@larc-iu/plaid-client 0.1.0-alpha.9 → 0.2.0-alpha.1

package/src/index.js

@@ -11,6 +11,7 @@ import { listAll, listPage, iterPages } from './pagination.js';
 import { createSSEConnection } from './sse.js';
 import {
   discoverServices,
+  discardService,
   serve,
   requestService,
 } from './services.js';
@@ -24,6 +25,32 @@ function bodyOf(obj) {
   return result;
 }
 
+// POST to an endpoint that takes no Authorization header (login, invite lookup
+// and redemption). Deliberately does not go through PlaidClient._request: these
+// are called before any client exists, which is the whole point.
+async function anonymousPost(baseUrl, path, body, options = {}) {
+  const base = baseUrl.replace(/\/$/, '');
+  const url = `${base}${path}`;
+  try {
+    const fetchOptions = {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    };
+    const signal = timeoutSignal(options.timeout !== undefined ? options.timeout : DEFAULT_TIMEOUT_MS);
+    if (signal) fetchOptions.signal = signal;
+
+    const response = await fetch(url, fetchOptions);
+    if (!response.ok) {
+      throw makeHttpError(response, await parseErrorBody(response), url, 'POST');
+    }
+    return transformResponse(await response.json());
+  } catch (error) {
+    if (error.status) throw error;
+    throw makeNetworkError(error, url, 'POST');
+  }
+}
+
 class PlaidClient {
   /**
    * Create a new PlaidClient instance
@@ -40,6 +67,16 @@ class PlaidClient {
     this.batchOperations = [];
     this.documentVersions = {};
     this.strictModeDocumentId = null;
+    // The open logical operation (audit-log group), or null. While set, every
+    // write is stamped with `?group-id=` (+ `group-message`) so the audit log
+    // folds them into ONE expandable entry. See beginOperation / withOperation.
+    // Shape: { id, message, depth, written, refined }.
+    this.operationGroup = null;
+    // Optional callback fired once (per client) when any request returns HTTP
+    // 401 — i.e. the token is missing/expired/invalid. Apps use it to discard
+    // the stored token and route back to login. See makeRequest in http.js.
+    this.onAuthError = options.onAuthError || null;
+    this._authErrorFired = false;
 
     // --- API Bundles ---
 
@@ -50,25 +87,40 @@ class PlaidClient {
        * @param {Array} tokens - The tokens to link
        * @param {any} [metadata] - Metadata for the link. Omit to leave unset; pass null to send JSON null.
        */
-      create: (vocabItem, tokens, metadata) =>
-        this._request('POST', '/api/v1/vocab-links', {
+      create: (vocabItem, tokens, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/vocab-links', { auditMessage,
           body: bodyOf({ 'vocab-item': vocabItem, tokens, metadata }),
         }),
+      /**
+       * Create multiple vocab links in a single operation. Entries may
+       * reference different vocab items, but all tokens across the call must
+       * belong to one document.
+       * @param {Array<{vocabItem: string, tokens: string[], metadata?: any}>} body - The vocab links to create
+       * @returns {Promise<{ids: string[]}>} The created entity IDs, in input order. (bulkDelete resolves to no value.)
+       */
+      bulkCreate: (body, auditMessage) =>
+        this._request('POST', '/api/v1/vocab-links/bulk', { auditMessage, body }),
+      /**
+       * Delete multiple vocab links in a single operation. Provide an array of IDs.
+       * @param {string[]} body - The vocab link IDs to delete
+       */
+      bulkDelete: (body, auditMessage) =>
+        this._request('DELETE', '/api/v1/vocab-links/bulk', { auditMessage, body }),
       /**
        * Replace all metadata for a vocab link. The entire metadata map is replaced - existing metadata keys not included in the request will be removed.
        * @param {string} id - The resource ID
        * @param {any} body - The request body
        */
-      setMetadata: (id, body) =>
-        this._request('PUT', `/api/v1/vocab-links/${id}/metadata`, {
+      setMetadata: (id, body, auditMessage) =>
+        this._request('PUT', `/api/v1/vocab-links/${id}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a vocab link.
        * @param {string} id - The resource ID
        */
-      deleteMetadata: (id) =>
-        this._request('DELETE', `/api/v1/vocab-links/${id}/metadata`, {
+      deleteMetadata: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-links/${id}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -76,8 +128,8 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (id, body) =>
-        this._request('PATCH', `/api/v1/vocab-links/${id}/metadata`, {
+      patchMetadata: (id, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/vocab-links/${id}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
@@ -93,8 +145,8 @@ class PlaidClient {
        * Delete a vocab link
        * @param {string} id - The resource ID
        */
-      delete: (id) =>
-        this._request('DELETE', `/api/v1/vocab-links/${id}`),
+      delete: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-links/${id}`, { auditMessage }),
     };
 
     this.vocabLayers = {
@@ -112,15 +164,15 @@ class PlaidClient {
        * Delete a vocab layer.
        * @param {string} id - The resource ID
        */
-      delete: (id) =>
-        this._request('DELETE', `/api/v1/vocab-layers/${id}`),
+      delete: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-layers/${id}`, { auditMessage }),
       /**
        * Update a vocab layer's name.
        * @param {string} id - The resource ID
        * @param {string} name - The name
        */
-      update: (id, name) =>
-        this._request('PATCH', `/api/v1/vocab-layers/${id}`, {
+      update: (id, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/vocab-layers/${id}`, { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -130,8 +182,8 @@ class PlaidClient {
        * @param {string} configKey - The config key
        * @param {any} configValue - Configuration value to set
        */
-      setConfig: (id, namespace, configKey, configValue) =>
-        this._request('PUT', `/api/v1/vocab-layers/${id}/config/${namespace}/${configKey}`, {
+      setConfig: (id, namespace, configKey, configValue, auditMessage) =>
+        this._request('PUT', `/api/v1/vocab-layers/${id}/config/${namespace}/${configKey}`, { auditMessage,
           rawBody: configValue, skipResponseTransform: true,
         }),
       /**
@@ -140,8 +192,8 @@ class PlaidClient {
        * @param {string} namespace - The config namespace
        * @param {string} configKey - The config key
        */
-      deleteConfig: (id, namespace, configKey) =>
-        this._request('DELETE', `/api/v1/vocab-layers/${id}/config/${namespace}/${configKey}`, {
+      deleteConfig: (id, namespace, configKey, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-layers/${id}/config/${namespace}/${configKey}`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -176,8 +228,8 @@ class PlaidClient {
        * Create a new vocab layer. Note: this also registers the user as a maintainer.
        * @param {string} name - The name
        */
-      create: (name) =>
-        this._request('POST', '/api/v1/vocab-layers', {
+      create: (name, auditMessage) =>
+        this._request('POST', '/api/v1/vocab-layers', { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -185,15 +237,15 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      addMaintainer: (id, userId) =>
-        this._request('POST', `/api/v1/vocab-layers/${id}/maintainers/${userId}`),
+      addMaintainer: (id, userId, auditMessage) =>
+        this._request('POST', `/api/v1/vocab-layers/${id}/maintainers/${userId}`, { auditMessage }),
       /**
        * Remove a user's maintainer privileges for this vocab layer.
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      removeMaintainer: (id, userId) =>
-        this._request('DELETE', `/api/v1/vocab-layers/${id}/maintainers/${userId}`),
+      removeMaintainer: (id, userId, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-layers/${id}/maintainers/${userId}`, { auditMessage }),
     };
 
