type(CASE WHEN d.type = 'object' THEN d.value ELSE '{}' END, '$.device_id') IS NOT 'text'
+      OR json_type(CASE WHEN d.type = 'object' THEN d.value ELSE '{}' END, '$.key_fingerprint') IS NOT 'text')
+     AND (instr(CASE WHEN d.type = 'text' THEN json_quote(d.value) ELSE d.value END,
+      json_quote(json_extract(h.value, '$.deviceId'))) > 0
+      OR EXISTS (SELECT 1 FROM json_each(h.value, '$.fingerprints') f
+       WHERE instr(d.value, f.value) > 0)))
+ ) OR ((json_valid(c.manifest_json) = 0 OR json_type(c.parsed, '$.device_decisions') IS NOT 'array') AND (
+  instr(c.manifest_json, json_quote(json_extract(h.value, '$.deviceId'))) > 0
+  OR EXISTS (SELECT 1 FROM json_each(h.value, '$.fingerprints') f
+   WHERE instr(c.manifest_json, f.value) > 0)
+ ))) LIMIT 501
+), snapshot_history AS MATERIALIZED (
+ SELECT json_extract(j.value, '$.group_id') AS group_id,
+  json_extract(j.value, '$.candidate_ref') AS candidate_ref,
+  json_extract(j.value, '$.manifest_version') AS manifest_version,
+  json_extract(j.value, '$.completed_at') AS completed_at,
+  json_extract(j.value, '$.created_at') AS created_at,
+  json_extract(j.value, '$.manifest_json') AS manifest_json
+ FROM history_input h, json_each(h.value, '$.records') j
+), snapshot_history_keys AS MATERIALIZED (
+ SELECT json_extract(j.value, '$.public_key') AS public_key,
+  json_extract(j.value, '$.fingerprint') AS fingerprint
+ FROM history_input h, json_each(h.value, '$.keys') j
+), snapshot_discovery_keys AS MATERIALIZED (
+ SELECT j.value AS public_key FROM history_input h, json_each(h.value, '$.discoveryKeys') j
+), discovery_lines AS NOT MATERIALIZED (
+ SELECT public_key,
+  ltrim(replace(replace(replace(replace(replace(public_key,
+   char(9), ' '), char(10), ' '), char(11), ' '), char(12), ' '), char(13), ' '), ' ') AS line
+ FROM history_key_sources
+), discovery_tails AS NOT MATERIALIZED (
+ SELECT public_key, CASE WHEN substr(line, 1, 12) = 'ssh-ed25519 '
+  THEN ltrim(substr(line, 13), ' ') ELSE NULL END AS tail FROM discovery_lines
+), discovery_tokens AS NOT MATERIALIZED (
+ SELECT public_key, CASE WHEN tail IS NOT NULL
+  THEN substr(tail, 1, instr(tail || ' ', ' ') - 1) ELSE NULL END AS token
+ FROM discovery_tails
+), live_discovery_keys AS MATERIALIZED (
+ SELECT DISTINCT e.public_key FROM discovery_tokens e CROSS JOIN history_input h
+ WHERE e.public_key = json_extract(h.value, '$.publicKey')
+ OR instr(e.public_key, char(0)) > 0
+ OR e.token IS NULL
+ OR EXISTS (SELECT 1 FROM json_each(h.value, '$.discoveryFragments') f
+  WHERE instr(replace(replace(e.token, '-', '+'), '_', '/'), f.value) > 0)
+ OR e.token GLOB '*[^A-Za-z0-9+/=_-]*'
+ LIMIT 8193
+), live_history_keys AS MATERIALIZED (
+ SELECT DISTINCT e.public_key, e.fingerprint FROM history_key_sources e
+ WHERE e.public_key IN (SELECT public_key FROM snapshot_history_keys)
+ LIMIT 4097
+)`;
+`${CONTROLLER_HISTORY_CTE}`;
+`${CONTROLLER_HISTORY_CTE}`;
+`${CONTROLLER_HISTORY_CTE}${MAX_BYTES}`;
+var CONTROLLER_HISTORY_GUARD = `AND (
+ (SELECT value FROM history_input) IS NULL OR (
+ json_extract((SELECT value FROM history_input), '$.deviceId') = e.device_id
+ AND json_extract((SELECT value FROM history_input), '$.publicKey') = e.public_key
+ AND json_extract((SELECT value FROM history_input), '$.fingerprint') = e.fingerprint
+ AND (SELECT count(*) FROM live_history) = (SELECT count(*) FROM snapshot_history)
+ AND NOT EXISTS (SELECT * FROM live_history EXCEPT SELECT * FROM snapshot_history)
+ AND NOT EXISTS (SELECT * FROM live_history_keys EXCEPT SELECT * FROM snapshot_history_keys)
+ AND NOT EXISTS (SELECT * FROM snapshot_history_keys EXCEPT SELECT * FROM live_history_keys)
+ AND NOT EXISTS (SELECT * FROM live_discovery_keys EXCEPT SELECT * FROM snapshot_discovery_keys)
+ AND NOT EXISTS (SELECT * FROM snapshot_discovery_keys EXCEPT SELECT * FROM live_discovery_keys)
+ ))`;
+//#endregion
+//#region ../core/src/coordinator-account-connection-storage.ts
+/**
+* Storage constraints, not an unlink/relink authorization API.
+* The explicit account-schema migration installs this DDL. Management writers
+* compose the winning proof, archive move and successor CAS in one backend.batch;
+* an Identity identifier alone never authorizes these effects.
+*/
+var CONNECTION_BIRTH_COLUMNS = [
+	"coordinator_id",
+	"link_id",
+	"issuer",
+	"subject",
+	"identity_id",
+	"attempt_id",
+	"controller_attestation_id",
+	"auth_config_revision",
+	"created_at_ms",
+	"revoked_at_ms",
+	"authority_kind",
+	"device_claim_id"
+];
+var current = "coordinator_auth_account_links";
+var history = "coordinator_auth_account_connection_history";
+var orders = "coordinator_auth_account_connection_orders";
+var birthEqual = CONNECTION_BIRTH_COLUMNS.map((c) => `c.${c} IS NEW.${c}`).join(" AND ");
+var immutableBirth = CONNECTION_BIRTH_COLUMNS.filter((c) => c !== "revoked_at_ms").map((c) => `NEW.${c} IS NOT OLD.${c}`).join(" OR ");
+`${CONNECTION_BIRTH_COLUMNS.map((column) => `h.${column} IS c.${column}`).join(" AND ")}`;
+`${current}${history}`;
+/** Alias l must be the pinned current target, never a caller-selected Identity. */
+var CONNECTION_NOT_REVOKED_SQL = `l.revoked_at_ms IS NULL AND NOT EXISTS (
+ SELECT 1 FROM ${history} h WHERE h.coordinator_id = l.coordinator_id
+ AND h.identity_id = l.identity_id AND h.revoked_at_ms IS NOT NULL)`;
+`${history}${current}${history}`;
+`${orders}`;
+`${orders}`;
+`${history}`, `${history}${history}${history}${history}${current}${birthEqual}`, `${history}`, `${history}${immutableBirth}${history}${current}${history}`, `${history}`, `${current}${history}`, `${history}`, `${orders}`, `${orders}${orders}`, `${orders}`, `${orders}`;
+`${CONNECTION_BIRTH_COLUMNS.join(",")}${CONNECTION_BIRTH_COLUMNS.join(",")}`;
+function rootBirths(coordinator, link) {
+	return `SELECT ${CONNECTION_BIRTH_COLUMNS.join(",")} FROM coordinator_auth_account_links WHERE coordinator_id = ${coordinator} AND link_id = ${link}
+ UNION ALL SELECT ${CONNECTION_BIRTH_COLUMNS.join(",")} FROM coordinator_auth_account_connection_history WHERE coordinator_id = ${coordinator} AND link_id = ${link}`;
+}
+/** Trusted SQL aliases only. Historical ownership is independent of current enrollment.
+* The immutable proof's key ID was derived at commit. Signed-device receipts also
+* pass a freshly derived canonical key ID; account sessions need no current key.
+* Link revocation is deliberately checked by the caller, including post-revoke audit.
+*/
+function authDeviceClaimProvenanceSql(options) {
+	if (options.connections) return connectionClaimProvenance(options);
+	return genesisClaimProvenance(options.link, "coordinator_auth_account_links", options.canonicalKeyId);
+}
+function genesisClaimProvenance(link, births, canonicalKeyId) {
+	const l = "pl";
+	return `EXISTS (WITH committed_claim AS MATERIALIZED (
+ SELECT ct.coordinator_id, ct.link_id, cd.key_id FROM coordinator_auth_link_attempts ct
+ JOIN ${births} pl ON pl.coordinator_id = ct.coordinator_id AND pl.link_id = ct.link_id
+ JOIN coordinator_auth_device_claims cd ON cd.coordinator_id = ct.coordinator_id AND cd.claim_id = ${l}.device_claim_id
+ JOIN coordinator_auth_link_audit_log ca ON ca.coordinator_id = ct.coordinator_id AND ca.link_id = ct.link_id AND ca.action = 'link_created'
+ WHERE ct.coordinator_id = ${link}.coordinator_id AND ct.link_id = ${link}.link_id
+ AND ct.attempt_id = ${l}.attempt_id
+ AND ct.authority_kind = 'device_claim' AND ct.controller_attestation_id IS NULL
+ AND ct.controller_review_receipt_id IS NULL AND ct.controller_revision IS NULL AND ct.state IN ('finalized','session_redeemed')
+ AND ${l}.authority_kind = 'device_claim' AND ${l}.controller_attestation_id IS NULL
+ AND ct.identity_id = ${l}.identity_id AND ct.issuer = ${l}.issuer AND ct.account_subject = ${l}.subject
+ AND ct.auth_config_revision = ${l}.auth_config_revision AND ct.finalized_at_ms = ${l}.created_at_ms
+ AND ct.browser_transaction_hash IS NOT NULL AND ct.browser_start_hash IS NOT NULL
+ AND ct.runtime_verifier_hash IS NOT NULL AND ct.completion_secret_hash IS NOT NULL
+ AND ct.created_at_ms <= ct.claimed_at_ms AND ct.claimed_at_ms <= ct.oidc_verified_at_ms
+ AND ct.oidc_verified_at_ms <= ct.confirmed_at_ms AND ct.confirmed_at_ms <= ct.finalized_at_ms AND ct.finalized_at_ms < ct.expires_at_ms
+ AND cd.attempt_id = ct.attempt_id AND cd.identity_id = ct.identity_id AND cd.group_id = ct.group_id AND cd.device_id = ct.device_id
+ AND cd.public_key = ct.public_key AND cd.fingerprint = ct.fingerprint
+ AND cd.issuer = ct.issuer AND cd.auth_config_revision = ct.auth_config_revision AND cd.created_at_ms = ct.finalized_at_ms
+ AND ca.authority_kind = 'device_claim' AND ca.controller_attestation_id IS NULL AND ca.device_claim_id IS ${l}.device_claim_id
+ AND ca.attempt_id = ct.attempt_id AND ca.identity_id = ct.identity_id AND ca.group_id = ct.group_id AND ca.device_id = ct.device_id
+ AND ca.fingerprint = ct.fingerprint AND ca.auth_config_revision = ct.auth_config_revision AND ca.created_at_ms = ct.finalized_at_ms)
+ SELECT 1 FROM committed_claim cp WHERE cp.coordinator_id = ${link}.coordinator_id AND cp.link_id = ${link}.link_id
+ ${canonicalKeyId ? `AND cp.key_id = ${canonicalKeyId}` : ""})`;
+}
+function connectionClaimProvenance(options) {
+	const l = options.link;
+	return `EXISTS (WITH connection_births AS MATERIALIZED (${rootBirths(`${l}.coordinator_id`, `${l}.device_claim_id`)}), continuation AS MATERIALIZED (
+ SELECT t.coordinator_id,t.link_id,d.key_id FROM coordinator_auth_link_attempts t
+ JOIN coordinator_auth_link_audit_log a ON a.coordinator_id = t.coordinator_id AND a.link_id = t.link_id AND a.action = 'link_created'
+ JOIN coordinator_auth_device_claims d ON d.coordinator_id = t.coordinator_id AND d.claim_id = ${l}.device_claim_id
+ WHERE t.coordinator_id = ${l}.coordinator_id AND t.link_id = ${l}.link_id AND t.attempt_id = ${l}.attempt_id
+ AND (${l}.authority_kind = 'device_claim' AND ${l}.controller_attestation_id IS NULL AND t.authority_kind = 'device_claim' AND t.controller_attestation_id IS NULL AND t.controller_review_receipt_id IS NULL AND t.controller_revision IS NULL)
+ AND (t.state IN ('finalized','session_redeemed') AND t.identity_id = ${l}.identity_id AND t.issuer = ${l}.issuer AND t.account_subject = ${l}.subject AND t.auth_config_revision = ${l}.auth_config_revision AND t.finalized_at_ms = ${l}.created_at_ms)
+ AND (t.browser_start_hash IS NOT NULL AND t.browser_transaction_hash IS NOT NULL AND t.runtime_verifier_hash IS NOT NULL AND t.completion_secret_hash IS NOT NULL AND t.created_at_ms <= t.claimed_at_ms AND t.claimed_at_ms <= t.oidc_verified_at_ms AND t.oidc_verified_at_ms <= t.confirmed_at_ms AND t.confirmed_at_ms <= t.finalized_at_ms AND t.finalized_at_ms < t.expires_at_ms)
+ AND (d.identity_id = t.identity_id AND d.issuer = t.issuer AND d.group_id = t.group_id AND d.device_id = t.device_id AND d.public_key = t.public_key AND d.fingerprint = t.fingerprint)
+ AND (a.attempt_id = t.attempt_id AND a.identity_id = t.identity_id AND a.group_id = t.group_id AND a.device_id = t.device_id AND a.fingerprint = t.fingerprint AND a.auth_config_revision = t.auth_config_revision AND a.created_at_ms = t.finalized_at_ms AND a.authority_kind = 'device_claim' AND a.controller_attestation_id IS NULL AND a.device_claim_id = d.claim_id)
+ AND ((t.prior_link_id IS NULL AND t.link_id = d.claim_id) OR EXISTS (SELECT 1 FROM coordinator_auth_account_connection_history h WHERE h.coordinator_id = t.coordinator_id AND h.link_id = t.prior_link_id AND h.identity_id = t.identity_id AND h.successor_link_id = t.link_id))
+ AND EXISTS (SELECT 1 FROM connection_births gl WHERE gl.coordinator_id = d.coordinator_id AND gl.link_id = d.claim_id AND ${genesisClaimProvenance("gl", "connection_births")}))
+ SELECT 1 FROM continuation cp ${options.canonicalKeyId ? "WHERE cp.key_id = ?" : ""})`;
+}
+/** Account management only; privileged enrollment/grant proofs remain attested-only. */
+function controllerBirthProvenance(link) {
+	return `EXISTS (WITH controller_receipt AS MATERIALIZED (SELECT t.coordinator_id,t.link_id FROM coordinator_auth_link_attempts t
+ JOIN coordinator_auth_controller_attestations origin ON origin.coordinator_id=t.coordinator_id AND origin.attestation_id=t.controller_attestation_id
+ JOIN coordinator_auth_link_audit_log a ON a.coordinator_id=t.coordinator_id AND a.link_id=t.link_id AND a.action='link_created'
+ WHERE (t.coordinator_id=${link}.coordinator_id AND t.link_id=${link}.link_id AND t.attempt_id=${link}.attempt_id AND t.authority_kind='controller_attestation' AND t.controller_attestation_id=${link}.controller_attestation_id)
+ AND (t.identity_id=${link}.identity_id AND t.issuer=${link}.issuer AND t.account_subject=${link}.subject AND t.auth_config_revision=${link}.auth_config_revision AND t.finalized_at_ms=${link}.created_at_ms AND t.state IN ('finalized','session_redeemed'))
+ AND (t.browser_transaction_hash IS NOT NULL AND t.runtime_verifier_hash IS NOT NULL AND t.completion_secret_hash IS NOT NULL AND t.created_at_ms<=t.claimed_at_ms AND t.claimed_at_ms<=t.oidc_verified_at_ms AND t.oidc_verified_at_ms<=t.confirmed_at_ms AND t.confirmed_at_ms<=t.finalized_at_ms AND t.finalized_at_ms<t.expires_at_ms)
+ AND (origin.identity_id=t.identity_id AND origin.group_id=t.group_id AND origin.device_id=t.device_id AND origin.public_key=t.public_key AND origin.fingerprint=t.fingerprint AND origin.review_receipt_id=t.controller_review_receipt_id AND origin.revision=t.controller_revision)
+ AND (t.prior_link_id IS NULL OR EXISTS (SELECT 1 FROM coordinator_auth_account_connection_history h WHERE h.coordinator_id=t.coordinator_id AND h.identity_id=t.identity_id AND h.link_id=t.prior_link_id AND h.successor_link_id=t.link_id))
+ AND (a.attempt_id=t.attempt_id AND a.identity_id=t.identity_id AND a.group_id=t.group_id AND a.device_id=t.device_id AND a.fingerprint=t.fingerprint AND a.controller_attestation_id=t.controller_attestation_id AND a.authority_kind=t.authority_kind AND a.device_claim_id IS NULL AND a.auth_config_revision=t.auth_config_revision AND a.created_at_ms=t.finalized_at_ms)) SELECT 1 FROM controller_receipt)`;
+}
+function authAccountLinkProvenanceSql(link, options = {}) {
+	return `((${link}.authority_kind = 'controller_attestation' AND ${link}.controller_attestation_id IS NOT NULL AND ${link}.device_claim_id IS NULL${options.connections ? ` AND ${controllerBirthProvenance(link)}` : ""})
+ OR (${authDeviceClaimProvenanceSql({
+		link,
+		connections: options.connections
+	})}))`;
+}
+`${CONNECTION_NOT_REVOKED_SQL}${authAccountLinkProvenanceSql("l", { connections: true })}`;
+//#endregion
+//#region ../core/src/coordinator-auth-controller.ts
+function isAuthControllerId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+var AUTH_CONTROLLER_SNAPSHOT_CTE = `
+	WITH snapshot(value) AS (SELECT ?), snapshot_invites AS MATERIALIZED (
+		SELECT json_extract(j.value, '$.inviteId') AS invite_id,
+			json_extract(j.value, '$.kind') AS invite_kind,
+			json_extract(j.value, '$.actorId') AS recipient_actor_id,
+			json_extract(j.value, '$.assignedIdentityId') AS assigned_identity_id,
+			json_extract(j.value, '$.targetIdentityId') AS target_identity_id,
+			json_extract(j.value, '$.digest') AS reviewed_preview_digest
+		FROM json_each((SELECT value FROM snapshot), '$.invites') j
+	), live_invites AS MATERIALIZED (
+		SELECT i.invite_id, i.invite_kind, i.recipient_actor_id, i.assigned_identity_id,
+			i.target_identity_id, i.reviewed_preview_digest FROM coordinator_invites i
+		WHERE i.group_id = ? AND i.bound_device_id = ? AND i.bound_public_key = ?
