@ours.network/cowork 0.2.0 → 0.3.0

package/dist/daemon.js

@@ -5492,7 +5492,108 @@ function isStrictRfc3339(value) {
   const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
   return day >= 1 && day <= days[month - 1];
 }
-var MAX_TEXT_BYTES, MAX_ROLE_BYTES, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoleSchema, MissionTextSchema, MessageTextSchema, RoomStateSchema, InviteModeSchema, InviteStateSchema, RelayStatusSchema, SeatSchema, RoomInviteSchema, MissionSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, PostMessageInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MessageShape, RelayIntentShape, RelayResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+function refineRoomLineage(room, context) {
+  const pendingIdentityName = `cowork-room-${room.room_id}`;
+  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
+  if (room.identity_cid === "" && !exactPacketPending) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["identity_cid"],
+      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+    });
+  }
+  if (room.identity_cid !== "" && room.status === "packet_pending") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: "packet_pending status requires an empty identity_cid"
+    });
+  }
+  const pendingByRecovery = /* @__PURE__ */ new Map();
+  for (const [index, invite] of room.invites.entries()) {
+    if (invite.recovery_of === void 0) continue;
+    const recoveryOf = invite.recovery_of;
+    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
+    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
+    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index, "recovery_of"],
+        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+      });
+    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index],
+        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+      });
+    }
+    if (invite.state === "receipt_pending") {
+      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
+      pendingByRecovery.set(recoveryOf, count);
+      if (count > 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invites", index, "recovery_of"],
+          message: "only one receipt_pending invite may exist per recovery_of pointer"
+        });
+      }
+    }
+  }
+}
+function migrateRoomV1(room, mintParticipantId) {
+  return RoomSchema.parse({
+    ...room,
+    version: 2,
+    mission: { ...room.mission, briefing_version: 1 },
+    role_briefings: {},
+    anonymous: false,
+    quiet_membership: false,
+    membership_epoch: 0,
+    seats: room.seats.map((seat) => ({
+      ...seat,
+      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
+      state: "active"
+    }))
+  });
+}
+function refineMessageCategory(message, context) {
+  const requires = (field, present) => {
+    if (present && message[field] === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${message.category} messages require ${field}`
+      });
+    }
+    if (!present && message[field] !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${field} is forbidden on ${message.category} messages`
+      });
+    }
+  };
+  requires("briefing_role", message.category === "role_briefing");
+  requires("membership", message.category === "membership");
+  if (message.category === "role_briefing" && message.briefing_version === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["briefing_version"],
+      message: "role_briefing messages require briefing_version"
+    });
+  }
+  if (message.category === "chat" || message.category === "membership") {
+    if (message.briefing_version !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["briefing_version"],
+        message: `briefing_version is forbidden on ${message.category} messages`
+      });
+    }
+  }
+}
+var MAX_TEXT_BYTES, MAX_ROLE_BYTES, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoleSchema, MissionTextSchema, MessageTextSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
@@ -5510,7 +5611,9 @@ var init_contracts = __esm({
     MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
     MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
     RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
+    SeatStateSchema = external_exports.enum(["active", "removed"]);
     InviteModeSchema = external_exports.enum(["one_time", "public"]);
+    DEFAULT_ROLE = "Participant";
     InviteStateSchema = external_exports.enum([
       "live",
       "consumed",
@@ -5519,13 +5622,54 @@ var init_contracts = __esm({
       "receipt_pending"
     ]);
     RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
-    SeatSchema = external_exports.object({
+    SeatV1Schema = external_exports.object({
       identity: NonEmptyStringSchema,
       display_name: NonEmptyStringSchema,
       role: RoleSchema,
       invite_id: NonEmptyStringSchema,
       accepted_at: Rfc3339Schema
     }).strict();
+    SeatSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema,
+      participant_id: LowerCrockfordUlidSchema,
+      state: SeatStateSchema,
+      alias: NonEmptyStringSchema.optional(),
+      removed_at: Rfc3339Schema.optional(),
+      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional(),
+      bounced_at: Rfc3339Schema.optional()
+    }).strict().superRefine((seat, context) => {
+      if (seat.state === "removed") {
+        if (seat.removed_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_at"],
+            message: "removed seats require removed_at"
+          });
+        }
+        if (seat.removed_epoch === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_epoch"],
+            message: "removed seats require removed_epoch"
+          });
+        }
+      } else {
+        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [field],
+              message: `${field} is reserved for removed seats`
+            });
+          }
+        }
+      }
+    });
     RoomInviteSchema = external_exports.object({
       invite_id: NonEmptyStringSchema,
       mode: InviteModeSchema,
@@ -5535,7 +5679,8 @@ var init_contracts = __esm({
       state: InviteStateSchema,
       recovery_of: NonEmptyStringSchema.optional(),
       recovery_confirmed: external_exports.boolean().optional(),
-      created_at: Rfc3339Schema
+      created_at: Rfc3339Schema,
+      replaces_seat: LowerCrockfordUlidSchema.optional()
     }).strict().superRefine((invite, context) => {
       if (invite.mode === "one_time" && invite.min_accepts !== 1) {
         context.addIssue({
@@ -5587,81 +5732,137 @@ var init_contracts = __esm({
         });
       }
     });
-    MissionSchema = external_exports.object({
+    MissionV1Schema = external_exports.object({
       goal: MissionTextSchema,
       briefing: MissionTextSchema
     }).strict();
-    RoomSchema = external_exports.object({
-      version: external_exports.literal(1),
+    MissionSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      briefing_version: PositiveSafeIntegerSchema
+    }).strict();
+    RoleBriefingSchema = external_exports.object({
+      text: MissionTextSchema,
+      version: PositiveSafeIntegerSchema,
+      updated_at: Rfc3339Schema
+    }).strict();
+    RoomCommonShape = {
       room_id: LowerCrockfordUlidSchema,
       identity_name: NonEmptyStringSchema,
       identity_cid: external_exports.string(),
-      mission: MissionSchema,
       state: RoomStateSchema,
       status: NonEmptyStringSchema.optional(),
       invites: external_exports.array(RoomInviteSchema),
-      seats: external_exports.array(SeatSchema),
       created_at: Rfc3339Schema,
       activated_at: Rfc3339Schema.optional(),
       closed_at: Rfc3339Schema.optional()
+    };
+    RoomV1Schema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(1),
+      mission: MissionV1Schema,
+      seats: external_exports.array(SeatV1Schema)
+    }).strict().superRefine(refineRoomLineage);
+    RoomSchema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(2),
+      mission: MissionSchema,
+      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
+      anonymous: external_exports.boolean(),
+      quiet_membership: external_exports.boolean(),
+      membership_epoch: external_exports.number().int().nonnegative().safe(),
+      seats: external_exports.array(SeatSchema)
     }).strict().superRefine((room, context) => {
-      const pendingIdentityName = `cowork-room-${room.room_id}`;
-      const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
-      if (room.identity_cid === "" && !exactPacketPending) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["identity_cid"],
-          message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
-        });
-      }
-      if (room.identity_cid !== "" && room.status === "packet_pending") {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["status"],
-          message: "packet_pending status requires an empty identity_cid"
-        });
-      }
-      const pendingByRecovery = /* @__PURE__ */ new Map();
-      for (const [index, invite] of room.invites.entries()) {
-        if (invite.recovery_of === void 0) continue;
-        const recoveryOf = invite.recovery_of;
-        const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
-        const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
-        if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      refineRoomLineage(room, context);
+      const byParticipant = /* @__PURE__ */ new Map();
+      const activeAliases = /* @__PURE__ */ new Set();
+      for (const [index, seat] of room.seats.entries()) {
+        if (byParticipant.has(seat.participant_id)) {
           context.addIssue({
             code: external_exports.ZodIssueCode.custom,
-            path: ["invites", index, "recovery_of"],
-            message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+            path: ["seats", index, "participant_id"],
+            message: "participant_id must be unique within the room"
           });
-        } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+        }
+        byParticipant.set(seat.participant_id, seat);
+        if (room.anonymous && seat.alias === void 0) {
           context.addIssue({
             code: external_exports.ZodIssueCode.custom,
-            path: ["invites", index],
-            message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+            path: ["seats", index, "alias"],