     this.relations = {
@@ -202,16 +254,16 @@ class PlaidClient {
        * @param {string} relationId - The relation ID
        * @param {any} body - The request body
        */
-      setMetadata: (relationId, body) =>
-        this._request('PUT', `/api/v1/relations/${relationId}/metadata`, {
+      setMetadata: (relationId, body, auditMessage) =>
+        this._request('PUT', `/api/v1/relations/${relationId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a relation.
        * @param {string} relationId - The relation ID
        */
-      deleteMetadata: (relationId) =>
-        this._request('DELETE', `/api/v1/relations/${relationId}/metadata`, {
+      deleteMetadata: (relationId, auditMessage) =>
+        this._request('DELETE', `/api/v1/relations/${relationId}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -219,8 +271,8 @@ class PlaidClient {
        * @param {string} relationId - The relation ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (relationId, body) =>
-        this._request('PATCH', `/api/v1/relations/${relationId}/metadata`, {
+      patchMetadata: (relationId, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/relations/${relationId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
@@ -228,8 +280,8 @@ class PlaidClient {
        * @param {string} relationId - The relation ID
        * @param {string} spanId - The span ID
        */
-      setTarget: (relationId, spanId) =>
-        this._request('PUT', `/api/v1/relations/${relationId}/target`, {
+      setTarget: (relationId, spanId, auditMessage) =>
+        this._request('PUT', `/api/v1/relations/${relationId}/target`, { auditMessage,
           body: bodyOf({ 'span-id': spanId }),
         }),
       /**
@@ -245,15 +297,15 @@ class PlaidClient {
        * Delete a relation.
        * @param {string} relationId - The relation ID
        */
-      delete: (relationId) =>
-        this._request('DELETE', `/api/v1/relations/${relationId}`),
+      delete: (relationId, auditMessage) =>
+        this._request('DELETE', `/api/v1/relations/${relationId}`, { auditMessage }),
       /**
        * Update a relation's value.
        * @param {string} relationId - The relation ID
        * @param {any} value - The value
        */
-      update: (relationId, value) =>
-        this._request('PATCH', `/api/v1/relations/${relationId}`, {
+      update: (relationId, value, auditMessage) =>
+        this._request('PATCH', `/api/v1/relations/${relationId}`, { auditMessage,
           body: bodyOf({ value }),
         }),
       /**
@@ -261,8 +313,8 @@ class PlaidClient {
        * @param {string} relationId - The relation ID
        * @param {string} spanId - The span ID
        */
-      setSource: (relationId, spanId) =>
-        this._request('PUT', `/api/v1/relations/${relationId}/source`, {
+      setSource: (relationId, spanId, auditMessage) =>
+        this._request('PUT', `/api/v1/relations/${relationId}/source`, { auditMessage,
           body: bodyOf({ 'span-id': spanId }),
         }),
       /**
@@ -275,22 +327,23 @@ class PlaidClient {
        * @param {any} value - The value
        * @param {any} [metadata] - Metadata map. Omit to leave unset; pass null to send JSON null.
        */
-      create: (layerId, sourceId, targetId, value, metadata) =>
-        this._request('POST', '/api/v1/relations', {
+      create: (layerId, sourceId, targetId, value, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/relations', { auditMessage,
           body: bodyOf({ 'layer-id': layerId, 'source-id': sourceId, 'target-id': targetId, value, metadata }),
         }),
       /**
        * Create multiple relations in a single operation.
        * @param {Array} body - The request body
+       * @returns {Promise<{ids: string[]}>} The created entity IDs, in input order. (bulkDelete resolves to no value.)
        */
-      bulkCreate: (body) =>
-        this._request('POST', '/api/v1/relations/bulk', { body }),
+      bulkCreate: (body, auditMessage) =>
+        this._request('POST', '/api/v1/relations/bulk', { auditMessage, body }),
       /**
        * Delete multiple relations in a single operation. Provide an array of IDs.
        * @param {Array} body - The request body
        */
-      bulkDelete: (body) =>
-        this._request('DELETE', '/api/v1/relations/bulk', { body }),
+      bulkDelete: (body, auditMessage) =>
+        this._request('DELETE', '/api/v1/relations/bulk', { auditMessage, body }),
     };
 