+			AND i.bound_fingerprint = ? AND i.revoked_at IS NULL
+			AND i.consumed_at IS NOT NULL AND i.consumed_at != ''
+			AND i.invite_kind IN ('team_member', 'add_device')
+	), ${CONTROLLER_HISTORY_CTE}`;
+var AUTH_CONTROLLER_SNAPSHOT_GUARD = `
+	AND ((SELECT value FROM snapshot) IS NULL OR (
+		e.identity_id IS json_extract((SELECT value FROM snapshot), '$.enrollmentIdentityId')
+		AND (SELECT count(*) FROM live_invites) =
+			(SELECT count(*) FROM snapshot_invites)
+		AND NOT EXISTS (
+			SELECT * FROM live_invites
+			EXCEPT
+			SELECT * FROM snapshot_invites
+		)
+	)) ${CONTROLLER_HISTORY_GUARD}`;
+var AUTH_CONTROLLER_AUTHORITY_GUARD = `
+	AND e.group_id = ? AND e.device_id = ? AND e.public_key = ?
+	AND e.fingerprint = ? AND e.identity_id IS ?
+	AND NOT EXISTS (SELECT 1 FROM coordinator_device_revocations WHERE
+		(subject_kind = 'device_id' AND subject_value = ?) OR
+		(subject_kind = 'ed25519_key' AND subject_value = ?))`;
+`${AUTH_CONTROLLER_SNAPSHOT_CTE}${AUTH_CONTROLLER_SNAPSHOT_GUARD}${AUTH_CONTROLLER_AUTHORITY_GUARD}`;
+`${AUTH_CONTROLLER_SNAPSHOT_CTE}${AUTH_CONTROLLER_SNAPSHOT_GUARD}${AUTH_CONTROLLER_AUTHORITY_GUARD}`;
+var AUTH_CONTROLLER_CURRENT_SQL = `
+	SELECT a.* FROM coordinator_auth_controller_attestations a
+	JOIN enrolled_devices e ON e.group_id = a.group_id AND e.device_id = a.device_id
+	JOIN groups g ON g.group_id = a.group_id
+	WHERE a.coordinator_id = ? AND a.attestation_id = ? AND a.revoked_at IS NULL
+		AND e.enabled = 1 AND g.archived_at IS NULL AND e.public_key = a.public_key
+		AND e.fingerprint = a.fingerprint
+		AND (e.identity_id IS NULL OR e.identity_id = a.identity_id)`;
+AUTH_CONTROLLER_CURRENT_SQL.replace("SELECT a.*", "SELECT e.*");
+`${AUTH_CONTROLLER_SNAPSHOT_CTE}`, `${AUTH_CONTROLLER_CURRENT_SQL}${AUTH_CONTROLLER_AUTHORITY_GUARD}`, `${AUTH_CONTROLLER_SNAPSHOT_GUARD}`;
+function ownerProfileConflict() {
+	throw new Error("Owner enrollment stopped for review. Keep the profile and saved request unchanged; no identity or access repair is automatic.");
+}
+[{
+	name: "trg_identity_devices_assignment_version",
+	create: `CREATE TRIGGER trg_identity_devices_assignment_version
+	AFTER UPDATE OF identity_id ON identity_devices
+	WHEN NEW.identity_id <> OLD.identity_id
+	BEGIN
+		UPDATE identity_devices
+		SET assignment_version = OLD.assignment_version + 1
+		WHERE device_id = NEW.device_id;
+	END`
+}, {
+	name: "trg_identity_devices_purge_decisions",
+	create: `CREATE TRIGGER trg_identity_devices_purge_decisions
+	AFTER DELETE ON identity_devices
+	BEGIN
+		DELETE FROM policy_team_device_decisions WHERE device_id = OLD.device_id;
+	END`
+}].map(({ name, create }) => `DROP TRIGGER IF EXISTS ${name};\n${create};`).join("\n");
+[
+	[
+		"insert",
+		"AFTER INSERT",
+		""
+	],
+	[
+		"delete",
+		"AFTER DELETE",
+		""
+	],
+	[
+		"update",
+		"AFTER UPDATE",
+		"WHEN OLD.id IS NOT NEW.id OR OLD.title IS NOT NEW.title OR OLD.body_text IS NOT NEW.body_text OR OLD.active IS NOT NEW.active"
+	]
+].map(([suffix, event, condition]) => ({
+	name: `vector_corpus_epoch_${suffix}`,
+	sql: `CREATE TRIGGER vector_corpus_epoch_${suffix} ${event} ON memory_items ${condition}
+	BEGIN UPDATE vector_corpus_epoch SET epoch = epoch + 1 WHERE id = 1; END`
+}));
+join(homedir(), ".codemem", "mem.sqlite");
+join(homedir(), ".codemem.sqlite"), join(homedir(), ".opencode-mem.sqlite");
+//#endregion
+//#region ../core/src/schema.ts
+/**
+* Drizzle ORM schema for the codemem SQLite database.
+*/
+var sessions = sqliteTable("sessions", {
+	id: integer("id").primaryKey(),
+	started_at: text("started_at").notNull(),
+	ended_at: text("ended_at"),
+	cwd: text("cwd"),
+	project: text("project"),
+	git_remote: text("git_remote"),
+	git_branch: text("git_branch"),
+	user: text("user"),
+	tool_version: text("tool_version"),
+	metadata_json: text("metadata_json"),
+	import_key: text("import_key")
+}, (table) => [index("idx_sessions_started_id").on(table.started_at, table.id)]);
+sqliteTable("replication_scopes", {
+	scope_id: text("scope_id").primaryKey(),
+	label: text("label").notNull(),
+	kind: text("kind").notNull().default("user"),
+	authority_type: text("authority_type").notNull().default("local"),
+	coordinator_id: text("coordinator_id"),
+	group_id: text("group_id"),
+	manifest_issuer_device_id: text("manifest_issuer_device_id"),
+	membership_epoch: integer("membership_epoch").notNull().default(0),
+	manifest_hash: text("manifest_hash"),
+	status: text("status").notNull().default("active"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [index("idx_replication_scopes_status").on(table.status), index("idx_replication_scopes_authority_group").on(table.coordinator_id, table.group_id)]);
+sqliteTable("project_scope_mappings", {
+	id: integer("id").primaryKey(),
+	workspace_identity: text("workspace_identity"),
+	project_pattern: text("project_pattern").notNull(),
+	scope_id: text("scope_id").notNull(),
+	priority: integer("priority").notNull().default(0),
+	source: text("source").notNull().default("user"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	index("idx_project_scope_mappings_workspace_priority").on(table.workspace_identity, table.priority),
+	index("idx_project_scope_mappings_pattern_priority").on(table.project_pattern, table.priority),
+	index("idx_project_scope_mappings_scope").on(table.scope_id)
+]);
+sqliteTable("scope_memberships", {
+	scope_id: text("scope_id").notNull(),
+	device_id: text("device_id").notNull(),
+	role: text("role").notNull().default("member"),
+	status: text("status").notNull().default("active"),
+	membership_epoch: integer("membership_epoch").notNull().default(0),
+	coordinator_id: text("coordinator_id"),
+	group_id: text("group_id"),
+	manifest_issuer_device_id: text("manifest_issuer_device_id"),
+	manifest_hash: text("manifest_hash"),
+	signed_manifest_json: text("signed_manifest_json"),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	primaryKey({ columns: [table.scope_id, table.device_id] }),
+	index("idx_scope_memberships_device_status").on(table.device_id, table.status),
+	index("idx_scope_memberships_scope_status").on(table.scope_id, table.status),
+	index("idx_scope_memberships_authority_group").on(table.coordinator_id, table.group_id)
+]);
+sqliteTable("artifacts", {
+	id: integer("id").primaryKey(),
+	session_id: integer("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
+	kind: text("kind").notNull(),
+	path: text("path"),
+	content_text: text("content_text"),
+	content_hash: text("content_hash"),
+	created_at: text("created_at").notNull(),
+	metadata_json: text("metadata_json")
+}, (table) => [index("idx_artifacts_session_kind").on(table.session_id, table.kind)]);
+var memoryItems = sqliteTable("memory_items", {
+	id: integer("id").primaryKey(),
+	session_id: integer("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
+	kind: text("kind").notNull(),
+	title: text("title").notNull(),
+	subtitle: text("subtitle"),
+	body_text: text("body_text").notNull(),
+	confidence: real("confidence").default(.5),
+	tags_text: text("tags_text").default(""),
+	active: integer("active").default(1),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull(),
+	metadata_json: text("metadata_json"),
+	actor_id: text("actor_id"),
+	actor_display_name: text("actor_display_name"),
+	visibility: text("visibility"),
+	workspace_id: text("workspace_id"),
+	workspace_kind: text("workspace_kind"),
+	origin_device_id: text("origin_device_id"),
+	origin_source: text("origin_source"),
+	trust_state: text("trust_state"),
+	facts: text("facts"),
+	narrative: text("narrative"),
+	concepts: text("concepts"),
+	files_read: text("files_read"),
+	files_modified: text("files_modified"),
+	user_prompt_id: integer("user_prompt_id"),
+	prompt_number: integer("prompt_number"),
+	deleted_at: text("deleted_at"),
+	rev: integer("rev").default(0),
+	dedup_key: text("dedup_key"),
+	import_key: text("import_key"),
+	scope_id: text("scope_id"),
+	project: text("project")
+}, (table) => [
+	index("idx_memory_items_active_created").on(table.active, table.created_at),
+	index("idx_memory_items_created_id").on(table.created_at, table.id),
+	index("idx_memory_items_origin_device_active").on(table.origin_device_id, table.active),
+	index("idx_memory_items_session").on(table.session_id),
+	index("idx_memory_items_project").on(table.project),
+	index("idx_memory_items_scope_visibility_created").on(table.scope_id, table.visibility, table.created_at),
+	index("idx_memory_items_scope_backfill_pending").on(table.id).where(sql`scope_id IS NULL OR scope_id = ''`),
+	index("idx_memory_items_dedup_key_active_created").on(table.dedup_key, table.active, table.created_at),
+	uniqueIndex("idx_memory_items_same_session_dedup_unique").on(table.session_id, table.kind, table.visibility, table.workspace_id, table.dedup_key).where(sql`active = 1 AND dedup_key IS NOT NULL`)
+]);
+sqliteTable("memory_file_refs", {
+	memory_id: integer("memory_id").notNull().references(() => memoryItems.id, { onDelete: "cascade" }),
+	file_path: text("file_path").notNull(),
+	relation: text("relation").notNull()
+}, (table) => [primaryKey({ columns: [
+	table.memory_id,
+	table.file_path,
+	table.relation
+] }), index("idx_memory_file_refs_path").on(table.file_path)]);
+sqliteTable("memory_concept_refs", {
+	memory_id: integer("memory_id").notNull().references(() => memoryItems.id, { onDelete: "cascade" }),
+	concept: text("concept").notNull()
+}, (table) => [primaryKey({ columns: [table.memory_id, table.concept] }), index("idx_memory_concept_refs_concept").on(table.concept)]);
+sqliteTable("usage_events", {
+	id: integer("id").primaryKey(),
+	session_id: integer("session_id").references(() => sessions.id, { onDelete: "set null" }),
+	event: text("event").notNull(),
+	tokens_read: integer("tokens_read").default(0),
+	tokens_written: integer("tokens_written").default(0),
+	tokens_saved: integer("tokens_saved").default(0),
+	created_at: text("created_at").notNull(),
+	metadata_json: text("metadata_json")
+}, (table) => [index("idx_usage_events_event_created").on(table.event, table.created_at), index("idx_usage_events_session").on(table.session_id)]);
+var retrievalAttempts = sqliteTable("retrieval_attempts", {
+	attempt_id: text("attempt_id").primaryKey(),
+	contract_version: integer("contract_version").notNull(),
+	surface: text("surface").notNull(),
+	trigger: text("trigger").notNull(),
+	started_at: text("started_at").notNull(),
+	completed_at: text("completed_at"),
+	retrieval_status: text("retrieval_status").notNull(),
+	delivery_status: text("delivery_status").notNull(),
+	candidate_count: integer("candidate_count").notNull(),
+	selected_count: integer("selected_count").notNull(),
+	persisted_candidate_count: integer("persisted_candidate_count").notNull(),
+	recorder_version: text("recorder_version").notNull(),
+	session_id: integer("session_id").references(() => sessions.id, { onDelete: "cascade" }),
+	source: text("source"),
+	stream_id: text("stream_id"),
+	source_session_id: text("source_session_id"),
+	prompt_number: integer("prompt_number"),
+	request_id: text("request_id"),
+	raw_event_start_seq: integer("raw_event_start_seq"),
+	raw_event_end_seq: integer("raw_event_end_seq"),
+	experiment_id: text("experiment_id"),
+	experiment_cell_id: text("experiment_cell_id"),
+	evaluation_checkout_id: text("evaluation_checkout_id"),
+	evaluation_fixture_id: text("evaluation_fixture_id"),
+	evaluation_seed: integer("evaluation_seed"),
+	latency_ms: integer("latency_ms"),
+	project: text("project"),
+	scope_id: text("scope_id"),
+	mode: text("mode"),
+	limit_requested: integer("limit_requested"),
+	token_budget: integer("token_budget"),
+	output_tokens: integer("output_tokens"),
+	working_set_file_count: integer("working_set_file_count"),
+	working_set_files_json: text("working_set_files_json"),
+	query_hash_sha256: text("query_hash_sha256"),
+	query_char_count: integer("query_char_count"),
+	query_token_estimate: integer("query_token_estimate"),
+	filter_summary_json: text("filter_summary_json"),
+	failure_code: text("failure_code"),
+	failure_stage: text("failure_stage"),
+	trace_version: integer("trace_version"),
+	automatic_recall_json: text("automatic_recall_json"),
+	automatic_recall_key: text("automatic_recall_key"),
+	retention_until: text("retention_until"),
+	retention_pinned: integer("retention_pinned").notNull().default(0),
+	retention_finalized_at: text("retention_finalized_at")
+}, (table) => [
+	index("idx_retrieval_attempts_session_started").on(table.session_id, table.started_at),
+	uniqueIndex("idx_retrieval_attempts_automatic_recall_key").on(table.automatic_recall_key),
+	index("idx_retrieval_attempts_source_stream_started").on(table.source, table.stream_id, table.started_at),
+	index("idx_retrieval_attempts_retention").on(table.retention_pinned, table.retention_until),
+	index("idx_retrieval_attempts_started").on(table.started_at, table.attempt_id),
+	index("idx_retrieval_attempts_surface_started").on(table.surface, table.started_at),
+	uniqueIndex("idx_retrieval_attempts_request_identity").on(table.source, table.surface, table.request_id).where(sql`request_id IS NOT NULL`),
