@ours.network/cowork 0.2.0 → 0.3.1

package/dist/daemon.js

@@ -4767,6 +4767,615 @@ var init_config = __esm({
   }
 });
 
+// src/contracts.ts
+import { createHash } from "node:crypto";
+function utf8Bounded(label, maximumBytes) {
+  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
+    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
+    `${label} must be at most ${maximumBytes} UTF-8 bytes`
+  );
+}
+function isStrictRfc3339(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
+  if (!match) return false;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
+  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
+  if (offsetHour > 23 || offsetMinute > 59) return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day >= 1 && day <= days[month - 1];
+}
+function refineRoomLineage(room, context) {
+  const pendingIdentityName = `cowork-room-${room.room_id}`;
+  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
+  if (room.identity_cid === "" && !exactPacketPending) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["identity_cid"],
+      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+    });
+  }
+  if (room.identity_cid !== "" && room.status === "packet_pending") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: "packet_pending status requires an empty identity_cid"
+    });
+  }
+  const pendingByRecovery = /* @__PURE__ */ new Map();
+  for (const [index, invite] of room.invites.entries()) {
+    if (invite.recovery_of === void 0) continue;
+    const recoveryOf = invite.recovery_of;
+    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
+    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
+    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index, "recovery_of"],
+        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+      });
+    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index],
+        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+      });
+    }
+    if (invite.state === "receipt_pending") {
+      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
+      pendingByRecovery.set(recoveryOf, count);
+      if (count > 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invites", index, "recovery_of"],
+          message: "only one receipt_pending invite may exist per recovery_of pointer"
+        });
+      }
+    }
+  }
+}
+function migrateRoomV1(room, mintParticipantId) {
+  return RoomSchema.parse({
+    ...room,
+    version: 2,
+    mission: { ...room.mission, briefing_version: 1 },
+    role_briefings: {},
+    anonymous: false,
+    quiet_membership: false,
+    membership_epoch: 0,
+    seats: room.seats.map((seat) => ({
+      ...seat,
+      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
+      state: "active"
+    }))
+  });
+}
+function refineRelaySubject(record, context) {
+  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
+  if (record.message_id === void 0 === (record.file_id === void 0)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["message_id"],
+      message: "relay records require exactly one of message_id or file_id"
+    });
+  }
+}
+function refineFileRecord(record, context) {
+  if (record.kind !== "file" || record.data_base64 === void 0) return;
+  const bytes = Buffer.from(record.data_base64, "base64");
+  if (bytes.toString("base64") !== record.data_base64) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
+  }
+  if (bytes.length !== record.size) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
+  }
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== record.sha256) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
+  }
+}
+function refineMessageCategory(message, context) {
+  const requires = (field, present) => {
+    if (present && message[field] === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${message.category} messages require ${field}`
+      });
+    }
+    if (!present && message[field] !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${field} is forbidden on ${message.category} messages`
+      });
+    }
+  };
+  requires("briefing_role", message.category === "role_briefing");
+  requires("membership", message.category === "membership");
+  if (message.category === "role_briefing" && message.briefing_version === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["briefing_version"],
+      message: "role_briefing messages require briefing_version"
+    });
+  }
+  if (message.category === "chat" || message.category === "membership") {
+    if (message.briefing_version !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["briefing_version"],
+        message: `briefing_version is forbidden on ${message.category} messages`
+      });
+    }
+  }
+}
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoleSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var init_contracts = __esm({
+  "src/contracts.ts"() {
+    "use strict";
+    init_zod();
+    MAX_TEXT_BYTES = 262144;
+    MAX_FILE_BYTES = 2 * 1024 * 1024;
+    MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
+    MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
+    MAX_FILE_NAME_BYTES = 255;
+    MAX_MIME_BYTES = 255;
+    MAX_ROLE_BYTES = 256;
+    NonEmptyStringSchema = external_exports.string().min(1);
+    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
+    LowerCrockfordUlidSchema = external_exports.string().regex(
+      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+      "must be a 26-character lowercase Crockford ULID"
+    );
+    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
+    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
+    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
+    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
+    FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
+    FileMimeSchema = external_exports.string().refine(
+      (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
+      `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
+    );
+    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
+    SeatStateSchema = external_exports.enum(["active", "removed"]);
+    InviteModeSchema = external_exports.enum(["one_time", "public"]);
+    DEFAULT_ROLE = "Participant";
+    InviteStateSchema = external_exports.enum([
+      "live",
+      "consumed",
+      "revoked",
+      "replacement_required",
+      "receipt_pending"
+    ]);
+    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
+    SeatV1Schema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema
+    }).strict();
+    SeatSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema,
+      participant_id: LowerCrockfordUlidSchema,
+      state: SeatStateSchema,
+      alias: NonEmptyStringSchema.optional(),
+      removed_at: Rfc3339Schema.optional(),
+      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional(),
+      bounced_at: Rfc3339Schema.optional()
+    }).strict().superRefine((seat, context) => {
+      if (seat.state === "removed") {
+        if (seat.removed_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_at"],
+            message: "removed seats require removed_at"
+          });
+        }
+        if (seat.removed_epoch === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_epoch"],
+            message: "removed seats require removed_epoch"
+          });
+        }
+      } else {
+        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [field],
+              message: `${field} is reserved for removed seats`
+            });
+          }
+        }
+      }
+    });
+    RoomInviteSchema = external_exports.object({
+      invite_id: NonEmptyStringSchema,
+      mode: InviteModeSchema,
+      role: RoleSchema,
+      min_accepts: PositiveSafeIntegerSchema,
+      accepted_cids: external_exports.array(NonEmptyStringSchema),
+      state: InviteStateSchema,
+      recovery_of: NonEmptyStringSchema.optional(),
+      recovery_confirmed: external_exports.boolean().optional(),
+      created_at: Rfc3339Schema,
+      replaces_seat: LowerCrockfordUlidSchema.optional()
+    }).strict().superRefine((invite, context) => {
+      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["min_accepts"],
+          message: "one_time invites require min_accepts === 1"
+        });
+      }
+      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_of"],
+          message: "receipt_pending invites require recovery_of"
+        });
+      }
+      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is forbidden without recovery_of"
+        });
+      }
+      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is required with recovery_of"
+        });
+      }
+      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "receipt_pending recovery lineage must be unconfirmed"
+        });
+      }
+      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
+        });
+      }
+      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["accepted_cids"],
+          message: "receipt_pending invites cannot have accepted CIDs"
+        });
+      }
+    });
+    MissionV1Schema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema
+    }).strict();
+    MissionSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      briefing_version: PositiveSafeIntegerSchema
+    }).strict();
+    RoleBriefingSchema = external_exports.object({
+      text: MissionTextSchema,
+      version: PositiveSafeIntegerSchema,
+      updated_at: Rfc3339Schema
+    }).strict();
+    RoomCommonShape = {
+      room_id: LowerCrockfordUlidSchema,
+      identity_name: NonEmptyStringSchema,
+      identity_cid: external_exports.string(),
+      state: RoomStateSchema,
+      status: NonEmptyStringSchema.optional(),
+      invites: external_exports.array(RoomInviteSchema),
+      created_at: Rfc3339Schema,
+      activated_at: Rfc3339Schema.optional(),
+      closed_at: Rfc3339Schema.optional()
+    };
+    RoomV1Schema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(1),
+      mission: MissionV1Schema,
+      seats: external_exports.array(SeatV1Schema)
+    }).strict().superRefine(refineRoomLineage);
+    RoomSchema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(2),
+      mission: MissionSchema,
+      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
+      anonymous: external_exports.boolean(),
+      quiet_membership: external_exports.boolean(),
+      membership_epoch: external_exports.number().int().nonnegative().safe(),
+      seats: external_exports.array(SeatSchema)
+    }).strict().superRefine((room, context) => {
+      refineRoomLineage(room, context);
+      const byParticipant = /* @__PURE__ */ new Map();
+      const activeAliases = /* @__PURE__ */ new Set();
+      for (const [index, seat] of room.seats.entries()) {
+        if (byParticipant.has(seat.participant_id)) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "participant_id"],
+            message: "participant_id must be unique within the room"
+          });
+        }
+        byParticipant.set(seat.participant_id, seat);
+        if (room.anonymous && seat.alias === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "anonymous rooms require an alias on every seat"
+          });
+        }
+        if (!room.anonymous && seat.alias !== void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "aliases are reserved for anonymous rooms"
+          });
+        }
+        if (seat.state === "active" && seat.alias !== void 0) {
+          if (activeAliases.has(seat.alias)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["seats", index, "alias"],
+              message: "active seats must hold distinct aliases"
+            });
+          }
+          activeAliases.add(seat.alias);
+        }
+        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "removed_epoch"],
+            message: "removed_epoch cannot exceed the room membership_epoch"
+          });
+        }
+      }
+      for (const [index, seat] of room.seats.entries()) {
+        if (seat.replaces_seat === void 0) continue;
+        const predecessor = byParticipant.get(seat.replaces_seat);
+        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "replaces_seat"],
+            message: "replaces_seat must reference a removed seat in this room"
+          });
+          continue;
+        }
+        if (predecessor.role !== seat.role) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "role"],
+            message: "a replacement seat must inherit the predecessor role"
+          });
+        }
+        if (room.anonymous && seat.alias !== predecessor.alias) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "an anonymous replacement seat must inherit the predecessor alias"
+          });
+        }
+      }
+    });
+    CreateRoomInputSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      anonymous: external_exports.boolean().optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict();
+    UpdateRoomInputSchema = external_exports.object({
+      goal: MissionTextSchema.optional(),
+      briefing: MissionTextSchema.optional(),
+      status: NonEmptyStringSchema.optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
+    RoleBriefingSetInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MissionTextSchema
+    }).strict();
+    RoleBriefingDeleteInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
+    PostMessageInputSchema = external_exports.object({
+      text: MessageTextSchema
+    }).strict();
+    AuthorSnapshotSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema
+    }).strict();
+    RecordCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      seq: PositiveSafeIntegerSchema,
+      record_id: NonEmptyStringSchema,
+      at: Rfc3339Schema
+    };
+    AppendCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      at: Rfc3339Schema
+    };
+    MembershipNoticeSchema = external_exports.object({