+            message: "anonymous rooms require an alias on every seat"
           });
         }
-        if (invite.state === "receipt_pending") {
-          const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
-          pendingByRecovery.set(recoveryOf, count);
-          if (count > 1) {
+        if (!room.anonymous && seat.alias !== void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "aliases are reserved for anonymous rooms"
+          });
+        }
+        if (seat.state === "active" && seat.alias !== void 0) {
+          if (activeAliases.has(seat.alias)) {
             context.addIssue({
               code: external_exports.ZodIssueCode.custom,
-              path: ["invites", index, "recovery_of"],
-              message: "only one receipt_pending invite may exist per recovery_of pointer"
+              path: ["seats", index, "alias"],
+              message: "active seats must hold distinct aliases"
             });
           }
+          activeAliases.add(seat.alias);
+        }
+        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "removed_epoch"],
+            message: "removed_epoch cannot exceed the room membership_epoch"
+          });
+        }
+      }
+      for (const [index, seat] of room.seats.entries()) {
+        if (seat.replaces_seat === void 0) continue;
+        const predecessor = byParticipant.get(seat.replaces_seat);
+        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "replaces_seat"],
+            message: "replaces_seat must reference a removed seat in this room"
+          });
+          continue;
+        }
+        if (predecessor.role !== seat.role) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "role"],
+            message: "a replacement seat must inherit the predecessor role"
+          });
+        }
+        if (room.anonymous && seat.alias !== predecessor.alias) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "an anonymous replacement seat must inherit the predecessor alias"
+          });
         }
       }
     });
     CreateRoomInputSchema = external_exports.object({
       goal: MissionTextSchema,
-      briefing: MissionTextSchema
+      briefing: MissionTextSchema,
+      anonymous: external_exports.boolean().optional(),
+      quiet_membership: external_exports.boolean().optional()
     }).strict();
     UpdateRoomInputSchema = external_exports.object({
       goal: MissionTextSchema.optional(),
       briefing: MissionTextSchema.optional(),
-      status: NonEmptyStringSchema.optional()
+      status: NonEmptyStringSchema.optional(),
+      quiet_membership: external_exports.boolean().optional()
     }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
+    RoleBriefingSetInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MissionTextSchema
+    }).strict();
+    RoleBriefingDeleteInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
     PostMessageInputSchema = external_exports.object({
       text: MessageTextSchema
     }).strict();
@@ -5682,11 +5883,25 @@ var init_contracts = __esm({
       room_id: LowerCrockfordUlidSchema,
       at: Rfc3339Schema
     };
+    MembershipNoticeSchema = external_exports.object({
+      action: external_exports.enum(["remove"]),
+      alias: NonEmptyStringSchema.optional(),
+      role: RoleSchema.optional(),
+      epoch: external_exports.number().int().nonnegative().safe()
+    }).strict();
+    AuthorAliasSchema = external_exports.object({
+      participant_id: LowerCrockfordUlidSchema,
+      alias: NonEmptyStringSchema
+    }).strict();
     MessageShape = {
       kind: external_exports.literal("message"),
       message_id: LowerCrockfordUlidSchema,
       author: AuthorSnapshotSchema,
-      category: external_exports.enum(["briefing", "chat"]),
+      author_alias: AuthorAliasSchema.optional(),
+      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+      briefing_role: RoleSchema.optional(),
+      briefing_version: PositiveSafeIntegerSchema.optional(),
+      membership: MembershipNoticeSchema.optional(),
       text: MessageTextSchema,
       recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
         const seen = /* @__PURE__ */ new Set();
@@ -5709,14 +5924,34 @@ var init_contracts = __esm({
       message_id: LowerCrockfordUlidSchema,
       recipient_identity: NonEmptyStringSchema
     };
+    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
     RelayResultShape = {
       kind: external_exports.literal("relay_result"),
       intent_record_id: NonEmptyStringSchema,
       message_id: LowerCrockfordUlidSchema,
       recipient_identity: NonEmptyStringSchema,
-      status: RelayStatusSchema,
+      status: RelayResultStatusSchema,
       wire_id: NonEmptyStringSchema.optional()
     };
+    MembershipIntentShape = {
+      kind: external_exports.literal("membership_intent"),
+      action: external_exports.enum(["remove"]),
+      participant_id: LowerCrockfordUlidSchema,
+      recipient_identity: NonEmptyStringSchema,
+      role: RoleSchema,
+      alias: NonEmptyStringSchema.optional(),
+      epoch: PositiveSafeIntegerSchema,
+      notify: external_exports.boolean()
+    };
+    MembershipResultShape = {
+      kind: external_exports.literal("membership_result"),
+      intent_record_id: NonEmptyStringSchema,
+      participant_id: LowerCrockfordUlidSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
     CloseNoticeIntentShape = {
       kind: external_exports.literal("close_notice_intent"),
       recipient_identity: NonEmptyStringSchema
@@ -5733,12 +5968,16 @@ var init_contracts = __esm({
     MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
     RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
     RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
+    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
     CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
     CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
     RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
       MessageRecordSchema,
       RelayIntentRecordSchema,
       RelayResultRecordSchema,
+      MembershipIntentRecordSchema,
+      MembershipResultRecordSchema,
       CloseNoticeIntentRecordSchema,
       CloseNoticeResultRecordSchema
     ]);
@@ -5750,19 +5989,54 @@ var init_contracts = __esm({
           message: 'record_id must equal room_id + ":" + seq'
         });
       }
+      if (record.kind === "message") refineMessageCategory(record, context);
     });
     AppendRecordSchema = external_exports.discriminatedUnion("kind", [
       external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
-    ]);
+    ]).superRefine((record, context) => {
+      if (record.kind === "message") refineMessageCategory(record, context);
+    });
   }
 });
 
-// src/intake.ts
+// src/ulid.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
+function generateUlid() {
+  let time = Date.now();
+  const output = new Array(26);
+  for (let index = 9; index >= 0; index -= 1) {
+    output[index] = CROCKFORD[time % 32];
+    time = Math.floor(time / 32);
+  }
+  const entropy = randomBytes2(10);
+  let bits = 0;
+  let value = 0;
+  let byteIndex = 0;
+  for (let index = 10; index < 26; index += 1) {
+    while (bits < 5) {
+      value = value << 8 | entropy[byteIndex++];
+      bits += 8;
+    }
+    bits -= 5;
+    output[index] = CROCKFORD[value >>> bits & 31];
+  }
+  return output.join("");
+}
+var CROCKFORD;
+var init_ulid = __esm({
+  "src/ulid.ts"() {
+    "use strict";
+    CROCKFORD = "0123456789abcdefghjkmnpqrstvwxyz";
+  }
+});
+
+// src/intake.ts
 function canonicalJson(value) {
   const encoded = JSON.stringify(canonicalValue(value));
   if (encoded === void 0) throw new TypeError("canonical JSON value is not serializable");
@@ -5783,34 +6057,25 @@ function canonicalValue(value) {
 function unique(values) {
   return [...new Set(values)];
 }
-function generateUlid() {
-  let time = Date.now();
-  const output = new Array(26);
-  for (let index = 9; index >= 0; index -= 1) {
-    output[index] = CROCKFORD[time % 32];
-    time = Math.floor(time / 32);
-  }
-  const entropy = randomBytes2(10);
-  let bits = 0;
-  let value = 0;
-  let byteIndex = 0;
-  for (let index = 10; index < 26; index += 1) {
-    while (bits < 5) {
-      value = value << 8 | entropy[byteIndex++];
-      bits += 8;
-    }
-    bits -= 5;
-    output[index] = CROCKFORD[value >>> bits & 31];
+function wireKind(category) {
+  switch (category) {
+    case "briefing":
+      return "room_briefing";
+    case "role_briefing":
+      return "room_role_briefing";
+    case "membership":
+      return "room_membership";
+    default:
+      return "room_msg";
   }
-  return output.join("");
 }
-var CROCKFORD, IntakePump;
+var IntakePump;
 var init_intake = __esm({
   "src/intake.ts"() {
     "use strict";
     init_zod();
     init_contracts();
-    CROCKFORD = "0123456789abcdefghjkmnpqrstvwxyz";
+    init_ulid();
     IntakePump = class {
       store;
       packets;
@@ -5895,15 +6160,18 @@ var init_intake = __esm({
       }
       async processInboxItem(roomId, packet, item) {
         const room = await this.store.load(roomId);
-        const seat = room.seats.find((candidate) => candidate.identity === item.sender_id);
+        const seat = room.seats.find(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
+        );
         if (room.state !== "active" || !seat) {
+          if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
           await packet.consumeInbox([item.msg_id]);
           return;
         }
         const before = await this.store.read(roomId);
         let message = this.findSourceMessage(before, item);
         if (!message) {
-          const recipientIdentities = unique(room.seats.map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
+          const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
           const appended = await this.store.append(roomId, {
             version: 1,
             kind: "message",
@@ -5915,6 +6183,9 @@ var init_intake = __esm({
               display_name: seat.display_name,
               role: seat.role
             },
+            // In an anonymous room the archive keeps both identities (INV-R4);
+            // the relay pump substitutes the alias into every outbound body.
