@ours.network/cowork 0.2.0 → 0.3.1

package/dist/cli.js

@@ -4271,6 +4271,591 @@ function lstatIfPresent(fs2, path) {
   }
 }
 
+// src/contracts.ts
+import { createHash } from "node:crypto";
+var MAX_TEXT_BYTES = 262144;
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
+var MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
+var MAX_FILE_NAME_BYTES = 255;
+var MAX_MIME_BYTES = 255;
+var MAX_ROLE_BYTES = 256;
+function utf8Bounded(label, maximumBytes) {
+  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
+    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
+    `${label} must be at most ${maximumBytes} UTF-8 bytes`
+  );
+}
+var NonEmptyStringSchema = external_exports.string().min(1);
+var PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
+var LowerCrockfordUlidSchema = external_exports.string().regex(
+  /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+  "must be a 26-character lowercase Crockford ULID"
+);
+function isStrictRfc3339(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
+  if (!match) return false;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
+  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
+  if (offsetHour > 23 || offsetMinute > 59) return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day >= 1 && day <= days[month - 1];
+}
+var Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
+var RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
+var MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
+var MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
+var FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
+var FileMimeSchema = external_exports.string().refine(
+  (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
+  `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
+);
+var RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
+var SeatStateSchema = external_exports.enum(["active", "removed"]);
+var InviteModeSchema = external_exports.enum(["one_time", "public"]);
+var InviteStateSchema = external_exports.enum([
+  "live",
+  "consumed",
+  "revoked",
+  "replacement_required",
+  "receipt_pending"
+]);
+var RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
+var SeatV1Schema = external_exports.object({
+  identity: NonEmptyStringSchema,
+  display_name: NonEmptyStringSchema,
+  role: RoleSchema,
+  invite_id: NonEmptyStringSchema,
+  accepted_at: Rfc3339Schema
+}).strict();
+var SeatSchema = external_exports.object({
+  identity: NonEmptyStringSchema,
+  display_name: NonEmptyStringSchema,
+  role: RoleSchema,
+  invite_id: NonEmptyStringSchema,
+  accepted_at: Rfc3339Schema,
+  participant_id: LowerCrockfordUlidSchema,
+  state: SeatStateSchema,
+  alias: NonEmptyStringSchema.optional(),
+  removed_at: Rfc3339Schema.optional(),
+  removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
+  replaces_seat: LowerCrockfordUlidSchema.optional(),
+  bounced_at: Rfc3339Schema.optional()
+}).strict().superRefine((seat, context) => {
+  if (seat.state === "removed") {
+    if (seat.removed_at === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["removed_at"],
+        message: "removed seats require removed_at"
+      });
+    }
+    if (seat.removed_epoch === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["removed_epoch"],
+        message: "removed seats require removed_epoch"
+      });
+    }
+  } else {
+    for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+      if (seat[field] !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [field],
+          message: `${field} is reserved for removed seats`
+        });
+      }
+    }
+  }
+});
+var RoomInviteSchema = external_exports.object({
+  invite_id: NonEmptyStringSchema,
+  mode: InviteModeSchema,
+  role: RoleSchema,
+  min_accepts: PositiveSafeIntegerSchema,
+  accepted_cids: external_exports.array(NonEmptyStringSchema),
+  state: InviteStateSchema,
+  recovery_of: NonEmptyStringSchema.optional(),
+  recovery_confirmed: external_exports.boolean().optional(),
+  created_at: Rfc3339Schema,
+  replaces_seat: LowerCrockfordUlidSchema.optional()
+}).strict().superRefine((invite, context) => {
+  if (invite.mode === "one_time" && invite.min_accepts !== 1) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["min_accepts"],
+      message: "one_time invites require min_accepts === 1"
+    });
+  }
