@hraness/peopleblade 0.1.1 → 0.1.2

package/dist/peopleblade.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 // @bun
+var __require = import.meta.require;
 
 // src/cli/main.ts
 import { existsSync as existsSync5 } from "fs";
@@ -5800,6 +5801,9 @@ function parseGranolaImportJson(raw) {
 
 // src/local/cloud-client.ts
 import { createHash as createHash2, randomBytes } from "crypto";
+import { z as z6 } from "zod";
+
+// src/local/cloud-configuration.ts
 import { z as z5 } from "zod";
 
 // src/local/config.ts
@@ -5856,6 +5860,100 @@ function writeLocalConfig(config) {
   renameSync(temporary, path);
 }
 
+// src/local/cloud-configuration.ts
+var cloudConfigurationSchema = z5.object({
+  baseUrl: z5.url().max(2048),
+  deviceId: z5.uuid(),
+  token: z5.string().min(20).max(512)
+}).strict();
+function cloudConfiguration(override) {
+  const config = override ?? readLocalConfig().cloud;
+  if (config === null)
+    throw new Error("Run `peopleblade cloud signin` first.");
+  return cloudConfigurationSchema.parse(config);
+}
+
+// src/local/cloud-transport.ts
+class CloudHttpError extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "CloudHttpError";
+  }
+}
+async function postJson(fetcher, url, body, bearer, timeoutMs = 45000, signal) {
+  const response = await fetcher(url, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...bearer === undefined ? {} : { authorization: `Bearer ${bearer}` } },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: signal === undefined ? AbortSignal.timeout(timeoutMs) : AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)])
+  });
+  if (response.bodyUsed || response.body?.locked)
+    await response.text();
+  const reader = response.body?.getReader();
+  let reachedEof = false;
+  let failed = false;
+  try {
+    const raw = reader === undefined ? "" : await readBoundedText(reader);
+    reachedEof = true;
+    return parseResponse(raw, response);
+  } catch (error) {
+    failed = true;
+    throw error;
+  } finally {
+    if (reader !== undefined) {
+      if (!reachedEof) {
+        try {
+          reader.cancel().catch(() => {
+            return;
+          });
+        } catch {}
+      }
+      try {
+        reader.releaseLock();
+      } catch (error) {
+        if (!failed)
+          throw error;
+      }
+    }
+  }
+}
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+async function readBoundedText(reader) {
+  const bytes = new Uint8Array(MAX_RESPONSE_BYTES + 3);
+  let length = 0;
+  for (;; ) {
+    const next = await reader.read();
+    if (next.done)
+      break;
+    if (next.value.byteLength > bytes.length - length)
+      throw new Error("PeopleBlade cloud response is too large.");
+    bytes.set(next.value, length);
+    length += next.value.byteLength;
+  }
+  const raw = new TextDecoder().decode(bytes.subarray(0, length));
+  if (Buffer.byteLength(raw) > MAX_RESPONSE_BYTES)
+    throw new Error("PeopleBlade cloud response is too large.");
+  return raw;
+}
+function parseResponse(raw, response) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    if (!response.ok)
+      throw new CloudHttpError(response.status, `PeopleBlade cloud returned HTTP ${response.status} without a JSON error response.`);
+    throw new Error("PeopleBlade cloud returned invalid JSON.");
+  }
+  if (!response.ok) {
+    const message = value !== null && typeof value === "object" && typeof value.message === "string" ? value.message : `PeopleBlade cloud returned HTTP ${response.status}.`;
+    throw new CloudHttpError(response.status, message);
+  }
+  return value;
+}
+
 // src/local/projection.ts
 function parseStringArray(value) {
   const parsed = JSON.parse(value);
@@ -5872,12 +5970,6 @@ function iso(value) {
 function localDatabaseFingerprint(database) {
   return localDatabaseInstanceId(database);
 }
-function localSchemaVersion(database) {
-  const row = database.query("SELECT count(*) AS count FROM schema_migrations").get();
-  if (row === null || !Number.isSafeInteger(row.count) || row.count < 1)
-    throw new Error("PeopleBlade schema is not initialized.");
-  return row.count;
-}
 function projectCloudContacts(database) {
   const rows = database.query(`
     WITH
@@ -6090,77 +6182,49 @@ function projectCloudContacts(database) {
 }
 
 // src/local/cloud-client.ts
-var deviceStartResponse = z5.object({
+var deviceStartResponse = z6.object({
   deviceCode: deviceCodeSchema,
-  userCode: z5.string().regex(/^[23456789A-HJ-NP-Z]{8}$/u),
-  verificationUri: z5.url().max(2048),
-  expiresIn: z5.number().int().min(60).max(3600),
-  interval: z5.number().int().min(1).max(30)
+  userCode: z6.string().regex(/^[23456789A-HJ-NP-Z]{8}$/u),
+  verificationUri: z6.url().max(2048),
+  expiresIn: z6.number().int().min(60).max(3600),
+  interval: z6.number().int().min(1).max(30)
 }).strict();
-var deviceStatusResponse = z5.discriminatedUnion("status", [
-  z5.object({ status: z5.literal("pending") }).strict(),
-  z5.object({ status: z5.literal("expired") }).strict(),
-  z5.object({ status: z5.literal("authorized"), deviceId: z5.uuid() }).strict()
+var deviceStatusResponse = z6.discriminatedUnion("status", [
+  z6.object({ status: z6.literal("pending") }).strict(),
+  z6.object({ status: z6.literal("expired") }).strict(),
+  z6.object({ status: z6.literal("authorized"), deviceId: z6.uuid() }).strict()
 ]);
-var syncStartResponse = z5.object({
-  snapshotId: z5.uuid(),
-  resumed: z5.boolean(),
-  uploadedContacts: z5.number().int().min(0).max(1e6),
-  uploadedPages: z5.number().int().min(0).max(1e5),
-  uploadedPageContactCounts: z5.array(z5.number().int().min(1).max(200)).max(1e5)
-}).strict().superRefine((value, context) => {
-  if (value.uploadedPageContactCounts.length !== value.uploadedPages)
-    context.addIssue({
-      code: "custom",
-      path: ["uploadedPageContactCounts"],
-      message: "Uploaded sync-page manifest length does not match its page count"
-    });
-  const contactCount = value.uploadedPageContactCounts.reduce((sum, count) => sum + count, 0);
-  if (contactCount !== value.uploadedContacts)
-    context.addIssue({
-      code: "custom",
-      path: ["uploadedContacts"],
-      message: "Uploaded sync-page manifest does not match its contact count"
-    });
-  if (!value.resumed && (value.uploadedContacts !== 0 || value.uploadedPages !== 0))
-    context.addIssue({
-      code: "custom",
-      path: ["resumed"],
-      message: "A fresh sync snapshot cannot report uploaded progress"
-    });
-});
-var SYNC_PAGE_TIMEOUT_MS = 240000;
-var boundedModelCoordinateSchema = z5.string().min(1).max(256).regex(/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/u);
-var usageOperationSchema = z5.string().regex(/^[a-z][a-z0-9_]{0,63}$/u);
-var usageProviderSchema = z5.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
-var usageUnitSchema = z5.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
-var cliEnrichmentUsageLimitResponse = z5.object({
+var boundedModelCoordinateSchema = z6.string().min(1).max(256).regex(/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/u);
+var usageOperationSchema = z6.string().regex(/^[a-z][a-z0-9_]{0,63}$/u);
+var usageProviderSchema = z6.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
+var usageUnitSchema = z6.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
+var cliEnrichmentUsageLimitResponse = z6.object({
   operation: usageOperationSchema,
   provider: usageProviderSchema,
   unit: usageUnitSchema,
-  maximum: z5.number().int().min(0).max(100)
+  maximum: z6.number().int().min(0).max(100)
 }).strict();
