@ours.network/cowork 0.4.1-nightly.20260816.4aaf940 → 0.5.0

package/dist/daemon.js

@@ -10,6 +10,446 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/adapt.ts
+import * as fs from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { brotliCompressSync, brotliDecompressSync, constants as zlibConstants } from "node:zlib";
+function withScope(fn) {
+  const lifetime = new AdaptObjectLifetime();
+  try {
+    return fn(lifetime);
+  } finally {
+    lifetime.Finalize();
+  }
+}
+async function withScopeAsync(fn) {
+  const lifetime = new AdaptObjectLifetime();
+  try {
+    return await fn(lifetime);
+  } finally {
+    lifetime.Finalize();
+  }
+}
+function locateUnit() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const override = process.env.OURS_COWORK_UNIT_DIR;
+  const candidates = override ? [resolve(override)] : [join(here, "mufl_code"), join(here, "..", "mufl_code")];
+  for (const dir of candidates) {
+    if (!fs.existsSync(dir)) continue;
+    const compiled = fs.readdirSync(dir).find((name) => name.endsWith(".muflo"));
+    if (compiled) {
+      return {
+        dir,
+        hash: compiled.slice(0, -".muflo".length),
+        contents: new Uint8Array(fs.readFileSync(join(dir, compiled)))
+      };
+    }
+  }
+  throw new Error(`no compiled .muflo packet found (looked in: ${candidates.join(", ")})`);
+}
+function wireHandlers(packet, hooks, log) {
+  const settleAfterActionLoop = (pending) => {
+    queueMicrotask(() => {
+      if (packet.pending[0] !== pending || !pending.payload || pending.callbackError) return;
+      packet.pending.shift();
+      clearTimeout(pending.timer);
+      pending.settled = true;
+      pending.resolve(pending.payload);
+    });
+  };
+  packet.pw.on_return_data = (data) => {
+    const lifetime = new AdaptObjectLifetime();
+    data.Attach(lifetime);
+    try {
+      if (packet.isClosed) return;
+      const kind = data.Reduce("kind").Visualize();
+      if (kind === "save_state") {
+        try {
+          hooks.onSaveState();
+        } catch (error) {
+          const pending2 = packet.pending[0];
+          if (pending2) pending2.callbackError = asError(error);
+          throw error;
+        }
+        return;
+      }
+      if (kind === "notify_agent") {
+        const payload = data.Reduce("payload");
+        hooks.onNotify(payload.Reduce("event").Visualize(), payload);
+        return;
+      }
+      const pending = packet.pending[0];
+      if (!pending) return;
+      if (pending.expired) {
+        packet.releaseExpired(pending);
+        return;
+      }
+      if (pending.payload) pending.payload.Destroy();
+      pending.payload = data.Reduce("payload").Detach();
+      settleAfterActionLoop(pending);
+    } finally {
+      lifetime.Finalize();
+    }
+  };
+  packet.pw.on_transaction_failure = (message) => {
+    log(`[${packet.name}] transaction rejected (origin uncorrelated):`, message);
+  };
+}
+function asError(error) {
+  return error instanceof Error ? error : new Error(String(error));
+}
+function packInvite(raw) {
+  return brotliCompressSync(raw, {
+    params: {
+      [zlibConstants.BROTLI_PARAM_QUALITY]: 11,
+      [zlibConstants.BROTLI_PARAM_SIZE_HINT]: raw.length
+    }
+  }).toString("base64url");
+}
+function unpackInvite(encoded, maximumBytes) {
+  const normalized = encoded.replace(/\s+/g, "");
+  if (maximumBytes !== void 0 && Buffer.byteLength(encoded, "utf8") > maximumBytes || normalized.length === 0 || !/^[A-Za-z0-9_-]+$/.test(normalized)) {
+    throw new Error("the invite blob is empty, oversized, or invalid base64url");
+  }
+  const compressed = Buffer.from(normalized, "base64url");
+  if (compressed.length === 0) throw new Error("the invite blob is empty or invalid base64url");
+  return Buffer.from(maximumBytes === void 0 ? brotliDecompressSync(compressed) : brotliDecompressSync(compressed, { maxOutputLength: maximumBytes }));
+}
+var commonSdk, executableSdk, wrapperSdk, wrappersSdk, AdaptObjectLifetime, adapt_wrapper, object_to_adapt_value, PacketWrapperConfigurator, LATE_RESULT_DRAIN_MS, Packet, AdaptHostShutdownError, AdaptHost;
+var init_adapt = __esm({
+  async "src/adapt.ts"() {
+    "use strict";
+    [commonSdk, executableSdk, wrapperSdk, wrappersSdk] = await Promise.all([
+      import("@adapt-toolkit/sdk/common"),
+      import("@adapt-toolkit/sdk/executables"),
+      import("@adapt-toolkit/sdk/wrapper"),
+      import("@adapt-toolkit/sdk/wrappers")
+    ]);
+    ({ AdaptObjectLifetime } = commonSdk);
+    ({ adapt_wrapper } = executableSdk);
+    ({ object_to_adapt_value } = wrapperSdk);
+    ({ PacketWrapperConfigurator } = wrappersSdk);
+    LATE_RESULT_DRAIN_MS = 50;
+    Packet = class {
+      pending = [];
+      lock = Promise.resolve();
+      expiredDrain;
+      releaseExpiredDrain;
+      closedError;
+      terminalNotified = false;
+      onTerminal;
+      terminalListeners = /* @__PURE__ */ new Set();
+      makeEnvelope;
+      name;
+      cid;
+      pw;
+      constructor(name, cid, pw, onTerminal = () => {
+      }, makeEnvelope = (transactionName, targ) => object_to_adapt_value({ name: transactionName, targ })) {
+        this.name = name;
+        this.cid = cid;
+        this.pw = pw;
+        this.onTerminal = onTerminal;
+        this.makeEnvelope = makeEnvelope;
+      }
+      get isClosed() {
+        return this.closedError !== void 0;
+      }
+      onTerminalClose(listener) {
+        if (this.closedError) {
+          listener(this.closedError);
+          return () => {
+          };
+        }
+        this.terminalListeners.add(listener);
+        return () => this.terminalListeners.delete(listener);
+      }
+      assertOpen() {
+        if (this.closedError) throw this.closedError;
+      }
+      readonlyTx(name, lifetime) {
+        this.assertOpen();
+        const envelope = this.makeEnvelope(name, void 0);
+        try {
+          const result = this.pw.packet.ExecuteTransaction(envelope);
+          return lifetime ? result.Attach(lifetime) : result;
+        } finally {
+          envelope.Destroy();
+        }
+      }
+      async withLock(fn) {
+        this.assertOpen();
+        const previous = this.lock;
+        let release;
+        this.lock = new Promise((resolveLock) => {
+          release = resolveLock;
+        });
+        await previous;
+        try {
+          this.assertOpen();
+          if (this.expiredDrain) await this.expiredDrain;
+          this.assertOpen();
+          return await fn();
+        } finally {
+          release();
+        }
+      }
+      enqueue(envelope, timeoutMs) {
+        return new Promise((resolveResult, rejectResult) => {
+          const timer = setTimeout(() => {
+            const pending2 = this.pending.find((candidate) => candidate.timer === timer);
+            if (!pending2 || pending2.settled) return;
+            pending2.settled = true;
+            pending2.expired = true;
+            pending2.reject(new Error(`timed out waiting for transaction result on packet "${this.name}"`));
+            this.expiredDrain = new Promise((resolveDrain) => {
+              this.releaseExpiredDrain = resolveDrain;
+            });
+            pending2.lateTimer = setTimeout(() => {
+              if (this.closedError || !pending2.expired || !this.pending.includes(pending2)) return;
+              this.close(new Error(
+                `packet "${this.name}" closed after a timed-out transaction produced no correlated callback`
+              ));
+            }, LATE_RESULT_DRAIN_MS);
+          }, timeoutMs);
+          const pending = { resolve: resolveResult, reject: rejectResult, timer };
+          this.pending.push(pending);
+          try {
+            this.pw.add_client_message(envelope);
+          } catch (error) {
+            clearTimeout(timer);
+            const index = this.pending.indexOf(pending);
+            if (index >= 0) this.pending.splice(index, 1);
+            rejectResult(asError(error));
+          }
+        });
+      }
+      mutatingTx(name, targ, lifetime, timeoutMs = 25e3) {
+        let envelope;
+        try {
+          this.assertOpen();
+          envelope = this.makeEnvelope(name, targ);
+        } catch (error) {
+          return Promise.reject(asError(error));
+        }
+        return this.withLock(() => this.enqueue(envelope, timeoutMs)).then(
+          (payload) => {
+            envelope.Destroy();
+            return lifetime ? payload.Attach(lifetime) : payload;
+          },
+          (error) => {
+            envelope.Destroy();
+            throw error;
+          }
+        );
+      }
+      newBinary(bytes, lifetime) {
+        this.assertOpen();
+        const value = this.pw.packet.NewBinaryFromBuffer(bytes);
+        return lifetime ? value.Attach(lifetime) : value;
+      }
+      close(error = new Error(`packet "${this.name}" is closed`)) {
+        if (this.closedError) return;
+        this.closedError = error;
+        const pending = this.pending.splice(0);
+        for (const call of pending) {
+          clearTimeout(call.timer);
+          if (call.lateTimer) clearTimeout(call.lateTimer);
+          call.payload?.Destroy();
+          if (!call.settled) {
+            call.settled = true;
+            call.reject(error);
+          }
+        }
+        this.releaseExpiredDrain?.();
+        this.releaseExpiredDrain = void 0;
+        this.expiredDrain = void 0;
+        if (!this.terminalNotified) {
+          this.terminalNotified = true;
+          for (const listener of this.terminalListeners) listener(error);
+          this.terminalListeners.clear();
+          this.onTerminal(error);
+        }
+      }
+      releaseExpired(pending) {
+        const index = this.pending.indexOf(pending);
+        if (index >= 0) this.pending.splice(index, 1);
+        if (pending.lateTimer) clearTimeout(pending.lateTimer);
+        pending.payload?.Destroy();
+        this.releaseExpiredDrain?.();
+        this.releaseExpiredDrain = void 0;
+        this.expiredDrain = void 0;
+      }
+    };
+    AdaptHostShutdownError = class extends AggregateError {
+      requiresProcessExit;
+      constructor(errors, requiresProcessExit) {
+        super(errors, "AdaptHost shutdown encountered errors");
+        this.name = "AdaptHostShutdownError";
+        this.requiresProcessExit = requiresProcessExit;
+      }
+    };
+    AdaptHost = class {
+      wrapper;
+      packets = /* @__PURE__ */ new Map();
+      exposedPackets = /* @__PURE__ */ new Set();
+      brokerUrl;
+      log;
+      unit;
+      shutdownWrapper;
+      constructor(brokerUrl, log = () => {
+      }, options = {}) {
+        this.brokerUrl = brokerUrl;
+        this.log = log;
+        this.unit = options.unit ?? locateUnit();
+        this.shutdownWrapper = options.shutdownWrapper;
+      }
+      get packetCount() {
+        return this.packets.size;
+      }
+      async boot() {
+        if (this.wrapper) return;
+        this.wrapper = await adapt_wrapper.start([
+          "--broker_address",
+          this.brokerUrl,
+          "--test_mode",
+          "--logger_config",
+          "--level",
+          "WARNING",
+          "--stdout",
+          "stderr",
+          "--logger_config_end"
+        ]);
+        this.wrapper.on_packet_created_cb = (cid) => {
+          this.log(`wrapper: packet ready ${cid.slice(0, 12)}\u2026`);
+        };
+        this.wrapper.start();
+      }
+      createPacket(name, seed, signingSecret, options = {}) {
+        const wrapper = this.wrapper;
+        if (!wrapper) return Promise.reject(new Error("AdaptHost.boot() must complete before creating packets"));
+        const config = new PacketWrapperConfigurator();
+        config.deferred_exposure = options.deferredExposure ?? false;
+        const args = [
+          "--unit_hash",
+          this.unit.hash,
+          "--seed_phrase",
+          seed,
+          "--unit_dir_path",
+          this.unit.dir
+        ];
+        if (signingSecret) args.push("--init_trn_argument", JSON.stringify(signingSecret));
+        config.process_arguments(args);
+        return new Promise((resolveCreate, rejectCreate) => {
+          let settled = false;
+          const timer = setTimeout(() => {
+            settled = true;
+            rejectCreate(new Error(`packet creation for "${name}" timed out`));
+          }, 3e4);
+          try {
+            wrapper.packet_manager.create_packet(config, (pw) => {
+              if (settled) {
+                pw.dispose();
+                return;
+              }
+              settled = true;
+              clearTimeout(timer);
+              const cid = withScope((lifetime) => pw.packet.GetContainerID().Attach(lifetime).Visualize());
+              let packet;
+              packet = new Packet(name, cid, pw, (error) => {
+                queueMicrotask(() => {
+                  if (this.packets.get(cid) !== packet) return;
+                  try {
+                    this.removePacket(cid, error);
+                  } catch (removeError) {
+                    this.log(`[${name}] terminal packet removal failed:`, removeError);
+                  }
+                });
+              });
+              this.packets.set(cid, packet);
+              if (!config.deferred_exposure) this.exposedPackets.add(cid);
+              resolveCreate(packet);
+            }, this.unit.contents);
+          } catch (error) {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            rejectCreate(asError(error));
+          }
+        });
+      }
+      exposePacket(cid) {
+        const wrapper = this.wrapper;
+        const packet = this.packets.get(cid);
+        if (!wrapper || !packet) throw new Error(`cannot expose unknown packet ${cid}`);
+        if (packet.isClosed) throw new Error(`cannot expose closed packet ${cid}`);
+        wrapper.expose_packet(cid);
+        this.exposedPackets.add(cid);
+      }
+      isPacketExposed(cid) {
+        return this.exposedPackets.has(cid);
+      }
+      removePacket(cid, error = new Error(`packet ${cid} removed from host`)) {
+        const wrapper = this.wrapper;
+        if (!wrapper) throw new Error("AdaptHost is not booted");
+        const packet = this.packets.get(cid);
+        if (!packet) return;
+        packet.close(error);
+        wrapper.remove_packet(cid);
+        this.packets.delete(cid);
+        this.exposedPackets.delete(cid);
+      }
+      close() {
+        if (!this.wrapper) return;
+        const errors = [];
+        for (const cid of [...this.packets.keys()]) {
+          try {
+            this.removePacket(cid, new Error("AdaptHost closed"));
+          } catch (error) {
+            errors.push(asError(error));
+          }
+        }
+        this.wrapper = void 0;
+        if (errors.length) throw new AggregateError(errors, "failed to remove all hosted packets");
+      }
+      /**
+       * Release every public SDK resource. SDK 0.10.12 exposes packet disposal but
+       * not its private broker client's stop(), so a real native wrapper reports
+       * that the owning process must exit after graceful daemon cleanup.