+  if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["recovery_of"],
+      message: "receipt_pending invites require recovery_of"
+    });
+  }
+  if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["recovery_confirmed"],
+      message: "recovery_confirmed is forbidden without recovery_of"
+    });
+  }
+  if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["recovery_confirmed"],
+      message: "recovery_confirmed is required with recovery_of"
+    });
+  }
+  if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["recovery_confirmed"],
+      message: "receipt_pending recovery lineage must be unconfirmed"
+    });
+  }
+  if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["recovery_confirmed"],
+      message: "live, consumed, and replacement_required recovery lineage must be confirmed"
+    });
+  }
+  if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["accepted_cids"],
+      message: "receipt_pending invites cannot have accepted CIDs"
+    });
+  }
+});
+var MissionV1Schema = external_exports.object({
+  goal: MissionTextSchema,
+  briefing: MissionTextSchema
+}).strict();
+var MissionSchema = external_exports.object({
+  goal: MissionTextSchema,
+  briefing: MissionTextSchema,
+  briefing_version: PositiveSafeIntegerSchema
+}).strict();
+var RoleBriefingSchema = external_exports.object({
+  text: MissionTextSchema,
+  version: PositiveSafeIntegerSchema,
+  updated_at: Rfc3339Schema
+}).strict();
+function refineRoomLineage(room, context) {
+  const pendingIdentityName = `cowork-room-${room.room_id}`;
+  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
+  if (room.identity_cid === "" && !exactPacketPending) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["identity_cid"],
+      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+    });
+  }
+  if (room.identity_cid !== "" && room.status === "packet_pending") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: "packet_pending status requires an empty identity_cid"
+    });
+  }
+  const pendingByRecovery = /* @__PURE__ */ new Map();
+  for (const [index, invite] of room.invites.entries()) {
+    if (invite.recovery_of === void 0) continue;
+    const recoveryOf = invite.recovery_of;
+    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
+    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
+    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index, "recovery_of"],
+        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+      });
+    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index],
+        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+      });
+    }
+    if (invite.state === "receipt_pending") {
+      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
+      pendingByRecovery.set(recoveryOf, count);
+      if (count > 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invites", index, "recovery_of"],
+          message: "only one receipt_pending invite may exist per recovery_of pointer"
+        });
+      }
+    }
+  }
+}
+var RoomCommonShape = {
+  room_id: LowerCrockfordUlidSchema,
+  identity_name: NonEmptyStringSchema,
+  identity_cid: external_exports.string(),
+  state: RoomStateSchema,
+  status: NonEmptyStringSchema.optional(),
+  invites: external_exports.array(RoomInviteSchema),
+  created_at: Rfc3339Schema,
+  activated_at: Rfc3339Schema.optional(),
+  closed_at: Rfc3339Schema.optional()
+};
+var RoomV1Schema = external_exports.object({
+  ...RoomCommonShape,
+  version: external_exports.literal(1),
+  mission: MissionV1Schema,
+  seats: external_exports.array(SeatV1Schema)
+}).strict().superRefine(refineRoomLineage);
+var RoomSchema = external_exports.object({
+  ...RoomCommonShape,
+  version: external_exports.literal(2),
+  mission: MissionSchema,
+  role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
+  anonymous: external_exports.boolean(),
+  quiet_membership: external_exports.boolean(),
+  membership_epoch: external_exports.number().int().nonnegative().safe(),
+  seats: external_exports.array(SeatSchema)
+}).strict().superRefine((room, context) => {
+  refineRoomLineage(room, context);
+  const byParticipant = /* @__PURE__ */ new Map();
+  const activeAliases = /* @__PURE__ */ new Set();
+  for (const [index, seat] of room.seats.entries()) {