-var cliEnrichmentPreviewResponse = z5.object({
-  previewId: z5.uuid(),
+var cliEnrichmentPreviewResponse = z6.object({
+  previewId: z6.uuid(),
   confirmationToken: cliEnrichmentConfirmationTokenSchema,
-  selectedCount: z5.number().int().min(1).max(100),
-  availableCredits: z5.number().int().min(0),
-  usageLimits: z5.array(cliEnrichmentUsageLimitResponse).min(1).max(16),
-  policyVersion: z5.literal(enrichmentPolicyVersion),
+  selectedCount: z6.number().int().min(1).max(100),
+  availableCredits: z6.number().int().min(0),
+  usageLimits: z6.array(cliEnrichmentUsageLimitResponse).min(1).max(16),
+  policyVersion: z6.literal(enrichmentPolicyVersion),
   model: boundedModelCoordinateSchema,
-  expiresAt: z5.iso.datetime({ offset: true })
+  expiresAt: z6.iso.datetime({ offset: true })
 }).strict();
-var cliPrioritizedEnrichmentContactResponse = z5.object({
-  localPersonId: z5.string().regex(/^[1-9][0-9]{0,18}$/u),
-  enrichmentInputVersion: z5.literal(2),
-  enrichmentInputSha256: z5.string().regex(/^[a-f0-9]{64}$/u),
-  rank: z5.number().int().min(1).max(100),
-  score: z5.number().int().min(0).max(1e4),
-  components: z5.object({
-    engagement: z5.number().int().min(0).max(5500),
-    reciprocity: z5.number().int().min(0).max(1000),
-    dataGaps: z5.number().int().min(0).max(2000),
-    identityReadiness: z5.number().int().min(0).max(1500)
+var cliPrioritizedEnrichmentContactResponse = z6.object({
+  localPersonId: z6.string().regex(/^[1-9][0-9]{0,18}$/u),
+  enrichmentInputVersion: z6.literal(2),
+  enrichmentInputSha256: z6.string().regex(/^[a-f0-9]{64}$/u),
+  rank: z6.number().int().min(1).max(100),
+  score: z6.number().int().min(0).max(1e4),
+  components: z6.object({
+    engagement: z6.number().int().min(0).max(5500),
+    reciprocity: z6.number().int().min(0).max(1000),
+    dataGaps: z6.number().int().min(0).max(2000),
+    identityReadiness: z6.number().int().min(0).max(1500)
   }).strict()
 }).strict().superRefine((value, context) => {
   const total = value.components.engagement + value.components.reciprocity + value.components.dataGaps + value.components.identityReadiness;
@@ -6168,39 +6232,39 @@ var cliPrioritizedEnrichmentContactResponse = z5.object({
     context.addIssue({ code: "custom", path: ["score"], message: "Priority score components drifted" });
 });
 var cliPrioritizedEnrichmentPreviewResponse = cliEnrichmentPreviewResponse.extend({
-  contacts: z5.array(cliPrioritizedEnrichmentContactResponse).min(1).max(100),
-  priority: z5.object({
-    policyVersion: z5.literal(enrichmentPriorityPolicyVersion),
-    asOf: z5.iso.datetime({ offset: true }),
-    receiptSha256: z5.string().regex(/^[a-f0-9]{64}$/u),
-    eligibleCount: z5.number().int().min(1).max(1e6),
-    executionCapacity: z5.tuple([z5.object({
-      operation: z5.literal("enrich_email"),
-      maximum: z5.number().int().min(0).max(100)
+  contacts: z6.array(cliPrioritizedEnrichmentContactResponse).min(1).max(100),
+  priority: z6.object({
+    policyVersion: z6.literal(enrichmentPriorityPolicyVersion),
+    asOf: z6.iso.datetime({ offset: true }),
+    receiptSha256: z6.string().regex(/^[a-f0-9]{64}$/u),
+    eligibleCount: z6.number().int().min(1).max(1e6),
+    executionCapacity: z6.tuple([z6.object({
+      operation: z6.literal("enrich_email"),
+      maximum: z6.number().int().min(0).max(100)
     }).strict()])
   }).strict()
 }).strict();
-var cliEnrichmentDispatchResponse = z5.object({
-  jobId: z5.uuid(),
-  dispatchStatus: z5.enum(["dispatching", "launched", "indeterminate"]),
-  replayed: z5.boolean()
+var cliEnrichmentDispatchResponse = z6.object({
+  jobId: z6.uuid(),
+  dispatchStatus: z6.enum(["dispatching", "launched", "indeterminate"]),
+  replayed: z6.boolean()
 }).strict();
-var enrichmentFieldSchema = z5.enum(["headline", "organization", "role", "location", "website", "publicEmail"]);
-var usageBillingSurfaceSchema = z5.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
+var enrichmentFieldSchema = z6.enum(["headline", "organization", "role", "location", "website", "publicEmail"]);
+var usageBillingSurfaceSchema = z6.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
 var usageModelSchema = boundedModelCoordinateSchema.nullable();
-var usageBillingUnitSchema = z5.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u).nullable();
-var usageBillingCertaintySchema = z5.enum(["unknown", "reported", "contractual", "conservative"]);
-var usageOutcomeSchema = z5.string().regex(/^[a-z][a-z0-9_]{0,63}$/u);
-var usageErrorCodeSchema = z5.string().regex(/^[A-Z0-9][A-Z0-9_:.-]{2,159}$/u).nullable();
-var usageCostCertaintySchema = z5.enum(["reported", "contractual", "estimated", "unknown", "reconciled"]);
-var usageExecutionRouteSchema = z5.string().regex(/^[a-z][a-z0-9_]{0,63}$/u);
-var usageExecutionProfileSha256Schema = z5.string().regex(/^[0-9a-f]{64}$/u).nullable();
-var boundedUsageCount = z5.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
-var cliEnrichmentUsageCoverageResponse = z5.object({
-  ledgerRuns: z5.number().int().min(0).max(100),
-  legacyRuns: z5.number().int().min(0).max(100)
+var usageBillingUnitSchema = z6.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u).nullable();
+var usageBillingCertaintySchema = z6.enum(["unknown", "reported", "contractual", "conservative"]);
+var usageOutcomeSchema = z6.string().regex(/^[a-z][a-z0-9_]{0,63}$/u);
+var usageErrorCodeSchema = z6.string().regex(/^[A-Z0-9][A-Z0-9_:.-]{2,159}$/u).nullable();
+var usageCostCertaintySchema = z6.enum(["reported", "contractual", "estimated", "unknown", "reconciled"]);
+var usageExecutionRouteSchema = z6.string().regex(/^[a-z][a-z0-9_]{0,63}$/u);
+var usageExecutionProfileSha256Schema = z6.string().regex(/^[0-9a-f]{64}$/u).nullable();
+var boundedUsageCount = z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var cliEnrichmentUsageCoverageResponse = z6.object({
+  ledgerRuns: z6.number().int().min(0).max(100),
+  legacyRuns: z6.number().int().min(0).max(100)
 }).strict();
-var cliEnrichmentProviderUsageResponse = z5.object({
+var cliEnrichmentProviderUsageResponse = z6.object({
   operation: usageOperationSchema,
   executionRoute: usageExecutionRouteSchema,
   executionProfileSha256: usageExecutionProfileSha256Schema,
@@ -6218,57 +6282,57 @@ var cliEnrichmentProviderUsageResponse = z5.object({
   inputTokens: boundedUsageCount,
   outputTokens: boundedUsageCount,
   billingUnit: usageBillingUnitSchema,
-  billedUnits: z5.number().min(0).max(Number.MAX_SAFE_INTEGER),
+  billedUnits: z6.number().min(0).max(Number.MAX_SAFE_INTEGER),
   billingCertainty: usageBillingCertaintySchema,
-  billingUnknown: z5.boolean(),
-  knownCostUsd: z5.number().min(0).max(Number.MAX_SAFE_INTEGER),
+  billingUnknown: z6.boolean(),
+  knownCostUsd: z6.number().min(0).max(Number.MAX_SAFE_INTEGER),
   costCertainty: usageCostCertaintySchema,
   unknownCostAttempts: boundedUsageCount
 }).strict();
-var cliEnrichmentAggregateFieldSourceResponse = z5.object({
+var cliEnrichmentAggregateFieldSourceResponse = z6.object({
   field: enrichmentFieldSchema,
   operation: usageOperationSchema,
   provider: usageProviderSchema,
-  contacts: z5.number().int().min(0).max(100)
+  contacts: z6.number().int().min(0).max(100)
 }).strict();
-var cliEnrichmentFailureResponse = z5.object({
+var cliEnrichmentFailureResponse = z6.object({
   operation: usageOperationSchema,
-  count: z5.number().int().min(1).max(100)
+  count: z6.number().int().min(1).max(100)
 }).strict();
-var cliEnrichmentJobStatusV4Response = z5.object({
-  id: z5.uuid(),
-  status: z5.enum(["queued", "running", "complete", "partial", "failed"]),
