@codemem/server 0.47.0-beta.4 → 0.47.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { closeSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, captureAccountOwnerProfilePins, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorAuthControllerReviewAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeCoordinatorLegacyTeamCompletionManifest, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readAccountOwnerAssociation, readCodememConfigFile, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorResolvedAccountOwnerReceiptStatus, readCoordinatorResolvedAccountOwnerStatus, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, runSyncPass, schema, scopeAuthorizationFailureReason, searchPiSessions, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyLocalIdentitySwitch, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, assertNoLocalIdentityOverride, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, captureAccountOwnerProfilePins, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, completeLocalIdentitySwitch, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorAuthControllerReviewAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyDecisionCountsAsOwner, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, markLocalIdentitySwitchBound, markLocalIdentitySwitchNotCommitted, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeCoordinatorLegacyTeamCompletionManifest, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readAccountOwnerAssociation, readAccountOwnerAssociationRetainedAtMs, readCodememConfigFile, readCompletedLocalIdentitySwitches, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorResolvedAccountOwnerReceiptStatus, readCoordinatorResolvedAccountOwnerStatus, readCoordinatorSyncConfig, readOpenLocalIdentitySwitch, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordLocalIdentitySwitch, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, resumeDeviceRebind, runDeviceRebind, runSyncPass, schema, scopeAuthorizationFailureReason, searchPiSessions, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -316,10 +316,31 @@ function safeFailure(error) {
 		default: return "request_failed";
 	}
 }
+function browserPath(intent) {
+	if (intent === "refresh" || intent === "disconnect") return "/auth/account/change/start";
+	if (intent === "sign_in") return "/auth/rebind/start";
+	return "/auth/link/start";
+}
+var REBIND_REFUSALS = {
+	account_not_linked: "account_not_linked",
+	already_this_identity: "already_this_identity",
+	current_identity_linked: "current_identity_linked",
+	device_already_bound: "device_already_bound",
+	daily_limit: "daily_limit"
+};
+/** Maps a rebind result to the operation's terminal state and failure. */
+function rebindOutcome(result) {
+	if (result.kind === "switched" || result.kind === "bound") return ["succeeded", null];
+	if (result.kind === "bind_unknown") return ["outcome_unknown", "bind_unconfirmed"];
+	if (result.kind === "pending") return ["outcome_unknown", "switch_pending"];
+	if (result.kind === "refused" && result.reason === "unavailable" && result.beforeBrowser) return ["failed", "sign_in_unavailable"];
+	if (result.kind === "refused") return ["failed", REBIND_REFUSALS[result.reason] ?? "request_failed"];
+	return ["failed", "request_failed"];
+}
 function validBrowserUrl(value, origin, intent) {
 	try {
 		const url = new URL(value);
-		return url.origin === origin && url.pathname === (intent === "refresh" || intent === "disconnect" ? "/auth/account/change/start" : "/auth/link/start") && !url.username && !url.password && !url.hash;
+		return url.origin === origin && url.pathname === browserPath(intent) && !url.username && !url.password && !url.hash;
 	} catch {
 		return false;
 	}
@@ -413,6 +434,7 @@ var InProcessAccountLinkRegistry = class {
 				onBrowserStart: (url) => this.#browserStart(job, url)
 			};
 			const intent = job.operation.intent ?? "connect";
+			if (intent === "sign_in") return await this.#runSignIn(job, options.onBrowserStart);
 			if (intent === "connect") await (this.#options.link ?? linkCoordinatorAccount)({
 				...options,
 				expectedAuthority
@@ -430,6 +452,25 @@ var InProcessAccountLinkRegistry = class {
 			this.#fail(job, error);
 		}
 	}
+	/** Sign-in may switch this device's Identity; its result maps to one terminal state. */
+	async #runSignIn(job, onBrowserStart) {
+		const rebind = this.#options.rebind;
+		if (!rebind) throw new CoordinatorAccountLinkError("invalid_options");
+		const [state, failure] = rebindOutcome(await rebind({
+			context: job.context,
+			signal: job.controller.signal,
+			onBrowserStart,
+			isCurrent: () => {
+				const current = this.#current(job.context);
+				if (!current) job.abortFailure = "context_changed";
+				return current;
+			}
+		}));
+		if (state !== "failed") this.#finish(job, state, failure);