+       */
+      async shutdown() {
+        const wrapper = this.wrapper;
+        if (!wrapper) return { requiresProcessExit: false };
+        const errors = [];
+        let requiresProcessExit = true;
+        try {
+          this.close();
+        } catch (error) {
+          errors.push(error);
+        }
+        try {
+          if (this.shutdownWrapper) {
+            await this.shutdownWrapper(wrapper);
+            requiresProcessExit = false;
+          } else {
+            const futureWrapper = wrapper;
+            const publicStop = futureWrapper.shutdown ?? futureWrapper.stop ?? futureWrapper.dispose;
+            if (typeof publicStop === "function") {
+              await publicStop.call(wrapper);
+              requiresProcessExit = false;
+            }
+          }
+        } catch (error) {
+          errors.push(error);
+        }
+        this.wrapper = void 0;
+        if (errors.length > 0) throw new AdaptHostShutdownError(errors, requiresProcessExit);
+        return { requiresProcessExit };
+      }
+    };
+  }
+});
+
 // node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -421,8 +861,8 @@ var init_parseUtil = __esm({
   "node_modules/zod/v3/helpers/parseUtil.js"() {
     init_errors();
     init_en();
-    makeIssue = (params) => {
-      const { data, path, errorMaps, issueData } = params;
+    makeIssue = (params2) => {
+      const { data, path, errorMaps, issueData } = params2;
       const fullPath = [...path, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
@@ -531,17 +971,17 @@ var init_errorUtil = __esm({
 });
 
 // node_modules/zod/v3/types.js
-function processCreateParams(params) {
-  if (!params)
+function processCreateParams(params2) {
+  if (!params2)
     return {};
-  const { errorMap: errorMap2, invalid_type_error, required_error, description } = params;
+  const { errorMap: errorMap2, invalid_type_error, required_error, description } = params2;
   if (errorMap2 && (invalid_type_error || required_error)) {
     throw new Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);
   }
   if (errorMap2)
     return { errorMap: errorMap2, description };
   const customMap = (iss, ctx) => {
-    const { message } = params;
+    const { message } = params2;
     if (iss.code === "invalid_enum_value") {
       return { message: message ?? ctx.defaultError };
     }
@@ -688,15 +1128,15 @@ function mergeValues(a, b) {
     return { valid: false };
   }
 }
-function createZodEnum(values, params) {
+function createZodEnum(values, params2) {
   return new ZodEnum({
     values,
     typeName: ZodFirstPartyTypeKind.ZodEnum,
-    ...processCreateParams(params)
+    ...processCreateParams(params2)
   });
 }
-function cleanParams(params, data) {
-  const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
+function cleanParams(params2, data) {
+  const p = typeof params2 === "function" ? params2(data) : typeof params2 === "string" ? { message: params2 } : params2;
   const p2 = typeof p === "string" ? { message: p } : p;
   return p2;
 }
@@ -707,16 +1147,16 @@ function custom(check, _params = {}, fatal) {
       if (r instanceof Promise) {
         return r.then((r2) => {
           if (!r2) {
-            const params = cleanParams(_params, data);
-            const _fatal = params.fatal ?? fatal ?? true;
-            ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+            const params2 = cleanParams(_params, data);
+            const _fatal = params2.fatal ?? fatal ?? true;
+            ctx.addIssue({ code: "custom", ...params2, fatal: _fatal });
           }
         });
       }
       if (!r) {
-        const params = cleanParams(_params, data);
-        const _fatal = params.fatal ?? fatal ?? true;
-        ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+        const params2 = cleanParams(_params, data);
+        const _fatal = params2.fatal ?? fatal ?? true;
+        ctx.addIssue({ code: "custom", ...params2, fatal: _fatal });
       }
       return;
     });
@@ -809,20 +1249,20 @@ var init_types = __esm({
         const result = this._parse(input);
         return Promise.resolve(result);
       }
-      parse(data, params) {
-        const result = this.safeParse(data, params);
+      parse(data, params2) {
+        const result = this.safeParse(data, params2);
         if (result.success)
           return result.data;
         throw result.error;
       }
-      safeParse(data, params) {
+      safeParse(data, params2) {
         const ctx = {
           common: {
             issues: [],
-            async: params?.async ?? false,
-            contextualErrorMap: params?.errorMap
+            async: params2?.async ?? false,
+            contextualErrorMap: params2?.errorMap
           },
-          path: params?.path || [],
+          path: params2?.path || [],
           schemaErrorMap: this._def.errorMap,
           parent: null,
           data,
@@ -867,20 +1307,20 @@ var init_types = __esm({
           issues: ctx.common.issues
         });
       }
-      async parseAsync(data, params) {
-        const result = await this.safeParseAsync(data, params);
+      async parseAsync(data, params2) {
+        const result = await this.safeParseAsync(data, params2);
         if (result.success)
           return result.data;
         throw result.error;
       }
-      async safeParseAsync(data, params) {
+      async safeParseAsync(data, params2) {
         const ctx = {
           common: {
             issues: [],
-            contextualErrorMap: params?.errorMap,
+            contextualErrorMap: params2?.errorMap,
             async: true
           },
-          path: params?.path || [],
+          path: params2?.path || [],
           schemaErrorMap: this._def.errorMap,
           parent: null,
           data,
@@ -1606,12 +2046,12 @@ var init_types = __esm({
         return max;
       }
     };
-    ZodString.create = (params) => {
+    ZodString.create = (params2) => {
       return new ZodString({
         checks: [],
         typeName: ZodFirstPartyTypeKind.ZodString,
-        coerce: params?.coerce ?? false,
-        ...processCreateParams(params)
+        coerce: params2?.coerce ?? false,
+        ...processCreateParams(params2)
       });
     };
     ZodNumber = class _ZodNumber extends ZodType {
@@ -1838,12 +2278,12 @@ var init_types = __esm({
         return Number.isFinite(min) && Number.isFinite(max);
       }
     };
-    ZodNumber.create = (params) => {
+    ZodNumber.create = (params2) => {
       return new ZodNumber({
         checks: [],
         typeName: ZodFirstPartyTypeKind.ZodNumber,
-        coerce: params?.coerce || false,
-        ...processCreateParams(params)
+        coerce: params2?.coerce || false,
+        ...processCreateParams(params2)
       });
     };
     ZodBigInt = class _ZodBigInt extends ZodType {
@@ -2010,12 +2450,12 @@ var init_types = __esm({
         return max;
       }
     };
-    ZodBigInt.create = (params) => {
+    ZodBigInt.create = (params2) => {
       return new ZodBigInt({
         checks: [],
         typeName: ZodFirstPartyTypeKind.ZodBigInt,
-        coerce: params?.coerce ?? false,
-        ...processCreateParams(params)
+        coerce: params2?.coerce ?? false,
+        ...processCreateParams(params2)
       });
     };
     ZodBoolean = class extends ZodType {
@@ -2036,11 +2476,11 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodBoolean.create = (params) => {
+    ZodBoolean.create = (params2) => {
       return new ZodBoolean({
         typeName: ZodFirstPartyTypeKind.ZodBoolean,
-        coerce: params?.coerce || false,
-        ...processCreateParams(params)
+        coerce: params2?.coerce || false,
+        ...processCreateParams(params2)
       });
     };
     ZodDate = class _ZodDate extends ZodType {
@@ -2144,12 +2584,12 @@ var init_types = __esm({
         return max != null ? new Date(max) : null;
       }
     };
-    ZodDate.create = (params) => {
+    ZodDate.create = (params2) => {
       return new ZodDate({
         checks: [],
-        coerce: params?.coerce || false,
+        coerce: params2?.coerce || false,
         typeName: ZodFirstPartyTypeKind.ZodDate,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodSymbol = class extends ZodType {
@@ -2167,10 +2607,10 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodSymbol.create = (params) => {
+    ZodSymbol.create = (params2) => {
       return new ZodSymbol({
         typeName: ZodFirstPartyTypeKind.ZodSymbol,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodUndefined = class extends ZodType {
@@ -2188,10 +2628,10 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodUndefined.create = (params) => {
+    ZodUndefined.create = (params2) => {
       return new ZodUndefined({
         typeName: ZodFirstPartyTypeKind.ZodUndefined,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodNull = class extends ZodType {
@@ -2209,10 +2649,10 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodNull.create = (params) => {
+    ZodNull.create = (params2) => {
       return new ZodNull({
         typeName: ZodFirstPartyTypeKind.ZodNull,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodAny = class extends ZodType {
@@ -2224,10 +2664,10 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodAny.create = (params) => {
+    ZodAny.create = (params2) => {
       return new ZodAny({
         typeName: ZodFirstPartyTypeKind.ZodAny,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodUnknown = class extends ZodType {
@@ -2239,10 +2679,10 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodUnknown.create = (params) => {
+    ZodUnknown.create = (params2) => {
       return new ZodUnknown({
         typeName: ZodFirstPartyTypeKind.ZodUnknown,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodNever = class extends ZodType {
@@ -2256,10 +2696,10 @@ var init_types = __esm({
         return INVALID;
       }
     };
-    ZodNever.create = (params) => {
+    ZodNever.create = (params2) => {
       return new ZodNever({
         typeName: ZodFirstPartyTypeKind.ZodNever,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodVoid = class extends ZodType {
@@ -2277,10 +2717,10 @@ var init_types = __esm({
         return OK(input.data);
       }
     };
-    ZodVoid.create = (params) => {
+    ZodVoid.create = (params2) => {
       return new ZodVoid({
         typeName: ZodFirstPartyTypeKind.ZodVoid,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodArray = class _ZodArray extends ZodType {
@@ -2374,14 +2814,14 @@ var init_types = __esm({
         return this.min(1, message);
       }
     };
-    ZodArray.create = (schema, params) => {
+    ZodArray.create = (schema, params2) => {
       return new ZodArray({
         type: schema,
         minLength: null,
         maxLength: null,
         exactLength: null,
         typeName: ZodFirstPartyTypeKind.ZodArray,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodObject = class _ZodObject extends ZodType {
@@ -2695,31 +3135,31 @@ var init_types = __esm({
         return createZodEnum(util.objectKeys(this.shape));
       }
     };
-    ZodObject.create = (shape, params) => {
+    ZodObject.create = (shape, params2) => {
       return new ZodObject({
         shape: () => shape,
         unknownKeys: "strip",
         catchall: ZodNever.create(),
         typeName: ZodFirstPartyTypeKind.ZodObject,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
-    ZodObject.strictCreate = (shape, params) => {
+    ZodObject.strictCreate = (shape, params2) => {
       return new ZodObject({
         shape: () => shape,
         unknownKeys: "strict",
         catchall: ZodNever.create(),
         typeName: ZodFirstPartyTypeKind.ZodObject,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
-    ZodObject.lazycreate = (shape, params) => {
+    ZodObject.lazycreate = (shape, params2) => {
       return new ZodObject({
         shape,
         unknownKeys: "strip",
         catchall: ZodNever.create(),
         typeName: ZodFirstPartyTypeKind.ZodObject,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodUnion = class extends ZodType {
@@ -2806,11 +3246,11 @@ var init_types = __esm({
         return this._def.options;
       }
     };
-    ZodUnion.create = (types, params) => {
+    ZodUnion.create = (types, params2) => {
       return new ZodUnion({
         options: types,
         typeName: ZodFirstPartyTypeKind.ZodUnion,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     getDiscriminator = (type) => {
@@ -2897,7 +3337,7 @@ var init_types = __esm({
        * @param types an array of object schemas
        * @param params
        */
-      static create(discriminator, options, params) {
+      static create(discriminator, options, params2) {
         const optionsMap = /* @__PURE__ */ new Map();
         for (const type of options) {
           const discriminatorValues = getDiscriminator(type.shape[discriminator]);
@@ -2916,7 +3356,7 @@ var init_types = __esm({
           discriminator,
           options,
           optionsMap,
-          ...processCreateParams(params)
+          ...processCreateParams(params2)
         });
       }
     };
@@ -2965,12 +3405,12 @@ var init_types = __esm({
         }
       }
     };
-    ZodIntersection.create = (left, right, params) => {
+    ZodIntersection.create = (left, right, params2) => {
       return new ZodIntersection({
         left,
         right,
         typeName: ZodFirstPartyTypeKind.ZodIntersection,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodTuple = class _ZodTuple extends ZodType {
@@ -3029,7 +3469,7 @@ var init_types = __esm({
         });
       }
     };
-    ZodTuple.create = (schemas, params) => {
+    ZodTuple.create = (schemas, params2) => {
       if (!Array.isArray(schemas)) {
         throw new Error("You must pass an array of schemas to z.tuple([ ... ])");
       }
@@ -3037,7 +3477,7 @@ var init_types = __esm({
         items: schemas,
         typeName: ZodFirstPartyTypeKind.ZodTuple,
         rest: null,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodRecord = class _ZodRecord extends ZodType {
@@ -3151,12 +3591,12 @@ var init_types = __esm({
         }
       }
     };
-    ZodMap.create = (keyType, valueType, params) => {
+    ZodMap.create = (keyType, valueType, params2) => {
       return new ZodMap({
         valueType,
         keyType,
         typeName: ZodFirstPartyTypeKind.ZodMap,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodSet = class _ZodSet extends ZodType {
@@ -3235,13 +3675,13 @@ var init_types = __esm({
         return this.min(1, message);
       }
     };
-    ZodSet.create = (valueType, params) => {
+    ZodSet.create = (valueType, params2) => {
       return new ZodSet({
         valueType,
         minSize: null,
         maxSize: null,
         typeName: ZodFirstPartyTypeKind.ZodSet,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodFunction = class _ZodFunction extends ZodType {
@@ -3281,18 +3721,18 @@ var init_types = __esm({
             }
           });
         }
-        const params = { errorMap: ctx.common.contextualErrorMap };
+        const params2 = { errorMap: ctx.common.contextualErrorMap };
         const fn = ctx.data;
         if (this._def.returns instanceof ZodPromise) {
           const me = this;
           return OK(async function(...args) {
             const error = new ZodError([]);
-            const parsedArgs = await me._def.args.parseAsync(args, params).catch((e) => {
+            const parsedArgs = await me._def.args.parseAsync(args, params2).catch((e) => {
               error.addIssue(makeArgsIssue(args, e));
               throw error;
             });
             const result = await Reflect.apply(fn, this, parsedArgs);
-            const parsedReturns = await me._def.returns._def.type.parseAsync(result, params).catch((e) => {
+            const parsedReturns = await me._def.returns._def.type.parseAsync(result, params2).catch((e) => {
               error.addIssue(makeReturnsIssue(result, e));
               throw error;
             });
@@ -3301,12 +3741,12 @@ var init_types = __esm({
         } else {
           const me = this;
           return OK(function(...args) {
-            const parsedArgs = me._def.args.safeParse(args, params);
+            const parsedArgs = me._def.args.safeParse(args, params2);
             if (!parsedArgs.success) {
               throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
             }
             const result = Reflect.apply(fn, this, parsedArgs.data);
-            const parsedReturns = me._def.returns.safeParse(result, params);
+            const parsedReturns = me._def.returns.safeParse(result, params2);
             if (!parsedReturns.success) {
               throw new ZodError([makeReturnsIssue(result, parsedReturns.error)]);
             }
@@ -3340,12 +3780,12 @@ var init_types = __esm({
         const validatedFunc = this.parse(func);
         return validatedFunc;
       }
-      static create(args, returns, params) {
+      static create(args, returns, params2) {
         return new _ZodFunction({
           args: args ? args : ZodTuple.create([]).rest(ZodUnknown.create()),
           returns: returns || ZodUnknown.create(),
           typeName: ZodFirstPartyTypeKind.ZodFunction,
-          ...processCreateParams(params)
+          ...processCreateParams(params2)
         });
       }
     };
@@ -3359,11 +3799,11 @@ var init_types = __esm({
         return lazySchema._parse({ data: ctx.data, path: ctx.path, parent: ctx });
       }
     };
-    ZodLazy.create = (getter, params) => {
+    ZodLazy.create = (getter, params2) => {
       return new ZodLazy({
         getter,
         typeName: ZodFirstPartyTypeKind.ZodLazy,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodLiteral = class extends ZodType {
@@ -3383,11 +3823,11 @@ var init_types = __esm({