+            ...room.anonymous && seat.alias !== void 0 ? { author_alias: { participant_id: seat.participant_id, alias: seat.alias } } : {},
             category: "chat",
             text: item.text,
             recipient_identities: recipientIdentities,
@@ -5927,6 +6198,28 @@ var init_intake = __esm({
         await this.completeMessageIntents(roomId, message);
         await packet.consumeInbox([item.msg_id]);
       }
+      /**
+       * One content-free self-assertion per removed seat (spec §5.2, OC-8), so a
+       * healthy ex-client stops sending. The durable bounced_at mark precedes the
+       * best-effort send: at-most-once, and a hostile peer gets nothing further.
+       */
+      async bounceRemovedSender(roomId, room, packet, item) {
+        const removed = room.seats.find(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "removed"
+        );
+        if (!removed || removed.bounced_at !== void 0) return;
+        if (room.seats.some(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
+        )) return;
+        const seats = room.seats.map((candidate) => candidate.participant_id === removed.participant_id ? { ...candidate, bounced_at: this.now() } : candidate);
+        await this.store.save(RoomSchema.parse({ ...room, seats }));
+        try {
+          const unsigned = { version: 1, kind: "room_not_member", room_id: roomId };
+          const signature = await packet.sign(canonicalJson(unsigned));
+          await packet.send(item.sender_id, canonicalJson({ ...unsigned, signature }));
+        } catch {
+        }
+      }
       async completeSnapshotIntents(roomId) {
         const records = await this.store.read(roomId);
         for (const message of records.filter(
@@ -5951,6 +6244,9 @@ var init_intake = __esm({
       }
       async relayPendingUnlocked(roomId, packet) {
         const records = await this.store.read(roomId);
+        const room = await this.store.load(roomId);
+        const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
+        const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
         const messages = new Map(records.filter((record) => record.kind === "message").map((message) => [message.message_id, message]));
         const completed = new Set(records.filter((record) => record.kind === "relay_result").map((result) => result.kind === "relay_result" ? result.intent_record_id : ""));
         for (const intent of records.filter(
@@ -5960,14 +6256,37 @@ var init_intake = __esm({
           const message = messages.get(intent.message_id);
           if (!message) continue;
           if (!message.recipient_identities.includes(intent.recipient_identity)) continue;
+          if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
+            const skipped = await this.store.append(roomId, {
+              version: 1,
+              kind: "relay_result",
+              room_id: roomId,
+              at: this.now(),
+              intent_record_id: intent.record_id,
+              message_id: intent.message_id,
+              recipient_identity: intent.recipient_identity,
+              status: "skipped_removed"
+            });
+            if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+            completed.add(intent.record_id);
+            continue;
+          }
           const unsigned = {
             version: 1,
-            kind: message.category === "briefing" ? "room_briefing" : "room_msg",
+            kind: wireKind(message.category),
             room_id: roomId,
             message_id: message.message_id,
-            author: message.author,
+            // INV-R3: an anonymous author leaves the archive only in alias form.
+            author: message.author_alias === void 0 ? message.author : {
+              identity: message.author_alias.participant_id,
+              display_name: message.author_alias.alias,
+              role: message.author.role
+            },
             text: message.text,
-            at: message.at
+            at: message.at,
+            ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
+            ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
+            ...message.membership === void 0 ? {} : { membership: message.membership }
           };
           const signature = await packet.sign(canonicalJson(unsigned));
           const body = canonicalJson({ ...unsigned, signature });
@@ -6012,27 +6331,11 @@ var init_intake = __esm({
 });
 
 // src/service.ts
-import { randomBytes as randomBytes3 } from "node:crypto";
-function generateUlid2() {
-  let time = Date.now();
-  const output = new Array(26);
-  for (let index = 9; index >= 0; index -= 1) {
-    output[index] = CROCKFORD2[time % 32];
-    time = Math.floor(time / 32);
-  }
-  const entropy = randomBytes3(10);
-  let bits = 0;
-  let value = 0;
-  let byteIndex = 0;
-  for (let index = 10; index < 26; index += 1) {
-    while (bits < 5) {
-      value = value << 8 | entropy[byteIndex++];
-      bits += 8;
-    }
-    bits -= 5;
-    output[index] = CROCKFORD2[value >>> bits & 31];
-  }
-  return output.join("");
+function activeSeats(room) {
+  return room.seats.filter((seat) => seat.state === "active");
+}
+function mintAlias(seated, role) {
+  return `${role} #${seated.filter((seat) => seat.role === role).length + 1}`;
 }
 function uniqueIdentities(identities) {
   return [...new Set(identities)];
@@ -6040,18 +6343,18 @@ function uniqueIdentities(identities) {
 function currentContactIdentities(packet) {
   return new Set(packet.listContacts().map((contact) => contact.container_id));
 }
-var CROCKFORD2, ROOM_ROLE, CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RoomServiceError, RoomService;
+var ROOM_ROLE, CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
 var init_service = __esm({
   "src/service.ts"() {
     "use strict";
     init_zod();
     init_contracts();
     init_intake();
-    CROCKFORD2 = "0123456789abcdefghjkmnpqrstvwxyz";
+    init_ulid();
     ROOM_ROLE = "room";
     CreateInviteInputSchema = external_exports.object({
       mode: InviteModeSchema,
-      role: RoleSchema,
+      role: RoleSchema.optional(),
       min_accepts: external_exports.number().int().positive().safe()
     }).strict().superRefine((input, context) => {
       if (input.mode === "one_time" && input.min_accepts !== 1) {
@@ -6064,11 +6367,22 @@ var init_service = __esm({
     });
     HistoryOptionsSchema = external_exports.object({
       after: external_exports.number().int().nonnegative().safe().optional(),
-      limit: external_exports.number().int().positive().safe().optional()
+      limit: external_exports.number().int().positive().safe().optional(),
+      view: external_exports.enum(["operator", "participant"]).optional()
     }).strict();
     DeleteRoomInputSchema = external_exports.object({
       confirm: external_exports.literal(true)
     }).strict();
+    RemoveParticipantInputSchema = external_exports.object({
+      participant: external_exports.string().min(1),
+      notify: external_exports.boolean().optional()
+    }).strict();
+    ReplaceParticipantInputSchema = external_exports.object({
+      participant: external_exports.string().min(1),
+      notify: external_exports.boolean().optional(),
+      mode: InviteModeSchema.optional(),
+      min_accepts: external_exports.number().int().positive().safe().optional()
+    }).strict();
     RoomServiceError = class extends Error {
       constructor(message, options) {
         super(message, options);
@@ -6087,8 +6401,8 @@ var init_service = __esm({
         this.store = store;
         this.packets = packets;
         this.nowValue = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-        this.nextRoomId = options.roomId ?? generateUlid2;
-        this.nextMessageId = options.messageId ?? generateUlid2;
+        this.nextRoomId = options.roomId ?? generateUlid;
+        this.nextMessageId = options.messageId ?? generateUlid;
         this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
         });
         this.intake = new IntakePump(store, packets, {
@@ -6102,14 +6416,18 @@ var init_service = __esm({
         const identityName = `cowork-room-${roomId}`;
         return this.lock(roomId, async () => {
           const provisional = RoomSchema.parse({
-            version: 1,
+            version: 2,
             room_id: roomId,
             identity_name: identityName,
             // PacketRegistry needs the durable room directory to exist first. A
             // valid, explicitly provisional value lets startup resume this exact
             // two-resource boundary without claiming a packet CID yet.
