@hasna/contacts 0.6.34 → 0.6.36

package/dist/server/index.js

@@ -87,43 +87,169 @@ class SqliteAdapter {
 }
 var init_sqlite_adapter = () => {};
 
-// src/db/paths.ts
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
+// node_modules/.pnpm/@hasna+paths@0.2.2/node_modules/@hasna/paths/dist/index.js
+import { homedir } from "os";
 import { join } from "path";
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function assertKind(kind) {
+  if (!PATH_KINDS.includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${PATH_KINDS.join(", ")}`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  assertKind(kind);
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join(home, ".config", "hasna");
+    case "data":
+      return join(home, ".local", "share", "hasna");
+    case "state":
+      return join(home, ".local", "state", "hasna");
+    case "cache":
+      return join(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertKind(kind);
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
+  return join(baseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return resolvePath("data", options);
+}
+function stateDir(options) {
+  return resolvePath("state", options);
+}
+var PATH_KINDS, KIND_ENV, APP_SLUG_RE;
+var init_dist = __esm(() => {
+  PATH_KINDS = ["config", "data", "state", "cache"];
+  KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
+// src/db/paths.ts
+import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 function ensurePrivateDir(dir) {
   if (!existsSync(dir))
     mkdirSync(dir, { recursive: true, mode: 448 });
   chmodSync(dir, 448);
 }
+function home() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
+}
+function hasContent(dir) {
+  if (!existsSync(dir))
+    return false;
+  try {
+    return readdirSync(dir).length > 0;
+  } catch {
+    return false;
+  }
+}
+function adoptLegacy(source, target) {
+  if (!hasContent(source) || hasContent(target))
+    return;
+  ensurePrivateDir(target);
+  for (const entry of readdirSync(source)) {
+    if (entry === ".vault-session")
+      continue;
+    if (entry === "{backups,images,documents}")
+      continue;
+    const oldPath = join2(source, entry);
+    const newPath = join2(target, entry);
+    const st = statSync(oldPath);
+    if (st.isDirectory()) {
+      cpSync(oldPath, newPath, { recursive: true });
+      chmodSync(newPath, 448);
+    } else if (st.isFile()) {
+      copyFileSync(oldPath, newPath);
+      chmodSync(newPath, 384);
+    }
+  }
+}
 function getDataDir() {
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  const hasnaDir = join(home, ".hasna");
-  const newDir = join(home, ".hasna", "contacts");
-  const oldDir = join(home, ".contacts");
-  if (existsSync(oldDir) && !existsSync(newDir)) {
-    ensurePrivateDir(hasnaDir);
-    ensurePrivateDir(newDir);
-    for (const file of readdirSync(oldDir)) {
-      const oldPath = join(oldDir, file);
-      if (statSync(oldPath).isFile()) {
-        const newPath = join(newDir, file);
-        copyFileSync(oldPath, newPath);
-        chmodSync(newPath, 384);
-      }
-    }
-  }
-  ensurePrivateDir(hasnaDir);
-  ensurePrivateDir(newDir);
-  return newDir;
+  const base = home();
+  const target = dataDir({ app: "contacts", home: base });
+  if (!checkedDataTargets.has(target)) {
+    adoptLegacy(join2(base, ".hasna", "contacts"), target);
+    adoptLegacy(join2(base, ".contacts"), target);
+    checkedDataTargets.add(target);
+  }
+  ensurePrivateDir(target);
+  return target;
+}
+function getStateDir() {
+  const base = home();
+  const target = stateDir({ app: "contacts", home: base });
+  if (!checkedStateTargets.has(target)) {
+    if (!hasContent(target)) {
+      const legacySession = join2(base, ".hasna", "contacts", ".vault-session");
+      if (existsSync(legacySession)) {
+        ensurePrivateDir(target);
+        const targetSession = join2(target, ".vault-session");
+        copyFileSync(legacySession, targetSession);
+        chmodSync(targetSession, 384);
+      }
+    }
+    checkedStateTargets.add(target);
+  }
+  ensurePrivateDir(target);
+  return target;
 }
 function getDbPath() {
   if (process.env["HASNA_CONTACTS_DB_PATH"])
     return process.env["HASNA_CONTACTS_DB_PATH"];
   if (process.env["CONTACTS_DB_PATH"])
     return process.env["CONTACTS_DB_PATH"];
-  return join(getDataDir(), "contacts.db");
+  return join2(getDataDir(), "contacts.db");
 }
-var init_paths = () => {};
+var checkedDataTargets, checkedStateTargets;
+var init_paths = __esm(() => {
+  init_dist();
+  checkedDataTargets = new Set;
+  checkedStateTargets = new Set;
+});
 
 // src/db/database.ts
 var exports_database = {};
@@ -131,6 +257,7 @@ __export(exports_database, {
   uuid: () => uuid,
   resetDatabase: () => resetDatabase,
   now: () => now,
+  getStateDir: () => getStateDir,
   getDbPath: () => getDbPath,
   getDatabase: () => getDatabase,
   getDataDir: () => getDataDir
@@ -176,7 +303,10 @@ function uuid() {
   return crypto.randomUUID();
 }
 function now() {
-  return new Date().toISOString();
+  const currentMs = Date.now();
+  const nextMs = currentMs > lastNowMs ? currentMs : lastNowMs + 1;
+  lastNowMs = nextMs;
+  return new Date(nextMs).toISOString();
 }
 function quoteIdentifier(identifier) {
   return `"${identifier.replaceAll('"', '""')}"`;
@@ -214,7 +344,7 @@ function runMigrations(db) {
     db.exec(`INSERT OR REPLACE INTO _migrations(version) VALUES(${i})`);
   }
 }
-var MIGRATIONS, _db = null;
+var MIGRATIONS, _db = null, lastNowMs = 0;
 var init_database = __esm(() => {
   init_sqlite_adapter();
   init_paths();
@@ -786,6 +916,81 @@ var init_database = __esm(() => {
   );
 
   CREATE INDEX IF NOT EXISTS idx_contacts_tombstones_deleted_at ON _contacts_tombstones(deleted_at);
+  `,
+    `
+  CREATE TABLE IF NOT EXISTS contact_project_membership_states (
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    project_id TEXT NOT NULL,
+    linked INTEGER NOT NULL CHECK(linked IN (0, 1)),
+    revision INTEGER NOT NULL DEFAULT 0 CHECK(revision >= 0),
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (contact_id, project_id)
+  );
+
+  INSERT OR IGNORE INTO contact_project_membership_states
+    (contact_id, project_id, linked, revision, updated_at)
+  SELECT contact_id, project_id, 1, 0, datetime('now')
+  FROM contact_projects;
+
+  CREATE TABLE IF NOT EXISTS contact_project_membership_receipts (
+    receipt_id TEXT PRIMARY KEY,
+    direction TEXT NOT NULL CHECK(direction IN ('attach', 'detach')),
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    project_id TEXT NOT NULL,
+    operation_id TEXT NOT NULL,
+    step_id TEXT NOT NULL,
+    expected_version TEXT NOT NULL,
+    before_json TEXT NOT NULL,
+    after_json TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    UNIQUE(operation_id, step_id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_contact_project_membership_states_project
+    ON contact_project_membership_states(project_id, linked, contact_id);
+  CREATE INDEX IF NOT EXISTS idx_contact_project_membership_receipts_target
+    ON contact_project_membership_receipts(contact_id, project_id, created_at);
+
+  CREATE TRIGGER IF NOT EXISTS sync_contact_project_membership_state_after_insert
+  AFTER INSERT ON contact_projects
+  BEGIN
+    INSERT INTO contact_project_membership_states
+      (contact_id, project_id, linked, revision, updated_at)
+    VALUES (NEW.contact_id, NEW.project_id, 1, 1, datetime('now'))
+    ON CONFLICT(contact_id, project_id) DO UPDATE SET
+      linked = 1,
+      revision = CASE
+        WHEN contact_project_membership_states.linked = 1
+          THEN contact_project_membership_states.revision
+        ELSE contact_project_membership_states.revision + 1
+      END,
+      updated_at = CASE
+        WHEN contact_project_membership_states.linked = 1
+          THEN contact_project_membership_states.updated_at
+        ELSE datetime('now')
+      END;
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS sync_contact_project_membership_state_after_delete
+  AFTER DELETE ON contact_projects
+  WHEN EXISTS (SELECT 1 FROM contacts WHERE id = OLD.contact_id)
+  BEGIN
+    INSERT INTO contact_project_membership_states
+      (contact_id, project_id, linked, revision, updated_at)
+    VALUES (OLD.contact_id, OLD.project_id, 0, 1, datetime('now'))
+    ON CONFLICT(contact_id, project_id) DO UPDATE SET
+      linked = 0,
+      revision = CASE
+        WHEN contact_project_membership_states.linked = 0
+          THEN contact_project_membership_states.revision
+        ELSE contact_project_membership_states.revision + 1
+      END,
+      updated_at = CASE
+        WHEN contact_project_membership_states.linked = 0
+          THEN contact_project_membership_states.updated_at
+        ELSE datetime('now')
+      END;
+  END;
   `
   ];
 });
@@ -883,6 +1088,219 @@ var init_tombstones = __esm(() => {
   init_database();
 });
 