+		else if (job.abortFailure) this.#finish(job, "failed", job.abortFailure);
+		else if (job.cancelled) this.#finish(job, "cancelled", "link_stopped");
+		else this.#finish(job, "failed", failure);
+	}
 	#fail(job, error) {
 		let failure = safeFailure(error);
 		if (job.abortFailure && (failure === "link_stopped" || failure === "request_failed")) failure = job.abortFailure;
@@ -484,6 +525,15 @@ var InProcessAccountLinkRegistry = class {
 		});
 		return { operation: this.#snapshot(job) };
 	}
+	supportsSignIn() {
+		if (!this.#options.rebind) return false;
+		try {
+			assertNoLocalIdentityOverride();
+			return true;
+		} catch {
+			return false;
+		}
+	}
 	lifecycleToken() {
 		busySlot.lifecycle ??= Symbol();
 		return busySlot.lifecycle;
@@ -584,18 +634,69 @@ function readOwnerAssociation(context, coordinatorId) {
 	if (context.publicKeyHash === void 0) return null;
 	const before = statSync(context.dbPath, { bigint: true });
 	const device = readAccountLinkDevice(context.dbPath);
-	const profile = {
-		...context,
-		publicKey: device.publicKey,
-		actorId: context.identityId,
-		coordinatorId
+	const profileFor = (actorId) => {
+		const profile = {
+			...context,
+			publicKey: device.publicKey,
+			actorId,
+			coordinatorId
+		};
+		return {
+			profile,
+			expectedProfilePins: captureAccountOwnerProfilePins(profile)
+		};
 	};
-	const expectedProfilePins = captureAccountOwnerProfilePins(profile);
-	const association = readAccountOwnerAssociation(profile, { expectedProfilePins }) ?? readAccountOwnerAssociation(profile);
+	const association = readCurrentAssociation(context, {
+		generation: (actorId) => {
+			const { profile, expectedProfilePins } = profileFor(actorId);
+			return readAccountOwnerAssociation(profile, { expectedProfilePins });
+		},
+		generationRetainedAtMs: (actorId) => {
+			const { profile, expectedProfilePins } = profileFor(actorId);
+			return readAccountOwnerAssociationRetainedAtMs(profile, { expectedProfilePins });
+		},
+		legacy: (actorId) => readAccountOwnerAssociation(profileFor(actorId).profile),
+		legacyRetainedAtMs: (actorId) => readAccountOwnerAssociationRetainedAtMs(profileFor(actorId).profile)
+	});
 	const after = statSync(context.dbPath, { bigint: true });
 	if (!before.isFile() || before.dev !== after.dev || before.ino !== after.ino || after.dev.toString() !== context.fileIdentity.dev || after.ino.toString() !== context.fileIdentity.ino || device.deviceId !== context.deviceId || createHash("sha256").update(device.publicKey).digest("hex") !== context.publicKeyHash || device.fingerprint !== context.fingerprint) throw new Error("account_owner_association_invalid");
 	return association;
 }
+/** A switch away from `actorId` completed after evidence published at `retainedAtMs`. */
+function switchedAwayAfter(switches, actorId, retainedAtMs) {
+	return retainedAtMs !== null && switches.some((s) => s.previousIdentityId === actorId && s.completedAtMs > retainedAtMs);
+}
+/** The shared legacy file pins a previous Identity whose switch superseded it. */
+function legacySuperseded(evidence, switches) {
+	return [...new Set(switches.map((s) => s.previousIdentityId))].some((actorId) => {
+		try {
+			return evidence.legacy(actorId) !== null && switchedAwayAfter(switches, actorId, evidence.legacyRetainedAtMs(actorId));
+		} catch {
+			return false;
+		}
+	});
+}
+/**
+* A switch away from the pinned Identity, completed after the association was
+* published, supersedes it for good. Read failures are suppressed only for the
+* shared legacy file, and only when it pins such a superseded Identity; a
+* failing exact generation for the current Identity is always reported.
+*/
+function readCurrentAssociation(context, evidence) {
+	const current = context.identityId;
+	const generation = evidence.generation(current);
+	const switches = () => readCompletedLocalIdentitySwitches(context.dbPath);
+	if (generation) return switchedAwayAfter(switches(), current, evidence.generationRetainedAtMs(current)) ? null : generation;
+	let legacy;
+	try {
+		legacy = evidence.legacy(current);
+	} catch (error) {
+		if (legacySuperseded(evidence, switches())) return null;
+		throw error;
+	}
+	if (!legacy) return null;
+	return switchedAwayAfter(switches(), current, evidence.legacyRetainedAtMs(current)) ? null : legacy;
+}
 function ownerUnavailable(view, code) {
 	return {
 		...withoutOwnerCapabilities(view),
@@ -688,7 +789,26 @@ function associatedOwnerView(view, context, association, remote) {
 }
 //#endregion
 //#region src/account/status.ts
-function attachOperation(view, registry, operationContextId = view.contextId) {
+/**
+* The owner-only state offers sign-in when the owner's Google account is
+* linked and this device's own Identity has none: signing in switches the
+* device to the owner's Identity.