             identity_cid: "",
-            mission: { goal: settings.goal, briefing: settings.briefing },
+            mission: { goal: settings.goal, briefing: settings.briefing, briefing_version: 1 },
+            role_briefings: {},
+            anonymous: settings.anonymous ?? false,
+            quiet_membership: settings.quiet_membership ?? false,
+            membership_epoch: 0,
             state: "provisioning",
             status: "packet_pending",
             invites: [],
@@ -6200,18 +6518,73 @@ var init_service = __esm({
       async updateRoom(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const settings = UpdateRoomInputSchema.parse(input);
-        return this.lock(id, async () => {
+        const { room: updated, redelivered } = await this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "update");
+          const briefingChanged = settings.briefing !== void 0 && settings.briefing !== room.mission.briefing;
           const mission = {
             goal: settings.goal ?? room.mission.goal,
-            briefing: settings.briefing ?? room.mission.briefing
+            briefing: settings.briefing ?? room.mission.briefing,
+            briefing_version: briefingChanged ? room.mission.briefing_version + 1 : room.mission.briefing_version
           };
-          return this.store.save(RoomSchema.parse({
+          const next = await this.store.save(RoomSchema.parse({
             ...room,
             mission,
+            ...settings.quiet_membership === void 0 ? {} : { quiet_membership: settings.quiet_membership },
             ...settings.status === void 0 ? {} : { status: settings.status }
           }));
+          if (briefingChanged && next.state === "active") {
+            await this.redeliverCommonBriefing(next);
+            return { room: next, redelivered: true };
+          }
+          return { room: next, redelivered: false };
+        });
+        if (redelivered) await this.intake.resumePending(id);
+        return updated;
+      }
+      /** Author or edit one role's briefing; an edit bumps its version and re-delivers to seats of that role only (spec §3.3). */
+      async setRoleBriefing(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RoleBriefingSetInputSchema.parse(input);
+        const { room: updated, redelivered } = await this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "set a role briefing for");
+          const existing = room.role_briefings[request.role];
+          if (existing && existing.text === request.text) return { room, redelivered: false };
+          const briefing = {
+            text: request.text,
+            version: existing === void 0 ? 1 : existing.version + 1,
+            updated_at: this.now()
+          };
+          const next = await this.store.save(RoomSchema.parse({
+            ...room,
+            role_briefings: { ...room.role_briefings, [request.role]: briefing }
+          }));
+          if (next.state !== "active") return { room: next, redelivered: false };
+          const holders = activeSeats(next).filter((seat) => seat.role === request.role);
+          if (holders.length === 0) return { room: next, redelivered: false };
+          await this.ensureBriefingKind(next, holders, {
+            category: "role_briefing",
+            briefing_role: request.role,
+            text: briefing.text,
+            briefing_version: briefing.version
+          });
+          return { room: next, redelivered: true };
+        });
+        if (redelivered) await this.intake.resumePending(id);
+        return updated;
+      }
+      async deleteRoleBriefing(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RoleBriefingDeleteInputSchema.parse(input);
+        return this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "delete a role briefing for");
+          if (room.role_briefings[request.role] === void 0) {
+            throw new RoomServiceError(`no role briefing exists for "${request.role}" in room "${id}"`);
+          }
+          const { [request.role]: _removed, ...rest } = room.role_briefings;
+          return this.store.save(RoomSchema.parse({ ...room, role_briefings: rest }));
         });
       }
       async createInvite(roomId, input) {
@@ -6220,33 +6593,215 @@ var init_service = __esm({
         return this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "create an invite for");
-          const packet = this.packet(id);
-          const minted = await packet.mintInvite(request.mode);
-          const invite = RoomInviteSchema.parse({
-            invite_id: minted.invite_id,
+          return this.mintInviteUnlocked(room, {
             mode: request.mode,
-            role: request.role,
-            min_accepts: request.min_accepts,
-            accepted_cids: [],
-            state: "live",
-            created_at: this.now()
+            role: request.role ?? DEFAULT_ROLE,
+            min_accepts: request.min_accepts
           });
+        });
+      }
+      async mintInviteUnlocked(room, request) {
+        const packet = this.packet(room.room_id);
+        const minted = await packet.mintInvite(request.mode);
+        const invite = RoomInviteSchema.parse({
+          invite_id: minted.invite_id,
+          mode: request.mode,
+          role: request.role,
+          min_accepts: request.min_accepts,
+          accepted_cids: [],
+          state: "live",
+          created_at: this.now(),
+          ...request.replaces_seat === void 0 ? {} : { replaces_seat: request.replaces_seat }
+        });
+        try {
+          await this.store.save(RoomSchema.parse({ ...room, invites: [...room.invites, invite] }));
+        } catch (error) {
           try {
-            await this.store.save(RoomSchema.parse({ ...room, invites: [...room.invites, invite] }));
-          } catch (error) {
-            try {
-              await packet.revokeInvite(minted.invite_id);
-            } catch {
-            }
-            throw error;
+            await packet.revokeInvite(minted.invite_id);
+          } catch {
           }
-          return {
-            room_id: id,
-            invite,
-            blob: minted.blob,
-            reusable: minted.reusable
+          throw error;
+        }
+        return {
+          room_id: room.room_id,
+          invite,
+          blob: minted.blob,
+          reusable: minted.reusable
+        };
+      }
+      /**
+       * Operator-only removal (spec §5.2): archive-before-act membership intent,
+       * seat state flip + epoch bump, core 0.13 bilateral sever with an honest
+       * receipt, and an alias-form announcement unless the room or call is quiet.
+       */
+      async removeParticipant(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RemoveParticipantInputSchema.parse(input);
+        const receipt = await this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "remove a participant from");
+          const seat = this.findActiveSeat(room, request.participant);
+          const notify = (request.notify ?? true) && !room.quiet_membership;
+          return this.beginRemovalUnlocked(room, seat, notify);
+        });
+        await this.intake.resumePending(id);
+        return receipt;
+      }
+      /**
+       * Removal plus a same-role invite stamped with the seat lineage (spec §5.3).
+       * Owner override OC-2/OC-6: in an anonymous room the flow is unconditionally
+       * silent — the successor inherits the alias and other members see nothing.