+	index("idx_retrieval_attempts_experiment_cell").on(table.experiment_id, table.experiment_cell_id)
+]);
+var retrievalExposures = sqliteTable("retrieval_exposures", {
+	exposure_id: integer("exposure_id").primaryKey({ autoIncrement: true }),
+	attempt_id: text("attempt_id").notNull().references(() => retrievalAttempts.attempt_id, { onDelete: "cascade" }),
+	memory_id: integer("memory_id").references(() => memoryItems.id, { onDelete: "set null" }),
+	memory_import_key: text("memory_import_key"),
+	origin_device_id: text("origin_device_id"),
+	rank: integer("rank").notNull(),
+	disposition: text("disposition").notNull(),
+	section: text("section"),
+	handoff_status: text("handoff_status").notNull(),
+	memory_rev: integer("memory_rev"),
+	memory_updated_at: text("memory_updated_at"),
+	memory_scope_id: text("memory_scope_id"),
+	memory_kind: text("memory_kind"),
+	memory_active: integer("memory_active"),
+	memory_deleted_at: text("memory_deleted_at"),
+	score_summary_json: text("score_summary_json"),
+	reason_codes_json: text("reason_codes_json")
+}, (table) => [uniqueIndex("idx_retrieval_exposures_attempt_rank").on(table.attempt_id, table.rank), index("idx_retrieval_exposures_memory").on(table.memory_id)]);
+var outcomeEvidence = sqliteTable("outcome_evidence", {
+	evidence_id: text("evidence_id").primaryKey(),
+	contract_version: integer("contract_version").notNull(),
+	dimension: text("dimension").notNull(),
+	evidence_type: text("evidence_type").notNull(),
+	source_class: text("source_class").notNull(),
+	observed_at: text("observed_at").notNull(),
+	producer: text("producer").notNull(),
+	producer_version: text("producer_version").notNull(),
+	status: text("status").notNull(),
+	value_type: text("value_type"),
+	value_integer: integer("value_integer"),
+	value_real: real("value_real"),
+	value_unit: text("value_unit"),
+	session_id: integer("session_id").references(() => sessions.id, { onDelete: "cascade" }),
+	source: text("source"),
+	stream_id: text("stream_id"),
+	source_session_id: text("source_session_id"),
+	prompt_number: integer("prompt_number"),
+	raw_event_start_seq: integer("raw_event_start_seq"),
+	raw_event_end_seq: integer("raw_event_end_seq"),
+	experiment_id: text("experiment_id"),
+	experiment_cell_id: text("experiment_cell_id"),
+	window_start_at: text("window_start_at"),
+	window_end_at: text("window_end_at"),
+	references_json: text("references_json"),
+	retention_until: text("retention_until"),
+	retention_pinned: integer("retention_pinned").notNull().default(0),
+	retention_finalized_at: text("retention_finalized_at")
+}, (table) => [
+	index("idx_outcome_evidence_observed_id").on(table.observed_at, table.evidence_id),
+	index("idx_outcome_evidence_session_observed").on(table.session_id, table.observed_at),
+	index("idx_outcome_evidence_source_stream_observed").on(table.source, table.stream_id, table.observed_at),
+	index("idx_outcome_evidence_type_observed").on(table.evidence_type, table.observed_at),
+	index("idx_outcome_evidence_retention").on(table.retention_pinned, table.retention_until)
+]);
+var attributionAssessments = sqliteTable("attribution_assessments", {
+	assessment_id: text("assessment_id").primaryKey(),
+	contract_version: integer("contract_version").notNull(),
+	subject_type: text("subject_type").notNull(),
+	attempt_id: text("attempt_id").notNull().references(() => retrievalAttempts.attempt_id, { onDelete: "cascade" }),
+	exposure_id: integer("exposure_id").references(() => retrievalExposures.exposure_id, { onDelete: "cascade" }),
+	dimension: text("dimension").notNull(),
+	impact_label: text("impact_label").notNull(),
+	basis: text("basis").notNull(),
+	confidence_level: text("confidence_level").notNull(),
+	method: text("method").notNull(),
+	method_version: text("method_version").notNull(),
+	created_at: text("created_at").notNull(),
+	claim_type: text("claim_type").notNull().default("observational")
+}, (table) => [
+	index("idx_attribution_assessments_attempt_created").on(table.attempt_id, table.created_at),
+	index("idx_attribution_assessments_label_created").on(table.impact_label, table.created_at),
+	index("idx_attribution_assessments_exposure").on(table.exposure_id)
+]);
+sqliteTable("attribution_assessment_evidence", {
+	assessment_id: text("assessment_id").notNull().references(() => attributionAssessments.assessment_id, { onDelete: "cascade" }),
+	evidence_id: text("evidence_id").notNull().references(() => outcomeEvidence.evidence_id, { onDelete: "cascade" })
+}, (table) => [primaryKey({ columns: [table.assessment_id, table.evidence_id] }), index("idx_attribution_assessment_evidence_evidence").on(table.evidence_id, table.assessment_id)]);
+sqliteTable("maintenance_jobs", {
+	kind: text("kind").primaryKey(),
+	title: text("title").notNull(),
+	status: text("status").notNull(),
+	message: text("message"),
+	progress_current: integer("progress_current").notNull().default(0),
+	progress_total: integer("progress_total"),
+	progress_unit: text("progress_unit").notNull().default("items"),
+	metadata_json: text("metadata_json"),
+	started_at: text("started_at"),
+	updated_at: text("updated_at").notNull(),
+	finished_at: text("finished_at"),
+	error: text("error")
+}, (table) => [index("idx_maintenance_jobs_status_updated").on(table.status, table.updated_at)]);
+sqliteTable("raw_events", {
+	id: integer("id").primaryKey(),
+	source: text("source").notNull().default("opencode"),
+	stream_id: text("stream_id").notNull().default(""),
+	opencode_session_id: text("opencode_session_id").notNull(),
+	event_id: text("event_id"),
+	event_seq: integer("event_seq").notNull(),
+	event_type: text("event_type").notNull(),
+	ts_wall_ms: integer("ts_wall_ms"),
+	ts_mono_ms: real("ts_mono_ms"),
+	payload_json: text("payload_json").notNull(),
+	capture_context_json: text("capture_context_json"),
+	created_at: text("created_at").notNull()
+}, (table) => [
+	uniqueIndex("idx_raw_events_source_stream_seq").on(table.source, table.stream_id, table.event_seq),
+	uniqueIndex("idx_raw_events_source_stream_event_id").on(table.source, table.stream_id, table.event_id),
+	index("idx_raw_events_session_seq").on(table.opencode_session_id, table.event_seq),
+	index("idx_raw_events_created").on(table.created_at),
+	index("idx_raw_events_capture_context").on(table.source, table.stream_id, table.event_seq).where(sql`${table.capture_context_json} IS NOT NULL`)
+]);
+sqliteTable("raw_event_sessions", {
+	source: text("source").notNull().default("opencode"),
+	stream_id: text("stream_id").notNull().default(""),
+	opencode_session_id: text("opencode_session_id").notNull(),
+	cwd: text("cwd"),
+	project: text("project"),
+	started_at: text("started_at"),
+	last_seen_ts_wall_ms: integer("last_seen_ts_wall_ms"),
+	last_received_event_seq: integer("last_received_event_seq").notNull().default(-1),
+	last_flushed_event_seq: integer("last_flushed_event_seq").notNull().default(-1),
+	updated_at: text("updated_at").notNull()
+}, (table) => [primaryKey({ columns: [table.source, table.stream_id] }), index("idx_raw_event_sessions_pending_updated").on(table.updated_at).where(sql`${table.last_received_event_seq} > ${table.last_flushed_event_seq}`)]);
+sqliteTable("pi_import_state", {
+	file_path: text("file_path").primaryKey(),
+	size_bytes: integer("size_bytes").notNull(),
+	mtime_ms: real("mtime_ms").notNull(),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("opencode_sessions", {
+	source: text("source").notNull().default("opencode"),
+	stream_id: text("stream_id").notNull().default(""),
+	opencode_session_id: text("opencode_session_id").notNull(),
+	session_id: integer("session_id").references(() => sessions.id, { onDelete: "cascade" }),
+	created_at: text("created_at").notNull()
+}, (table) => [primaryKey({ columns: [table.source, table.stream_id] }), index("idx_opencode_sessions_session").on(table.session_id)]);
+sqliteTable("raw_event_flush_batches", {
+	id: integer("id").primaryKey(),
+	source: text("source").notNull().default("opencode"),
+	stream_id: text("stream_id").notNull().default(""),
+	opencode_session_id: text("opencode_session_id").notNull(),
+	start_event_seq: integer("start_event_seq").notNull(),
+	end_event_seq: integer("end_event_seq").notNull(),
+	extractor_version: text("extractor_version").notNull(),
+	status: text("status").notNull(),
+	error_message: text("error_message"),
+	error_type: text("error_type"),
+	observer_provider: text("observer_provider"),
+	observer_model: text("observer_model"),
+	observer_runtime: text("observer_runtime"),
+	observer_auth_source: text("observer_auth_source"),
+	observer_auth_type: text("observer_auth_type"),
+	observer_error_code: text("observer_error_code"),
+	observer_error_message: text("observer_error_message"),
+	attempt_count: integer("attempt_count").notNull().default(0),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	uniqueIndex("idx_flush_batches_source_stream_seq_ver").on(table.source, table.stream_id, table.start_event_seq, table.end_event_seq, table.extractor_version),
+	index("idx_flush_batches_session_created").on(table.opencode_session_id, table.created_at),
+	index("idx_flush_batches_status_updated").on(table.status, table.updated_at),
+	index("idx_flush_batches_observer_status_updated").on(table.status, table.updated_at).where(sql`${table.observer_provider} IS NOT NULL`),
+	index("idx_flush_batches_capture_status_updated").on(table.status, table.updated_at).where(sql`${table.observer_provider} IS NULL`)
+]);
+sqliteTable("user_prompts", {
+	id: integer("id").primaryKey(),
+	session_id: integer("session_id").references(() => sessions.id, { onDelete: "cascade" }),
+	project: text("project"),
+	prompt_text: text("prompt_text").notNull(),
+	prompt_number: integer("prompt_number"),
+	created_at: text("created_at").notNull(),
+	created_at_epoch: integer("created_at_epoch").notNull(),
+	metadata_json: text("metadata_json"),
+	import_key: text("import_key")
+}, (table) => [
+	index("idx_user_prompts_session").on(table.session_id),
+	index("idx_user_prompts_project").on(table.project),
+	index("idx_user_prompts_epoch").on(table.created_at_epoch)
+]);
+sqliteTable("session_summaries", {
+	id: integer("id").primaryKey(),
+	session_id: integer("session_id").references(() => sessions.id, { onDelete: "cascade" }),
+	project: text("project"),
+	request: text("request"),
+	investigated: text("investigated"),
+	learned: text("learned"),
+	completed: text("completed"),
+	next_steps: text("next_steps"),
+	notes: text("notes"),
+	files_read: text("files_read"),
+	files_edited: text("files_edited"),
+	prompt_number: integer("prompt_number"),
+	created_at: text("created_at").notNull(),
+	created_at_epoch: integer("created_at_epoch").notNull(),
+	metadata_json: text("metadata_json"),
+	import_key: text("import_key")
+}, (table) => [
+	index("idx_session_summaries_session").on(table.session_id),
+	index("idx_session_summaries_project").on(table.project),
+	index("idx_session_summaries_epoch").on(table.created_at_epoch)
+]);
+sqliteTable("replication_ops", {
+	op_id: text("op_id").primaryKey(),
+	entity_type: text("entity_type").notNull(),
+	entity_id: text("entity_id").notNull(),
+	op_type: text("op_type").notNull(),
+	payload_json: text("payload_json"),
+	clock_rev: integer("clock_rev").notNull(),
+	clock_updated_at: text("clock_updated_at").notNull(),
+	clock_device_id: text("clock_device_id").notNull(),
+	device_id: text("device_id").notNull(),
+	created_at: text("created_at").notNull(),
+	scope_id: text("scope_id")
+}, (table) => [
+	index("idx_replication_ops_created").on(table.created_at, table.op_id),
+	index("idx_replication_ops_entity").on(table.entity_type, table.entity_id),
+	index("idx_replication_ops_scope_created").on(table.scope_id, table.created_at, table.op_id)
+]);
+sqliteTable("replication_cursors", {
+	peer_device_id: text("peer_device_id").primaryKey(),
+	last_applied_cursor: text("last_applied_cursor"),
+	last_acked_cursor: text("last_acked_cursor"),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("replication_cursors_v2", {
+	peer_device_id: text("peer_device_id").notNull(),
+	scope_id: text("scope_id").notNull(),
+	last_applied_cursor: text("last_applied_cursor"),
+	last_acked_cursor: text("last_acked_cursor"),
+	updated_at: text("updated_at").notNull()
+}, (table) => [primaryKey({ columns: [table.peer_device_id, table.scope_id] }), index("idx_replication_cursors_v2_scope").on(table.scope_id)]);
+sqliteTable("sync_peers", {
+	peer_device_id: text("peer_device_id").primaryKey(),
+	name: text("name"),
+	pinned_fingerprint: text("pinned_fingerprint"),
+	public_key: text("public_key"),
+	addresses_json: text("addresses_json"),
+	manual_addresses_json: text("manual_addresses_json"),
+	last_success_address: text("last_success_address"),
+	claimed_local_actor: integer("claimed_local_actor").notNull().default(0),
+	actor_id: text("actor_id"),
+	projects_include_json: text("projects_include_json"),
+	projects_exclude_json: text("projects_exclude_json"),
+	created_at: text("created_at").notNull(),
+	last_seen_at: text("last_seen_at"),
+	last_sync_at: text("last_sync_at"),
+	last_error: text("last_error"),
+	runtime_version: text("runtime_version"),