+// src/types/project-memberships.ts
+var ContactProjectMembershipConflictError;
+var init_project_memberships = __esm(() => {
+  ContactProjectMembershipConflictError = class ContactProjectMembershipConflictError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ContactProjectMembershipConflictError";
+    }
+  };
+});
+
+// src/db/project-memberships.ts
+import { createHash } from "crypto";
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function membershipVersion(contactId, projectId, linked, revision) {
+  return `cpmv_${digest(JSON.stringify([contactId, projectId, linked, revision])).slice(0, 32)}`;
+}
+function receiptId(input) {
+  return `cpmr_${digest(JSON.stringify([
+    input.operation_id,
+    input.step_id,
+    input.contact_id,
+    input.project_id
+  ])).slice(0, 32)}`;
+}
+function stateRow(contactId, projectId, db) {
+  const persisted = db.query(`SELECT contact_id, project_id, linked, revision
+     FROM contact_project_membership_states
+     WHERE contact_id = ? AND project_id = ?`).get(contactId, projectId);
+  if (persisted)
+    return persisted;
+  const linked = Boolean(db.query(`SELECT 1 AS present FROM contact_projects WHERE contact_id = ? AND project_id = ?`).get(contactId, projectId));
+  return { contact_id: contactId, project_id: projectId, linked: linked ? 1 : 0, revision: 0 };
+}
+function snapshot(row) {
+  const linked = Boolean(row.linked);
+  return {
+    contact_id: row.contact_id,
+    project_id: row.project_id,
+    linked,
+    version: membershipVersion(row.contact_id, row.project_id, linked, row.revision)
+  };
+}
+function required(value, name) {
+  const normalized = value.trim();
+  if (!normalized)
+    throw new Error(`${name} is required`);
+  return normalized;
+}
+function normalizeInput(input) {
+  return {
+    contact_id: required(input.contact_id, "contact_id"),
+    project_id: required(input.project_id, "project_id"),
+    operation_id: required(input.operation_id, "operation_id"),
+    step_id: required(input.step_id, "step_id"),
+    expected_version: required(input.expected_version, "expected_version")
+  };
+}
+function parseSnapshot(value) {
+  return JSON.parse(value);
+}
+function replay(row, direction, input) {
+  if (row.direction !== direction || row.contact_id !== input.contact_id || row.project_id !== input.project_id || row.expected_version !== input.expected_version) {
+    throw new ContactProjectMembershipConflictError(`operation_id/step_id already accepted for a different contact-project membership mutation`);
+  }
+  return {
+    outcome: "duplicate_of_accepted",
+    operation_id: row.operation_id,
+    step_id: row.step_id,
+    before: parseSnapshot(row.before_json),
+    after: parseSnapshot(row.after_json),
+    receipt_id: row.receipt_id
+  };
+}
+function transitionWithoutReceipt(contactId, projectId, linked, db) {
+  const beforeRow = stateRow(contactId, projectId, db);
+  const changed = Boolean(beforeRow.linked) !== linked;
+  const afterRow = {
+    ...beforeRow,
+    linked: linked ? 1 : 0,
+    revision: changed ? beforeRow.revision + 1 : beforeRow.revision
+  };
+  const changedAt = now();
+  db.run(`INSERT INTO contact_project_membership_states
+       (contact_id, project_id, linked, revision, updated_at)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(contact_id, project_id) DO UPDATE SET
+       linked = excluded.linked,
+       revision = excluded.revision,
+       updated_at = excluded.updated_at`, [contactId, projectId, afterRow.linked, afterRow.revision, changedAt]);
+  if (linked) {
+    db.run(`INSERT OR IGNORE INTO contact_projects (contact_id, project_id) VALUES (?, ?)`, [contactId, projectId]);
+  } else {
+    db.run(`DELETE FROM contact_projects WHERE contact_id = ? AND project_id = ?`, [contactId, projectId]);
+  }
+  return changed;
+}
+function setContactProjectMembershipWithoutReceipt(contactId, projectId, linked, db = getDatabase()) {
+  const normalizedContactId = required(contactId, "contact_id");
+  const normalizedProjectId = required(projectId, "project_id");
+  return db.transaction(() => transitionWithoutReceipt(normalizedContactId, normalizedProjectId, linked, db));
+}
+function replaceContactProjectMembershipsWithoutReceipts(contactId, projectIds, db = getDatabase()) {
+  const normalizedContactId = required(contactId, "contact_id");
+  const normalizedProjectIds = [...new Set(projectIds.map((projectId) => required(projectId, "project_id")))];
+  return db.transaction(() => {
+    const currentRows = db.query(`SELECT project_id FROM contact_projects WHERE contact_id = ?`).all(normalizedContactId);
+    const desired = new Set(normalizedProjectIds);
+    const population = new Set([...currentRows.map((row) => row.project_id), ...normalizedProjectIds]);
+    for (const projectId of population) {
+      transitionWithoutReceipt(normalizedContactId, projectId, desired.has(projectId), db);
+    }
+    return normalizedProjectIds;
+  });
+}
+function readContactProjectMembership(contactId, projectId, db = getDatabase()) {
+  return snapshot(stateRow(required(contactId, "contact_id"), required(projectId, "project_id"), db));
+}
+function listContactProjectMemberships(projectId, maxItems, db = getDatabase()) {
+  const normalizedProjectId = required(projectId, "project_id");
+  if (!Number.isInteger(maxItems) || maxItems < 1)
+    throw new Error("max_items must be a positive integer");
+  const rows = db.query(`SELECT cp.contact_id, cp.project_id,
+            COALESCE(state.linked, 1) AS linked,
+            COALESCE(state.revision, 0) AS revision
+     FROM contact_projects cp
+     LEFT JOIN contact_project_membership_states state
+       ON state.contact_id = cp.contact_id AND state.project_id = cp.project_id
+     WHERE cp.project_id = ?
+     ORDER BY cp.contact_id ASC
+     LIMIT ?`).all(normalizedProjectId, maxItems + 1);
+  if (rows.length > maxItems) {
+    throw new Error(`contact project membership collection exceeds max_items=${maxItems}`);
+  }
+  const contactIds = rows.map((row) => row.contact_id);
+  return {
+    project_id: normalizedProjectId,
+    contact_ids: contactIds,
+    complete: true,
+    membership_revision: `cpml_${digest(JSON.stringify(rows.map((row) => snapshot(row)))).slice(0, 32)}`
+  };
+}
+function mutateContactProjectMembership(direction, rawInput, db = getDatabase()) {
+  const input = normalizeInput(rawInput);
+  return db.transaction(() => {
+    const existingReceipt = db.query(`SELECT direction, contact_id, project_id, operation_id, step_id, expected_version,
+              before_json, after_json, receipt_id
+       FROM contact_project_membership_receipts
+       WHERE operation_id = ? AND step_id = ?`).get(input.operation_id, input.step_id);
+    if (existingReceipt)
+      return replay(existingReceipt, direction, input);
+    const contact = db.query(`SELECT id FROM contacts WHERE id = ?`).get(input.contact_id);
+    if (!contact)
+      throw new Error(`contact not found: ${input.contact_id}`);
+    const beforeRow = stateRow(input.contact_id, input.project_id, db);
+    const before = snapshot(beforeRow);
+    if (before.version !== input.expected_version) {
+      throw new ContactProjectMembershipConflictError(`contact project membership expected_version conflict: expected ${input.expected_version}, current ${before.version}`);
+    }
+    const desiredLinked = direction === "attach";
+    const changed = before.linked !== desiredLinked;
+    const afterRow = {
+      ...beforeRow,
+      linked: desiredLinked ? 1 : 0,
+      revision: changed ? beforeRow.revision + 1 : beforeRow.revision
+    };
+    const changedAt = now();
+    db.run(`INSERT INTO contact_project_membership_states
+        (contact_id, project_id, linked, revision, updated_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(contact_id, project_id) DO UPDATE SET
+         linked = excluded.linked,
+         revision = excluded.revision,
+         updated_at = excluded.updated_at`, [input.contact_id, input.project_id, afterRow.linked, afterRow.revision, changedAt]);
+    if (desiredLinked) {
+      db.run(`INSERT OR IGNORE INTO contact_projects (contact_id, project_id) VALUES (?, ?)`, [input.contact_id, input.project_id]);
+    } else {
+      db.run(`DELETE FROM contact_projects WHERE contact_id = ? AND project_id = ?`, [input.contact_id, input.project_id]);
+    }
+    const after = snapshot(afterRow);
+    const id = receiptId(input);
+    db.run(`INSERT INTO contact_project_membership_receipts (
+         receipt_id, direction, contact_id, project_id, operation_id, step_id,
+         expected_version, before_json, after_json, created_at
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      id,
+      direction,
+      input.contact_id,
+      input.project_id,
+      input.operation_id,
+      input.step_id,
+      input.expected_version,
+      JSON.stringify(before),
+      JSON.stringify(after),
+      changedAt
+    ]);
+    return {
+      outcome: changed ? "accepted" : "duplicate_of_accepted",
+      operation_id: input.operation_id,
+      step_id: input.step_id,
+      before,
+      after,
+      receipt_id: id
+    };
+  });
+}
+var init_project_memberships2 = __esm(() => {
+  init_database();
+  init_project_memberships();
+});
+
 // src/db/contacts.ts
 var exports_contacts = {};
 __export(exports_contacts, {
@@ -1481,37 +1899,141 @@ function autoLinkContactToCompany(contactId, db) {
 }
 function linkContactToProject(contactId, projectId, db) {
   const d = db || getDatabase();
-  d.run(`INSERT OR IGNORE INTO contact_projects (contact_id, project_id) VALUES (?, ?)`, [contactId, projectId]);
+  setContactProjectMembershipWithoutReceipt(contactId, projectId, true, d);
 }
 function unlinkContactFromProject(contactId, projectId, db) {
   const d = db || getDatabase();
-  d.run(`DELETE FROM contact_projects WHERE contact_id = ? AND project_id = ?`, [contactId, projectId]);
+  setContactProjectMembershipWithoutReceipt(contactId, projectId, false, d);
 }
 function getContactProjectIds(contactId, db) {
   const d = db || getDatabase();
-  const rows = d.query(`SELECT project_id FROM contact_projects WHERE contact_id = ?`).all(contactId);
+  const rows = d.query(`SELECT project_id FROM contact_projects WHERE contact_id = ? ORDER BY project_id ASC`).all(contactId);
   return rows.map((r) => r.project_id);
 }
 function listContactIdsByProject(projectId, db) {
   const d = db || getDatabase();
-  const rows = d.query(`SELECT contact_id FROM contact_projects WHERE project_id = ?`).all(projectId);
+  const rows = d.query(`SELECT contact_id FROM contact_projects WHERE project_id = ? ORDER BY contact_id ASC`).all(projectId);
   return rows.map((r) => r.contact_id);
 }
 function setContactProjects(contactId, projectIds, db) {
   const d = db || getDatabase();
-  d.run(`DELETE FROM contact_projects WHERE contact_id = ?`, [contactId]);
-  for (const pid of projectIds) {
-    d.run(`INSERT OR IGNORE INTO contact_projects (contact_id, project_id) VALUES (?, ?)`, [contactId, pid]);
-  }
+  replaceContactProjectMembershipsWithoutReceipts(contactId, projectIds, d);
 }
 var init_contacts = __esm(() => {
   init_types();
   init_database();
   init_activity();
   init_tombstones();
+  init_project_memberships2();
+});
+
+// node_modules/.pnpm/content-type@1.0.5/node_modules/content-type/index.js
+var require_content_type = __commonJS((exports) => {
+  /*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+  var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
+  var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
+  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
+  var QUOTE_REGEXP = /([\\"])/g;
+  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  exports.format = format;
+  exports.parse = parse;
+  function format(obj) {
+    if (!obj || typeof obj !== "object") {
+      throw new TypeError("argument obj is required");
+    }
+    var parameters = obj.parameters;
+    var type = obj.type;
+    if (!type || !TYPE_REGEXP.test(type)) {
+      throw new TypeError("invalid type");
+    }
+    var string = type;
+    if (parameters && typeof parameters === "object") {
+      var param;
+      var params = Object.keys(parameters).sort();
+      for (var i = 0;i < params.length; i++) {
+        param = params[i];
+        if (!TOKEN_REGEXP.test(param)) {
+          throw new TypeError("invalid parameter name");
+        }
+        string += "; " + param + "=" + qstring(parameters[param]);
+      }
+    }
+    return string;
+  }
+  function parse(string) {
+    if (!string) {
+      throw new TypeError("argument string is required");
+    }
+    var header = typeof string === "object" ? getcontenttype(string) : string;
+    if (typeof header !== "string") {
+      throw new TypeError("argument string is required to be a string");
+    }
+    var index = header.indexOf(";");
+    var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+    if (!TYPE_REGEXP.test(type)) {
+      throw new TypeError("invalid media type");
+    }
+    var obj = new ContentType(type.toLowerCase());
+    if (index !== -1) {
+      var key;
+      var match;
+      var value;
+      PARAM_REGEXP.lastIndex = index;
+      while (match = PARAM_REGEXP.exec(header)) {
+        if (match.index !== index) {
+          throw new TypeError("invalid parameter format");
+        }
+        index += match[0].length;
+        key = match[1].toLowerCase();
+        value = match[2];
+        if (value.charCodeAt(0) === 34) {
+          value = value.slice(1, -1);
+          if (value.indexOf("\\") !== -1) {
+            value = value.replace(QESC_REGEXP, "$1");
+          }
+        }
+        obj.parameters[key] = value;
+      }
+      if (index !== header.length) {
+        throw new TypeError("invalid parameter format");
+      }
+    }
+    return obj;
+  }
+  function getcontenttype(obj) {
+    var header;
+    if (typeof obj.getHeader === "function") {
+      header = obj.getHeader("content-type");
+    } else if (typeof obj.headers === "object") {
+      header = obj.headers && obj.headers["content-type"];
+    }
+    if (typeof header !== "string") {
+      throw new TypeError("content-type header is missing from object");
+    }
+    return header;
+  }
+  function qstring(val) {
+    var str = String(val);
+    if (TOKEN_REGEXP.test(str)) {
+      return str;
+    }
+    if (str.length > 0 && !TEXT_REGEXP.test(str)) {
+      throw new TypeError("invalid parameter value");
+    }
+    return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+  }
+  function ContentType(type) {
+    this.parameters = Object.create(null);
+    this.type = type;
+  }
 });
 
-// node_modules/ajv/dist/compile/codegen/code.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = undefined;
@@ -1665,7 +2187,7 @@ var require_code = __commonJS((exports) => {
   exports.regexpCode = regexpCode;
 });
 
-// node_modules/ajv/dist/compile/codegen/scope.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/scope.js
 var require_scope = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ValueScope = exports.ValueScopeName = exports.Scope = exports.varKinds = exports.UsedValueState = undefined;
@@ -1811,7 +2333,7 @@ var require_scope = __commonJS((exports) => {
   exports.ValueScope = ValueScope;
 });
 
-// node_modules/ajv/dist/compile/codegen/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/index.js
 var require_codegen = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.or = exports.and = exports.not = exports.CodeGen = exports.operators = exports.varKinds = exports.ValueScopeName = exports.ValueScope = exports.Scope = exports.Name = exports.regexpCode = exports.stringify = exports.getProperty = exports.nil = exports.strConcat = exports.str = exports._ = undefined;
@@ -2521,7 +3043,7 @@ var require_codegen = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/compile/util.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/util.js
 var require_util = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.checkStrictMode = exports.getErrorPath = exports.Type = exports.useFunc = exports.setEvaluated = exports.evaluatedPropsToName = exports.mergeEvaluated = exports.eachItem = exports.unescapeJsonPointer = exports.escapeJsonPointer = exports.escapeFragment = exports.unescapeFragment = exports.schemaRefOrVal = exports.schemaHasRulesButRef = exports.schemaHasRules = exports.checkUnknownRules = exports.alwaysValidSchema = exports.toHash = undefined;
@@ -2685,7 +3207,7 @@ var require_util = __commonJS((exports) => {
   exports.checkStrictMode = checkStrictMode;
 });
 
-// node_modules/ajv/dist/compile/names.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/names.js
 var require_names = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -2710,7 +3232,7 @@ var require_names = __commonJS((exports) => {
   exports.default = names;
 });
 
-// node_modules/ajv/dist/compile/errors.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/errors.js
 var require_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendErrors = exports.resetErrorsCount = exports.reportExtraError = exports.reportError = exports.keyword$DataError = exports.keywordError = undefined;
@@ -2828,7 +3350,7 @@ var require_errors = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/compile/validate/boolSchema.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/boolSchema.js
 var require_boolSchema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.boolOrEmptySchema = exports.topBoolOrEmptySchema = undefined;
@@ -2876,7 +3398,7 @@ var require_boolSchema = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/compile/rules.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/rules.js
 var require_rules = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRules = exports.isJSONType = undefined;
@@ -2904,7 +3426,7 @@ var require_rules = __commonJS((exports) => {
   exports.getRules = getRules;
 });
 
-// node_modules/ajv/dist/compile/validate/applicability.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/applicability.js
 var require_applicability = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.shouldUseRule = exports.shouldUseGroup = exports.schemaHasRulesForType = undefined;
@@ -2924,7 +3446,7 @@ var require_applicability = __commonJS((exports) => {
   exports.shouldUseRule = shouldUseRule;
 });
 
-// node_modules/ajv/dist/compile/validate/dataType.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/dataType.js
 var require_dataType = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.reportTypeError = exports.checkDataTypes = exports.checkDataType = exports.coerceAndCheckDataType = exports.getJSONTypes = exports.getSchemaTypes = exports.DataType = undefined;
@@ -3105,7 +3627,7 @@ var require_dataType = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/compile/validate/defaults.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/defaults.js
 var require_defaults = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.assignDefaults = undefined;
@@ -3139,7 +3661,7 @@ var require_defaults = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/vocabularies/code.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/code.js
 var require_code2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateUnion = exports.validateArray = exports.usePattern = exports.callValidateCode = exports.schemaProperties = exports.allSchemaProperties = exports.noPropertyInData = exports.propertyInData = exports.isOwnProperty = exports.hasPropFunc = exports.reportMissingProp = exports.checkMissingProp = exports.checkReportMissingProp = undefined;
@@ -3268,7 +3790,7 @@ var require_code2 = __commonJS((exports) => {
   exports.validateUnion = validateUnion;
 });
 
-// node_modules/ajv/dist/compile/validate/keyword.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/keyword.js
 var require_keyword = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateKeywordUsage = exports.validSchemaType = exports.funcKeywordCode = exports.macroKeywordCode = undefined;
@@ -3383,7 +3905,7 @@ var require_keyword = __commonJS((exports) => {
   exports.validateKeywordUsage = validateKeywordUsage;
 });
 
-// node_modules/ajv/dist/compile/validate/subschema.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/subschema.js
 var require_subschema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.extendSubschemaMode = exports.extendSubschemaData = exports.getSubschema = undefined;
@@ -3463,7 +3985,7 @@ var require_subschema = __commonJS((exports) => {
   exports.extendSubschemaMode = extendSubschemaMode;
 });
 
-// node_modules/fast-deep-equal/index.js
+// node_modules/.pnpm/fast-deep-equal@3.1.3/node_modules/fast-deep-equal/index.js
 var require_fast_deep_equal = __commonJS((exports, module) => {
   module.exports = function equal(a, b) {
     if (a === b)
@@ -3505,7 +4027,7 @@ var require_fast_deep_equal = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/json-schema-traverse/index.js
+// node_modules/.pnpm/json-schema-traverse@1.0.0/node_modules/json-schema-traverse/index.js
 var require_json_schema_traverse = __commonJS((exports, module) => {
   var traverse = module.exports = function(schema, opts, cb) {
     if (typeof opts == "function") {
@@ -3588,7 +4110,7 @@ var require_json_schema_traverse = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/ajv/dist/compile/resolve.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/resolve.js
 var require_resolve = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getSchemaRefs = exports.resolveUrl = exports.normalizeId = exports._getFullPath = exports.getFullPath = exports.inlineRef = undefined;
@@ -3741,7 +4263,7 @@ var require_resolve = __commonJS((exports) => {
   exports.getSchemaRefs = getSchemaRefs;
 });
 
-// node_modules/ajv/dist/compile/validate/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/validate/index.js
 var require_validate = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getData = exports.KeywordCxt = exports.validateFunctionCode = undefined;
@@ -4246,7 +4768,7 @@ var require_validate = __commonJS((exports) => {
   exports.getData = getData;
 });
 
-// node_modules/ajv/dist/runtime/validation_error.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/runtime/validation_error.js
 var require_validation_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 
@@ -4260,7 +4782,7 @@ var require_validation_error = __commonJS((exports) => {
   exports.default = ValidationError;
 });
 
-// node_modules/ajv/dist/compile/ref_error.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/ref_error.js
 var require_ref_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var resolve_1 = require_resolve();
@@ -4275,7 +4797,7 @@ var require_ref_error = __commonJS((exports) => {
   exports.default = MissingRefError;
 });
 
-// node_modules/ajv/dist/compile/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/index.js
 var require_compile = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.resolveSchema = exports.getCompilingSchema = exports.resolveRef = exports.compileSchema = exports.SchemaEnv = undefined;
@@ -4496,7 +5018,7 @@ var require_compile = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/refs/data.json
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/refs/data.json
 var require_data = __commonJS((exports, module) => {
   module.exports = {
     $id: "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#",
@@ -5286,7 +5808,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   module.exports.fastUri = fastUri;
 });
 
-// node_modules/ajv/dist/runtime/uri.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/runtime/uri.js
 var require_uri = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var uri = require_fast_uri();
@@ -5294,7 +5816,7 @@ var require_uri = __commonJS((exports) => {
   exports.default = uri;
 });
 
-// node_modules/ajv/dist/core.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/core.js
 var require_core = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = undefined;
@@ -5405,7 +5927,7 @@ var require_core = __commonJS((exports) => {
     constructor(opts = {}) {
       this.schemas = {};
       this.refs = {};
-      this.formats = {};
+      this.formats = Object.create(null);
       this._compilations = new Set;
       this._loading = {};
       this._cache = new Map;
@@ -5887,7 +6409,7 @@ var require_core = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv/dist/vocabularies/core/id.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/id.js
 var require_id = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var def = {
@@ -5899,7 +6421,7 @@ var require_id = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/core/ref.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/ref.js
 var require_ref = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.callRef = exports.getValidate = undefined;
@@ -6018,7 +6540,7 @@ var require_ref = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/core/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/core/index.js
 var require_core2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var id_1 = require_id();
@@ -6036,7 +6558,7 @@ var require_core2 = __commonJS((exports) => {
   exports.default = core2;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/limitNumber.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitNumber.js
 var require_limitNumber = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6065,7 +6587,7 @@ var require_limitNumber = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/multipleOf.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/multipleOf.js
 var require_multipleOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6090,7 +6612,7 @@ var require_multipleOf = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/runtime/ucs2length.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/runtime/ucs2length.js
 var require_ucs2length = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   function ucs2length(str) {
@@ -6113,7 +6635,7 @@ var require_ucs2length = __commonJS((exports) => {
   ucs2length.code = 'require("ajv/dist/runtime/ucs2length").default';
 });
 