+*/
+function withOwnerSignIn(owner, own, context, remote) {
+	if (owner.ownerProjection?.status.profileState !== "linked" || own.canSignIn !== true || own.remote.kind !== "status" || own.remote.state !== "unlinked") return owner;
+	return {
+		...owner,
+		canSignIn: true,
+		signIn: {
+			contextId: context.contextId,
+			coordinatorId: remote.status.coordinatorId,
+			authority: remote.status.authority
+		}
+	};
+}
+function attachOperation(input, registry, operationContextId = input.contextId) {
+	const { canSignIn, signIn, ...rest } = input;
+	const view = registry?.supportsSignIn?.() ? input : rest;
 	const operation = operationContextId ? registry?.forContext(operationContextId) ?? null : null;
 	const operationContext = operation && operationContextId && operationContextId !== view.contextId ? { operationContextId } : {};
 	if (registry?.hasActive()) return {
@@ -696,6 +816,7 @@ function attachOperation(view, registry, operationContextId = view.contextId) {
 		...operationContext,
 		operation,
 		canLink: false,
+		..."canSignIn" in view ? { canSignIn: false } : {},
 		blockedReason: "operation_active"
 	};
 	return {
@@ -722,6 +843,7 @@ function accountLocalView(result) {
 		} : null,
 		remote: { kind: "not_checked" },
 		canLink: false,
+		canSignIn: false,
 		blockedReason: "setup_incomplete",
 		operation: null,
 		checkedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -755,12 +877,84 @@ function applyRemote(view, remote) {
 			account: identityMatches && status.state === "linked" ? status.account : null
 		},
 		canLink: status.state === "unlinked" && identityMatches,
+		canSignIn: identityMatches && signInState(status),
 		blockedReason
 	};
 }
+/** Sign-in starts unlinked, or linked when this device has no proof of its own (a self-bind). */
+function signInState(status) {
+	return status.state === "unlinked" || status.state === "linked" && !status.account;
+}
 async function readAccountStatus(options, groupId, signal, readOptions = {}) {
 	const initial = options.readContext(groupId);
 	if ("error" in initial) return initial;
+	if (groupId === void 0 && readOptions.expectedContext === void 0 && initial.setup === "group_selection_required" && initial.groups.length > 0) return withPeopleNames(options, await readFirstUsableGroupStatus(options, initial.groups, signal));
+	return withPeopleNames(options, await readStatusFromContext(options, initial, groupId, signal, readOptions));
+}
+/**
+* Names come from the local People list at view time. They stay out of the
+* context, so renaming someone in Sharing cannot abort an account operation.
+*/
+function withPeopleNames(options, result) {
+	if ("error" in result) return result;
+	const name = (identityId) => {
+		try {
+			return options.identityName?.(identityId) || void 0;
+		} catch {
+			return;
+		}
+	};
+	let view = result;
+	const localName = view.local ? name(view.local.identityId) : void 0;
+	if (view.local && localName) view = {
+		...view,
+		local: {
+			...view.local,
+			identityLabel: localName
+		}
+	};
+	const ownerName = view.accountOwner ? name(view.accountOwner.identityId) : void 0;
+	if (view.accountOwner && ownerName) view = {
+		...view,
+		accountOwner: {
+			...view.accountOwner,
+			displayName: ownerName
+		}
+	};
+	return view;
+}
+/** 2: use this group. 1: review, keep looking. 0: this enrollment was refused. -1: stop. */
+function usableStatusRank(result) {
+	if ("error" in result) return -1;
+	if (result.ownerProjection) return 2;
+	if (result.remote.kind === "status") return result.remote.state === "review_required" ? 1 : 2;
+	if (result.remote.kind === "unavailable" && result.remote.code === "coordinator_rejected") return 0;
+	return -1;
+}
+/**
+* Account status is per coordinator, and the group only picks which enrollment
+* signs the request. Try configured groups in order and keep the first one
+* whose enrollment the coordinator accepts, preferring a decided status over
+* review. Each attempt is a full signed read with its own context checks.
+*/
+async function readFirstUsableGroupStatus(options, groups, signal) {
+	let best = null;
+	for (const groupId of groups) {
+		if (signal.aborted) break;
+		const result = await readGroupAccountStatus(options, groupId, signal);
+		const rank = usableStatusRank(result);
+		if (rank === 2) return result;
+		if (rank === -1) return best && usableStatusRank(best) === 1 ? best : result;
+		if (!best || rank > usableStatusRank(best)) best = result;
+	}
+	return best ?? readGroupAccountStatus(options, void 0, signal);
+}
+async function readGroupAccountStatus(options, groupId, signal) {
+	const initial = options.readContext(groupId);
+	if ("error" in initial) return initial;
+	return readStatusFromContext(options, initial, groupId, signal);
+}
+async function readStatusFromContext(options, initial, groupId, signal, readOptions = {}) {
 	const view = accountLocalView(initial);
 	if (initial.setup !== "ready" || !initial.context) return attachOperation(view, options.registry);
 	const snapshot = JSON.stringify(initial);