+	runtime_version_observed_at: text("runtime_version_observed_at"),
+	highest_observed_direct_signature_version: integer("highest_observed_direct_signature_version"),
+	discovered_via_coordinator_id: text("discovered_via_coordinator_id"),
+	discovered_via_group_id: text("discovered_via_group_id"),
+	trust_provenance: text("trust_provenance"),
+	pending_bootstrap_grant_id: text("pending_bootstrap_grant_id")
+});
+sqliteTable("sync_peer_signature_state", {
+	peer_device_id: text("peer_device_id").primaryKey(),
+	highest_observed_direct_signature_version: integer("highest_observed_direct_signature_version").notNull()
+});
+sqliteTable("sync_nonces", {
+	nonce: text("nonce").primaryKey(),
+	device_id: text("device_id").notNull(),
+	created_at: text("created_at").notNull()
+});
+sqliteTable("sync_device", {
+	device_id: text("device_id").primaryKey(),
+	public_key: text("public_key").notNull(),
+	fingerprint: text("fingerprint").notNull(),
+	created_at: text("created_at").notNull()
+});
+sqliteTable("sync_attempts", {
+	id: integer("id").primaryKey({ autoIncrement: true }),
+	peer_device_id: text("peer_device_id").notNull(),
+	started_at: text("started_at").notNull(),
+	finished_at: text("finished_at"),
+	ok: integer("ok").notNull(),
+	ops_in: integer("ops_in").notNull(),
+	ops_out: integer("ops_out").notNull(),
+	error: text("error"),
+	local_sync_capability: text("local_sync_capability"),
+	peer_sync_capability: text("peer_sync_capability"),
+	negotiated_sync_capability: text("negotiated_sync_capability"),
+	failure_category: text("failure_category")
+}, (table) => [
+	index("idx_sync_attempts_peer_started").on(table.peer_device_id, table.started_at),
+	index("idx_sync_attempts_occurred").on(sql`CASE WHEN ${table.finished_at} IS NULL THEN ${table.started_at} ELSE ${table.finished_at} END`, table.id),
+	index("idx_sync_attempts_error_occurred").on(sql`CASE WHEN ${table.finished_at} IS NULL THEN ${table.started_at} ELSE ${table.finished_at} END`, table.id).where(sql`${table.ok} = 0`),
+	index("idx_sync_attempts_success_occurred").on(sql`CASE WHEN ${table.finished_at} IS NULL THEN ${table.started_at} ELSE ${table.finished_at} END`, table.id).where(sql`${table.ok} <> 0`)
+]);
+sqliteTable("sync_scope_rejections", {
+	id: integer("id").primaryKey({ autoIncrement: true }),
+	peer_device_id: text("peer_device_id"),
+	op_id: text("op_id").notNull(),
+	entity_type: text("entity_type").notNull(),
+	entity_id: text("entity_id").notNull(),
+	scope_id: text("scope_id"),
+	reason: text("reason").notNull(),
+	created_at: text("created_at").notNull()
+}, (table) => [index("idx_sync_scope_rejections_peer_created").on(table.peer_device_id, table.created_at), index("idx_sync_scope_rejections_scope_created").on(table.scope_id, table.created_at)]);
+sqliteTable("sync_daemon_state", {
+	id: integer("id").primaryKey(),
+	last_error: text("last_error"),
+	last_traceback: text("last_traceback"),
+	last_error_at: text("last_error_at"),
+	last_ok_at: text("last_ok_at"),
+	phase: text("phase")
+});
+sqliteTable("sync_reset_state", {
+	id: integer("id").primaryKey(),
+	generation: integer("generation").notNull(),
+	snapshot_id: text("snapshot_id").notNull(),
+	baseline_cursor: text("baseline_cursor"),
+	retained_floor_cursor: text("retained_floor_cursor"),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("sync_reset_state_v2", {
+	scope_id: text("scope_id").primaryKey(),
+	generation: integer("generation").notNull(),
+	snapshot_id: text("snapshot_id").notNull(),
+	baseline_cursor: text("baseline_cursor"),
+	retained_floor_cursor: text("retained_floor_cursor"),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("sync_retention_state", {
+	id: integer("id").primaryKey(),
+	last_run_at: text("last_run_at"),
+	last_duration_ms: integer("last_duration_ms"),
+	last_deleted_ops: integer("last_deleted_ops").notNull().default(0),
+	last_estimated_bytes_before: integer("last_estimated_bytes_before"),
+	last_estimated_bytes_after: integer("last_estimated_bytes_after"),
+	retained_floor_cursor: text("retained_floor_cursor"),
+	last_error: text("last_error"),
+	last_error_at: text("last_error_at")
+});
+sqliteTable("sync_retention_state_v2", {
+	scope_id: text("scope_id").primaryKey(),
+	last_run_at: text("last_run_at"),
+	last_duration_ms: integer("last_duration_ms"),
+	last_deleted_ops: integer("last_deleted_ops").notNull().default(0),
+	last_estimated_bytes_before: integer("last_estimated_bytes_before"),
+	last_estimated_bytes_after: integer("last_estimated_bytes_after"),
+	retained_floor_cursor: text("retained_floor_cursor"),
+	last_error: text("last_error"),
+	last_error_at: text("last_error_at")
+});
+sqliteTable("raw_event_ingest_samples", {
+	id: integer("id").primaryKey({ autoIncrement: true }),
+	created_at: text("created_at").notNull(),
+	inserted_events: integer("inserted_events").notNull().default(0),
+	skipped_invalid: integer("skipped_invalid").notNull().default(0),
+	skipped_duplicate: integer("skipped_duplicate").notNull().default(0),
+	skipped_conflict: integer("skipped_conflict").notNull().default(0)
+});
+sqliteTable("raw_event_ingest_stats", {
+	id: integer("id").primaryKey(),
+	inserted_events: integer("inserted_events").notNull().default(0),
+	skipped_events: integer("skipped_events").notNull().default(0),
+	skipped_invalid: integer("skipped_invalid").notNull().default(0),
+	skipped_duplicate: integer("skipped_duplicate").notNull().default(0),
+	skipped_conflict: integer("skipped_conflict").notNull().default(0),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("coordinator_group_preferences", {
+	coordinator_id: text("coordinator_id").notNull(),
+	group_id: text("group_id").notNull(),
+	projects_include_json: text("projects_include_json"),
+	projects_exclude_json: text("projects_exclude_json"),
+	auto_seed_scope: integer("auto_seed_scope").notNull().default(1),
+	default_space_scope_id: text("default_space_scope_id"),
+	auto_grant_default_space_on_join: integer("auto_grant_default_space_on_join").notNull().default(0),
+	updated_at: text("updated_at").notNull()
+}, (table) => ({ pk: primaryKey({ columns: [table.coordinator_id, table.group_id] }) }));
+sqliteTable("actors", {
+	actor_id: text("actor_id").primaryKey(),
+	display_name: text("display_name").notNull(),
+	is_local: integer("is_local").notNull().default(0),
+	status: text("status").notNull().default("active"),
+	merged_into_actor_id: text("merged_into_actor_id"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => ({
+	isLocalIdx: index("idx_actors_is_local").on(table.is_local),
+	statusIdx: index("idx_actors_status").on(table.status)
+}));
+sqliteTable("recipient_policy_review_resolutions", {
+	review_item_id: text("review_item_id").notNull(),
+	source_fingerprint: text("source_fingerprint").notNull(),
+	decision: text("decision").notNull(),
+	decision_input_json: text("decision_input_json").notNull(),
+	preview_json: text("preview_json").notNull(),
+	decided_by_identity_id: text("decided_by_identity_id").notNull(),
+	decided_by_device_id: text("decided_by_device_id").notNull(),
+	resolved_at: text("resolved_at").notNull()
+}, (table) => [primaryKey({ columns: [table.review_item_id, table.source_fingerprint] })]);
+sqliteTable("coordinator_enrollment_reconciliation_issues", {
+	coordinator_id: text("coordinator_id").notNull(),
+	group_id: text("group_id").notNull(),
+	kind: text("kind").notNull(),
+	reference_id: text("reference_id").notNull(),
+	code: text("code").notNull(),
+	status: text("status").notNull().default("open"),
+	first_seen_at: text("first_seen_at").notNull(),
+	last_seen_at: text("last_seen_at").notNull(),
+	resolved_at: text("resolved_at"),
+	occurrence_count: integer("occurrence_count").notNull().default(1),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	primaryKey({ columns: [
+		table.coordinator_id,
+		table.group_id,
+		table.kind,
+		table.reference_id,
+		table.code
+	] }),
+	index("idx_coordinator_enrollment_issues_boundary_status").on(table.coordinator_id, table.group_id, table.status),
+	index("idx_coordinator_enrollment_issues_status_recent").on(table.status, table.last_seen_at, table.resolved_at)
+]);
+var policyTeams = sqliteTable("policy_teams", {
+	team_id: text("team_id").primaryKey(),
+	display_name: text("display_name").notNull(),
+	status: text("status").notNull(),
+	device_eligibility_mode: text("device_eligibility_mode").notNull().default("person_all_devices"),
+	provenance: text("provenance").notNull(),
+	revision: text("revision").notNull(),
+	migration_state: text("migration_state").notNull(),
+	source_fingerprint: text("source_fingerprint"),
+	idempotency_key: text("idempotency_key").notNull().unique(),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("policy_team_memberships", {
+	team_id: text("team_id").notNull(),
+	identity_id: text("identity_id").notNull(),
+	role: text("role").notNull(),
+	status: text("status").notNull(),
+	provenance: text("provenance").notNull(),
+	revision: text("revision").notNull(),
+	migration_state: text("migration_state").notNull(),
+	source_fingerprint: text("source_fingerprint"),
+	idempotency_key: text("idempotency_key").notNull().unique(),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => ({
+	pk: primaryKey({ columns: [table.team_id, table.identity_id] }),
+	identityStatusIdx: index("idx_policy_team_memberships_identity_status").on(table.identity_id, table.status)
+}));
+sqliteTable("policy_team_device_decisions", {
+	team_id: text("team_id").notNull().references(() => policyTeams.team_id, { onDelete: "cascade" }),
+	device_id: text("device_id").notNull(),
+	decision: text("decision").notNull(),
+	assignment_version: integer("assignment_version").notNull().default(0),
+	provenance: text("provenance").notNull(),
+	revision: text("revision").notNull(),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [primaryKey({ columns: [table.team_id, table.device_id] }), index("idx_policy_team_device_decisions_device").on(table.device_id)]);
+sqliteTable("identity_devices", {
+	device_id: text("device_id").primaryKey(),
+	identity_id: text("identity_id").notNull(),
+	display_name: text("display_name").notNull(),
+	status: text("status").notNull(),
+	provenance: text("provenance").notNull(),
+	revision: text("revision").notNull(),
+	migration_state: text("migration_state").notNull(),
+	assignment_version: integer("assignment_version").notNull().default(0),
+	source_fingerprint: text("source_fingerprint"),
+	idempotency_key: text("idempotency_key").notNull().unique(),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => ({ identityStatusIdx: index("idx_identity_devices_identity_status").on(table.identity_id, table.status) }));
+var deviceIdentityBindingCommits = sqliteTable("device_identity_binding_commits", {
+	commit_digest: text("commit_digest").primaryKey(),
+	reviewed_inventory_digest: text("reviewed_inventory_digest").notNull(),
+	request_json: text("request_json").notNull(),
+	outcomes_json: text("outcomes_json").notNull(),
+	write_count: integer("write_count").notNull(),
+	decided_by_identity_id: text("decided_by_identity_id").notNull(),
+	decided_by_device_id: text("decided_by_device_id").notNull(),
+	created_at: text("created_at").notNull()
+});
+sqliteTable("device_identity_binding_audit", {
+	event_id: text("event_id").primaryKey(),
+	commit_digest: text("commit_digest").notNull().references(() => deviceIdentityBindingCommits.commit_digest),
+	device_id: text("device_id").notNull(),
+	previous_identity_id: text("previous_identity_id"),
+	target_identity_id: text("target_identity_id").notNull(),
+	action: text("action").notNull(),
+	previous_assignment_version: integer("previous_assignment_version"),
+	resulting_assignment_version: integer("resulting_assignment_version").notNull(),
+	decided_by_identity_id: text("decided_by_identity_id").notNull(),
+	decided_by_device_id: text("decided_by_device_id").notNull(),
+	created_at: text("created_at").notNull()
+}, (table) => [uniqueIndex("idx_device_identity_binding_audit_commit_device").on(table.commit_digest, table.device_id), index("idx_device_identity_binding_audit_device_created").on(table.device_id, table.created_at, table.event_id)]);
+sqliteTable("project_recipients", {
+	canonical_project_identity: text("canonical_project_identity").notNull(),
+	recipient_kind: text("recipient_kind").notNull(),
+	recipient_id: text("recipient_id").notNull(),
+	status: text("status").notNull(),
+	provenance: text("provenance").notNull(),
+	policy_revision: text("policy_revision").notNull(),
+	migration_state: text("migration_state").notNull(),
+	source_fingerprint: text("source_fingerprint"),
+	idempotency_key: text("idempotency_key").notNull().unique(),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => ({
+	pk: primaryKey({ columns: [
+		table.canonical_project_identity,
+		table.recipient_kind,
+		table.recipient_id
+	] }),
+	projectStatusIdx: index("idx_project_recipients_project_status").on(table.canonical_project_identity, table.status),
+	recipientStatusIdx: index("idx_project_recipients_recipient_status").on(table.recipient_kind, table.recipient_id, table.status)
+}));