+    if (byParticipant.has(seat.participant_id)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "participant_id"],
+        message: "participant_id must be unique within the room"
+      });
+    }
+    byParticipant.set(seat.participant_id, seat);
+    if (room.anonymous && seat.alias === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "alias"],
+        message: "anonymous rooms require an alias on every seat"
+      });
+    }
+    if (!room.anonymous && seat.alias !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "alias"],
+        message: "aliases are reserved for anonymous rooms"
+      });
+    }
+    if (seat.state === "active" && seat.alias !== void 0) {
+      if (activeAliases.has(seat.alias)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["seats", index, "alias"],
+          message: "active seats must hold distinct aliases"
+        });
+      }
+      activeAliases.add(seat.alias);
+    }
+    if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "removed_epoch"],
+        message: "removed_epoch cannot exceed the room membership_epoch"
+      });
+    }
+  }
+  for (const [index, seat] of room.seats.entries()) {
+    if (seat.replaces_seat === void 0) continue;
+    const predecessor = byParticipant.get(seat.replaces_seat);
+    if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "replaces_seat"],
+        message: "replaces_seat must reference a removed seat in this room"
+      });
+      continue;
+    }
+    if (predecessor.role !== seat.role) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "role"],
+        message: "a replacement seat must inherit the predecessor role"
+      });
+    }
+    if (room.anonymous && seat.alias !== predecessor.alias) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["seats", index, "alias"],
+        message: "an anonymous replacement seat must inherit the predecessor alias"
+      });
+    }
+  }
+});
+var CreateRoomInputSchema = external_exports.object({
+  goal: MissionTextSchema,
+  briefing: MissionTextSchema,
+  anonymous: external_exports.boolean().optional(),
+  quiet_membership: external_exports.boolean().optional()
+}).strict();
+var UpdateRoomInputSchema = external_exports.object({
+  goal: MissionTextSchema.optional(),
+  briefing: MissionTextSchema.optional(),
+  status: NonEmptyStringSchema.optional(),
+  quiet_membership: external_exports.boolean().optional()
+}).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
+var RoleBriefingSetInputSchema = external_exports.object({
+  role: RoleSchema,
+  text: MissionTextSchema
+}).strict();
+var RoleBriefingDeleteInputSchema = external_exports.object({
+  role: RoleSchema
+}).strict();
+var PostMessageInputSchema = external_exports.object({
+  text: MessageTextSchema
+}).strict();
+var AuthorSnapshotSchema = external_exports.object({
+  identity: NonEmptyStringSchema,
+  display_name: NonEmptyStringSchema,
+  role: RoleSchema
+}).strict();
+var RecordCommonShape = {
+  version: external_exports.literal(1),
+  room_id: LowerCrockfordUlidSchema,
+  seq: PositiveSafeIntegerSchema,
+  record_id: NonEmptyStringSchema,
+  at: Rfc3339Schema
+};
+var AppendCommonShape = {
+  version: external_exports.literal(1),
+  room_id: LowerCrockfordUlidSchema,
+  at: Rfc3339Schema
+};
+var MembershipNoticeSchema = external_exports.object({
+  action: external_exports.enum(["remove"]),
+  alias: NonEmptyStringSchema.optional(),
+  role: RoleSchema.optional(),
+  epoch: external_exports.number().int().nonnegative().safe()
+}).strict();
+var AuthorAliasSchema = external_exports.object({
+  participant_id: LowerCrockfordUlidSchema,
+  alias: NonEmptyStringSchema
+}).strict();
+var MessageShape = {
+  kind: external_exports.literal("message"),
+  message_id: LowerCrockfordUlidSchema,
+  author: AuthorSnapshotSchema,
+  author_alias: AuthorAliasSchema.optional(),
+  category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+  briefing_role: RoleSchema.optional(),
+  briefing_version: PositiveSafeIntegerSchema.optional(),
+  membership: MembershipNoticeSchema.optional(),
+  text: MessageTextSchema,
+  recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const [index, identity] of identities.entries()) {
+      if (seen.has(identity)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [index],
+          message: "recipient identities must be unique"
+        });
+      }
+      seen.add(identity);