-// node_modules/ajv/dist/vocabularies/validation/limitLength.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitLength.js
 var require_limitLength = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6142,7 +6664,7 @@ var require_limitLength = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/pattern.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/pattern.js
 var require_pattern = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
@@ -6176,7 +6698,7 @@ var require_pattern = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/limitProperties.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitProperties.js
 var require_limitProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6202,7 +6724,7 @@ var require_limitProperties = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/required.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/required.js
 var require_required = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
@@ -6281,7 +6803,7 @@ var require_required = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/limitItems.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/limitItems.js
 var require_limitItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6307,7 +6829,7 @@ var require_limitItems = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/runtime/equal.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/runtime/equal.js
 var require_equal = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var equal = require_fast_deep_equal();
@@ -6315,7 +6837,7 @@ var require_equal = __commonJS((exports) => {
   exports.default = equal;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/uniqueItems.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/uniqueItems.js
 var require_uniqueItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var dataType_1 = require_dataType();
@@ -6379,7 +6901,7 @@ var require_uniqueItems = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/const.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/const.js
 var require_const = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6405,7 +6927,7 @@ var require_const = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/enum.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/enum.js
 var require_enum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6451,7 +6973,7 @@ var require_enum = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/validation/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/validation/index.js
 var require_validation = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var limitNumber_1 = require_limitNumber();
@@ -6481,7 +7003,7 @@ var require_validation = __commonJS((exports) => {
   exports.default = validation;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/additionalItems.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalItems.js
 var require_additionalItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateAdditionalItems = undefined;
@@ -6531,7 +7053,7 @@ var require_additionalItems = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/items.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items.js
 var require_items = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateTuple = undefined;
@@ -6585,7 +7107,7 @@ var require_items = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/prefixItems.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/prefixItems.js
 var require_prefixItems = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var items_1 = require_items();
@@ -6599,7 +7121,7 @@ var require_prefixItems = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/items2020.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/items2020.js
 var require_items2020 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6631,7 +7153,7 @@ var require_items2020 = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/contains.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/contains.js
 var require_contains = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6722,7 +7244,7 @@ var require_contains = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/dependencies.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/dependencies.js
 var require_dependencies = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateSchemaDeps = exports.validatePropertyDeps = exports.error = undefined;
@@ -6807,7 +7329,7 @@ var require_dependencies = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/propertyNames.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/propertyNames.js
 var require_propertyNames = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -6847,7 +7369,7 @@ var require_propertyNames = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/additionalProperties.js
 var require_additionalProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
@@ -6950,7 +7472,7 @@ var require_additionalProperties = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/properties.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/properties.js
 var require_properties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var validate_1 = require_validate();
@@ -7005,7 +7527,7 @@ var require_properties = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/patternProperties.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/patternProperties.js
 var require_patternProperties = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
@@ -7076,7 +7598,7 @@ var require_patternProperties = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/not.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/not.js
 var require_not = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
@@ -7104,7 +7626,7 @@ var require_not = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/anyOf.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/anyOf.js
 var require_anyOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var code_1 = require_code2();
@@ -7118,7 +7640,7 @@ var require_anyOf = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/oneOf.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/oneOf.js
 var require_oneOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -7173,7 +7695,7 @@ var require_oneOf = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/allOf.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/allOf.js
 var require_allOf = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
@@ -7197,7 +7719,7 @@ var require_allOf = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/if.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/if.js
 var require_if = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -7263,7 +7785,7 @@ var require_if = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/thenElse.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/thenElse.js
 var require_thenElse = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var util_1 = require_util();
@@ -7278,7 +7800,7 @@ var require_thenElse = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/applicator/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/applicator/index.js
 var require_applicator = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var additionalItems_1 = require_additionalItems();
@@ -7321,7 +7843,7 @@ var require_applicator = __commonJS((exports) => {
   exports.default = getApplicator;
 });
 
-// node_modules/ajv/dist/vocabularies/format/format.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/format.js
 var require_format = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -7408,7 +7930,7 @@ var require_format = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/vocabularies/format/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/format/index.js
 var require_format2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var format_1 = require_format();
@@ -7416,7 +7938,7 @@ var require_format2 = __commonJS((exports) => {
   exports.default = format;
 });
 
-// node_modules/ajv/dist/vocabularies/metadata.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/metadata.js
 var require_metadata = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.contentVocabulary = exports.metadataVocabulary = undefined;
@@ -7436,7 +7958,7 @@ var require_metadata = __commonJS((exports) => {
   ];
 });
 
-// node_modules/ajv/dist/vocabularies/draft7.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/draft7.js
 var require_draft7 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var core_1 = require_core2();
@@ -7455,7 +7977,7 @@ var require_draft7 = __commonJS((exports) => {
   exports.default = draft7Vocabularies;
 });
 
-// node_modules/ajv/dist/vocabularies/discriminator/types.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/types.js
 var require_types = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.DiscrError = undefined;
@@ -7466,7 +7988,7 @@ var require_types = __commonJS((exports) => {
   })(DiscrError || (exports.DiscrError = DiscrError = {}));
 });
 
-// node_modules/ajv/dist/vocabularies/discriminator/index.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/vocabularies/discriminator/index.js
 var require_discriminator = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var codegen_1 = require_codegen();
@@ -7542,8 +8064,8 @@ var require_discriminator = __commonJS((exports) => {
         if (!tagRequired)
           throw new Error(`discriminator: "${tagName}" must be required`);
         return oneOfMapping;
-        function hasRequired({ required: required2 }) {
-          return Array.isArray(required2) && required2.includes(tagName);
+        function hasRequired({ required: required3 }) {
+          return Array.isArray(required3) && required3.includes(tagName);
         }
         function addMappings(sch, i) {
           if (sch.const) {
@@ -7568,7 +8090,7 @@ var require_discriminator = __commonJS((exports) => {
   exports.default = def;
 });
 
-// node_modules/ajv/dist/refs/json-schema-draft-07.json
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/refs/json-schema-draft-07.json
 var require_json_schema_draft_07 = __commonJS((exports, module) => {
   module.exports = {
     $schema: "http://json-schema.org/draft-07/schema#",
@@ -7723,7 +8245,7 @@ var require_json_schema_draft_07 = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/ajv/dist/ajv.js
+// node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/ajv.js
 var require_ajv = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.MissingRefError = exports.ValidationError = exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = exports.Ajv = undefined;
@@ -7791,7 +8313,7 @@ var require_ajv = __commonJS((exports, module) => {
   } });
 });
 
-// node_modules/ajv-formats/dist/formats.js
+// node_modules/.pnpm/ajv-formats@3.0.1_ajv@8.20.0/node_modules/ajv-formats/dist/formats.js
 var require_formats = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatNames = exports.fastFormats = exports.fullFormats = undefined;
@@ -7968,7 +8490,7 @@ var require_formats = __commonJS((exports) => {
   }
 });
 
-// node_modules/ajv-formats/dist/limit.js
+// node_modules/.pnpm/ajv-formats@3.0.1_ajv@8.20.0/node_modules/ajv-formats/dist/limit.js
 var require_limit = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.formatLimitDefinition = undefined;
@@ -8037,7 +8559,7 @@ var require_limit = __commonJS((exports) => {
   exports.default = formatLimitPlugin;
 });
 
-// node_modules/ajv-formats/dist/index.js
+// node_modules/.pnpm/ajv-formats@3.0.1_ajv@8.20.0/node_modules/ajv-formats/dist/index.js
 var require_dist = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var formats_1 = require_formats();
@@ -9024,6 +9546,94 @@ var init_pg_migrations = __esm(() => {
   CREATE INDEX IF NOT EXISTS idx_contact_tags_tag_contact ON contact_tags(tag_id, contact_id);
 
   INSERT INTO _migrations (version) VALUES (13) ON CONFLICT DO NOTHING;
+  `,
+    `
+  CREATE TABLE IF NOT EXISTS contact_project_membership_states (
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    project_id TEXT NOT NULL,
+    linked BOOLEAN NOT NULL,
+    revision BIGINT NOT NULL DEFAULT 0 CHECK(revision >= 0),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (contact_id, project_id)
+  );
+
+  INSERT INTO contact_project_membership_states
+    (contact_id, project_id, linked, revision, updated_at)
+  SELECT contact_id, project_id, TRUE, 0, NOW()
+  FROM contact_projects
+  ON CONFLICT DO NOTHING;
+
+  CREATE TABLE IF NOT EXISTS contact_project_membership_receipts (
+    receipt_id TEXT PRIMARY KEY,
+    direction TEXT NOT NULL CHECK(direction IN ('attach', 'detach')),
+    contact_id TEXT NOT NULL REFERENCES contacts(id) ON DELETE CASCADE,
+    project_id TEXT NOT NULL,
+    operation_id TEXT NOT NULL,
+    step_id TEXT NOT NULL,
+    expected_version TEXT NOT NULL,
+    before_json JSONB NOT NULL,
+    after_json JSONB NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(operation_id, step_id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_contact_project_membership_states_project
+    ON contact_project_membership_states(project_id, linked, contact_id);
+  CREATE INDEX IF NOT EXISTS idx_contact_project_membership_receipts_target
+    ON contact_project_membership_receipts(contact_id, project_id, created_at);
+
+  CREATE OR REPLACE FUNCTION sync_contact_project_membership_state_from_legacy()
+  RETURNS TRIGGER
+  LANGUAGE plpgsql
+  AS $$
+  DECLARE
+    target_contact_id TEXT;
+    target_project_id TEXT;
+    target_linked BOOLEAN;
+  BEGIN
+    IF TG_OP = 'INSERT' THEN
+      target_contact_id := NEW.contact_id;
+      target_project_id := NEW.project_id;
+      target_linked := TRUE;
+    ELSE
+      target_contact_id := OLD.contact_id;
+      target_project_id := OLD.project_id;
+      target_linked := FALSE;
+      IF NOT EXISTS (SELECT 1 FROM contacts WHERE id = target_contact_id) THEN
+        RETURN OLD;
+      END IF;
+    END IF;
+
+    INSERT INTO contact_project_membership_states
+      (contact_id, project_id, linked, revision, updated_at)
+    VALUES (target_contact_id, target_project_id, target_linked, 1, NOW())
+    ON CONFLICT (contact_id, project_id) DO UPDATE SET
+      linked = EXCLUDED.linked,
+      revision = CASE
+        WHEN contact_project_membership_states.linked IS DISTINCT FROM EXCLUDED.linked
+          THEN contact_project_membership_states.revision + 1
+        ELSE contact_project_membership_states.revision
+      END,
+      updated_at = CASE
+        WHEN contact_project_membership_states.linked IS DISTINCT FROM EXCLUDED.linked
+          THEN NOW()
+        ELSE contact_project_membership_states.updated_at
+      END;
+
+    IF TG_OP = 'INSERT' THEN
+      RETURN NEW;
+    END IF;
+    RETURN OLD;
+  END;
+  $$;
+
+  DROP TRIGGER IF EXISTS sync_contact_project_membership_state_from_legacy
+    ON contact_projects;
+  CREATE TRIGGER sync_contact_project_membership_state_from_legacy
+  AFTER INSERT OR DELETE ON contact_projects
+  FOR EACH ROW EXECUTE FUNCTION sync_contact_project_membership_state_from_legacy();
+
+  INSERT INTO _migrations (version) VALUES (14) ON CONFLICT DO NOTHING;
   `
   ];
 });
@@ -9152,7 +9762,7 @@ var init_cloud = __esm(() => {
 init_database();
 init_contacts();
 import { existsSync as existsSync9 } from "fs";
-import { join as join7, resolve as resolve2, relative } from "path";
+import { join as join9, resolve as resolve2, relative } from "path";
 
 // src/db/companies.ts
 init_types();
@@ -9978,8 +10588,8 @@ async function exportContacts(format, contacts) {
 // src/lib/images.ts
 init_database();
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, copyFileSync as copyFileSync2, unlinkSync, readdirSync as readdirSync2, readFileSync, writeFileSync } from "fs";
-import { join as join2, extname, basename } from "path";
-var IMAGES_DIR = join2(getDataDir(), "images");
+import { join as join3, extname, basename } from "path";
+var IMAGES_DIR = join3(getDataDir(), "images");
 function ensureImagesDir() {
   if (!existsSync3(IMAGES_DIR))
     mkdirSync3(IMAGES_DIR, { recursive: true });
@@ -9996,14 +10606,14 @@ function saveImage(entityId, source, options) {
     const ext2 = base64Match[1] === "jpeg" ? "jpg" : base64Match[1];
     const data = Buffer.from(base64Match[2], "base64");
     const filename2 = `${entityId}.${ext2}`;
-    writeFileSync(join2(IMAGES_DIR, filename2), data);
+    writeFileSync(join3(IMAGES_DIR, filename2), data);
     return filename2;
   }
   if (!existsSync3(source) && /^[A-Za-z0-9+/=\n\r]+$/.test(source.trim()) && source.length > 100) {
     const ext2 = options?.format || "jpg";
     const data = Buffer.from(source.trim(), "base64");
     const filename2 = `${entityId}.${ext2}`;
-    writeFileSync(join2(IMAGES_DIR, filename2), data);
+    writeFileSync(join3(IMAGES_DIR, filename2), data);
     return filename2;
   }
   if (!existsSync3(source)) {
@@ -10015,14 +10625,14 @@ function saveImage(entityId, source, options) {
     throw new Error(`Unsupported image format: ${ext}. Supported: ${validExts.join(", ")}`);
   }
   const filename = `${entityId}.${ext === "jpeg" ? "jpg" : ext}`;
-  copyFileSync2(source, join2(IMAGES_DIR, filename));
+  copyFileSync2(source, join3(IMAGES_DIR, filename));
   return filename;
 }
 function getImagePath(entityId) {
   ensureImagesDir();
   const files = readdirSync2(IMAGES_DIR);
   const match = files.find((f) => f.startsWith(`${entityId}.`));
-  return match ? join2(IMAGES_DIR, match) : null;
+  return match ? join3(IMAGES_DIR, match) : null;
 }
 function getImageAsBase64(entityId) {
   const path = getImagePath(entityId);
@@ -10039,7 +10649,7 @@ function deleteImage(entityId) {
   let deleted = false;
   for (const f of files) {
     if (f.startsWith(`${entityId}.`)) {
-      unlinkSync(join2(IMAGES_DIR, f));
+      unlinkSync(join3(IMAGES_DIR, f));
       deleted = true;
     }
   }
@@ -10051,20 +10661,31 @@ function listImages() {
   return files.map((f) => ({
     entity_id: basename(f, extname(f)),
     filename: f,
-    path: join2(IMAGES_DIR, f)
+    path: join3(IMAGES_DIR, f)
   }));
 }
 