+var legacyTeamSetupDrafts = sqliteTable("legacy_team_setup_drafts", {
+	attempt_id: text("attempt_id").primaryKey(),
+	candidate_id: text("candidate_id").notNull(),
+	coordinator_id: text("coordinator_id").notNull(),
+	group_id: text("group_id").notNull(),
+	state: text("state").notNull().default("needs_setup"),
+	display_name: text("display_name").notNull(),
+	roster_fingerprint: text("roster_fingerprint").notNull(),
+	projection_fingerprint: text("projection_fingerprint").notNull(),
+	finish_digest: text("finish_digest"),
+	safe_error_code: text("safe_error_code"),
+	completed_team_id: text("completed_team_id"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull(),
+	completed_at: text("completed_at"),
+	superseded_at: text("superseded_at")
+}, (table) => [
+	index("idx_legacy_team_setup_drafts_candidate_state").on(table.candidate_id, table.state, table.created_at),
+	index("idx_legacy_team_setup_drafts_state_updated").on(table.state, table.updated_at),
+	index("idx_legacy_team_setup_drafts_finish_digest").on(table.finish_digest)
+]);
+sqliteTable("legacy_team_setup_completions", {
+	attempt_id: text("attempt_id").notNull(),
+	finish_digest: text("finish_digest").notNull(),
+	candidate_ref: text("candidate_ref").notNull(),
+	confirmed_access_delta_digest: text("confirmed_access_delta_digest").notNull(),
+	completed_team_id: text("completed_team_id").notNull(),
+	response_json: text("response_json").notNull(),
+	completed_at: text("completed_at").notNull(),
+	created_at: text("created_at").notNull()
+}, (table) => [uniqueIndex("idx_legacy_team_setup_completions_attempt_finish").on(table.attempt_id, table.finish_digest), index("idx_legacy_team_setup_completions_exact_replay").on(table.candidate_ref, table.attempt_id, table.finish_digest, table.confirmed_access_delta_digest)]);
+sqliteTable("legacy_team_setup_draft_devices", {
+	attempt_id: text("attempt_id").notNull().references(() => legacyTeamSetupDrafts.attempt_id, { onDelete: "cascade" }),
+	device_id: text("device_id").notNull(),
+	device_ref: text("device_ref").notNull(),
+	key_fingerprint: text("key_fingerprint").notNull(),
+	display_name: text("display_name").notNull(),
+	enabled: integer("enabled", { mode: "boolean" }).notNull(),
+	existing_identity_id: text("existing_identity_id"),
+	existing_assignment_version: integer("existing_assignment_version"),
+	verified_evidence_kind: text("verified_evidence_kind"),
+	identity_evidence: text("identity_evidence"),
+	decision: text("decision").notNull().default("unresolved"),
+	target_identity_id: text("target_identity_id"),
+	expected_assignment_kind: text("expected_assignment_kind"),
+	expected_assignment_version: integer("expected_assignment_version"),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	primaryKey({ columns: [table.attempt_id, table.device_id] }),
+	uniqueIndex("idx_legacy_team_setup_devices_attempt_ref").on(table.attempt_id, table.device_ref),
+	index("idx_legacy_team_setup_devices_attempt_decision").on(table.attempt_id, table.decision)
+]);
+sqliteTable("legacy_team_setup_draft_projects", {
+	attempt_id: text("attempt_id").notNull().references(() => legacyTeamSetupDrafts.attempt_id, { onDelete: "cascade" }),
+	project_ref: text("project_ref").notNull(),
+	source_project_identity: text("source_project_identity").notNull(),
+	display_name: text("display_name").notNull(),
+	source_fingerprint: text("source_fingerprint").notNull(),
+	resolution_kind: text("resolution_kind").notNull().default("unresolved"),
+	resolved_project_identity: text("resolved_project_identity"),
+	target_scope_id: text("target_scope_id"),
+	updated_at: text("updated_at").notNull()
+}, (table) => [primaryKey({ columns: [table.attempt_id, table.project_ref] }), index("idx_legacy_team_setup_projects_attempt_resolution").on(table.attempt_id, table.resolution_kind)]);
+sqliteTable("recipient_managed_project_projections", {
+	canonical_project_identity: text("canonical_project_identity").notNull(),
+	display_name: text("display_name").notNull(),
+	managed_scope_id: text("managed_scope_id").notNull(),
+	coordinator_id: text("coordinator_id").notNull(),
+	group_id: text("group_id").notNull(),
+	recipient_identity_id: text("recipient_identity_id").notNull(),
+	accepting_device_id: text("accepting_device_id").notNull(),
+	source_operation_id: text("source_operation_id").notNull(),
+	reviewed_project_set_digest: text("reviewed_project_set_digest").notNull(),
+	status: text("status").notNull().default("active"),
+	accepted_at: text("accepted_at").notNull(),
+	revoked_at: text("revoked_at"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	primaryKey({ columns: [table.source_operation_id, table.canonical_project_identity] }),
+	index("idx_recipient_managed_projects_identity_status").on(table.recipient_identity_id, table.status),
+	index("idx_recipient_managed_projects_scope_authority").on(table.managed_scope_id, table.coordinator_id, table.group_id, table.status)
+]);
+sqliteTable("recipient_policy_authority_states", {
+	canonical_project_identity: text("canonical_project_identity").primaryKey(),
+	authority_state: text("authority_state").notNull().default("legacy"),
+	generation: integer("generation").notNull().default(0),
+	desired_devices_digest: text("desired_devices_digest"),
+	current_devices_digest: text("current_devices_digest"),
+	stable_parity_evidence_digest: text("stable_parity_evidence_digest"),
+	stable_parity_passed_at: text("stable_parity_passed_at"),
+	fresh_snapshot_fingerprint: text("fresh_snapshot_fingerprint"),
+	fresh_snapshot_observed_at: text("fresh_snapshot_observed_at"),
+	safe_error_code: text("safe_error_code"),
+	state_changed_at: text("state_changed_at").notNull(),
+	last_error_at: text("last_error_at"),
+	attempt_count: integer("attempt_count").notNull().default(0),
+	last_attempt_at: text("last_attempt_at"),
+	wake_epoch: integer("wake_epoch").notNull().default(0),
+	last_completed_at: text("last_completed_at"),
+	lease_owner: text("lease_owner"),
+	lease_acquired_at: text("lease_acquired_at"),
+	lease_expires_at: text("lease_expires_at"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+});
+sqliteTable("recipient_policy_reconciliation_steps", {
+	canonical_project_identity: text("canonical_project_identity").notNull(),
+	generation: integer("generation").notNull(),
+	step_key: text("step_key").notNull(),
+	effect_id: text("effect_id").notNull(),
+	payload_digest: text("payload_digest").notNull(),
+	status: text("status").notNull().default("pending"),
+	attempt_count: integer("attempt_count").notNull().default(0),
+	started_at: text("started_at"),
+	completed_at: text("completed_at"),
+	last_attempt_at: text("last_attempt_at"),
+	safe_error_code: text("safe_error_code"),
+	error_at: text("error_at"),
+	lease_owner: text("lease_owner"),
+	lease_acquired_at: text("lease_acquired_at"),
+	lease_expires_at: text("lease_expires_at"),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [
+	primaryKey({ columns: [
+		table.canonical_project_identity,
+		table.generation,
+		table.step_key
+	] }),
+	uniqueIndex("idx_recipient_policy_reconciliation_steps_effect").on(table.effect_id),
+	index("idx_recipient_policy_reconciliation_steps_status").on(table.canonical_project_identity, table.status),
+	index("idx_recipient_policy_reconciliation_steps_pending_refresh").on(table.canonical_project_identity, table.generation, table.step_key).where(sql`${table.status} IN ('pending', 'running', 'failed') AND ${table.step_key} GLOB 'refresh-after-revocations-v2:*'`)
+]);
+sqliteTable("recipient_policy_deny_overlays", {
+	canonical_project_identity: text("canonical_project_identity").notNull(),
+	scope_id: text("scope_id").notNull(),
+	device_id: text("device_id").notNull(),
+	generation: integer("generation").notNull(),
+	reason_code: text("reason_code").notNull(),
+	created_at: text("created_at").notNull(),
+	updated_at: text("updated_at").notNull()
+}, (table) => [primaryKey({ columns: [
+	table.canonical_project_identity,
+	table.scope_id,
+	table.device_id
+] }), index("idx_recipient_policy_deny_overlays_scope_device").on(table.scope_id, table.device_id)]);
+//#endregion
+//#region ../core/src/coordinator-owner-profile-files.ts
+function ownerDatabaseFile(path) {
+	const node = lstatSync(path, { bigint: true });
+	if (!node.isFile() || node.isSymbolicLink()) return ownerProfileConflict();
+	return `${node.dev}:${node.ino}`;
+}
+function ownerObject(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return ownerProfileConflict();
+	return value;
+}
+function assertFile(path, options = {}) {
+	const stat = lstatSync(path);
+	if (!stat.isFile() || stat.isSymbolicLink() || options.private && (stat.mode & 511) !== 384 || stat.size > 1048576) ownerProfileConflict();
+}
+function ownerFileSnapshot(path) {
+	assertFile(path);
+	const node = lstatSync(path, { bigint: true });
+	return {
+		text: readFileSync(path, "utf8"),
+		dev: String(node.dev),
+		ino: String(node.ino),
+		ctime: String(node.ctimeNs)
+	};
+}
+function readOwnerState(path) {
+	assertFile(path, { private: true });
+	return ownerObject(JSON.parse(readFileSync(path, "utf8")));
+}
+function syncDirectory(path) {
+	const fd = openSync(path, "r");
+	try {
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+/** Sync an existing POSIX directory without changing its permissions or contents. */
+function syncOwnerProfileDirectory(path) {
+	syncDirectory(path);
+}
+/** Durable, create-only publication; never overwrite a retained final request. */
+function retainOwnerState(path, value) {
+	const text = JSON.stringify(value);
+	if (text === void 0) ownerProfileConflict();
+	const staged = stageOwnerState(path, text);
+	linkSync(staged.path, path);
+	syncDirectory(dirname(path));
+	assertPublishedConfigLock(path, staged.snapshot);
+	assertPublishedConfigLock(staged.path, staged.snapshot);
+	unlinkSync(staged.path);
+	syncDirectory(dirname(path));
+}
+function stageOwnerState(path, text) {
+	const temporary = `${path}.tmp-${randomUUID()}`;
+	const fd = openSync(temporary, "wx", 384);
+	let identity;
+	let closeAttempted = false;
+	try {
+		const node = fstatSync(fd, { bigint: true });
+		identity = {
+			dev: String(node.dev),
+			ino: String(node.ino)
+		};
+		writeFileSync(fd, text);
+		fsyncSync(fd);
+		const snapshot = ownerFileSnapshot(temporary);
+		if (snapshot.dev !== identity.dev || snapshot.ino !== identity.ino || snapshot.text !== text) ownerProfileConflict();
+		syncDirectory(dirname(path));
+		closeAttempted = true;
+		closeSync(fd);
+		return {
+			path: temporary,
+			snapshot
+		};
+	} catch (error) {
+		if (identity) cleanupUnpublishedConfigLock(temporary, identity);
+		if (!closeAttempted) closeSync(fd);
+		throw error;
+	}
+}
+function cleanupUnpublishedConfigLock(path, identity) {
+	try {
+		const node = lstatSync(path, { bigint: true });
+		if (!node.isFile() || node.isSymbolicLink() || node.nlink !== 1n || String(node.dev) !== identity.dev || String(node.ino) !== identity.ino) return;
+		unlinkSync(path);
+	} catch {}
+}
+function assertPublishedConfigLock(path, staged) {
+	const current = ownerFileSnapshot(path);
+	if (current.dev !== staged.dev || current.ino !== staged.ino || current.text !== staged.text) ownerProfileConflict();
+	return current;
+}
+//#endregion
+//#region ../core/src/account-owner-association-directory.ts
+function accountOwnerAssociationDirectory() {
+	return join(homedir(), ".codemem", "account-owner-associations");
+}
+function checkDirectory(path, options = {}) {
+	try {
+		const stat = lstatSync(path);
+		const unsafeMode = options.private ? (stat.mode & 511) !== 448 : (stat.mode & 18) !== 0;
+		if (!stat.isDirectory() || stat.isSymbolicLink() || unsafeMode || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new Error("account_owner_association_invalid");
+		return true;
+	} catch (error) {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+/** Missing directories stay missing during reads. Never follow a state-directory symlink. */
+function readAccountOwnerAssociationDirectory(path) {
+	return checkDirectory(dirname(path)) && checkDirectory(path, { private: true });
+}
+function createDirectory(path) {
+	try {
+		mkdirSync(path, { mode: 448 });
+	} catch (error) {
+		if (!error || typeof error !== "object" || !("code" in error) || error.code !== "EEXIST") throw error;
+	}
+}
+/** Sync ancestors on every retry: an earlier mkdir may have become visible without its fsync. */
+function retainAccountOwnerAssociationDirectory(path) {
+	const parent = dirname(path);
+	createDirectory(parent);
+	if (!checkDirectory(parent)) throw new Error("account_owner_association_invalid");
+	syncOwnerProfileDirectory(dirname(parent));
+	createDirectory(path);
+	if (!checkDirectory(path, { private: true })) throw new Error("account_owner_association_invalid");
+	syncOwnerProfileDirectory(parent);
+}
+//#endregion
+//#region ../core/src/coordinator-auth-browser-style.ts
+/** Standalone auth pages mirror the Viewer's tokens without loading remote assets.
+* Keep these palette values aligned with ui/static/{tokens,themes}.css.
+* Separate origins cannot read the Viewer's saved theme; use the OS preference.