         return this._def.value;
       }
     };
-    ZodLiteral.create = (value, params) => {
+    ZodLiteral.create = (value, params2) => {
       return new ZodLiteral({
         value,
         typeName: ZodFirstPartyTypeKind.ZodLiteral,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodEnum = class _ZodEnum extends ZodType {
@@ -3486,11 +3926,11 @@ var init_types = __esm({
         return this._def.values;
       }
     };
-    ZodNativeEnum.create = (values, params) => {
+    ZodNativeEnum.create = (values, params2) => {
       return new ZodNativeEnum({
         values,
         typeName: ZodFirstPartyTypeKind.ZodNativeEnum,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodPromise = class extends ZodType {
@@ -3516,11 +3956,11 @@ var init_types = __esm({
         }));
       }
     };
-    ZodPromise.create = (schema, params) => {
+    ZodPromise.create = (schema, params2) => {
       return new ZodPromise({
         type: schema,
         typeName: ZodFirstPartyTypeKind.ZodPromise,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodEffects = class extends ZodType {
@@ -3646,20 +4086,20 @@ var init_types = __esm({
         util.assertNever(effect);
       }
     };
-    ZodEffects.create = (schema, effect, params) => {
+    ZodEffects.create = (schema, effect, params2) => {
       return new ZodEffects({
         schema,
         typeName: ZodFirstPartyTypeKind.ZodEffects,
         effect,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
-    ZodEffects.createWithPreprocess = (preprocess, schema, params) => {
+    ZodEffects.createWithPreprocess = (preprocess, schema, params2) => {
       return new ZodEffects({
         schema,
         effect: { type: "preprocess", transform: preprocess },
         typeName: ZodFirstPartyTypeKind.ZodEffects,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodOptional = class extends ZodType {
@@ -3674,11 +4114,11 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodOptional.create = (type, params) => {
+    ZodOptional.create = (type, params2) => {
       return new ZodOptional({
         innerType: type,
         typeName: ZodFirstPartyTypeKind.ZodOptional,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodNullable = class extends ZodType {
@@ -3693,11 +4133,11 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodNullable.create = (type, params) => {
+    ZodNullable.create = (type, params2) => {
       return new ZodNullable({
         innerType: type,
         typeName: ZodFirstPartyTypeKind.ZodNullable,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     ZodDefault = class extends ZodType {
@@ -3717,12 +4157,12 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodDefault.create = (type, params) => {
+    ZodDefault.create = (type, params2) => {
       return new ZodDefault({
         innerType: type,
         typeName: ZodFirstPartyTypeKind.ZodDefault,
-        defaultValue: typeof params.default === "function" ? params.default : () => params.default,
-        ...processCreateParams(params)
+        defaultValue: typeof params2.default === "function" ? params2.default : () => params2.default,
+        ...processCreateParams(params2)
       });
     };
     ZodCatch = class extends ZodType {
@@ -3770,12 +4210,12 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodCatch.create = (type, params) => {
+    ZodCatch.create = (type, params2) => {
       return new ZodCatch({
         innerType: type,
         typeName: ZodFirstPartyTypeKind.ZodCatch,
-        catchValue: typeof params.catch === "function" ? params.catch : () => params.catch,
-        ...processCreateParams(params)
+        catchValue: typeof params2.catch === "function" ? params2.catch : () => params2.catch,
+        ...processCreateParams(params2)
       });
     };
     ZodNaN = class extends ZodType {
@@ -3793,10 +4233,10 @@ var init_types = __esm({
         return { status: "valid", value: input.data };
       }
     };
-    ZodNaN.create = (params) => {
+    ZodNaN.create = (params2) => {
       return new ZodNaN({
         typeName: ZodFirstPartyTypeKind.ZodNaN,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     BRAND = Symbol("zod_brand");
@@ -3884,11 +4324,11 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodReadonly.create = (type, params) => {
+    ZodReadonly.create = (type, params2) => {
       return new ZodReadonly({
         innerType: type,
         typeName: ZodFirstPartyTypeKind.ZodReadonly,
-        ...processCreateParams(params)
+        ...processCreateParams(params2)
       });
     };
     late = {
@@ -3932,9 +4372,9 @@ var init_types = __esm({
       ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
       ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
     })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
-    instanceOfType = (cls, params = {
+    instanceOfType = (cls, params2 = {
       message: `Input not instance of ${cls.name}`
-    }) => custom((data) => data instanceof cls, params);
+    }) => custom((data) => data instanceof cls, params2);
     stringType = ZodString.create;
     numberType = ZodNumber.create;
     nanType = ZodNaN.create;
@@ -4119,29 +4559,26 @@ var init_zod = __esm({
 // src/config.ts
 import * as nodeFs from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, parse, resolve } from "node:path";
-function daemonMode(config) {
-  return config.daemon?.mode ?? "embedded";
-}
+import { dirname as dirname2, isAbsolute, join as join2, parse, resolve as resolve2 } from "node:path";
 function defaultConfig(home = homedir()) {
   return {
     version: 1,
     brokerUrl: "wss://broker1.ours.network",
-    stateDir: resolve(home, ".ours-cowork"),
+    stateDir: resolve2(home, ".ours-cowork"),
     rest: { enabled: true, port: 3052 }
   };
 }
 function loadConfig(env = process.env, io = {}) {
-  const fs3 = io.fs ?? nodeFs;
+  const fs2 = io.fs ?? nodeFs;
   const defaults = defaultConfig(io.home);
-  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
+  const configPath = resolve2(env.OURS_COWORK_CONFIG ?? join2(io.home ?? homedir(), ".ours-cowork", "config.json"));
   let file = defaults;
-  const stat = lstatIfPresent(fs3, configPath);
+  const stat = lstatIfPresent(fs2, configPath);
   if (stat) {
-    assertSecureFile(fs3, configPath, "config file");
+    assertSecureFile(fs2, configPath, "config file");
     let parsed;
     try {
-      parsed = JSON.parse(readSecureFile(fs3, configPath, "config file").toString("utf8"));
+      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
     } catch (error) {
       throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
     }
@@ -4154,100 +4591,42 @@ function loadConfig(env = process.env, io = {}) {
     throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
   }
   const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
-  const daemon = mergeDaemonSelection(env, file.daemon);
   try {
     return CoworkConfigSchema.parse({
       version: 1,
       brokerUrl: env.OURS_COWORK_BROKER_URL ?? file.brokerUrl,
-      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
+      stateDir: resolve2(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
       rest: {
         enabled: restPort === void 0 ? file.rest.enabled : true,
         port: restPort ?? file.rest.port
-      },
-      ...daemon === void 0 ? {} : { daemon }
+      }
     });
   } catch (error) {
     throw new CoworkConfigError("invalid effective cowork config", { cause: error });
   }
 }
-function mergeDaemonSelection(env, file) {
-  const mode = env.OURS_COWORK_DAEMON_MODE;
-  const endpoint = env.OURS_COWORK_DAEMON_ENDPOINT;
-  const stateDir = env.OURS_COWORK_DAEMON_STATE_DIR;
-  if (mode === void 0 && endpoint === void 0 && stateDir === void 0) return file;
-  if (mode !== void 0 && mode !== "embedded" && mode !== "external") {
-    throw new CoworkConfigError('OURS_COWORK_DAEMON_MODE must be "embedded" or "external"');
-  }
-  const effectiveMode = mode ?? file?.mode ?? "external";
-  if (effectiveMode === "embedded") {
-    if (endpoint !== void 0 || stateDir !== void 0) {
-      throw new CoworkConfigError(
-        'OURS_COWORK_DAEMON_ENDPOINT and OURS_COWORK_DAEMON_STATE_DIR require daemon mode "external"'
-      );
-    }
-    return { mode: "embedded" };
-  }
-  const effectiveEndpoint = endpoint ?? file?.endpoint;
-  const effectiveStateDir = stateDir ?? file?.stateDir;
-  return {
-    mode: "external",
-    ...effectiveEndpoint === void 0 ? {} : { endpoint: effectiveEndpoint },
-    ...effectiveStateDir === void 0 ? {} : { stateDir: effectiveStateDir }
-  };
-}
-function isDaemonOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && (url.pathname === "" || url.pathname === "/");
-}
-function isConfidentialDaemonEndpoint(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" || isLoopbackHost(url.hostname);
-}
-function isLoopbackHost(hostname) {
-  const host = hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
-  if (host === "localhost") return true;
-  if (host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
-  const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-  if (!octets) return false;
-  const parts = octets.slice(1).map(Number);
-  return parts.every((part) => part <= 255) && parts[0] === 127;
-}
-function normalizeDaemonEndpoint(value) {
-  const url = new URL(value);
-  return `${url.protocol}//${url.host}`;
-}
 function ensureRuntimeState(config, io = {}) {
   const parsed = CoworkConfigSchema.parse(config);
-  const fs3 = io.fs ?? nodeFs;
-  const stateDir = resolve(parsed.stateDir);
-  assertSecureAncestors(fs3, stateDir, "state directory");
-  const existing = lstatIfPresent(fs3, stateDir);
+  const fs2 = io.fs ?? nodeFs;
+  const stateDir = resolve2(parsed.stateDir);
+  assertSecureAncestors(fs2, stateDir, "state directory");
+  const existing = lstatIfPresent(fs2, stateDir);
   if (!existing) {
-    createSecureDirectoryTree(fs3, stateDir, "state directory");
+    createSecureDirectoryTree(fs2, stateDir, "state directory");
   }
-  assertSecureDirectory(fs3, stateDir, "state directory");
-  const roomsPath = join(stateDir, "rooms");
-  const rooms = lstatIfPresent(fs3, roomsPath);
+  assertSecureDirectory(fs2, stateDir, "state directory");
+  const roomsPath = join2(stateDir, "rooms");
+  const rooms = lstatIfPresent(fs2, roomsPath);
   if (!rooms) {
-    fs3.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs3, roomsPath, "rooms directory");
-    fsyncDirectory(fs3, stateDir);
+    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
+    fsyncDirectory(fs2, stateDir);
   }
-  assertSecureDirectory(fs3, roomsPath, "rooms directory");
+  assertSecureDirectory(fs2, roomsPath, "rooms directory");
   return {
-    socketPath: join(stateDir, "management.sock"),
-    pidPath: join(stateDir, "daemon.pid"),
-    lockPath: join(stateDir, "daemon.lock")
+    socketPath: join2(stateDir, "management.sock"),
+    pidPath: join2(stateDir, "daemon.pid"),
+    lockPath: join2(stateDir, "daemon.lock")
   };
 }
 function parsePort(value) {
@@ -4258,15 +4637,15 @@ function parsePort(value) {
   if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
   return port;
 }
-function assertSecureAncestors(fs3, path, label) {
-  const absolute = isAbsolute(path) ? path : resolve(path);
+function assertSecureAncestors(fs2, path, label) {
+  const absolute = isAbsolute(path) ? path : resolve2(path);
   const root = parse(absolute).root;
-  const rootOwner = fs3.lstatSync(root).uid;
+  const rootOwner = fs2.lstatSync(root).uid;
   let cursor = root;
   const components = absolute.slice(root.length).split("/").filter(Boolean);
   for (const [index, component] of components.entries()) {
-    cursor = join(cursor, component);
-    const stat = lstatIfPresent(fs3, cursor);
+    cursor = join2(cursor, component);
+    const stat = lstatIfPresent(fs2, cursor);
     if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
     if (!stat) break;
     if (!stat.isDirectory()) {
@@ -4285,39 +4664,39 @@ function assertTrustedAncestor(stat, rootOwner, path, label) {
     throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
   }
 }
-function createSecureDirectoryTree(fs3, path, label) {
+function createSecureDirectoryTree(fs2, path, label) {
   const missing = [];
   let cursor = path;
-  while (!lstatIfPresent(fs3, cursor)) {
+  while (!lstatIfPresent(fs2, cursor)) {
     missing.push(cursor);
-    const parent = dirname(cursor);
+    const parent = dirname2(cursor);
     if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
     cursor = parent;
   }
-  assertSecureAncestors(fs3, path, label);
+  assertSecureAncestors(fs2, path, label);
   for (const directory of missing.reverse()) {
-    fs3.mkdirSync(directory, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs3, directory, label);
-    fsyncDirectory(fs3, dirname(directory));
+    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, directory, label);
+    fsyncDirectory(fs2, dirname2(directory));
   }
 }
-function secureOpenedDirectory(fs3, path, label) {
+function secureOpenedDirectory(fs2, path, label) {
   let fd;
   try {
-    fd = fs3.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs3.fstatSync(fd);
-    const current = fs3.lstatSync(path);
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
     if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
       throw new CoworkConfigError(`${label} changed while opening`);
     }
-    fs3.fchmodSync(fd, DIRECTORY_MODE);
-    fs3.fsyncSync(fd);
+    fs2.fchmodSync(fd, DIRECTORY_MODE);
+    fs2.fsyncSync(fd);
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function assertSecureDirectory(fs3, path, label) {
-  const stat = fs3.lstatSync(path);
+function assertSecureDirectory(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
   if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
   if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
   if ((stat.mode & 511) !== DIRECTORY_MODE) {
@@ -4325,8 +4704,8 @@ function assertSecureDirectory(fs3, path, label) {
   }
   assertOwner(stat, label);
 }
-function assertSecureFile(fs3, path, label) {
-  const stat = fs3.lstatSync(path);
+function assertSecureFile(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
   if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
   if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
   if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
@@ -4337,38 +4716,38 @@ function assertOwner(stat, label) {
     throw new CoworkConfigError(`${label} must be owned by the current user`);
   }
 }
-function readSecureFile(fs3, path, label) {
+function readSecureFile(fs2, path, label) {
   let fd;
   try {
-    fd = fs3.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs3.fstatSync(fd);
-    const current = fs3.lstatSync(path);
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
     if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
       throw new CoworkConfigError(`${label} changed while opening`);
     }
-    return fs3.readFileSync(fd);
+    return fs2.readFileSync(fd);
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function fsyncDirectory(fs3, path) {
+function fsyncDirectory(fs2, path) {
   let fd;
   try {
-    fd = fs3.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    fs3.fsyncSync(fd);
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    fs2.fsyncSync(fd);
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function lstatIfPresent(fs3, path) {
+function lstatIfPresent(fs2, path) {
   try {
-    return fs3.lstatSync(path);
+    return fs2.lstatSync(path);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
 }
-var DIRECTORY_MODE, FILE_MODE, NO_FOLLOW, CoworkDaemonSchema, CoworkConfigSchema, CoworkConfigError;
+var DIRECTORY_MODE, FILE_MODE, NO_FOLLOW, CoworkConfigSchema, CoworkConfigError;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -4376,33 +4755,6 @@ var init_config = __esm({
     DIRECTORY_MODE = 448;
     FILE_MODE = 384;
     NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
-    CoworkDaemonSchema = external_exports.object({
-      mode: external_exports.enum(["embedded", "external"]),
-      endpoint: external_exports.string().url().refine(isDaemonOrigin, "daemon.endpoint must be an http(s) origin with no credentials, path, query, or fragment").refine(isConfidentialDaemonEndpoint, "daemon.endpoint must use https:// unless the daemon is on this host (http:// is allowed only for localhost, 127.0.0.0/8, or [::1])").transform(normalizeDaemonEndpoint).optional(),
-      stateDir: external_exports.string().min(1).transform((value) => resolve(value)).optional()
-    }).strict().superRefine((value, ctx) => {
-      if (value.mode === "external") {
-        for (const field of ["endpoint", "stateDir"]) {
-          if (value[field] === void 0) {
-            ctx.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [field],
-              message: `daemon.${field} is required when daemon.mode is "external"`
-            });
-          }
-        }
-        return;
-      }
-      for (const field of ["endpoint", "stateDir"]) {
-        if (value[field] !== void 0) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [field],
-            message: `daemon.${field} is only valid when daemon.mode is "external"`
-          });
-        }
-      }
-    });
     CoworkConfigSchema = external_exports.object({
       version: external_exports.literal(1),
       brokerUrl: external_exports.string().url().refine((value) => {
@@ -4413,10 +4765,7 @@ var init_config = __esm({
       rest: external_exports.object({
         enabled: external_exports.boolean(),
         port: external_exports.number().int().min(1).max(65535)
-      }).strict(),
-      // Absent unless an operator selected a daemon explicitly, so an untouched
-      // deployment keeps producing byte-identical effective configuration.