 // src/lib/vault.ts
 init_database();
 import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
-import { join as join3 } from "path";
-import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
-var VAULT_DIR = getDataDir();
-var VAULT_CONFIG = join3(VAULT_DIR, "vault.json");
-var VAULT_SESSION = join3(VAULT_DIR, ".vault-session");
-var DOCUMENTS_DIR = join3(VAULT_DIR, "documents");
+import { join as join4 } from "path";
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash as createHash2 } from "crypto";
 var SESSION_TTL_MS = 30 * 60 * 1000;
+function getVaultDir() {
+  return getDataDir();
+}
+function getVaultConfigPath() {
+  return join4(getDataDir(), "vault.json");
+}
+function getVaultSessionPath() {
+  return join4(getStateDir(), ".vault-session");
+}
+function getDocumentsDir() {
+  const dir = join4(getDataDir(), "documents");
+  if (!existsSync4(dir))
+    mkdirSync4(dir, { recursive: true });
+  return dir;
+}
 var _derivedKey = null;
 function deriveKey(passphrase, salt) {
   return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
@@ -10074,16 +10695,17 @@ function saveSession(key) {
     key: key.toString("hex"),
     expires_at: new Date(Date.now() + SESSION_TTL_MS).toISOString()
   };
-  writeFileSync2(VAULT_SESSION, JSON.stringify(session), { mode: 384 });
+  writeFileSync2(getVaultSessionPath(), JSON.stringify(session), { mode: 384 });
 }
 function loadSession() {
-  if (!existsSync4(VAULT_SESSION))
+  const sessionPath = getVaultSessionPath();
+  if (!existsSync4(sessionPath))
     return null;
   try {
-    const session = JSON.parse(readFileSync2(VAULT_SESSION, "utf-8"));
+    const session = JSON.parse(readFileSync2(sessionPath, "utf-8"));
     if (new Date(session.expires_at).getTime() < Date.now()) {
       try {
-        unlinkSync2(VAULT_SESSION);
+        unlinkSync2(sessionPath);
       } catch {}
       return null;
     }
@@ -10094,33 +10716,33 @@ function loadSession() {
 }
 function clearSession() {
   try {
-    if (existsSync4(VAULT_SESSION))
-      unlinkSync2(VAULT_SESSION);
+    if (existsSync4(getVaultSessionPath()))
+      unlinkSync2(getVaultSessionPath());
   } catch {}
 }
 function initVault(passphrase) {
-  if (!existsSync4(VAULT_DIR))
-    mkdirSync4(VAULT_DIR, { recursive: true });
-  if (!existsSync4(DOCUMENTS_DIR))
-    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  const vaultDir = getVaultDir();
+  if (!existsSync4(vaultDir))
+    mkdirSync4(vaultDir, { recursive: true });
+  mkdirSync4(getDocumentsDir(), { recursive: true });
   const salt = randomBytes(32);
   const key = deriveKey(passphrase, salt);
-  const keyHash = createHash("sha256").update(key).digest("hex");
+  const keyHash = createHash2("sha256").update(key).digest("hex");
   const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
-  writeFileSync2(VAULT_CONFIG, JSON.stringify(config, null, 2));
+  writeFileSync2(getVaultConfigPath(), JSON.stringify(config, null, 2));
   _derivedKey = key;
   saveSession(key);
 }
 function isVaultInitialized() {
-  return existsSync4(VAULT_CONFIG);
+  return existsSync4(getVaultConfigPath());
 }
 function unlockVault(passphrase) {
-  if (!existsSync4(VAULT_CONFIG))
+  if (!existsSync4(getVaultConfigPath()))
     throw new Error("Vault not initialized. Run 'contacts vault init' first.");
-  const config = JSON.parse(readFileSync2(VAULT_CONFIG, "utf-8"));
+  const config = JSON.parse(readFileSync2(getVaultConfigPath(), "utf-8"));
   const salt = Buffer.from(config.salt, "hex");
   const key = deriveKey(passphrase, salt);
-  const keyHash = createHash("sha256").update(key).digest("hex");
+  const keyHash = createHash2("sha256").update(key).digest("hex");
   if (keyHash !== config.key_hash)
     return false;
   _derivedKey = key;
@@ -10172,21 +10794,52 @@ function decrypt(ciphertext, iv) {
   return decrypted;
 }
 function storeFile(sourcePath, entityId) {
-  if (!existsSync4(DOCUMENTS_DIR))
-    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
+  const documentsDir = getDocumentsDir();
+  if (!existsSync4(documentsDir))
+    mkdirSync4(documentsDir, { recursive: true });
   const ext = sourcePath.split(".").pop() || "bin";
-  const destPath = join3(DOCUMENTS_DIR, `${entityId}.${ext}`);
+  const destPath = join4(documentsDir, `${entityId}.${ext}`);
   const data = readFileSync2(sourcePath);
   writeFileSync2(destPath, data);
   return destPath;
 }
-function getDocumentsDir() {
-  if (!existsSync4(DOCUMENTS_DIR))
-    mkdirSync4(DOCUMENTS_DIR, { recursive: true });
-  return DOCUMENTS_DIR;
+
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (!header) {
+    return;
+  }
+  try {
+    return import_content_type.default.parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) {
+      return;
+    }
+    return essence;
+  }
+}
+function isJsonContentType(header) {
+  if (header === "application/json") {
+    return true;
+  }
+  return mediaTypeEssence(header) === "application/json";
 }
 
-// node_modules/zod/v4/core/core.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15000;
+var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) {
+    return;
+  }
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
   status: "aborted"
 });
@@ -10246,12 +10899,12 @@ function config(newConfig) {
     Object.assign(globalConfig, newConfig);
   return globalConfig;
 }
-// node_modules/zod/v4/core/util.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/util.js
 var exports_util = {};
 __export(exports_util, {
   unwrapMessage: () => unwrapMessage,
   stringifyPrimitive: () => stringifyPrimitive,
-  required: () => required,
+  required: () => required2,
   randomString: () => randomString,
   propertyKeyTypes: () => propertyKeyTypes,
   promiseAllObject: () => promiseAllObject,
@@ -10662,7 +11315,7 @@ function partial(Class, schema, mask) {
     checks: []
   });
 }
-function required(Class, schema, mask) {
+function required2(Class, schema, mask) {
   const oldShape = schema._zod.def.shape;
   const shape = { ...oldShape };
   if (mask) {
@@ -10760,7 +11413,7 @@ class Class {
   constructor(..._args) {}
 }
 
-// node_modules/zod/v4/core/errors.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/errors.js
 var initializer = (inst, def) => {
   inst.name = "$ZodError";
   Object.defineProperty(inst, "_zod", {
@@ -10834,7 +11487,7 @@ function formatError(error, _mapper) {
   return fieldErrors;
 }
 
-// node_modules/zod/v4/core/parse.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/parse.js
 var _parse = (_Err) => (schema, value, _ctx, _params) => {
   const ctx = _ctx ? Object.assign(_ctx, { async: false }) : { async: false };
   const result = schema._zod.run({ value, issues: [] }, ctx);
@@ -10885,7 +11538,7 @@ var _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
   } : { success: true, data: result.value };
 };
 var safeParseAsync = /* @__PURE__ */ _safeParseAsync($ZodRealError);
-// node_modules/zod/v4/core/regexes.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/regexes.js
 var cuid = /^[cC][^\s-]{8,}$/;
 var cuid2 = /^[0-9a-z]+$/;
 var ulid = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
@@ -10943,7 +11596,7 @@ var _null = /null/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
-// node_modules/zod/v4/core/checks.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a;
   inst._zod ?? (inst._zod = {});
@@ -11327,7 +11980,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// node_modules/zod/v4/core/doc.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/doc.js
 class Doc {
   constructor(args = []) {
     this.content = [];
@@ -11365,14 +12018,14 @@ class Doc {
   }
 }
 
-// node_modules/zod/v4/core/versions.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 0,
   patch: 0
 };
 
-// node_modules/zod/v4/core/schemas.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a;
   inst ?? (inst = {});
@@ -12603,7 +13256,7 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-// node_modules/zod/v4/locales/en.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/locales/en.js
 var parsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -12720,7 +13373,7 @@ function en_default() {
     localeError: error()
   };
 }
-// node_modules/zod/v4/core/registries.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/registries.js
 var $output = Symbol("ZodOutput");
 var $input = Symbol("ZodInput");
 
@@ -12770,7 +13423,7 @@ function registry() {
   return new $ZodRegistry;
 }
 var globalRegistry = /* @__PURE__ */ registry();
-// node_modules/zod/v4/core/api.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/api.js
 function _string(Class2, params) {
   return new Class2({
     type: "string",
@@ -13205,7 +13858,7 @@ function _refine(Class2, fn, _params) {
   });
   return schema;
 }
-// node_modules/zod/v4/core/to-json-schema.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/to-json-schema.js
 class JSONSchemaGenerator {
   constructor(params) {
     this.counter = 0;
@@ -13957,7 +14610,7 @@ function isTransforming(_schema, _ctx) {
   }
   throw new Error(`Unknown schema type: ${def.type}`);
 }
-// node_modules/zod/v4/classic/iso.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
   time: () => time2,
@@ -13998,7 +14651,7 @@ function duration2(params) {
   return _isoDuration(ZodISODuration, params);
 }
 
-// node_modules/zod/v4/classic/errors.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/errors.js
 var initializer2 = (inst, issues) => {
   $ZodError.init(inst, issues);
   inst.name = "ZodError";
@@ -14027,13 +14680,13 @@ var ZodRealError = $constructor("ZodError", initializer2, {
   Parent: Error
 });
 
-// node_modules/zod/v4/classic/parse.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/parse.js
 var parse3 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
 
-// node_modules/zod/v4/classic/schemas.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/schemas.js
 var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
   $ZodType.init(inst, def);
   inst.def = def;
@@ -14638,10 +15291,10 @@ function superRefine(fn) {
 function preprocess(fn, schema) {
   return pipe(transform(fn), schema);
 }
-// node_modules/zod/v4/classic/external.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var DEFAULT_NEGOTIATED_PROTOCOL_VERSION = "2025-03-26";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
@@ -14651,7 +15304,7 @@ var AssertObjectSchema = custom((v) => v !== null && (typeof v === "object" || t
 var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   pollInterval: number2().optional()
 });
 var TaskMetadataSchema = object({
@@ -14805,7 +15458,8 @@ var ClientCapabilitiesSchema = object({
   roots: object({
     listChanged: boolean2().optional()
   }).optional(),
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   protocolVersion: string2(),
@@ -14831,7 +15485,8 @@ var ServerCapabilitiesSchema = object({
   tools: object({
     listChanged: boolean2().optional()
   }).optional(),
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   protocolVersion: string2(),
@@ -14946,6 +15601,7 @@ var ResourceSchema = object({
   uri: string2(),
   description: optional(string2()),
   mimeType: optional(string2()),
+  size: optional(number2()),
   annotations: AnnotationsSchema.optional(),
   _meta: optional(looseObject({}))
 });
@@ -15485,17 +16141,19 @@ class UrlElicitationRequiredError extends McpError {
   }
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 class WebStandardStreamableHTTPServerTransport {
   constructor(options = {}) {
     this._started = false;
     this._hasHandledRequest = false;
     this._streamMapping = new Map;
     this._requestToStreamMapping = new Map;
+    this._resumableStreams = new Set;
     this._requestResponseMap = new Map;
     this._initialized = false;
     this._enableJsonResponse = false;
     this._standaloneSseStreamId = "_GET_stream";
+    this._closed = false;
     this.sessionIdGenerator = options.sessionIdGenerator;
     this._enableJsonResponse = options.enableJsonResponse ?? false;
     this._eventStore = options.eventStore;
@@ -15505,6 +16163,22 @@ class WebStandardStreamableHTTPServerTransport {
     this._allowedOrigins = options.allowedOrigins;
     this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
     this._retryInterval = options.retryInterval;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed)
+      return;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(`: keepalive
+
+`));
+      } catch {
+        if (timer !== undefined)
+          clearInterval(timer);
+      }
+    });
+    return timer;
   }
   async start() {
     if (this._started) {
@@ -15552,6 +16226,9 @@ class WebStandardStreamableHTTPServerTransport {
     return;
   }
   async handleRequest(req, options) {
+    if (this._closed) {
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
     if (!this.sessionIdGenerator && this._hasHandledRequest) {
       throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
     }
@@ -15591,6 +16268,7 @@ data:
 `;
     }
     controller.enqueue(encoder.encode(primingEvent));
+    this._resumableStreams.add(streamId);
   }
   async handleGetRequest(req) {
     const acceptHeader = req.headers.get("accept");
@@ -15618,18 +16296,25 @@ data:
     }
     const encoder = new TextEncoder;
     let streamController;
+    let keepAliveTimer = undefined;
     const readable = new ReadableStream({
       start: (controller) => {
         streamController = controller;
       },
       cancel: () => {
-        this._streamMapping.delete(this._standaloneSseStreamId);
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) {
+          this._streamMapping.delete(this._standaloneSseStreamId);
+        }
       }
     });
     const headers = {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive"
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     };
     if (this.sessionId !== undefined) {
       headers["mcp-session-id"] = this.sessionId;
@@ -15638,12 +16323,16 @@ data:
       controller: streamController,
       encoder,
       cleanup: () => {
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
           streamController.close();
         } catch {}
       }
     });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
     return new Response(readable, { headers });
   }
   async replayEvents(lastEventId) {
@@ -15667,20 +16356,33 @@ data:
       const headers = {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive"
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
+      let replayedStreamId = undefined;
+      let cancelled = false;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
-        cancel: () => {}
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (replayedStreamId !== undefined && this._streamMapping.get(replayedStreamId)?.controller === streamController) {
+            this._streamMapping.delete(replayedStreamId);
+          }
+        }
       });
-      const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+      const replayedEventIds = new Set;
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
           const success = this.writeSSEEvent(streamController, encoder, message, eventId);
           if (!success) {
@@ -15688,19 +16390,34 @@ data:
             try {
               streamController.close();
             } catch {}
+          } else {
+            replayedEventIds.add(eventId);
           }
         }
       });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {}
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
         encoder,
+        replayedEventIds,
         cleanup: () => {
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
           this._streamMapping.delete(replayedStreamId);
           try {
             streamController.close();
           } catch {}
         }
       });
+      this._resumableStreams.add(replayedStreamId);
+      keepAliveTimer = this.startKeepAlive(streamController, encoder);
       return new Response(readable, { headers });
     } catch (error2) {
       this.onerror?.(error2);
@@ -15750,7 +16467,7 @@ data:
         return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept both application/json and text/event-stream");
       }
       const ct = req.headers.get("content-type");
-      if (!ct || !ct.includes("application/json")) {
+      if (!isJsonContentType(ct)) {
         this.onerror?.(new Error("Unsupported Media Type: Content-Type must be application/json"));
         return this.createJsonErrorResponse(415, -32000, "Unsupported Media Type: Content-Type must be application/json");
       }
@@ -15780,6 +16497,9 @@ data:
         this.onerror?.(new Error("Parse error: Invalid JSON-RPC message"));
         return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const isInitializationRequest = messages.some(isInitializeRequest);
       if (isInitializationRequest) {
         if (this._initialized && this.sessionId !== undefined) {
@@ -15806,6 +16526,9 @@ data:
           return protocolError;
         }
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const hasRequests = messages.some(isJSONRPCRequest);
       if (!hasRequests) {
         for (const message of messages) {
@@ -15836,18 +16559,25 @@ data:
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
         cancel: () => {
-          this._streamMapping.delete(streamId);
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (this._streamMapping.get(streamId)?.controller === streamController) {
+            this._streamMapping.delete(streamId);
+          }
         }
       });
       const headers = {
         "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
@@ -15858,6 +16588,9 @@ data:
             controller: streamController,
             encoder,
             cleanup: () => {
+              if (keepAliveTimer !== undefined) {
+                clearInterval(keepAliveTimer);
+              }
               this._streamMapping.delete(streamId);
               try {
                 streamController.close();
@@ -15867,19 +16600,33 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
-      for (const message of messages) {
-        let closeSSEStream;
-        let closeStandaloneSSEStream;
-        if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
-          closeSSEStream = () => {
-            this.closeSSEStream(message.id);
-          };
-          closeStandaloneSSEStream = () => {
-            this.closeStandaloneSSEStream();
-          };
+      try {
+        await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+        for (const message of messages) {
+          let closeSSEStream;
+          let closeStandaloneSSEStream;
+          if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
+            closeSSEStream = () => {
+              this.closeSSEStream(message.id);
+            };
+            closeStandaloneSSEStream = () => {
+              this.closeStandaloneSSEStream();
+            };
+          }
+          this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
         }
-        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+      } catch (error2) {
+        this._streamMapping.get(streamId)?.cleanup();
+        this._resumableStreams.delete(streamId);
+        for (const message of messages) {
+          if (isJSONRPCRequest(message)) {
+            this._requestToStreamMapping.delete(message.id);
+          }
+        }
+        throw error2;
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) {
+        keepAliveTimer = this.startKeepAlive(streamController, encoder);
       }
       return new Response(readable, { status: 200, headers });
     } catch (error2) {
@@ -15896,9 +16643,12 @@ data:
     if (protocolError) {
       return protocolError;
     }
-    await Promise.resolve(this._onsessionclosed?.(this.sessionId));
-    await this.close();
-    return new Response(null, { status: 200 });
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
   }
   validateSession(req) {
     if (this.sessionIdGenerator === undefined) {
@@ -15928,11 +16678,16 @@ data:
     return;
   }
   async close() {
+    if (this._closed) {
+      return;
+    }
+    this._closed = true;
     this._streamMapping.forEach(({ cleanup }) => {
       cleanup();
     });
     this._streamMapping.clear();
     this._requestResponseMap.clear();
+    this._resumableStreams.clear();
     this.onclose?.();
   }
   closeSSEStream(requestId) {
@@ -15967,7 +16722,7 @@ data:
       if (standaloneSse === undefined) {
         return;
       }
-      if (standaloneSse.controller && standaloneSse.encoder) {
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === undefined || !standaloneSse.replayedEventIds?.has(eventId))) {
         this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
       }
       return;
@@ -15976,13 +16731,19 @@ data:
     if (!streamId) {
       throw new Error(`No connection established for request ID: ${String(requestId)}`);
     }
-    const stream = this._streamMapping.get(streamId);
-    if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
       let eventId;
       if (this._eventStore) {
         eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === undefined || !stream.replayedEventIds?.has(eventId))) {
+        const written = this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        if (written && eventId !== undefined) {
+          this._resumableStreams.add(streamId);
+        }
       }
-      this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
@@ -15990,6 +16751,25 @@ data:
       const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
       if (allResponsesReady) {
         if (!stream) {
+          if (this._closed) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            this._resumableStreams.delete(streamId);
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
         if (this._enableJsonResponse && stream.resolveJson) {
@@ -16012,6 +16792,7 @@ data:
           this._requestResponseMap.delete(id);
           this._requestToStreamMapping.delete(id);
         }
+        this._resumableStreams.delete(streamId);
       }
     }
   }
@@ -16067,9 +16848,9 @@ function startMcpHttpServer(options) {
 