     this.spanLayers = {
@@ -301,8 +354,8 @@ class PlaidClient {
        * @param {string} configKey - The config key
        * @param {any} configValue - Configuration value to set
        */
-      setConfig: (spanLayerId, namespace, configKey, configValue) =>
-        this._request('PUT', `/api/v1/span-layers/${spanLayerId}/config/${namespace}/${configKey}`, {
+      setConfig: (spanLayerId, namespace, configKey, configValue, auditMessage) =>
+        this._request('PUT', `/api/v1/span-layers/${spanLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           rawBody: configValue, skipResponseTransform: true,
         }),
       /**
@@ -311,8 +364,8 @@ class PlaidClient {
        * @param {string} namespace - The config namespace
        * @param {string} configKey - The config key
        */
-      deleteConfig: (spanLayerId, namespace, configKey) =>
-        this._request('DELETE', `/api/v1/span-layers/${spanLayerId}/config/${namespace}/${configKey}`, {
+      deleteConfig: (spanLayerId, namespace, configKey, auditMessage) =>
+        this._request('DELETE', `/api/v1/span-layers/${spanLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -328,15 +381,15 @@ class PlaidClient {
        * Delete a span layer.
        * @param {string} spanLayerId - The span layer ID
        */
-      delete: (spanLayerId) =>
-        this._request('DELETE', `/api/v1/span-layers/${spanLayerId}`),
+      delete: (spanLayerId, auditMessage) =>
+        this._request('DELETE', `/api/v1/span-layers/${spanLayerId}`, { auditMessage }),
       /**
        * Update a span layer's name.
        * @param {string} spanLayerId - The span layer ID
        * @param {string} name - The name
        */
-      update: (spanLayerId, name) =>
-        this._request('PATCH', `/api/v1/span-layers/${spanLayerId}`, {
+      update: (spanLayerId, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/span-layers/${spanLayerId}`, { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -344,8 +397,8 @@ class PlaidClient {
        * @param {string} tokenLayerId - The token layer ID
        * @param {string} name - The name
        */
-      create: (tokenLayerId, name) =>
-        this._request('POST', '/api/v1/span-layers', {
+      create: (tokenLayerId, name, auditMessage) =>
+        this._request('POST', '/api/v1/span-layers', { auditMessage,
           body: bodyOf({ 'token-layer-id': tokenLayerId, name }),
         }),
       /**
@@ -353,8 +406,8 @@ class PlaidClient {
        * @param {string} spanLayerId - The span layer ID
        * @param {string} direction - The direction ("up" or "down")
        */
-      shift: (spanLayerId, direction) =>
-        this._request('POST', `/api/v1/span-layers/${spanLayerId}/shift`, {
+      shift: (spanLayerId, direction, auditMessage) =>
+        this._request('POST', `/api/v1/span-layers/${spanLayerId}/shift`, { auditMessage,
           body: bodyOf({ direction }),
         }),
     };
@@ -365,8 +418,8 @@ class PlaidClient {
        * @param {string} spanId - The span ID
        * @param {Array} tokens - The tokens
        */
-      setTokens: (spanId, tokens) =>
-        this._request('PUT', `/api/v1/spans/${spanId}/tokens`, {
+      setTokens: (spanId, tokens, auditMessage) =>
+        this._request('PUT', `/api/v1/spans/${spanId}/tokens`, { auditMessage,
           body: bodyOf({ tokens }),
         }),
       /**
@@ -377,8 +430,8 @@ class PlaidClient {
        * @param {any} value - The value
        * @param {any} [metadata] - Metadata map. Omit to leave unset; pass null to send JSON null.
        */
-      create: (spanLayerId, tokens, value, metadata) =>
-        this._request('POST', '/api/v1/spans', {
+      create: (spanLayerId, tokens, value, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/spans', { auditMessage,
           body: bodyOf({ 'span-layer-id': spanLayerId, tokens, value, metadata }),
         }),
       /**
@@ -394,44 +447,45 @@ class PlaidClient {
        * Delete a span.
        * @param {string} spanId - The span ID
        */
-      delete: (spanId) =>
-        this._request('DELETE', `/api/v1/spans/${spanId}`),
+      delete: (spanId, auditMessage) =>
+        this._request('DELETE', `/api/v1/spans/${spanId}`, { auditMessage }),
       /**
        * Update a span's value.
        * @param {string} spanId - The span ID
        * @param {any} value - The value
        */
-      update: (spanId, value) =>
-        this._request('PATCH', `/api/v1/spans/${spanId}`, {
+      update: (spanId, value, auditMessage) =>
+        this._request('PATCH', `/api/v1/spans/${spanId}`, { auditMessage,
           body: bodyOf({ value }),
         }),
       /**
        * Create multiple spans in a single operation.
        * @param {Array} body - The request body
+       * @returns {Promise<{ids: string[]}>} The created entity IDs, in input order. (bulkDelete resolves to no value.)
        */
-      bulkCreate: (body) =>
-        this._request('POST', '/api/v1/spans/bulk', { body }),
+      bulkCreate: (body, auditMessage) =>
+        this._request('POST', '/api/v1/spans/bulk', { auditMessage, body }),
       /**
        * Delete multiple spans in a single operation. Provide an array of IDs.
        * @param {Array} body - The request body
        */
-      bulkDelete: (body) =>
-        this._request('DELETE', '/api/v1/spans/bulk', { body }),
+      bulkDelete: (body, auditMessage) =>
+        this._request('DELETE', '/api/v1/spans/bulk', { auditMessage, body }),
       /**
        * Replace all metadata for a span.
        * @param {string} spanId - The span ID
        * @param {any} body - The request body
        */
-      setMetadata: (spanId, body) =>
-        this._request('PUT', `/api/v1/spans/${spanId}/metadata`, {
+      setMetadata: (spanId, body, auditMessage) =>
+        this._request('PUT', `/api/v1/spans/${spanId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a span.
        * @param {string} spanId - The span ID
        */
-      deleteMetadata: (spanId) =>
-        this._request('DELETE', `/api/v1/spans/${spanId}/metadata`, {
+      deleteMetadata: (spanId, auditMessage) =>
+        this._request('DELETE', `/api/v1/spans/${spanId}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -439,8 +493,8 @@ class PlaidClient {
        * @param {string} spanId - The span ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (spanId, body) =>
-        this._request('PATCH', `/api/v1/spans/${spanId}/metadata`, {
+      patchMetadata: (spanId, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/spans/${spanId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
     };
@@ -451,8 +505,8 @@ class PlaidClient {
        * changes are rolled back.
        * @param {Array} body - The request body
        */
-      submit: (body) =>
-        this._request('POST', '/api/v1/batch', {
+      submit: (body, auditMessage) =>
+        this._request('POST', '/api/v1/batch', { auditMessage,
           body, noBatch: true,
         }),
     };
@@ -463,16 +517,16 @@ class PlaidClient {
        * @param {string} textId - The text ID
        * @param {any} body - The request body
        */
-      setMetadata: (textId, body) =>
-        this._request('PUT', `/api/v1/texts/${textId}/metadata`, {
+      setMetadata: (textId, body, auditMessage) =>
+        this._request('PUT', `/api/v1/texts/${textId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a text.
        * @param {string} textId - The text ID
        */
-      deleteMetadata: (textId) =>
-        this._request('DELETE', `/api/v1/texts/${textId}/metadata`, {
+      deleteMetadata: (textId, auditMessage) =>
+        this._request('DELETE', `/api/v1/texts/${textId}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -480,8 +534,8 @@ class PlaidClient {
        * @param {string} textId - The text ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (textId, body) =>
-        this._request('PATCH', `/api/v1/texts/${textId}/metadata`, {
+      patchMetadata: (textId, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/texts/${textId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
@@ -492,8 +546,8 @@ class PlaidClient {
        * @param {string} body - The request body
        * @param {any} [metadata] - Metadata map. Omit to leave unset; pass null to send JSON null.
        */
-      create: (textLayerId, documentId, body, metadata) =>
-        this._request('POST', '/api/v1/texts', {
+      create: (textLayerId, documentId, body, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/texts', { auditMessage,
           body: bodyOf({ 'text-layer-id': textLayerId, 'document-id': documentId, body, metadata }),
         }),
       /**
@@ -509,8 +563,8 @@ class PlaidClient {
        * Delete a text and all dependent data.
        * @param {string} textId - The text ID
        */
-      delete: (textId) =>
-        this._request('DELETE', `/api/v1/texts/${textId}`),
+      delete: (textId, auditMessage) =>
+        this._request('DELETE', `/api/v1/texts/${textId}`, { auditMessage }),
       /**
        * Update a text's body. A diff is computed and token indices are updated
        * so that tokens remain intact. Alternatively, `body` can be a list of
@@ -518,8 +572,8 @@ class PlaidClient {
        * @param {string} textId - The text ID
        * @param {any} body - The request body
        */
-      update: (textId, body) =>
-        this._request('PATCH', `/api/v1/texts/${textId}`, {
+      update: (textId, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/texts/${textId}`, { auditMessage,
           body: bodyOf({ body }),
         }),
     };
@@ -563,8 +617,8 @@ class PlaidClient {
        * @param {string} password - The password
        * @param {boolean} isAdmin - Whether the user is an admin
        */
-      create: (username, password, isAdmin) =>
-        this._request('POST', '/api/v1/users', {
+      create: (username, password, isAdmin, auditMessage) =>
+        this._request('POST', '/api/v1/users', { auditMessage,
           body: bodyOf({ username, password, 'is-admin': isAdmin }),
         }),
       /**
@@ -597,16 +651,16 @@ class PlaidClient {
        * Reversible via activate(), which restores login only.
        * @param {string} id - The resource ID
        */
-      delete: (id) =>
-        this._request('DELETE', `/api/v1/users/${id}`),
+      delete: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/users/${id}`, { auditMessage }),
       /**
        * Reactivate a deactivated user, restoring their ability to log in.
        * Project memberships, vocab maintainerships, and API tokens removed
        * at deactivation are NOT restored — re-grant them deliberately.
        * @param {string} id - The resource ID
        */
-      activate: (id) =>
-        this._request('POST', `/api/v1/users/${id}/activate`),
+      activate: (id, auditMessage) =>
+        this._request('POST', `/api/v1/users/${id}/activate`, { auditMessage }),
       /**
        * Modify a user. Admins may change the username, password, and admin
        * status of any user. All other users may only modify their own username
@@ -616,10 +670,64 @@ class PlaidClient {
        * @param {string} [username] - New username
        * @param {boolean} [isAdmin] - New admin status
        */
-      update: (id, password, username, isAdmin) =>
-        this._request('PATCH', `/api/v1/users/${id}`, {
+      update: (id, password, username, isAdmin, auditMessage) =>
+        this._request('PATCH', `/api/v1/users/${id}`, { auditMessage,
           body: bodyOf({ password, username, 'is-admin': isAdmin }),
         }),
+      /**
+       * Build a URL for a user's profile picture, suitable for use directly as
+       * an `<img>` src. An image element cannot send an Authorization header,
+       * so the session token rides in the query string, the same way document
+       * media does.
+       *
+       * Pass the user record's `avatarHash` as the second argument whenever you
+       * have it: the URL then addresses that exact picture, so the browser can
+       * cache it indefinitely and still pick up a replacement the moment the
+       * user changes it. Returns null when the user has no picture, so callers
+       * can fall back to initials without a wasted request.
+       * @param {string} id - The user ID
+       * @param {string} [avatarHash] - The user record's `avatarHash`
+       * @returns {string|null}
+       */
+      avatarUrl: (id, avatarHash) => {
+        if (avatarHash === null) return null;
+        const params = new URLSearchParams({ token: this.token });
+        if (avatarHash) params.set('v', avatarHash);
+        return `${this.baseUrl}/api/v1/users/${id}/avatar?${params}`;
+      },
+      /**
+       * Fetch a user's profile picture as raw bytes. Most callers want
+       * avatarUrl() instead. This one is for non-browser consumers.
+       * @param {string} id - The user ID
+       */
+      getAvatar: (id) =>
+        this._request('GET', `/api/v1/users/${id}/avatar`, {
+          noBatch: true,
+          binaryResponse: true,
+        }),
+      /**
+       * Upload a profile picture. Your own, or anyone's if you are an admin.
+       * The server center-crops to a square, scales to the configured edge
+       * length, and re-encodes, so no client-side resizing is needed. Accepts
+       * PNG, JPEG, WebP, and GIF. Resolves to the updated user record.
+       * @param {string} id - The user ID
+       * @param {File} file - The image to upload
+       */
+      setAvatar: (id, file, auditMessage) => {
+        const fd = new FormData();
+        fd.append('file', file);
+        return this._request('PUT', `/api/v1/users/${id}/avatar`, { auditMessage,
+          body: fd, formData: true, noBatch: true,
+        });
+      },
+      /**
+       * Remove a profile picture. Your own, or anyone's if you are an admin.
+       * @param {string} id - The user ID
+       */
+      deleteAvatar: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/users/${id}/avatar`, { auditMessage,
+          noBatch: true,
+        }),
     };
 