+    }
+  }),
+  source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+  source_wire_id: NonEmptyStringSchema.optional()
+};
+var RelayIntentShape = {
+  kind: external_exports.literal("relay_intent"),
+  message_id: LowerCrockfordUlidSchema.optional(),
+  file_id: LowerCrockfordUlidSchema.optional(),
+  recipient_identity: NonEmptyStringSchema
+};
+var RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+var RelayResultShape = {
+  kind: external_exports.literal("relay_result"),
+  intent_record_id: NonEmptyStringSchema,
+  message_id: LowerCrockfordUlidSchema.optional(),
+  file_id: LowerCrockfordUlidSchema.optional(),
+  recipient_identity: NonEmptyStringSchema,
+  status: RelayResultStatusSchema,
+  wire_id: NonEmptyStringSchema.optional(),
+  metadata_wire_id: NonEmptyStringSchema.optional()
+};
+var FileShape = {
+  kind: external_exports.literal("file"),
+  file_id: LowerCrockfordUlidSchema,
+  author: AuthorSnapshotSchema,
+  author_alias: AuthorAliasSchema.optional(),
+  filename: FileNameSchema,
+  mime: FileMimeSchema,
+  size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  data_base64: external_exports.string(),
+  recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const [index, identity] of identities.entries()) {
+      if (seen.has(identity)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [index],
+          message: "recipient identities must be unique"
+        });
+      }
+      seen.add(identity);
+    }
+  }),
+  source_file_id: external_exports.number().int().nonnegative().safe(),
+  source_wire_id: NonEmptyStringSchema.optional()
+};
+var MembershipIntentShape = {
+  kind: external_exports.literal("membership_intent"),
+  action: external_exports.enum(["remove"]),
+  participant_id: LowerCrockfordUlidSchema,
+  recipient_identity: NonEmptyStringSchema,
+  role: RoleSchema,
+  alias: NonEmptyStringSchema.optional(),
+  epoch: PositiveSafeIntegerSchema,
+  notify: external_exports.boolean()
+};
+var MembershipResultShape = {
+  kind: external_exports.literal("membership_result"),
+  intent_record_id: NonEmptyStringSchema,
+  participant_id: LowerCrockfordUlidSchema,
+  status: RelayStatusSchema,
+  notified: external_exports.boolean(),
+  key_material_retained: external_exports.literal(true),
+  uncertain_after_restart: external_exports.literal(true).optional()
+};
+var CloseNoticeIntentShape = {
+  kind: external_exports.literal("close_notice_intent"),
+  recipient_identity: NonEmptyStringSchema
+};
+var CloseNoticeResultShape = {
+  kind: external_exports.literal("close_notice_result"),
+  intent_record_id: NonEmptyStringSchema,
+  recipient_identity: NonEmptyStringSchema,
+  status: RelayStatusSchema,
+  notified: external_exports.boolean(),
+  key_material_retained: external_exports.literal(true),
+  uncertain_after_restart: external_exports.literal(true).optional()
+};
+var MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
+var FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
+var RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
+var RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+var MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
+var MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
+var CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
+var CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
+var RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
+  MessageRecordSchema,
+  FileRecordSchema,
+  RelayIntentRecordSchema,
+  RelayResultRecordSchema,
+  MembershipIntentRecordSchema,
+  MembershipResultRecordSchema,
+  CloseNoticeIntentRecordSchema,
+  CloseNoticeResultRecordSchema
+]);
+function refineRelaySubject(record, context) {
+  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
+  if (record.message_id === void 0 === (record.file_id === void 0)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["message_id"],
+      message: "relay records require exactly one of message_id or file_id"
+    });
+  }
+}
+function refineFileRecord(record, context) {
+  if (record.kind !== "file" || record.data_base64 === void 0) return;
+  const bytes = Buffer.from(record.data_base64, "base64");
+  if (bytes.toString("base64") !== record.data_base64) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
+  }
+  if (bytes.length !== record.size) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