+*/
+var COORDINATOR_AUTH_STYLE = `
+:root{color-scheme:dark;--surface-0:#0b1016;--surface-1:#0f1720;--surface-2:#111c27;--text-primary:#e7f0f7;--text-secondary:#b7c5d3;--accent:#7ef0c2;--accent-hover:#9eff87;--border:rgba(126,240,194,.12);--border-strong:rgba(126,240,194,.28);--font-sans:"Geist",system-ui,-apple-system,sans-serif;--font-mono:"JetBrains Mono",ui-monospace,monospace;font-family:var(--font-sans);color:var(--text-primary);background:var(--surface-0)}
+*{box-sizing:border-box}body{margin:0;padding:clamp(1rem,5vw,4rem) 1rem;line-height:1.6}main{max-width:34rem;margin:0 auto;padding:clamp(1.25rem,4vw,2rem);border:1px solid var(--border-strong);border-radius:20px;background:var(--surface-1)}
+.brand{display:flex;align-items:center;gap:.6rem;margin:0 0 1.5rem;color:var(--accent);font-size:.875rem;font-weight:700;letter-spacing:.02em}.brand::before{content:"";width:.65rem;height:.65rem;border-radius:3px;background:var(--accent)}
+h1,h2{font-family:inherit;font-weight:600;line-height:1.25;letter-spacing:-.025em}h1{font-size:1.6rem;margin:0 0 1rem}h2{font-size:1.05rem;margin:0 0 .5rem}p{margin:.5rem 0}section{padding:1.25rem 0;border-bottom:1px solid var(--border)}.eyebrow{font-size:.75rem;letter-spacing:.08em;text-transform:uppercase;color:var(--text-secondary)}
+.profile{display:flex;align-items:center;gap:1rem}.profile-text{min-width:0;overflow-wrap:anywhere}.avatar{position:relative;display:inline-flex;align-items:center;justify-content:center;flex:0 0 3rem;width:3rem;height:3rem;border-radius:50%;background:var(--surface-2);color:var(--accent);overflow:hidden}.initials{font-weight:700}.avatar img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover}.note{font-size:.875rem;color:var(--text-secondary)}
+dl{margin:0}dt{font-size:.8rem;font-weight:600;color:var(--text-secondary);margin-top:1rem}dd{margin:.25rem 0 0}code{font-family:var(--font-mono);font-size:.8rem;overflow-wrap:anywhere;white-space:pre-wrap}
+.actions{display:flex;flex-wrap:wrap;gap:.75rem;margin:1.5rem 0 0}form{margin:0}button,.link{font:inherit;font-size:.875rem;font-weight:600;display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:.65rem 1rem;border:1px solid var(--border-strong);border-radius:10px;background:var(--accent);color:var(--surface-0);cursor:pointer;text-decoration:none}button.secondary{background:transparent;color:var(--accent)}a{color:var(--accent)}button:hover,.link:hover{background:var(--accent-hover);color:var(--surface-0)}:focus-visible{outline:3px solid var(--accent);outline-offset:4px}
+@media(prefers-color-scheme:light){:root{color-scheme:light;--surface-0:#f7faf8;--surface-1:#fff;--surface-2:#eef5f1;--text-primary:#0b1016;--text-secondary:#3f4d5c;--accent:#0f8a68;--accent-hover:#0a6f53;--border:rgba(15,138,104,.16);--border-strong:rgba(15,138,104,.3)}button,.link,button:hover,.link:hover{color:#fff}button.secondary{color:var(--accent)}button.secondary:hover{color:#fff}}
+@media(max-width:30rem){body{padding:1rem}.actions{flex-direction:column}.actions form,.actions button,.actions .link{width:100%}h1{font-size:1.4rem}}
+`;
+//#endregion
+//#region ../core/src/coordinator-account-link-receiver.ts
+function normalizeCoordinatorAccountLinkOrigin$1(value) {
+	if (typeof value !== "string") return null;
+	try {
+		const url = new URL(value);
+		if (!(url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "[::1]")) && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || value.includes("\\") || /[\s\p{Cc}]/u.test(value) || value.includes("?") || value.includes("#") || value !== url.origin && value !== `${url.origin}/`) return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+`${createHash("sha256").update(COORDINATOR_AUTH_STYLE).digest("base64")}`;
+//#endregion
+//#region ../core/src/account-owner-association.ts
+var PIN_FIELDS = [
+	"databaseFile",
+	"deviceId",
+	"keyId",
+	"fingerprint",
+	"actorId",
+	"coordinatorUrl",
+	"coordinatorId",
+	"groupId"
+];
+var REVIEW_FIELDS = [
+	"ownerIdentityId",
+	"attestationId",
+	"reviewDigest"
+];
+function invalidAssociation() {
+	throw new Error("account_owner_association_invalid");
+}
+function hash(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+/** Local context only, not authority. Does not inspect the running actor or its config. */
+function captureAccountOwnerProfilePins$1(profile) {
+	const origin = normalizeCoordinatorAccountLinkOrigin$1(profile.coordinatorUrl);
+	const key = parseSshEd25519PublicKey(profile.publicKey);
+	if (!origin || key.kind !== "ed25519" || !isAuthControllerId(profile.actorId) || !isAuthControllerId(profile.deviceId) || !isAuthControllerId(profile.groupId) || !isAuthControllerId(profile.coordinatorId) || typeof profile.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(profile.fingerprint)) return invalidAssociation();
+	return {
+		databaseFile: ownerDatabaseFile(profile.dbPath),
+		deviceId: profile.deviceId,
+		keyId: hash(key.blob),
+		fingerprint: profile.fingerprint,
+		actorId: profile.actorId,
+		coordinatorUrl: origin,
+		coordinatorId: profile.coordinatorId,
+		groupId: profile.groupId
+	};
+}
+var profilePins = captureAccountOwnerProfilePins$1;
+function ownData(value, fields) {
+	if (!value || typeof value !== "object") return invalidAssociation();
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return invalidAssociation();
+	const descriptors = Object.getOwnPropertyDescriptors(value);
+	if (Reflect.ownKeys(descriptors).length !== fields.length) return invalidAssociation();
+	return Object.fromEntries(fields.map((field) => {
+		const descriptor = descriptors[field];
+		if (!Object.hasOwn(descriptors, field) || !descriptor || !("value" in descriptor)) return invalidAssociation();
+		return [field, descriptor.value];
+	}));
+}
+function captureStoredPins(value) {
+	if (typeof value.databaseFile !== "string" || !/^(0|[1-9][0-9]*):(0|[1-9][0-9]*)$/.test(value.databaseFile) || !isAuthControllerId(value.deviceId) || !isAuthControllerId(value.actorId) || !isAuthControllerId(value.coordinatorId) || !isAuthControllerId(value.groupId) || typeof value.keyId !== "string" || !/^[a-f0-9]{64}$/.test(value.keyId) || typeof value.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(value.fingerprint) || typeof value.coordinatorUrl !== "string" || normalizeCoordinatorAccountLinkOrigin$1(value.coordinatorUrl) !== value.coordinatorUrl) return invalidAssociation();
+	return {
+		databaseFile: value.databaseFile,
+		deviceId: value.deviceId,
+		keyId: value.keyId,
+		fingerprint: value.fingerprint,
+		actorId: value.actorId,
+		coordinatorUrl: value.coordinatorUrl,
+		coordinatorId: value.coordinatorId,
+		groupId: value.groupId
+	};
+}
+function pinsMatch(value, expected) {
+	return PIN_FIELDS.every((field) => value[field] === expected[field]);
+}
+function captureStoredAssociation(input) {
+	const value = ownData(input, [
+		"version",
+		...PIN_FIELDS,
+		...REVIEW_FIELDS
+	]);
+	const pins = captureStoredPins(value);
+	if (value.version !== 1 || !isAuthControllerId(value.ownerIdentityId) || !isAuthControllerId(value.attestationId) || typeof value.reviewDigest !== "string" || !/^[a-f0-9]{64}$/.test(value.reviewDigest)) return invalidAssociation();
+	return {
+		version: 1,
+		...pins,
+		ownerIdentityId: value.ownerIdentityId,
+		attestationId: value.attestationId,
+		reviewDigest: value.reviewDigest
+	};
+}
+function associationPath(profile) {
+	const origin = normalizeCoordinatorAccountLinkOrigin$1(profile.coordinatorUrl);
+	if (!origin || !isAuthControllerId(profile.groupId)) return invalidAssociation();
+	const scope = hash(JSON.stringify([
+		origin,
+		profile.coordinatorId,
+		profile.groupId
+	])).slice(0, 32);
+	return `${resolve(profile.dbPath)}.account-owner-${scope}.json`;
+}
+function captureAssociation(value, profile) {
+	const record = captureStoredAssociation(value);
+	if (!pinsMatch(record, profilePins(profile))) return invalidAssociation();
+	return record;
+}
+function captureGeneration(profile, expected) {
+	const expectedPins = captureStoredPins(ownData(expected, PIN_FIELDS));
+	const dbPath = resolve(profile.dbPath);
+	const pins = profilePins({
+		...profile,
+		dbPath
+	});
+	if (!pinsMatch(pins, expectedPins)) return invalidAssociation();
+	const scope = hash(JSON.stringify([
+		pins.coordinatorUrl,
+		pins.coordinatorId,
+		pins.groupId
+	])).slice(0, 32);
+	const base = `${dbPath}.account-owner-${scope}`;
+	const generation = hash(JSON.stringify(pins));
+	const basenameBase = join(dirname(dbPath), `${hash(basename(dbPath))}.account-owner-${scope}`);
+	return {
+		dbPath,
+		pins,
+		legacyPath: `${base}.json`,
+		previousPaths: [`${base}-${generation}.json`, `${basenameBase}-${generation}.json`],
+		path: join(accountOwnerAssociationDirectory(), `.account-owner-${generation}.json`)
+	};
+}
+function assertGenerationCurrent(profile, context) {
+	try {
+		if (resolve(profile.dbPath) === context.dbPath && pinsMatch(profilePins(profile), context.pins)) return;
+	} catch {}
+	throw new Error("account_owner_association_context_changed_outcome_unknown");
+}
+function readStoredAssociation(path, options = {}) {
+	try {
+		lstatSync(path);
+	} catch (error) {
+		if (error && typeof error === "object" && "code" in error) {
+			if (error.code === "ENOENT") return null;
+			if (options.historicalPath && error.code === "ENAMETOOLONG") return null;
+		}
+		return invalidAssociation();
+	}
+	try {
+		const stat = lstatSync(path);
+		if (typeof process.getuid === "function" && stat.uid !== process.getuid()) return invalidAssociation();
+		return captureStoredAssociation(readOwnerState(path));
+	} catch {
+		return invalidAssociation();
+	}
+}
+function readGeneration(context) {
+	const legacy = readStoredAssociation(context.legacyPath, { historicalPath: true });
+	let found = null;
+	const paths = [...context.previousPaths];
+	if (readAccountOwnerAssociationDirectory(dirname(context.path))) paths.push(context.path);
+	for (const path of paths) {
+		const record = readStoredAssociation(path, { historicalPath: path !== context.path });
+		if (!record) continue;
+		if (!pinsMatch(record, context.pins)) return invalidAssociation();
+		if (found && JSON.stringify(found.record) !== JSON.stringify(record)) return invalidAssociation();
+		found = {
+			record,
+			path
+		};
+	}
+	if (found) return found;
+	if (legacy && pinsMatch(legacy, context.pins)) return {
+		record: legacy,
+		path: context.legacyPath
+	};
+	return null;
+}
+/**
+* Read without initializing the database, changing the actor, or granting access.
+* Expected pins opt trusted local callers into exact generations; omitted pins keep legacy behavior.
+*/
+function readAccountOwnerAssociation$1(profile, options) {
+	if (options?.expectedProfilePins !== void 0) {
+		const context = captureGeneration(profile, options.expectedProfilePins);
+		const record = readGeneration(context);
+		assertGenerationCurrent(profile, context);
+		return record?.record ?? null;
+	}
+	const path = associationPath(profile);
+	try {
+		lstatSync(path);
+	} catch (error) {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		return invalidAssociation();
+	}
+	try {
+		const stat = lstatSync(path);
+		if (typeof process.getuid === "function" && stat.uid !== process.getuid()) return invalidAssociation();
+		return captureAssociation(readOwnerState(path), profile);
+	} catch {
+		return invalidAssociation();
+	}
+}
+/**
+* Create-only publication after review; an exact retry never replaces prior owner evidence.
+* Generation checks cover this profile object and the DB file, not runtime actor/config state.
+* A future recovery service must check that state before and after calling this helper.
+* Pathname replacement and restoration between checks is not detected atomically.
+*/
+function retainAccountOwnerAssociation(profile, input, options) {
+	const review = ownData(input, REVIEW_FIELDS);
+	if (options?.expectedProfilePins !== void 0) return retainGeneration(profile, review, captureGeneration(profile, options.expectedProfilePins));
+	const record = captureAssociation({
+		version: 1,
+		...profilePins(profile),
+		...review
+	}, profile);
+	const existing = readAccountOwnerAssociation$1(profile);
+	if (existing) {
+		if (JSON.stringify(existing) !== JSON.stringify(record)) return invalidAssociation();
+		syncOwnerProfileDirectory(dirname(associationPath(profile)));
+		return existing;
+	}
+	try {
+		retainOwnerState(associationPath(profile), record);
+	} catch (error) {
+		if (!error || typeof error !== "object" || !("code" in error) || error.code !== "EEXIST") return invalidAssociation();
+	}
+	const retained = readAccountOwnerAssociation$1(profile);
+	if (!retained || JSON.stringify(retained) !== JSON.stringify(record)) return invalidAssociation();
+	syncOwnerProfileDirectory(dirname(associationPath(profile)));
+	return retained;
+}
+function retainGeneration(profile, review, context) {
+	const record = captureStoredAssociation({
+		version: 1,
+		...context.pins,
+		...review
+	});
+	const existing = readGeneration(context);
+	assertGenerationCurrent(profile, context);
+	if (existing && JSON.stringify(existing.record) !== JSON.stringify(record)) return invalidAssociation();
+	retainAccountOwnerAssociationDirectory(dirname(context.path));
+	assertGenerationCurrent(profile, context);
+	if (existing?.path === context.path) {
+		syncOwnerProfileDirectory(dirname(context.path));
+		assertGenerationCurrent(profile, context);
+		return existing.record;
+	}
+	try {
+		retainOwnerState(context.path, record);
+	} catch (error) {
+		if (!error || typeof error !== "object" || !("code" in error) || error.code !== "EEXIST") return invalidAssociation();
+	}
+	assertGenerationCurrent(profile, context);
+	const retained = readGeneration(context);
+	if (!retained || JSON.stringify(retained.record) !== JSON.stringify(record)) return invalidAssociation();
+	syncOwnerProfileDirectory(dirname(context.path));
+	assertGenerationCurrent(profile, context);
+	return retained.record;
+}
+//#endregion
+//#region src/account/owner-recovery-candidates.ts
+function historyRows(response) {
+	const history = response?.legacy_history;
+	return Array.isArray(history) ? history : [];
+}
+/** Return [identity, group] pairs for this device, or none when the record is unreadable. */
+function recordedOwners(row, deviceId) {
+	const record = row;
+	const groupId = record?.group_id;
+	if (!recoveryId(groupId)) return [];
+	let manifest;
+	try {
+		manifest = normalizeCoordinatorLegacyTeamCompletionManifest(record?.manifest);
+	} catch {
+		return [];
+	}
+	return manifest.device_decisions.flatMap((decision) => {
+		const identityId = decision.identity_id;
+		if (decision.device_id !== deviceId || !recoveryId(identityId)) return [];
+		if (!legacyDecisionCountsAsOwner(decision)) return [];
+		return [[identityId, groupId]];
+	});
+}
+/** Map each Identity recorded for this device to the groups whose Team history records it. */
+function recordedOwnerGroups(responses, device) {
+	const owners = /* @__PURE__ */ new Map();
+	const pairs = responses.flatMap(historyRows).flatMap((row) => recordedOwners(row, device.deviceId));
+	for (const [identityId, groupId] of pairs) owners.set(identityId, /* @__PURE__ */ new Set([...owners.get(identityId) ?? [], groupId]));
+	return owners;
+}
+var MAX_LABEL_LENGTH = 256;
+var LISTED_GROUPS = 3;
+function candidateLabel(prefix, groups) {
+	const sorted = [...groups].sort();
+	const listed = sorted.slice(0, LISTED_GROUPS).join(", ");
+	const more = sorted.length - LISTED_GROUPS;
+	const label = `${prefix} recorded for this device in ${more > 0 ? `${listed} and ${more} more` : listed}`;
+	if (label.length <= MAX_LABEL_LENGTH) return label;
+	return `${prefix} recorded for this device in ${sorted.length === 1 ? "1 group" : `${sorted.length} groups`}`;
+}
+var MAX_CANDIDATES = 256;
+function candidateList(owners, currentIdentityId) {
+	const rank = (id) => id === currentIdentityId ? 0 : 1;
+	return [...owners.entries()].sort(([left], [right]) => rank(left) - rank(right) || left.localeCompare(right)).slice(0, MAX_CANDIDATES).map(([id, groups]) => {
+		return {
+			id,
+			label: candidateLabel(id === currentIdentityId ? "This profile's Identity," : "Identity", [...groups])
+		};
+	});
+}
+/**
+* The coordinator returns this device's history across all groups once it finds an
+* enrollment. It hides the enrollment on an identity mismatch but still sends the
+* history, so non-empty history also counts as complete.