     this.apiTokens = {
@@ -661,8 +769,8 @@ class PlaidClient {
        * @param {string} name - A human label, e.g. "Stanza Parser"
        * @returns {Promise<{id: string, name: string, token: string}>}
        */
-      create: (userId, name) =>
-        this._request('POST', `/api/v1/users/${userId}/tokens`, {
+      create: (userId, name, auditMessage) =>
+        this._request('POST', `/api/v1/users/${userId}/tokens`, { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -670,8 +778,76 @@ class PlaidClient {
        * @param {string} userId - The user ID who owns the token
        * @param {string} tokenId - The token ID to revoke
        */
-      revoke: (userId, tokenId) =>
-        this._request('DELETE', `/api/v1/users/${userId}/tokens/${tokenId}`),
+      revoke: (userId, tokenId, auditMessage) =>
+        this._request('DELETE', `/api/v1/users/${userId}/tokens/${tokenId}`, { auditMessage }),
+    };
+
+    this.invites = {
+      /**
+       * List invites you minted, oldest first. With `projectId`, lists that
+       * project's invites instead (including co-maintainers'), which requires
+       * maintainer or admin on it. Never includes invite codes — the code is
+       * returned once, by create(), and is not recoverable afterward.
+       * Transparently follows pagination cursors and returns the full flat array.
+       * Cannot be used inside a batch (auto-paginates across requests); throws if called while batching — use listPage() for a single page in a batch.
+       * @param {object} [opts]
+       * @param {string} [opts.projectId] - List this project's invites instead of your own
+       */
+      list: ({ projectId } = {}) =>
+        listAll(this, '/api/v1/invites', { query: { 'project-id': projectId } }),
+      /**
+       * Fetch a single page of invites.
+       * @param {object} [opts]
+       * @param {string} [opts.projectId] - List this project's invites instead of your own
+       * @param {number} [opts.limit] - Page size (1..1000; server default 100)
+       * @param {string} [opts.cursor] - Opaque cursor from a previous page
+       * @returns {Promise<{entries: Array, nextCursor: (string|null)}>}
+       */
+      listPage: ({ projectId, limit, cursor } = {}) =>
+        listPage(this, '/api/v1/invites', { limit, cursor, query: { 'project-id': projectId } }),
+      /**
+       * Async-iterate invites page by page; yields each page's entries array.
+       * @param {object} [opts]
+       * @param {string} [opts.projectId] - List this project's invites instead of your own
+       * @param {number} [opts.pageSize] - Per-request page size
+       * Cannot be used inside a batch (auto-paginates across requests); throws on first iteration if called while batching — use listPage() for a single page in a batch.
+       * @returns {AsyncGenerator<Array>}
+       */
+      iterPages: ({ projectId, pageSize } = {}) =>
+        iterPages(this, '/api/v1/invites', { pageSize, query: { 'project-id': projectId } }),
+      /**
+       * Mint an invite. The returned `code` is shown ONLY here — it is never
+       * stored and cannot be recovered, so build and hand off the link now.
+       * Use PlaidClient.inviteUrl() to turn it into one.
+       *
+       * Admins may mint anything. A project maintainer may mint role grants on
+       * projects they maintain, and nothing else: no admin grant, no grantless
+       * invite, no password resets.
+       * @param {object} opts
+       * @param {string} [opts.projectId] - Project the redeemer joins (with projectRole)
+       * @param {string} [opts.projectRole] - "reader" | "writer" | "maintainer"
+       * @param {boolean} [opts.grantAdmin] - Make the new account a global admin (admin only)
+       * @param {string} [opts.targetUserId] - Make this a password reset for that user (admin only)
+       * @param {number} [opts.maxUses] - How many accounts this link may create (default 1)
+       * @param {number} [opts.ttlDays] - Days until it expires (default 14, max 365)
+       * @param {string} [opts.note] - Human label shown in your invite list
+       * @returns {Promise<{id: string, code: string, kind: string, status: string}>}
+       */
+      create: ({ projectId, projectRole, grantAdmin, targetUserId, maxUses, ttlDays, note } = {}, auditMessage) =>
+        this._request('POST', '/api/v1/invites', { auditMessage,
+          body: bodyOf({
+            'project-id': projectId, 'project-role': projectRole,
+            'grant-admin': grantAdmin, 'target-user-id': targetUserId,
+            'max-uses': maxUses, 'ttl-days': ttlDays, note,
+          }),
+        }),
+      /**
+       * Revoke an invite, killing the link immediately. Idempotent. Allowed for
+       * the creator, an admin, or a maintainer of the invite's project.
+       * @param {string} id - The invite ID
+       */
+      revoke: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/invites/${id}`, { auditMessage }),
     };
 