+       */
+      async replaceParticipant(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = ReplaceParticipantInputSchema.parse(input);
+        const receipt = await this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "replace a participant in");
+          const seat = this.findActiveSeat(room, request.participant);
+          const notify = room.anonymous ? false : (request.notify ?? true) && !room.quiet_membership;
+          const removal = await this.beginRemovalUnlocked(room, seat, notify);
+          const current = await this.store.load(id);
+          const invite = await this.mintInviteUnlocked(current, {
+            mode: request.mode ?? "one_time",
+            role: seat.role,
+            min_accepts: request.min_accepts ?? 1,
+            replaces_seat: seat.participant_id
+          });
+          return { ...invite, removal };
+        });
+        await this.intake.resumePending(id);
+        return receipt;
+      }
+      findActiveSeat(room, participant) {
+        const seat = room.seats.find((candidate) => candidate.state === "active" && (candidate.identity === participant || candidate.participant_id === participant));
+        if (!seat) {
+          throw new RoomServiceError(`"${participant}" is not an active participant of room "${room.room_id}"`);
+        }
+        return seat;
+      }
+      async beginRemovalUnlocked(room, seat, notify) {
+        const intent = await this.store.append(room.room_id, {
+          version: 1,
+          kind: "membership_intent",
+          room_id: room.room_id,
+          at: this.now(),
+          action: "remove",
+          participant_id: seat.participant_id,
+          recipient_identity: seat.identity,
+          role: seat.role,
+          // The participant-visible label: the alias in anonymous rooms, the
+          // contact display name otherwise (INV-R3 holds either way).
+          alias: seat.alias ?? seat.display_name,
+          epoch: room.membership_epoch + 1,
+          notify
+        });
+        if (intent.kind !== "membership_intent") {
+          throw new RoomServiceError("storage returned the wrong membership intent kind");
+        }
+        const { receipt } = await this.completeRemovalUnlocked(room, intent);
+        return receipt;
+      }
+      /**
+       * Idempotent completion of a durable removal intent: each step re-checks the
+       * archive/state it would produce, so a crash anywhere re-drives cleanly
+       * (INV-R5; the 0.13 sever is replay-safe by design).
+       */
+      async completeRemovalUnlocked(room, intent) {
+        let current = room;
+        const index = current.seats.findIndex(
+          (candidate) => candidate.participant_id === intent.participant_id
+        );
+        if (index < 0) {
+          throw new RoomServiceError(
+            `membership intent ${intent.record_id} references an unknown seat in room "${current.room_id}"`
+          );
+        }
+        if (current.seats[index].state !== "removed") {
+          const seats = [...current.seats];
+          seats[index] = {
+            ...seats[index],
+            state: "removed",
+            removed_at: intent.at,
+            removed_epoch: intent.epoch
           };
+          current = await this.store.save(RoomSchema.parse({
+            ...current,
+            seats,
+            membership_epoch: Math.max(current.membership_epoch, intent.epoch)
+          }));
+        }
+        const records = await this.store.read(current.room_id);
+        const existing = records.find((record) => record.kind === "membership_result" && record.intent_record_id === intent.record_id);
+        let outcome;
+        if (existing !== void 0 && existing.kind === "membership_result") {
+          outcome = {
+            status: existing.status,
+            notified: existing.notified,
+            key_material_retained: true
+          };
+        } else {
+          outcome = await this.packet(current.room_id).removeContact(intent.recipient_identity);
+          const result = await this.store.append(current.room_id, {
+            version: 1,
+            kind: "membership_result",
+            room_id: current.room_id,
+            at: this.now(),
+            intent_record_id: intent.record_id,
+            participant_id: intent.participant_id,
+            status: outcome.status,
+            notified: outcome.notified,
+            key_material_retained: true
+          });
+          if (result.kind !== "membership_result") {
+            throw new RoomServiceError("storage returned the wrong membership result kind");
+          }
+        }
+        if (intent.notify) await this.ensureMembershipNotice(current, intent);
+        return {
+          room: current,
+          receipt: {
+            room_id: current.room_id,
+            participant_id: intent.participant_id,
+            epoch: intent.epoch,
+            status: outcome.status,
+            notified: outcome.notified,
+            key_material_retained: true
+          }
+        };
+      }
+      async ensureMembershipNotice(room, intent) {
+        const records = await this.store.read(room.room_id);
+        const already = records.some((record) => record.kind === "message" && record.category === "membership" && record.membership?.action === "remove" && record.membership.epoch === intent.epoch);
+        if (already) return;
+        const remaining = activeSeats(room);
+        if (remaining.length === 0) return;
+        const label = intent.alias ?? intent.role;
+        const appended = await this.store.append(room.room_id, {
+          version: 1,
+          kind: "message",
+          room_id: room.room_id,
+          at: this.now(),
+          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+          author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
+          category: "membership",
+          text: `${label} left the room \xB7 epoch ${intent.epoch}`,
+          membership: { action: "remove", alias: label, role: intent.role, epoch: intent.epoch },
+          recipient_identities: uniqueIdentities(remaining.map((seat) => seat.identity))
         });
+        if (appended.kind !== "message") {
+          throw new RoomServiceError("storage returned the wrong membership notice kind");
+        }
+        for (const recipientIdentity of appended.recipient_identities) {
+          await this.store.append(room.room_id, {
+            version: 1,
+            kind: "relay_intent",
+            room_id: room.room_id,
+            at: this.now(),
+            message_id: appended.message_id,
+            recipient_identity: recipientIdentity
+          });
+        }
       }
       async revokeInvite(roomId, inviteId) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
@@ -6426,8 +6981,26 @@ var init_service = __esm({
       }
       async history(roomId, options = {}) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
-        const page = HistoryOptionsSchema.parse(options);
-        return this.store.read(id, page);
+        const { view, ...page } = HistoryOptionsSchema.parse(options);
+        const records = await this.store.read(id, page);
+        if (view !== "participant") return records;
+        return records.filter((record) => record.kind === "message").map((record) => {
+          const {
+            author_alias,
+            recipient_identities: _recipients,
+            source_msg_id: _sourceMsg,
+            source_wire_id: _sourceWire,
+            ...rest
+          } = record;
+          return {
+            ...rest,
+            author: author_alias === void 0 ? record.author : {
+              identity: author_alias.participant_id,
+              display_name: author_alias.alias,
+              role: record.author.role
+            }
+          };
+        });
       }
       /**
        * Forward-only close. Every external contact mutation is preceded by a
@@ -6492,7 +7065,7 @@ var init_service = __esm({
             },
             category: "chat",
             text: request.text,
-            recipient_identities: uniqueIdentities(room.seats.map((seat) => seat.identity))
+            recipient_identities: uniqueIdentities(activeSeats(room).map((seat) => seat.identity))
           });
           if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong room message kind");
           for (const recipientIdentity of appended.recipient_identities) {
@@ -6517,7 +7090,15 @@ var init_service = __esm({
         }
         const origins = packet.listContactOrigins();
         const inviteById = new Map(room.invites.map((invite) => [invite.invite_id, invite]));
-        const existingCids = new Set(room.seats.map((seat) => seat.identity));
+        const existingCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
+        const lastRemovedAt = /* @__PURE__ */ new Map();
+        for (const seat of room.seats) {
+          if (seat.state !== "removed" || seat.removed_at === void 0) continue;
+          const previous = lastRemovedAt.get(seat.identity);
+          if (previous === void 0 || seat.removed_at > previous) {
+            lastRemovedAt.set(seat.identity, seat.removed_at);
+          }
+        }
         const newSeats = [];
         for (const [cid, displayName] of contactsByCid) {
           if (existingCids.has(cid)) continue;
@@ -6525,12 +7106,23 @@ var init_service = __esm({
           if (!origin || origin.via !== "invite_one_time" && origin.via !== "invite_public") continue;
           const invite = inviteById.get(origin.invite_id);
           if (!invite || invite.state === "receipt_pending" || invite.recovery_of !== void 0 && invite.recovery_confirmed !== true) continue;
+          const removedAt = lastRemovedAt.get(cid);
+          if (removedAt !== void 0 && invite.created_at <= removedAt) continue;
+          const seated = [...room.seats, ...newSeats];
+          const predecessor = invite.replaces_seat === void 0 ? void 0 : seated.find((seat) => seat.participant_id === invite.replaces_seat && seat.state === "removed");
+          if (invite.replaces_seat !== void 0 && !predecessor) continue;
           newSeats.push({
             identity: cid,
             display_name: displayName,
             role: invite.role,
             invite_id: invite.invite_id,
-            accepted_at: origin.at
+            accepted_at: origin.at,
+            participant_id: LowerCrockfordUlidSchema.parse(generateUlid()),
+            state: "active",
+            ...predecessor === void 0 ? {} : { replaces_seat: predecessor.participant_id },
+            // OC-6 (owner override): a replacement into a role inherits the
+            // predecessor's alias — the alias binds to the seat/role lineage.