+      action: external_exports.enum(["remove"]),
+      alias: NonEmptyStringSchema.optional(),
+      role: RoleSchema.optional(),
+      epoch: external_exports.number().int().nonnegative().safe()
+    }).strict();
+    AuthorAliasSchema = external_exports.object({
+      participant_id: LowerCrockfordUlidSchema,
+      alias: NonEmptyStringSchema
+    }).strict();
+    MessageShape = {
+      kind: external_exports.literal("message"),
+      message_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+      briefing_role: RoleSchema.optional(),
+      briefing_version: PositiveSafeIntegerSchema.optional(),
+      membership: MembershipNoticeSchema.optional(),
+      text: MessageTextSchema,
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
+          }
+          seen.add(identity);
+        }
+      }),
+      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+      source_wire_id: NonEmptyStringSchema.optional()
+    };
+    RelayIntentShape = {
+      kind: external_exports.literal("relay_intent"),
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema
+    };
+    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+    RelayResultShape = {
+      kind: external_exports.literal("relay_result"),
+      intent_record_id: NonEmptyStringSchema,
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayResultStatusSchema,
+      wire_id: NonEmptyStringSchema.optional(),
+      metadata_wire_id: NonEmptyStringSchema.optional()
+    };
+    FileShape = {
+      kind: external_exports.literal("file"),
+      file_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      filename: FileNameSchema,
+      mime: FileMimeSchema,
+      size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
+      sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+      data_base64: external_exports.string(),
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
+          }
+          seen.add(identity);
+        }
+      }),
+      source_file_id: external_exports.number().int().nonnegative().safe(),
+      source_wire_id: NonEmptyStringSchema.optional()
+    };
+    MembershipIntentShape = {
+      kind: external_exports.literal("membership_intent"),
+      action: external_exports.enum(["remove"]),
+      participant_id: LowerCrockfordUlidSchema,
+      recipient_identity: NonEmptyStringSchema,
+      role: RoleSchema,
+      alias: NonEmptyStringSchema.optional(),
+      epoch: PositiveSafeIntegerSchema,
+      notify: external_exports.boolean()
+    };
+    MembershipResultShape = {
+      kind: external_exports.literal("membership_result"),
+      intent_record_id: NonEmptyStringSchema,
+      participant_id: LowerCrockfordUlidSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    CloseNoticeIntentShape = {
+      kind: external_exports.literal("close_notice_intent"),
+      recipient_identity: NonEmptyStringSchema
+    };
+    CloseNoticeResultShape = {
+      kind: external_exports.literal("close_notice_result"),
+      intent_record_id: NonEmptyStringSchema,
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
+    FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
+    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
+    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
+    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
+    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
+    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
+    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
+      MessageRecordSchema,
+      FileRecordSchema,
+      RelayIntentRecordSchema,
+      RelayResultRecordSchema,
+      MembershipIntentRecordSchema,
+      MembershipResultRecordSchema,
+      CloseNoticeIntentRecordSchema,
+      CloseNoticeResultRecordSchema
+    ]);
+    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
+      if (record.record_id !== `${record.room_id}:${record.seq}`) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["record_id"],
+          message: 'record_id must equal room_id + ":" + seq'
+        });
+      }
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
+    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
+    ]).superRefine((record, context) => {
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
+  }
+});
+
 // src/packets.ts
 import { randomBytes } from "node:crypto";
 import * as nodeFs2 from "node:fs";
@@ -4831,6 +5440,26 @@ function renderInbox(value) {
   }
   return output;
 }
+function renderFileInbox(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const file = value.Reduce(index);
+    if (file.IsNil()) break;
+    output.push({
+      file_id: Number(file.Reduce("file_id").Visualize()),
+      sender_id: file.Reduce("sender_id").Visualize(),
+      sender_name: file.Reduce("sender_name").Visualize(),
+      filename: file.Reduce("filename").Visualize(),
+      mime: file.Reduce("mime").Visualize(),
+      data: Buffer.from(file.Reduce("data").GetBinary()),
+      date: adaptTimeToRfc3339(file.Reduce("date").Visualize()),
+      status: file.Reduce("status").Visualize(),
+      wire_id: file.Reduce("wire_id").Visualize()
+    });
+  }
+  return output;
+}
 function renderIntegerArray(value) {
   const output = [];
   if (value.IsNil()) return output;
@@ -4924,6 +5553,7 @@ var init_packets = __esm({
   async "src/packets.ts"() {
     "use strict";
     await init_adapt();
+    init_contracts();
     PacketPersistenceError = class extends Error {
       constructor(message, options) {
         super(message, options);
@@ -5420,354 +6050,136 @@ var init_packets = __esm({
           };
         });
       }
-      async send(contactCid, body) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx(
-            "::a2a_messaging::send_message",
-            { contact: contactCid, text: body },
-            lifetime
-          );
-          const refused = !result.Reduce("downgrade_refused").IsNil();
-          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
-        });
+      peekFileInbox() {
+        return withScope((lifetime) => renderFileInbox(
+          this.packet.readonlyTx("::actor::list_incoming_files", lifetime)
+        ).filter((file) => file.status === "unread").map(({ status: _status, ...file }) => file));
       }
-      async removeContact(contactCid) {
+      async consumeFileInbox(expectedIds) {
         return withScopeAsync(async (lifetime) => {
           const result = await this.packet.mutatingTx(
-            "::a2a_messaging::remove_contact",
-            { contact: contactCid },
+            "::actor::consume_files",
+            { expected_ids: expectedIds },
             lifetime
           );
-          const notified = strictBooleanValue(result.Reduce("notified"), "remove_contact notified");
-          const keyMaterialRetained = strictBooleanValue(
-            result.Reduce("key_material_retained"),
-            "remove_contact key_material_retained"
-          );
-          if (!keyMaterialRetained) {
-            throw new Error("remove_contact key_material_retained must be true");
-          }
           return {
-            status: notified ? "queued" : "send_failed",
-            notified,
-            key_material_retained: true
+            consumed: renderIntegerArray(result.Reduce("consumed")),
+            deferred: renderIntegerArray(result.Reduce("deferred"))
           };
         });
       }
-      async sign(canonicalJson2) {
+      async send(contactCid, body) {
         return withScopeAsync(async (lifetime) => {
           const result = await this.packet.mutatingTx(
-            "::actor::sign_app_envelope",
-            { canonical_json: canonicalJson2 },
-            lifetime
-          );
-          return Buffer.from(result.Reduce("signature").GetBinary()).toString("base64url");
-        });
-      }
-    };
-  }
-});
-
-// src/contracts.ts
-function utf8Bounded(label, maximumBytes) {
-  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
-    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
-    `${label} must be at most ${maximumBytes} UTF-8 bytes`
-  );
-}
-function isStrictRfc3339(value) {
-  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
-  if (!match) return false;
-  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = Number(secondText);
-  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
-  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
-  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
-  if (offsetHour > 23 || offsetMinute > 59) return false;
-  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  return day >= 1 && day <= days[month - 1];
-}
-var MAX_TEXT_BYTES, MAX_ROLE_BYTES, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoleSchema, MissionTextSchema, MessageTextSchema, RoomStateSchema, InviteModeSchema, InviteStateSchema, RelayStatusSchema, SeatSchema, RoomInviteSchema, MissionSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, PostMessageInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MessageShape, RelayIntentShape, RelayResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
-var init_contracts = __esm({
-  "src/contracts.ts"() {
-    "use strict";
-    init_zod();
-    MAX_TEXT_BYTES = 262144;
-    MAX_ROLE_BYTES = 256;
-    NonEmptyStringSchema = external_exports.string().min(1);
-    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
-    LowerCrockfordUlidSchema = external_exports.string().regex(
-      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
-      "must be a 26-character lowercase Crockford ULID"
-    );
-    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
-    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
-    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
-    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
-    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
-    InviteModeSchema = external_exports.enum(["one_time", "public"]);
-    InviteStateSchema = external_exports.enum([
-      "live",
-      "consumed",
-      "revoked",
-      "replacement_required",
-      "receipt_pending"
-    ]);
-    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
-    SeatSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema
-    }).strict();
-    RoomInviteSchema = external_exports.object({
-      invite_id: NonEmptyStringSchema,
-      mode: InviteModeSchema,
-      role: RoleSchema,
-      min_accepts: PositiveSafeIntegerSchema,
-      accepted_cids: external_exports.array(NonEmptyStringSchema),
-      state: InviteStateSchema,
-      recovery_of: NonEmptyStringSchema.optional(),
-      recovery_confirmed: external_exports.boolean().optional(),
-      created_at: Rfc3339Schema
-    }).strict().superRefine((invite, context) => {
-      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["min_accepts"],
-          message: "one_time invites require min_accepts === 1"
-        });
-      }
-      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_of"],
-          message: "receipt_pending invites require recovery_of"
-        });
-      }
-      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is forbidden without recovery_of"
-        });
-      }
-      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is required with recovery_of"
-        });
-      }
-      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "receipt_pending recovery lineage must be unconfirmed"
-        });
-      }
-      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
-        });
-      }
-      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["accepted_cids"],
-          message: "receipt_pending invites cannot have accepted CIDs"
-        });
-      }
-    });
-    MissionSchema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema
-    }).strict();
-    RoomSchema = external_exports.object({
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      identity_name: NonEmptyStringSchema,
-      identity_cid: external_exports.string(),
-      mission: MissionSchema,
-      state: RoomStateSchema,
-      status: NonEmptyStringSchema.optional(),
-      invites: external_exports.array(RoomInviteSchema),
-      seats: external_exports.array(SeatSchema),
-      created_at: Rfc3339Schema,
-      activated_at: Rfc3339Schema.optional(),
-      closed_at: Rfc3339Schema.optional()
-    }).strict().superRefine((room, context) => {
-      const pendingIdentityName = `cowork-room-${room.room_id}`;
-      const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
-      if (room.identity_cid === "" && !exactPacketPending) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["identity_cid"],
-          message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+            "::a2a_messaging::send_message",
+            { contact: contactCid, text: body },
+            lifetime
+          );
+          const refused = !result.Reduce("downgrade_refused").IsNil();
+          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
         });
       }
-      if (room.identity_cid !== "" && room.status === "packet_pending") {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["status"],
-          message: "packet_pending status requires an empty identity_cid"
+      async sendFile(contactCid, filename, mime, data) {
+        const validName = FileNameSchema.parse(filename);
+        const validMime = FileMimeSchema.parse(mime);
+        if (data.length > MAX_FILE_BYTES) {
+          throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
+        }
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::send_file",
+            {
+              contact: contactCid,
+              filename: validName,
+              mime: validMime,
+              // The core contract takes bytes. A filesystem path here would make
+              // recovery depend on staging ownership and is deliberately forbidden.