+  }
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== record.sha256) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
+  }
+}
+function refineMessageCategory(message, context) {
+  const requires = (field, present) => {
+    if (present && message[field] === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${message.category} messages require ${field}`
+      });
+    }
+    if (!present && message[field] !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${field} is forbidden on ${message.category} messages`
+      });
+    }
+  };
+  requires("briefing_role", message.category === "role_briefing");
+  requires("membership", message.category === "membership");
+  if (message.category === "role_briefing" && message.briefing_version === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["briefing_version"],
+      message: "role_briefing messages require briefing_version"
+    });
+  }
+  if (message.category === "chat" || message.category === "membership") {
+    if (message.briefing_version !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["briefing_version"],
+        message: `briefing_version is forbidden on ${message.category} messages`
+      });
+    }
+  }
+}
+var CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
+  if (record.record_id !== `${record.room_id}:${record.seq}`) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["record_id"],
+      message: 'record_id must equal room_id + ":" + seq'
+    });
+  }
+  if (record.kind === "message") refineMessageCategory(record, context);
+  refineRelaySubject(record, context);
+  refineFileRecord(record, context);
+});
+var AppendRecordSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
+]).superRefine((record, context) => {
+  if (record.kind === "message") refineMessageCategory(record, context);
+  refineRelaySubject(record, context);
+  refineFileRecord(record, context);
+});
+
 // src/cli.ts
 var EXIT = {
   success: 0,
@@ -4287,7 +4872,6 @@ var NATIVE_RPC_TIMEOUT_MS = 12e4;
 var START_TIMEOUT_MS = 3e4;
 var WEB_READY_TIMEOUT_MS = 3e4;
 var STOP_TIMEOUT_MS = 12e3;
-var MAX_RESPONSE_BYTES = 1024 * 1024;
 var SELF = fileURLToPath(import.meta.url);
 var SYSTEMD_UNIT = "ours-cowork.service";
 var LAUNCHD_LABEL = "network.ours.cowork";
@@ -4316,7 +4900,9 @@ var NATIVE_MUTATION_METHODS = /* @__PURE__ */ new Set([
   "room.message",
   "room.close",
   "room.recover",
-  "room.recover.confirm"
+  "room.recover.confirm",
+  "room.participant.remove",
+  "room.participant.replace"
 ]);
 function rpcTimeoutForMethod(method) {
   return NATIVE_MUTATION_METHODS.has(method) ? NATIVE_RPC_TIMEOUT_MS : RPC_TIMEOUT_MS;
@@ -4349,14 +4935,17 @@ Usage:
   ours-cowork [--json] docs [topic]
 
 Room commands:
-  create --goal <text> --briefing <text>
-  settings <room-id> [--goal <text>] [--briefing <text>] [--status <text>]
-  invite <room-id> --role <label> [--mode one_time|public] [--min-accepts <n>]
+  create --goal <text> --briefing <text> [--anonymous] [--quiet-membership]
+  settings <room-id> [--goal <text>] [--briefing <text>] [--status <text>] [--quiet-membership true|false]
+  role-briefing <room-id> --role <label> (--text <text> | --delete)
+  invite <room-id> [--role <label>] [--mode one_time|public] [--min-accepts <n>]
   revoke <room-id> <invite-id>
+  remove <room-id> <participant> [--silent]
+  replace <room-id> <participant> [--mode one_time|public] [--min-accepts <n>] [--silent]
   list
   show <room-id>
   participants <room-id>
-  history <room-id> [--after <seq>] [--limit <n>]
+  history <room-id> [--after <seq>] [--limit <n>] [--view operator|participant]
   message <room-id> --text <text>
   close <room-id>
   delete <room-id> --yes
@@ -4436,23 +5025,44 @@ function roomRequest(command, args) {
   if (!command) usageError("room requires a command");
   switch (command) {
     case "create": {
-      const parsed = parseOptions(args, ["--goal", "--briefing"]);
+      const parsed = parseOptions(args, ["--goal", "--briefing"], ["--anonymous", "--quiet-membership"]);
       exactPositionals(parsed, 0, "room create");
       return { method: "room.create", params: {
         goal: requiredFlag(parsed, "--goal", "room create"),
-        briefing: requiredFlag(parsed, "--briefing", "room create")
+        briefing: requiredFlag(parsed, "--briefing", "room create"),