 // src/mcp/index.ts
 import { readFileSync as readFileSync5 } from "fs";
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 
-// node_modules/zod/v3/external.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -16181,7 +16962,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// node_modules/zod/v3/helpers/util.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -16312,7 +17093,7 @@ var getParsedType2 = (data) => {
   }
 };
 
-// node_modules/zod/v3/ZodError.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -16431,7 +17212,7 @@ ZodError2.create = (issues) => {
   return error2;
 };
 
-// node_modules/zod/v3/locales/en.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue2, _ctx) => {
   let message;
   switch (issue2.code) {
@@ -16534,7 +17315,7 @@ var errorMap = (issue2, _ctx) => {
 };
 var en_default2 = errorMap;
 
-// node_modules/zod/v3/errors.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default2;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -16542,7 +17323,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// node_modules/zod/v3/helpers/parseUtil.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -16648,14 +17429,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// node_modules/zod/v3/helpers/errorUtil.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// node_modules/zod/v3/types.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -20042,7 +20823,7 @@ var coerce = {
   date: (arg) => ZodDate.create({ ...arg, coerce: true })
 };
 var NEVER2 = INVALID;
-// node_modules/zod/v4/mini/schemas.js
+// node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/mini/schemas.js
 var ZodMiniType = /* @__PURE__ */ $constructor("ZodMiniType", (inst, def) => {
   if (!inst._zod)
     throw new Error("Uninitialized schema in ZodMiniType.");
@@ -20084,7 +20865,7 @@ function object2(shape, params) {
   };
   return new ZodMiniObject(def);
 }
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -20168,17 +20949,34 @@ function normalizeObjectSchema(schema) {
   }
   return;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error2) {
   if (error2 && typeof error2 === "object") {
+    if ("issues" in error2 && Array.isArray(error2.issues) && error2.issues.length > 0) {
+      return error2.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join(`
+`);
+    }
     if ("message" in error2 && typeof error2.message === "string") {
       return error2.message;
     }
-    if ("issues" in error2 && Array.isArray(error2.issues) && error2.issues.length > 0) {
-      const firstIssue = error2.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error2);
     } catch {
@@ -20228,12 +21026,12 @@ function getLiteralValue(schema) {
   return;
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
 
-// node_modules/zod-to-json-schema/dist/esm/Options.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use");
 var defaultOptions = {
   name: undefined,
@@ -20266,7 +21064,7 @@ var getDefaultOptions = (options) => typeof options === "string" ? {
   ...defaultOptions,
   ...options
 };
-// node_modules/zod-to-json-schema/dist/esm/Refs.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/Refs.js
 var getRefs = (options) => {
   const _options = getDefaultOptions(options);
   const currentPath = _options.name !== undefined ? [..._options.basePath, _options.definitionPath, _options.name] : _options.basePath;
@@ -20285,7 +21083,7 @@ var getRefs = (options) => {
     ]))
   };
 };
-// node_modules/zod-to-json-schema/dist/esm/errorMessages.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/errorMessages.js
 function addErrorMessage(res, key, errorMessage, refs) {
   if (!refs?.errorMessages)
     return;
@@ -20300,7 +21098,7 @@ function setResponseValueAndErrors(res, key, value, errorMessage, refs) {
   res[key] = value;
   addErrorMessage(res, key, errorMessage, refs);
 }
-// node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
 var getRelativePath = (pathA, pathB) => {
   let i = 0;
   for (;i < pathA.length && i < pathB.length; i++) {
@@ -20309,7 +21107,7 @@ var getRelativePath = (pathA, pathB) => {
   }
   return [(pathA.length - i).toString(), ...pathB.slice(i)].join("/");
 };
-// node_modules/zod-to-json-schema/dist/esm/parsers/any.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/any.js
 function parseAnyDef(refs) {
   if (refs.target !== "openAi") {
     return {};
@@ -20325,7 +21123,7 @@ function parseAnyDef(refs) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/array.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/array.js
 function parseArrayDef(def, refs) {
   const res = {
     type: "array"
@@ -20349,7 +21147,7 @@ function parseArrayDef(def, refs) {
   return res;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/bigint.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/bigint.js
 function parseBigintDef(def, refs) {
   const res = {
     type: "integer",
@@ -20395,24 +21193,24 @@ function parseBigintDef(def, refs) {
   return res;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/boolean.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/boolean.js
 function parseBooleanDef() {
   return {
     type: "boolean"
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/branded.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/branded.js
 function parseBrandedDef(_def, refs) {
   return parseDef(_def.type._def, refs);
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/catch.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/catch.js
 var parseCatchDef = (def, refs) => {
   return parseDef(def.innerType._def, refs);
 };
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/date.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/date.js
 function parseDateDef(def, refs, overrideDateStrategy) {
   const strategy = overrideDateStrategy ?? refs.dateStrategy;
   if (Array.isArray(strategy)) {
@@ -20457,7 +21255,7 @@ var integerDateParser = (def, refs) => {
   return res;
 };
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/default.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/default.js
 function parseDefaultDef(_def, refs) {
   return {
     ...parseDef(_def.innerType._def, refs),
@@ -20465,12 +21263,12 @@ function parseDefaultDef(_def, refs) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/effects.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/effects.js
 function parseEffectsDef(_def, refs) {
   return refs.effectStrategy === "input" ? parseDef(_def.schema._def, refs) : parseAnyDef(refs);
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/enum.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/enum.js
 function parseEnumDef(def) {
   return {
     type: "string",
@@ -20478,7 +21276,7 @@ function parseEnumDef(def) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/intersection.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/intersection.js
 var isJsonSchema7AllOfType = (type) => {
   if ("type" in type && type.type === "string")
     return false;
@@ -20520,7 +21318,7 @@ function parseIntersectionDef(def, refs) {
   } : undefined;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/literal.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/literal.js
 function parseLiteralDef(def, refs) {
   const parsedType2 = typeof def.value;
   if (parsedType2 !== "bigint" && parsedType2 !== "number" && parsedType2 !== "boolean" && parsedType2 !== "string") {
@@ -20540,7 +21338,7 @@ function parseLiteralDef(def, refs) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/string.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 var emojiRegex2 = undefined;
 var zodPatterns = {
   cuid: /^[cC][^\s-]{8,}$/,
@@ -20837,7 +21635,7 @@ function stringifyRegExpWithFlags(regex, refs) {
   return pattern;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/record.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/record.js
 function parseRecordDef(def, refs) {
   if (refs.target === "openAi") {
     console.warn("Warning: OpenAI may not support records in schemas! Try an array of key-value pairs instead.");
@@ -20889,7 +21687,7 @@ function parseRecordDef(def, refs) {
   return schema;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/map.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/map.js
 function parseMapDef(def, refs) {
   if (refs.mapStrategy === "record") {
     return parseRecordDef(def, refs);
@@ -20914,7 +21712,7 @@ function parseMapDef(def, refs) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
 function parseNativeEnumDef(def) {
   const object3 = def.values;
   const actualKeys = Object.keys(def.values).filter((key) => {
@@ -20928,7 +21726,7 @@ function parseNativeEnumDef(def) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/never.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/never.js
 function parseNeverDef(refs) {
   return refs.target === "openAi" ? undefined : {
     not: parseAnyDef({
@@ -20938,7 +21736,7 @@ function parseNeverDef(refs) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/null.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/null.js
 function parseNullDef(refs) {
   return refs.target === "openApi3" ? {
     enum: ["null"],
@@ -20948,7 +21746,7 @@ function parseNullDef(refs) {
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/union.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/union.js
 var primitiveMappings = {
   ZodString: "string",
   ZodNumber: "number",
@@ -21016,7 +21814,7 @@ var asAnyOf = (def, refs) => {
   return anyOf.length ? { anyOf } : undefined;
 };
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/nullable.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/nullable.js
 function parseNullableDef(def, refs) {
   if (["ZodString", "ZodNumber", "ZodBigInt", "ZodBoolean", "ZodNull"].includes(def.innerType._def.typeName) && (!def.innerType._def.checks || !def.innerType._def.checks.length)) {
     if (refs.target === "openApi3") {
@@ -21048,7 +21846,7 @@ function parseNullableDef(def, refs) {
   return base && { anyOf: [base, { type: "null" }] };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/number.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/number.js
 function parseNumberDef(def, refs) {
   const res = {
     type: "number"
@@ -21097,14 +21895,14 @@ function parseNumberDef(def, refs) {
   return res;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/object.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/object.js
 function parseObjectDef(def, refs) {
   const forceOptionalIntoNullable = refs.target === "openAi";
   const result = {
     type: "object",
     properties: {}
   };
-  const required2 = [];
+  const required3 = [];
   const shape = def.shape();
   for (const propName in shape) {
     let propDef = shape[propName];
@@ -21131,11 +21929,11 @@ function parseObjectDef(def, refs) {
     }
     result.properties[propName] = parsedDef;
     if (!propOptional) {
-      required2.push(propName);
+      required3.push(propName);
     }
   }
-  if (required2.length) {
-    result.required = required2;
+  if (required3.length) {
+    result.required = required3;
   }
   const additionalProperties = decideAdditionalProperties(def, refs);
   if (additionalProperties !== undefined) {
@@ -21167,7 +21965,7 @@ function safeIsOptional(schema) {
   }
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/optional.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/optional.js
 var parseOptionalDef = (def, refs) => {
   if (refs.currentPath.toString() === refs.propertyPath?.toString()) {
     return parseDef(def.innerType._def, refs);
@@ -21186,7 +21984,7 @@ var parseOptionalDef = (def, refs) => {
   } : parseAnyDef(refs);
 };
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/pipeline.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/pipeline.js
 var parsePipelineDef = (def, refs) => {
   if (refs.pipeStrategy === "input") {
     return parseDef(def.in._def, refs);
@@ -21206,12 +22004,12 @@ var parsePipelineDef = (def, refs) => {
   };
 };
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/promise.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/promise.js
 function parsePromiseDef(def, refs) {
   return parseDef(def.type._def, refs);
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/set.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/set.js
 function parseSetDef(def, refs) {
   const items = parseDef(def.valueType._def, {
     ...refs,
@@ -21231,7 +22029,7 @@ function parseSetDef(def, refs) {
   return schema;
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/tuple.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/tuple.js
 function parseTupleDef(def, refs) {
   if (def.rest) {
     return {
@@ -21259,24 +22057,24 @@ function parseTupleDef(def, refs) {
   }
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/undefined.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/undefined.js
 function parseUndefinedDef(refs) {
   return {
     not: parseAnyDef(refs)
   };
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/unknown.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/unknown.js
 function parseUnknownDef(refs) {
   return parseAnyDef(refs);
 }
 
-// node_modules/zod-to-json-schema/dist/esm/parsers/readonly.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parsers/readonly.js
 var parseReadonlyDef = (def, refs) => {
   return parseDef(def.innerType._def, refs);
 };
 
-// node_modules/zod-to-json-schema/dist/esm/selectParser.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/selectParser.js
 var selectParser = (def, typeName, refs) => {
   switch (typeName) {
     case ZodFirstPartyTypeKind.ZodString:
@@ -21354,7 +22152,7 @@ var selectParser = (def, typeName, refs) => {
   }
 };
 
-// node_modules/zod-to-json-schema/dist/esm/parseDef.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/parseDef.js
 function parseDef(def, refs, forceResolution = false) {
   const seenItem = refs.seen.get(def);
   if (refs.override) {
@@ -21409,7 +22207,7 @@ var addMeta = (def, refs, jsonSchema) => {
   }
   return jsonSchema;
 };
-// node_modules/zod-to-json-schema/dist/esm/zodToJsonSchema.js
+// node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@3.25.76/node_modules/zod-to-json-schema/dist/esm/zodToJsonSchema.js
 var zodToJsonSchema = (schema, options) => {
   const refs = getRefs(options);
   let definitions = typeof options === "object" && options.definitions ? Object.entries(options.definitions).reduce((acc, [name2, schema2]) => ({
@@ -21469,7 +22267,7 @@ var zodToJsonSchema = (schema, options) => {
   }
   return combined;
 };
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -21511,7 +22309,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 60000;
 
 class Protocol {
@@ -21715,6 +22513,10 @@ class Protocol {
     this._progressHandlers.clear();
     this._taskProgressTokens.clear();
     this._pendingDebouncedNotifications.clear();
+    for (const info of this._timeoutInfo.values()) {
+      clearTimeout(info.timeoutId);
+    }
+    this._timeoutInfo.clear();
     for (const controller of this._requestHandlerAbortControllers.values()) {
       controller.abort();
     }
@@ -21845,7 +22647,9 @@ class Protocol {
         await capturedTransport?.send(errorResponse);
       }
     }).catch((error2) => this._onerror(new Error(`Failed to send response: ${error2}`))).finally(() => {
-      this._requestHandlerAbortControllers.delete(request.id);
+      if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+        this._requestHandlerAbortControllers.delete(request.id);
+      }
     });
   }
   _onprogress(notification) {
@@ -22346,7 +23150,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -22386,7 +23190,7 @@ class AjvJsonSchemaValidator {
   }
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
@@ -22464,7 +23268,7 @@ class ExperimentalServerTasks {
   }
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -22499,7 +23303,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 class Server extends Protocol {
   constructor(_serverInfo, options) {
     super(options);
@@ -22547,16 +23351,7 @@ class Server extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -22832,7 +23627,7 @@ class Server extends Protocol {
   }
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -22846,7 +23641,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -22904,7 +23699,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 class ExperimentalMcpServerTasks {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -22918,7 +23713,7 @@ class ExperimentalMcpServerTasks {
     return mcpServerInternal._createRegisteredTool(name, config2.title, config2.description, config2.inputSchema, config2.outputSchema, config2.annotations, execution, config2._meta, handler);
   }
 }
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -23502,6 +24297,9 @@ class McpServer {
           annotations = rest.shift();
         }
       } else if (typeof firstArg === "object" && firstArg !== null) {
+        if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+          throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+        }
         annotations = rest.shift();
       }
     }
@@ -23594,6 +24392,9 @@ function getZodSchemaObject(schema) {
   if (isZodRawShapeCompat(schema)) {
     return objectFromShape(schema);
   }
+  if (!isZodSchemaInstance(schema)) {
+    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+  }
   return schema;
 }
 function promptArgumentsFromSchema(schema) {
@@ -23638,12 +24439,22 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
+
 class ReadBuffer {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -23671,20 +24482,25 @@ function serializeMessage(message) {
 `;
 }
 