+            ...room.anonymous ? { alias: predecessor?.alias ?? mintAlias(seated, invite.role) } : {}
           });
           existingCids.add(cid);
         }
@@ -6556,13 +7148,26 @@ var init_service = __esm({
           }
           return { ...invite, accepted_cids, state };
         });
-        let next = RoomSchema.parse({ ...room, seats, invites });
+        let next = RoomSchema.parse({
+          ...room,
+          seats,
+          invites,
+          membership_epoch: room.membership_epoch + newSeats.length
+        });
+        const journal = await this.store.read(next.room_id);
+        const completedIntents = new Set(journal.filter((record) => record.kind === "membership_result").map((record) => record.kind === "membership_result" ? record.intent_record_id : ""));
+        for (const intent of journal.filter(
+          (record) => record.kind === "membership_intent"
+        )) {
+          if (completedIntents.has(intent.record_id)) continue;
+          ({ room: next } = await this.completeRemovalUnlocked(next, intent));
+        }
         const requirementsMet = invites.filter((invite) => invite.state !== "revoked").every((invite) => invite.accepted_cids.length >= invite.min_accepts);
         if (next.state === "provisioning" && seats.length > 0 && requirementsMet) {
-          const activationAt = await this.ensureActivationBriefing(next, seats);
+          const activationAt = await this.ensureActivationBriefing(next, activeSeats(next));
           next = RoomSchema.parse({ ...next, state: "active", activated_at: activationAt });
-        } else if (next.state === "active") {
-          for (const seat of newSeats) await this.ensureLateBriefing(next, seat);
+        } else if (next.state === "active" && newSeats.length > 0) {
+          await this.ensureActivationBriefing(next, newSeats);
         }
         return this.store.save(next);
       }
@@ -6659,62 +7264,98 @@ var init_service = __esm({
       deleteReceipt(roomId) {
         return { version: 1, room_id: roomId, deleted: true, scope: "this_host" };
       }
+      /**
+       * Deliver the common briefing followed by the seat's role briefing (spec
+       * §3.3): exactly once per (seat, briefing kind, version) via the message +
+       * relay-intent ledger. Returns the timestamp of the common briefing message
+       * that admitted the earliest of the given recipients (activation time).
+       */
       async ensureActivationBriefing(room, recipients) {
+        const at = await this.ensureBriefingKind(room, recipients, {
+          category: "briefing",
+          text: room.mission.briefing,
+          briefing_version: room.mission.briefing_version
+        });
+        await this.ensureRoleBriefings(room, recipients);
+        return at;
+      }
+      async ensureRoleBriefings(room, recipients) {
+        for (const seat of recipients) {
+          const briefing = room.role_briefings[seat.role];
+          if (!briefing) continue;
+          await this.ensureBriefingKind(room, [seat], {
+            category: "role_briefing",
+            briefing_role: seat.role,
+            text: briefing.text,
+            briefing_version: briefing.version
+          });
+        }
+      }
+      /** Re-deliver the (just bumped) common briefing to every active seat. */
+      async redeliverCommonBriefing(room) {
+        await this.ensureBriefingKind(room, activeSeats(room), {
+          category: "briefing",
+          text: room.mission.briefing,
+          briefing_version: room.mission.briefing_version
+        });
+      }
+      async ensureBriefingKind(room, recipients, briefing) {
         const records = await this.store.read(room.room_id);
-        let message = records.find(
-          (record) => record.kind === "message" && record.category === "briefing"
-        );
-        if (!message) message = await this.appendBriefing(room, recipients);
-        const intents = new Set(records.filter((record) => record.kind === "relay_intent" && record.message_id === message.message_id).map((record) => record.kind === "relay_intent" ? record.recipient_identity : ""));
-        for (const recipientIdentity of message.recipient_identities) {
-          if (!intents.has(recipientIdentity)) {
+        const matching = records.filter((record) => record.kind === "message" && record.category === briefing.category && record.briefing_role === briefing.briefing_role && (record.briefing_version ?? 1) === briefing.briefing_version);
+        const intentsByMessage = /* @__PURE__ */ new Map();
+        for (const record of records) {
+          if (record.kind !== "relay_intent") continue;
+          const intents = intentsByMessage.get(record.message_id) ?? /* @__PURE__ */ new Set();
+          intents.add(record.recipient_identity);
+          intentsByMessage.set(record.message_id, intents);
+        }
+        const covered = /* @__PURE__ */ new Set();
+        for (const message of matching) {
+          const intents = intentsByMessage.get(message.message_id) ?? /* @__PURE__ */ new Set();
+          for (const recipientIdentity of message.recipient_identities) {
+            covered.add(recipientIdentity);
+            if (!intents.has(recipientIdentity)) {
+              await this.store.append(room.room_id, {
+                version: 1,
+                kind: "relay_intent",
+                room_id: room.room_id,
+                at: this.now(),
+                message_id: message.message_id,
+                recipient_identity: recipientIdentity
+              });
+            }
+          }
+        }
+        const missing = recipients.filter((seat) => !covered.has(seat.identity));
+        let appendedAt;
+        if (missing.length > 0) {
+          const appended = await this.store.append(room.room_id, {
+            version: 1,
+            kind: "message",
+            room_id: room.room_id,
+            at: this.now(),
+            message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+            author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
+            category: briefing.category,
+            ...briefing.briefing_role === void 0 ? {} : { briefing_role: briefing.briefing_role },
+            briefing_version: briefing.briefing_version,
+            text: briefing.text,
+            recipient_identities: uniqueIdentities(missing.map((seat) => seat.identity))
+          });
+          if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
+          appendedAt = appended.at;
+          for (const recipientIdentity of appended.recipient_identities) {
             await this.store.append(room.room_id, {
               version: 1,
               kind: "relay_intent",
               room_id: room.room_id,
               at: this.now(),
-              message_id: message.message_id,
+              message_id: appended.message_id,
               recipient_identity: recipientIdentity
             });
           }
         }
-        const originalAudience = new Set(message.recipient_identities);
-        for (const recipient of recipients) {
-          if (!originalAudience.has(recipient.identity)) await this.ensureLateBriefing(room, recipient);
-        }
-        return message.at;
-      }