@@ -804,13 +998,21 @@ async function readAccountStatus(options, groupId, signal, readOptions = {}) {
 		},
 		blockedReason: "status_unavailable"
 	}, options.registry);
-	return finishAccountStatus(options, initial.context, fresh, remote, signal);
+	return finishAccountStatus(options, initial.context, fresh, remote, {
+		signal,
+		ownIdentityOnly: readOptions.ownIdentityOnly === true
+	});
 }
-async function finishAccountStatus(options, context, fresh, remote, signal) {
+async function finishAccountStatus(options, context, fresh, remote, read) {
+	const { signal } = read;
 	const currentView = applyRemote(accountLocalView(fresh), remote);
 	if (remote.kind === "status") {
 		const associated = await readAssociatedOwner(options, context, currentView, remote, signal);
-		if (associated) return attachOperation(associated, options.registry, context.contextId);
+		if (associated) {
+			const owner = withOwnerSignIn(associated, currentView, context, remote);
+			if (read.ownIdentityOnly && owner.signIn?.contextId === context.contextId) return attachOperation(currentView, options.registry);
+			return attachOperation(owner, options.registry, context.contextId);
+		}
 	}
 	await attachManagementActions(options, context, currentView, signal);
 	if (remote.kind === "status") try {
@@ -824,7 +1026,8 @@ async function readAssociatedOwner(options, context, view, actorRemote, signal)
 	const local = {
 		...view,
 		remote: { kind: "not_checked" },
-		canLink: false
+		canLink: false,
+		canSignIn: false
 	};
 	try {
 		const association = readOwnerAssociation(context, actorRemote.status.coordinatorId);
@@ -944,7 +1147,7 @@ function isCurrent(options, operation) {
 	return !("error" in fresh) && fresh.setup === "ready" && fresh.context?.groupId === operation.groupId && fresh.context.contextId === operation.contextId;
 }
 function validStartBody(body) {
-	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect") && (body.authority === "controller_attestation" || body.authority === "device_claim");
+	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect" || body.intent === "sign_in") && (body.authority === "controller_attestation" || body.authority === "device_claim");
 }
 function unlinkTargetChanged(body, view) {
 	return body.intent === "disconnect" && body.expectedLinkId !== view.unlinkTarget;
@@ -962,7 +1165,10 @@ async function startOperation(c, options) {
 	if ("error" in initial || initial.setup !== "ready" || !initial.context || initial.context?.contextId !== body.contextId) return c.json({ error: "account_context_changed" }, 409);
 	const checkedContext = structuredClone(initial.context);
 	const expectedLifecycleToken = options.registry.lifecycleToken();
-	const view = await readAccountStatus(options, body.groupId, c.req.raw.signal, { expectedContext: checkedContext });
+	const view = await readAccountStatus(options, body.groupId, c.req.raw.signal, {
+		expectedContext: checkedContext,
+		ownIdentityOnly: body.intent === "sign_in"
+	});
 	if ("error" in view || view.setup !== "ready" || view.contextId !== body.contextId || view.remote.kind === "unavailable" && view.remote.code === "context_changed") return c.json({ error: "account_context_changed" }, 409);
 	if (view.operation && view.operation.finishedAt === null) return c.json({
 		error: "account_link_in_progress",
@@ -982,6 +1188,7 @@ async function startOperation(c, options) {
 }
 function actionAllowed(view, intent = "connect") {
 	if (intent === "connect") return view.canLink;
+	if (intent === "sign_in") return view.canSignIn === true;
 	if (intent === "refresh" || intent === "disconnect") return view.managementActions?.[intent] === true;
 	return false;
 }
@@ -1059,6 +1266,14 @@ var AccountOwnerRecoveryError = class extends Error {
 		this.code = code;
 	}
 };
+/**
+* The fix for an unsafe local state directory, or null for any other error. Matches the
+* core error by code because the bundle can carry a second copy of the core class.
+*/
+function unsafeStorageMessage(error) {
+	if (!(error instanceof Error) || !("code" in error)) return null;
+	return error.code === "account_owner_association_directory_unsafe" ? error.message : null;
+}
 function requireRecovery(condition, code = "invalid") {
 	if (!condition) throw new AccountOwnerRecoveryError(code);
 }
@@ -1100,7 +1315,7 @@ function readWeakLabel(value) {
 		effect: row.effect
 	};
 }
-function historyRows(value, selection, labels) {
+function historyRows$1(value, selection, labels) {
 	const row = recoveryRecord(value);
 	requireRecovery(recoveryId(row.group_id) && recoveryId(row.candidate_ref) && timestamp(row.created_at));
 	const manifest = normalizeCoordinatorLegacyTeamCompletionManifest(row.manifest);
@@ -1118,7 +1333,7 @@ function historyRows(value, selection, labels) {
 			identityId: decision.identity_id ?? "",
 			assignment: decision.decision,
 			relation,
-			reason: "Retained canonical Team decision; display metadata only."
+			reason: legacyDecisionCountsAsOwner(decision) ? "Recorded in Team history." : "Guessed by another device in Team history."
 		};
 	});
 }