+              data: this.packet.newBinary(data, lifetime)
+            },
+            lifetime
+          );
+          const refused = !result.Reduce("downgrade_refused").IsNil() || !result.Reduce("migrating").IsNil();
+          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
         });
       }
-      const pendingByRecovery = /* @__PURE__ */ new Map();
-      for (const [index, invite] of room.invites.entries()) {
-        if (invite.recovery_of === void 0) continue;
-        const recoveryOf = invite.recovery_of;
-        const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
-        const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
-        if (!source || source.invite_id === invite.invite_id || !validSourceState) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["invites", index, "recovery_of"],
-            message: "recovery_of must point to a source invite in the state required by this recovery lineage"
-          });
-        } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["invites", index],
-            message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
-          });
-        }
-        if (invite.state === "receipt_pending") {
-          const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
-          pendingByRecovery.set(recoveryOf, count);
-          if (count > 1) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: ["invites", index, "recovery_of"],
-              message: "only one receipt_pending invite may exist per recovery_of pointer"
-            });
+      async removeContact(contactCid) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::remove_contact",
+            { contact: contactCid },
+            lifetime
+          );
+          const notified = strictBooleanValue(result.Reduce("notified"), "remove_contact notified");
+          const keyMaterialRetained = strictBooleanValue(
+            result.Reduce("key_material_retained"),
+            "remove_contact key_material_retained"
+          );
+          if (!keyMaterialRetained) {
+            throw new Error("remove_contact key_material_retained must be true");
           }
-        }
+          return {
+            status: notified ? "queued" : "send_failed",
+            notified,
+            key_material_retained: true
+          };
+        });
       }
-    });
-    CreateRoomInputSchema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema
-    }).strict();
-    UpdateRoomInputSchema = external_exports.object({
-      goal: MissionTextSchema.optional(),
-      briefing: MissionTextSchema.optional(),
-      status: NonEmptyStringSchema.optional()
-    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
-    PostMessageInputSchema = external_exports.object({
-      text: MessageTextSchema
-    }).strict();
-    AuthorSnapshotSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema
-    }).strict();
-    RecordCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      seq: PositiveSafeIntegerSchema,
-      record_id: NonEmptyStringSchema,
-      at: Rfc3339Schema
-    };
-    AppendCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      at: Rfc3339Schema
-    };
-    MessageShape = {
-      kind: external_exports.literal("message"),
-      message_id: LowerCrockfordUlidSchema,
-      author: AuthorSnapshotSchema,
-      category: external_exports.enum(["briefing", "chat"]),
-      text: MessageTextSchema,
-      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, identity] of identities.entries()) {
-          if (seen.has(identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "recipient identities must be unique"
-            });
-          }
-          seen.add(identity);
-        }
-      }),
-      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
-      source_wire_id: NonEmptyStringSchema.optional()
-    };
-    RelayIntentShape = {
-      kind: external_exports.literal("relay_intent"),
-      message_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema
-    };
-    RelayResultShape = {
-      kind: external_exports.literal("relay_result"),
-      intent_record_id: NonEmptyStringSchema,
-      message_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayStatusSchema,
-      wire_id: NonEmptyStringSchema.optional()
-    };
-    CloseNoticeIntentShape = {
-      kind: external_exports.literal("close_notice_intent"),
-      recipient_identity: NonEmptyStringSchema
-    };
-    CloseNoticeResultShape = {
-      kind: external_exports.literal("close_notice_result"),
-      intent_record_id: NonEmptyStringSchema,
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
-    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
-    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
-    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
-    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
-    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
-      MessageRecordSchema,
-      RelayIntentRecordSchema,
-      RelayResultRecordSchema,
-      CloseNoticeIntentRecordSchema,
-      CloseNoticeResultRecordSchema
-    ]);
-    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
-      if (record.record_id !== `${record.room_id}:${record.seq}`) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["record_id"],
-          message: 'record_id must equal room_id + ":" + seq'
+      async sign(canonicalJson2) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::sign_app_envelope",
+            { canonical_json: canonicalJson2 },
+            lifetime
+          );
+          return Buffer.from(result.Reduce("signature").GetBinary()).toString("base64url");
         });
       }
-    });
-    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
-    ]);
+    };
   }
 });
 
-// src/intake.ts
+// src/ulid.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
+function generateUlid() {
+  let time = Date.now();
+  const output = new Array(26);
+  for (let index = 9; index >= 0; index -= 1) {
+    output[index] = CROCKFORD[time % 32];
+    time = Math.floor(time / 32);
+  }
+  const entropy = randomBytes2(10);
+  let bits = 0;
+  let value = 0;
+  let byteIndex = 0;
+  for (let index = 10; index < 26; index += 1) {
+    while (bits < 5) {
+      value = value << 8 | entropy[byteIndex++];
+      bits += 8;
+    }
+    bits -= 5;
+    output[index] = CROCKFORD[value >>> bits & 31];
+  }
+  return output.join("");
+}
+var CROCKFORD;
+var init_ulid = __esm({
+  "src/ulid.ts"() {
+    "use strict";
+    CROCKFORD = "0123456789abcdefghjkmnpqrstvwxyz";
+  }
+});
+
+// src/intake.ts
+import { createHash as createHash2 } from "node:crypto";
 function canonicalJson(value) {
   const encoded = JSON.stringify(canonicalValue(value));
   if (encoded === void 0) throw new TypeError("canonical JSON value is not serializable");
   return encoded;
 }
+async function sendSignedBody(packet, recipientIdentity, unsigned) {
+  const signature = await packet.sign(canonicalJson(unsigned));
+  return packet.send(recipientIdentity, canonicalJson({ ...unsigned, signature }));
+}
 function canonicalValue(value) {
   if (Array.isArray(value)) return value.map(canonicalValue);
   if (value !== null && typeof value === "object") {
@@ -5783,34 +6195,25 @@ function canonicalValue(value) {
 function unique(values) {
   return [...new Set(values)];
 }
-function generateUlid() {
-  let time = Date.now();
-  const output = new Array(26);
-  for (let index = 9; index >= 0; index -= 1) {
-    output[index] = CROCKFORD[time % 32];
-    time = Math.floor(time / 32);
-  }
-  const entropy = randomBytes2(10);
-  let bits = 0;
-  let value = 0;
-  let byteIndex = 0;
-  for (let index = 10; index < 26; index += 1) {
-    while (bits < 5) {
-      value = value << 8 | entropy[byteIndex++];
-      bits += 8;
-    }
-    bits -= 5;
-    output[index] = CROCKFORD[value >>> bits & 31];
+function wireKind(category) {
+  switch (category) {
+    case "briefing":
+      return "room_briefing";
+    case "role_briefing":
+      return "room_role_briefing";
+    case "membership":
+      return "room_membership";
+    default:
+      return "room_msg";
   }
-  return output.join("");
 }
-var CROCKFORD, IntakePump;
+var IntakePump;
 var init_intake = __esm({
   "src/intake.ts"() {
     "use strict";
     init_zod();
     init_contracts();
-    CROCKFORD = "0123456789abcdefghjkmnpqrstvwxyz";
+    init_ulid();
     IntakePump = class {
       store;
       packets;
@@ -5890,20 +6293,72 @@ var init_intake = __esm({
       async processAndRelayUnlocked(roomId, packet) {
         const snapshot = packet.peekInbox();
         for (const item of snapshot) await this.processInboxItem(roomId, packet, item);
+        const fileSnapshot = packet.peekFileInbox();
+        for (const item of fileSnapshot) await this.processFileInboxItem(roomId, packet, item);
         await this.completeSnapshotIntents(roomId);
         await this.relayPendingUnlocked(roomId, packet);
       }
+      async processFileInboxItem(roomId, packet, item) {
+        const parsedName = FileNameSchema.safeParse(item.filename);
+        const parsedMime = FileMimeSchema.safeParse(item.mime);
+        if (!parsedName.success || !parsedMime.success) {
+          await packet.consumeFileInbox([item.file_id]);
+          return;
+        }
+        if (item.data.length > MAX_FILE_BYTES) {
+          throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
+        }
+        const room = await this.store.load(roomId);
+        const seat = room.seats.find(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
+        );
+        if (room.state !== "active" || !seat) {
+          if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
+          await packet.consumeFileInbox([item.file_id]);
+          return;
+        }
+        const records = await this.store.read(roomId);
+        let file = this.findSourceFile(records, item);
+        if (!file) {
+          const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
+          const bytes = Buffer.from(item.data);
+          const appended = await this.store.append(roomId, {
+            version: 1,
+            kind: "file",
+            room_id: roomId,
+            at: Rfc3339Schema.parse(item.date),
+            file_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+            author: { identity: seat.identity, display_name: seat.display_name, role: seat.role },
+            ...room.anonymous && seat.alias !== void 0 ? { author_alias: { participant_id: seat.participant_id, alias: seat.alias } } : {},
+            filename: parsedName.data,
+            mime: parsedMime.data,
+            size: bytes.length,
+            sha256: createHash2("sha256").update(bytes).digest("hex"),
+            data_base64: bytes.toString("base64"),
+            recipient_identities: recipientIdentities,
+            source_file_id: item.file_id,
+            ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id }
+          });
+          if (appended.kind !== "file") throw new Error("storage returned the wrong participant file kind");
+          file = appended;
+        }
+        await this.completeFileIntents(roomId, file);
+        await packet.consumeFileInbox([item.file_id]);
+      }
       async processInboxItem(roomId, packet, item) {
         const room = await this.store.load(roomId);
-        const seat = room.seats.find((candidate) => candidate.identity === item.sender_id);
+        const seat = room.seats.find(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
+        );
         if (room.state !== "active" || !seat) {
+          if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
           await packet.consumeInbox([item.msg_id]);
           return;
         }
         const before = await this.store.read(roomId);
         let message = this.findSourceMessage(before, item);
         if (!message) {
-          const recipientIdentities = unique(room.seats.map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
+          const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
           const appended = await this.store.append(roomId, {
             version: 1,
             kind: "message",
@@ -5915,6 +6370,9 @@ var init_intake = __esm({
               display_name: seat.display_name,
               role: seat.role
             },
+            // In an anonymous room the archive keeps both identities (INV-R4);
+            // the relay pump substitutes the alias into every outbound body.