-      async ensureLateBriefing(room, seat) {
-        const records = await this.store.read(room.room_id);
-        let message = [...records].reverse().find(
-          (record) => record.kind === "message" && record.category === "briefing" && record.recipient_identities.includes(seat.identity)
-        );
-        if (!message) message = await this.appendBriefing(room, [seat]);
-        const alreadyBriefed = records.some((record) => record.kind === "relay_intent" && record.message_id === message.message_id && record.recipient_identity === seat.identity);
-        if (alreadyBriefed) return;
-        await this.store.append(room.room_id, {
-          version: 1,
-          kind: "relay_intent",
-          room_id: room.room_id,
-          at: this.now(),
-          message_id: message.message_id,
-          recipient_identity: seat.identity
-        });
-      }
-      async appendBriefing(room, recipients) {
-        const record = await this.store.append(room.room_id, {
-          version: 1,
-          kind: "message",
-          room_id: room.room_id,
-          at: this.now(),
-          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
-          author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
-          category: "briefing",
-          text: room.mission.briefing,
-          recipient_identities: uniqueIdentities(recipients.map((seat) => seat.identity))
-        });
-        if (record.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
-        return record;
+        return matching[0]?.at ?? appendedAt ?? this.now();
       }
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
@@ -6740,7 +7381,7 @@ var init_service = __esm({
 });
 
 // src/storage.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes3 } from "node:crypto";
 import * as nodeFs3 from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { dirname as dirname4, join as join4 } from "node:path";
@@ -6749,6 +7390,7 @@ var init_storage = __esm({
   "src/storage.ts"() {
     "use strict";
     init_contracts();
+    init_ulid();
     DIRECTORY_MODE2 = 448;
     FILE_MODE2 = 384;
     NO_FOLLOW2 = nodeFs3.constants.O_NOFOLLOW ?? 0;
@@ -6989,11 +7631,17 @@ var init_storage = __esm({
               `room "${validRoomId}" has archive residue without deletion metadata`
             );
           }
-          const expected = /* @__PURE__ */ new Set(["archive.jsonl", "room.json"]);
+          const expected = /* @__PURE__ */ new Set(["archive.jsonl", "room.json", "room.json.v1.bak"]);
           const unexpected = this.fs.readdirSync(roomDir).filter((name) => !expected.has(name));
           if (unexpected.length > 0) {
             throw new CoworkStorageError(`room "${validRoomId}" contains live or unexpected residue: ${unexpected.join(", ")}`);
           }
+          const backupPath = `${metadataPath}.v1.bak`;
+          if (this.lstatIfPresent(backupPath)) {
+            this.assertRegularFile(backupPath, "room metadata v1 backup");
+            this.fs.unlinkSync(backupPath);
+            this.fsyncDirectory(roomDir);
+          }
           if (archivePresent) {
             this.assertRegularFile(archivePath, "room archive");
             this.fs.unlinkSync(archivePath);
@@ -7048,10 +7696,106 @@ var init_storage = __esm({
         } catch (error) {
           throw this.wrap(`malformed metadata for room "${roomId}"`, error);
         }
-        const room = RoomSchema.parse(decoded);
+        const room = this.isVersion1(decoded) ? this.migrateUnlocked(roomId, decoded, bytes) : RoomSchema.parse(decoded);
         if (room.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
         return room;
       }
+      isVersion1(decoded) {
+        return typeof decoded === "object" && decoded !== null && decoded.version === 1;
+      }
+      /**
+       * Lazy additive v1 → v2 migration (spec §7): preserve the exact pre-migration
+       * bytes once as room.json.v1.bak, then atomically persist the v2 metadata.
+       *
+       * THE BACKUP IS WRITTEN TEMP → FSYNC → RENAME, not opened in place, and the
+       * reason is a crash window that an existence check cannot see. The earlier
+       * version guarded with `if (!lstatIfPresent(backupPath))` and wrote straight
+       * into the final path under O_CREAT|O_EXCL. A crash inside that write leaves a
+       * PARTIAL file that nonetheless EXISTS, so the next load's existence check
+       * skips the backup, writes v2, and the pre-migration bytes are gone — no
+       * error, no warning, and the one artefact that exists to undo a bad migration
+       * is a truncated fragment. Measured before the fix: a 40-byte prefix of a
+       * 604-byte room, JSON.parse false, room.json already v2.
+       *
+       * A rename is atomic, so the final path now only ever appears complete. The
+       * temp file is created with O_EXCL under a pid+random name and removed on
+       * failure, so a crashed attempt leaves at most an orphan temp, never a
+       * plausible-looking backup.
+       *
+       * AND AN EXISTING BACKUP IS PARSED BEFORE IT IS TRUSTED, which repairs the
+       * case where a partial file is ALREADY on disk from a build without this fix —
+       * exactly the state a host that ran the previous code could be in right now.
+       * A backup that does not parse as v1 is replaced by the bytes we hold, because
+       * those are the real pre-migration bytes and the fragment is worthless.
+       *
+       * WHAT THE BACKUP IS NOT: restoring it is NOT a rollback. See the note on
+       * `restoreV1Backup` — re-migrating mints fresh participant ids.
+       */
+      migrateUnlocked(roomId, decoded, originalBytes) {
+        const v1 = RoomV1Schema.parse(decoded);
+        if (v1.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
+        const migrated = migrateRoomV1(v1, generateUlid);
+        const backupPath = `${this.metadataPath(roomId)}.v1.bak`;
+        if (!this.hasIntactV1Backup(backupPath)) {
+          this.atomicBytesWrite(backupPath, originalBytes, "room metadata v1 backup");
+        }
+        this.atomicMetadataWrite(this.metadataPath(roomId), migrated);
+        return migrated;
+      }
+      /**
+       * Is there already a backup we would be willing to hand back to an operator?
+       *
+       * Existence is not the question — a partial file exists. It must parse and
+       * still claim to be the v1 metadata for this room; anything else is a fragment
+       * and is better overwritten with the bytes we are holding right now.
+       */
+      hasIntactV1Backup(backupPath) {
+        if (!this.lstatIfPresent(backupPath)) return false;
+        try {
+          const decoded = JSON.parse(utf8Decoder.decode(this.readFileNoFollow(backupPath, "room metadata v1 backup")));
+          return this.isVersion1(decoded);
+        } catch {
+          return false;
+        }
+      }
+      /**
+       * Durably place exact bytes at `path`: temp under O_EXCL, fsync, rename, fsync
+       * the directory. The same dance as atomicMetadataWrite, which serialises a Room
+       * rather than taking bytes verbatim — and taking them verbatim is the whole
+       * point for a backup, whose value is being byte-identical to what was there.