-      daemon: CoworkDaemonSchema.optional()
+      }).strict()
     }).strict();
     CoworkConfigError = class extends Error {
       constructor(message, options) {
@@ -4427,271 +4776,6 @@ var init_config = __esm({
   }
 });
 
-// src/ours-runtime.ts
-import { randomBytes } from "node:crypto";
-import * as fs from "node:fs";
-import { join as join2, resolve as resolve2 } from "node:path";
-function createOursHost(config, log = () => {
-}) {
-  return daemonMode(config) === "external" ? new ExternalOursHost(config, log) : new EmbeddedOursHost(config, log);
-}
-function sleep(ms, signal) {
-  return new Promise((resolveSleep) => {
-    const timer = setTimeout(finish, ms);
-    signal.addEventListener("abort", finish, { once: true });
-    function finish() {
-      clearTimeout(timer);
-      signal.removeEventListener("abort", finish);
-      resolveSleep();
-    }
-  });
-}
-function sdkRuntimeStateDir(config) {
-  return resolve2(config.stateDir, "ours-sdk");
-}
-function configureOwnedSdkEnvironment(config) {
-  const stateDir = sdkRuntimeStateDir(config);
-  fs.mkdirSync(stateDir, { recursive: true, mode: 448 });
-  fs.chmodSync(stateDir, 448);
-  process.env.OURS_CONFIG = join2(stateDir, "config.json");
-  process.env.OURS_STATE_DIR = stateDir;
-  process.env.OURS_BROKER_URL = config.brokerUrl;
-  process.env.OURS_PORT = "0";
-  process.env.OURS_API_VISIBILITY = "owner";
-  process.env.OURS_TRANSPORT = "http";
-  process.env.OURS_AUTOSTART = "false";
-  process.env.OURS_GC_INTERVAL_MS = "3600000";
-  delete process.env.OURS_API_TOKEN;
-  return stateDir;
-}
-var WATCH_RETRY_MIN_MS, WATCH_RETRY_MAX_MS, EmbeddedOursHost, ExternalOursHost;
-var init_ours_runtime = __esm({
-  "src/ours-runtime.ts"() {
-    "use strict";
-    init_config();
-    WATCH_RETRY_MIN_MS = 500;
-    WATCH_RETRY_MAX_MS = 3e4;
-    EmbeddedOursHost = class {
-      config;
-      log;
-      listeners = /* @__PURE__ */ new Set();
-      handle;
-      Client;
-      apiToken;
-      closed = false;
-      constructor(config, log = () => {
-      }) {
-        this.config = config;
-        this.log = log;
-      }
-      async boot() {
-        if (this.handle) return;
-        if (this.closed) throw new Error("embedded ours SDK runtime cannot restart in the same process");
-        const runtimeDir = configureOwnedSdkEnvironment(this.config);
-        let handle;
-        try {
-          const [{ OursClient }, { startDaemon }] = await Promise.all([
-            import("@ours.network/sdk"),
-            import("@ours.network/sdk/daemon")
-          ]);
-          handle = await startDaemon({
-            version: "@ours.network/cowork@vNext",
-            handleSignals: false,
-            onIdentityNotify: (identityName) => {
-              for (const listener of this.listeners) {
-                try {
-                  listener(identityName);
-                } catch (error) {
-                  this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
-                }
-              }
-            }
-          });
-          const tokenPath = join2(runtimeDir, "daemon-token");
-          const apiToken = fs.readFileSync(tokenPath, "utf8").trim();
-          if (!apiToken) throw new Error("embedded ours SDK runtime created an empty owner token");
-          this.Client = OursClient;
-          this.apiToken = apiToken;
-          this.handle = handle;
-        } catch (error) {
-          await handle?.close();
-          throw new Error("failed to start the embedded ours SDK runtime", { cause: error });
-        }
-      }
-      createClient(leaseToken = `cowork-${randomBytes(16).toString("hex")}`) {
-        if (!this.handle || !this.Client || !this.apiToken) {
-          throw new Error("embedded ours SDK runtime is not booted");
-        }
-        return new this.Client({
-          url: `http://127.0.0.1:${this.handle.port}`,
-          leaseToken,
-          apiToken: this.apiToken
-        });
-      }
-      onIdentityNotify(listener) {
-        this.listeners.add(listener);
-        return () => this.listeners.delete(listener);
-      }
-      close() {
-      }
-      async shutdown() {
-        if (this.closed) return { requiresProcessExit: true };
-        this.closed = true;
-        const handle = this.handle;
-        this.handle = void 0;
-        this.Client = void 0;
-        this.apiToken = void 0;
-        this.listeners.clear();
-        await handle?.close();
-        return { requiresProcessExit: true };
-      }
-    };
-    ExternalOursHost = class {
-      endpoint;
-      daemonStateDir;
-      log;
-      listeners = /* @__PURE__ */ new Set();
-      watchers = /* @__PURE__ */ new Map();
-      watchLeaseToken = `cowork-watch-${randomBytes(16).toString("hex")}`;
-      Client;
-      resolved;
-      watchClient;
-      closed = false;
-      constructor(config, log = () => {
-      }) {
-        const daemon = config.daemon;
-        if (daemon?.mode !== "external" || daemon.endpoint === void 0 || daemon.stateDir === void 0) {
-          throw new Error("external ours daemon mode requires both daemon.endpoint and daemon.stateDir");
-        }
-        this.endpoint = daemon.endpoint;
-        this.daemonStateDir = daemon.stateDir;
-        this.log = log;
-      }
-      async boot() {
-        if (this.resolved) return;
-        if (this.closed) throw new Error("external ours daemon host cannot restart in the same process");
-        const { OursClient, resolveDaemonConfig, assertDaemonStateDir } = await import("@ours.network/sdk");
-        let resolved;
-        try {
-          resolved = resolveDaemonConfig({ endpoint: this.endpoint, expectStateDir: this.daemonStateDir });
-        } catch (error) {
-          throw new Error(`cowork cannot select the external ours daemon at ${this.endpoint}`, { cause: error });
-        }
-        try {
-          await assertDaemonStateDir(resolved);
-        } catch (error) {
-          throw new Error(
-            `the external ours daemon at ${this.endpoint} is unavailable or does not own ${this.daemonStateDir}`,
-            { cause: error }
-          );
-        }
-        this.Client = OursClient;
-        this.resolved = resolved;
-        this.watchClient = this.createClient(this.watchLeaseToken);
-      }
-      createClient(leaseToken = `cowork-${randomBytes(16).toString("hex")}`) {
-        if (!this.Client || !this.resolved) throw new Error("external ours daemon host is not booted");
-        return new this.Client({
-          url: this.resolved.baseUrl.value,
-          leaseToken,
-          ...this.resolved.token === void 0 ? {} : { apiToken: this.resolved.token.value }
-        });
-      }
-      onIdentityNotify(listener) {
-        this.listeners.add(listener);
-        return () => this.listeners.delete(listener);
-      }
-      trackIdentity(identityName) {
-        if (!this.watchClient) throw new Error("external ours daemon host is not booted");
-        const existing = this.watchers.get(identityName);
-        if (existing) return () => this.untrack(identityName, existing);
-        const controller = new AbortController();
-        const watcher = { controller, work: Promise.resolve() };
-        watcher.work = this.follow(identityName, controller.signal);
-        this.watchers.set(identityName, watcher);
-        return () => this.untrack(identityName, watcher);
-      }
-      close() {
-      }
-      async shutdown() {
-        if (this.closed) return { requiresProcessExit: false };
-        this.closed = true;
-        this.listeners.clear();
-        const watchers = [...this.watchers.values()];
-        this.watchers.clear();
-        for (const watcher of watchers) watcher.controller.abort();
-        await Promise.allSettled(watchers.map((watcher) => watcher.work));
-        const client = this.watchClient;
-        this.watchClient = void 0;
-        this.Client = void 0;
-        this.resolved = void 0;
-        if (client) await client.releaseLease().catch(() => {
-        });
-        return { requiresProcessExit: false };
-      }
-      untrack(identityName, watcher) {
-        if (this.watchers.get(identityName) !== watcher) return;
-        this.watchers.delete(identityName);
-        watcher.controller.abort();
-      }
-      /**
-       * Long-poll one identity forever, reconnecting with bounded backoff.
-       *
-       * A watch primes at the daemon's tip, so a reconnected watch never replays
-       * what arrived while it was down. Losing those arrivals would be silent, so
-       * every reconnect announces the identity once. The consumer's reaction to an
-       * announcement is a full state refresh, which is exactly the recovery this
-       * needs; it is idempotent and self-coalescing, so the extra announcement can
-       * only cost one refresh.
-       *
-       * ORDER IS LOAD-BEARING. The resync is issued only AFTER the replacement
-       * watch's request is already in flight, because that request is what fixes
-       * the new tip. Announcing first would read the inbox at T0 and fix the tip at
-       * T1 > T0, and anything arriving in between would be in neither — the very
-       * gap this exists to close. This way every arrival lands in the refresh, on
-       * the stream, or (harmlessly) in both.
-       */
-      async follow(identityName, signal) {
-        let backoffMs = WATCH_RETRY_MIN_MS;
-        let resyncPending = false;
-        while (!signal.aborted) {
-          const client = this.watchClient;
-          if (!client) return;
-          try {
-            const stream = client.watchNotifications(identityName, { signal });
-            let step = stream.next();
-            if (resyncPending) {
-              resyncPending = false;
-              this.announce(identityName);
-            }
-            for (let settled = await step; !settled.done; settled = await step) {
-              backoffMs = WATCH_RETRY_MIN_MS;
-              this.announce(identityName);
-              step = stream.next();
-            }
-          } catch (error) {
-            if (signal.aborted) return;
-            resyncPending = true;
-            this.log(`[${identityName}] external ours daemon notification watch failed:`, error);
-          }
-          if (signal.aborted) return;
-          await sleep(backoffMs, signal);
-          backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
-        }
-      }
-      announce(identityName) {
-        for (const listener of this.listeners) {
-          try {
-            listener(identityName);
-          } catch (error) {
-            this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
-          }
-        }
-      }
-    };
-  }
-});
-
 // src/contracts.ts
 import { createHash } from "node:crypto";
 function utf8Bounded(label, maximumBytes) {
@@ -4721,15 +4805,15 @@ function isStrictRfc3339(value) {
 function normalizeRoomName(value) {
   return value.trim().normalize("NFC");
 }
-function roomIdentityName(roomId) {
-  return `${ROOM_IDENTITY_PREFIX}${LowerCrockfordUlidSchema.parse(roomId)}`;
+function roomIdentityName(roomName) {
+  return `${ROOM_IDENTITY_PREFIX}${RoomNameSchema.parse(roomName)}`;
 }
 function legacyRoomIdentityName(roomId) {
   return `cowork-room-${LowerCrockfordUlidSchema.parse(roomId)}`;
 }
 function refineRoomLineage(room, context) {
   const pendingIdentityName = legacyRoomIdentityName(room.room_id);
-  const currentPendingIdentityName = roomIdentityName(room.room_id);
+  const currentPendingIdentityName = room.room_name === void 0 ? void 0 : roomIdentityName(room.room_name);
   const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && (room.identity_name === pendingIdentityName || room.identity_name === currentPendingIdentityName) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
   if (room.identity_cid === "" && !exactPacketPending) {
     context.addIssue({
@@ -4786,6 +4870,7 @@ function migrateRoomV1(room, mintParticipantId) {
     version: 2,
     mission: { ...room.mission, briefing_version: 1 },
     role_briefings: {},
+    rest_roles: [],
     anonymous: false,
     quiet_membership: false,
     membership_epoch: 0,
@@ -4856,7 +4941,7 @@ function refineMessageCategory(message, context) {
     }
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, RoleSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, RoleSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
@@ -4889,7 +4974,7 @@ var init_contracts = __esm({
         });
       }
     });
-    ROOM_IDENTITY_PREFIX = "ours-cowork-";
+    ROOM_IDENTITY_PREFIX = "ours-cowork-room:";
     RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
     MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
     MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
@@ -5087,6 +5172,13 @@ var init_contracts = __esm({
       version: external_exports.literal(2),
       mission: MissionSchema,
       role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
+      /**
+       * Roles a REST caller may author under (spec §3.1). A plain array of names:
+       * the role name IS the identifier, so there is nothing per-role to store.
+       * Not a seat, not a membership — no invariant here constrains it, because a
+       * role is a label and several speakers may share one.