+*/
+function hasCompleteHistory(response) {
+	const row = response;
+	return row?.enrollment !== null && typeof row?.enrollment === "object" || historyRows(response).length > 0;
+}
+/**
+* Suggest owners from read-only coordinator previews of this device's current review.
+* Suggestions are display hints: the scoped owner preview still checks the chosen ID.
+*
+* Previews share the coordinator's admin review rate limit with the owner preview and
+* confirmation. History is filtered by device, not group, so this asks one group at a
+* time and stops at the first enrolled group instead of spending one request per group.
+*/
+async function readRecoveryCandidates(options) {
+	const { device } = options;
+	const responses = [];
+	for (const groupId of options.groups) {
+		let response;
+		try {
+			response = await options.previewDeviceOwner({
+				remoteUrl: options.remoteUrl,
+				adminSecret: options.adminSecret,
+				groupId,
+				deviceId: device.deviceId,
+				fingerprint: device.fingerprint,
+				identityId: device.identityId
+			});
+		} catch {
+			continue;
+		}
+		responses.push(response);
+		if (hasCompleteHistory(response)) break;
+	}
+	return candidateList(recordedOwnerGroups(responses, device), device.identityId);
+}
+//#endregion
+//#region src/account/owner-recovery-context.ts
+function recoverySha(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function captureDevice(context) {
+	const before = statSync(context.dbPath, { bigint: true });
+	const device = readAccountLinkDevice(context.dbPath);
+	const publicKey = loadPublicKey(context.keysDir);
+	const after = statSync(context.dbPath, { bigint: true });
+	requireRecovery(before.isFile() && before.dev === after.dev && before.ino === after.ino && after.dev.toString() === context.fileIdentity.dev && after.ino.toString() === context.fileIdentity.ino && device.deviceId === context.deviceId && device.fingerprint === context.fingerprint && recoverySha(device.publicKey) === context.publicKeyHash && publicKey === device.publicKey);
+	return device.publicKey;
+}
+function captureRecoveryContext(readContext) {
+	let result = readContext();
+	requireRecovery(!("error" in result) && result.groups.length > 0 && result.groups.length <= 25);
+	if (!result.context) result = readContext(result.groups[0]);
+	requireRecovery(!("error" in result) && result.setup === "ready" && result.context);
+	const context = structuredClone(result.context);
+	const groups = [...result.groups].sort();
+	requireRecovery(groups.every(recoveryId) && new Set(groups).size === groups.length && recoveryId(context.identityId));
+	return {
+		context,
+		groups,
+		publicKey: captureDevice(context),
+		semanticId: recoverySha(JSON.stringify([
+			resolve(context.dbPath),
+			context.keysDir === void 0 ? null : resolve(context.keysDir),
+			context.configPath === void 0 ? null : resolve(context.configPath),
+			context.fileIdentity,
+			context.identityId,
+			context.deviceId,
+			context.publicKeyHash,
+			context.fingerprint,
+			context.coordinatorUrl,
+			groups
+		]))
+	};
+}
+function recoveryProfile(capture, coordinatorId) {
+	const context = capture.context;
+	return {
+		contextId: recoverySha(JSON.stringify([capture.semanticId, coordinatorId])),
+		memoryActorId: context.identityId,
+		deviceId: context.deviceId,
+		fingerprint: context.fingerprint,
+		coordinatorOrigin: context.coordinatorUrl,
+		coordinatorId,
+		configuredGroups: [...capture.groups]
+	};
+}
+function assertRecoverySelection(selection, expected) {
+	requireRecovery(JSON.stringify(selection.profile) === JSON.stringify(expected) && recoveryId(selection.existingOwnerId) && Array.isArray(selection.groups) && selection.groups.length > 0 && selection.groups.length <= 25 && new Set(selection.groups).size === selection.groups.length && selection.groups.every((group) => expected.configuredGroups.includes(group)));
+}
+function recoveryDestinations(capture, coordinatorId) {
+	return new Map(capture.groups.map((groupId) => {
+		const profile = {
+			dbPath: capture.context.dbPath,
+			deviceId: capture.context.deviceId,
+			publicKey: capture.publicKey,
+			fingerprint: capture.context.fingerprint,
+			actorId: capture.context.identityId,
+			coordinatorUrl: capture.context.coordinatorUrl,
+			coordinatorId,
+			groupId
+		};
+		return [groupId, {
+			profile,
+			pins: captureAccountOwnerProfilePins(profile)
+		}];
+	}));
+}
+function assertNoCompetingOwner(destinations, ownerIdentityId) {
+	for (const { profile, pins } of destinations.values()) {
+		const existing = readAccountOwnerAssociation(profile, { expectedProfilePins: pins });
+		requireRecovery(!existing || existing.ownerIdentityId === ownerIdentityId);
+	}
+}
+//#endregion
+//#region src/account/owner-recovery-service.ts
+var CANDIDATE_TTL_MS = 6e4;
+function groupAction(state) {
+	if (state === "ready") return "new";
+	if (state === "restored") return "reuse";
+	return "blocked";
+}
+function uniqueRows(rows) {
+	return [...new Map(rows.map((row) => [JSON.stringify(row), row])).values()];
+}
+function staleDenial(error) {
+	return error instanceof Error && "status" in error && error.status === 409 && "code" in error && error.code === "review_stale";
+}
+/** No routes or configuration composition: these callbacks are private server capabilities. */
+var AccountOwnerRecoveryService = class {
+	#options;
+	#handles = /* @__PURE__ */ new Map();
+	#candidateCache;
+	#reservations = /* @__PURE__ */ new Set();
+	#controller = new AbortController();
+	#closed = false;
+	constructor(options) {
+		this.#options = options;
+	}
+	#now() {
+		return (this.#options.now ?? Date.now)();
+	}
+	#assertCurrent(capture, reservation) {
+		requireRecovery(!this.#closed, "unavailable");
+		requireRecovery(!reservation || reservation.isCurrent(), "context_changed");
+		requireRecovery(captureRecoveryContext(this.#options.readContext).semanticId === capture.semanticId && !this.#closed && (!reservation || reservation.isCurrent()), "context_changed");
+	}
+	#capture() {
+		requireRecovery(!this.#closed, "unavailable");
+		const capture = captureRecoveryContext(this.#options.readContext);
+		this.#assertCurrent(capture);
+		return capture;
+	}
+	async #discover(capture) {
+		this.#assertCurrent(capture);
+		const c = capture.context;
+		const response = await (this.#options.readRemoteStatus ?? readCoordinatorAccountLinkStatus)({
+			dbPath: c.dbPath,
+			keysDir: c.keysDir,
+			coordinatorUrl: c.coordinatorUrl,
+			groupId: c.groupId,
+			identityId: c.identityId,
+			signal: this.#controller.signal
+		});
+		this.#assertCurrent(capture);
+		requireRecovery(response.kind === "status" && recoveryId(response.status.coordinatorId) && response.status.deviceId === c.deviceId && response.status.fingerprint === c.fingerprint && response.status.groupId === c.groupId, "unavailable");
+		return response.status.coordinatorId;
+	}
+	async getProfile() {
+		const capture = this.#capture();
+		const coordinatorId = await this.#discover(capture);
+		this.#assertCurrent(capture);
+		const adminSecret = this.#options.readAdminSecret();
+		const candidates = adminSecret ? await this.#candidates(capture, adminSecret) : [];
+		this.#assertCurrent(capture);
+		return {
+			version: 1,
+			profile: recoveryProfile(capture, coordinatorId),
+			reviewAccess: adminSecret ? "operator" : "request",
+			candidates
+		};
+	}
+	async #candidates(capture, adminSecret) {
+		const cached = this.#candidateCache;
+		if (cached?.semanticId === capture.semanticId && this.#now() - cached.at < CANDIDATE_TTL_MS) return structuredClone(cached.candidates);
+		const c = capture.context;
+		const candidates = await readRecoveryCandidates({
+			previewDeviceOwner: this.#options.previewDeviceOwner ?? coordinatorAuthControllerReviewAction,
+			remoteUrl: c.coordinatorUrl,
+			adminSecret,
+			groups: capture.groups,
+			device: {
+				deviceId: c.deviceId,
+				fingerprint: c.fingerprint,
+				identityId: c.identityId
+			}
+		});
+		this.#assertCurrent(capture);
+		this.#candidateCache = {
+			semanticId: capture.semanticId,
+			at: this.#now(),
+			candidates
+		};
+		return structuredClone(candidates);
+	}
+	#reviewInput(capture, selection, groupId) {
+		const adminSecret = this.#options.readAdminSecret();
+		requireRecovery(typeof adminSecret === "string" && adminSecret.length > 0);
+		this.#assertCurrent(capture);
+		return {
+			remoteUrl: capture.context.coordinatorUrl,
+			adminSecret,
+			purpose: "existing_account_owner",
+			resolutionScope: RECOVERY_SCOPE,
+			groupId,
+			deviceId: capture.context.deviceId,
+			fingerprint: capture.context.fingerprint,
+			identityId: selection.existingOwnerId
+		};
+	}
+	async #previewReview(entry, groupId) {
+		const input = this.#reviewInput(entry.capture, entry.preview, groupId);
+		this.#assertCurrent(entry.capture);
+		const raw = await (this.#options.reviewOwner ?? coordinatorAuthControllerReviewAction)(input);
+		this.#assertCurrent(entry.capture);
+		const evidence = structuredClone(raw);
+		entry.reviews.set(groupId, validateRecoveryReview(evidence, entry.preview, groupId));
+		entry.evidence.set(groupId, evidence);
+	}
+	#newReview(request, capture) {
+		return {
+			capture,
+			destinations: recoveryDestinations(capture, request.profile.coordinatorId),
+			purpose: request.purpose,
+			createdAt: this.#now(),
+			reviews: /* @__PURE__ */ new Map(),
+			evidence: /* @__PURE__ */ new Map(),
+			preview: {
+				...structuredClone(request),
+				scope: RECOVERY_SCOPE,
+				approvalDigest: randomBytes(32).toString("hex"),
+				groupPreviews: [],
+				history: {
+					complete: false,
+					rows: [],
+					operatorHelp: "Ask the coordinator operator to review the existing account owner and provide receipt references."
+				},
+				reviewedWeakLabels: []
+			}
+		};
+	}
+	#projectReviews(entry) {
+		const reviews = [...entry.reviews.values()];
+		entry.preview.history = {
+			complete: true,
+			rows: uniqueRows(reviews.flatMap((review) => review.rows))
+		};
+		entry.preview.reviewedWeakLabels = uniqueRows(reviews.flatMap((review) => review.labels));
+		entry.preview.groupPreviews = entry.preview.groups.map((groupId) => {
+			const review = entry.reviews.get(groupId);
+			requireRecovery(review);
+			return {
+				groupId,
+				action: groupAction(review.state),
+				reason: review.state === "needs_review" ? review.reasons.join("; ") : "Fresh coordinator owner review."
+			};
+		});
+	}
+	#retainHandle(entry) {
+		for (const [key, value] of this.#handles) if (this.#now() - value.createdAt >= 3e5) this.#handles.delete(key);
+		while (this.#handles.size >= 16) {
+			const oldest = this.#handles.keys().next().value;
+			requireRecovery(oldest);
+			this.#handles.delete(oldest);
+		}
+		this.#handles.set(entry.preview.approvalDigest, entry);
+		return structuredClone(entry.preview);
+	}
+	async preview(request) {
+		const capture = this.#capture();
+		const coordinatorId = await this.#discover(capture);
+		this.#assertCurrent(capture);
+		assertRecoverySelection(request, recoveryProfile(capture, coordinatorId));
+		requireRecovery(recoveryId(request.requestId) && (request.purpose === "review" || request.purpose === "check_status"));
+		const entry = this.#newReview(request, capture);
+		const admin = this.#options.readAdminSecret();
+		this.#assertCurrent(capture);
+		if (admin) {
+			for (const groupId of entry.preview.groups) await this.#previewReview(entry, groupId);
+			this.#projectReviews(entry);
+		} else await this.#requestAssistance(entry);
+		this.#assertCurrent(capture);
+		return this.#retainHandle(entry);
+	}
+	async #requestAssistance(entry) {
+		for (const groupId of entry.preview.groups) {
+			this.#assertCurrent(entry.capture);
+			await (this.#options.readRemoteOwnerStatus ?? readCoordinatorResolvedAccountOwnerStatus)({
+				...entry.capture.context,
+				groupId,
+				ownerIdentityId: entry.preview.existingOwnerId,
+				signal: this.#controller.signal
+			});
+			this.#assertCurrent(entry.capture);
+		}
+		entry.preview.groupPreviews = entry.preview.groups.map((groupId) => ({
+			groupId,
+			action: "blocked",
+			reason: "An operator must review the full retained history."