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 class StdioServerTransport {
-  constructor(_stdin = process2.stdin, _stdout = process2.stdout) {
+  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer;
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error2) {
+        this.onerror?.(error2);
+        this.close().catch(() => {});
+      }
     };
     this._onerror = (error2) => {
       this.onerror?.(error2);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   async start() {
     if (this._started) {
@@ -23730,9 +24546,9 @@ class StdioServerTransport {
 }
 
 // src/lib/connector.ts
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { homedir } from "os";
+import { homedir as homedir3 } from "os";
 
 class ConnectorNotInstalledError extends Error {
   connectorName;
@@ -23800,9 +24616,9 @@ async function runConnector(name, args, opts = {}) {
 }
 function getConnectorTokenPath(name, profile = "default") {
   const bases = [
-    join4(homedir(), ".connectors", `connect-${name}`, "profiles", profile, "tokens.json"),
-    join4(homedir(), ".connect", `connect-${name}`, "profiles", profile, "tokens.json"),
-    join4(homedir(), ".connect", `connect-${name}`, "tokens.json")
+    join5(homedir3(), ".connectors", `connect-${name}`, "profiles", profile, "tokens.json"),
+    join5(homedir3(), ".connect", `connect-${name}`, "profiles", profile, "tokens.json"),
+    join5(homedir3(), ".connect", `connect-${name}`, "tokens.json")
   ];
   for (const p of bases) {
     if (existsSync5(p))
@@ -23894,6 +24710,7 @@ function getStorageStatus(db = getDatabase()) {
 
 // src/store/index.ts
 init_contacts();
+init_project_memberships2();
 
 // src/db/groups.ts
 init_database();
@@ -26496,6 +27313,15 @@ class LocalStore {
   async listContactIdsByProject(projectId) {
     return listContactIdsByProject(projectId, this.db);
   }
+  async readContactProjectMembership(contactId, projectId) {
+    return readContactProjectMembership(contactId, projectId, this.db);
+  }
+  async listContactProjectMemberships(projectId, maxItems) {
+    return listContactProjectMemberships(projectId, maxItems, this.db);
+  }
+  async mutateContactProjectMembership(direction, input) {
+    return mutateContactProjectMembership(direction, input, this.db);
+  }
   async createCompany(input) {
     return createCompany(input, this.db);
   }
@@ -27118,20 +27944,33 @@ class ApiStore {
   async findContactByEmailAddress(address) {
     return this.getContactByEmail(address);
   }
-  async linkContactToProject() {
-    return unavailable("linkContactToProject");
+  async linkContactToProject(contactId, projectId) {
+    await this.client.transport.put(`/contacts/${this.enc(contactId)}/projects/${this.enc(projectId)}`);
+  }
+  async unlinkContactFromProject(contactId, projectId) {
+    await this.del(`/contacts/${this.enc(contactId)}/projects/${this.enc(projectId)}`);
   }
-  async unlinkContactFromProject() {
-    return unavailable("unlinkContactFromProject");
+  async getContactProjectIds(contactId) {
+    return pick2(await this.g(`/contacts/${this.enc(contactId)}/projects`), "project_ids") ?? [];
   }
-  async getContactProjectIds() {
-    return unavailable("getContactProjectIds");
+  async setContactProjects(contactId, projectIds) {
+    await this.client.transport.put(`/contacts/${this.enc(contactId)}/projects`, { project_ids: projectIds });
   }
-  async setContactProjects() {
-    return unavailable("setContactProjects");
+  async listContactIdsByProject(projectId) {
+    return pick2(await this.g(`/projects/${this.enc(projectId)}/contacts`), "contact_ids") ?? [];
   }
-  async listContactIdsByProject() {
-    return unavailable("listContactIdsByProject");
+  async readContactProjectMembership(contactId, projectId) {
+    return this.client.transport.get(`/projects/${this.enc(projectId)}/contact-memberships/${this.enc(contactId)}`);
+  }
+  async listContactProjectMemberships(projectId, maxItems) {
+    return this.client.transport.get(`/projects/${this.enc(projectId)}/contact-memberships`, { query: { max_items: maxItems } });
+  }
+  async mutateContactProjectMembership(direction, input) {
+    return this.client.transport.post(`/projects/${this.enc(input.project_id)}/contact-memberships/${this.enc(input.contact_id)}/${direction}`, {
+      operation_id: input.operation_id,
+      step_id: input.step_id,
+      expected_version: input.expected_version
+    });
   }
   async createCompany(input) {
     const res = await this.client.create("companies", stripUndefined(input));
@@ -29017,6 +29856,7 @@ Only include fields that are actually visible in the document. Return valid JSON
 }
 
 // src/mcp/handlers/advanced.ts
+import { join as join6 } from "path";
 var json3 = (v) => ({
   content: [{ type: "text", text: JSON.stringify(v, null, 2) }]
 });
@@ -29024,8 +29864,8 @@ var _contactsAgents = new Map;
 var advancedHandlers = {
   get_field_history: async (a) => json3({ history: await getStore().getFieldHistory(a.contact_id, a.field_name) }),
   get_contact_at: async (a) => {
-    const snapshot = await getStore().getContactAt(a.contact_id, a.timestamp);
-    return json3({ contact_id: a.contact_id, timestamp: a.timestamp, snapshot });
+    const snapshot2 = await getStore().getContactAt(a.contact_id, a.timestamp);
+    return json3({ contact_id: a.contact_id, timestamp: a.timestamp, snapshot: snapshot2 });
   },
   get_job_history: async (a) => json3({ history: await getStore().getJobHistory(a.contact_id) }),
   add_job_entry: async (a) => json3(await getStore().addJobEntry(a.contact_id, {
@@ -29178,8 +30018,9 @@ var advancedHandlers = {
     const { contact_id, image, format } = a;
     await store.getContact(contact_id);
     const filename = await store.saveImage(contact_id, image, { format });
-    await store.updateContact(contact_id, { avatar_url: `~/.hasna/contacts/images/${filename}` });
-    return json3({ ok: true, contact_id, filename, avatar_url: `~/.hasna/contacts/images/${filename}` });
+    const avatarUrl = join6(getImagesDir(), filename);
+    await store.updateContact(contact_id, { avatar_url: avatarUrl });
+    return json3({ ok: true, contact_id, filename, avatar_url: avatarUrl });
   },
   get_contact_photo: async (a) => {
     const { contact_id } = a;
@@ -29201,8 +30042,9 @@ var advancedHandlers = {
     const { company_id, image, format } = a;
     await store.getCompany(company_id);
     const filename = await store.saveImage(company_id, image, { format });
-    await store.updateCompany(company_id, { logo_url: `~/.hasna/contacts/images/${filename}` });
-    return json3({ ok: true, company_id, filename, logo_url: `~/.hasna/contacts/images/${filename}` });
+    const logoUrl = join6(getImagesDir(), filename);
+    await store.updateCompany(company_id, { logo_url: logoUrl });
+    return json3({ ok: true, company_id, filename, logo_url: logoUrl });
   },
   get_company_logo: async (a) => {
     const { company_id } = a;
@@ -29501,11 +30343,11 @@ function jsonSchemaToZodType(schema) {
 }
 function jsonSchemaToZodObject(schema) {
   const objectSchema = schema && typeof schema === "object" ? schema : {};
-  const required2 = new Set(objectSchema.required ?? []);
+  const required3 = new Set(objectSchema.required ?? []);
   const shape = {};
   for (const [key, value] of Object.entries(objectSchema.properties ?? {})) {
     const propertySchema = jsonSchemaToZodType(value);
-    shape[key] = required2.has(key) ? propertySchema : propertySchema.optional();
+    shape[key] = required3.has(key) ? propertySchema : propertySchema.optional();
   }
   return describeSchema(exports_external.object(shape).passthrough(), objectSchema.description);
 }
@@ -30973,10 +31815,10 @@ var TOOL_DEFINITIONS = [
   { name: "get_deal_team", description: "Get the full buying committee for a deal with contact names and roles.", inputSchema: { type: "object", properties: { deal_id: { type: "string" } }, required: ["deal_id"] } },
   { name: "get_coverage_gaps", description: "Identify coverage gaps in a company account \u2014 missing economic buyer, technical evaluator, or org chart relationships.", inputSchema: { type: "object", properties: { company_id: { type: "string" } }, required: ["company_id"] } },
   { name: "get_recent_contact_events", description: "Polling fallback for change events \u2014 returns recent activity log entries, optionally filtered by event type or date.", inputSchema: { type: "object", properties: { since: { type: "string", description: "ISO 8601 datetime \u2014 only events after this date" }, event_types: { type: "array", items: { type: "string" } } } } },
-  { name: "set_contact_photo", description: "Set a contact's profile photo. Provide either a local file path or base64-encoded image data (with or without data URI prefix). Stores image in ~/.hasna/contacts/images/ and updates avatar_url. Supported formats: jpg, png, gif, webp, svg, avif.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, image: { type: "string", description: "File path (e.g. /tmp/photo.jpg) OR base64 data (e.g. data:image/png;base64,...) OR raw base64 string" }, format: { type: "string", description: "Image format hint when using raw base64 (jpg, png, webp). Not needed for file paths or data URIs." } }, required: ["contact_id", "image"] } },
+  { name: "set_contact_photo", description: "Set a contact's profile photo. Provide either a local file path or base64-encoded image data (with or without data URI prefix). Stores image in the XDG data root images dir and updates avatar_url. Supported formats: jpg, png, gif, webp, svg, avif.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, image: { type: "string", description: "File path (e.g. /tmp/photo.jpg) OR base64 data (e.g. data:image/png;base64,...) OR raw base64 string" }, format: { type: "string", description: "Image format hint when using raw base64 (jpg, png, webp). Not needed for file paths or data URIs." } }, required: ["contact_id", "image"] } },
   { name: "get_contact_photo", description: "Get a contact's profile photo as base64 data URI. Returns null if no photo is set.", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } },
   { name: "delete_contact_photo", description: "Remove a contact's profile photo.", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } },
-  { name: "set_company_logo", description: "Set a company's logo image. Provide either a local file path or base64-encoded image data. Stores image in ~/.hasna/contacts/images/ and updates logo_url.", inputSchema: { type: "object", properties: { company_id: { type: "string" }, image: { type: "string", description: "File path or base64 data" }, format: { type: "string", description: "Image format hint for raw base64" } }, required: ["company_id", "image"] } },
+  { name: "set_company_logo", description: "Set a company's logo image. Provide either a local file path or base64-encoded image data. Stores image in the XDG data root images dir and updates logo_url.", inputSchema: { type: "object", properties: { company_id: { type: "string" }, image: { type: "string", description: "File path or base64 data" }, format: { type: "string", description: "Image format hint for raw base64" } }, required: ["company_id", "image"] } },
   { name: "get_company_logo", description: "Get a company's logo as base64 data URI.", inputSchema: { type: "object", properties: { company_id: { type: "string" } }, required: ["company_id"] } },
   { name: "delete_company_logo", description: "Remove a company's logo image.", inputSchema: { type: "object", properties: { company_id: { type: "string" } }, required: ["company_id"] } },
   { name: "set_sensitivity", description: "Set a contact's sensitivity level (normal, confidential, restricted). Restricted contacts are hidden from list/search unless explicitly requested.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, sensitivity: { type: "string", enum: ["normal", "confidential", "restricted"] } }, required: ["contact_id", "sensitivity"] } },
@@ -30984,7 +31826,7 @@ var TOOL_DEFINITIONS = [
   { name: "vault_unlock", description: "Unlock the vault for this session with a passphrase.", inputSchema: { type: "object", properties: { passphrase: { type: "string" } }, required: ["passphrase"] } },
   { name: "vault_lock", description: "Lock the vault, clearing the encryption key from memory.", inputSchema: { type: "object", properties: {} } },
   { name: "vault_status", description: "Check vault initialization and lock status.", inputSchema: { type: "object", properties: {} } },
-  { name: "add_document", description: "Store a document for a contact (passport, tax_id, medical_record, etc.). Text values are encrypted; file attachments are stored plain so agents can read them. Vault must be unlocked.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, doc_type: { type: "string", enum: [...DOCUMENT_TYPES] }, label: { type: "string" }, value: { type: "string", description: "Plaintext value (will be encrypted in DB)" }, file_path: { type: "string", description: "File to attach \u2014 stored PLAIN in ~/.hasna/contacts/documents/ for agent access" }, metadata: { type: "object" }, expires_at: { type: "string" } }, required: ["contact_id", "doc_type", "value"] } },
+  { name: "add_document", description: "Store a document for a contact (passport, tax_id, medical_record, etc.). Text values are encrypted; file attachments are stored plain so agents can read them. Vault must be unlocked.", inputSchema: { type: "object", properties: { contact_id: { type: "string" }, doc_type: { type: "string", enum: [...DOCUMENT_TYPES] }, label: { type: "string" }, value: { type: "string", description: "Plaintext value (will be encrypted in DB)" }, file_path: { type: "string", description: "File to attach \u2014 stored PLAIN in the XDG data root documents dir for agent access" }, metadata: { type: "object" }, expires_at: { type: "string" } }, required: ["contact_id", "doc_type", "value"] } },
   { name: "list_documents", description: "List documents for a contact (metadata only \u2014 no decryption needed). Returns file_path for attachments so agents can read them directly.", inputSchema: { type: "object", properties: { contact_id: { type: "string" } }, required: ["contact_id"] } },
   { name: "get_document", description: "Get a document with decrypted value and file_path. Vault must be unlocked for the text value; file is always accessible.", inputSchema: { type: "object", properties: { document_id: { type: "string" } }, required: ["document_id"] } },
   { name: "get_document_file", description: "Get the plain file path for a document attachment. Agents can read this file directly \u2014 it is NOT encrypted. Returns null if no file attached.", inputSchema: { type: "object", properties: { document_id: { type: "string" } }, required: ["document_id"] } },
@@ -31094,7 +31936,7 @@ function registerContactsStorageTools(server) {
 // src/mcp/index.ts
 function getServerVersion() {
   try {
-    const packageJsonPath = join5(import.meta.dir, "..", "..", "package.json");
+    const packageJsonPath = join7(import.meta.dir, "..", "..", "package.json");
     const pkg2 = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
     return pkg2.version ?? "0.0.0";
   } catch {
@@ -31185,11 +32027,11 @@ function isLoopbackBindHost(hostname2) {
   const normalized = hostname2.trim().toLowerCase();
   return ["localhost", "127.0.0.1", "::1", "[::1]"].includes(normalized);
 }
-function hasScope(principal, required2) {
-  const prefix = required2.split(":")[0];
-  return principal.scopes.has("*") || principal.scopes.has(required2) || principal.scopes.has(`${prefix}:*`);
+function hasScope(principal, required3) {
+  const prefix = required3.split(":")[0];
+  return principal.scopes.has("*") || principal.scopes.has(required3) || principal.scopes.has(`${prefix}:*`);
 }
-function authenticateContactsRequest(req, required2, context = { allowUnauthenticatedLoopback: false }) {
+function authenticateContactsRequest(req, required3, context = { allowUnauthenticatedLoopback: false }) {
   const configured = parseTokenRecords();
   const token = bearerToken(req) ?? req.headers.get("x-contacts-token");
   if (token) {
@@ -31197,8 +32039,8 @@ function authenticateContactsRequest(req, required2, context = { allowUnauthenti
     if (!matched)
       return { ok: false, status: 401, message: "Invalid contacts token" };
     const principal = { id: "api-token", scopes: matched.scopes, localDevelopment: false };
-    if (!hasScope(principal, required2))
-      return { ok: false, status: 403, message: `Missing scope: ${required2}` };
+    if (!hasScope(principal, required3))
+      return { ok: false, status: 403, message: `Missing scope: ${required3}` };
     return { ok: true, principal };
   }
   if (configured.length === 0 && context.allowUnauthenticatedLoopback) {
@@ -31249,9 +32091,12 @@ function redactContactForExport(contact) {
 }
 