+       */
+      rest_roles: external_exports.array(RoleSchema),
       anonymous: external_exports.boolean(),
       quiet_membership: external_exports.boolean(),
       membership_epoch: external_exports.number().int().nonnegative().safe(),
@@ -5175,10 +5267,17 @@ var init_contracts = __esm({
       }
     });
     RoomSchema = external_exports.preprocess((value) => {
-      if (typeof value !== "object" || value === null || Object.hasOwn(value, "room_name")) return value;
-      const roomId = value.room_id;
-      if (typeof roomId !== "string" || !LowerCrockfordUlidSchema.safeParse(roomId).success) return value;
-      return { ...value, room_name: defaultRoomName(roomId) };
+      if (typeof value !== "object" || value === null) return value;
+      const patch = {};
+      if (!Object.hasOwn(value, "room_name")) {
+        const roomId = value.room_id;
+        if (typeof roomId === "string" && LowerCrockfordUlidSchema.safeParse(roomId).success) {
+          patch.room_name = defaultRoomName(roomId);
+        }
+      }
+      if (!Object.hasOwn(value, "rest_roles")) patch.rest_roles = [];
+      if (Object.keys(patch).length === 0) return value;
+      return { ...value, ...patch };
     }, CurrentRoomSchema);
     CreateRoomInputSchema = external_exports.object({
       name: RoomNameSchema.optional(),
@@ -5204,6 +5303,13 @@ var init_contracts = __esm({
     PostMessageInputSchema = external_exports.object({
       text: MessageTextSchema
     }).strict();
+    PostAsRoleInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MessageTextSchema
+    }).strict();
+    RestRoleInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
     ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
     AcceptExternalInviteInputSchema = external_exports.object({
       role: RoleSchema,
@@ -5241,10 +5347,6 @@ var init_contracts = __esm({
       participant_id: LowerCrockfordUlidSchema,
       alias: NonEmptyStringSchema
     }).strict();
-    ReplyReferenceSchema = external_exports.object({
-      wire_id: NonEmptyStringSchema,
-      sentence: PositiveSafeIntegerSchema.optional()
-    }).strict();
     MessageShape = {
       kind: external_exports.literal("message"),
       message_id: LowerCrockfordUlidSchema,
@@ -5269,8 +5371,7 @@ var init_contracts = __esm({
         }
       }),
       source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
-      source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
+      source_wire_id: NonEmptyStringSchema.optional()
     };
     RelayIntentShape = {
       kind: external_exports.literal("relay_intent"),
@@ -5313,8 +5414,7 @@ var init_contracts = __esm({
         }
       }),
       source_file_id: external_exports.number().int().nonnegative().safe(),
-      source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
+      source_wire_id: NonEmptyStringSchema.optional()
     };
     MembershipIntentShape = {
       kind: external_exports.literal("membership_intent"),
@@ -5396,93 +5496,217 @@ var init_contracts = __esm({
 });
 
 // src/packets.ts
-import { createHash as createHash2 } from "node:crypto";
-import * as fs2 from "node:fs";
-import { join as join3 } from "node:path";
-import { brotliCompressSync, brotliDecompressSync, constants as zlibConstants } from "node:zlib";
-function sendResult(result) {
-  if (result.kind === "refused" || result.kind === "migrating") return { status: "send_failed" };
-  if (result.kind === "introduced") return { status: "queued" };
-  return { status: "queued", wire_id: result.wireId };
-}
-async function fileItem(file, bytes) {
-  return {
-    file_id: file.file_id,
-    sender_id: file.from.id,
-    sender_name: file.from.name,
-    filename: file.filename,
-    mime: file.mime,
-    data: Buffer.from(bytes),
-    date: normalizeDate(file.date),
-    wire_id: file.wire_id,
-    reply_to: cloneReply(file.reply_to)
-  };
+import { randomBytes } from "node:crypto";
+import * as nodeFs2 from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+function atomicWriteFileSync(target, bytes, ops = nodeFs2) {
+  const temp = `${target}.tmp-${process.pid}-${temporarySequence++}`;
+  let fileFd;
+  let directoryFd;
+  try {
+    fileFd = ops.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_TRUNC | nodeFs2.constants.O_WRONLY, 384);
+    ops.fchmodSync(fileFd, 384);
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      const written = ops.writeSync(fileFd, bytes, offset, bytes.byteLength - offset, null);
+      if (written <= 0) throw new Error(`short write while persisting ${target}`);
+      offset += written;
+    }
+    ops.fsyncSync(fileFd);
+    ops.closeSync(fileFd);
+    fileFd = void 0;
+    ops.renameSync(temp, target);
+    ops.chmodSync(target, 384);
+    directoryFd = ops.openSync(dirname3(target), nodeFs2.constants.O_RDONLY);
+    ops.fsyncSync(directoryFd);
+    ops.closeSync(directoryFd);
+    directoryFd = void 0;
+  } catch (error) {
+    if (fileFd !== void 0) {
+      try {
+        ops.closeSync(fileFd);
+      } catch {
+      }
+    }
+    if (directoryFd !== void 0) {
+      try {
+        ops.closeSync(directoryFd);
+      } catch {
+      }
+    }
+    try {
+      ops.rmSync(temp, { force: true });
+    } catch {
+    }
+    throw new PacketPersistenceError(`failed to durably persist ${target}`, { cause: error });
+  }
 }
-function cloneReply(reply) {
-  return reply === null ? null : {
-    wire_id: reply.wire_id,
-    ...reply.sentence === void 0 ? {} : { sentence: reply.sentence }
-  };
+function renderInbox(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const message = value.Reduce(index);
+    if (message.IsNil()) break;
+    output.push({
+      msg_id: Number(message.Reduce("msg_id").Visualize()),
+      sender_id: message.Reduce("sender_id").Visualize(),
+      sender_name: message.Reduce("sender_name").Visualize(),
+      text: message.Reduce("text").Visualize(),
+      date: adaptTimeToRfc3339(message.Reduce("date").Visualize()),
+      status: message.Reduce("status").Visualize(),
+      wire_id: message.Reduce("wire_id").Visualize()
+    });
+  }
+  return output;
 }
-function normalizeDate(value) {
-  const date = new Date(value);
-  if (Number.isNaN(date.valueOf())) throw new Error(`SDK returned an invalid message timestamp: ${value}`);
-  return date.toISOString();
+function renderFileInbox(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const file = value.Reduce(index);
+    if (file.IsNil()) break;
+    output.push({
+      file_id: Number(file.Reduce("file_id").Visualize()),
+      sender_id: file.Reduce("sender_id").Visualize(),
+      sender_name: file.Reduce("sender_name").Visualize(),
+      filename: file.Reduce("filename").Visualize(),
+      mime: file.Reduce("mime").Visualize(),
+      data: Buffer.from(file.Reduce("data").GetBinary()),
+      date: adaptTimeToRfc3339(file.Reduce("date").Visualize()),
+      status: file.Reduce("status").Visualize(),
+      wire_id: file.Reduce("wire_id").Visualize()
+    });
+  }
+  return output;
 }
-function hasOursCode(error, code) {
-  return error instanceof Error && "code" in error && error.code === code;
+function renderIntegerArray(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const item = value.Reduce(index);
+    if (item.IsNil()) break;
+    output.push(Number(item.Visualize()));
+  }
+  return output;
 }
-function validateRoomId(roomId) {
-  if (!/^[0-7][0-9a-hjkmnp-tv-z]{25}$/.test(roomId)) throw new Error(`invalid room id "${roomId}"`);
+function dictionaryEntries(value) {
+  if (value.IsNil()) return [];
+  return value.GetKeys().map((key) => [key.Visualize(), value.Reduce(key)]);
 }
-function unpackInvite(encoded, maximumBytes) {
-  const normalized = encoded.replace(/\s+/g, "");
-  if (maximumBytes !== void 0 && Buffer.byteLength(encoded, "utf8") > maximumBytes || normalized.length === 0 || !/^[A-Za-z0-9_-]+$/.test(normalized)) {
-    throw new Error("the invite blob is empty, oversized, or invalid base64url");
+function booleanValue(value) {
+  if (value.IsNil()) return false;
+  try {
+    return value.GetBoolean();
+  } catch {
+    return /true/i.test(value.Visualize());
   }
-  const compressed = Buffer.from(normalized, "base64url");
-  if (compressed.length === 0) throw new Error("the invite blob is empty or invalid base64url");
-  return Buffer.from(maximumBytes === void 0 ? brotliDecompressSync(compressed) : brotliDecompressSync(compressed, { maxOutputLength: maximumBytes }));
 }
-var LegacyCoworkStateError, PacketRegistry, SdkRoomPacket;
+function strictBooleanValue(value, label) {
+  if (value.IsNil()) throw new Error(`${label} must be a boolean`);
+  let decoded;
+  try {
+    decoded = value.GetBoolean();
+  } catch (error) {
+    throw new Error(`${label} must be a boolean`, { cause: error });
+  }
+  if (typeof decoded !== "boolean") throw new Error(`${label} must be a boolean`);
+  return decoded;
+}
+function nilString(value) {
+  return value.IsNil() ? "" : value.Visualize();
+}
+function adaptTimeToRfc3339(value) {
+  const rfc3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?(?:Z|([+-])(\d{2}):(\d{2}))$/.exec(value);
+  if (rfc3339) {
+    const [, year2, month2, day2, hour2, minute2, second2, fraction2 = "", sign2, offsetHour2 = "0", offsetMinute = "0"] = rfc3339;
+    if (sign2 === "-" && offsetHour2 === "00" && offsetMinute === "00") return invalidAdaptTime(value);
+    return canonicalUtcTime(value, year2, month2, day2, hour2, minute2, second2, fraction2, sign2, offsetHour2, offsetMinute);
+  }
+  const native = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))? \(UTC(?:([+-])(0|[1-9]|1\d|2[0-3]))?\)$/.exec(value);
+  if (!native) return invalidAdaptTime(value);
+  const [, year, month, day, hour, minute, second, fraction = "", sign, offsetHour = "0"] = native;
+  if (sign === "-" && offsetHour === "0") return invalidAdaptTime(value);
+  return canonicalUtcTime(value, year, month, day, hour, minute, second, fraction, sign, offsetHour, "0");
+}
+function canonicalUtcTime(source, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, offsetSign, offsetHourText, offsetMinuteText) {
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = Number(offsetHourText);
+  const offsetMinute = Number(offsetMinuteText);
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const monthDays = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  if (month < 1 || month > 12 || day < 1 || day > monthDays[month - 1] || hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59) return invalidAdaptTime(source);
+  const milliseconds = Number(fraction.slice(0, 3).padEnd(3, "0"));
+  const local = /* @__PURE__ */ new Date(0);
+  local.setUTCFullYear(year, month - 1, day);
+  local.setUTCHours(hour, minute, second, milliseconds);
+  if (local.getUTCFullYear() !== year || local.getUTCMonth() !== month - 1 || local.getUTCDate() !== day || local.getUTCHours() !== hour || local.getUTCMinutes() !== minute || local.getUTCSeconds() !== second) {
+    return invalidAdaptTime(source);
+  }
+  const direction = offsetSign === "-" ? -1 : 1;
+  const offsetMilliseconds = direction * (offsetHour * 60 + offsetMinute) * 6e4;
+  const canonical = new Date(local.getTime() - offsetMilliseconds).toISOString();
+  if (!/^\d{4}-/.test(canonical)) return invalidAdaptTime(source);
+  return canonical;
+}
+function invalidAdaptTime(value) {
+  throw new Error(`unexpected ADAPT time visualization: ${value}`);
+}
+function inviteMode(value) {
+  const normalized = value.replace(/^\$/, "");
+  if (normalized === "one_time" || normalized === "public") return normalized;
+  throw new Error(`unexpected invite mode: ${value}`);
+}
+function exportSigningSecret(packet) {
+  return withScope((lifetime) => Buffer.from(packet.readonlyTx("::actor::export_signing_secret", lifetime).Serialize()).toString("hex"));
+}
+function validateRoomId(roomId) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(roomId)) throw new Error(`invalid room id: ${roomId}`);
+}
+var PacketPersistenceError, temporarySequence, PacketRegistry, HostedRoomPacket;
 var init_packets = __esm({
-  "src/packets.ts"() {
+  async "src/packets.ts"() {
     "use strict";
+    await init_adapt();
     init_contracts();
-    LegacyCoworkStateError = class extends Error {
-      constructor(roomId) {
-        super(
-          `room "${roomId}" uses the pre-1.0 custom packet format and cannot be opened by the standard ours SDK runtime; back it up with the old release, recreate the room for cowork 1.0, and re-invite its participants`
-        );
-        this.name = "LegacyCoworkStateError";
+    PacketPersistenceError = class extends Error {
+      constructor(message, options) {
+        super(message, options);
+        this.name = "PacketPersistenceError";
       }
     };
+    temporarySequence = 0;
     PacketRegistry = class {
       packets = /* @__PURE__ */ new Map();
-      trackers = /* @__PURE__ */ new Map();
       host;
       stateDir;
       fs;
+      persistence;
       log;
+      seed;
+      beforeExpose;
       onNotify;
-      unsubscribe;
+      provisioningCheckpoint;
+      stagingName;
       constructor(host, stateDir, options = {}) {
         this.host = host;
         this.stateDir = stateDir;
-        this.fs = options.fs ?? fs2;
+        this.fs = options.fs ?? nodeFs2;
+        this.persistence = options.persistence ?? this.fs;
         this.log = options.log ?? (() => {
         });
+        this.seed = options.seed ?? (() => randomBytes(24).toString("hex"));
+        this.beforeExpose = options.beforeExpose ?? (() => {
+        });
         this.onNotify = options.onNotify ?? (() => {
         });
-        this.unsubscribe = host.onIdentityNotify((name) => {
-          const found = [...this.packets.entries()].find(([, packet2]) => packet2.name === name);
-          if (!found) return;
-          const [roomId, packet] = found;
-          void packet.refresh().then(
-            () => this.onNotify(roomId, "message_received"),
-            (error) => this.log(`[${name}] failed to refresh SDK state after notification:`, error)
-          );
+        this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
         });
+        this.stagingName = options.stagingName ?? (() => `live.staging-${randomBytes(16).toString("hex")}`);
       }
       get size() {
         return this.packets.size;
@@ -5490,253 +5714,563 @@ var init_packets = __esm({
       get(roomId) {
         return this.packets.get(roomId);
       }
-      async create(roomId, identityName = `ours-cowork-${roomId}`, bio = `ours-cowork mission room ${roomId}`) {
+      async create(roomId, identityName = `cowork-room-${roomId}`, bio = `ours-cowork mission room ${roomId}`) {
         validateRoomId(roomId);
-        this.assertStandardIdentity(roomId, identityName);
-        this.assertNoLegacyState(roomId);
-        if (this.packets.has(roomId)) throw new Error(`room identity "${roomId}" is already hosted`);
-        const client = this.host.createClient();
-        try {
-          let cid;
+        if (this.packets.has(roomId)) throw new Error(`room packet "${roomId}" is already hosted`);
+        const liveDir = this.liveDir(roomId);
+        if (this.hasRestorableState(roomId)) {
           try {
-            cid = (await client.chooseIdentity({ name: identityName, force: false })).cid;
+            return await this.restore(roomId, void 0, identityName, bio);
           } catch (error) {
-            if (!hasOursCode(error, "NO_SUCH_IDENTITY")) throw error;
-            const created = await client.createIdentity({
-              name: identityName,
-              bio,
-              exposeLocal: false,
-              localAutoAccept: true
-            });
-            cid = created.info.cid;
+            this.log(`[${this.packetName(roomId)}] pending packet restore failed; reprovisioning:`, error);
           }
-          const packet = new SdkRoomPacket(identityName, cid, client);
-          await packet.refresh();
-          this.packets.set(roomId, packet);
-          this.track(roomId, identityName);
-          return packet;
+        }
+        this.prepareProvisioningDirectory(roomId);
+        let native;
+        try {
+          native = await this.host.createPacket(this.packetName(roomId), this.seed());
+          let room;
+          room = new HostedRoomPacket(
+            native,
+            () => this.saveState(native, liveDir),
+            this.log,
+            (event) => this.onNotify(roomId, event),
+            () => {
+              if (this.packets.get(roomId) === room) this.packets.delete(roomId);
+            }
+          );
+          atomicWriteFileSync(this.identityPath(roomId), Buffer.from(exportSigningSecret(native), "utf8"), this.persistence);
+          this.provisioningCheckpoint("identity");
+          this.saveState(native, liveDir);
+          this.provisioningCheckpoint("state");
+          this.packets.set(roomId, room);
+          await room.setIdentity(identityName, bio);
+          this.provisioningCheckpoint("identity_applied");
+          return room;
         } catch (error) {
-          await client.releaseLease().catch(() => {
-          });
-          throw new Error(`failed to provision standard SDK identity for room "${roomId}"`, { cause: error });
+          if (native) {
+            try {
+              this.host.removePacket(native.cid);
+            } catch {
+            }
+          }
+          this.packets.delete(roomId);
+          throw error;
         }
       }
-      async restore(roomId, expectedCid, identityName = `ours-cowork-${roomId}`) {
+      async restore(roomId, expectedCid, identityName, bio) {
         validateRoomId(roomId);
-        this.assertStandardIdentity(roomId, identityName);
-        this.assertNoLegacyState(roomId);
-        if (this.packets.has(roomId)) throw new Error(`room identity "${roomId}" is already hosted`);
-        const client = this.host.createClient();
+        if (this.packets.has(roomId)) throw new Error(`room packet "${roomId}" is already hosted`);
+        const liveDir = this.liveDir(roomId);
+        const secret = this.fs.readFileSync(this.identityPath(roomId), "utf8").trim();
+        if (!/^[0-9a-f]+$/i.test(secret) || secret.length % 2 !== 0) {
+          throw new Error(`invalid signing secret for room "${roomId}"`);
+        }
+        const stateBytes = this.fs.readFileSync(this.statePath(roomId));
+        if (stateBytes.length === 0) throw new Error(`empty packet state for room "${roomId}"`);
+        const native = await this.host.createPacket(
+          this.packetName(roomId),
+          this.seed(),
+          secret,
+          { deferredExposure: true }
+        );
+        if (expectedCid !== void 0 && native.cid !== expectedCid) {
+          try {
+            this.host.removePacket(native.cid);
+          } catch {
+          }
+          throw new Error(
+            `restored room packet CID mismatch for "${roomId}": expected "${expectedCid}", found "${native.cid}"`
+          );
+        }
+        let room;
+        room = new HostedRoomPacket(
+          native,
+          () => this.saveState(native, liveDir),
+          this.log,
+          (event) => this.onNotify(roomId, event),
+          () => {
+            if (this.packets.get(roomId) === room) this.packets.delete(roomId);
+          }
+        );
         try {
-          const bound = await client.chooseIdentity({ name: identityName, force: false });
-          if (expectedCid !== void 0 && bound.cid !== expectedCid) {
-            throw new Error(`restored room identity CID mismatch: expected "${expectedCid}", found "${bound.cid}"`);
-          }
-          const packet = new SdkRoomPacket(identityName, bound.cid, client);
-          await packet.refresh();
-          this.packets.set(roomId, packet);
-          this.track(roomId, identityName);
-          return packet;
-        } catch (error) {
-          await client.releaseLease().catch(() => {
+          await withScopeAsync(async (lifetime) => {
+            const state = native.pw.packet.ParseValue(new Uint8Array(stateBytes)).Attach(lifetime);
+            await native.mutatingTx("::actor::import_state", state, lifetime);
           });
+          native.pw.refresh_identity_proof_document();
+          if (identityName !== void 0 && bio !== void 0) {
+            await room.setIdentity(identityName, bio);
+            this.provisioningCheckpoint("identity_applied");
+          }
+          atomicWriteFileSync(
+            this.ownershipPath(roomId),
+            Buffer.from(`${roomId}
+`, "utf8"),
+            this.persistence
+          );
+          await this.beforeExpose(room);
+          this.host.exposePacket(native.cid);
+          this.packets.set(roomId, room);
+          return room;
+        } catch (error) {
+          try {
+            this.host.removePacket(native.cid);
+          } catch {
+          }
           throw error;
         }
       }
       async destroy(roomId) {
         validateRoomId(roomId);
-        const packet = this.packets.get(roomId);
-        if (!packet) return [];
-        try {
-          await packet.destroy();
+        const room = this.packets.get(roomId);
+        if (room) {
+          this.host.removePacket(room.cid);
           this.packets.delete(roomId);
-          return [];
+        }
+        const liveDir = this.liveDir(roomId);
+        let removalFailure;
+        try {
+          this.assertSafeRoomDirectory(roomId);
+          this.fs.rmSync(liveDir, { recursive: true, force: true });
+          this.fsyncDirectory(this.roomDir(roomId));
         } catch (error) {
-          throw new Error(`failed to remove standard SDK identity for room "${roomId}"`, { cause: error });
-        } finally {
-          this.untrack(roomId);
+          this.log(`[${room?.name ?? this.packetName(roomId)}] live-state removal failed:`, error);
+          removalFailure = error;
+        }
+        const residue = this.residue(roomId);
+        if (removalFailure !== void 0 && residue.length === 0) {
+          throw new PacketPersistenceError(
+            `live-state removal durability is uncertain for room "${roomId}"`,
+            { cause: removalFailure }
+          );
         }
+        return residue;
       }
+      /** Unhost runtime packets while retaining every byte required for restart. */
       async unhostAll() {
-        this.unsubscribe();
-        for (const roomId of [...this.trackers.keys()]) this.untrack(roomId);
         const errors = [];
-        for (const [roomId, packet] of [...this.packets]) {
+        for (const [roomId, room] of [...this.packets]) {
           try {
-            await packet.close();
+            this.host.removePacket(room.cid, new Error("cowork daemon is shutting down"));
+            this.packets.delete(roomId);
           } catch (error) {
             errors.push(error);
           }
-          this.packets.delete(roomId);
         }
-        if (errors.length) throw new AggregateError(errors, "failed to release room SDK leases");
+        if (errors.length > 0) throw new AggregateError(errors, "failed to unhost room packets");
       }
-      /**
-       * Hosts that watch the runtime from outside need to be told which identities
-       * exist; an embedded host omits `trackIdentity` and keeps its own callback.