-  dispatchStatus: z5.enum(["dispatching", "launched", "indeterminate"]),
-  selectedCount: z5.number().int().min(1).max(100),
-  completedCount: z5.number().int().min(0).max(100),
-  failedCount: z5.number().int().min(0).max(100),
-  productCreditsSpent: z5.number().int().min(0).max(100),
+var cliEnrichmentJobStatusV4Response = z6.object({
+  id: z6.uuid(),
+  status: z6.enum(["queued", "running", "complete", "partial", "failed"]),
+  dispatchStatus: z6.enum(["dispatching", "launched", "indeterminate"]),
+  selectedCount: z6.number().int().min(1).max(100),
+  completedCount: z6.number().int().min(0).max(100),
+  failedCount: z6.number().int().min(0).max(100),
+  productCreditsSpent: z6.number().int().min(0).max(100),
   usageCoverage: cliEnrichmentUsageCoverageResponse,
-  providerUsage: z5.array(cliEnrichmentProviderUsageResponse).max(256),
-  fieldSources: z5.array(cliEnrichmentAggregateFieldSourceResponse).max(600),
-  failures: z5.array(cliEnrichmentFailureResponse).max(9),
-  createdAt: z5.iso.datetime({ offset: true }),
-  completedAt: z5.iso.datetime({ offset: true }).nullable()
+  providerUsage: z6.array(cliEnrichmentProviderUsageResponse).max(256),
+  fieldSources: z6.array(cliEnrichmentAggregateFieldSourceResponse).max(600),
+  failures: z6.array(cliEnrichmentFailureResponse).max(9),
+  createdAt: z6.iso.datetime({ offset: true }),
+  completedAt: z6.iso.datetime({ offset: true }).nullable()
 }).strict();
-var cliEnrichmentRunDetailResponse = z5.object({
-  localPersonId: z5.string().regex(/^[1-9][0-9]{0,18}$/u),
-  status: z5.enum(["pending", "running", "complete", "failed"]),
-  errorCode: z5.string().min(1).max(200).nullable(),
+var cliEnrichmentRunDetailResponse = z6.object({
+  localPersonId: z6.string().regex(/^[1-9][0-9]{0,18}$/u),
+  status: z6.enum(["pending", "running", "complete", "failed"]),
+  errorCode: z6.string().min(1).max(200).nullable(),
   failureOperation: usageOperationSchema.nullable(),
-  identityMatch: z5.enum(["confirmed", "possible", "insufficient"]).nullable(),
-  confidence: z5.number().int().min(0).max(100).nullable(),
-  fieldsPresent: z5.array(enrichmentFieldSchema).max(6),
-  claimFields: z5.array(enrichmentFieldSchema).max(6)
+  identityMatch: z6.enum(["confirmed", "possible", "insufficient"]).nullable(),
+  confidence: z6.number().int().min(0).max(100).nullable(),
+  fieldsPresent: z6.array(enrichmentFieldSchema).max(6),
+  claimFields: z6.array(enrichmentFieldSchema).max(6)
 }).strict();
-var cliEnrichmentRunUsageResponse = z5.object({
+var cliEnrichmentRunUsageResponse = z6.object({
   operation: usageOperationSchema,
   executionRoute: usageExecutionRouteSchema,
   executionProfileSha256: usageExecutionProfileSha256Schema,
-  attempt: z5.number().int().min(1).max(16),
+  attempt: z6.number().int().min(1).max(16),
   billingSurface: usageBillingSurfaceSchema,
   provider: usageProviderSchema,
   model: usageModelSchema,
-  status: z5.enum(["open", "succeeded", "failed", "indeterminate"]),
+  status: z6.enum(["open", "succeeded", "failed", "indeterminate"]),
   outcome: usageOutcomeSchema,
   errorCode: usageErrorCodeSchema,
   results: boundedUsageCount,
@@ -6276,10 +6340,10 @@ var cliEnrichmentRunUsageResponse = z5.object({
   inputTokens: boundedUsageCount,
   outputTokens: boundedUsageCount,
   billingUnit: usageBillingUnitSchema,
-  billedUnits: z5.number().min(0).max(Number.MAX_SAFE_INTEGER),
+  billedUnits: z6.number().min(0).max(Number.MAX_SAFE_INTEGER),
   billingCertainty: usageBillingCertaintySchema,
-  billingUnknown: z5.boolean(),
-  costUsd: z5.number().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
+  billingUnknown: z6.boolean(),
+  costUsd: z6.number().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
   costCertainty: usageCostCertaintySchema
 }).strict().superRefine((value, context) => {
   if ((value.status === "open" || value.status === "succeeded") && value.errorCode !== null) {
@@ -6290,27 +6354,22 @@ var cliEnrichmentRunUsageResponse = z5.object({
     });
   }
 });
-var cliEnrichmentRunFieldSourceResponse = z5.object({
+var cliEnrichmentRunFieldSourceResponse = z6.object({
   field: enrichmentFieldSchema,
-  sources: z5.array(z5.object({
+  sources: z6.array(z6.object({
     operation: usageOperationSchema,
     provider: usageProviderSchema,
-    evidenceRows: z5.number().int().min(1).max(5)
+    evidenceRows: z6.number().int().min(1).max(5)
   }).strict()).max(5)
 }).strict();
-var cliEnrichmentJobDetailsV4Response = z5.object({
-  jobId: z5.uuid(),
-  runs: z5.array(cliEnrichmentRunDetailResponse.extend({
-    usageCoverage: z5.enum(["ledger", "legacy"]),
-    usage: z5.array(cliEnrichmentRunUsageResponse).max(512),
-    fieldSources: z5.array(cliEnrichmentRunFieldSourceResponse).max(6)
+var cliEnrichmentJobDetailsV4Response = z6.object({
+  jobId: z6.uuid(),
+  runs: z6.array(cliEnrichmentRunDetailResponse.extend({
+    usageCoverage: z6.enum(["ledger", "legacy"]),
+    usage: z6.array(cliEnrichmentRunUsageResponse).max(512),
+    fieldSources: z6.array(cliEnrichmentRunFieldSourceResponse).max(6)
   }).strict()).max(100)
 }).strict();
-var cloudConfigurationSchema = z5.object({
-  baseUrl: z5.url().max(2048),
-  deviceId: z5.uuid(),
-  token: z5.string().min(20).max(512)
-}).strict();
 function baseUrl(value) {
   const parsed = new URL(value);
   if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1"].includes(parsed.hostname))) {
@@ -6321,40 +6380,6 @@ function baseUrl(value) {
   parsed.hash = "";
   return parsed.toString().replace(/\/$/u, "");
 }
-
-class CloudHttpError extends Error {
-  status;
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-    this.name = "CloudHttpError";
-  }
-}
-async function postJson(fetcher, url, body, bearer, timeoutMs = 45000) {
-  const response = await fetcher(url, {
-    method: "POST",
-    headers: { "content-type": "application/json", ...bearer === undefined ? {} : { authorization: `Bearer ${bearer}` } },
-    body: JSON.stringify(body),
-    redirect: "error",
-    signal: AbortSignal.timeout(timeoutMs)
-  });
-  const raw = await response.text();
-  if (Buffer.byteLength(raw) > 2 * 1024 * 1024)
-    throw new Error("PeopleBlade cloud response is too large.");
-  let value;
-  try {
-    value = JSON.parse(raw);
-  } catch {
-    if (!response.ok)
-      throw new CloudHttpError(response.status, `PeopleBlade cloud returned HTTP ${response.status} without a JSON error response.`);
-    throw new Error("PeopleBlade cloud returned invalid JSON.");
-  }
-  if (!response.ok) {
-    const message = value !== null && typeof value === "object" && typeof value.message === "string" ? value.message : `PeopleBlade cloud returned HTTP ${response.status}.`;
-    throw new CloudHttpError(response.status, message);
-  }
-  return value;
-}
 function clearCloudCredentials(options) {
   (options.clearCredentials ?? (() => writeLocalConfig({ cloud: null })))();
 }
@@ -6421,62 +6446,8 @@ async function signOutCloud(options = {}) {
   }
 }
 async function syncCloud(database, options = {}) {
-  const config = options.configuration ?? readLocalConfig().cloud;
-  if (config === null)
-    throw new Error("Run `peopleblade cloud signin` first.");
-  const validatedConfig = cloudConfigurationSchema.parse(config);
-  const fetcher = options.fetcher ?? fetch;
-  const pageSize = Math.max(1, Math.min(200, options.pageSize ?? 200));
-  const contacts = projectCloudContacts(database);
-  const startInput = syncStartSchema.parse({
-    contactCount: contacts.length,
-    databaseFingerprint: localDatabaseFingerprint(database),