     this.tokenLayers = {
@@ -680,8 +856,8 @@ class PlaidClient {
        * @param {string} tokenLayerId - The token layer ID
        * @param {string} direction - The direction ("up" or "down")
        */
-      shift: (tokenLayerId, direction) =>
-        this._request('POST', `/api/v1/token-layers/${tokenLayerId}/shift`, {
+      shift: (tokenLayerId, direction, auditMessage) =>
+        this._request('POST', `/api/v1/token-layers/${tokenLayerId}/shift`, { auditMessage,
           body: bodyOf({ direction }),
         }),
       /**
@@ -691,8 +867,8 @@ class PlaidClient {
        * @param {string} [overlapMode] - Per-layer, immutable token invariant: "any" (default), "non-overlapping", or "partitioning". On partitioning layers, single token create/update/delete are rejected; use bulkCreate plus split/merge/shift.
        * @param {string} [parentTokenLayerId] - Optional immutable parent token layer. Tokens in this layer must nest within a parent-layer token; the parent layer must be in the same text layer and be "non-overlapping" or "partitioning" (an "any" parent is rejected). A nested layer may be "any" or "non-overlapping" but not "partitioning" (partitioning is only for root layers), e.g. words (non-overlapping, parent=sentences) within sentences (partitioning).
        */
-      create: (textLayerId, name, overlapMode, parentTokenLayerId) =>
-        this._request('POST', '/api/v1/token-layers', {
+      create: (textLayerId, name, overlapMode, parentTokenLayerId, auditMessage) =>
+        this._request('POST', '/api/v1/token-layers', { auditMessage,
           body: bodyOf({ 'text-layer-id': textLayerId, name, 'overlap-mode': overlapMode, 'parent-token-layer-id': parentTokenLayerId }),
         }),
       /**
@@ -702,8 +878,8 @@ class PlaidClient {
        * @param {string} configKey - The config key
        * @param {any} configValue - Configuration value to set
        */
-      setConfig: (tokenLayerId, namespace, configKey, configValue) =>
-        this._request('PUT', `/api/v1/token-layers/${tokenLayerId}/config/${namespace}/${configKey}`, {
+      setConfig: (tokenLayerId, namespace, configKey, configValue, auditMessage) =>
+        this._request('PUT', `/api/v1/token-layers/${tokenLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           rawBody: configValue, skipResponseTransform: true,
         }),
       /**
@@ -712,8 +888,8 @@ class PlaidClient {
        * @param {string} namespace - The config namespace
        * @param {string} configKey - The config key
        */
-      deleteConfig: (tokenLayerId, namespace, configKey) =>
-        this._request('DELETE', `/api/v1/token-layers/${tokenLayerId}/config/${namespace}/${configKey}`, {
+      deleteConfig: (tokenLayerId, namespace, configKey, auditMessage) =>
+        this._request('DELETE', `/api/v1/token-layers/${tokenLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -729,15 +905,15 @@ class PlaidClient {
        * Delete a token layer.
        * @param {string} tokenLayerId - The token layer ID
        */
-      delete: (tokenLayerId) =>
-        this._request('DELETE', `/api/v1/token-layers/${tokenLayerId}`),
+      delete: (tokenLayerId, auditMessage) =>
+        this._request('DELETE', `/api/v1/token-layers/${tokenLayerId}`, { auditMessage }),
       /**
        * Update a token layer's name.
        * @param {string} tokenLayerId - The token layer ID
        * @param {string} name - The name
        */
-      update: (tokenLayerId, name) =>
-        this._request('PATCH', `/api/v1/token-layers/${tokenLayerId}`, {
+      update: (tokenLayerId, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/token-layers/${tokenLayerId}`, { auditMessage,
           body: bodyOf({ name }),
         }),
     };
@@ -756,14 +932,14 @@ class PlaidClient {
        * Acquire or refresh a document lock
        * @param {string} documentId - The document ID
        */
-      acquireLock: (documentId) =>
-        this._request('POST', `/api/v1/documents/${documentId}/lock`),
+      acquireLock: (documentId, auditMessage) =>
+        this._request('POST', `/api/v1/documents/${documentId}/lock`, { auditMessage }),
       /**
        * Release a document lock
        * @param {string} documentId - The document ID
        */
-      releaseLock: (documentId) =>
-        this._request('DELETE', `/api/v1/documents/${documentId}/lock`),
+      releaseLock: (documentId, auditMessage) =>
+        this._request('DELETE', `/api/v1/documents/${documentId}/lock`, { auditMessage }),
       /**
        * Get media file for a document
        * @param {string} documentId - The document ID
@@ -780,10 +956,10 @@ class PlaidClient {
        * @param {string} documentId - The document ID
        * @param {File} file - The file to upload
        */
-      uploadMedia: (documentId, file) => {
+      uploadMedia: (documentId, file, auditMessage) => {
         const fd = new FormData();
         fd.append('file', file);
-        return this._request('PUT', `/api/v1/documents/${documentId}/media`, {
+        return this._request('PUT', `/api/v1/documents/${documentId}/media`, { auditMessage,
           body: fd, formData: true, noBatch: true,
         });
       },
@@ -791,8 +967,8 @@ class PlaidClient {
        * Delete media file for a document
        * @param {string} documentId - The document ID
        */
-      deleteMedia: (documentId) =>
-        this._request('DELETE', `/api/v1/documents/${documentId}/media`, {
+      deleteMedia: (documentId, auditMessage) =>
+        this._request('DELETE', `/api/v1/documents/${documentId}/media`, { auditMessage,
           noBatch: true,
         }),
       /**
@@ -800,16 +976,16 @@ class PlaidClient {
        * @param {string} documentId - The document ID
        * @param {any} body - The request body
        */
-      setMetadata: (documentId, body) =>
-        this._request('PUT', `/api/v1/documents/${documentId}/metadata`, {
+      setMetadata: (documentId, body, auditMessage) =>
+        this._request('PUT', `/api/v1/documents/${documentId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a document.
        * @param {string} documentId - The document ID
        */
-      deleteMetadata: (documentId) =>
-        this._request('DELETE', `/api/v1/documents/${documentId}/metadata`, {
+      deleteMetadata: (documentId, auditMessage) =>
+        this._request('DELETE', `/api/v1/documents/${documentId}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -817,8 +993,8 @@ class PlaidClient {
        * @param {string} documentId - The document ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (documentId, body) =>
-        this._request('PATCH', `/api/v1/documents/${documentId}/metadata`, {
+      patchMetadata: (documentId, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/documents/${documentId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
@@ -848,15 +1024,15 @@ class PlaidClient {
        * Delete a document and all data contained.
        * @param {string} documentId - The document ID
        */
-      delete: (documentId) =>
-        this._request('DELETE', `/api/v1/documents/${documentId}`),
+      delete: (documentId, auditMessage) =>
+        this._request('DELETE', `/api/v1/documents/${documentId}`, { auditMessage }),
       /**
        * Update a document's name.
        * @param {string} documentId - The document ID
        * @param {string} name - The name
        */
-      update: (documentId, name) =>
-        this._request('PATCH', `/api/v1/documents/${documentId}`, {
+      update: (documentId, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/documents/${documentId}`, { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -865,8 +1041,8 @@ class PlaidClient {
        * @param {string} name - The name
        * @param {any} [metadata] - Metadata map. Omit to leave unset; pass null to send JSON null.
        */
-      create: (projectId, name, metadata) =>
-        this._request('POST', '/api/v1/documents', {
+      create: (projectId, name, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/documents', { auditMessage,
           body: bodyOf({ 'project-id': projectId, name, metadata }),
         }),
     };
@@ -877,29 +1053,29 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      addWriter: (id, userId) =>
-        this._request('POST', `/api/v1/projects/${id}/writers/${userId}`),
+      addWriter: (id, userId, auditMessage) =>
+        this._request('POST', `/api/v1/projects/${id}/writers/${userId}`, { auditMessage }),
       /**
        * Remove a user's writer privileges for this project.
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      removeWriter: (id, userId) =>
-        this._request('DELETE', `/api/v1/projects/${id}/writers/${userId}`),
+      removeWriter: (id, userId, auditMessage) =>
+        this._request('DELETE', `/api/v1/projects/${id}/writers/${userId}`, { auditMessage }),
       /**
        * Set a user's access level to read-only for this project.
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      addReader: (id, userId) =>
-        this._request('POST', `/api/v1/projects/${id}/readers/${userId}`),
+      addReader: (id, userId, auditMessage) =>
+        this._request('POST', `/api/v1/projects/${id}/readers/${userId}`, { auditMessage }),
       /**
        * Remove a user's reader privileges for this project.
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      removeReader: (id, userId) =>
-        this._request('DELETE', `/api/v1/projects/${id}/readers/${userId}`),
+      removeReader: (id, userId, auditMessage) =>
+        this._request('DELETE', `/api/v1/projects/${id}/readers/${userId}`, { auditMessage }),
       /**
        * Set a configuration value for a project in an editor namespace.
        * @param {string} id - The resource ID
@@ -907,8 +1083,8 @@ class PlaidClient {
        * @param {string} configKey - The config key
        * @param {any} configValue - Configuration value to set
        */
-      setConfig: (id, namespace, configKey, configValue) =>
-        this._request('PUT', `/api/v1/projects/${id}/config/${namespace}/${configKey}`, {
+      setConfig: (id, namespace, configKey, configValue, auditMessage) =>
+        this._request('PUT', `/api/v1/projects/${id}/config/${namespace}/${configKey}`, { auditMessage,
           rawBody: configValue, skipResponseTransform: true,
         }),
       /**
@@ -917,8 +1093,8 @@ class PlaidClient {
        * @param {string} namespace - The config namespace
        * @param {string} configKey - The config key
        */
-      deleteConfig: (id, namespace, configKey) =>
-        this._request('DELETE', `/api/v1/projects/${id}/config/${namespace}/${configKey}`, {
+      deleteConfig: (id, namespace, configKey, auditMessage) =>
+        this._request('DELETE', `/api/v1/projects/${id}/config/${namespace}/${configKey}`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -926,15 +1102,15 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      addMaintainer: (id, userId) =>
-        this._request('POST', `/api/v1/projects/${id}/maintainers/${userId}`),
+      addMaintainer: (id, userId, auditMessage) =>
+        this._request('POST', `/api/v1/projects/${id}/maintainers/${userId}`, { auditMessage }),
       /**
        * Remove a user's maintainer privileges for this project.
        * @param {string} id - The resource ID
        * @param {string} userId - The user ID
        */
-      removeMaintainer: (id, userId) =>
-        this._request('DELETE', `/api/v1/projects/${id}/maintainers/${userId}`),
+      removeMaintainer: (id, userId, auditMessage) =>
+        this._request('DELETE', `/api/v1/projects/${id}/maintainers/${userId}`, { auditMessage }),
       /**
        * Get audit log for a project. Transparently follows pagination cursors
        * and returns the full flat array.
@@ -953,15 +1129,15 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {string} vocabId - The vocab layer ID
        */
-      linkVocab: (id, vocabId) =>
-        this._request('POST', `/api/v1/projects/${id}/vocabs/${vocabId}`),
+      linkVocab: (id, vocabId, auditMessage) =>
+        this._request('POST', `/api/v1/projects/${id}/vocabs/${vocabId}`, { auditMessage }),
       /**
        * Unlink a vocabulary from a project.
        * @param {string} id - The resource ID
        * @param {string} vocabId - The vocab layer ID
        */
-      unlinkVocab: (id, vocabId) =>
-        this._request('DELETE', `/api/v1/projects/${id}/vocabs/${vocabId}`),
+      unlinkVocab: (id, vocabId, auditMessage) =>
+        this._request('DELETE', `/api/v1/projects/${id}/vocabs/${vocabId}`, { auditMessage }),
       /**
        * Get a project by ID. To fetch the project's documents, use
        * listDocuments(id) — the include-documents flag has been removed.
@@ -1011,18 +1187,25 @@ class PlaidClient {
       iterDocuments: (id, { pageSize } = {}) =>
         iterPages(this, `/api/v1/projects/${id}/documents`, { pageSize }),
       /**
-       * Delete a project.
+       * Delete a project and everything in it. This is irrecoverable.
+       *
+       * For a large project this can take a long time, so the client's
+       * per-request timeout is DISABLED by default. Pass `{ timeout }` to
+       * impose a finite bound.
        * @param {string} id - The resource ID
+       * @param {string} [auditMessage] - Custom audit-log message
+       * @param {object} [options]
+       * @param {number} [options.timeout=0] - Per-request timeout in ms (0/null disables)
        */
-      delete: (id) =>
-        this._request('DELETE', `/api/v1/projects/${id}`),
+      delete: (id, auditMessage, { timeout = 0 } = {}) =>
+        this._request('DELETE', `/api/v1/projects/${id}`, { auditMessage, timeout }),
       /**
        * Update a project's name.
        * @param {string} id - The resource ID
        * @param {string} name - The name
        */
-      update: (id, name) =>
-        this._request('PATCH', `/api/v1/projects/${id}`, {
+      update: (id, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/projects/${id}`, { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -1057,8 +1240,8 @@ class PlaidClient {
        * Create a new project. Note: this also registers the user as a maintainer.
        * @param {string} name - The name
        */
-      create: (name) =>
-        this._request('POST', '/api/v1/projects', {
+      create: (name, auditMessage) =>
+        this._request('POST', '/api/v1/projects', { auditMessage,
           body: bodyOf({ name }),
         }),
     };
@@ -1071,8 +1254,8 @@ class PlaidClient {
        * @param {string} configKey - The config key
        * @param {any} configValue - Configuration value to set
        */
-      setConfig: (textLayerId, namespace, configKey, configValue) =>
-        this._request('PUT', `/api/v1/text-layers/${textLayerId}/config/${namespace}/${configKey}`, {