-       */
-      track(roomId, identityName) {
-        const dispose = this.host.trackIdentity?.(identityName);
-        if (dispose) this.trackers.set(roomId, dispose);
-      }
-      untrack(roomId) {
-        const dispose = this.trackers.get(roomId);
-        if (!dispose) return;
-        this.trackers.delete(roomId);
+      saveState(packet, liveDir) {
         try {
-          dispose();
+          const bytes = withScope((lifetime) => Buffer.from(packet.readonlyTx("::actor::export_state", lifetime).Serialize()));
+          atomicWriteFileSync(join3(liveDir, "state_data.bin"), bytes, this.persistence);
         } catch (error) {
-          this.log(`failed to stop the notification watch for room "${roomId}":`, error);
+          if (error instanceof PacketPersistenceError) throw error;
+          throw new PacketPersistenceError(`failed to export state for packet "${packet.name}"`, { cause: error });
         }
       }
-      assertNoLegacyState(roomId) {
-        const live = join3(this.stateDir, "rooms", roomId, "live");
-        if (this.fs.existsSync(join3(live, "identity.key")) || this.fs.existsSync(join3(live, "state_data.bin"))) {
-          throw new LegacyCoworkStateError(roomId);
+      residue(roomId) {
+        const liveDir = this.liveDir(roomId);
+        try {
+          this.fs.lstatSync(liveDir);
+          return [liveDir];
+        } catch (error) {
+          if (error.code === "ENOENT") return [];
+          throw error;
         }
       }
-      assertStandardIdentity(roomId, identityName) {
-        if (identityName !== `ours-cowork-${roomId}`) throw new LegacyCoworkStateError(roomId);
+      packetName(roomId) {
+        return `cowork-room-${roomId}`;
       }
-    };
-    SdkRoomPacket = class {
-      name;
-      cid;
-      client;
-      contacts = [];
-      invites = [];
-      inbox = [];
-      fileInbox = [];
-      refreshWork;
-      constructor(name, cid, client) {
-        this.name = name;
-        this.cid = cid;
-        this.client = client;
-      }
-      refresh() {
-        this.refreshWork ??= this.refreshUnlocked().finally(() => {
-          this.refreshWork = void 0;
-        });
-        return this.refreshWork;
-      }
-      async refreshUnlocked() {
-        const contacts = await this.client.listContacts();
-        this.contacts = contacts.contacts.map((contact) => ({ ...contact }));
-        this.invites = (await this.client.listInvites()).flatMap((invite) => invite.mode === "one_time" || invite.mode === "public" ? [{ invite_id: invite.invite_id, mode: invite.mode }] : []);
-        this.inbox = (await this.client.listIncomingMessages()).filter((message) => message.status === "unread").map((message) => ({
-          msg_id: message.msg_id,
-          sender_id: message.sender_id,
-          sender_name: message.sender_name,
-          text: message.text,
-          date: normalizeDate(message.date),
-          wire_id: message.wire_id,
-          reply_to: cloneReply(message.reply_to)
-        }));
-        await this.refreshFiles();
+      roomDir(roomId) {
+        return join3(this.stateDir, "rooms", roomId);
       }
-      async refreshFiles() {
-        const unread = (await this.client.listIncomingFiles()).filter((file) => file.status === "unread");
-        if (unread.length === 0) {
-          this.fileInbox = [];
-          return;
+      liveDir(roomId) {
+        return join3(this.roomDir(roomId), "live");
+      }
+      identityPath(roomId) {
+        return join3(this.liveDir(roomId), "identity.key");
+      }
+      statePath(roomId) {
+        return join3(this.liveDir(roomId), "state_data.bin");
+      }
+      ownershipPath(roomId) {
+        return join3(this.liveDir(roomId), ".cowork-provisioning-v1");
+      }
+      stagingJournalPath(roomId) {
+        return join3(this.roomDir(roomId), ".cowork-provisioning-stage");
+      }
+      residuePath(roomId) {
+        return join3(this.roomDir(roomId), "provisioning-residue");
+      }
+      hasRestorableState(roomId) {
+        try {
+          const secret = this.fs.readFileSync(this.identityPath(roomId), "utf8").trim();
+          return /^[0-9a-f]+$/i.test(secret) && secret.length % 2 === 0 && this.fs.readFileSync(this.statePath(roomId)).length > 0;
+        } catch {
+          return false;
+        }
+      }
+      prepareProvisioningDirectory(roomId) {
+        const roomDir = this.roomDir(roomId);
+        const liveDir = this.liveDir(roomId);
+        if (!this.fs.existsSync(roomDir)) {
+          this.fs.mkdirSync(roomDir, { recursive: true, mode: 448 });
+          this.fs.chmodSync(roomDir, 448);
         }
-        const ids = unread.map((file) => file.file_id);
-        const wires = unread.map((file) => file.wire_id);
+        if (this.fs.existsSync(liveDir)) {
+          let owned = false;
+          try {
+            owned = this.fs.readFileSync(this.ownershipPath(roomId), "utf8") === `${roomId}
+`;
+          } catch {
+          }
+          if (owned) {
+            this.assertSafeRoomDirectory(roomId);
+            this.fs.rmSync(liveDir, { recursive: true, force: true });
+            this.fsyncDirectory(roomDir);
+          } else {
+            this.assertSafeRoomDirectory(roomId);
+            const residue = this.residuePath(roomId);
+            if (this.fs.existsSync(residue)) {
+              throw new PacketPersistenceError(
+                `room "${roomId}" has unknown live state and an existing provisioning residue; inspect both before retrying`
+              );
+            }
+            this.fs.renameSync(liveDir, residue);
+            this.fs.chmodSync(residue, 448);
+            this.fsyncDirectory(roomDir);
+          }
+        }
+        this.cleanupOwnedStaging(roomId);
+        const stagingName = this.stagingName();
+        if (!/^live\.staging-[0-9a-f]{32}$/.test(stagingName)) {
+          throw new PacketPersistenceError(`invalid provisioning staging name for room "${roomId}"`);
+        }
+        this.createStagingJournal(roomId, stagingName);
+        const stagingDir = join3(roomDir, stagingName);
+        try {
+          this.fs.mkdirSync(stagingDir, { recursive: false, mode: 448 });
+        } catch (error) {
+          try {
+            this.fs.unlinkSync(this.stagingJournalPath(roomId));
+            this.fsyncDirectory(roomDir);
+          } catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], `provisioning staging collision cleanup failed for room "${roomId}"`);
+          }
+          throw new PacketPersistenceError(`provisioning staging collision for room "${roomId}"`, { cause: error });
+        }
+        this.fs.chmodSync(stagingDir, 448);
+        atomicWriteFileSync(
+          join3(stagingDir, ".cowork-provisioning-v1"),
+          Buffer.from(`${roomId}
+`, "utf8"),
+          this.persistence
+        );
+        this.provisioningCheckpoint("mkdir");
+        this.fs.renameSync(stagingDir, liveDir);
+        this.fsyncDirectory(roomDir);
+        this.fs.unlinkSync(this.stagingJournalPath(roomId));
+        this.fsyncDirectory(roomDir);
+      }
+      cleanupOwnedStaging(roomId) {
+        const journal = this.stagingJournalPath(roomId);
+        let journalFd;
         try {
-          await this.client.getFiles({ wire_ids: wires });
-          this.fileInbox = await Promise.all(unread.map(async (file) => fileItem(file, await this.client.fetchFile(file.wire_id))));
+          try {
+            journalFd = this.fs.openSync(
+              journal,
+              nodeFs2.constants.O_RDONLY | (nodeFs2.constants.O_NOFOLLOW ?? 0)
+            );
+          } catch (error) {
+            if (error.code === "ENOENT") return;
+            throw error;
+          }
+          const journalStat = this.fs.fstatSync(journalFd);
+          if (!journalStat.isFile() || journalStat.size > 128) {
+            throw new PacketPersistenceError(`unsafe provisioning staging journal for room "${roomId}"`);
+          }
+          const stagingName = this.fs.readFileSync(journalFd, "utf8").trim();
+          if (!/^live\.staging-[0-9a-f]{32}$/.test(stagingName)) {
+            throw new PacketPersistenceError(`invalid provisioning staging journal for room "${roomId}"`);
+          }
+          const roomDir = this.roomDir(roomId);
+          const stagingDir = join3(roomDir, stagingName);
+          if (this.fs.existsSync(stagingDir)) {
+            const stat = this.fs.lstatSync(stagingDir);
+            if (stat.isSymbolicLink() || !stat.isDirectory()) {
+              throw new PacketPersistenceError(`unsafe provisioning staging path for room "${roomId}"`);
+            }
+            let owned = false;
+            try {
+              owned = this.fs.readFileSync(join3(stagingDir, ".cowork-provisioning-v1"), "utf8") === `${roomId}
+`;
+            } catch {
+            }
+            if (owned) {
+              this.fs.rmSync(stagingDir, { recursive: true, force: true });
+              this.fsyncDirectory(roomDir);
+            } else {
+              const residue = this.residuePath(roomId);
+              if (this.fs.existsSync(residue)) {
+                throw new PacketPersistenceError(
+                  `provisioning staging recovery for room "${roomId}" found an existing provisioning residue; preserving both`
+                );
+              }
+              this.fs.renameSync(stagingDir, residue);
+              this.fs.chmodSync(residue, 448);
+              this.fsyncDirectory(roomDir);
+            }
+          }
+          const currentJournal = this.fs.lstatSync(journal);
+          if (!currentJournal.isFile() || currentJournal.dev !== journalStat.dev || currentJournal.ino !== journalStat.ino) {
+            throw new PacketPersistenceError(
+              `provisioning staging journal changed during recovery for room "${roomId}"; replacement preserved`
+            );
+          }
+          this.fs.unlinkSync(journal);
+          this.fsyncDirectory(roomDir);
         } finally {
-          await this.client.deferFiles({ file_ids: ids }).catch(() => {
-          });
+          if (journalFd !== void 0) this.fs.closeSync(journalFd);
         }
       }
+      createStagingJournal(roomId, stagingName) {
+        const journal = this.stagingJournalPath(roomId);
+        const bytes = Buffer.from(`${stagingName}
+`, "utf8");
+        let fd;
+        let created = false;
+        try {
+          fd = this.persistence.openSync(
+            journal,
+            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | (nodeFs2.constants.O_NOFOLLOW ?? 0),
+            384
+          );
+          created = true;
+          this.persistence.fchmodSync(fd, 384);
+          let offset = 0;
+          while (offset < bytes.byteLength) {
+            const written = this.persistence.writeSync(fd, bytes, offset, bytes.byteLength - offset, null);
+            if (written <= 0) throw new Error(`short write while persisting ${journal}`);
+            offset += written;
+          }
+          this.persistence.fsyncSync(fd);
+          this.persistence.closeSync(fd);
+          fd = void 0;
+          this.fsyncDirectory(this.roomDir(roomId));
+        } catch (error) {
+          if (fd !== void 0) {
+            try {
+              this.persistence.closeSync(fd);
+            } catch {
+            }
+          }
+          if (created) {
+            try {
+              this.fs.unlinkSync(journal);
+              this.fsyncDirectory(this.roomDir(roomId));
+            } catch {
+            }
+          }
+          throw new PacketPersistenceError(`failed to establish staging ownership for room "${roomId}"`, { cause: error });
+        }
+      }
+      assertSafeRoomDirectory(roomId) {
+        const roomDir = this.roomDir(roomId);
+        const stat = this.fs.lstatSync(roomDir);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+          throw new Error(`room directory for "${roomId}" is not a safe directory`);
+        }
+      }
+      fsyncDirectory(path) {
+        let fd;
+        try {
+          fd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | (nodeFs2.constants.O_NOFOLLOW ?? 0));
+          this.fs.fsyncSync(fd);
+        } finally {
+          if (fd !== void 0) this.fs.closeSync(fd);
+        }
+      }
+    };
+    HostedRoomPacket = class {
+      name;
+      cid;
+      packet;
+      constructor(packet, saveState, log, onNotify = () => {
+      }, onTerminal = () => {
+      }) {
+        this.packet = packet;
+        this.name = packet.name;
+        this.cid = packet.cid;
+        wireHandlers(packet, { onSaveState: saveState, onNotify: (event) => onNotify(event) }, log);
+        packet.onTerminalClose?.(onTerminal);
+      }
+      async setIdentity(identityName, bio) {
+        await withScopeAsync((lifetime) => this.packet.mutatingTx("::a2a_messaging::set_my_name", { name: identityName }, lifetime));
+        await withScopeAsync((lifetime) => this.packet.mutatingTx("::a2a_messaging::set_my_bio", { bio }, lifetime));
+      }
       async mintInvite(mode) {
-        const result = await this.client.generateInvite({ mode });
-        await this.refresh();
-        return { blob: result.blob, invite_id: result.inviteId, reusable: mode === "public" };
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx("::a2a_messaging::generate_invite", { mode }, lifetime);
+          return {
+            blob: packInvite(Buffer.from(result.Reduce("invite").GetBinary())),
+            invite_id: result.Reduce("invite_id").Visualize(),
+            reusable: booleanValue(result.Reduce("reusable"))
+          };
+        });
       }
       async addContact(invite) {
-        const decoded = unpackInvite(invite, MAX_EXTERNAL_INVITE_BYTES);
-        const result = await this.client.addContact({ invite });
-        await this.refresh();
-        return {
-          invite_id: createHash2("sha256").update(decoded).digest("hex"),
-          container_id: result.cid,
-          inviter_name: result.display,
-          pending_name: result.display
-        };
+        let decoded;
+        try {
+          decoded = unpackInvite(invite, MAX_EXTERNAL_INVITE_BYTES);
+        } catch (error) {
+          throw new Error("external invite could not be decoded within the 48 KiB limit", { cause: error });
+        }
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx("::a2a_messaging::add_contact", {
+            invite: this.packet.newBinary(decoded, lifetime)
+          }, lifetime);
+          return {
+            invite_id: result.Reduce("invite_id").Visualize(),
+            container_id: result.Reduce("container_id").Visualize(),
+            inviter_name: result.Reduce("inviter_name").Visualize(),
+            pending_name: result.Reduce("pending").Visualize()
+          };
+        });
       }
       async revokeInvite(inviteId) {
-        const result = await this.client.revokeInvite({ invite_id: inviteId });
-        await this.refresh();
-        return { revoked: result.revoked };
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx("::a2a_messaging::revoke_invite", { invite_id: inviteId }, lifetime);
+          return { revoked: booleanValue(result.Reduce("revoked")) };
+        });
       }
       listInvites() {
-        return this.invites.map((invite) => ({ ...invite }));
+        return withScope((lifetime) => {
+          const value = this.packet.readonlyTx("::a2a_messaging::list_invites", lifetime);
+          return dictionaryEntries(value).map(([inviteId, invite]) => ({
+            invite_id: inviteId,
+            mode: inviteMode(invite.Reduce("mode").Visualize())
+          }));
+        });
       }
       listContacts() {
-        return this.contacts.map((contact) => ({ ...contact }));
+        return withScope((lifetime) => {
+          const value = this.packet.readonlyTx("::a2a_messaging::list_contacts", lifetime);
+          return dictionaryEntries(value).map(([, contact]) => ({
+            name: contact.Reduce("name").Visualize(),
+            container_id: contact.Reduce("container_id").Visualize()
+          }));
+        });
       }
-      peekInbox() {
-        return this.inbox.map((item) => ({ ...item }));
+      listContactOrigins() {
+        return withScope((lifetime) => {
+          const value = this.packet.readonlyTx("::a2a_messaging::list_contact_origins", lifetime);
+          return Object.fromEntries(dictionaryEntries(value).map(([cid, origin]) => [cid, {
+            via: origin.Reduce("via").Visualize(),
+            invite_id: nilString(origin.Reduce("invite_id")),
+            at: adaptTimeToRfc3339(origin.Reduce("at").Visualize())
+          }]));
+        });
       }
-      peekFileInbox() {