-    schemaVersion: localSchemaVersion(database),
-    resumeVersion: 1
-  });
-  const started = syncStartResponse.parse(await postJson(fetcher, `${validatedConfig.baseUrl}/api/cli/sync/start`, startInput, validatedConfig.token, 285000));
-  if (started.uploadedContacts > contacts.length) {
-    throw new Error("Cloud sync resume progress exceeds the current local projection.");
-  }
-  let pages = 0;
-  let offset = 0;
-  for (const priorPageContacts of started.uploadedPageContactCounts) {
-    const replayContacts = contacts.slice(offset, offset + priorPageContacts);
-    if (replayContacts.length !== priorPageContacts) {
-      throw new Error("Cloud sync resume manifest exceeds the current local projection.");
-    }
-    const input = syncPageSchema.parse({ snapshotId: started.snapshotId, ordinal: pages, contacts: replayContacts });
-    await postJson(fetcher, `${validatedConfig.baseUrl}/api/cli/sync/page`, input, validatedConfig.token, SYNC_PAGE_TIMEOUT_MS);
-    pages += 1;
-    offset += priorPageContacts;
-  }
-  if (offset !== started.uploadedContacts || pages !== started.uploadedPages) {
-    throw new Error("Cloud sync resume manifest did not reproduce its reported progress.");
-  }
-  for (;offset < contacts.length; offset += pageSize) {
-    const input = syncPageSchema.parse({ snapshotId: started.snapshotId, ordinal: pages, contacts: contacts.slice(offset, offset + pageSize) });
-    await postJson(fetcher, `${validatedConfig.baseUrl}/api/cli/sync/page`, input, validatedConfig.token, SYNC_PAGE_TIMEOUT_MS);
-    pages += 1;
-  }
-  const finish = syncFinishSchema.parse({ snapshotId: started.snapshotId, pages, contactCount: contacts.length });
-  await postJson(fetcher, `${validatedConfig.baseUrl}/api/cli/sync/finish`, finish, validatedConfig.token);
-  database.query(`INSERT INTO cloud_sync_state(singleton,base_url,device_id,last_snapshot_id,last_synced_at)
-    VALUES (1,?,?,?,CURRENT_TIMESTAMP)
-    ON CONFLICT(singleton) DO UPDATE SET base_url=excluded.base_url, device_id=excluded.device_id,
-      last_snapshot_id=excluded.last_snapshot_id, last_synced_at=excluded.last_synced_at`).run(validatedConfig.baseUrl, validatedConfig.deviceId, started.snapshotId);
-  return {
-    snapshotId: started.snapshotId,
-    contacts: contacts.length,
-    pages,
-    resumed: started.resumed,
-    replayedPages: started.uploadedPages
-  };
-}
-function cloudConfiguration(override) {
-  const config = override ?? readLocalConfig().cloud;
-  if (config === null)
-    throw new Error("Run `peopleblade cloud signin` first.");
-  return cloudConfigurationSchema.parse(config);
+  const { startCloudSync } = __require("./cloud-sync-client.js");
+  return startCloudSync(database, options, postJson);
 }
 function selectedLocalContacts(database, personIds, config) {
   const unique = [...new Set(personIds)].sort((left, right) => left - right);
@@ -6504,11 +6475,13 @@ function selectedLocalContacts(database, personIds, config) {
 async function previewCloudEnrichment(database, personIds, options = {}) {
   const config = cloudConfiguration(options.configuration);
   const contacts = selectedLocalContacts(database, personIds, config);
-  const response = cliEnrichmentPreviewResponse.parse(await postJson(options.fetcher ?? fetch, `${config.baseUrl}/api/cli/enrich/preview`, { contacts: contacts.map((contact) => ({
-    localPersonId: contact.localPersonId,
-    enrichmentInputVersion: contact.enrichmentInputVersion,
-    enrichmentInputSha256: contact.enrichmentInputSha256
-  })) }, config.token));
+  const response = cliEnrichmentPreviewResponse.parse(await postJson(options.fetcher ?? fetch, `${config.baseUrl}/api/cli/enrich/preview`, {
+    contacts: contacts.map((contact) => ({
+      localPersonId: contact.localPersonId,
+      enrichmentInputVersion: contact.enrichmentInputVersion,
+      enrichmentInputSha256: contact.enrichmentInputSha256
+    }))
+  }, config.token));
   const contactCreditLimits = response.usageLimits.filter((limit) => limit.operation === "enrich_contact" && limit.unit === "credit");
   if (response.selectedCount !== contacts.length || contactCreditLimits.length !== 1 || contactCreditLimits[0]?.maximum !== contacts.length || new Set(response.usageLimits.map((limit) => `${limit.operation}\x00${limit.provider}\x00${limit.unit}`)).size !== response.usageLimits.length) {
     throw new Error("PeopleBlade cloud enrichment preview count drifted.");
@@ -6886,12 +6859,13 @@ function assertSourceBindingCurrent(database, authority, binding) {
   const current = readSourceBindingState(database, authority, binding.authId);
   if (current === null)
     return;
-  if (current.subjectSha256 !== binding.subjectSha256 || current.authSha256 !== binding.authSha256) {
-    throw new Error("Source authorization changed its bound provider target. Run the provider's explicit rebind transition before syncing.");
+  if (current.subjectSha256 !== binding.subjectSha256 || current.authSha256 !== binding.authSha256 || canonicalJson(current.metadata) !== canonicalJson(binding.metadata)) {
+    throw new Error("Source authorization changed its bound provider target or reviewed metadata. Run the provider's explicit rebind transition before syncing.");
   }
 }
 function bindSourceBinding(database, authority, binding, observedAt) {
-  const byAuth = getRow(database, `SELECT binding.id,incarnation.subject_sha256,incarnation.auth_sha256
+  const byAuth = getRow(database, `SELECT binding.id,incarnation.subject_sha256,incarnation.auth_sha256,
+        incarnation.metadata_json
       FROM source_bindings binding
       JOIN current_source_binding_incarnations incarnation
         ON incarnation.source_binding_id=binding.id
@@ -6904,29 +6878,47 @@ function bindSourceBinding(database, authority, binding, observedAt) {
   if (byAuth !== null && (byAuth.subject_sha256 !== binding.subjectSha256 || byAuth.auth_sha256 !== binding.authSha256) || bySubject !== null && (bySubject.auth_id !== binding.authId || bySubject.auth_sha256 !== binding.authSha256)) {
     throw new Error("Source authorization is already bound to a different stable realm.");
   }
+  const metadataJson = canonicalJson(binding.metadata);
+  if (byAuth !== null && byAuth.metadata_json !== metadataJson) {
+    throw new Error("Source authorization changed its reviewed metadata. Run the provider's explicit rebind transition before syncing.");
+  }
   if (byAuth === null) {
     return insertedId(database.query(`INSERT INTO source_bindings(
       authority,auth_id,subject_sha256,auth_sha256,first_seen_at,last_seen_at,metadata_json
-    ) VALUES (?,?,?,?,?,?,?)`).run(authority, binding.authId, binding.subjectSha256, binding.authSha256, observedAt, observedAt, canonicalJson(binding.metadata)));
+    ) VALUES (?,?,?,?,?,?,?)`).run(authority, binding.authId, binding.subjectSha256, binding.authSha256, observedAt, observedAt, metadataJson));
   }
   const current = getRow(database, "SELECT last_seen_at FROM source_bindings WHERE id=?", byAuth.id);
   if (current === null) {
     throw new Error("Source authorization disappeared while it was being bound.");
   }
   if (isAtLeastAsRecent(observedAt, current.last_seen_at)) {
-    database.query("UPDATE source_bindings SET last_seen_at=?,metadata_json=? WHERE id=?").run(observedAt, canonicalJson(binding.metadata), byAuth.id);
+    database.query("UPDATE source_bindings SET last_seen_at=?,metadata_json=? WHERE id=?").run(observedAt, metadataJson, byAuth.id);
     database.query(`UPDATE source_binding_incarnations SET last_seen_at=?,metadata_json=?