+            ...room.anonymous && seat.alias !== void 0 ? { author_alias: { participant_id: seat.participant_id, alias: seat.alias } } : {},
             category: "chat",
             text: item.text,
             recipient_identities: recipientIdentities,
@@ -5927,11 +6385,51 @@ var init_intake = __esm({
         await this.completeMessageIntents(roomId, message);
         await packet.consumeInbox([item.msg_id]);
       }
+      /**
+       * One content-free self-assertion per removed seat (spec §5.2, OC-8), so a
+       * healthy ex-client stops sending. The durable bounced_at mark precedes the
+       * best-effort send: at-most-once, and a hostile peer gets nothing further.
+       */
+      async bounceRemovedSender(roomId, room, packet, item) {
+        const removed = room.seats.find(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "removed"
+        );
+        if (!removed || removed.bounced_at !== void 0) return;
+        if (room.seats.some(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
+        )) return;
+        const seats = room.seats.map((candidate) => candidate.participant_id === removed.participant_id ? { ...candidate, bounced_at: this.now() } : candidate);
+        await this.store.save(RoomSchema.parse({ ...room, seats }));
+        try {
+          const unsigned = { version: 1, kind: "room_not_member", room_id: roomId };
+          await sendSignedBody(packet, item.sender_id, unsigned);
+        } catch {
+        }
+      }
       async completeSnapshotIntents(roomId) {
         const records = await this.store.read(roomId);
         for (const message of records.filter(
           (record) => record.kind === "message"
         )) await this.completeMessageIntents(roomId, message);
+        for (const file of records.filter(
+          (record) => record.kind === "file"
+        )) await this.completeFileIntents(roomId, file);
+      }
+      async completeFileIntents(roomId, file) {
+        const records = await this.store.read(roomId);
+        const intended = new Set(records.filter((record) => record.kind === "relay_intent" && record.file_id === file.file_id).map((intent) => intent.recipient_identity));
+        for (const recipientIdentity of file.recipient_identities) {
+          if (intended.has(recipientIdentity)) continue;
+          await this.store.append(roomId, {
+            version: 1,
+            kind: "relay_intent",
+            room_id: roomId,
+            at: this.now(),
+            file_id: file.file_id,
+            recipient_identity: recipientIdentity
+          });
+          intended.add(recipientIdentity);
+        }
       }
       async completeMessageIntents(roomId, message) {
         const records = await this.store.read(roomId);
@@ -5951,27 +6449,110 @@ var init_intake = __esm({
       }
       async relayPendingUnlocked(roomId, packet) {
         const records = await this.store.read(roomId);
+        const room = await this.store.load(roomId);
+        const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
+        const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
         const messages = new Map(records.filter((record) => record.kind === "message").map((message) => [message.message_id, message]));
+        const files = new Map(records.filter((record) => record.kind === "file").map((file) => [file.file_id, file]));
         const completed = new Set(records.filter((record) => record.kind === "relay_result").map((result) => result.kind === "relay_result" ? result.intent_record_id : ""));
         for (const intent of records.filter(
           (record) => record.kind === "relay_intent"
         )) {
           if (completed.has(intent.record_id)) continue;
-          const message = messages.get(intent.message_id);
-          if (!message) continue;
-          if (!message.recipient_identities.includes(intent.recipient_identity)) continue;
+          const message = intent.message_id === void 0 ? void 0 : messages.get(intent.message_id);
+          const file = intent.file_id === void 0 ? void 0 : files.get(intent.file_id);
+          if (message === void 0 === (file === void 0)) continue;
+          const recipients = message?.recipient_identities ?? file.recipient_identities;
+          if (!recipients.includes(intent.recipient_identity)) continue;
+          if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
+            const skipped = await this.store.append(roomId, {
+              version: 1,
+              kind: "relay_result",
+              room_id: roomId,
+              at: this.now(),
+              intent_record_id: intent.record_id,
+              ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
+              ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
+              recipient_identity: intent.recipient_identity,
+              status: "skipped_removed"
+            });
+            if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+            completed.add(intent.record_id);
+            continue;
+          }
+          if (file !== void 0) {
+            const author = file.author_alias === void 0 ? file.author : {
+              identity: file.author_alias.participant_id,
+              display_name: file.author_alias.alias,
+              role: file.author.role
+            };
+            const metadata = await sendSignedBody(packet, intent.recipient_identity, {
+              version: 1,
+              kind: "room_file",
+              room_id: roomId,
+              file_id: file.file_id,
+              author,
+              filename: file.filename,
+              mime: file.mime,
+              size: file.size,
+              sha256: file.sha256,
+              at: file.at
+            });
+            if (metadata.status === "send_failed") {
+              const failed = await this.store.append(roomId, {
+                version: 1,
+                kind: "relay_result",
+                room_id: roomId,
+                at: this.now(),
+                intent_record_id: intent.record_id,
+                file_id: file.file_id,
+                recipient_identity: intent.recipient_identity,
+                status: "send_failed"
+              });
+              if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+              completed.add(intent.record_id);
+              continue;
+            }
+            const outcome2 = await packet.sendFile(
+              intent.recipient_identity,
+              file.filename,
+              file.mime,
+              Buffer.from(file.data_base64, "base64")
+            );
+            const appended2 = await this.store.append(roomId, {
+              version: 1,
+              kind: "relay_result",
+              room_id: roomId,
+              at: this.now(),
+              intent_record_id: intent.record_id,
+              file_id: file.file_id,
+              recipient_identity: intent.recipient_identity,
+              status: outcome2.status,
+              ...outcome2.wire_id === void 0 || outcome2.wire_id === "" ? {} : { wire_id: outcome2.wire_id },
+              ...metadata.wire_id === void 0 || metadata.wire_id === "" ? {} : { metadata_wire_id: metadata.wire_id }
+            });
+            if (appended2.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+            completed.add(intent.record_id);
+            continue;
+          }
           const unsigned = {
             version: 1,
-            kind: message.category === "briefing" ? "room_briefing" : "room_msg",
+            kind: wireKind(message.category),
             room_id: roomId,
             message_id: message.message_id,
-            author: message.author,
+            // INV-R3: an anonymous author leaves the archive only in alias form.
+            author: message.author_alias === void 0 ? message.author : {
+              identity: message.author_alias.participant_id,
+              display_name: message.author_alias.alias,
+              role: message.author.role
+            },
             text: message.text,
-            at: message.at
+            at: message.at,
+            ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
+            ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
+            ...message.membership === void 0 ? {} : { membership: message.membership }
           };
-          const signature = await packet.sign(canonicalJson(unsigned));
-          const body = canonicalJson({ ...unsigned, signature });
-          const outcome = await packet.send(intent.recipient_identity, body);
+          const outcome = await sendSignedBody(packet, intent.recipient_identity, unsigned);
           const appended = await this.store.append(roomId, {
             version: 1,
             kind: "relay_result",
@@ -5996,6 +6577,16 @@ var init_intake = __esm({
         }
         return message;
       }
+      findSourceFile(records, item) {
+        const file = records.find((record) => record.kind === "file" && record.source_file_id === item.file_id);
+        if (!file) return void 0;
+        const observedWireId = item.wire_id === "" ? void 0 : item.wire_id;
+        const bytes = Buffer.from(item.data);
+        if (file.source_wire_id !== observedWireId || file.author.identity !== item.sender_id || file.filename !== item.filename || file.mime !== item.mime || file.at !== item.date || file.size !== bytes.length || file.data_base64 !== bytes.toString("base64")) {
+          throw new Error(`file inbox source ${item.file_id} does not match its durable room file`);
+        }
+        return file;
+      }
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
       }
@@ -6012,27 +6603,28 @@ var init_intake = __esm({
 });
 
 // src/service.ts
-import { randomBytes as randomBytes3 } from "node:crypto";
-function generateUlid2() {
-  let time = Date.now();
-  const output = new Array(26);
-  for (let index = 9; index >= 0; index -= 1) {
-    output[index] = CROCKFORD2[time % 32];
-    time = Math.floor(time / 32);
-  }
-  const entropy = randomBytes3(10);
-  let bits = 0;
-  let value = 0;
-  let byteIndex = 0;
-  for (let index = 10; index < 26; index += 1) {
-    while (bits < 5) {
-      value = value << 8 | entropy[byteIndex++];
-      bits += 8;
+function byteBoundedHistoryPage(records) {
+  const page = [];
+  let bytes = 2;
+  for (const record of records) {
+    const encoded = JSON.stringify(record);
+    const nextBytes = Buffer.byteLength(encoded, "utf8") + (page.length === 0 ? 0 : 1);
+    if (bytes + nextBytes > MAX_HISTORY_PAGE_BYTES) {
+      if (page.length === 0) {
+        throw new RangeError(`one history record exceeds the ${MAX_HISTORY_PAGE_BYTES}-byte page contract`);
+      }
+      break;
     }
-    bits -= 5;
-    output[index] = CROCKFORD2[value >>> bits & 31];
+    page.push(record);
+    bytes += nextBytes;
   }
-  return output.join("");
+  return page;
+}
+function activeSeats(room) {
+  return room.seats.filter((seat) => seat.state === "active");
+}
+function mintAlias(seated, role) {
+  return `${role} #${seated.filter((seat) => seat.role === role).length + 1}`;
 }
 function uniqueIdentities(identities) {
   return [...new Set(identities)];
@@ -6040,18 +6632,18 @@ function uniqueIdentities(identities) {
 function currentContactIdentities(packet) {
   return new Set(packet.listContacts().map((contact) => contact.container_id));
 }
-var CROCKFORD2, ROOM_ROLE, CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RoomServiceError, RoomService;
+var ROOM_ROLE, CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
 var init_service = __esm({
   "src/service.ts"() {
     "use strict";
     init_zod();
     init_contracts();
     init_intake();
-    CROCKFORD2 = "0123456789abcdefghjkmnpqrstvwxyz";
+    init_ulid();
     ROOM_ROLE = "room";
     CreateInviteInputSchema = external_exports.object({
       mode: InviteModeSchema,
-      role: RoleSchema,
+      role: RoleSchema.optional(),
       min_accepts: external_exports.number().int().positive().safe()
     }).strict().superRefine((input, context) => {
       if (input.mode === "one_time" && input.min_accepts !== 1) {
@@ -6064,11 +6656,22 @@ var init_service = __esm({
     });
     HistoryOptionsSchema = external_exports.object({
       after: external_exports.number().int().nonnegative().safe().optional(),
-      limit: external_exports.number().int().positive().safe().optional()
+      limit: external_exports.number().int().positive().safe().optional(),
+      view: external_exports.enum(["operator", "participant"]).optional()
     }).strict();
     DeleteRoomInputSchema = external_exports.object({
       confirm: external_exports.literal(true)
     }).strict();
+    RemoveParticipantInputSchema = external_exports.object({
+      participant: external_exports.string().min(1),
+      notify: external_exports.boolean().optional()
+    }).strict();
+    ReplaceParticipantInputSchema = external_exports.object({
+      participant: external_exports.string().min(1),
+      notify: external_exports.boolean().optional(),
+      mode: InviteModeSchema.optional(),
+      min_accepts: external_exports.number().int().positive().safe().optional()
+    }).strict();
     RoomServiceError = class extends Error {
       constructor(message, options) {
         super(message, options);
@@ -6087,8 +6690,8 @@ var init_service = __esm({
         this.store = store;
         this.packets = packets;
         this.nowValue = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-        this.nextRoomId = options.roomId ?? generateUlid2;
-        this.nextMessageId = options.messageId ?? generateUlid2;
+        this.nextRoomId = options.roomId ?? generateUlid;
+        this.nextMessageId = options.messageId ?? generateUlid;
         this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
         });
         this.intake = new IntakePump(store, packets, {
@@ -6102,14 +6705,18 @@ var init_service = __esm({
         const identityName = `cowork-room-${roomId}`;
         return this.lock(roomId, async () => {
           const provisional = RoomSchema.parse({
-            version: 1,
+            version: 2,
             room_id: roomId,
             identity_name: identityName,
             // PacketRegistry needs the durable room directory to exist first. A
             // valid, explicitly provisional value lets startup resume this exact
             // two-resource boundary without claiming a packet CID yet.