+      setConfig: (textLayerId, namespace, configKey, configValue, auditMessage) =>
+        this._request('PUT', `/api/v1/text-layers/${textLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           rawBody: configValue, skipResponseTransform: true,
         }),
       /**
@@ -1081,8 +1264,8 @@ class PlaidClient {
        * @param {string} namespace - The config namespace
        * @param {string} configKey - The config key
        */
-      deleteConfig: (textLayerId, namespace, configKey) =>
-        this._request('DELETE', `/api/v1/text-layers/${textLayerId}/config/${namespace}/${configKey}`, {
+      deleteConfig: (textLayerId, namespace, configKey, auditMessage) =>
+        this._request('DELETE', `/api/v1/text-layers/${textLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -1098,15 +1281,15 @@ class PlaidClient {
        * Delete a text layer.
        * @param {string} textLayerId - The text layer ID
        */
-      delete: (textLayerId) =>
-        this._request('DELETE', `/api/v1/text-layers/${textLayerId}`),
+      delete: (textLayerId, auditMessage) =>
+        this._request('DELETE', `/api/v1/text-layers/${textLayerId}`, { auditMessage }),
       /**
        * Update a text layer's name.
        * @param {string} textLayerId - The text layer ID
        * @param {string} name - The name
        */
-      update: (textLayerId, name) =>
-        this._request('PATCH', `/api/v1/text-layers/${textLayerId}`, {
+      update: (textLayerId, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/text-layers/${textLayerId}`, { auditMessage,
           body: bodyOf({ name }),
         }),
       /**
@@ -1114,8 +1297,8 @@ class PlaidClient {
        * @param {string} textLayerId - The text layer ID
        * @param {string} direction - The direction ("up" or "down")
        */
-      shift: (textLayerId, direction) =>
-        this._request('POST', `/api/v1/text-layers/${textLayerId}/shift`, {
+      shift: (textLayerId, direction, auditMessage) =>
+        this._request('POST', `/api/v1/text-layers/${textLayerId}/shift`, { auditMessage,
           body: bodyOf({ direction }),
         }),
       /**
@@ -1123,8 +1306,8 @@ class PlaidClient {
        * @param {string} projectId - The project ID
        * @param {string} name - The name
        */
-      create: (projectId, name) =>
-        this._request('POST', '/api/v1/text-layers', {
+      create: (projectId, name, auditMessage) =>
+        this._request('POST', '/api/v1/text-layers', { auditMessage,
           body: bodyOf({ 'project-id': projectId, name }),
         }),
     };
@@ -1135,16 +1318,16 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {any} body - The request body
        */
-      setMetadata: (id, body) =>
-        this._request('PUT', `/api/v1/vocab-items/${id}/metadata`, {
+      setMetadata: (id, body, auditMessage) =>
+        this._request('PUT', `/api/v1/vocab-items/${id}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a vocab item.
        * @param {string} id - The resource ID
        */
-      deleteMetadata: (id) =>
-        this._request('DELETE', `/api/v1/vocab-items/${id}/metadata`, {
+      deleteMetadata: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-items/${id}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -1152,8 +1335,8 @@ class PlaidClient {
        * @param {string} id - The resource ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (id, body) =>
-        this._request('PATCH', `/api/v1/vocab-items/${id}/metadata`, {
+      patchMetadata: (id, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/vocab-items/${id}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
@@ -1162,10 +1345,24 @@ class PlaidClient {
        * @param {string} form - The vocab item form
        * @param {any} [metadata] - Metadata map. Omit to leave unset; pass null to send JSON null.
        */
-      create: (vocabLayerId, form, metadata) =>
-        this._request('POST', '/api/v1/vocab-items', {
+      create: (vocabLayerId, form, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/vocab-items', { auditMessage,
           body: bodyOf({ 'vocab-layer-id': vocabLayerId, form, metadata }),
         }),
+      /**
+       * Create multiple vocab items in a single operation. Entries may target
+       * different vocab layers; the user must have write access to each.
+       * @param {Array<{vocabLayerId: string, form: string, metadata?: any}>} body - The vocab items to create
+       */
+      bulkCreate: (body, auditMessage) =>
+        this._request('POST', '/api/v1/vocab-items/bulk', { auditMessage, body }),
+      /**
+       * Delete multiple vocab items in a single operation. Each item's
+       * descendant vocab links are deleted too. Provide an array of IDs.
+       * @param {string[]} body - The vocab item IDs to delete
+       */
+      bulkDelete: (body, auditMessage) =>
+        this._request('DELETE', '/api/v1/vocab-items/bulk', { auditMessage, body }),
       /**
        * Get a vocab item by ID
        * @param {string} id - The resource ID
@@ -1179,15 +1376,15 @@ class PlaidClient {
        * Delete a vocab item
        * @param {string} id - The resource ID
        */
-      delete: (id) =>
-        this._request('DELETE', `/api/v1/vocab-items/${id}`),
+      delete: (id, auditMessage) =>
+        this._request('DELETE', `/api/v1/vocab-items/${id}`, { auditMessage }),
       /**
        * Update a vocab item's form
        * @param {string} id - The resource ID
        * @param {string} form - The vocab item form
        */
-      update: (id, form) =>
-        this._request('PATCH', `/api/v1/vocab-items/${id}`, {
+      update: (id, form, auditMessage) =>
+        this._request('PATCH', `/api/v1/vocab-items/${id}`, { auditMessage,
           body: bodyOf({ form }),
         }),
     };
@@ -1198,8 +1395,8 @@ class PlaidClient {
        * @param {string} relationLayerId - The relation layer ID
        * @param {string} direction - The direction ("up" or "down")
        */
-      shift: (relationLayerId, direction) =>
-        this._request('POST', `/api/v1/relation-layers/${relationLayerId}/shift`, {
+      shift: (relationLayerId, direction, auditMessage) =>
+        this._request('POST', `/api/v1/relation-layers/${relationLayerId}/shift`, { auditMessage,
           body: bodyOf({ direction }),
         }),
       /**
@@ -1207,8 +1404,8 @@ class PlaidClient {
        * @param {string} spanLayerId - The span layer ID
        * @param {string} name - The name
        */
-      create: (spanLayerId, name) =>
-        this._request('POST', '/api/v1/relation-layers', {
+      create: (spanLayerId, name, auditMessage) =>
+        this._request('POST', '/api/v1/relation-layers', { auditMessage,
           body: bodyOf({ 'span-layer-id': spanLayerId, name }),
         }),
       /**
@@ -1218,8 +1415,8 @@ class PlaidClient {
        * @param {string} configKey - The config key
        * @param {any} configValue - Configuration value to set
        */
-      setConfig: (relationLayerId, namespace, configKey, configValue) =>
-        this._request('PUT', `/api/v1/relation-layers/${relationLayerId}/config/${namespace}/${configKey}`, {
+      setConfig: (relationLayerId, namespace, configKey, configValue, auditMessage) =>
+        this._request('PUT', `/api/v1/relation-layers/${relationLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           rawBody: configValue, skipResponseTransform: true,
         }),
       /**
@@ -1228,8 +1425,8 @@ class PlaidClient {
        * @param {string} namespace - The config namespace
        * @param {string} configKey - The config key
        */
-      deleteConfig: (relationLayerId, namespace, configKey) =>
-        this._request('DELETE', `/api/v1/relation-layers/${relationLayerId}/config/${namespace}/${configKey}`, {
+      deleteConfig: (relationLayerId, namespace, configKey, auditMessage) =>
+        this._request('DELETE', `/api/v1/relation-layers/${relationLayerId}/config/${namespace}/${configKey}`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -1245,15 +1442,15 @@ class PlaidClient {
        * Delete a relation layer.
        * @param {string} relationLayerId - The relation layer ID
        */
-      delete: (relationLayerId) =>
-        this._request('DELETE', `/api/v1/relation-layers/${relationLayerId}`),
+      delete: (relationLayerId, auditMessage) =>
+        this._request('DELETE', `/api/v1/relation-layers/${relationLayerId}`, { auditMessage }),
       /**
        * Update a relation layer's name.
        * @param {string} relationLayerId - The relation layer ID
        * @param {string} name - The name
        */
-      update: (relationLayerId, name) =>
-        this._request('PATCH', `/api/v1/relation-layers/${relationLayerId}`, {
+      update: (relationLayerId, name, auditMessage) =>
+        this._request('PATCH', `/api/v1/relation-layers/${relationLayerId}`, { auditMessage,
           body: bodyOf({ name }),
         }),
     };
@@ -1277,8 +1474,8 @@ class PlaidClient {
        * @param {number} [precedence] - Ordering precedence
        * @param {any} [metadata] - Metadata map. Omit to leave unset; pass null to send JSON null.
        */
-      create: (tokenLayerId, text, begin, end, precedence, metadata) =>
-        this._request('POST', '/api/v1/tokens', {
+      create: (tokenLayerId, text, begin, end, precedence, metadata, auditMessage) =>
+        this._request('POST', '/api/v1/tokens', { auditMessage,
           body: bodyOf({ 'token-layer-id': tokenLayerId, text, begin, end, precedence, metadata }),
         }),
       /**
@@ -1295,8 +1492,8 @@ class PlaidClient {
        * have no remaining tokens, the span will also be deleted.
        * @param {string} tokenId - The token ID
        */
-      delete: (tokenId) =>
-        this._request('DELETE', `/api/v1/tokens/${tokenId}`),
+      delete: (tokenId, auditMessage) =>
+        this._request('DELETE', `/api/v1/tokens/${tokenId}`, { auditMessage }),
       /**
        * Update a token.
        * @param {string} tokenId - The token ID
@@ -1307,30 +1504,31 @@ class PlaidClient {
        *   CLEAR it (revert to no explicit ordering). bodyOf keeps null but
        *   drops undefined, so the three cases map correctly to the server.
        */
-      update: (tokenId, begin, end, precedence) =>
-        this._request('PATCH', `/api/v1/tokens/${tokenId}`, {
+      update: (tokenId, begin, end, precedence, auditMessage) =>
+        this._request('PATCH', `/api/v1/tokens/${tokenId}`, { auditMessage,
           body: bodyOf({ begin, end, precedence }),
         }),
       /**
        * Create multiple tokens in a single operation.
        * @param {Array} body - The request body
+       * @returns {Promise<{ids: string[]}>} The created entity IDs, in input order. (bulkDelete resolves to no value.)
        */
-      bulkCreate: (body) =>
-        this._request('POST', '/api/v1/tokens/bulk', { body }),
+      bulkCreate: (body, auditMessage) =>
+        this._request('POST', '/api/v1/tokens/bulk', { auditMessage, body }),
       /**
        * Delete multiple tokens in a single operation. Provide an array of IDs.
        * @param {Array} body - The request body
        */
-      bulkDelete: (body) =>
-        this._request('DELETE', '/api/v1/tokens/bulk', { body }),
+      bulkDelete: (body, auditMessage) =>
+        this._request('DELETE', '/api/v1/tokens/bulk', { auditMessage, body }),
       /**
        * Split a token at a Unicode code-point offset. The original token becomes the
        * left half (keeps its ID, spans, vocab-links); the new right token's ID is returned.
        * @param {string} tokenId - The token ID
        * @param {number} position - Code-point offset to split at (strictly between begin and end)
        */
-      split: (tokenId, position) =>
-        this._request('POST', `/api/v1/tokens/${tokenId}/split`, {
+      split: (tokenId, position, auditMessage) =>
+        this._request('POST', `/api/v1/tokens/${tokenId}/split`, { auditMessage,
           body: bodyOf({ position }),
         }),
       /**
@@ -1341,8 +1539,8 @@ class PlaidClient {
        * @param {string} tokenId - The anchor token ID
        * @param {string} otherTokenId - The other token to merge in
        */
-      merge: (tokenId, otherTokenId) =>
-        this._request('POST', `/api/v1/tokens/${tokenId}/merge`, {
+      merge: (tokenId, otherTokenId, auditMessage) =>
+        this._request('POST', `/api/v1/tokens/${tokenId}/merge`, { auditMessage,
           body: bodyOf({ 'other-token-id': otherTokenId }),
         }),
       /**
@@ -1353,8 +1551,8 @@ class PlaidClient {
        * @param {number} [begin] - New start offset, inclusive (Unicode code points)
        * @param {number} [end] - New end offset, exclusive (Unicode code points)
        */
-      shift: (tokenId, begin, end) =>
-        this._request('POST', `/api/v1/tokens/${tokenId}/shift`, {
+      shift: (tokenId, begin, end, auditMessage) =>
+        this._request('POST', `/api/v1/tokens/${tokenId}/shift`, { auditMessage,
           body: bodyOf({ begin, end }),
         }),
       /**
@@ -1362,16 +1560,16 @@ class PlaidClient {
        * @param {string} tokenId - The token ID
        * @param {any} body - The request body
        */
-      setMetadata: (tokenId, body) =>
-        this._request('PUT', `/api/v1/tokens/${tokenId}/metadata`, {
+      setMetadata: (tokenId, body, auditMessage) =>
+        this._request('PUT', `/api/v1/tokens/${tokenId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
       /**
        * Remove all metadata from a token.
        * @param {string} tokenId - The token ID
        */
-      deleteMetadata: (tokenId) =>
-        this._request('DELETE', `/api/v1/tokens/${tokenId}/metadata`, {
+      deleteMetadata: (tokenId, auditMessage) =>
+        this._request('DELETE', `/api/v1/tokens/${tokenId}/metadata`, { auditMessage,
           skipResponseTransform: true,
         }),
       /**
@@ -1379,8 +1577,8 @@ class PlaidClient {
        * @param {string} tokenId - The token ID
        * @param {any} body - The metadata patch
        */
-      patchMetadata: (tokenId, body) =>
-        this._request('PATCH', `/api/v1/tokens/${tokenId}/metadata`, {
+      patchMetadata: (tokenId, body, auditMessage) =>
+        this._request('PATCH', `/api/v1/tokens/${tokenId}/metadata`, { auditMessage,
           rawBody: body, skipResponseTransform: true,
         }),
     };
@@ -1402,19 +1600,30 @@ class PlaidClient {
        * @param {any} data - The message data to send
        * @returns {Promise<any>} Response from the send operation
        */
-      sendMessage: (projectId, data) =>
-        this._request('POST', `/api/v1/projects/${projectId}/message`, {
+      sendMessage: (projectId, data, auditMessage) =>
+        this._request('POST', `/api/v1/projects/${projectId}/message`, { auditMessage,
           body: { body: data },
         }),
 