-        WHERE source_binding_id=? AND retired_at IS NULL`).run(observedAt, canonicalJson(binding.metadata), byAuth.id);
+        WHERE source_binding_id=? AND retired_at IS NULL`).run(observedAt, metadataJson, byAuth.id);
   }
   return byAuth.id;
 }
-function transitionSourceBinding(database, input) {
+function commitSourceBindingTransition(database, input, transition) {
   if (input.next.authId !== input.authId) {
     throw new Error("Source binding transition cannot change the authorization ID.");
   }
-  if (input.next.subjectSha256 === input.expected.subjectSha256 && input.next.authSha256 === input.expected.authSha256) {
+  const identityChanged = input.next.subjectSha256 !== input.expected.subjectSha256 || input.next.authSha256 !== input.expected.authSha256;
+  const metadataChanged = canonicalJson(input.next.metadata) !== input.expected.metadataJson;
+  if (transition === "identity" && !identityChanged) {
     throw new Error("Source binding transition requires a changed subject or authorization identity.");
   }
+  if (transition === "metadata" && identityChanged) {
+    throw new Error("Source binding metadata transition cannot change subject or authorization identity.");
+  }
+  if (transition === "metadata" && !metadataChanged) {
+    throw new Error("Source binding metadata transition requires changed metadata.");
+  }
+  if (transition === "metadata" && (input.expected.completeRealmInventoryObservedAt === null || input.expected.completeRealmInventorySha256 === null || input.completeRealmInventorySha256 !== input.expected.completeRealmInventorySha256 || input.verifyLocked === undefined)) {
+    throw new Error("Source binding metadata transition requires an exact complete inventory proof.");
+  }
+  if (input.next.subjectSha256 === input.expected.subjectSha256 && input.next.authSha256 === input.expected.authSha256 && canonicalJson(input.next.metadata) === input.expected.metadataJson) {
+    throw new Error("Source binding transition cannot append an unchanged incarnation.");
+  }
   const evidenceJson = canonicalJson(input.evidence);
   if (Buffer.byteLength(evidenceJson, "utf8") > 64 * 1024) {
     throw new Error("Source binding transition evidence exceeds 64 KiB.");
@@ -6978,6 +6970,26 @@ function transitionSourceBinding(database, input) {
     throw error;
   }
 }
+function transitionSourceBinding(database, input) {
+  return commitSourceBindingTransition(database, input, "identity");
+}
+function transitionSourceBindingMetadata(database, input) {
+  return commitSourceBindingTransition(database, {
+    authority: input.authority,
+    authId: input.authId,
+    expected: input.expected,
+    next: {
+      authId: input.authId,
+      subjectSha256: input.expected.subjectSha256,
+      authSha256: input.expected.authSha256,
+      metadata: input.nextMetadata
+    },
+    observedAt: input.observedAt,
+    completeRealmInventorySha256: input.completeRealmInventorySha256,
+    evidence: input.evidence,
+    verifyLocked: input.verifyLocked
+  }, "metadata");
+}
 function bindSourceRealmCoordinates(database, authority, accountKey, binding, realm, observedAt) {
   const sourceBindingId = bindSourceBinding(database, authority, binding, observedAt);
   const existingRealm = getRow(database, `SELECT id,source_binding_id,identity_namespace,external_id_sha256,state_observed_at
@@ -7440,16 +7452,16 @@ import {
 import { basename as basename2, dirname as dirname3, join as join3, resolve as resolve2 } from "path";
 
 // src/lib/ensoul-contracts.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var ensoulSourcePacketVersion = "ensoul.source-packet.v1";
 var peoplebladeEnsoulAdapter = "peopleblade";
 var peoplebladeEnsoulPayloadSchema = "ensoul.public-enrichment-source.v1";
 var ensoulDigestCanonicalization = "JCS-RFC8785";
-var digestSchema = z6.string().regex(/^[a-f0-9]{64}$/u);
-var prefixedDigestSchema = z6.string().regex(/^sha256:[a-f0-9]{64}$/u);
-var timestampSchema = z6.iso.datetime({ offset: true });
-var boundedText2 = (maximum) => z6.string().trim().min(1).max(maximum);
-var positiveSafeInteger = z6.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var digestSchema = z7.string().regex(/^[a-f0-9]{64}$/u);
+var prefixedDigestSchema = z7.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var timestampSchema = z7.iso.datetime({ offset: true });
+var boundedText2 = (maximum) => z7.string().trim().min(1).max(maximum);
+var positiveSafeInteger = z7.number().int().positive().max(Number.MAX_SAFE_INTEGER);
 function assertWellFormedUnicode(value) {
   for (let index = 0;index < value.length; index += 1) {
     const code = value.charCodeAt(index);
@@ -7491,7 +7503,7 @@ function ensoulJcsCanonicalJson(value) {
   }
   throw new Error("JCS input is not valid JSON.");
 }
-var ensoulSourceClassSchema = z6.enum([
+var ensoulSourceClassSchema = z7.enum([
   "private_capture",
   "polished_self_presentation",
   "observed_behavior",
@@ -7500,24 +7512,24 @@ var ensoulSourceClassSchema = z6.enum([
   "metadata",
   "public_web_evidence"
 ]);
-var ensoulSourceRecordSemanticSchema = z6.object({
+var ensoulSourceRecordSemanticSchema = z7.object({
   id: boundedText2(200),
   kind: boundedText2(100),
   occurredAt: timestampSchema.optional(),
   observedAt: timestampSchema.optional(),
-  authorRole: z6.enum(["subject", "counterpart", "third_party", "mixed", "unknown"]),
-  contentRole: z6.enum(["original", "quoted", "forwarded", "summary", "ai_assisted", "mixed", "unknown"]),
-  authorshipConfidence: z6.enum(["verified", "strong", "weak", "unknown"]),
-  sentStatus: z6.enum(["sent", "draft", "received", "published", "unknown"]),
-  visibility: z6.enum(["public", "private"]),
+  authorRole: z7.enum(["subject", "counterpart", "third_party", "mixed", "unknown"]),
+  contentRole: z7.enum(["original", "quoted", "forwarded", "summary", "ai_assisted", "mixed", "unknown"]),
+  authorshipConfidence: z7.enum(["verified", "strong", "weak", "unknown"]),
+  sentStatus: z7.enum(["sent", "draft", "received", "published", "unknown"]),
+  visibility: z7.enum(["public", "private"]),
   sourceClass: ensoulSourceClassSchema,
-  content: z6.object({
-    text: z6.string().max(50000).optional(),
-    title: z6.string().max(1000).optional(),
+  content: z7.object({
+    text: z7.string().max(50000).optional(),
+    title: z7.string().max(1000).optional(),
     url: httpUrlSchema.optional(),
-    truncated: z6.boolean().optional()
+    truncated: z7.boolean().optional()
   }).strict().refine((content) => content.text !== undefined || content.title !== undefined || content.url !== undefined, "Record content requires text, title, or URL"),
-  provenance: z6.object({
+  provenance: z7.object({
     provider: boundedText2(100),
     operation: boundedText2(160).optional(),
     sourceId: boundedText2(300).optional(),
@@ -7530,17 +7542,17 @@ var ensoulSourceRecordSemanticSchema = z6.object({
 var ensoulSourceRecordSchema = ensoulSourceRecordSemanticSchema.extend({
   digest: prefixedDigestSchema
 }).strict();
-var ensoulClaimSchema = z6.object({
+var ensoulClaimSchema = z7.object({
   id: boundedText2(200),
   text: boundedText2(4000),
-  recordIds: z6.array(boundedText2(200)).min(1).max(50).refine((values) => new Set(values).size === values.length, "Claim record IDs must be unique"),
-  status: z6.enum(["source_reported", "adapter_structured", "contested"]),
-  claimantRole: z6.enum(["subject", "counterpart", "third_party", "institutional", "adapter", "unknown"]),
-  claimKind: z6.enum(["fact", "stated_belief", "reported_observation", "derived_index"]),
+  recordIds: z7.array(boundedText2(200)).min(1).max(50).refine((values) => new Set(values).size === values.length, "Claim record IDs must be unique"),
+  status: z7.enum(["source_reported", "adapter_structured", "contested"]),
+  claimantRole: z7.enum(["subject", "counterpart", "third_party", "institutional", "adapter", "unknown"]),
+  claimKind: z7.enum(["fact", "stated_belief", "reported_observation", "derived_index"]),
   subjectLocalId: boundedText2(200),
-  sensitivity: z6.enum(["ordinary", "sensitive_explicit"])
+  sensitivity: z7.enum(["ordinary", "sensitive_explicit"])
 }).strict();
-var ensoulLimitationSchema = z6.enum([
+var ensoulLimitationSchema = z7.enum([
   "Public-web evidence plus bounded local subject background only; this packet is not a complete account of the person.",
   "Web authorship is unknown; no record is a direct subject voice sample.",
   "Private messages and CRM notes are excluded.",
@@ -7548,41 +7560,41 @@ var ensoulLimitationSchema = z6.enum([
   "Raw provider payloads, credentials, and unrelated contacts are excluded.",
   "Do not infer sensitive traits, diagnoses, consent, or permission to act from this packet."