-        return this.fileInbox.map((item) => ({ ...item, data: Buffer.from(item.data) }));
+      peekInbox() {
+        return withScope((lifetime) => renderInbox(this.packet.readonlyTx("::actor::list_incoming_messages", lifetime)).filter((message) => message.status === "unread").map(({ status: _status, ...message }) => message));
       }
       async consumeInbox(expectedIds) {
-        if (expectedIds.length === 0) return { consumed: [], deferred: [] };
-        const pulled = await this.client.getMessages();
-        const expected = new Set(expectedIds);
-        const consumed = pulled.messages.filter((message) => expected.has(message.msg_id)).map((message) => message.msg_id);
-        const deferred = pulled.messages.filter((message) => !expected.has(message.msg_id)).map((message) => message.msg_id);
-        if (deferred.length) await this.client.deferMessages({ msg_ids: deferred });
-        await this.refresh();
-        return { consumed, deferred };
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::consume_messages",
+            { expected_ids: expectedIds },
+            lifetime
+          );
+          return {
+            consumed: renderIntegerArray(result.Reduce("consumed")),
+            deferred: renderIntegerArray(result.Reduce("deferred"))
+          };
+        });
+      }
+      peekFileInbox() {
+        return withScope((lifetime) => renderFileInbox(
+          this.packet.readonlyTx("::actor::list_incoming_files", lifetime)
+        ).filter((file) => file.status === "unread").map(({ status: _status, ...file }) => file));
       }
       async consumeFileInbox(expectedIds) {
-        const expected = new Set(expectedIds);
-        const selected = this.fileInbox.filter((file) => expected.has(file.file_id));
-        if (selected.length) await this.client.getFiles({ wire_ids: selected.map((file) => file.wire_id) });
-        this.fileInbox = this.fileInbox.filter((file) => !expected.has(file.file_id));
-        return { consumed: selected.map((file) => file.file_id), deferred: [] };
-      }
-      async send(contactCid, body, replyTo) {
-        return sendResult(await this.client.sendMessage({
-          contact: contactCid,
-          text: body,
-          ...replyTo === void 0 ? {} : {
-            reply_to_wire_id: replyTo.wire_id,
-            ...replyTo.sentence === void 0 ? {} : { reply_to_sentence: replyTo.sentence }
-          }
-        }));
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::consume_files",
+            { expected_ids: expectedIds },
+            lifetime
+          );
+          return {
+            consumed: renderIntegerArray(result.Reduce("consumed")),
+            deferred: renderIntegerArray(result.Reduce("deferred"))
+          };
+        });
+      }
+      async send(contactCid, body) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::send_message",
+            { contact: contactCid, text: body },
+            lifetime
+          );
+          const refused = !result.Reduce("downgrade_refused").IsNil();
+          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
+        });
       }
-      async sendFile(contactCid, filename, mime, data, replyTo) {
+      async sendFile(contactCid, filename, mime, data) {
         const validName = FileNameSchema.parse(filename);
         const validMime = FileMimeSchema.parse(mime);
-        if (data.length > MAX_FILE_BYTES) throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
-        return sendResult(await this.client.sendFile({
-          contact: contactCid,
-          data_base64: data.toString("base64"),
-          filename: validName,
-          mime: validMime,
-          ...replyTo === void 0 ? {} : {
-            reply_to_wire_id: replyTo.wire_id,
-            ...replyTo.sentence === void 0 ? {} : { reply_to_sentence: replyTo.sentence }
-          }
-        }));
+        if (data.length > MAX_FILE_BYTES) {
+          throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
+        }
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::send_file",
+            {
+              contact: contactCid,
+              filename: validName,
+              mime: validMime,
+              // The core contract takes bytes. A filesystem path here would make
+              // recovery depend on staging ownership and is deliberately forbidden.
+              data: this.packet.newBinary(data, lifetime)
+            },
+            lifetime
+          );
+          const refused = !result.Reduce("downgrade_refused").IsNil() || !result.Reduce("migrating").IsNil();
+          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
+        });
       }
       async removeContact(contactCid) {
-        const result = await this.client.removeContact({ contact: contactCid });
-        const notified = result.notified === true;
-        await this.refresh();
-        return { status: notified ? "queued" : "send_failed", notified, key_material_retained: true };
-      }
-      async close() {
-        await this.client.releaseLease();
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::remove_contact",
+            { contact: contactCid },
+            lifetime
+          );
+          const notified = strictBooleanValue(result.Reduce("notified"), "remove_contact notified");
+          const keyMaterialRetained = strictBooleanValue(
+            result.Reduce("key_material_retained"),
+            "remove_contact key_material_retained"
+          );
+          if (!keyMaterialRetained) {
+            throw new Error("remove_contact key_material_retained must be true");
+          }
+          return {
+            status: notified ? "queued" : "send_failed",
+            notified,
+            key_material_retained: true
+          };
+        });
       }
-      async destroy() {
-        await this.client.removeIdentity({ name: this.name });
-        await this.client.releaseLease();
+      async sign(canonicalJson2) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::sign_app_envelope",
+            { canonical_json: canonicalJson2 },
+            lifetime
+          );
+          return Buffer.from(result.Reduce("signature").GetBinary()).toString("base64url");
+        });
       }
     };
   }
@@ -5774,18 +6308,15 @@ var init_ulid = __esm({
 });
 
 // src/intake.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function canonicalJson(value) {
   const encoded = JSON.stringify(canonicalValue(value));
   if (encoded === void 0) throw new TypeError("canonical JSON value is not serializable");
   return encoded;
 }
-async function sendRoomBody(packet, recipientIdentity, unsigned) {
-  return packet.send(recipientIdentity, canonicalJson(unsigned));
-}
-function sameReply(stored, observed) {
-  if (stored === void 0 || observed == null) return stored === void 0 && observed == null;
-  return stored.wire_id === observed.wire_id && stored.sentence === observed.sentence;
+async function sendSignedBody(packet, recipientIdentity, unsigned) {
+  const signature = await packet.sign(canonicalJson(unsigned));
+  return packet.send(recipientIdentity, canonicalJson({ ...unsigned, signature }));
 }
 function canonicalValue(value) {
   if (Array.isArray(value)) return value.map(canonicalValue);
@@ -5940,12 +6471,11 @@ var init_intake = __esm({
             filename: parsedName.data,
             mime: parsedMime.data,
             size: bytes.length,
-            sha256: createHash3("sha256").update(bytes).digest("hex"),
+            sha256: createHash2("sha256").update(bytes).digest("hex"),
             data_base64: bytes.toString("base64"),
             recipient_identities: recipientIdentities,
             source_file_id: item.file_id,
-            ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id },
-            ...item.reply_to == null ? {} : { source_reply_to: item.reply_to }
+            ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id }
           });
           if (appended.kind !== "file") throw new Error("storage returned the wrong participant file kind");
           file = appended;
@@ -5985,8 +6515,7 @@ var init_intake = __esm({
             text: item.text,
             recipient_identities: recipientIdentities,
             source_msg_id: item.msg_id,
-            ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id },
-            ...item.reply_to == null ? {} : { source_reply_to: item.reply_to }
+            ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id }
           });
           if (appended.kind !== "message") throw new Error("storage returned the wrong participant message kind");
           message = appended;
@@ -6011,7 +6540,7 @@ var init_intake = __esm({
         await this.store.save(RoomSchema.parse({ ...room, seats }));
         try {
           const unsigned = { version: 1, kind: "room_not_member", room_id: roomId };
-          await sendRoomBody(packet, item.sender_id, unsigned);
+          await sendSignedBody(packet, item.sender_id, unsigned);
         } catch {
         }
       }
@@ -6095,7 +6624,7 @@ var init_intake = __esm({
               display_name: file.author_alias.alias,
               role: file.author.role
             };
-            const metadata = await sendRoomBody(packet, intent.recipient_identity, {
+            const metadata = await sendSignedBody(packet, intent.recipient_identity, {
               version: 1,
               kind: "room_file",
               room_id: roomId,
@@ -6161,7 +6690,7 @@ var init_intake = __esm({
             ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
             ...message.membership === void 0 ? {} : { membership: message.membership }
           };
-          const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned);
+          const outcome = await sendSignedBody(packet, intent.recipient_identity, unsigned);
           const appended = await this.store.append(roomId, {
             version: 1,
             kind: "relay_result",
@@ -6181,7 +6710,7 @@ var init_intake = __esm({
         const message = records.find((record) => record.kind === "message" && record.source_msg_id === item.msg_id);
         if (!message) return void 0;
         const observedWireId = item.wire_id === "" ? void 0 : item.wire_id;
-        if (message.source_wire_id !== observedWireId || !sameReply(message.source_reply_to, item.reply_to) || message.author.identity !== item.sender_id || message.text !== item.text || message.at !== item.date) {
+        if (message.source_wire_id !== observedWireId || message.author.identity !== item.sender_id || message.text !== item.text || message.at !== item.date) {
           throw new Error(`inbox source ${item.msg_id} does not match its durable room message`);
         }
         return message;
@@ -6191,7 +6720,7 @@ var init_intake = __esm({
         if (!file) return void 0;
         const observedWireId = item.wire_id === "" ? void 0 : item.wire_id;
         const bytes = Buffer.from(item.data);
-        if (file.source_wire_id !== observedWireId || !sameReply(file.source_reply_to, item.reply_to) || file.author.identity !== item.sender_id || file.filename !== item.filename || file.mime !== item.mime || file.at !== item.date || file.size !== bytes.length || file.data_base64 !== bytes.toString("base64")) {
+        if (file.source_wire_id !== observedWireId || file.author.identity !== item.sender_id || file.filename !== item.filename || file.mime !== item.mime || file.at !== item.date || file.size !== bytes.length || file.data_base64 !== bytes.toString("base64")) {
           throw new Error(`file inbox source ${item.file_id} does not match its durable room file`);
         }
         return file;
@@ -6212,7 +6741,7 @@ var init_intake = __esm({
 });
 
 // src/service.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 function byteBoundedHistoryPage(records) {
   const page = [];
   let bytes = 2;
@@ -6247,11 +6776,11 @@ function currentContactIdentities(packet) {
 }
 var ROOM_ROLE, CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
 var init_service = __esm({
-  "src/service.ts"() {
+  async "src/service.ts"() {
     "use strict";
     init_zod();
     init_contracts();
-    init_packets();
+    await init_adapt();
     init_intake();
     init_ulid();
     ROOM_ROLE = "room";
@@ -6317,7 +6846,7 @@ var init_service = __esm({
         const settings = CreateRoomInputSchema.parse(input);
         const roomId = LowerCrockfordUlidSchema.parse(this.nextRoomId());
         const roomName = settings.name ?? defaultRoomName(roomId);
-        const identityName = roomIdentityName(roomId);
+        const identityName = roomIdentityName(roomName);
         return this.lock(roomId, async () => {
           const provisional = RoomSchema.parse({
             version: 2,
@@ -6330,6 +6859,7 @@ var init_service = __esm({
             identity_cid: "",
             mission: { goal: settings.goal, briefing: settings.briefing, briefing_version: 1 },
             role_briefings: {},
+            rest_roles: [],
             anonymous: settings.anonymous ?? false,
             quiet_membership: settings.quiet_membership ?? false,
             membership_epoch: 0,
@@ -6400,7 +6930,7 @@ var init_service = __esm({
             throw new RoomServiceError(`room packet "${id}" with established CID must be restored, not created`);
           }
           try {
-            packet = await this.packets.restore(id, room.identity_cid, room.identity_name);
+            packet = await this.packets.restore(id, room.identity_cid);
           } catch (error) {
             throw new RoomServiceError(
               `failed to restore established room packet "${id}": ${error instanceof Error ? error.message : String(error)}`,
@@ -6499,11 +7029,6 @@ var init_service = __esm({
         return this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "create an invite for");
-          if (room.invites.some((invite) => invite.state === "live" || invite.state === "receipt_pending")) {
-            throw new RoomServiceError(
-              "standard SDK rooms permit one live invitation at a time so every accepted contact has unambiguous room admission metadata"
-            );
-          }
           return this.mintInviteUnlocked(room, {
             mode: request.mode,
             role: request.role ?? DEFAULT_ROLE,
@@ -6521,7 +7046,7 @@ var init_service = __esm({
         } catch {
           throw new RoomServiceError("external invite is invalid or exceeds the 48 KiB decoded limit");
         }
-        const digest = createHash4("sha256").update(decoded).digest("hex");
+        const digest = createHash3("sha256").update(decoded).digest("hex");
         const receipt = await this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "accept an external invite for");
@@ -6587,11 +7112,6 @@ var init_service = __esm({
         return receipt;
       }
       async mintInviteUnlocked(room, request) {
-        if (room.invites.some((invite2) => invite2.state === "live" || invite2.state === "receipt_pending")) {
-          throw new RoomServiceError(
-            "standard SDK rooms permit one live invitation at a time; revoke or consume the current invitation first"
-          );
-        }
         const packet = this.packet(room.room_id);
         const minted = await packet.mintInvite(request.mode);
         const invite = RoomInviteSchema.parse({
@@ -6961,7 +7481,7 @@ var init_service = __esm({
           }
           const coreInvite = this.packet(id).listInvites().find((invite) => invite.invite_id === replacementId);
           if (!coreInvite || coreInvite.mode !== replacement.mode) {
-            throw new RoomServiceError("recovered invite is no longer present in SDK identity state");
+            throw new RoomServiceError("recovered invite is no longer present in packet state");
           }
           const confirmed2 = {
             invite_id: replacement.invite_id,
@@ -7085,38 +7605,107 @@ var init_service = __esm({
         const id = LowerCrockfordUlidSchema.parse(roomId);
         return this.lock(id, async () => {
           const room = await this.store.load(id);
-          if (room.state !== "active") {
-            throw new RoomServiceError(`cannot post a room message while room "${id}" is not active`);
+          return this.appendChatUnlocked(id, room, {
+            identity: room.identity_cid,
+            display_name: room.identity_name,
+            role: ROOM_ROLE
+          }, request.text);
+        });
+      }
+      /**
+       * Register a role a REST caller may author under (spec §3.2). Idempotent, like
+       * revokeInvite. Registration does not consult seats: a role is a label, not a
+       * channel, so a role may be held by a seat and be REST-addressable at once.