+        ...parsed.booleans.has("--anonymous") ? { anonymous: true } : {},
+        ...parsed.booleans.has("--quiet-membership") ? { quiet_membership: true } : {}
       } };
     }
     case "settings": {
-      const parsed = parseOptions(args, ["--goal", "--briefing", "--status"]);
+      const parsed = parseOptions(args, ["--goal", "--briefing", "--status", "--quiet-membership"]);
       const [roomId] = exactPositionals(parsed, 1, "room settings");
       const params = { room_id: roomId };
       for (const [flag, key] of [["--goal", "goal"], ["--briefing", "briefing"], ["--status", "status"]]) {
         if (parsed.values[flag] !== void 0) params[key] = parsed.values[flag];
       }
+      const quiet = parsed.values["--quiet-membership"];
+      if (quiet !== void 0) {
+        if (quiet !== "true" && quiet !== "false") usageError("--quiet-membership must be true or false");
+        params.quiet_membership = quiet === "true";
+      }
       if (Object.keys(params).length === 1) usageError("room settings requires at least one setting option");
       return { method: "room.settings", params };
     }
+    case "role-briefing": {
+      const parsed = parseOptions(args, ["--role", "--text"], ["--delete"]);
+      const [roomId] = exactPositionals(parsed, 1, "room role-briefing");
+      const role = requiredFlag(parsed, "--role", "room role-briefing");
+      if (parsed.booleans.has("--delete")) {
+        if (parsed.values["--text"] !== void 0) usageError("room role-briefing takes either --text or --delete");
+        return { method: "room.briefing.role.delete", params: { room_id: roomId, role } };
+      }
+      return { method: "room.briefing.role.set", params: {
+        room_id: roomId,
+        role,
+        text: requiredFlag(parsed, "--text", "room role-briefing")
+      } };
+    }
     case "invite": {
       const parsed = parseOptions(args, ["--mode", "--role", "--min-accepts"]);
       const [roomId] = exactPositionals(parsed, 1, "room invite");
@@ -4463,10 +5073,33 @@ function roomRequest(command, args) {
       return { method: "room.invite", params: {
         room_id: roomId,
         mode,
-        role: requiredFlag(parsed, "--role", "room invite"),
+        // Omitted role = the built-in "Participant" role (daemon-side default).
+        ...parsed.values["--role"] === void 0 ? {} : { role: parsed.values["--role"] },
         min_accepts: minimum
       } };
     }
+    case "remove": {
+      const parsed = parseOptions(args, [], ["--silent"]);
+      const [roomId, participant] = exactPositionals(parsed, 2, "room remove");
+      return { method: "room.participant.remove", params: {
+        room_id: roomId,
+        participant,
+        ...parsed.booleans.has("--silent") ? { notify: false } : {}
+      } };
+    }
+    case "replace": {
+      const parsed = parseOptions(args, ["--mode", "--min-accepts"], ["--silent"]);
+      const [roomId, participant] = exactPositionals(parsed, 2, "room replace");
+      const mode = parsed.values["--mode"];
+      if (mode !== void 0 && mode !== "one_time" && mode !== "public") usageError("--mode must be one_time or public");
+      return { method: "room.participant.replace", params: {
+        room_id: roomId,
+        participant,
+        ...mode === void 0 ? {} : { mode },
+        ...parsed.values["--min-accepts"] === void 0 ? {} : { min_accepts: parseInteger(parsed.values["--min-accepts"], "--min-accepts", 1) },
+        ...parsed.booleans.has("--silent") ? { notify: false } : {}
+      } };
+    }
     case "revoke": {
       const parsed = parseOptions(args);
       const [roomId, inviteId] = exactPositionals(parsed, 2, "room revoke");
@@ -4483,11 +5116,16 @@ function roomRequest(command, args) {
       return { method: `room.${command}`, params: { room_id: roomId } };
     }
     case "history": {
-      const parsed = parseOptions(args, ["--after", "--limit"]);
+      const parsed = parseOptions(args, ["--after", "--limit", "--view"]);
       const [roomId] = exactPositionals(parsed, 1, "room history");
       const params = { room_id: roomId };
       if (parsed.values["--after"] !== void 0) params.after = parseInteger(parsed.values["--after"], "--after", 0);
       if (parsed.values["--limit"] !== void 0) params.limit = parseInteger(parsed.values["--limit"], "--limit", 1);