@@ -1156,7 +1371,7 @@ function validateRecoveryReview(value, selection, groupId) {
 	requireRecovery(Array.isArray(row.legacy_history) && row.legacy_history.length <= 500 && Array.isArray(row.reviewed_weak_labels) && row.reviewed_weak_labels.length <= 256 && Array.isArray(row.reasons) && row.reasons.every((reason) => typeof reason === "string"));
 	const labels = row.reviewed_weak_labels.map(readWeakLabel);
 	requireRecovery(new Set(labels.map((label) => JSON.stringify(label))).size === labels.length);
-	const rows = row.legacy_history.flatMap((history) => historyRows(history, selection, labels));
+	const rows = row.legacy_history.flatMap((history) => historyRows$1(history, selection, labels));
 	requireRecovery(row.reasons.length <= 8 && row.reasons.every((reason) => typeof reason === "string" && RECOVERY_REASON.test(reason)));
 	const reasons = row.reasons;
 	if (row.state === "needs_review") {
@@ -1367,6 +1582,11 @@ async function dispatch(c, service) {
 function accountOwnerRecoveryRoutes(service) {
 	const app = new Hono();
 	app.onError((error, c) => {
+		const storage = unsafeStorageMessage(error);
+		if (storage) return c.json({
+			error: "account_owner_recovery_storage_unsafe",
+			detail: storage
+		}, 409);
 		if (!(error instanceof AccountOwnerRecoveryError)) return c.json({ error: "account_owner_recovery_unavailable" }, 503);
 		return c.json({ error: `account_owner_recovery_${error.code}` }, {
 			invalid: 400,
@@ -6804,6 +7024,24 @@ function projectMappingChoices(store) {
 		sourceDisplayName: candidate.display_project
 	}));
 }
+function viewerSafeDevice(candidateRef, device) {
+	return {
+		deviceRef: device.deviceRef,
+		displayName: device.displayName,
+		enabled: device.enabled,
+		existingIdentityRef: identityRef(candidateRef, device.existingIdentityId),
+		suggestedIdentityRef: identityRef(candidateRef, device.suggestedIdentityId),
+		verifiedEvidenceKind: device.verifiedEvidenceKind,
+		identityEvidence: device.identityEvidence,
+		decision: device.decision,
+		targetIdentityRef: identityRef(candidateRef, device.targetIdentityId),
+		expectation: device.expectation.kind === "existing" ? {
+			kind: "existing",
+			assignmentVersion: device.expectation.assignmentVersion,
+			identityRef: requiredIdentityRef(candidateRef, device.expectation.identityId)
+		} : { kind: "absent" }
+	};
+}
 function viewerSafeDraft(store, draft) {
 	if (draft.devices.length > MAX_DEVICES || draft.projects.length > MAX_PROJECTS) throw new Error("legacy_team_setup_roster_too_large");
 	const completed = draft.state === "completed";
@@ -6813,21 +7051,7 @@ function viewerSafeDraft(store, draft) {
 	requireCompleteMappingChoices(mappableProjectCount, mappingChoices.length);
 	const mappingChoiceIdentities = mappingChoices.map((choice) => choice.projectIdentity);
 	return {
-		devices: draft.devices.map((device) => ({
-			deviceRef: device.deviceRef,
-			displayName: device.displayName,
-			enabled: device.enabled,
-			existingIdentityRef: identityRef(draft.candidateRef, device.existingIdentityId),
-			suggestedIdentityRef: identityRef(draft.candidateRef, device.suggestedIdentityId),
-			verifiedEvidenceKind: device.verifiedEvidenceKind,
-			decision: device.decision,
-			targetIdentityRef: identityRef(draft.candidateRef, device.targetIdentityId),
-			expectation: device.expectation.kind === "existing" ? {
-				kind: "existing",
-				assignmentVersion: device.expectation.assignmentVersion,
-				identityRef: requiredIdentityRef(draft.candidateRef, device.expectation.identityId)
-			} : { kind: "absent" }
-		})),
+		devices: draft.devices.map((device) => viewerSafeDevice(draft.candidateRef, device)),
 		projects: draft.projects.map((project) => ({
 			projectRef: project.projectRef,
 			displayName: project.displayName,
@@ -9799,6 +10023,7 @@ function isPendingCaptureActorConflict(error) {
 /** False leaves the conflict untouched; callers must check before claiming or merging identity. */
 function ensureLocalActorRecord(store) {
 	return store.db.transaction(() => {
+		store.assertLocalIdentityCurrent();
 		try {
 			store.assertPendingLocalCaptureAdoptionActors();
 		} catch (error) {
@@ -15358,6 +15583,7 @@ sqliteTable("legacy_team_setup_draft_devices", {
 	existing_identity_id: text("existing_identity_id"),
 	existing_assignment_version: integer("existing_assignment_version"),
 	verified_evidence_kind: text("verified_evidence_kind"),
+	identity_evidence: text("identity_evidence"),
 	decision: text("decision").notNull().default("unresolved"),
 	target_identity_id: text("target_identity_id"),
 	expected_assignment_kind: text("expected_assignment_kind"),
@@ -15561,16 +15787,44 @@ function assertPublishedConfigLock(path, staged) {
 function accountOwnerAssociationDirectory() {
 	return join(homedir(), ".codemem", "account-owner-associations");
 }
+/**
+* A state directory that other local users could change. The message names the path and
+* the command that fixes it, because callers show it to the person who owns the directory.
+*/
+var AccountOwnerAssociationDirectoryError = class extends Error {
+	path;
+	problem;