             identity_cid: "",
-            mission: { goal: settings.goal, briefing: settings.briefing },
+            mission: { goal: settings.goal, briefing: settings.briefing, briefing_version: 1 },
+            role_briefings: {},
+            anonymous: settings.anonymous ?? false,
+            quiet_membership: settings.quiet_membership ?? false,
+            membership_epoch: 0,
             state: "provisioning",
             status: "packet_pending",
             invites: [],
@@ -6200,18 +6807,73 @@ var init_service = __esm({
       async updateRoom(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const settings = UpdateRoomInputSchema.parse(input);
-        return this.lock(id, async () => {
+        const { room: updated, redelivered } = await this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "update");
+          const briefingChanged = settings.briefing !== void 0 && settings.briefing !== room.mission.briefing;
           const mission = {
             goal: settings.goal ?? room.mission.goal,
-            briefing: settings.briefing ?? room.mission.briefing
+            briefing: settings.briefing ?? room.mission.briefing,
+            briefing_version: briefingChanged ? room.mission.briefing_version + 1 : room.mission.briefing_version
           };
-          return this.store.save(RoomSchema.parse({
+          const next = await this.store.save(RoomSchema.parse({
             ...room,
             mission,
+            ...settings.quiet_membership === void 0 ? {} : { quiet_membership: settings.quiet_membership },
             ...settings.status === void 0 ? {} : { status: settings.status }
           }));
+          if (briefingChanged && next.state === "active") {
+            await this.redeliverCommonBriefing(next);
+            return { room: next, redelivered: true };
+          }
+          return { room: next, redelivered: false };
+        });
+        if (redelivered) await this.intake.resumePending(id);
+        return updated;
+      }
+      /** Author or edit one role's briefing; an edit bumps its version and re-delivers to seats of that role only (spec §3.3). */
+      async setRoleBriefing(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RoleBriefingSetInputSchema.parse(input);
+        const { room: updated, redelivered } = await this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "set a role briefing for");
+          const existing = room.role_briefings[request.role];
+          if (existing && existing.text === request.text) return { room, redelivered: false };
+          const briefing = {
+            text: request.text,
+            version: existing === void 0 ? 1 : existing.version + 1,
+            updated_at: this.now()
+          };
+          const next = await this.store.save(RoomSchema.parse({
+            ...room,
+            role_briefings: { ...room.role_briefings, [request.role]: briefing }
+          }));
+          if (next.state !== "active") return { room: next, redelivered: false };
+          const holders = activeSeats(next).filter((seat) => seat.role === request.role);
+          if (holders.length === 0) return { room: next, redelivered: false };
+          await this.ensureBriefingKind(next, holders, {
+            category: "role_briefing",
+            briefing_role: request.role,
+            text: briefing.text,
+            briefing_version: briefing.version
+          });
+          return { room: next, redelivered: true };
+        });
+        if (redelivered) await this.intake.resumePending(id);
+        return updated;
+      }
+      async deleteRoleBriefing(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RoleBriefingDeleteInputSchema.parse(input);
+        return this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "delete a role briefing for");
+          if (room.role_briefings[request.role] === void 0) {
+            throw new RoomServiceError(`no role briefing exists for "${request.role}" in room "${id}"`);
+          }
+          const { [request.role]: _removed, ...rest } = room.role_briefings;
+          return this.store.save(RoomSchema.parse({ ...room, role_briefings: rest }));
         });
       }
       async createInvite(roomId, input) {
@@ -6220,33 +6882,215 @@ var init_service = __esm({
         return this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "create an invite for");
-          const packet = this.packet(id);
-          const minted = await packet.mintInvite(request.mode);
-          const invite = RoomInviteSchema.parse({
-            invite_id: minted.invite_id,
+          return this.mintInviteUnlocked(room, {
             mode: request.mode,
-            role: request.role,
-            min_accepts: request.min_accepts,
-            accepted_cids: [],
-            state: "live",
-            created_at: this.now()
+            role: request.role ?? DEFAULT_ROLE,
+            min_accepts: request.min_accepts
           });
+        });
+      }
+      async mintInviteUnlocked(room, request) {
+        const packet = this.packet(room.room_id);
+        const minted = await packet.mintInvite(request.mode);
+        const invite = RoomInviteSchema.parse({
+          invite_id: minted.invite_id,
+          mode: request.mode,
+          role: request.role,
+          min_accepts: request.min_accepts,
+          accepted_cids: [],
+          state: "live",
+          created_at: this.now(),
+          ...request.replaces_seat === void 0 ? {} : { replaces_seat: request.replaces_seat }
+        });
+        try {
+          await this.store.save(RoomSchema.parse({ ...room, invites: [...room.invites, invite] }));
+        } catch (error) {
           try {
-            await this.store.save(RoomSchema.parse({ ...room, invites: [...room.invites, invite] }));
-          } catch (error) {
-            try {
-              await packet.revokeInvite(minted.invite_id);
-            } catch {
-            }
-            throw error;
+            await packet.revokeInvite(minted.invite_id);
+          } catch {
           }
-          return {
-            room_id: id,
-            invite,
-            blob: minted.blob,
-            reusable: minted.reusable
+          throw error;
+        }
+        return {
+          room_id: room.room_id,
+          invite,
+          blob: minted.blob,
+          reusable: minted.reusable
+        };
+      }
+      /**
+       * Operator-only removal (spec §5.2): archive-before-act membership intent,
+       * seat state flip + epoch bump, core 0.13 bilateral sever with an honest
+       * receipt, and an alias-form announcement unless the room or call is quiet.
+       */
+      async removeParticipant(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RemoveParticipantInputSchema.parse(input);
+        const receipt = await this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "remove a participant from");
+          const seat = this.findActiveSeat(room, request.participant);
+          const notify = (request.notify ?? true) && !room.quiet_membership;
+          return this.beginRemovalUnlocked(room, seat, notify);
+        });
+        await this.intake.resumePending(id);
+        return receipt;
+      }
+      /**
+       * Removal plus a same-role invite stamped with the seat lineage (spec §5.3).
+       * Owner override OC-2/OC-6: in an anonymous room the flow is unconditionally
+       * silent — the successor inherits the alias and other members see nothing.
+       */
+      async replaceParticipant(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = ReplaceParticipantInputSchema.parse(input);
+        const receipt = await this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "replace a participant in");
+          const seat = this.findActiveSeat(room, request.participant);
+          const notify = room.anonymous ? false : (request.notify ?? true) && !room.quiet_membership;
+          const removal = await this.beginRemovalUnlocked(room, seat, notify);
+          const current = await this.store.load(id);
+          const invite = await this.mintInviteUnlocked(current, {
+            mode: request.mode ?? "one_time",
+            role: seat.role,
+            min_accepts: request.min_accepts ?? 1,
+            replaces_seat: seat.participant_id
+          });
+          return { ...invite, removal };
+        });
+        await this.intake.resumePending(id);
+        return receipt;
+      }
+      findActiveSeat(room, participant) {
+        const seat = room.seats.find((candidate) => candidate.state === "active" && (candidate.identity === participant || candidate.participant_id === participant));
+        if (!seat) {
+          throw new RoomServiceError(`"${participant}" is not an active participant of room "${room.room_id}"`);
+        }
+        return seat;
+      }
+      async beginRemovalUnlocked(room, seat, notify) {
+        const intent = await this.store.append(room.room_id, {
+          version: 1,
+          kind: "membership_intent",
+          room_id: room.room_id,
+          at: this.now(),
+          action: "remove",
+          participant_id: seat.participant_id,
+          recipient_identity: seat.identity,
+          role: seat.role,
+          // The participant-visible label: the alias in anonymous rooms, the
+          // contact display name otherwise (INV-R3 holds either way).