+		}));
+	}
+	#reserve() {
+		requireRecovery(!this.#closed, "unavailable");
+		const reservation = this.#options.registry.tryReserveRecovery?.();
+		requireRecovery(reservation, "busy");
+		requireRecovery(reservation.isCurrent(), "context_changed");
+		this.#reservations.add(reservation);
+		return reservation;
+	}
+	#release(reservation) {
+		reservation.release();
+		this.#reservations.delete(reservation);
+	}
+	async confirm(input) {
+		requireRecovery(!this.#closed, "unavailable");
+		const entry = this.#handles.get(input.approvalDigest);
+		requireRecovery(entry && JSON.stringify(entry.preview) === JSON.stringify(input.preview));
+		if (entry.outcome) return structuredClone(await entry.outcome);
+		requireRecovery(this.#now() - entry.createdAt < 3e5 && entry.purpose === "review" && entry.preview.history.complete && entry.preview.groupPreviews.every((group) => group.action !== "blocked"));
+		const reservation = this.#reserve();
+		entry.outcome = this.#applyReview(entry, reservation).finally(() => this.#release(reservation));
+		return structuredClone(await entry.outcome);
+	}
+	async #applyReview(entry, reservation) {
+		this.#assertCurrent(entry.capture, reservation);
+		assertNoCompetingOwner(entry.destinations, entry.preview.existingOwnerId);
+		this.#assertCurrent(entry.capture, reservation);
+		const groups = [];
+		let verifiedReceipt;
+		for (const groupId of entry.preview.groups) {
+			const applied = await this.#applyGroup(entry, groupId, reservation, { verifiedReceipt });
+			groups.push(applied.outcome);
+			verifiedReceipt ??= applied.verifiedReceipt;
+		}
+		return {
+			preview: structuredClone(entry.preview),
+			groups
+		};
+	}
+	async #confirmNew(entry, groupId, reservation) {
+		const review = entry.reviews.get(groupId);
+		requireRecovery(review?.digest);
+		const input = this.#reviewInput(entry.capture, entry.preview, groupId);
+		this.#assertCurrent(entry.capture, reservation);
+		const raw = await (this.#options.reviewOwner ?? coordinatorAuthControllerReviewAction)({
+			...input,
+			confirmOwnerResolutionDigest: review.digest,
+			assertBeforeOwnerResolutionConfirm: () => this.#assertCurrent(entry.capture, reservation)
+		});
+		this.#assertCurrent(entry.capture, reservation);
+		const confirmed = validateRecoveryReview(structuredClone(raw), entry.preview, groupId);
+		requireRecovery(confirmed.state === "ready" && confirmed.digest === review.digest && confirmed.receipt);
+		return confirmed.receipt;
+	}
+	async #applyGroup(entry, groupId, reservation, options) {
+		try {
+			this.#assertCurrent(entry.capture, reservation);
+			const review = entry.reviews.get(groupId);
+			requireRecovery(review && review.state !== "needs_review");
+			let receipt = options.verifiedReceipt ?? review.receipt;
+			if (!options.verifiedReceipt && review.state === "ready") receipt = await this.#confirmNew(entry, groupId, reservation);
+			this.#assertCurrent(entry.capture, reservation);
+			requireRecovery(receipt);
+			const outcome = await this.#verifyAndRetain(entry, groupId, receipt, reservation, { afterRemoteConfirmation: Boolean(options.verifiedReceipt) || review.state === "ready" });
+			if (outcome.status !== "confirmed") return { outcome };
+			return {
+				outcome,
+				verifiedReceipt: structuredClone(receipt)
+			};
+		} catch (error) {
+			return { outcome: {
+				groupId,
+				status: staleDenial(error) ? "failed" : "unknown",
+				message: "Check coordinator status or import original receipts before trying again."
+			} };
+		}
+	}
+	async #verifyAndRetain(entry, groupId, receipt, reservation, options = {}) {
+		this.#assertCurrent(entry.capture, reservation);
+		const response = await (this.#options.readRemoteReceiptStatus ?? readCoordinatorResolvedAccountOwnerReceiptStatus)({
+			dbPath: entry.capture.context.dbPath,
+			keysDir: entry.capture.context.keysDir,
+			coordinatorUrl: entry.capture.context.coordinatorUrl,
+			groupId,
+			ownerIdentityId: entry.preview.existingOwnerId,
+			receipt: structuredClone(receipt),
+			signal: this.#controller.signal
+		});
+		this.#assertCurrent(entry.capture, reservation);
+		if (!this.#validOwnerProof(response, entry, groupId)) return {
+			groupId,
+			status: options.afterRemoteConfirmation ? "unknown" : "failed",
+			message: "The original owner receipt could not be verified with a linked account."
+		};
+		this.#publish(entry, groupId, receipt, reservation);
+		return {
+			groupId,
+			status: "confirmed",
+			message: "Verified existing owner context retained; memory authorship is unchanged."
+		};
+	}
+	#validOwnerProof(response, entry, groupId) {
+		if (response.kind !== "owner_status") return false;
+		const status = response.status, p = entry.preview.profile;
+		return status.version === 1 && status.coordinatorId === p.coordinatorId && status.groupId === groupId && status.deviceId === p.deviceId && status.fingerprint === p.fingerprint && status.state === "owner_confirmed" && status.ownerIdentity === entry.preview.existingOwnerId && status.profileState === "linked" && status.profile !== null && typeof status.profile === "object" && !Array.isArray(status.profile);
+	}
+	#publish(entry, groupId, receipt, reservation) {
+		this.#assertCurrent(entry.capture, reservation);
+		assertNoCompetingOwner(entry.destinations, entry.preview.existingOwnerId);
+		const destination = entry.destinations.get(groupId);
+		requireRecovery(destination);
+		const { profile, pins } = destination;
+		const existing = readAccountOwnerAssociation(profile, { expectedProfilePins: pins });
+		this.#assertCurrent(entry.capture, reservation);
+		if (!existing) retainAccountOwnerAssociation(profile, {
+			ownerIdentityId: entry.preview.existingOwnerId,
+			attestationId: receipt.attestationId,
+			reviewDigest: receipt.reviewEvidenceDigest
+		}, { expectedProfilePins: pins });
+		this.#assertCurrent(entry.capture, reservation);
+	}
+	async importReply(input) {
+		const reservation = this.#reserve();
+		try {
+			const capture = this.#capture();
+			const coordinatorId = await this.#discover(capture);
+			this.#assertCurrent(capture, reservation);
+			assertRecoverySelection(input.selection, recoveryProfile(capture, coordinatorId));
+			const receipts = parseRecoveryReply(input.replyText, input.selection);
+			const entry = this.#newReview({
+				...input.selection,
+				requestId: randomBytes(16).toString("hex"),
+				purpose: "review"
+			}, capture);
+			assertNoCompetingOwner(entry.destinations, entry.preview.existingOwnerId);
+			const groups = [];
+			for (const [groupId, receipt] of receipts) groups.push(await this.#importGroup(entry, groupId, receipt, reservation));
+			return {
+				preview: entry.preview,
+				groups
+			};
+		} finally {
+			this.#release(reservation);
+		}
+	}
+	async #importGroup(entry, groupId, receipt, reservation) {
+		try {
+			return await this.#verifyAndRetain(entry, groupId, receipt, reservation);
+		} catch {
+			return {
+				groupId,
+				status: "unknown",
+				message: "Context or proof outcome changed; check status before importing again."
+			};
+		}
+	}
+	async close() {
+		this.#closed = true;
+		this.#controller.abort();
+		this.#handles.clear();
+		for (const reservation of this.#reservations) this.#release(reservation);
+	}
+};
+function createAccountOwnerRecoveryService(options) {
+	return new AccountOwnerRecoveryService(options);
+}
+//#endregion
+//#region src/account/rebind.ts
+/**
+* Viewer side of "Sign in with Google" when the account belongs to another
+* Identity (ADR 0005 Section 8): run the coordinator rebind, then switch this
+* device's local Identity. An unclear outcome stays recorded and resumes.
+*/
+/** Pins the local facts the person reviewed; the coordinator stores and signs it. */
+function reviewDigest(store, context) {
+	const binding = store.db.prepare("SELECT identity_id, assignment_version FROM identity_devices WHERE device_id = ?").get(context.deviceId);
+	const localActors = store.db.prepare("SELECT actor_id FROM actors WHERE is_local = 1 ORDER BY actor_id").pluck().all();
+	return createHash("sha256").update(JSON.stringify([
+		"codemem-device-rebind-review-v1",
+		context.deviceId,
+		context.fingerprint,
+		context.identityId,
+		binding ?? null,
+		localActors
+	])).digest("hex");
+}
+/**
+* Finishes the local half from a coordinator receipt. Each step is
+* idempotent, so a later resume can repeat it.
+*/
+function finishLocalSwitch(store, paths, attemptId, receipt) {
+	try {
+		if (receipt) markLocalIdentitySwitchBound(store.db, receipt);
+		const context = { configPath: paths.configPath };
+		applyLocalIdentitySwitch(store.db, {
+			attemptId,
+			displayName: store.actorDisplayName,
+			expectedPublicKey: loadPublicKey(paths.keysDir) ?? ""
+		}, context);
+		completeLocalIdentitySwitch(store.db, {
+			attemptId,
+			configPath: paths.configPath
+		});
+		const target = readTarget(store, attemptId);
+		if (!target || !store.refreshPersistedLocalIdentity(target)) return { kind: "pending" };
+		return {
+			kind: "switched",
+			targetIdentityId: target
+		};
+	} catch {
+		return { kind: "pending" };
+	}
+}
+function readTarget(store, attemptId) {
+	const row = store.db.prepare("SELECT target_identity_id FROM local_identity_switches WHERE attempt_id = ? AND state = 'completed'").pluck().get(attemptId);
+	return typeof row === "string" ? row : null;
+}
+function createAccountRebindRunner(store) {
+	return async ({ context, signal, onBrowserStart, isCurrent = () => true }) => {
+		try {
+			assertNoLocalIdentityOverride();
+		} catch {
+			return { kind: "failed" };
+		}
+		const earlier = await resolveOpenSwitch(store, context);
+		if (earlier) return earlier;
+		const recorded = {};
+		return settleOutcome(store, context, await runRebind(store, context, {
+			signal,
+			onBrowserStart,
+			recorded,
+			isCurrent
+		}), recorded.attemptId);
+	};
+}
+/** An earlier switch left open is resolved first; no new Google trip until it is. */
+async function resolveOpenSwitch(store, context) {
+	if (!readOpenLocalIdentitySwitch(store.db)) return null;
+	const resumed = await resumeAccountRebind(store, context);
+	if (resumed?.kind === "switched") return resumed;
+	return readOpenLocalIdentitySwitch(store.db) ? { kind: "pending" } : null;
+}
+/**
+* A refusal or failure means this run's finalize did not commit, and nothing
+* else sends it, so the attempt this run recorded can close at once.
+*/
+function settleOutcome(store, context, outcome, recordedAttemptId) {
+	if ((outcome.kind === "refused" || outcome.kind === "failed") && recordedAttemptId) markLocalIdentitySwitchNotCommitted(store.db, recordedAttemptId);
+	if (outcome.kind === "refused") return {
+		kind: "refused",
+		reason: outcome.reason,
+		...outcome.beforeBrowser ? { beforeBrowser: true } : {}
+	};
+	if (outcome.kind === "failed") return { kind: "failed" };
+	if (outcome.kind === "unknown") return isSelfBind(outcome.pending) ? { kind: "bind_unknown" } : { kind: "pending" };
+	if (isSelfBind(outcome.receipt)) return { kind: "bound" };
+	return finishLocalSwitch(store, context, outcome.receipt.attemptId, outcome.receipt);
+}
+/** A self-bind keeps this device's Identity, so it has no local switch. */
+function isSelfBind(attempt) {
+	return attempt.targetIdentityId === attempt.previousIdentityId;
+}
+function runRebind(store, context, run) {
+	return runDeviceRebind({
+		dbPath: context.dbPath,
+		keysDir: context.keysDir,
+		coordinatorUrl: context.coordinatorUrl,
+		groupId: context.groupId,
+		currentIdentityId: context.identityId,
+		reviewDigest: reviewDigest(store, context),
+		openBrowser: run.onBrowserStart,
+		recordPending: (pending) => {
+			if (!run.isCurrent()) throw new Error("device_rebind_context_changed");
+			if (reviewDigest(store, context) !== pending.reviewDigest) throw new Error("device_rebind_review_changed");
+			if (isSelfBind(pending)) return;
+			recordLocalIdentitySwitch(store.db, pending, { configPath: context.configPath });
+			run.recorded.attemptId = pending.attemptId;
+		},
+		signal: run.signal
+	});
+}
+/**
+* Picks up a switch an earlier run left open. A recorded attempt is resolved
+* by reading coordinator status, never by sending finalize again.
+*/
+async function resumeAccountRebind(store, paths) {
+	const open = readOpenLocalIdentitySwitch(store.db);
+	if (!open) return null;
+	if (open.state !== "pending") return finishLocalSwitch(store, paths, open.attemptId);
+	const resumed = await resumeDeviceRebind({
+		dbPath: store.dbPath,
+		keysDir: paths.keysDir,
+		coordinatorUrl: open.coordinatorOrigin,
+		groupId: open.groupId,
+		pending: open
+	});
+	if (resumed.kind === "finalized") return finishLocalSwitch(store, paths, open.attemptId, resumed.receipt);
+	if (resumed.kind === "not_committed") {
+		markLocalIdentitySwitchNotCommitted(store.db, open.attemptId);
+		return { kind: "failed" };
+	}
+	return { kind: "pending" };
+}
+//#endregion
+//#region src/index.ts
+/**
+* @codemem/server — HTTP server (viewer, sync, API).
+*
+* Single HTTP server handling viewer routes and sync daemon.
+* Shares one better-sqlite3 connection between viewer and sync.
+* Embedding inference runs in a worker_thread (lazy-started).
 *
 * Entry: `codemem serve`
 */
 /** Shared store instance — SQLite WAL mode handles concurrent reads safely. */
 var sharedStore = null;
+var sharedStoreClosePromise = null;
 /** Get (or create) the shared store instance. Exported so the sweeper can share it. */
 function getStore() {
 	if (!sharedStore) sharedStore = new MemoryStore(resolveDbPath());
 	return sharedStore;
 }
-/** Close the shared store (called on shutdown). */
+/** Close a synchronous-only shared store. Async pack owners use closeStoreAsync(). */
 function closeStore() {
 	sharedStore?.close();
 	sharedStore = null;
 }
+/** Drain semantic work before closing SQLite and releasing the shared store. */
+function closeStoreAsync() {
+	if (sharedStoreClosePromise) return sharedStoreClosePromise;
+	if (!sharedStore) return Promise.resolve();
+	const store = sharedStore;
+	sharedStoreClosePromise = store.closeAsync().then(() => {
+		if (sharedStore === store) sharedStore = null;
+		sharedStoreClosePromise = null;
+	});
+	return sharedStoreClosePromise;
+}
 function registerStaticRoutes(app) {
 	const staticRoot = process.env.CODEMEM_VIEWER_STATIC_DIR ?? join(import.meta.dirname ?? ".", "../static");
 	app.use("/assets/*", async (c, next) => {
@@ -13761,6 +16823,7 @@ function registerAccountRoutes(app, options) {
 	const account = createAccountGuard(options);
 	app.use("*", account.middleware);
 	app.route("/", account.routes);
+	if (options.ownerRecovery) app.route("/", accountOwnerRecoveryRoutes(options.ownerRecovery));
 	if (options.readContext) app.route("/", accountStatusRoutes({
 		...options,
 		readContext: options.readContext
@@ -13784,6 +16847,7 @@ function createApp(opts) {
 	const viewerTargetGuard = viewerTargetQueryGuard(storeFactory);
 	app.use("/api/memories/*", viewerTargetGuard);
 	app.use("/api/memory", viewerTargetGuard);
+	app.use("/api/pi/sessions/search", viewerTargetGuard);
 	app.route("/", healthRoutes(storeFactory));
 	app.route("/", diagnosticsRoutes(storeFactory));
 	app.route("/", statsRoutes(storeFactory));
@@ -13845,6 +16909,6 @@ function createSyncApp(opts) {
 	return app;
 }
 //#endregion
-export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, createAccountContextReader, createAccountLinkRegistry, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory };
+export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, closeStoreAsync, createAccountContextReader, createAccountLinkRegistry, createAccountOwnerRecoveryService, createAccountRebindRunner, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory, resumeAccountRebind };
 
 //# sourceMappingURL=index.js.map