+	code = "account_owner_association_directory_unsafe";
+	constructor(path, problem) {
+		super(directoryProblemMessage(path, problem));
+		this.path = path;
+		this.problem = problem;
+		this.name = "AccountOwnerAssociationDirectoryError";
+	}
+};
+function directoryProblemMessage(path, problem) {
+	if (problem === "shared_write") return `${path} is writable by other users. Run \`chmod go-w ${path}\`, then try again.`;
+	if (problem === "not_private") return `${path} must be private to you. Run \`chmod 700 ${path}\`, then try again.`;
+	if (problem === "wrong_owner") return `${path} is owned by another user. Make it yours.`;
+	return `${path} must be a real directory, not a file or symlink.`;
+}
+function directoryProblem(stat, options) {
+	if (!stat.isDirectory() || stat.isSymbolicLink()) return "not_directory";
+	if (typeof process.getuid === "function" && stat.uid !== process.getuid()) return "wrong_owner";
+	if (options.private) return (stat.mode & 511) === 448 ? null : "not_private";
+	return (stat.mode & 18) === 0 ? null : "shared_write";
+}
 function checkDirectory(path, options = {}) {
+	let stat;
 	try {
-		const stat = lstatSync(path);
-		const unsafeMode = options.private ? (stat.mode & 511) !== 448 : (stat.mode & 18) !== 0;
-		if (!stat.isDirectory() || stat.isSymbolicLink() || unsafeMode || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new Error("account_owner_association_invalid");
-		return true;
+		stat = lstatSync(path);
 	} catch (error) {
 		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
 		throw error;
 	}
+	const problem = directoryProblem(stat, options);
+	if (problem) throw new AccountOwnerAssociationDirectoryError(path, problem);
+	return true;
 }
 /** Missing directories stay missing during reads. Never follow a state-directory symlink. */
 function readAccountOwnerAssociationDirectory(path) {
@@ -15877,6 +16131,97 @@ function retainGeneration(profile, review, context) {
 	return retained.record;
 }
 //#endregion
+//#region src/account/owner-recovery-candidates.ts
+function historyRows(response) {
+	const history = response?.legacy_history;
+	return Array.isArray(history) ? history : [];
+}
+/** Return [identity, group] pairs for this device, or none when the record is unreadable. */
+function recordedOwners(row, deviceId) {
+	const record = row;
+	const groupId = record?.group_id;
+	if (!recoveryId(groupId)) return [];
+	let manifest;
+	try {
+		manifest = normalizeCoordinatorLegacyTeamCompletionManifest(record?.manifest);
+	} catch {
+		return [];
+	}
+	return manifest.device_decisions.flatMap((decision) => {
+		const identityId = decision.identity_id;
+		if (decision.device_id !== deviceId || !recoveryId(identityId)) return [];
+		if (!legacyDecisionCountsAsOwner(decision)) return [];
+		return [[identityId, groupId]];
+	});
+}
+/** Map each Identity recorded for this device to the groups whose Team history records it. */
+function recordedOwnerGroups(responses, device) {
+	const owners = /* @__PURE__ */ new Map();
+	const pairs = responses.flatMap(historyRows).flatMap((row) => recordedOwners(row, device.deviceId));
+	for (const [identityId, groupId] of pairs) owners.set(identityId, /* @__PURE__ */ new Set([...owners.get(identityId) ?? [], groupId]));
+	return owners;
+}
+var MAX_LABEL_LENGTH = 256;
+var LISTED_GROUPS = 3;
+function candidateLabel(prefix, groups) {
+	const sorted = [...groups].sort();
+	const listed = sorted.slice(0, LISTED_GROUPS).join(", ");
+	const more = sorted.length - LISTED_GROUPS;
+	const label = `${prefix} recorded for this device in ${more > 0 ? `${listed} and ${more} more` : listed}`;
+	if (label.length <= MAX_LABEL_LENGTH) return label;
+	return `${prefix} recorded for this device in ${sorted.length === 1 ? "1 group" : `${sorted.length} groups`}`;
+}
+var MAX_CANDIDATES = 256;
+function candidateList(owners, currentIdentityId) {
+	const rank = (id) => id === currentIdentityId ? 0 : 1;
+	return [...owners.entries()].sort(([left], [right]) => rank(left) - rank(right) || left.localeCompare(right)).slice(0, MAX_CANDIDATES).map(([id, groups]) => {
+		return {
+			id,
+			label: candidateLabel(id === currentIdentityId ? "This profile's Identity," : "Identity", [...groups])
+		};
+	});
+}
+/**
+* The coordinator returns this device's history across all groups once it finds an
+* enrollment. It hides the enrollment on an identity mismatch but still sends the
+* history, so non-empty history also counts as complete.
+*/
+function hasCompleteHistory(response) {
+	const row = response;
+	return row?.enrollment !== null && typeof row?.enrollment === "object" || historyRows(response).length > 0;
+}
+/**
+* Suggest owners from read-only coordinator previews of this device's current review.
+* Suggestions are display hints: the scoped owner preview still checks the chosen ID.
+*
+* Previews share the coordinator's admin review rate limit with the owner preview and
+* confirmation. History is filtered by device, not group, so this asks one group at a
+* time and stops at the first enrolled group instead of spending one request per group.