 // src/server/v1.ts
+init_project_memberships();
 init_cloud();
 
 // src/server/pg-store.ts
+init_project_memberships();
+import { createHash as createHash3 } from "crypto";
 function uuid3() {
   return crypto.randomUUID();
 }
@@ -31286,6 +32131,45 @@ function newUuid() {
 function nowIso() {
   return new Date().toISOString();
 }
+function contactProjectDigest(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function contactProjectMembershipVersion(row) {
+  return `cpmv_${contactProjectDigest(JSON.stringify([
+    row.contact_id,
+    row.project_id,
+    Boolean(row.linked),
+    Number(row.revision)
+  ])).slice(0, 32)}`;
+}
+function contactProjectMembershipSnapshot(row) {
+  return {
+    contact_id: row.contact_id,
+    project_id: row.project_id,
+    linked: Boolean(row.linked),
+    version: contactProjectMembershipVersion(row)
+  };
+}
+function parseMembershipSnapshot(value) {
+  if (typeof value === "string")
+    return JSON.parse(value);
+  return value;
+}
+function requiredMembershipValue(value, name) {
+  const normalized = value.trim();
+  if (!normalized)
+    throw new Error(`${name} is required`);
+  return normalized;
+}
+function normalizeMembershipMutationInput(input) {
+  return {
+    contact_id: requiredMembershipValue(input.contact_id, "contact_id"),
+    project_id: requiredMembershipValue(input.project_id, "project_id"),
+    operation_id: requiredMembershipValue(input.operation_id, "operation_id"),
+    step_id: requiredMembershipValue(input.step_id, "step_id"),
+    expected_version: requiredMembershipValue(input.expected_version, "expected_version")
+  };
+}
 function parseJson(value) {
   if (!value)
     return {};
@@ -31353,6 +32237,29 @@ function mapTag(row) {
     created_at: iso(row.created_at)
   };
 }
+function mapEmail(row) {
+  return {
+    id: String(row["id"]),
+    contact_id: row["contact_id"] ?? null,
+    company_id: row["company_id"] ?? null,
+    address: String(row["address"]),
+    type: row["type"],
+    is_primary: Boolean(row["is_primary"]),
+    created_at: iso(row["created_at"])
+  };
+}
+function mapPhone(row) {
+  return {
+    id: String(row["id"]),
+    contact_id: row["contact_id"] ?? null,
+    company_id: row["company_id"] ?? null,
+    number: String(row["number"]),
+    country_code: row["country_code"] ?? null,
+    type: row["type"],
+    is_primary: Boolean(row["is_primary"]),
+    created_at: iso(row["created_at"])
+  };
+}
 
 class ContactsPgStore {
   client;
@@ -31372,6 +32279,45 @@ class ContactsPgStore {
       tagsByContactId.get(row.contact_id)?.push(mapTag(row));
     return contacts.map((contact) => ({ ...contact, tags: tagsByContactId.get(contact.id) ?? [] }));
   }
+  async attachContactMethods(contacts) {
+    if (contacts.length === 0)
+      return [];
+    const ids = contacts.map((contact) => contact.id);
+    const emailsByContactId = new Map(ids.map((id) => [id, []]));
+    const phonesByContactId = new Map(ids.map((id) => [id, []]));
+    const [emailRows, phoneRows] = await Promise.all([
+      this.client.many(`SELECT * FROM emails WHERE contact_id = ANY($1::text[]) ORDER BY created_at ASC`, [ids]),
+      this.client.many(`SELECT * FROM phones WHERE contact_id = ANY($1::text[]) ORDER BY created_at ASC`, [ids])
+    ]);
+    for (const row of emailRows)
+      emailsByContactId.get(String(row["contact_id"]))?.push(mapEmail(row));
+    for (const row of phoneRows)
+      phonesByContactId.get(String(row["contact_id"]))?.push(mapPhone(row));
+    return contacts.map((contact) => ({
+      ...contact,
+      emails: emailsByContactId.get(contact.id) ?? [],
+      phones: phonesByContactId.get(contact.id) ?? []
+    }));
+  }
+  async attachContactDetails(contacts) {
+    return this.attachContactMethods(await this.attachTags(contacts));
+  }
+  async insertContactMethods(contactId, emails, phones) {
+    for (const email2 of emails ?? []) {
+      await this.client.query(`INSERT INTO emails (id, contact_id, company_id, address, type, is_primary)
+         SELECT $1, $2, NULL, $3, $4, $5
+         WHERE NOT EXISTS (
+           SELECT 1 FROM emails WHERE contact_id = $2 AND LOWER(address) = LOWER($3)
+         )`, [uuid3(), contactId, email2.address, email2.type ?? "work", email2.is_primary ?? false]);
+    }
+    for (const phone of phones ?? []) {
+      await this.client.query(`INSERT INTO phones (id, contact_id, company_id, number, country_code, type, is_primary)
+         SELECT $1, $2, NULL, $3, $4, $5, $6
+         WHERE NOT EXISTS (
+           SELECT 1 FROM phones WHERE contact_id = $2 AND number = $3
+         )`, [uuid3(), contactId, phone.number, phone.country_code ?? null, phone.type ?? "mobile", phone.is_primary ?? false]);
+    }
+  }
   async listContacts(filter = {}) {
     const limit = Math.min(Math.max(filter.limit ?? 50, 1), 500);
     const offset = Math.max(filter.offset ?? 0, 0);
@@ -31397,13 +32343,13 @@ class ContactsPgStore {
     const countRow = await this.client.get(`SELECT COUNT(*)::text AS count FROM contacts ${whereSql}`, params);
     params.push(limit, offset);
     const rows = await this.client.many(`SELECT * FROM contacts ${whereSql} ORDER BY display_name ASC LIMIT $${params.length - 1} OFFSET $${params.length}`, params);
-    return { contacts: await this.attachTags(rows.map(mapContact)), count: Number(countRow?.count ?? rows.length) };
+    return { contacts: await this.attachContactDetails(rows.map(mapContact)), count: Number(countRow?.count ?? rows.length) };
   }
   async getContact(id) {
     const row = await this.client.get(`SELECT * FROM contacts WHERE id = $1`, [id]);
     if (!row)
       return null;
-    return (await this.attachTags([mapContact(row)]))[0];
+    return (await this.attachContactDetails([mapContact(row)]))[0];
   }
   async createContact(input) {
     const id = uuid3();
@@ -31439,7 +32385,8 @@ class ContactsPgStore {
       input.priority ?? 3,
       input.timezone ?? null
     ]);
-    return (await this.attachTags([mapContact(row)]))[0];
+    await this.insertContactMethods(id, input.emails, input.phones);
+    return (await this.attachContactDetails([mapContact(row)]))[0];
   }
   async updateContact(id, input) {
     const allowed = {};
@@ -31474,17 +32421,192 @@ class ContactsPgStore {
       allowed.custom_fields = JSON.stringify(input.custom_fields);
     }
     const keys = Object.keys(allowed);
-    if (keys.length === 0)
+    const hasMethodAppends = Boolean(input.emails_add?.length || input.phones_add?.length);
+    if (keys.length === 0 && !hasMethodAppends)
       return this.getContact(id);
     const sets = keys.map((k, i) => `${k} = $${i + 2}`);
     sets.push(`updated_at = NOW()`);
     const row = await this.client.get(`UPDATE contacts SET ${sets.join(", ")} WHERE id = $1 RETURNING *`, [id, ...keys.map((k) => allowed[k])]);
-    return row ? (await this.attachTags([mapContact(row)]))[0] : null;
+    if (!row)
+      return null;
+    await this.insertContactMethods(id, input.emails_add, input.phones_add);
+    return (await this.attachContactDetails([mapContact(row)]))[0];
   }
   async deleteContact(id) {
     const result = await this.client.query(`DELETE FROM contacts WHERE id = $1`, [id]);
     return result.rowCount > 0;
   }
+  async linkContactToProject(contactId, projectId) {
+    await this.client.transaction(async (client) => {
+      await this.transitionContactProjectMembershipWithoutReceipt(client, contactId, projectId, true);
+    });
+  }
+  async unlinkContactFromProject(contactId, projectId) {
+    return this.client.transaction((client) => this.transitionContactProjectMembershipWithoutReceipt(client, contactId, projectId, false));
+  }
+  async getContactProjectIds(contactId) {
+    const rows = await this.client.many(`SELECT project_id
+       FROM contact_projects
+       WHERE contact_id = $1
+       ORDER BY project_id ASC`, [contactId]);
+    return rows.map((row) => row.project_id);
+  }
+  async setContactProjects(contactId, projectIds) {
+    const uniqueProjectIds = [...new Set(projectIds.map((projectId) => requiredMembershipValue(projectId, "project_id")))];
+    await this.client.transaction(async (client) => {
+      const current = await client.many(`SELECT project_id FROM contact_projects WHERE contact_id = $1`, [contactId]);
+      const desired = new Set(uniqueProjectIds);
+      const population = new Set([...current.map((row) => row.project_id), ...uniqueProjectIds]);
+      for (const projectId of population) {
+        await this.transitionContactProjectMembershipWithoutReceipt(client, contactId, projectId, desired.has(projectId));
+      }
+    });
+    return uniqueProjectIds;
+  }
+  async listContactIdsByProject(projectId) {
+    const rows = await this.client.many(`SELECT contact_id
+       FROM contact_projects
+       WHERE project_id = $1
+       ORDER BY contact_id ASC`, [projectId]);
+    return rows.map((row) => row.contact_id);
+  }
+  async contactProjectMembershipState(client, contactId, projectId, forUpdate = false) {
+    let row = await client.get(`SELECT contact_id, project_id, linked, revision
+       FROM contact_project_membership_states
+       WHERE contact_id = $1 AND project_id = $2${forUpdate ? " FOR UPDATE" : ""}`, [contactId, projectId]);
+    if (row)
+      return row;
+    const linked = Boolean(await client.get(`SELECT 1 AS present FROM contact_projects WHERE contact_id = $1 AND project_id = $2`, [contactId, projectId]));
+    if (!forUpdate) {
+      return { contact_id: contactId, project_id: projectId, linked, revision: 0 };
+    }
+    await client.execute(`INSERT INTO contact_project_membership_states
+         (contact_id, project_id, linked, revision, updated_at)
+       VALUES ($1, $2, $3, 0, NOW())
+       ON CONFLICT (contact_id, project_id) DO NOTHING`, [contactId, projectId, linked]);
+    row = await client.get(`SELECT contact_id, project_id, linked, revision
+       FROM contact_project_membership_states
+       WHERE contact_id = $1 AND project_id = $2
+       FOR UPDATE`, [contactId, projectId]);
+    if (!row)
+      throw new Error("failed to initialize contact project membership state");
+    return row;
+  }
+  async transitionContactProjectMembershipWithoutReceipt(client, contactId, projectId, linked) {
+    const normalizedContactId = requiredMembershipValue(contactId, "contact_id");
+    const normalizedProjectId = requiredMembershipValue(projectId, "project_id");
+    const before = await this.contactProjectMembershipState(client, normalizedContactId, normalizedProjectId, true);
+    const changed = Boolean(before.linked) !== linked;
+    const revision = Number(before.revision) + (changed ? 1 : 0);
+    await client.execute(`UPDATE contact_project_membership_states
+       SET linked = $3, revision = $4, updated_at = NOW()
+       WHERE contact_id = $1 AND project_id = $2`, [normalizedContactId, normalizedProjectId, linked, revision]);
+    if (linked) {
+      await client.execute(`INSERT INTO contact_projects (contact_id, project_id) VALUES ($1, $2)
+         ON CONFLICT (contact_id, project_id) DO NOTHING`, [normalizedContactId, normalizedProjectId]);
+    } else {
+      await client.execute(`DELETE FROM contact_projects WHERE contact_id = $1 AND project_id = $2`, [normalizedContactId, normalizedProjectId]);
+    }
+    return changed;
+  }
+  async readContactProjectMembership(contactId, projectId) {
+    return contactProjectMembershipSnapshot(await this.contactProjectMembershipState(this.client, contactId, projectId));
+  }
+  async listContactProjectMemberships(projectId, maxItems) {
+    if (!Number.isInteger(maxItems) || maxItems < 1)
+      throw new Error("max_items must be a positive integer");
+    const rows = await this.client.many(`SELECT cp.contact_id, cp.project_id,
+              COALESCE(state.linked, TRUE) AS linked,
+              COALESCE(state.revision, 0) AS revision
+       FROM contact_projects cp
+       LEFT JOIN contact_project_membership_states state
+         ON state.contact_id = cp.contact_id AND state.project_id = cp.project_id
+       WHERE cp.project_id = $1
+       ORDER BY cp.contact_id ASC
+       LIMIT $2`, [projectId, maxItems + 1]);
+    if (rows.length > maxItems) {
+      throw new Error(`contact project membership collection exceeds max_items=${maxItems}`);
+    }
+    return {
+      project_id: projectId,
+      contact_ids: rows.map((row) => row.contact_id),
+      complete: true,
+      membership_revision: `cpml_${contactProjectDigest(JSON.stringify(rows.map(contactProjectMembershipSnapshot))).slice(0, 32)}`
+    };
+  }
+  async mutateContactProjectMembership(direction, rawInput) {
+    const input = normalizeMembershipMutationInput(rawInput);
+    return this.client.transaction(async (client) => {
+      await client.execute(`SELECT pg_advisory_xact_lock(hashtext($1), hashtext($2))`, [input.operation_id, input.step_id]);
+      const receipt = await client.get(`SELECT direction, contact_id, project_id, operation_id, step_id, expected_version,
+                before_json, after_json, receipt_id
+         FROM contact_project_membership_receipts
+         WHERE operation_id = $1 AND step_id = $2`, [input.operation_id, input.step_id]);
+      if (receipt) {
+        if (receipt.direction !== direction || receipt.contact_id !== input.contact_id || receipt.project_id !== input.project_id || receipt.expected_version !== input.expected_version) {
+          throw new ContactProjectMembershipConflictError("operation_id/step_id already accepted for a different contact-project membership mutation");
+        }
+        return {
+          outcome: "duplicate_of_accepted",
+          operation_id: receipt.operation_id,
+          step_id: receipt.step_id,
+          before: parseMembershipSnapshot(receipt.before_json),
+          after: parseMembershipSnapshot(receipt.after_json),
+          receipt_id: receipt.receipt_id
+        };
+      }
+      const contact = await client.get(`SELECT id FROM contacts WHERE id = $1`, [input.contact_id]);
+      if (!contact)
+        throw new Error(`contact not found: ${input.contact_id}`);
+      const beforeRow = await this.contactProjectMembershipState(client, input.contact_id, input.project_id, true);
+      const before = contactProjectMembershipSnapshot(beforeRow);
+      if (before.version !== input.expected_version) {
+        throw new ContactProjectMembershipConflictError(`contact project membership expected_version conflict: expected ${input.expected_version}, current ${before.version}`);
+      }
+      const desiredLinked = direction === "attach";
+      const changed = before.linked !== desiredLinked;
+      const revision = Number(beforeRow.revision) + (changed ? 1 : 0);
+      const afterRow = { ...beforeRow, linked: desiredLinked, revision };
+      await client.execute(`UPDATE contact_project_membership_states
+         SET linked = $3, revision = $4, updated_at = NOW()
+         WHERE contact_id = $1 AND project_id = $2`, [input.contact_id, input.project_id, desiredLinked, revision]);
+      if (desiredLinked) {
+        await client.execute(`INSERT INTO contact_projects (contact_id, project_id) VALUES ($1, $2)
+           ON CONFLICT (contact_id, project_id) DO NOTHING`, [input.contact_id, input.project_id]);
+      } else {
+        await client.execute(`DELETE FROM contact_projects WHERE contact_id = $1 AND project_id = $2`, [input.contact_id, input.project_id]);
+      }
+      const after = contactProjectMembershipSnapshot(afterRow);
+      const id = `cpmr_${contactProjectDigest(JSON.stringify([
+        input.operation_id,
+        input.step_id,
+        input.contact_id,
+        input.project_id
+      ])).slice(0, 32)}`;
+      await client.execute(`INSERT INTO contact_project_membership_receipts (
+           receipt_id, direction, contact_id, project_id, operation_id, step_id,
+           expected_version, before_json, after_json
+         ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, $9::jsonb)`, [
+        id,
+        direction,
+        input.contact_id,
+        input.project_id,
+        input.operation_id,
+        input.step_id,
+        input.expected_version,
+        JSON.stringify(before),
+        JSON.stringify(after)
+      ]);
+      return {
+        outcome: changed ? "accepted" : "duplicate_of_accepted",
+        operation_id: input.operation_id,
+        step_id: input.step_id,
+        before,
+        after,
+        receipt_id: id
+      };
+    });
+  }
   async listCompanies(filter = {}) {
     const limit = Math.min(Math.max(filter.limit ?? 50, 1), 500);
     const offset = Math.max(filter.offset ?? 0, 0);
@@ -32951,6 +34073,84 @@ function contactListFilterFromUrl(url) {
     ...url.searchParams.get("offset") ? { offset: Number(url.searchParams.get("offset")) } : {}
   };
 }
+async function handleContactProjectsRoute(req, method, segments, store) {
+  const resource = segments[1];
+  const id = segments[2];
+  const sub = segments[3];
+  if (resource === "contacts" && id && sub === "projects") {
+    const contact = await store.getContact(id);
+    if (!contact)
+      return error2(404, "contact not found");
+    const projectId = segments[4];
+    if (projectId) {
+      if (method === "PUT") {
+        await store.linkContactToProject(id, projectId);
+        return json5({ attached: true, contact_id: id, project_id: projectId });
+      }
+      if (method === "DELETE") {
+        const removed = await store.unlinkContactFromProject(id, projectId);
+        return json5({ removed, contact_id: id, project_id: projectId });
+      }
+      return error2(405, `method ${method} not allowed on /v1/contacts/:contact_id/projects/:project_id`);
+    }
+    if (method === "GET") {
+      return json5({ contact_id: id, project_ids: await store.getContactProjectIds(id) });
+    }
+    if (method === "PUT") {
+      const body = await readJson(req);
+      if (!body || !Array.isArray(body.project_ids) || !body.project_ids.every((value) => typeof value === "string" && value.trim().length > 0)) {
+        return error2(400, "project_ids must be an array of non-empty strings");
+      }
+      const projectIds = await store.setContactProjects(id, body.project_ids);
+      return json5({ contact_id: id, project_ids: projectIds });
+    }
+    return error2(405, `method ${method} not allowed on /v1/contacts/:contact_id/projects`);
+  }
+  if (resource === "projects" && id && sub === "contacts") {
+    if (method === "GET") {
+      return json5({ project_id: id, contact_ids: await store.listContactIdsByProject(id) });
+    }
+    return error2(405, `method ${method} not allowed on /v1/projects/:project_id/contacts`);
+  }
+  if (resource === "projects" && id && sub === "contact-memberships") {
+    const contactId = segments[4];
+    const action = segments[5];
+    if (!contactId) {
+      if (method !== "GET") {
+        return error2(405, `method ${method} not allowed on /v1/projects/:project_id/contact-memberships`);
+      }
+      const rawMaxItems = new URL(req.url).searchParams.get("max_items");
+      const maxItems = rawMaxItems === null ? 1000 : Number(rawMaxItems);
+      if (!Number.isInteger(maxItems) || maxItems < 1)
+        return error2(400, "max_items must be a positive integer");
+      return json5(await store.listContactProjectMemberships(id, maxItems));
+    }
+    if (!action) {
+      if (method !== "GET") {
+        return error2(405, `method ${method} not allowed on /v1/projects/:project_id/contact-memberships/:contact_id`);
+      }
+      const contact = await store.getContact(contactId);
+      if (!contact)
+        return error2(404, "contact not found");
+      return json5(await store.readContactProjectMembership(contactId, id));
+    }
+    if ((action === "attach" || action === "detach") && method === "POST") {
+      const body = await readJson(req);
+      if (!body || typeof body.operation_id !== "string" || typeof body.step_id !== "string" || typeof body.expected_version !== "string" || body.operation_id.trim().length === 0 || body.step_id.trim().length === 0 || body.expected_version.trim().length === 0) {
+        return error2(400, "operation_id, step_id, and expected_version are required non-empty strings");
+      }
+      return json5(await store.mutateContactProjectMembership(action, {
+        contact_id: contactId,
+        project_id: id,
+        operation_id: body.operation_id,
+        step_id: body.step_id,
+        expected_version: body.expected_version
+      }));
+    }
+    return error2(405, `method ${method} not allowed on contact-project membership route`);
+  }
+  return null;
+}
 async function handleV1Request(req, url) {
   const path = url.pathname;
   if (path !== "/v1" && !path.startsWith("/v1/"))
@@ -32985,6 +34185,9 @@ async function handleV1Request(req, url) {
     return v === null ? undefined : Number(v);
   };
   try {
+    const projectLinks = await handleContactProjectsRoute(req, method, segments, store);
+    if (projectLinks)
+      return projectLinks;
     if (resource === "contacts" && id && sub) {
       if (sub === "tags") {
         const tagId = segments[4];
@@ -33686,6 +34889,8 @@ async function handleV1Request(req, url) {
     return error2(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
     const msg = e.message || "internal error";
+    if (e instanceof ContactProjectMembershipConflictError)
+      return error2(409, msg);
     if (/violates|constraint|invalid input|duplicate key/i.test(msg))
       return error2(400, msg);
     return error2(500, msg);
@@ -33694,7 +34899,7 @@ async function handleV1Request(req, url) {
 