 ]);
-var peoplebladeEnsoulPacketBodySchema = z6.object({
-  schemaVersion: z6.literal(ensoulSourcePacketVersion),
-  digestCanonicalization: z6.literal(ensoulDigestCanonicalization),
+var peoplebladeEnsoulPacketBodySchema = z7.object({
+  schemaVersion: z7.literal(ensoulSourcePacketVersion),
+  digestCanonicalization: z7.literal(ensoulDigestCanonicalization),
   generatedAt: timestampSchema,
-  subject: z6.object({
+  subject: z7.object({
     localId: boundedText2(200),
-    kind: z6.literal("person"),
+    kind: z7.literal("person"),
     displayName: boundedText2(300).optional(),
     identityBasis: boundedText2(1000)
   }).strict(),
-  scope: z6.object({
-    adapter: z6.literal(peoplebladeEnsoulAdapter),
-    payloadSchema: z6.literal(peoplebladeEnsoulPayloadSchema),
+  scope: z7.object({
+    adapter: z7.literal(peoplebladeEnsoulAdapter),
+    payloadSchema: z7.literal(peoplebladeEnsoulPayloadSchema),
     asOf: timestampSchema,
     sourceCutoff: timestampSchema.optional(),
-    completeness: z6.enum(["complete", "sampled", "bounded", "unknown"]),
+    completeness: z7.enum(["complete", "sampled", "bounded", "unknown"]),
     sourceRevision: boundedText2(300),
-    limits: z6.object({
+    limits: z7.object({
       maxCurrentEnrichments: positiveSafeInteger,
       maxRecords: positiveSafeInteger,
       maxClaims: positiveSafeInteger,
       maxPacketBytes: positiveSafeInteger,
       oldestObservedAt: timestampSchema.nullable(),
-      exactContactCoordinates: z6.literal("excluded-or-redacted"),
-      notes: z6.literal("excluded"),
-      messages: z6.literal("excluded"),
-      rawProviderPayloads: z6.literal("excluded")
+      exactContactCoordinates: z7.literal("excluded-or-redacted"),
+      notes: z7.literal("excluded"),
+      messages: z7.literal("excluded"),
+      rawProviderPayloads: z7.literal("excluded")
     }).strict()
   }).strict(),
-  records: z6.array(ensoulSourceRecordSchema).max(2000),
-  claims: z6.array(ensoulClaimSchema).max(500),
-  limitations: z6.array(ensoulLimitationSchema).min(1).max(32)
+  records: z7.array(ensoulSourceRecordSchema).max(2000),
+  claims: z7.array(ensoulClaimSchema).max(500),
+  limitations: z7.array(ensoulLimitationSchema).min(1).max(32)
 }).strict();
 var peoplebladeEnsoulPacketSemanticSchema = peoplebladeEnsoulPacketBodySchema.extend({
-  packetId: z6.string().trim().min(8).max(160)
+  packetId: z7.string().trim().min(8).max(160)
 }).strict();
 var ensoulSourcePacketSchema = peoplebladeEnsoulPacketSemanticSchema.extend({
   packetDigest: prefixedDigestSchema
@@ -10158,15 +10170,15 @@ function syncAppleContacts(database, options = {}) {
 }
 
 // src/local/source-ingestion.ts
-import { z as z7 } from "zod";
-var providerSchema = z7.string().regex(/^[a-z][a-z0-9-]{0,63}$/u);
-var boundedText3 = (maximum) => z7.string().min(1).max(maximum).refine((value) => !/[\u0000\r]/u.test(value), "Text contains an unsupported control character");
+import { z as z8 } from "zod";
+var providerSchema = z8.string().regex(/^[a-z][a-z0-9-]{0,63}$/u);
+var boundedText3 = (maximum) => z8.string().min(1).max(maximum).refine((value) => !/[\u0000\r]/u.test(value), "Text contains an unsupported control character");
 var nullableText3 = (maximum) => boundedText3(maximum).nullable();
-var digestSchema2 = z7.string().regex(/^[a-f0-9]{64}$/u);
-var timestampSchema2 = z7.iso.datetime({ offset: true });
+var digestSchema2 = z8.string().regex(/^[a-f0-9]{64}$/u);
+var timestampSchema2 = z8.iso.datetime({ offset: true });
 var sqliteNoCase = (value) => value.replace(/[A-Z]/gu, (character) => character.toLowerCase());
-var jsonObjectSchema = z7.record(z7.string(), z7.json()).refine((value) => Buffer.byteLength(canonicalJson(value), "utf8") <= 64 * 1024, "Metadata exceeds 64 KiB");
-var personSchema = z7.object({
+var jsonObjectSchema = z8.record(z8.string(), z8.json()).refine((value) => Buffer.byteLength(canonicalJson(value), "utf8") <= 64 * 1024, "Metadata exceeds 64 KiB");
+var personSchema = z8.object({
   displayName: nullableText3(1024),
   givenName: nullableText3(1024),
   middleName: nullableText3(1024),
@@ -10179,16 +10191,16 @@ var personSchema = z7.object({
   title: nullableText3(1024),
   birthday: birthdaySchema,
   observationBasis: boundedText3(128),
-  observationPriority: z7.number().int().min(0).max(1000),
+  observationPriority: z8.number().int().min(0).max(1000),
   metadata: jsonObjectSchema
 }).strict();
-var resourceSchema = z7.object({
+var resourceSchema = z8.object({
   type: boundedText3(64),
   id: boundedText3(4096),
   username: nullableText3(2048),
   profileUrl: nullableText3(4096),
-  profileUrlIdentityEligible: z7.boolean(),
-  nameIdentityEligible: z7.boolean(),
+  profileUrlIdentityEligible: z8.boolean(),
+  nameIdentityEligible: z8.boolean(),
   displayName: nullableText3(2048),
   metadata: jsonObjectSchema
 }).strict().superRefine((resource, context) => {
@@ -10199,20 +10211,20 @@ var resourceSchema = z7.object({
       message: "An identity-eligible profile URL must be a stored HTTP(S) profile URL"
     });
 });
-var methodSchema = z7.object({
-  kind: z7.enum(["email", "phone", "url", "address", "date", "social", "other"]),
+var methodSchema = z8.object({
+  kind: z8.enum(["email", "phone", "url", "address", "date", "social", "other"]),
   value: boundedText3(8192),
   normalizedValue: boundedText3(8192),
-  label: z7.string().max(256),
-  primary: z7.boolean(),
-  confidence: z7.enum(["exact", "likely", "possible", "unknown"]),
-  identityEligible: z7.boolean(),
+  label: z8.string().max(256),
+  primary: z8.boolean(),
+  confidence: z8.enum(["exact", "likely", "possible", "unknown"]),
+  identityEligible: z8.boolean(),
   metadata: jsonObjectSchema
 }).strict();
-var contactSchema = z7.object({
+var contactSchema = z8.object({
   person: personSchema,
   resource: resourceSchema,
-  methods: z7.array(methodSchema).max(1000)
+  methods: z8.array(methodSchema).max(1000)
 }).strict().superRefine((contact, context) => {
   const coordinates = new Set;
   contact.methods.forEach((method, index) => {
@@ -10223,24 +10235,24 @@ var contactSchema = z7.object({
     coordinates.add(coordinate);
   });
 });
-var completenessSchema = z7.enum(["complete", "partial", "lower-bound", "unknown"]);
-var coverageSchema = z7.object({
-  localEnumerationComplete: z7.boolean(),
-  remoteSetComplete: z7.boolean(),
-  truncated: z7.boolean(),
-  absencePolicy: z7.enum(["reconcile-observed", "preserve"]),
-  warnings: z7.array(boundedText3(128)).max(32)
+var completenessSchema = z8.enum(["complete", "partial", "lower-bound", "unknown"]);
+var coverageSchema = z8.object({
+  localEnumerationComplete: z8.boolean(),
+  remoteSetComplete: z8.boolean(),
+  truncated: z8.boolean(),
+  absencePolicy: z8.enum(["reconcile-observed", "preserve"]),
+  warnings: z8.array(boundedText3(128)).max(32)
 }).strict();
-var interactionSchema = z7.object({
+var interactionSchema = z8.object({
   resourceType: boundedText3(64),
   resourceId: boundedText3(4096),
-  sentCount: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  receivedCount: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  interactionCount: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  conversationCount: z7.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
+  sentCount: z8.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  receivedCount: z8.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  interactionCount: z8.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  conversationCount: z8.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
   firstInteractionAt: timestampSchema2.nullable(),
   lastInteractionAt: timestampSchema2.nullable(),
-  reciprocal: z7.boolean(),
+  reciprocal: z8.boolean(),
   completeness: completenessSchema,
   metadata: jsonObjectSchema