+*/
+async function readRecoveryCandidates(options) {
+	const { device } = options;
+	const responses = [];
+	for (const groupId of options.groups) {
+		let response;
+		try {
+			response = await options.previewDeviceOwner({
+				remoteUrl: options.remoteUrl,
+				adminSecret: options.adminSecret,
+				groupId,
+				deviceId: device.deviceId,
+				fingerprint: device.fingerprint,
+				identityId: device.identityId,
+				timeoutS: options.timeoutS
+			});
+		} catch {
+			continue;
+		}
+		responses.push(response);
+		if (hasCompleteHistory(response)) break;
+	}
+	return candidateList(recordedOwnerGroups(responses, device), device.identityId);
+}
+//#endregion
 //#region src/account/owner-recovery-context.ts
 function recoverySha(value) {
 	return createHash("sha256").update(value).digest("hex");
@@ -15954,8 +16299,7 @@ function assertNoCompetingOwner(destinations, ownerIdentityId) {
 		requireRecovery(!existing || existing.ownerIdentityId === ownerIdentityId);
 	}
 }
-//#endregion
-//#region src/account/owner-recovery-service.ts
+var CANDIDATE_TTL_MS = 6e4;
 function groupAction(state) {
 	if (state === "ready") return "new";
 	if (state === "restored") return "reuse";
@@ -15971,6 +16315,7 @@ function staleDenial(error) {
 var AccountOwnerRecoveryService = class {
 	#options;
 	#handles = /* @__PURE__ */ new Map();
+	#candidateCache;
 	#reservations = /* @__PURE__ */ new Set();
 	#controller = new AbortController();
 	#closed = false;
@@ -15980,6 +16325,10 @@ var AccountOwnerRecoveryService = class {
 	#now() {
 		return (this.#options.now ?? Date.now)();
 	}
+	#timeoutS() {
+		const configured = this.#options.readCoordinatorTimeoutS?.() ?? 0;
+		return Math.max(10, Number.isFinite(configured) ? configured : 0);
+	}
 	#assertCurrent(capture, reservation) {
 		requireRecovery(!this.#closed, "unavailable");
 		requireRecovery(!reservation || reservation.isCurrent(), "context_changed");
@@ -16010,14 +16359,39 @@ var AccountOwnerRecoveryService = class {
 		const capture = this.#capture();
 		const coordinatorId = await this.#discover(capture);
 		this.#assertCurrent(capture);
-		const reviewAccess = this.#options.readAdminSecret() ? "operator" : "request";
+		const adminSecret = this.#options.readAdminSecret();
+		const candidates = adminSecret ? await this.#candidates(capture, adminSecret) : [];
 		this.#assertCurrent(capture);
 		return {
 			version: 1,
 			profile: recoveryProfile(capture, coordinatorId),
-			reviewAccess,
-			candidates: []
+			reviewAccess: adminSecret ? "operator" : "request",
+			candidates
+		};
+	}
+	async #candidates(capture, adminSecret) {
+		const cached = this.#candidateCache;
+		if (cached?.semanticId === capture.semanticId && this.#now() - cached.at < CANDIDATE_TTL_MS) return structuredClone(cached.candidates);
+		const c = capture.context;
+		const candidates = await readRecoveryCandidates({
+			previewDeviceOwner: this.#options.previewDeviceOwner ?? coordinatorAuthControllerReviewAction,
+			remoteUrl: c.coordinatorUrl,
+			adminSecret,
+			groups: capture.groups,
+			device: {
+				deviceId: c.deviceId,
+				fingerprint: c.fingerprint,
+				identityId: c.identityId
+			},
+			timeoutS: this.#timeoutS()
+		});
+		this.#assertCurrent(capture);
+		this.#candidateCache = {
+			semanticId: capture.semanticId,
+			at: this.#now(),
+			candidates
 		};
+		return structuredClone(candidates);
 	}
 	#reviewInput(capture, selection, groupId) {
 		const adminSecret = this.#options.readAdminSecret();
@@ -16031,7 +16405,8 @@ var AccountOwnerRecoveryService = class {
 			groupId,
 			deviceId: capture.context.deviceId,
 			fingerprint: capture.context.fingerprint,
-			identityId: selection.existingOwnerId
+			identityId: selection.existingOwnerId,
+			timeoutS: this.#timeoutS()
 		};
 	}
 	async #previewReview(entry, groupId) {
@@ -16197,7 +16572,7 @@ var AccountOwnerRecoveryService = class {
 			return { outcome: {
 				groupId,
 				status: staleDenial(error) ? "failed" : "unknown",
-				message: "Check coordinator status or import original receipts before trying again."
+				message: unsafeStorageMessage(error) ?? "Check coordinator status or import original receipts before trying again."
 			} };
 		}
 	}
@@ -16272,11 +16647,11 @@ var AccountOwnerRecoveryService = class {
 	async #importGroup(entry, groupId, receipt, reservation) {
 		try {
 			return await this.#verifyAndRetain(entry, groupId, receipt, reservation);
-		} catch {
+		} catch (error) {
 			return {
 				groupId,
 				status: "unknown",
-				message: "Context or proof outcome changed; check status before importing again."
+				message: unsafeStorageMessage(error) ?? "Context or proof outcome changed; check status before importing again."
 			};
 		}
 	}
@@ -16291,6 +16666,143 @@ function createAccountOwnerRecoveryService(options) {
 	return new AccountOwnerRecoveryService(options);
 }
 //#endregion
+//#region src/account/rebind.ts
+/**
+* Viewer side of "Sign in with Google" when the account belongs to another
+* Identity (ADR 0005 Section 8): run the coordinator rebind, then switch this
+* device's local Identity. An unclear outcome stays recorded and resumes.
+*/
+/** Pins the local facts the person reviewed; the coordinator stores and signs it. */
+function reviewDigest(store, context) {
+	const binding = store.db.prepare("SELECT identity_id, assignment_version FROM identity_devices WHERE device_id = ?").get(context.deviceId);
+	const localActors = store.db.prepare("SELECT actor_id FROM actors WHERE is_local = 1 ORDER BY actor_id").pluck().all();
+	return createHash("sha256").update(JSON.stringify([
+		"codemem-device-rebind-review-v1",
+		context.deviceId,
+		context.fingerprint,
+		context.identityId,
+		binding ?? null,
+		localActors
+	])).digest("hex");
+}
+/**
+* Finishes the local half from a coordinator receipt. Each step is
+* idempotent, so a later resume can repeat it.