+      const view = parsed.values["--view"];
+      if (view !== void 0) {
+        if (view !== "operator" && view !== "participant") usageError("--view must be operator or participant");
+        params.view = view;
+      }
       return { method: "room.history", params };
     }
     case "message": {
@@ -4550,8 +5188,8 @@ function rpcCall(socketPath, method, params, timeoutMs = RPC_TIMEOUT_MS) {
     socket.on("data", (chunk) => {
       if (settled) return;
       size += Buffer.byteLength(chunk, "utf8");
-      if (size > MAX_RESPONSE_BYTES) {
-        finishError(new CliError(EXIT.internal, "internal", "daemon response exceeded 1 MiB"));
+      if (size > MAX_MANAGEMENT_RESPONSE_BYTES) {
+        finishError(new CliError(EXIT.internal, "internal", "daemon response exceeded 4 MiB"));
         return;
       }
       bytes += chunk;
@@ -4687,13 +5325,11 @@ function httpGetReady(url, timeoutMs) {
       if (deadline) clearTimeout(deadline);
       deadline = void 0;
       request.removeListener("response", onResponse);
-      request.removeListener("error", onRequestError);
       request.removeListener("timeout", onRequestTimeout);
       request.removeListener("close", onRequestClose);
       request.setTimeout(0);
       if (response) {
         response.removeListener("end", onResponseEnd);
-        response.removeListener("error", onResponseError);
         response.removeListener("aborted", onResponseAborted);
         response.removeListener("close", onResponseClose);
         if (!response.destroyed) response.destroy();
@@ -4717,14 +5353,14 @@ function httpGetReady(url, timeoutMs) {
       }
       response = incoming;
       incoming.once("end", onResponseEnd);
-      incoming.once("error", onResponseError);
+      incoming.on("error", onResponseError);
       incoming.once("aborted", onResponseAborted);
       incoming.once("close", onResponseClose);
       incoming.resume();
     };
     const request = http.get(url);
     request.once("response", onResponse);
-    request.once("error", onRequestError);
+    request.on("error", onRequestError);
     request.once("timeout", onRequestTimeout);
     request.once("close", onRequestClose);
     request.setTimeout(timeoutMs);
@@ -4940,6 +5576,35 @@ function readDocs(topic) {
     throw new CliError(EXIT.internal, "internal", `offline documentation is missing: ${file}`, { cause: error });
   }
 }
+async function readHistoryPages(socketPath, params) {
+  const requested = typeof params.limit === "number" ? params.limit : Number.MAX_SAFE_INTEGER;
+  let after = typeof params.after === "number" ? params.after : 0;
+  const records = [];
+  while (records.length < requested) {
+    const remaining = requested - records.length;
+    const pageParams = { ...params, after, ...remaining < Number.MAX_SAFE_INTEGER ? { limit: remaining } : {} };
+    const page = await rpcCall(
+      socketPath,
+      "room.history",
+      pageParams,
+      rpcTimeoutForMethod("room.history")
+    );
+    if (!Array.isArray(page)) {
+      throw new CliError(EXIT.internal, "internal", "daemon returned an invalid history page");
+    }
+    if (page.length === 0) break;
+    for (const record of page) {
+      const seq = record !== null && typeof record === "object" ? record.seq : void 0;
+      if (typeof seq !== "number" || !Number.isSafeInteger(seq) || seq <= after) {
+        throw new CliError(EXIT.internal, "internal", "daemon returned a non-progressing history page");
+      }
+      after = seq;
+      records.push(record);
+      if (records.length === requested) break;
+    }
+  }
+  return records;
+}
 async function execute(args, output) {
   const command = args[0] ?? "help";
   if (command === "help" || command === "--help" || command === "-h") {
@@ -4956,8 +5621,9 @@ async function execute(args, output) {
   if (command === "room") {
     const request = roomRequest(args[1], args.slice(2));
     const config2 = loadCliConfig();
-    const result = await rpcCall(
-      join2(config2.stateDir, "management.sock"),
+    const socketPath = join2(config2.stateDir, "management.sock");
+    const result = request.method === "room.history" ? await readHistoryPages(socketPath, request.params) : await rpcCall(
+      socketPath,
       request.method,
       request.params,
       rpcTimeoutForMethod(request.method)