 }).strict().superRefine((interaction, context) => {
@@ -10253,32 +10265,32 @@ var interactionSchema = z7.object({
   if (interaction.interactionCount === 0 && (interaction.firstInteractionAt !== null || interaction.lastInteractionAt !== null) || interaction.interactionCount > 0 && (interaction.firstInteractionAt === null || interaction.lastInteractionAt === null) || interaction.firstInteractionAt !== null && interaction.lastInteractionAt !== null && Date.parse(interaction.firstInteractionAt) > Date.parse(interaction.lastInteractionAt))
     context.addIssue({ code: "custom", path: ["firstInteractionAt"], message: "Interaction timestamps do not match the observed count" });
 });
-var sourceBindingSchema = z7.object({
+var sourceBindingSchema = z8.object({
   authId: boundedText3(128),
   authSha256: digestSchema2,
   subjectSha256: digestSchema2,
   metadata: jsonObjectSchema
 }).strict();
-var sourceRealmSchema = z7.object({
+var sourceRealmSchema = z8.object({
   service: boundedText3(64),
   identityNamespace: boundedText3(128),
   externalIdSha256: digestSchema2,
   metadata: jsonObjectSchema
 }).strict();
-var sourceRealmInventoryEntrySchema = z7.object({
+var sourceRealmInventoryEntrySchema = z8.object({
   accountKey: boundedText3(256),
   sourceRealm: sourceRealmSchema
 }).strict();
-var sourceRealmInventorySchema = z7.object({
-  schemaVersion: z7.literal(1),
+var sourceRealmInventorySchema = z8.object({
+  schemaVersion: z8.literal(1),
   provider: providerSchema,
   observedAt: timestampSchema2,
   sourceBinding: sourceBindingSchema,
-  localEnumerationComplete: z7.boolean(),
-  truncated: z7.boolean(),
-  absencePolicy: z7.enum(["reconcile-observed", "preserve"]),
-  realms: z7.array(sourceRealmInventoryEntrySchema).max(128),
-  warnings: z7.array(boundedText3(128)).max(32)
+  localEnumerationComplete: z8.boolean(),
+  truncated: z8.boolean(),
+  absencePolicy: z8.enum(["reconcile-observed", "preserve"]),
+  realms: z8.array(sourceRealmInventoryEntrySchema).max(128),
+  warnings: z8.array(boundedText3(128)).max(32)
 }).strict().superRefine((inventory, context) => {
   if (inventory.absencePolicy === "reconcile-observed" && (!inventory.localEnumerationComplete || inventory.truncated)) {
     context.addIssue({
@@ -10301,8 +10313,8 @@ var sourceRealmInventorySchema = z7.object({
     externalIds.add(entry.sourceRealm.externalIdSha256);
   });
 });
-var contactSourceSnapshotSchema = z7.object({
-  schemaVersion: z7.literal(1),
+var contactSourceSnapshotSchema = z8.object({
+  schemaVersion: z8.literal(1),
   provider: providerSchema,
   accountKey: boundedText3(256),
   mode: boundedText3(64),
@@ -10313,8 +10325,8 @@ var contactSourceSnapshotSchema = z7.object({
   observedAt: timestampSchema2,
   sourceBinding: sourceBindingSchema,
   sourceRealm: sourceRealmSchema,
-  contacts: z7.array(contactSchema).max(250000),
-  interactions: z7.array(interactionSchema).max(250000),
+  contacts: z8.array(contactSchema).max(250000),
+  interactions: z8.array(interactionSchema).max(250000),
   metadata: jsonObjectSchema
 }).strict().superRefine((snapshot, context) => {
   if (snapshot.coverage.absencePolicy === "reconcile-observed" && (!snapshot.coverage.localEnumerationComplete || snapshot.coverage.truncated)) {
@@ -10354,19 +10366,19 @@ function resourceStableKey(snapshot, resource) {
   return `source:${sha256(canonicalJson([snapshot.provider, snapshot.accountKey, resource.type, resource.id]))}`;
 }
 function parseCachedResult(value) {
-  return z7.object({
-    account_key: z7.string(),
-    source_rows: z7.number().int(),
-    people_created: z7.number().int(),
-    people_matched: z7.number().int(),
-    methods_touched: z7.number().int(),
-    interactions_touched: z7.number().int(),
-    resources_removed: z7.number().int(),
-    reconciled: z7.boolean(),
+  return z8.object({
+    account_key: z8.string(),
+    source_rows: z8.number().int(),
+    people_created: z8.number().int(),
+    people_matched: z8.number().int(),
+    methods_touched: z8.number().int(),
+    interactions_touched: z8.number().int(),
+    resources_removed: z8.number().int(),
+    reconciled: z8.boolean(),
     completeness: completenessSchema,
-    local_enumeration_complete: z7.boolean(),
-    remote_set_complete: z7.boolean(),
-    truncated: z7.boolean()
+    local_enumeration_complete: z8.boolean(),
+    remote_set_complete: z8.boolean(),
+    truncated: z8.boolean()
   }).strict().transform((result) => ({ ...result, cached: true })).parse(JSON.parse(value));
 }
 function bindSourceRealm(database, snapshot) {
@@ -11994,8 +12006,8 @@ function invokeCapabilitySync(request, options = {}) {
   return parsed.live;
 }
 
-// node_modules/@hraness/wrench/dist/index-q9xsrgw8.js
-var WRENCH_VERSION = "0.16.7";
+// node_modules/@hraness/wrench/dist/index-j1f3cp88.js
+var WRENCH_VERSION = "0.16.8";
 
 // node_modules/@hraness/wrench/dist/beeper-client.js
 import { spawnSync as spawnSync2 } from "child_process";
@@ -16980,8 +16992,8 @@ function projectBeeperContactInteractions(summary, coordinates) {
 // src/local/providers/beeper-compatibility.ts
 var BEEPER_WRENCH_COMPATIBILITY = Object.freeze({
   wrench: Object.freeze({
-    version: "0.16.7",
-    commit: "a2b321081335ac28e5df0ccbb67ebea0424d49f5"
+    version: "0.16.8",
+    commit: "b0cf2ecbc1113fcc8ef673a824be475c3d7bbb46"
   }),
   adapter: Object.freeze({
     id: "beeper-local",
@@ -17018,6 +17030,22 @@ var BEEPER_WRENCH_COMPATIBILITY = Object.freeze({
     commit: "b9c1714410139c2139b597338cd002d785653e85"
   })
 });
+var PEOPLEBLADE_010_WRENCH_0150_BEEPER_SOURCE_BINDING_METADATA = Object.freeze({
+  transport: "local-cli",
+  wrenchVersion: "0.15.0",
+  wrenchCommit: "41b16fcbf9ed0e8d8a332aa380b7187642aac2e3",
+  adapterId: "beeper-local",
+  adapterVersion: "2.0.0",
+  adapterSha256: "e0e1adb52a667af64289db74bad0016753fff2e9fc784ed3cdaae457eb1f19c6",
+  cliId: "beeper-cli",
+  cliVersion: "0.6.2",
+  cliCommit: "a416af06023449a87312dc11e54643fd9dc94b8c",
+  contracts: Object.freeze({
+    contactsList: "eac1536860bc19ff8b9c59abe44c33414ee559e9c550be9d1185ed8375e27d7f",
+    contactsSearch: "bc88cfbca7b8bd9cf5f297cb7d3c922d70dedcaf6d5000e20ed97f9e7b864482",
+    messagingSearch: "27196d8d2cc5eeb855d61d8e27134e81dc56b64f20ea8033d4406c959dffd6f6"
+  })
+});
 var PREVIOUS_BEEPER_SOURCE_BINDING_METADATA = Object.freeze({
   transport: "local-cli",
   wrenchVersion: "0.16.6",
@@ -17066,6 +17094,22 @@ var LEGACY_WRENCH_0167_SEARCH_V1_SOURCE_BINDING_METADATA = Object.freeze({
     messagingSearch: "27b45f4fd370bddaf94c991bf65393556f246fc466c17a360689e467539e41c2"
   })
 });
+var PREVIOUS_WRENCH_0167_BEEPER_SOURCE_BINDING_METADATA = Object.freeze({
+  transport: "local-cli",
+  wrenchVersion: "0.16.7",
+  wrenchCommit: "a2b321081335ac28e5df0ccbb67ebea0424d49f5",
+  adapterId: "beeper-local",
+  adapterVersion: "2.4.0",
+  adapterSha256: "2714af7e821b799c1d0b57106e8e193cb9787e5a6da37e1269f4aae0710a4ddc",
+  cliId: "beeper-cli",
+  cliVersion: "0.6.2",
+  cliCommit: "a416af06023449a87312dc11e54643fd9dc94b8c",
+  contracts: Object.freeze({
+    contactsList: "8048565547c2a09078528d0a35f7a0c3a2e8850b17b075dc572e8b59115fcb57",
+    contactsSearch: "e57cdcc9012ed5fb8f956e16a2368e95adf0a6b8bb404f903e64df85061b1ca1",
+    messagingSearch: "2fc54d139a54d19c31a82237e4b417994e12679db3da5fd71ec9265e3622b0bf"
+  })
+});
 var LEGACY_BEEPER_WRENCH_COMPATIBILITY = Object.freeze({
   wrenchVersion: "0.14.0",
   adapterId: "beeper-local",
@@ -17523,6 +17567,9 @@ function classifyReviewedBeeperPredecessor(value, currentMetadata) {
   if (isLegacyBindingMetadata(value))
     return "wrench-0.14-beeper-1.1";
   const encoded = canonicalJson(value);
+  if (encoded === canonicalJson(PEOPLEBLADE_010_WRENCH_0150_BEEPER_SOURCE_BINDING_METADATA)) {
+    return "peopleblade-0.1.0-wrench-0.15-beeper-2.0";