+          alias: seat.alias ?? seat.display_name,
+          epoch: room.membership_epoch + 1,
+          notify
+        });
+        if (intent.kind !== "membership_intent") {
+          throw new RoomServiceError("storage returned the wrong membership intent kind");
+        }
+        const { receipt } = await this.completeRemovalUnlocked(room, intent);
+        return receipt;
+      }
+      /**
+       * Idempotent completion of a durable removal intent: each step re-checks the
+       * archive/state it would produce, so a crash anywhere re-drives cleanly
+       * (INV-R5; the 0.13 sever is replay-safe by design).
+       */
+      async completeRemovalUnlocked(room, intent) {
+        let current = room;
+        const index = current.seats.findIndex(
+          (candidate) => candidate.participant_id === intent.participant_id
+        );
+        if (index < 0) {
+          throw new RoomServiceError(
+            `membership intent ${intent.record_id} references an unknown seat in room "${current.room_id}"`
+          );
+        }
+        if (current.seats[index].state !== "removed") {
+          const seats = [...current.seats];
+          seats[index] = {
+            ...seats[index],
+            state: "removed",
+            removed_at: intent.at,
+            removed_epoch: intent.epoch
+          };
+          current = await this.store.save(RoomSchema.parse({
+            ...current,
+            seats,
+            membership_epoch: Math.max(current.membership_epoch, intent.epoch)
+          }));
+        }
+        const records = await this.store.read(current.room_id);
+        const existing = records.find((record) => record.kind === "membership_result" && record.intent_record_id === intent.record_id);
+        let outcome;
+        if (existing !== void 0 && existing.kind === "membership_result") {
+          outcome = {
+            status: existing.status,
+            notified: existing.notified,
+            key_material_retained: true
           };
+        } else {
+          outcome = await this.packet(current.room_id).removeContact(intent.recipient_identity);
+          const result = await this.store.append(current.room_id, {
+            version: 1,
+            kind: "membership_result",
+            room_id: current.room_id,
+            at: this.now(),
+            intent_record_id: intent.record_id,
+            participant_id: intent.participant_id,
+            status: outcome.status,
+            notified: outcome.notified,
+            key_material_retained: true
+          });
+          if (result.kind !== "membership_result") {
+            throw new RoomServiceError("storage returned the wrong membership result kind");
+          }
+        }
+        if (intent.notify) await this.ensureMembershipNotice(current, intent);
+        return {
+          room: current,
+          receipt: {
+            room_id: current.room_id,
+            participant_id: intent.participant_id,
+            epoch: intent.epoch,
+            status: outcome.status,
+            notified: outcome.notified,
+            key_material_retained: true
+          }
+        };
+      }
+      async ensureMembershipNotice(room, intent) {
+        const records = await this.store.read(room.room_id);
+        const already = records.some((record) => record.kind === "message" && record.category === "membership" && record.membership?.action === "remove" && record.membership.epoch === intent.epoch);
+        if (already) return;
+        const remaining = activeSeats(room);
+        if (remaining.length === 0) return;
+        const label = intent.alias ?? intent.role;
+        const appended = await this.store.append(room.room_id, {
+          version: 1,
+          kind: "message",
+          room_id: room.room_id,
+          at: this.now(),
+          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+          author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
+          category: "membership",
+          text: `${label} left the room \xB7 epoch ${intent.epoch}`,
+          membership: { action: "remove", alias: label, role: intent.role, epoch: intent.epoch },
+          recipient_identities: uniqueIdentities(remaining.map((seat) => seat.identity))
         });
+        if (appended.kind !== "message") {
+          throw new RoomServiceError("storage returned the wrong membership notice kind");
+        }
+        for (const recipientIdentity of appended.recipient_identities) {
+          await this.store.append(room.room_id, {
+            version: 1,
+            kind: "relay_intent",
+            room_id: room.room_id,
+            at: this.now(),
+            message_id: appended.message_id,
+            recipient_identity: recipientIdentity
+          });
+        }
       }
       async revokeInvite(roomId, inviteId) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
@@ -6426,8 +7270,27 @@ var init_service = __esm({
       }
       async history(roomId, options = {}) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
-        const page = HistoryOptionsSchema.parse(options);
-        return this.store.read(id, page);
+        const { view, ...page } = HistoryOptionsSchema.parse(options);
+        const records = await this.store.read(id, view === "participant" ? { after: page.after } : page);
+        if (view !== "participant") return byteBoundedHistoryPage(records);
+        const projected = records.filter((record) => record.kind === "message").map((record) => {
+          const {
+            author_alias,
+            recipient_identities: _recipients,
+            source_msg_id: _sourceMsg,
+            source_wire_id: _sourceWire,
+            ...rest
+          } = record;
+          return {
+            ...rest,
+            author: author_alias === void 0 ? record.author : {
+              identity: author_alias.participant_id,
+              display_name: author_alias.alias,
+              role: record.author.role
+            }
+          };
+        });
+        return byteBoundedHistoryPage(projected.slice(0, page.limit ?? Number.MAX_SAFE_INTEGER));
       }
       /**
        * Forward-only close. Every external contact mutation is preceded by a
@@ -6492,7 +7355,7 @@ var init_service = __esm({
             },
             category: "chat",
             text: request.text,
-            recipient_identities: uniqueIdentities(room.seats.map((seat) => seat.identity))
+            recipient_identities: uniqueIdentities(activeSeats(room).map((seat) => seat.identity))
           });
           if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong room message kind");
           for (const recipientIdentity of appended.recipient_identities) {
@@ -6517,7 +7380,15 @@ var init_service = __esm({
         }
         const origins = packet.listContactOrigins();
         const inviteById = new Map(room.invites.map((invite) => [invite.invite_id, invite]));
-        const existingCids = new Set(room.seats.map((seat) => seat.identity));
+        const existingCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
+        const lastRemovedAt = /* @__PURE__ */ new Map();
+        for (const seat of room.seats) {
+          if (seat.state !== "removed" || seat.removed_at === void 0) continue;
+          const previous = lastRemovedAt.get(seat.identity);
+          if (previous === void 0 || seat.removed_at > previous) {
+            lastRemovedAt.set(seat.identity, seat.removed_at);
+          }
+        }
         const newSeats = [];
         for (const [cid, displayName] of contactsByCid) {
           if (existingCids.has(cid)) continue;
@@ -6525,12 +7396,23 @@ var init_service = __esm({
           if (!origin || origin.via !== "invite_one_time" && origin.via !== "invite_public") continue;
           const invite = inviteById.get(origin.invite_id);
           if (!invite || invite.state === "receipt_pending" || invite.recovery_of !== void 0 && invite.recovery_confirmed !== true) continue;
+          const removedAt = lastRemovedAt.get(cid);
+          if (removedAt !== void 0 && invite.created_at <= removedAt) continue;
+          const seated = [...room.seats, ...newSeats];
+          const predecessor = invite.replaces_seat === void 0 ? void 0 : seated.find((seat) => seat.participant_id === invite.replaces_seat && seat.state === "removed");
+          if (invite.replaces_seat !== void 0 && !predecessor) continue;
           newSeats.push({
             identity: cid,
             display_name: displayName,
             role: invite.role,
             invite_id: invite.invite_id,
-            accepted_at: origin.at
+            accepted_at: origin.at,
+            participant_id: LowerCrockfordUlidSchema.parse(generateUlid()),
+            state: "active",
+            ...predecessor === void 0 ? {} : { replaces_seat: predecessor.participant_id },
+            // OC-6 (owner override): a replacement into a role inherits the
+            // predecessor's alias — the alias binds to the seat/role lineage.
+            ...room.anonymous ? { alias: predecessor?.alias ?? mintAlias(seated, invite.role) } : {}
           });
           existingCids.add(cid);
         }
@@ -6556,13 +7438,26 @@ var init_service = __esm({
           }
           return { ...invite, accepted_cids, state };
         });
-        let next = RoomSchema.parse({ ...room, seats, invites });
+        let next = RoomSchema.parse({
+          ...room,
+          seats,
+          invites,
+          membership_epoch: room.membership_epoch + newSeats.length
+        });
+        const journal = await this.store.read(next.room_id);
+        const completedIntents = new Set(journal.filter((record) => record.kind === "membership_result").map((record) => record.kind === "membership_result" ? record.intent_record_id : ""));
+        for (const intent of journal.filter(
+          (record) => record.kind === "membership_intent"
+        )) {
+          if (completedIntents.has(intent.record_id)) continue;
+          ({ room: next } = await this.completeRemovalUnlocked(next, intent));
+        }
         const requirementsMet = invites.filter((invite) => invite.state !== "revoked").every((invite) => invite.accepted_cids.length >= invite.min_accepts);
         if (next.state === "provisioning" && seats.length > 0 && requirementsMet) {
-          const activationAt = await this.ensureActivationBriefing(next, seats);
+          const activationAt = await this.ensureActivationBriefing(next, activeSeats(next));
           next = RoomSchema.parse({ ...next, state: "active", activated_at: activationAt });
-        } else if (next.state === "active") {
-          for (const seat of newSeats) await this.ensureLateBriefing(next, seat);
+        } else if (next.state === "active" && newSeats.length > 0) {
+          await this.ensureActivationBriefing(next, newSeats);
         }
         return this.store.save(next);
       }
@@ -6659,62 +7554,98 @@ var init_service = __esm({
       deleteReceipt(roomId) {
         return { version: 1, room_id: roomId, deleted: true, scope: "this_host" };
       }
+      /**
+       * Deliver the common briefing followed by the seat's role briefing (spec
+       * §3.3): exactly once per (seat, briefing kind, version) via the message +
+       * relay-intent ledger. Returns the timestamp of the common briefing message
+       * that admitted the earliest of the given recipients (activation time).