       /**
-       * Discover the services currently connected to a project (synchronous GET).
+       * Discover the services seen on a project (synchronous GET). Currently
+       * connected services carry `online: true`; previously-seen offline ones
+       * carry `online: false` plus a `lastSeenAt` stamp.
        * @param {string} projectId - The UUID of the project to query
-       * @param {number} [timeout] - Ignored; kept for back-compat
        * @returns {Promise<Array>} Array of discovered service information
        */
-      discoverServices: (projectId, timeout) =>
-        discoverServices(this, projectId, timeout),
+      discoverServices: (projectId) =>
+        discoverServices(this, projectId),
+
+      /**
+       * Forget a previously-seen (offline) service. Maintainer-only; 409 if
+       * the service is currently connected.
+       * @param {string} projectId - The UUID of the project
+       * @param {string} serviceId - The ID of the service to forget
+       * @returns {Promise<void>}
+       */
+      discardService: (projectId, serviceId) =>
+        discardService(this, projectId, serviceId),
 
       /**
        * Register as a service and handle incoming work requests.
@@ -1475,8 +1684,27 @@ class PlaidClient {
      *   For 'count': {return: 'count', count}. Entity cells are full entity objects
      *   (same shape as the GET endpoints).
      */
-    this.query = (body) =>
-      this._request('POST', '/api/v1/query', { body });
+    this.query = (body, auditMessage) =>
+      this._request('POST', '/api/v1/query', { auditMessage, body });
+
+    // Logical-operation groups (audit-log grouping). There is no create: a
+    // group row is made lazily by the first write carrying `?group-id=`
+    // (see beginOperation). Not an audited write, so no auditMessage arg.
+    this.operationGroups = {
+      /**
+       * Get a logical-operation group (its label + creator).
+       * @param {string} id - The group id
+       */
+      get: (id) =>
+        this._request('GET', `/api/v1/operation-groups/${id}`),
+      /**
+       * Relabel a logical-operation group after the fact. Owner or admin only.
+       * @param {string} id - The group id
+       * @param {string|null} message - The new label
+       */
+      update: (id, message) =>
+        this._request('PATCH', `/api/v1/operation-groups/${id}`, { body: { message } }),
+    };
   }
 
   // --- Core methods ---
@@ -1499,10 +1727,105 @@ class PlaidClient {
     this.strictModeDocumentId = null;
   }
 