+  }
   if (encoded === canonicalJson(LEGACY_MISLABELED_BEEPER_SOURCE_BINDING_METADATA)) {
     return "peopleblade-pre-0.1.1-mislabeled-beeper-search";
   }
@@ -17532,8 +17579,11 @@ function classifyReviewedBeeperPredecessor(value, currentMetadata) {
   if (encoded === canonicalJson(LEGACY_WRENCH_0167_SEARCH_V1_SOURCE_BINDING_METADATA)) {
     return "wrench-0.16.7-beeper-2.4-search-v1";
   }
-  if (encoded === currentMetadata)
+  if (encoded === canonicalJson(PREVIOUS_WRENCH_0167_BEEPER_SOURCE_BINDING_METADATA)) {
     return "wrench-0.16.7-beeper-2.4";
+  }
+  if (encoded === currentMetadata)
+    return "wrench-0.16.8-beeper-2.4";
   return null;
 }
 function assertStoredRealmInventory(database, sourceBindingId, accounts, storedSha256) {
@@ -17596,10 +17646,9 @@ function rebindBeeperSource(database, options = {}) {
   }
   const verifiedInventorySha256 = assertStoredRealmInventory(database, current.id, inventory.accounts, current.completeRealmInventorySha256);
   const currentMetadata = canonicalJson(beeperSourceBindingMetadata());
-  if (current.subjectSha256 === next.subjectSha256 && current.authSha256 === next.authSha256) {
-    if (canonicalJson(current.metadata) !== currentMetadata) {
-      throw new Error("Current Beeper binding metadata does not match the pinned Wrench route.");
-    }
+  const sameIdentity = current.subjectSha256 === next.subjectSha256 && current.authSha256 === next.authSha256;
+  const storedMetadata = canonicalJson(current.metadata);
+  if (sameIdentity && storedMetadata === currentMetadata) {
     return {
       transitioned: false,
       source_binding_id: current.id,
@@ -17613,6 +17662,10 @@ function rebindBeeperSource(database, options = {}) {
   if (predecessor === null) {
     throw new Error("Beeper rebind source coordinates are not a reviewed predecessor.");
   }
+  const metadataOnly = sameIdentity && (predecessor === "peopleblade-0.1.0-wrench-0.15-beeper-2.0" || predecessor === "wrench-0.16.7-beeper-2.4");
+  if (sameIdentity && !metadataOnly) {
+    throw new Error("Beeper metadata-only rebind requires an exact reviewed same-identity predecessor.");
+  }
   if (predecessor === "wrench-0.14-beeper-1.1") {
     assertLegacyBeeperReceipt(database, current);
     const derivedLegacySubjectSha256 = sha256(legacyBeeperAccountSubject(inventory.accounts));
@@ -17622,7 +17675,7 @@ function rebindBeeperSource(database, options = {}) {
   }
   const evidence = {
     schemaVersion: 1,
-    kind: "beeper-source-binding-rebind",
+    kind: metadataOnly ? "beeper-source-binding-metadata-rebind" : "beeper-source-binding-rebind",
     authority: PROVIDER4,
     authId,
     sourceBindingId: current.id,
@@ -17653,25 +17706,36 @@ function rebindBeeperSource(database, options = {}) {
       finishedAt: inventory.execution.finishedAt
     }
   };
-  const result = transitionSourceBinding(database, {
+  const expected = {
+    subjectSha256: current.subjectSha256,
+    authSha256: current.authSha256,
+    incarnationId: current.incarnationId,
+    lastSeenAt: current.lastSeenAt,
+    metadataJson: storedMetadata,
+    completeRealmInventoryObservedAt: current.completeRealmInventoryObservedAt,
+    completeRealmInventorySha256: current.completeRealmInventorySha256
+  };
+  const verifyLocked = () => {
+    assertStoredRealmInventory(database, current.id, inventory.accounts, current.completeRealmInventorySha256);
+  };
+  const result = metadataOnly ? transitionSourceBindingMetadata(database, {
     authority: PROVIDER4,
     authId,
-    expected: {
-      subjectSha256: current.subjectSha256,
-      authSha256: current.authSha256,
-      incarnationId: current.incarnationId,
-      lastSeenAt: current.lastSeenAt,
-      metadataJson: canonicalJson(current.metadata),
-      completeRealmInventoryObservedAt: current.completeRealmInventoryObservedAt,
-      completeRealmInventorySha256: current.completeRealmInventorySha256
-    },
+    expected,
+    nextMetadata: next.metadata,
+    observedAt: inventory.execution.finishedAt,
+    completeRealmInventorySha256: verifiedInventorySha256,
+    evidence,
+    verifyLocked
+  }) : transitionSourceBinding(database, {
+    authority: PROVIDER4,
+    authId,
+    expected,
     next,
     observedAt: inventory.execution.finishedAt,
     completeRealmInventorySha256: verifiedInventorySha256,
     evidence,
-    verifyLocked: () => {
-      assertStoredRealmInventory(database, current.id, inventory.accounts, current.completeRealmInventorySha256);
-    }
+    verifyLocked
   });
   return {
     transitioned: true,
@@ -17694,9 +17758,9 @@ function syncBeeperContacts(database, options = {}) {
   }, options.invoke);
   const inventoryInput = { limit: 1 };
   const inventory = parseBeeperContactPage(invoke(inventoryInput), inventoryInput, authId);
-  ledgerBeeperContactRead(database, `beeper:binding:${sha256(inventory.accountSubject)}`, inventory);
   const inventoryBinding = sourceBinding(inventory, authId);
   assertSourceBindingCurrent(database, PROVIDER4, inventoryBinding);
+  ledgerBeeperContactRead(database, `beeper:binding:${sha256(inventory.accountSubject)}`, inventory);
   const inventorySha256 = accountInventorySha256(inventory.accounts);
   const orderedAccounts = [...inventory.accounts].sort((left, right) => {
     const serviceOrder = normalizeService(left).localeCompare(normalizeService(right));
@@ -18362,6 +18426,12 @@ function backfillBeeperSearch(database, options) {
   const invoke = (operation, input) => callPeopleBladeWrench({ adapterId: ADAPTER_ID2, operationId: operation, authId, input }, options.invoke);
   const inventoryInput = { limit: 1 };
   const inventory = parseBeeperContactPage(invoke("contacts.list", inventoryInput), inventoryInput, authId);
+  assertSourceBindingCurrent(database, PROVIDER5, {
+    authId,
+    authSha256: inventory.execution.authSha256,
+    subjectSha256: sha256(inventory.accountSubject),
+    metadata: beeperSourceBindingMetadata()
+  });
   let executionReceiptsRecorded = 0;
   if (!ledgerPeopleBladeWrenchInvocation(database, {
     provider: PROVIDER5,
@@ -18372,12 +18442,6 @@ function backfillBeeperSearch(database, options) {
     metadata: { subjectSha256: sha256(inventory.accountSubject) }
   }).replayed)
     executionReceiptsRecorded += 1;
-  assertSourceBindingCurrent(database, PROVIDER5, {
-    authId,
-    authSha256: inventory.execution.authSha256,
-    subjectSha256: sha256(inventory.accountSubject),
-    metadata: beeperSourceBindingMetadata()
-  });
   const accounts = [...inventory.accounts].filter((account) => requestedServices === null || requestedServices.has(normalizeService2(account))).sort((left, right) => normalizeService2(left).localeCompare(normalizeService2(right)) || left.accountId.localeCompare(right.accountId));
   if (requestedServices !== null) {
     const found = new Set(accounts.map(normalizeService2));
@@ -23924,7 +23988,7 @@ function syncWhatsAppRelationships(database, options = {}) {
 }
 
 // src/cli/version.ts
-var peoplebladeVersion = "0.1.1";
+var peoplebladeVersion = "0.1.2";
 
 // src/cli/main.ts
 var usage = `PeopleBlade \u2014 local-first contact intelligence
@@ -24500,7 +24564,7 @@ ${verification}`) });
       if (options.length)
         fail3(`Unknown argument: ${options[0]}`);
       if (!confirm)
-        fail3("beeper rebind requires --confirm after reviewing the Wrench force-rebind and connected-account inventory.");
+        fail3("beeper rebind requires --confirm after reviewing the current Wrench binding, release, and connected-account inventory.");
       console.error("Beeper binding \xB7 verifying the complete connected-account inventory before an append-only transition");
       print(rebindBeeperSource(database, { ...authId3 === undefined ? {} : { authId: authId3 } }), asJson);
       return;