+       */
       async ensureActivationBriefing(room, recipients) {
+        const at = await this.ensureBriefingKind(room, recipients, {
+          category: "briefing",
+          text: room.mission.briefing,
+          briefing_version: room.mission.briefing_version
+        });
+        await this.ensureRoleBriefings(room, recipients);
+        return at;
+      }
+      async ensureRoleBriefings(room, recipients) {
+        for (const seat of recipients) {
+          const briefing = room.role_briefings[seat.role];
+          if (!briefing) continue;
+          await this.ensureBriefingKind(room, [seat], {
+            category: "role_briefing",
+            briefing_role: seat.role,
+            text: briefing.text,
+            briefing_version: briefing.version
+          });
+        }
+      }
+      /** Re-deliver the (just bumped) common briefing to every active seat. */
+      async redeliverCommonBriefing(room) {
+        await this.ensureBriefingKind(room, activeSeats(room), {
+          category: "briefing",
+          text: room.mission.briefing,
+          briefing_version: room.mission.briefing_version
+        });
+      }
+      async ensureBriefingKind(room, recipients, briefing) {
         const records = await this.store.read(room.room_id);
-        let message = records.find(
-          (record) => record.kind === "message" && record.category === "briefing"
-        );
-        if (!message) message = await this.appendBriefing(room, recipients);
-        const intents = new Set(records.filter((record) => record.kind === "relay_intent" && record.message_id === message.message_id).map((record) => record.kind === "relay_intent" ? record.recipient_identity : ""));
-        for (const recipientIdentity of message.recipient_identities) {
-          if (!intents.has(recipientIdentity)) {
+        const matching = records.filter((record) => record.kind === "message" && record.category === briefing.category && record.briefing_role === briefing.briefing_role && (record.briefing_version ?? 1) === briefing.briefing_version);
+        const intentsByMessage = /* @__PURE__ */ new Map();
+        for (const record of records) {
+          if (record.kind !== "relay_intent" || record.message_id === void 0) continue;
+          const intents = intentsByMessage.get(record.message_id) ?? /* @__PURE__ */ new Set();
+          intents.add(record.recipient_identity);
+          intentsByMessage.set(record.message_id, intents);
+        }
+        const covered = /* @__PURE__ */ new Set();
+        for (const message of matching) {
+          const intents = intentsByMessage.get(message.message_id) ?? /* @__PURE__ */ new Set();
+          for (const recipientIdentity of message.recipient_identities) {
+            covered.add(recipientIdentity);
+            if (!intents.has(recipientIdentity)) {
+              await this.store.append(room.room_id, {
+                version: 1,
+                kind: "relay_intent",
+                room_id: room.room_id,
+                at: this.now(),
+                message_id: message.message_id,
+                recipient_identity: recipientIdentity
+              });
+            }
+          }
+        }
+        const missing = recipients.filter((seat) => !covered.has(seat.identity));
+        let appendedAt;
+        if (missing.length > 0) {
+          const appended = await this.store.append(room.room_id, {
+            version: 1,
+            kind: "message",
+            room_id: room.room_id,
+            at: this.now(),
+            message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+            author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
+            category: briefing.category,
+            ...briefing.briefing_role === void 0 ? {} : { briefing_role: briefing.briefing_role },
+            briefing_version: briefing.briefing_version,
+            text: briefing.text,
+            recipient_identities: uniqueIdentities(missing.map((seat) => seat.identity))
+          });
+          if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
+          appendedAt = appended.at;
+          for (const recipientIdentity of appended.recipient_identities) {
             await this.store.append(room.room_id, {
               version: 1,
               kind: "relay_intent",
               room_id: room.room_id,
               at: this.now(),
-              message_id: message.message_id,
+              message_id: appended.message_id,
               recipient_identity: recipientIdentity
             });
           }
         }
-        const originalAudience = new Set(message.recipient_identities);
-        for (const recipient of recipients) {
-          if (!originalAudience.has(recipient.identity)) await this.ensureLateBriefing(room, recipient);
-        }
-        return message.at;
-      }
-      async ensureLateBriefing(room, seat) {
-        const records = await this.store.read(room.room_id);
-        let message = [...records].reverse().find(
-          (record) => record.kind === "message" && record.category === "briefing" && record.recipient_identities.includes(seat.identity)
-        );
-        if (!message) message = await this.appendBriefing(room, [seat]);
-        const alreadyBriefed = records.some((record) => record.kind === "relay_intent" && record.message_id === message.message_id && record.recipient_identity === seat.identity);
-        if (alreadyBriefed) return;
-        await this.store.append(room.room_id, {
-          version: 1,
-          kind: "relay_intent",
-          room_id: room.room_id,
-          at: this.now(),
-          message_id: message.message_id,
-          recipient_identity: seat.identity
-        });
-      }
-      async appendBriefing(room, recipients) {
-        const record = await this.store.append(room.room_id, {
-          version: 1,
-          kind: "message",
-          room_id: room.room_id,
-          at: this.now(),
-          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
-          author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
-          category: "briefing",
-          text: room.mission.briefing,
-          recipient_identities: uniqueIdentities(recipients.map((seat) => seat.identity))
-        });
-        if (record.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
-        return record;
+        return matching[0]?.at ?? appendedAt ?? this.now();
       }
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
@@ -6740,7 +7671,7 @@ var init_service = __esm({
 });
 
 // src/storage.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes3 } from "node:crypto";
 import * as nodeFs3 from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { dirname as dirname4, join as join4 } from "node:path";
@@ -6749,6 +7680,7 @@ var init_storage = __esm({
   "src/storage.ts"() {
     "use strict";
     init_contracts();
+    init_ulid();
     DIRECTORY_MODE2 = 448;
     FILE_MODE2 = 384;
     NO_FOLLOW2 = nodeFs3.constants.O_NOFOLLOW ?? 0;
@@ -6989,11 +7921,17 @@ var init_storage = __esm({
               `room "${validRoomId}" has archive residue without deletion metadata`
             );
           }
-          const expected = /* @__PURE__ */ new Set(["archive.jsonl", "room.json"]);
+          const expected = /* @__PURE__ */ new Set(["archive.jsonl", "room.json", "room.json.v1.bak"]);
           const unexpected = this.fs.readdirSync(roomDir).filter((name) => !expected.has(name));
           if (unexpected.length > 0) {
             throw new CoworkStorageError(`room "${validRoomId}" contains live or unexpected residue: ${unexpected.join(", ")}`);
           }
+          const backupPath = `${metadataPath}.v1.bak`;
+          if (this.lstatIfPresent(backupPath)) {
+            this.assertRegularFile(backupPath, "room metadata v1 backup");
+            this.fs.unlinkSync(backupPath);
+            this.fsyncDirectory(roomDir);
+          }
           if (archivePresent) {
             this.assertRegularFile(archivePath, "room archive");
             this.fs.unlinkSync(archivePath);
@@ -7048,10 +7986,106 @@ var init_storage = __esm({
         } catch (error) {
           throw this.wrap(`malformed metadata for room "${roomId}"`, error);
         }
-        const room = RoomSchema.parse(decoded);
+        const room = this.isVersion1(decoded) ? this.migrateUnlocked(roomId, decoded, bytes) : RoomSchema.parse(decoded);
         if (room.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
         return room;
       }
+      isVersion1(decoded) {
+        return typeof decoded === "object" && decoded !== null && decoded.version === 1;
+      }
+      /**
+       * Lazy additive v1 → v2 migration (spec §7): preserve the exact pre-migration
+       * bytes once as room.json.v1.bak, then atomically persist the v2 metadata.
+       *
+       * THE BACKUP IS WRITTEN TEMP → FSYNC → RENAME, not opened in place, and the
+       * reason is a crash window that an existence check cannot see. The earlier
+       * version guarded with `if (!lstatIfPresent(backupPath))` and wrote straight
+       * into the final path under O_CREAT|O_EXCL. A crash inside that write leaves a
+       * PARTIAL file that nonetheless EXISTS, so the next load's existence check
+       * skips the backup, writes v2, and the pre-migration bytes are gone — no
+       * error, no warning, and the one artefact that exists to undo a bad migration
+       * is a truncated fragment. Measured before the fix: a 40-byte prefix of a
+       * 604-byte room, JSON.parse false, room.json already v2.
+       *
+       * A rename is atomic, so the final path now only ever appears complete. The
+       * temp file is created with O_EXCL under a pid+random name and removed on
+       * failure, so a crashed attempt leaves at most an orphan temp, never a
+       * plausible-looking backup.
+       *
+       * AND AN EXISTING BACKUP IS PARSED BEFORE IT IS TRUSTED, which repairs the
+       * case where a partial file is ALREADY on disk from a build without this fix —
+       * exactly the state a host that ran the previous code could be in right now.
+       * A backup that does not parse as v1 is replaced by the bytes we hold, because
+       * those are the real pre-migration bytes and the fragment is worthless.
+       *
+       * WHAT THE BACKUP IS NOT: restoring it is NOT a rollback. See the note on
+       * `restoreV1Backup` — re-migrating mints fresh participant ids.
+       */
+      migrateUnlocked(roomId, decoded, originalBytes) {
+        const v1 = RoomV1Schema.parse(decoded);
+        if (v1.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
+        const migrated = migrateRoomV1(v1, generateUlid);
+        const backupPath = `${this.metadataPath(roomId)}.v1.bak`;
+        if (!this.hasIntactV1Backup(backupPath)) {
+          this.atomicBytesWrite(backupPath, originalBytes, "room metadata v1 backup");
+        }
+        this.atomicMetadataWrite(this.metadataPath(roomId), migrated);
+        return migrated;
+      }
+      /**
+       * Is there already a backup we would be willing to hand back to an operator?
+       *
+       * Existence is not the question — a partial file exists. It must parse and
+       * still claim to be the v1 metadata for this room; anything else is a fragment
+       * and is better overwritten with the bytes we are holding right now.
+       */
+      hasIntactV1Backup(backupPath) {
+        if (!this.lstatIfPresent(backupPath)) return false;
+        try {
+          const decoded = JSON.parse(utf8Decoder.decode(this.readFileNoFollow(backupPath, "room metadata v1 backup")));
+          return this.isVersion1(decoded);
+        } catch {
+          return false;
+        }
+      }
+      /**
+       * Durably place exact bytes at `path`: temp under O_EXCL, fsync, rename, fsync
+       * the directory. The same dance as atomicMetadataWrite, which serialises a Room
+       * rather than taking bytes verbatim — and taking them verbatim is the whole
+       * point for a backup, whose value is being byte-identical to what was there.