+  /**
+   * Begin a LOGICAL OPERATION: a user-meaningful action ("Merge morphemes",
+   * "Re-transcribe") implemented as many low-level writes, possibly across
+   * several batches and even a service round-trip. Until `endOperation()`,
+   * every write is stamped with a client-minted `?group-id=` (and the message)
+   * so the audit log shows the whole run as ONE expandable entry labeled
+   * `message`, with each write's own description underneath.
+   *
+   * Grouping is orthogonal to batches: a batch is a transaction boundary, an
+   * operation is an intent boundary. An operation is NOT atomic — if write 3
+   * of 5 fails, writes 1–2 stay committed (and logged under the group). Use a
+   * batch inside the operation for any step that must be all-or-nothing.
+   *
+   * Nesting flattens: a `beginOperation` while one is open is a no-op that
+   * joins the outer operation (the outer label wins), and the matching
+   * `endOperation` is likewise a no-op. The label is recorded on the FIRST
+   * write, so an operation that is never ended (crash, closed tab) is still
+   * labeled in the log.
+   *
+   * @param {string} message - Human label for the operation.
+   * @param {object} [opts] - Optional `{ id }`: adopt an existing group id instead of minting one (a service joining the requester's operation; `requestService` propagates an open operation to the service automatically).
+   * @returns {string} The operation's group id.
+   */
+  beginOperation(message, { id } = {}) {
+    if (this.operationGroup) {
+      this.operationGroup.depth += 1;
+      return this.operationGroup.id;
+    }
+    this.operationGroup = {
+      id: id || crypto.randomUUID(),
+      message: message == null ? null : String(message),
+      depth: 1,
+      written: false,
+      refined: undefined,
+    };
+    return this.operationGroup.id;
+  }
+
+  /**
+   * End the current logical operation. With no argument this is purely local
+   * (no request). Pass a refined `message` to relabel the group now that the
+   * outcome is known (e.g. `endOperation('Merged 3 morphemes')`) — that sends
+   * one PATCH, skipped if the operation never wrote anything. A refine from a
+   * nested (flattened) `endOperation` is ignored; the outer label wins.
+   * @param {string} [message] - Optional refined label.
+   * @returns {Promise<void>}
+   */
+  async endOperation(message) {
+    const group = this.operationGroup;
+    if (!group) return;
+    if (group.depth > 1) {
+      group.depth -= 1;
+      return;
+    }
+    this.operationGroup = null;
+    const refined = message !== undefined ? message : group.refined;
+    if (refined !== undefined && group.written) {
+      try {
+        await this.operationGroups.update(group.id, refined);
+      } catch (e) {
+        // 404: the group never materialized server-side (every tagged write
+        // failed or a batch was aborted). Nothing to relabel — not an error.
+        if (e.status !== 404) throw e;
+      }
+    }
+  }
+
+  /**
+   * Run `fn` as one logical operation (see beginOperation), ending it when
+   * `fn` settles — including on throw. `fn` receives a `setMessage(msg)`
+   * callback to refine the label once the outcome is known.
+   *
+   *   await client.withOperation('Merge morphemes', async (setMessage) => {
+   *     await client.batched(() => { ... });
+   *     setMessage(`Merged ${n} morphemes`);
+   *   });
+   *
+   * @param {string} message - Human label for the operation.
+   * @param {function} fn - The work to run; receives `setMessage(msg)` to refine the label once the outcome is known.
+   * @returns {Promise<any>} Whatever `fn` resolves to.
+   */
+  async withOperation(message, fn) {
+    this.beginOperation(message);
+    const group = this.operationGroup;
+    const setMessage = (msg) => { if (group.depth === 1) group.refined = msg; };
+    try {
+      return await fn(setMessage);
+    } finally {
+      await this.endOperation();
+    }
+  }
+
   /** Begin a batch of operations. Subsequent API calls will be queued. */
   beginBatch() {
     this.isBatching = true;
     this.batchOperations = [];
+    // Strict mode stamps the expected document-version on the FIRST write of
+    // the batch only (see _request) — reset the marker per batch.
+    this.batchVersionStamped = false;
   }
 
   /**
@@ -1587,6 +1910,38 @@ class PlaidClient {
     return this.isBatching;
   }
 
+  /**
+   * Run `fn` with a batch open, then submit all queued ops as ONE atomic
+   * request — or abort the batch if `fn` throws, so a half-open batch can never
+   * silently swallow later non-batch calls. `fn` makes the (queued) client
+   * calls; it must NOT call submitBatch itself. Resolves to the batch results
+   * array (`[]` if `fn` queued nothing).
+   *
+   *   const [sentRes, wordRes] = await client.batched(async () => {
+   *     client.tokens.bulkCreate(sentenceOps);
+   *     client.tokens.bulkCreate(wordOps);
+   *   });
+   *
+   * Server-side a batch runs sequentially in one transaction (a child op sees
+   * parents created earlier in the same `fn`; any op's failure rolls the whole
+   * batch back). Not nestable. Named `batched()` because `client.batch` is the
+   * low-level batch resource.
+   * @param {() => (void | Promise<void>)} fn
+   * @returns {Promise<Array>}
+   */
+  async batched(fn) {
+    this.beginBatch();
+    try {
+      await fn();
+    } catch (e) {
+      // fn failed: drop the queued ops so the client leaves batch mode and
+      // later plain calls don't queue into a never-submitted batch.
+      if (this.isBatchMode()) this.abortBatch();
+      throw e;
+    }
+    return this.submitBatch();
+  }
+
   /**
    * Authenticate and return a new client instance with token. This is the
    * single auth entry point — there is no `client.login` resource.
@@ -1596,6 +1951,64 @@ class PlaidClient {
    * @param {object} [options] - Client options forwarded to the constructor (e.g. { timeout })
    * @returns {Promise<PlaidClient>} - Authenticated client instance
    */
+  /**
+   * Build the link to hand someone for an invite code. The server never sees
+   * an app URL, so the app that minted the invite is the one that names it.
+   * Both SPAs use HashRouter, so the code rides in the fragment — which also
+   * keeps it out of server access logs.
+   * @param {string} appUrl - Where the SPA lives, e.g. "https://plaid.example.org/igt/"
+   * @param {string} code - The code returned by invites.create()
+   * @returns {string}
+   */
+  static inviteUrl(appUrl, code) {
+    return `${appUrl.replace(/#.*$/, '').replace(/\/$/, '')}/#/invite/${encodeURIComponent(code)}`;
+  }
+
+  /**
+   * Describe an invite code, with NO authentication — this is what a signup
+   * page calls before the redeemer has an account. Returns the kind of link
+   * ("signup" or "password-reset"), its status ("active", "used", "expired",
+   * "revoked"), and the project it grants access to, if any.
+   *
+   * Throws a 404-shaped error if the code is unknown. A known-but-dead code
+   * resolves normally with a non-"active" status, so the page can say why.
+   * @param {string} baseUrl - The API base URL
+   * @param {string} code - The invite code
+   * @param {object} [options]
+   * @returns {Promise<{kind: string, status: string, expiresAt: string, projectName?: string, projectRole?: string, username?: string, grantAdmin: boolean}>}
+   */
+  static async lookupInvite(baseUrl, code, options = {}) {
+    return anonymousPost(baseUrl, '/api/v1/invite-codes/lookup', { code }, options);
+  }
+
+  /**
+   * Redeem an invite code, with NO authentication.
+   *
+   * For a signup invite, pass `username` and `password` to create the account;
+   * the invite's grants are applied in the same transaction. For a password
+   * reset link, pass `password` only. Resolves to a logged-in client, exactly
+   * like login() — the redeemer just chose these credentials, so there is no
+   * reason to send them to a login form to retype them.
+   * @param {string} baseUrl - The API base URL
+   * @param {string} code - The invite code
+   * @param {object} credentials
+   * @param {string} [credentials.username] - Desired username (signup only)
+   * @param {string} credentials.password - Desired password (min 8 characters)
+   * @param {object} [options]
+   * @returns {Promise<{client: PlaidClient, userId: string, kind: string}>}
+   */
+  static async redeemInvite(baseUrl, code, { username, password } = {}, options = {}) {
+    const data = await anonymousPost(
+      baseUrl, '/api/v1/invite-codes/redeem',
+      bodyOf({ code, username, password }), options,
+    );
+    return {
+      client: new PlaidClient(baseUrl.replace(/\/$/, ''), data.token || '', options),
+      userId: data.userId,
+      kind: data.kind,
+    };
+  }
+
   static async login(baseUrl, userId, password, options = {}) {
     baseUrl = baseUrl.replace(/\/$/, '');
     const url = `${baseUrl}/api/v1/login`;
@@ -1642,3 +2055,19 @@ export {
   buildDefaultValues,
   coerceParamValues,
 } from './serviceSchema.js';
+// Provenance: the cross-app convention for machine-provided vs human-labeled
+// information (flat prov/provSource/provConfirmed metadata; absence = human),
+// plus the machine-writer contract. See ./provenance.js and the manual,
+// "Provenance".
+export {
+  PROV,
+  PROV_STATES,
+  PROV_CONFIRMED,
+  stampInferred,
+  confirmedInferred,
+  provState,
+  isMachine,
+  isProtected,
+  verifyOnEdit,
+  serviceSource,
+} from './provenance.js';