+*/
+function finishLocalSwitch(store, paths, attemptId, receipt) {
+	try {
+		if (receipt) markLocalIdentitySwitchBound(store.db, receipt);
+		const context = { configPath: paths.configPath };
+		applyLocalIdentitySwitch(store.db, {
+			attemptId,
+			displayName: store.actorDisplayName,
+			expectedPublicKey: loadPublicKey(paths.keysDir) ?? ""
+		}, context);
+		completeLocalIdentitySwitch(store.db, {
+			attemptId,
+			configPath: paths.configPath
+		});
+		const target = readTarget(store, attemptId);
+		if (!target || !store.refreshPersistedLocalIdentity(target)) return { kind: "pending" };
+		return {
+			kind: "switched",
+			targetIdentityId: target
+		};
+	} catch {
+		return { kind: "pending" };
+	}
+}
+function readTarget(store, attemptId) {
+	const row = store.db.prepare("SELECT target_identity_id FROM local_identity_switches WHERE attempt_id = ? AND state = 'completed'").pluck().get(attemptId);
+	return typeof row === "string" ? row : null;
+}
+function createAccountRebindRunner(store) {
+	return async ({ context, signal, onBrowserStart, isCurrent = () => true }) => {
+		try {
+			assertNoLocalIdentityOverride();
+		} catch {
+			return { kind: "failed" };
+		}
+		const earlier = await resolveOpenSwitch(store, context);
+		if (earlier) return earlier;
+		const recorded = {};
+		return settleOutcome(store, context, await runRebind(store, context, {
+			signal,
+			onBrowserStart,
+			recorded,
+			isCurrent
+		}), recorded.attemptId);
+	};
+}
+/** An earlier switch left open is resolved first; no new Google trip until it is. */
+async function resolveOpenSwitch(store, context) {
+	if (!readOpenLocalIdentitySwitch(store.db)) return null;
+	const resumed = await resumeAccountRebind(store, context);
+	if (resumed?.kind === "switched") return resumed;
+	return readOpenLocalIdentitySwitch(store.db) ? { kind: "pending" } : null;
+}
+/**
+* A refusal or failure means this run's finalize did not commit, and nothing
+* else sends it, so the attempt this run recorded can close at once.
+*/
+function settleOutcome(store, context, outcome, recordedAttemptId) {
+	if ((outcome.kind === "refused" || outcome.kind === "failed") && recordedAttemptId) markLocalIdentitySwitchNotCommitted(store.db, recordedAttemptId);
+	if (outcome.kind === "refused") return {
+		kind: "refused",
+		reason: outcome.reason,
+		...outcome.beforeBrowser ? { beforeBrowser: true } : {}
+	};
+	if (outcome.kind === "failed") return { kind: "failed" };
+	if (outcome.kind === "unknown") return isSelfBind(outcome.pending) ? { kind: "bind_unknown" } : { kind: "pending" };
+	if (isSelfBind(outcome.receipt)) return { kind: "bound" };
+	return finishLocalSwitch(store, context, outcome.receipt.attemptId, outcome.receipt);
+}
+/** A self-bind keeps this device's Identity, so it has no local switch. */
+function isSelfBind(attempt) {
+	return attempt.targetIdentityId === attempt.previousIdentityId;
+}
+function runRebind(store, context, run) {
+	return runDeviceRebind({
+		dbPath: context.dbPath,
+		keysDir: context.keysDir,
+		coordinatorUrl: context.coordinatorUrl,
+		groupId: context.groupId,
+		currentIdentityId: context.identityId,
+		reviewDigest: reviewDigest(store, context),
+		openBrowser: run.onBrowserStart,
+		recordPending: (pending) => {
+			if (!run.isCurrent()) throw new Error("device_rebind_context_changed");
+			if (reviewDigest(store, context) !== pending.reviewDigest) throw new Error("device_rebind_review_changed");
+			if (isSelfBind(pending)) return;
+			recordLocalIdentitySwitch(store.db, pending, { configPath: context.configPath });
+			run.recorded.attemptId = pending.attemptId;
+		},
+		signal: run.signal
+	});
+}
+/**
+* Picks up a switch an earlier run left open. A recorded attempt is resolved
+* by reading coordinator status, never by sending finalize again.
+*/
+async function resumeAccountRebind(store, paths) {
+	const open = readOpenLocalIdentitySwitch(store.db);
+	if (!open) return null;
+	if (open.state !== "pending") return finishLocalSwitch(store, paths, open.attemptId);
+	const resumed = await resumeDeviceRebind({
+		dbPath: store.dbPath,
+		keysDir: paths.keysDir,
+		coordinatorUrl: open.coordinatorOrigin,
+		groupId: open.groupId,
+		pending: open
+	});
+	if (resumed.kind === "finalized") return finishLocalSwitch(store, paths, open.attemptId, resumed.receipt);
+	if (resumed.kind === "not_committed") {
+		markLocalIdentitySwitchNotCommitted(store.db, open.attemptId);
+		return { kind: "failed" };
+	}
+	return { kind: "pending" };
+}
+//#endregion
 //#region src/index.ts
 /**
 * @codemem/server — HTTP server (viewer, sync, API).
@@ -16443,6 +16955,6 @@ function createSyncApp(opts) {
 	return app;
 }
 //#endregion
-export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, closeStoreAsync, createAccountContextReader, createAccountLinkRegistry, createAccountOwnerRecoveryService, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory };
+export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, closeStoreAsync, createAccountContextReader, createAccountLinkRegistry, createAccountOwnerRecoveryService, createAccountRebindRunner, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory, resumeAccountRebind };
 
 //# sourceMappingURL=index.js.map