 // src/lib/package-version.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname2, join as join6 } from "path";
+import { dirname as dirname2, join as join8 } from "path";
 import { fileURLToPath } from "url";
 var cached3 = null;
 function getPackageVersion() {
@@ -33703,7 +34908,7 @@ function getPackageVersion() {
   try {
     let dir = dirname2(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
-      const pkgPath = join6(dir, "package.json");
+      const pkgPath = join8(dir, "package.json");
       if (existsSync8(pkgPath)) {
         const pkg2 = JSON.parse(readFileSync7(pkgPath, "utf8"));
         if (pkg2.name === "@hasna/contacts" && pkg2.version) {
@@ -33859,6 +35064,58 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
             color: { type: "string" },
             description: { type: "string" }
           }
+        },
+        ProjectIdsInput: {
+          type: "object",
+          required: ["project_ids"],
+          properties: {
+            project_ids: {
+              type: "array",
+              items: { type: "string", minLength: 1 },
+              uniqueItems: true
+            }
+          }
+        },
+        ContactProjectMembershipSnapshot: {
+          type: "object",
+          required: ["contact_id", "project_id", "linked", "version"],
+          properties: {
+            contact_id: { type: "string" },
+            project_id: { type: "string" },
+            linked: { type: "boolean" },
+            version: { type: "string" }
+          }
+        },
+        ContactProjectMembershipMutationInput: {
+          type: "object",
+          required: ["operation_id", "step_id", "expected_version"],
+          properties: {
+            operation_id: { type: "string", minLength: 1 },
+            step_id: { type: "string", minLength: 1 },
+            expected_version: { type: "string", minLength: 1 }
+          }
+        },
+        ContactProjectMembershipMutationResult: {
+          type: "object",
+          required: ["outcome", "operation_id", "step_id", "before", "after", "receipt_id"],
+          properties: {
+            outcome: { type: "string", enum: ["accepted", "duplicate_of_accepted"] },
+            operation_id: { type: "string" },
+            step_id: { type: "string" },
+            before: { $ref: "#/components/schemas/ContactProjectMembershipSnapshot" },
+            after: { $ref: "#/components/schemas/ContactProjectMembershipSnapshot" },
+            receipt_id: { type: "string" }
+          }
+        },
+        ContactProjectMembershipListResult: {
+          type: "object",
+          required: ["project_id", "contact_ids", "complete", "membership_revision"],
+          properties: {
+            project_id: { type: "string" },
+            contact_ids: { type: "array", items: { type: "string" } },
+            complete: { type: "boolean", const: true },
+            membership_revision: { type: "string" }
+          }
         }
       }
     },
@@ -34059,6 +35316,167 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
           })
         }
       },
+      "/v1/contacts/{contact_id}/projects": {
+        get: {
+          operationId: "getContactProjectIds",
+          summary: "List project ids attached to a contact",
+          parameters: [
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: objResponse({
+            contact_id: { type: "string" },
+            project_ids: { type: "array", items: { type: "string" } }
+          })
+        },
+        put: {
+          operationId: "setContactProjects",
+          summary: "Atomically replace a contact's project memberships",
+          parameters: [
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectIdsInput" } } }
+          },
+          responses: objResponse({
+            contact_id: { type: "string" },
+            project_ids: { type: "array", items: { type: "string" } }
+          })
+        }
+      },
+      "/v1/contacts/{contact_id}/projects/{project_id}": {
+        put: {
+          operationId: "linkContactToProject",
+          summary: "Attach a contact to a project idempotently",
+          parameters: [
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } },
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: objResponse({
+            attached: { type: "boolean" },
+            contact_id: { type: "string" },
+            project_id: { type: "string" }
+          })
+        },
+        delete: {
+          operationId: "unlinkContactFromProject",
+          summary: "Detach a contact from a project",
+          parameters: [
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } },
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: objResponse({
+            removed: { type: "boolean" },
+            contact_id: { type: "string" },
+            project_id: { type: "string" }
+          })
+        }
+      },
+      "/v1/projects/{project_id}/contacts": {
+        get: {
+          operationId: "listContactIdsByProject",
+          summary: "List contact ids attached to a project",
+          parameters: [
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: objResponse({
+            project_id: { type: "string" },
+            contact_ids: { type: "array", items: { type: "string" } }
+          })
+        }
+      },
+      "/v1/projects/{project_id}/contact-memberships": {
+        get: {
+          operationId: "listContactProjectMemberships",
+          summary: "List the complete authoritative contact membership collection for a project",
+          parameters: [
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } },
+            { name: "max_items", in: "query", required: true, schema: { type: "integer", minimum: 1 } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ContactProjectMembershipListResult" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/projects/{project_id}/contact-memberships/{contact_id}": {
+        get: {
+          operationId: "readContactProjectMembership",
+          summary: "Read one authoritative contact-project membership snapshot",
+          parameters: [
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } },
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ContactProjectMembershipSnapshot" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/projects/{project_id}/contact-memberships/{contact_id}/attach": {
+        post: {
+          operationId: "attachContactProjectMembership",
+          summary: "Attach a contact to a project under expected-version CAS with a replay-safe receipt",
+          parameters: [
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } },
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/ContactProjectMembershipMutationInput" }
+              }
+            }
+          },
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ContactProjectMembershipMutationResult" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/projects/{project_id}/contact-memberships/{contact_id}/detach": {
+        post: {
+          operationId: "detachContactProjectMembership",
+          summary: "Detach a contact from a project under expected-version CAS with a replay-safe receipt",
+          parameters: [
+            { name: "project_id", in: "path", required: true, schema: { type: "string" } },
+            { name: "contact_id", in: "path", required: true, schema: { type: "string" } }
+          ],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/ContactProjectMembershipMutationInput" }
+              }
+            }
+          },
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ContactProjectMembershipMutationResult" }
+                }
+              }
+            }
+          }
+        }
+      },
       "/v1/stats": {
         get: {
           operationId: "getStats",
@@ -34076,7 +35494,7 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
 
 // src/server/serve.ts
 init_cloud();
-var DASHBOARD_DIST = join7(import.meta.dir, "../../dashboard/dist");
+var DASHBOARD_DIST = join9(import.meta.dir, "../../dashboard/dist");
 var DEFAULT_REST_HOST = "127.0.0.1";
 function json6(data, status = 200) {
   return new Response(JSON.stringify(data), {
@@ -34109,9 +35527,9 @@ function requireScope(req, scope, options) {
 function isResponse(value) {
   return value instanceof Response;
 }
-function privateFileHeaders(contentType) {
+function privateFileHeaders(contentType2) {
   return {
-    ...contentType ? { "Content-Type": contentType } : {},
+    ...contentType2 ? { "Content-Type": contentType2 } : {},
     "Cache-Control": "private, no-store",
     "X-Content-Type-Options": "nosniff"
   };
@@ -34119,8 +35537,8 @@ function privateFileHeaders(contentType) {
 function isSafeEntityId(id) {
   return /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/.test(id) && !id.includes("..") && !id.includes("/");
 }
-function isPathInside(baseDir, filePath) {
-  const base = resolve2(baseDir);
+function isPathInside(baseDir2, filePath) {
+  const base = resolve2(baseDir2);
   const file = resolve2(filePath);
   const rel = relative(base, file);
   return rel === "" || !!rel && !rel.startsWith("..") && !rel.startsWith("/") && !rel.includes("..\\");
@@ -34392,15 +35810,15 @@ async function handleImages(req, _url2, segments, options) {
     const principal = requireScope(req, "images:write", options);
     if (isResponse(principal))
       return principal;
-    const contentType = req.headers.get("content-type") || "";
-    if (contentType.includes("multipart/form-data")) {
+    const contentType2 = req.headers.get("content-type") || "";
+    if (contentType2.includes("multipart/form-data")) {
       const formData = await req.formData();
       const file = formData.get("image");
       if (!file)
         return apiError("No image file in form data");
       const ext = file.name?.split(".").pop() || "jpg";
       const buffer = Buffer.from(await file.arrayBuffer());
-      const tmpPath = join7(getImagesDir(), `_upload_${entityId}.${ext}`);
+      const tmpPath = join9(getImagesDir(), `_upload_${entityId}.${ext}`);
       const { writeFileSync: wfs } = await import("fs");
       wfs(tmpPath, buffer);
       try {
@@ -34521,8 +35939,8 @@ function createContactsRequestHandler(options = {}) {
         if (isResponse(principal)) {
           response = principal;
         } else {
-          const filePath = join7(DASHBOARD_DIST, url.pathname === "/" ? "index.html" : url.pathname);
-          response = serveStaticFile(filePath) ?? serveStaticFile(join7(DASHBOARD_DIST, "index.html")) ?? new Response("Not Found", { status: 404 });
+          const filePath = join9(DASHBOARD_DIST, url.pathname === "/" ? "index.html" : url.pathname);
+          response = serveStaticFile(filePath) ?? serveStaticFile(join9(DASHBOARD_DIST, "index.html")) ?? new Response("Not Found", { status: 404 });
         }
       }
     } catch (err2) {