+       */
+      atomicBytesWrite(path, bytes, label) {
+        if (this.lstatIfPresent(path)) this.assertRegularFile(path, label);
+        const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
+        let fd;
+        try {
+          fd = this.fs.openSync(
+            temp,
+            nodeFs3.constants.O_CREAT | nodeFs3.constants.O_EXCL | nodeFs3.constants.O_WRONLY | NO_FOLLOW2,
+            FILE_MODE2
+          );
+          this.validateOpenPath(fd, temp, `temporary ${label}`, "file", true);
+          this.fs.fchmodSync(fd, FILE_MODE2);
+          this.writeAll(fd, bytes);
+          this.fs.fsyncSync(fd);
+          this.fs.closeSync(fd);
+          fd = void 0;
+          this.fs.renameSync(temp, path);
+          this.fsyncDirectory(dirname4(path));
+        } catch (error) {
+          if (fd !== void 0) {
+            try {
+              this.fs.closeSync(fd);
+            } catch {
+            }
+          }
+          try {
+            this.fs.rmSync(temp, { force: true });
+          } catch {
+          }
+          throw this.wrap(`failed to write ${label} at ${path}`, error);
+        }
+      }
       scanArchive(roomId) {
         const path = this.archivePath(roomId);
         this.assertRegularFile(path, "room archive");
@@ -7213,7 +8247,7 @@ var init_storage = __esm({
       }
       atomicMetadataWrite(path, room) {
         if (this.lstatIfPresent(path)) this.assertRegularFile(path, "room metadata");
-        const temp = `${path}.tmp-${process.pid}-${randomBytes4(8).toString("hex")}`;
+        const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
         const bytes = Buffer.from(`${JSON.stringify(room)}
 `, "utf8");
         let fd;
@@ -7456,7 +8490,7 @@ var init_web = __esm({
 });
 
 // src/transports.ts
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import * as http from "node:http";
 import * as net from "node:net";
 import * as nodeFs5 from "node:fs";
@@ -7469,19 +8503,36 @@ function createServiceRoutes(service) {
         room_id: external_exports.string(),
         goal: external_exports.unknown().optional(),
         briefing: external_exports.unknown().optional(),
-        status: external_exports.unknown().optional()
+        status: external_exports.unknown().optional(),
+        quiet_membership: external_exports.unknown().optional()
       }).strict().parse(params);
       return service.updateRoom(room_id, input);
     } },
+    "room.briefing.role.set": { auth: true, run: (params) => {
+      const { room_id, ...input } = RoleBriefingSetParams.parse(params);
+      return service.setRoleBriefing(room_id, input);
+    } },
+    "room.briefing.role.delete": { auth: true, run: (params) => {
+      const { room_id, ...input } = RoleBriefingDeleteParams.parse(params);
+      return service.deleteRoleBriefing(room_id, input);
+    } },
     "room.invite": { auth: true, run: (params) => {
       const { room_id, ...input } = external_exports.object({
         room_id: external_exports.string(),
         mode: external_exports.unknown(),
-        role: external_exports.unknown(),
+        role: external_exports.unknown().optional(),
         min_accepts: external_exports.unknown()
       }).strict().parse(params);
       return service.createInvite(room_id, input);
     } },
+    "room.participant.remove": { auth: true, run: (params) => {
+      const { room_id, ...input } = ParticipantRemoveParams.parse(params);
+      return service.removeParticipant(room_id, input);
+    } },
+    "room.participant.replace": { auth: true, run: (params) => {
+      const { room_id, ...input } = ParticipantReplaceParams.parse(params);
+      return service.replaceParticipant(room_id, input);
+    } },
     "room.revoke": { auth: true, run: (params) => {
       const value = InviteRevokeParams.parse(params);
       return service.revokeInvite(value.room_id, value.invite_id);
@@ -7639,7 +8690,7 @@ function responseFinished2(response) {
     response.once("error", rejectResponse);
   });
 }
-var MAX_REQUEST_BYTES, HTTP_HEADERS_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, HTTP_BODY_IDLE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, MAX_STALE_PRIVATE_SOCKET_CLEANUP, RpcIdSchema, RpcRequestSchema, RpcDispatcher, RoomIdParams, InviteRevokeParams, RecoverConfirmParams, HistoryParams, TransportServer;
+var MAX_REQUEST_BYTES, HTTP_HEADERS_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, HTTP_BODY_IDLE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, MAX_STALE_PRIVATE_SOCKET_CLEANUP, RpcIdSchema, RpcRequestSchema, RpcDispatcher, RoomIdParams, InviteRevokeParams, RecoverConfirmParams, HistoryParams, RoleBriefingSetParams, RoleBriefingDeleteParams, ParticipantRemoveParams, ParticipantReplaceParams, TransportServer;
 var init_transports = __esm({
   "src/transports.ts"() {
     "use strict";
@@ -7714,7 +8765,29 @@ var init_transports = __esm({
     HistoryParams = external_exports.object({
       room_id: external_exports.string(),
       after: external_exports.number().optional(),
-      limit: external_exports.number().optional()
+      limit: external_exports.number().optional(),
+      view: external_exports.enum(["operator", "participant"]).optional()
+    }).strict();
+    RoleBriefingSetParams = external_exports.object({
+      room_id: external_exports.string(),
+      role: external_exports.string(),
+      text: external_exports.string()
+    }).strict();
+    RoleBriefingDeleteParams = external_exports.object({
+      room_id: external_exports.string(),
+      role: external_exports.string()
+    }).strict();
+    ParticipantRemoveParams = external_exports.object({
+      room_id: external_exports.string(),
+      participant: external_exports.string(),
+      notify: external_exports.boolean().optional()
+    }).strict();
+    ParticipantReplaceParams = external_exports.object({
+      room_id: external_exports.string(),
+      participant: external_exports.string(),
+      notify: external_exports.boolean().optional(),
+      mode: external_exports.enum(["one_time", "public"]).optional(),
+      min_accepts: external_exports.number().optional()
     }).strict();
     TransportServer = class {
       options;
@@ -7751,7 +8824,7 @@ var init_transports = __esm({
         await this.cleanupStalePrivateSockets();
         const unix = net.createServer((socket) => this.handleUnix(socket));
         this.unixServer = unix;
-        const privateSocketPath = `${this.options.socketPath}.private-${process.pid}-${randomBytes5(6).toString("hex")}`;
+        const privateSocketPath = `${this.options.socketPath}.private-${process.pid}-${randomBytes4(6).toString("hex")}`;
         this.privateSocketPath = privateSocketPath;
         try {
           await listen(unix, privateSocketPath);
@@ -8060,7 +9133,7 @@ var init_transports = __esm({
         }
       }
       quarantinePath(target, label) {
-        const path = `${this.options.socketPath}.safe-residue-${label}-${process.pid}-${randomBytes5(6).toString("hex")}`;
+        const path = `${this.options.socketPath}.safe-residue-${label}-${process.pid}-${randomBytes4(6).toString("hex")}`;
         this.fs.renameSync(target, path);
         const moved = this.fs.lstatSync(path);
         return { target, path, dev: moved.dev, ino: moved.ino };
@@ -8084,7 +9157,7 @@ var init_transports = __esm({
         }
       }
       quarantinePublicPath() {
-        const quarantinePath = `${this.options.socketPath}.replacement-${process.pid}-${randomBytes5(6).toString("hex")}`;
+        const quarantinePath = `${this.options.socketPath}.replacement-${process.pid}-${randomBytes4(6).toString("hex")}`;
         try {
           this.fs.renameSync(this.options.socketPath, quarantinePath);
         } catch (error) {
@@ -8132,6 +9205,7 @@ __export(daemon_runtime_exports, {
   DaemonShutdownError: () => DaemonShutdownError,
   acquireDaemonLock: () => acquireDaemonLock,
   createDaemonControlRoutes: () => createDaemonControlRoutes,
+  isIntakeNotification: () => isIntakeNotification,
   loadConfig: () => loadConfig,
   removeDaemonPid: () => removeDaemonPid,
   writeDaemonPid: () => writeDaemonPid
@@ -8139,6 +9213,9 @@ __export(daemon_runtime_exports, {
 import * as nodeFs6 from "node:fs";
 import { join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+function isIntakeNotification(event) {
+  return event === "message_received" || event === "file_received" || event === "contact_accepted";
+}
 function createDaemonControlRoutes(control) {
   if (!/^[0-9a-f]{32}$/.test(control.session)) throw new TypeError("invalid daemon control session");
   const requireExact = (params, keys) => {
@@ -8421,7 +9498,7 @@ var init_daemon_runtime = __esm({
             {
               log: this.options.log,
               onNotify: (roomId, event) => {
-                if (event === "message_received" || event === "contact_accepted") {
+                if (isIntakeNotification(event)) {
                   this.handleNotification(roomId, event, serviceRef);
                 }
               }
@@ -8608,7 +9685,7 @@ var daemon_process_exports = {};
 __export(daemon_process_exports, {
   runDaemonProcess: () => runDaemonProcess
 });
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 async function runDaemonProcess() {
   try {
     const code = process.env.OURS_COWORK_DAEMON_WORKER === "1" ? await runWorker() : await runSupervisor();
@@ -8721,7 +9798,7 @@ async function runWorker() {
     },
     control: {
       // Created only after the supervisor capability handshake completed.
-      session: randomBytes6(16).toString("hex"),
+      session: randomBytes5(16).toString("hex"),
       async requestSupervisorShutdown() {
         if (!capability || disconnected || process.connected === false) return false;
         return sendIpc({ type: "shutdown_request", capability });
@@ -8799,7 +9876,7 @@ var init_daemon_process = __esm({
 
 // src/daemon.ts
 import { fork } from "node:child_process";
-import { randomBytes as randomBytes7 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 import { resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 async function runSupervisor(options = {}) {
@@ -8906,7 +9983,7 @@ var init_daemon = __esm({
         this.signals = options.signals ?? process;
         this.shutdownTimeoutMs = options.shutdownTimeoutMs ?? DAEMON_SHUTDOWN_TIMEOUT_MS;
         this.onStageCallback = options.onStage;
-        this.capability = options.capability ?? randomBytes7(32).toString("hex");
+        this.capability = options.capability ?? randomBytes6(32).toString("hex");
         if (!/^[0-9a-f]{64}$/.test(this.capability)) throw new Error("invalid daemon worker capability");
         this.done = new Promise((resolveDone) => {
           this.resolveDone = resolveDone;