+       */
+      atomicBytesWrite(path, bytes, label) {
+        if (this.lstatIfPresent(path)) this.assertRegularFile(path, label);
+        const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
+        let fd;
+        try {
+          fd = this.fs.openSync(
+            temp,
+            nodeFs3.constants.O_CREAT | nodeFs3.constants.O_EXCL | nodeFs3.constants.O_WRONLY | NO_FOLLOW2,
+            FILE_MODE2
+          );
+          this.validateOpenPath(fd, temp, `temporary ${label}`, "file", true);
+          this.fs.fchmodSync(fd, FILE_MODE2);
+          this.writeAll(fd, bytes);
+          this.fs.fsyncSync(fd);
+          this.fs.closeSync(fd);
+          fd = void 0;
+          this.fs.renameSync(temp, path);
+          this.fsyncDirectory(dirname4(path));
+        } catch (error) {
+          if (fd !== void 0) {
+            try {
+              this.fs.closeSync(fd);
+            } catch {
+            }
+          }
+          try {
+            this.fs.rmSync(temp, { force: true });
+          } catch {
+          }
+          throw this.wrap(`failed to write ${label} at ${path}`, error);
+        }
+      }
       scanArchive(roomId) {
         const path = this.archivePath(roomId);
         this.assertRegularFile(path, "room archive");
@@ -7213,7 +7957,7 @@ var init_storage = __esm({
       }
       atomicMetadataWrite(path, room) {
         if (this.lstatIfPresent(path)) this.assertRegularFile(path, "room metadata");
-        const temp = `${path}.tmp-${process.pid}-${randomBytes4(8).toString("hex")}`;
+        const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
         const bytes = Buffer.from(`${JSON.stringify(room)}
 `, "utf8");
         let fd;
@@ -7456,7 +8200,7 @@ var init_web = __esm({
 });
 
 // src/transports.ts
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import * as http from "node:http";
 import * as net from "node:net";
 import * as nodeFs5 from "node:fs";
@@ -7469,19 +8213,36 @@ function createServiceRoutes(service) {
         room_id: external_exports.string(),
         goal: external_exports.unknown().optional(),
         briefing: external_exports.unknown().optional(),
-        status: external_exports.unknown().optional()
+        status: external_exports.unknown().optional(),
+        quiet_membership: external_exports.unknown().optional()
       }).strict().parse(params);
       return service.updateRoom(room_id, input);
     } },
+    "room.briefing.role.set": { auth: true, run: (params) => {
+      const { room_id, ...input } = RoleBriefingSetParams.parse(params);
+      return service.setRoleBriefing(room_id, input);
+    } },
+    "room.briefing.role.delete": { auth: true, run: (params) => {
+      const { room_id, ...input } = RoleBriefingDeleteParams.parse(params);
+      return service.deleteRoleBriefing(room_id, input);
+    } },
     "room.invite": { auth: true, run: (params) => {
       const { room_id, ...input } = external_exports.object({
         room_id: external_exports.string(),
         mode: external_exports.unknown(),
-        role: external_exports.unknown(),
+        role: external_exports.unknown().optional(),
         min_accepts: external_exports.unknown()
       }).strict().parse(params);
       return service.createInvite(room_id, input);
     } },
+    "room.participant.remove": { auth: true, run: (params) => {
+      const { room_id, ...input } = ParticipantRemoveParams.parse(params);
+      return service.removeParticipant(room_id, input);
+    } },
+    "room.participant.replace": { auth: true, run: (params) => {
+      const { room_id, ...input } = ParticipantReplaceParams.parse(params);
+      return service.replaceParticipant(room_id, input);
+    } },
     "room.revoke": { auth: true, run: (params) => {
       const value = InviteRevokeParams.parse(params);
       return service.revokeInvite(value.room_id, value.invite_id);
@@ -7639,7 +8400,7 @@ function responseFinished2(response) {
     response.once("error", rejectResponse);
   });
 }
-var MAX_REQUEST_BYTES, HTTP_HEADERS_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, HTTP_BODY_IDLE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, MAX_STALE_PRIVATE_SOCKET_CLEANUP, RpcIdSchema, RpcRequestSchema, RpcDispatcher, RoomIdParams, InviteRevokeParams, RecoverConfirmParams, HistoryParams, TransportServer;
+var MAX_REQUEST_BYTES, HTTP_HEADERS_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, HTTP_BODY_IDLE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, MAX_STALE_PRIVATE_SOCKET_CLEANUP, RpcIdSchema, RpcRequestSchema, RpcDispatcher, RoomIdParams, InviteRevokeParams, RecoverConfirmParams, HistoryParams, RoleBriefingSetParams, RoleBriefingDeleteParams, ParticipantRemoveParams, ParticipantReplaceParams, TransportServer;
 var init_transports = __esm({
   "src/transports.ts"() {
     "use strict";
@@ -7714,7 +8475,29 @@ var init_transports = __esm({
     HistoryParams = external_exports.object({
       room_id: external_exports.string(),
       after: external_exports.number().optional(),
-      limit: external_exports.number().optional()
+      limit: external_exports.number().optional(),
+      view: external_exports.enum(["operator", "participant"]).optional()
+    }).strict();
+    RoleBriefingSetParams = external_exports.object({
+      room_id: external_exports.string(),
+      role: external_exports.string(),
+      text: external_exports.string()
+    }).strict();
+    RoleBriefingDeleteParams = external_exports.object({
+      room_id: external_exports.string(),
+      role: external_exports.string()
+    }).strict();
+    ParticipantRemoveParams = external_exports.object({
+      room_id: external_exports.string(),
+      participant: external_exports.string(),
+      notify: external_exports.boolean().optional()
+    }).strict();
+    ParticipantReplaceParams = external_exports.object({
+      room_id: external_exports.string(),
+      participant: external_exports.string(),
+      notify: external_exports.boolean().optional(),
+      mode: external_exports.enum(["one_time", "public"]).optional(),
+      min_accepts: external_exports.number().optional()
     }).strict();
     TransportServer = class {
       options;
@@ -7751,7 +8534,7 @@ var init_transports = __esm({
         await this.cleanupStalePrivateSockets();
         const unix = net.createServer((socket) => this.handleUnix(socket));
         this.unixServer = unix;
-        const privateSocketPath = `${this.options.socketPath}.private-${process.pid}-${randomBytes5(6).toString("hex")}`;
+        const privateSocketPath = `${this.options.socketPath}.private-${process.pid}-${randomBytes4(6).toString("hex")}`;
         this.privateSocketPath = privateSocketPath;
         try {
           await listen(unix, privateSocketPath);
@@ -8060,7 +8843,7 @@ var init_transports = __esm({
         }
       }
       quarantinePath(target, label) {
-        const path = `${this.options.socketPath}.safe-residue-${label}-${process.pid}-${randomBytes5(6).toString("hex")}`;
+        const path = `${this.options.socketPath}.safe-residue-${label}-${process.pid}-${randomBytes4(6).toString("hex")}`;
         this.fs.renameSync(target, path);
         const moved = this.fs.lstatSync(path);
         return { target, path, dev: moved.dev, ino: moved.ino };
@@ -8084,7 +8867,7 @@ var init_transports = __esm({
         }
       }
       quarantinePublicPath() {
-        const quarantinePath = `${this.options.socketPath}.replacement-${process.pid}-${randomBytes5(6).toString("hex")}`;
+        const quarantinePath = `${this.options.socketPath}.replacement-${process.pid}-${randomBytes4(6).toString("hex")}`;
         try {
           this.fs.renameSync(this.options.socketPath, quarantinePath);
         } catch (error) {
@@ -8608,7 +9391,7 @@ var daemon_process_exports = {};
 __export(daemon_process_exports, {
   runDaemonProcess: () => runDaemonProcess
 });
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 async function runDaemonProcess() {
   try {
     const code = process.env.OURS_COWORK_DAEMON_WORKER === "1" ? await runWorker() : await runSupervisor();
@@ -8721,7 +9504,7 @@ async function runWorker() {
     },
     control: {
       // Created only after the supervisor capability handshake completed.
-      session: randomBytes6(16).toString("hex"),
+      session: randomBytes5(16).toString("hex"),
       async requestSupervisorShutdown() {
         if (!capability || disconnected || process.connected === false) return false;
         return sendIpc({ type: "shutdown_request", capability });
@@ -8799,7 +9582,7 @@ var init_daemon_process = __esm({
 
 // src/daemon.ts
 import { fork } from "node:child_process";
-import { randomBytes as randomBytes7 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 import { resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 async function runSupervisor(options = {}) {
@@ -8906,7 +9689,7 @@ var init_daemon = __esm({
         this.signals = options.signals ?? process;
         this.shutdownTimeoutMs = options.shutdownTimeoutMs ?? DAEMON_SHUTDOWN_TIMEOUT_MS;
         this.onStageCallback = options.onStage;
-        this.capability = options.capability ?? randomBytes7(32).toString("hex");
+        this.capability = options.capability ?? randomBytes6(32).toString("hex");
         if (!/^[0-9a-f]{64}$/.test(this.capability)) throw new Error("invalid daemon worker capability");
         this.done = new Promise((resolveDone) => {
           this.resolveDone = resolveDone;