+       */
+      async addRestRole(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RestRoleInputSchema.parse(input);
+        if (request.role === ROOM_ROLE) {
+          throw new RoomServiceError(`role "${ROOM_ROLE}" is reserved for the room's own voice`);
+        }
+        return this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "register a REST role for");
+          if (room.rest_roles.includes(request.role)) return room;
+          return this.store.save(RoomSchema.parse({
+            ...room,
+            rest_roles: [...room.rest_roles, request.role]
+          }));
+        });
+      }
+      /**
+       * Unregister a REST-addressable role. Messages it already authored are left
+       * exactly as posted and no tombstone is kept: there is no secret whose
+       * exposure window an auditor would need to reconstruct (spec §3.2).
+       */
+      async removeRestRole(roomId, input) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = RestRoleInputSchema.parse(input);
+        return this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertMutable(room, "remove a REST role from");
+          if (!room.rest_roles.includes(request.role)) return room;
+          return this.store.save(RoomSchema.parse({
+            ...room,
+            rest_roles: room.rest_roles.filter((role) => role !== request.role)
+          }));
+        });
+      }
+      /**
+       * Author a message under a registered REST role (spec §4). Room-side
+       * authorship: the room packet signs the bytes, so `identity` is the room's CID
+       * and the role name doubles as `display_name` — using the room's own name there
+       * would render as the room impersonating a foreign role.
+       */
+      async postAsRole(roomId, input) {
+        const request = PostAsRoleInputSchema.parse(input);
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        return this.lock(id, async () => {
+          const room = await this.store.load(id);
+          this.assertPostable(id, room);
+          if (!room.rest_roles.includes(request.role)) {
+            throw new RoomServiceError(`role "${request.role}" is not registered for REST authorship in room "${id}"`);
           }
-          const appended = await this.store.append(id, {
+          return this.appendChatUnlocked(id, room, {
+            identity: room.identity_cid,
+            display_name: request.role,
+            role: request.role
+          }, request.text);
+        });
+      }
+      /**
+       * The one operator-side chat append: archive the message, then journal one
+       * relay intent per active seat and resume the pump. Shared by postMessage and
+       * postAsRole so the two authorship paths cannot drift apart — only the author
+       * block differs between them. Caller holds the room lock and supplies the room
+       * it loaded inside that lock.
+       */
+      async appendChatUnlocked(id, room, author, text) {
+        this.assertPostable(id, room);
+        const appended = await this.store.append(id, {
+          version: 1,
+          kind: "message",
+          room_id: id,
+          at: this.now(),
+          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+          author,
+          category: "chat",
+          text,
+          recipient_identities: uniqueIdentities(activeSeats(room).map((seat) => seat.identity))
+        });
+        if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong room message kind");
+        for (const recipientIdentity of appended.recipient_identities) {
+          await this.store.append(id, {
             version: 1,
-            kind: "message",
+            kind: "relay_intent",
             room_id: id,
             at: this.now(),
-            message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
-            author: {
-              identity: room.identity_cid,
-              display_name: room.identity_name,
-              role: ROOM_ROLE
-            },
-            category: "chat",
-            text: request.text,
-            recipient_identities: uniqueIdentities(activeSeats(room).map((seat) => seat.identity))
+            message_id: appended.message_id,
+            recipient_identity: recipientIdentity
           });
-          if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong room message kind");
-          for (const recipientIdentity of appended.recipient_identities) {
-            await this.store.append(id, {
-              version: 1,
-              kind: "relay_intent",
-              room_id: id,
-              at: this.now(),
-              message_id: appended.message_id,
-              recipient_identity: recipientIdentity
-            });
-          }
-          await this.intake.resumePending(id);
-          return appended;
-        });
+        }
+        await this.intake.resumePending(id);
+        return appended;
       }
       async reconcileUnlocked(room, packet) {
         if (room.state === "closed" || room.state === "closing") return room;
@@ -7124,6 +7713,7 @@ var init_service = __esm({
         for (const contact of packet.listContacts()) {
           if (!contactsByCid.has(contact.container_id)) contactsByCid.set(contact.container_id, contact.name);
         }
+        const origins = packet.listContactOrigins();
         const inviteById = new Map(room.invites.map((invite) => [invite.invite_id, invite]));
         const existingCids = new Set(room.seats.filter((seat) => seat.state === "active" || seat.state === "pending").map((seat) => seat.identity));
         const lastRemovedAt = /* @__PURE__ */ new Map();
@@ -7139,26 +7729,37 @@ var init_service = __esm({
         for (const [seatIndex, seat] of room.seats.entries()) {
           if (seat.state !== "pending") continue;
           const displayName = contactsByCid.get(seat.identity);
-          if (displayName === void 0) continue;
+          const origin = origins[seat.identity];
+          if (displayName === void 0 || origin === void 0) continue;
+          const completedExternalRedemption = origin.via === "invite_redeemed" && origin.invite_id === seat.invite_id;
+          const fallbackInvite = origin.via === "invite_one_time" || origin.via === "invite_public" ? inviteById.get(origin.invite_id) : void 0;
+          const confirmedFallback = fallbackInvite !== void 0 && fallbackInvite.state !== "receipt_pending" && (fallbackInvite.recovery_of === void 0 || fallbackInvite.recovery_confirmed === true);
+          if (!completedExternalRedemption && !confirmedFallback) continue;
+          const removedAt = lastRemovedAt.get(seat.identity);
+          if (fallbackInvite !== void 0 && removedAt !== void 0 && fallbackInvite.created_at <= removedAt) continue;
+          const predecessor = fallbackInvite?.replaces_seat === void 0 ? void 0 : room.seats.find((candidate) => candidate.participant_id === fallbackInvite.replaces_seat && candidate.state === "removed");
+          if (fallbackInvite?.replaces_seat !== void 0 && predecessor === void 0) continue;
           const { alias: _alias, replaces_seat: _replacesSeat, ...base } = seat;
           const activated = {
             ...base,
             state: "active",
             display_name: displayName,
-            accepted_at: this.now(),
-            ..._replacesSeat === void 0 ? {} : { replaces_seat: _replacesSeat },
-            ...room.anonymous ? { alias: _alias } : {}
+            accepted_at: origin.at,
+            role: fallbackInvite?.role ?? seat.role,
+            invite_id: fallbackInvite?.invite_id ?? seat.invite_id,
+            ...fallbackInvite === void 0 ? _replacesSeat === void 0 ? {} : { replaces_seat: _replacesSeat } : predecessor === void 0 ? {} : { replaces_seat: predecessor.participant_id },
+            ...room.anonymous ? { alias: fallbackInvite === void 0 ? _alias : predecessor?.alias ?? (fallbackInvite.role === seat.role ? _alias : mintAlias(seatsWithActivations, fallbackInvite.role)) } : {}
           };
           activatedPending.push(activated);
           seatsWithActivations[seatIndex] = activated;
         }
         const newSeats = [];
-        const eligibleInvites = room.invites.filter((invite) => invite.state === "live" && (invite.recovery_of === void 0 || invite.recovery_confirmed === true));
-        const admissionInvite = eligibleInvites.length === 1 ? eligibleInvites[0] : void 0;
         for (const [cid, displayName] of contactsByCid) {
           if (existingCids.has(cid)) continue;
-          const invite = admissionInvite;
-          if (!invite) continue;
+          const origin = origins[cid];
+          if (!origin || origin.via !== "invite_one_time" && origin.via !== "invite_public") continue;
+          const invite = inviteById.get(origin.invite_id);
+          if (!invite || invite.state === "receipt_pending" || invite.recovery_of !== void 0 && invite.recovery_confirmed !== true) continue;
           const removedAt = lastRemovedAt.get(cid);
           if (removedAt !== void 0 && invite.created_at <= removedAt) continue;
           const seated = [...seatsWithActivations, ...newSeats];
@@ -7169,7 +7770,7 @@ var init_service = __esm({
             display_name: displayName,
             role: invite.role,
             invite_id: invite.invite_id,
-            accepted_at: this.now(),
+            accepted_at: origin.at,
             participant_id: LowerCrockfordUlidSchema.parse(generateUlid()),
             state: "active",
             ...predecessor === void 0 ? {} : { replaces_seat: predecessor.participant_id },
@@ -7420,13 +8021,18 @@ var init_service = __esm({
         if (!packet) throw new RoomServiceError(`room packet "${roomId}" is not hosted`);
         return packet;
       }
+      assertPostable(id, room) {
+        if (room.state !== "active") {
+          throw new RoomServiceError(`cannot post a room message while room "${id}" is not active`);
+        }
+      }
       assertMutable(room, action) {
         if (room.state === "closing" || room.state === "closed") {
           throw new RoomServiceError(`cannot ${action} room "${room.room_id}" while it is ${room.state}`);
         }
       }
       isPacketPending(room) {
-        return room.identity_cid === "" && room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === roomIdentityName(room.room_id);
+        return room.identity_cid === "" && room.state === "provisioning" && room.status === "packet_pending" && (room.identity_name === legacyRoomIdentityName(room.room_id) || room.identity_name === roomIdentityName(room.room_name));
       }
       now() {
         return external_exports.string().datetime({ offset: true }).parse(this.nowValue());
@@ -7437,9 +8043,9 @@ var init_service = __esm({
 
 // src/storage.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-import * as nodeFs2 from "node:fs";
+import * as nodeFs3 from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { dirname as dirname4, join as join4 } from "node:path";
 var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, utf8Decoder, CoworkStorageError, RoomQueue, CoworkStore;
 var init_storage = __esm({
   "src/storage.ts"() {
@@ -7448,7 +8054,7 @@ var init_storage = __esm({
     init_ulid();
     DIRECTORY_MODE2 = 448;
     FILE_MODE2 = 384;
-    NO_FOLLOW2 = nodeFs2.constants.O_NOFOLLOW ?? 0;
+    NO_FOLLOW2 = nodeFs3.constants.O_NOFOLLOW ?? 0;
     utf8Decoder = new TextDecoder("utf-8", { fatal: true });
     CoworkStorageError = class extends Error {
       constructor(message, options) {
@@ -7484,7 +8090,7 @@ var init_storage = __esm({
       constructor(stateDir, options = {}) {
         if (!stateDir) throw new CoworkStorageError("state directory is required");
         this.stateDir = stateDir;
-        this.fs = options.fs ?? nodeFs2;
+        this.fs = options.fs ?? nodeFs3;
       }
       mutex(roomId, work) {
         const validRoomId = this.roomId(roomId);
@@ -7617,7 +8223,7 @@ var init_storage = __esm({
           try {
             fd = this.fs.openSync(
               archivePath,
-              nodeFs2.constants.O_WRONLY | nodeFs2.constants.O_APPEND | NO_FOLLOW2
+              nodeFs3.constants.O_WRONLY | nodeFs3.constants.O_APPEND | NO_FOLLOW2
             );
             const opened = this.validateOpenPath(fd, archivePath, "room archive", "file", true);
             originalSize = opened.size;
@@ -7832,7 +8438,7 @@ var init_storage = __esm({
         try {
           fd = this.fs.openSync(
             temp,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
+            nodeFs3.constants.O_CREAT | nodeFs3.constants.O_EXCL | nodeFs3.constants.O_WRONLY | NO_FOLLOW2,
             FILE_MODE2
           );
           this.validateOpenPath(fd, temp, `temporary ${label}`, "file", true);
@@ -7842,7 +8448,7 @@ var init_storage = __esm({
           this.fs.closeSync(fd);
           fd = void 0;
           this.fs.renameSync(temp, path);
-          this.fsyncDirectory(dirname2(path));
+          this.fsyncDirectory(dirname4(path));
         } catch (error) {
           if (fd !== void 0) {
             try {
@@ -7938,7 +8544,7 @@ var init_storage = __esm({
             break;
           }
           missing.push(cursor);
-          const parent = dirname2(cursor);
+          const parent = dirname4(cursor);
           if (parent === cursor) throw new CoworkStorageError(`cannot find existing parent for ${label}`);
           cursor = parent;
         }
@@ -7949,13 +8555,13 @@ var init_storage = __esm({
             created.push(directory);
             this.fs.chmodSync(directory, DIRECTORY_MODE2);
             this.fsyncDirectory(directory);
-            this.fsyncDirectory(dirname2(directory));
+            this.fsyncDirectory(dirname4(directory));
           }
         } catch (error) {
           for (const directory of created.reverse()) {
             try {
               this.fs.rmdirSync(directory);
-              this.fsyncDirectory(dirname2(directory));
+              this.fsyncDirectory(dirname4(directory));
             } catch {
             }
           }
@@ -8005,7 +8611,7 @@ var init_storage = __esm({
         try {
           fd = this.fs.openSync(
             path,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
+            nodeFs3.constants.O_CREAT | nodeFs3.constants.O_EXCL | nodeFs3.constants.O_WRONLY | NO_FOLLOW2,
             FILE_MODE2
           );
           this.validateOpenPath(fd, path, "room archive", "file", true);
@@ -8014,7 +8620,7 @@ var init_storage = __esm({
         } finally {
           if (fd !== void 0) this.fs.closeSync(fd);
         }
-        this.fsyncDirectory(dirname2(path));
+        this.fsyncDirectory(dirname4(path));
       }
       atomicMetadataWrite(path, room) {
         if (this.lstatIfPresent(path)) this.assertRegularFile(path, "room metadata");
@@ -8025,7 +8631,7 @@ var init_storage = __esm({
         try {
           fd = this.fs.openSync(
             temp,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
+            nodeFs3.constants.O_CREAT | nodeFs3.constants.O_EXCL | nodeFs3.constants.O_WRONLY | NO_FOLLOW2,
             FILE_MODE2
           );
           this.validateOpenPath(fd, temp, "temporary room metadata", "file", true);
@@ -8035,7 +8641,7 @@ var init_storage = __esm({
           this.fs.closeSync(fd);
           fd = void 0;
           this.fs.renameSync(temp, path);
-          this.fsyncDirectory(dirname2(path));
+          this.fsyncDirectory(dirname4(path));
         } catch (error) {
           if (fd !== void 0) {
             try {
@@ -8061,7 +8667,7 @@ var init_storage = __esm({
       readFileNoFollow(path, label) {
         let fd;
         try {
-          fd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | NO_FOLLOW2);
+          fd = this.fs.openSync(path, nodeFs3.constants.O_RDONLY | NO_FOLLOW2);
           this.validateOpenPath(fd, path, label, "file", true);
           return this.fs.readFileSync(fd);
         } finally {
@@ -8071,7 +8677,7 @@ var init_storage = __esm({
       fsyncDirectory(path) {
         let fd;
         try {
-          fd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | NO_FOLLOW2);
+          fd = this.fs.openSync(path, nodeFs3.constants.O_RDONLY | NO_FOLLOW2);
           this.validateOpenPath(fd, path, "directory fsync target", "directory", false);
           this.fs.fsyncSync(fd);
         } finally {
@@ -8102,33 +8708,775 @@ var init_storage = __esm({
   }
 });
 
+// src/openapi.ts
+function params(properties, required) {
+  return { type: "object", additionalProperties: false, properties, required: [...required] };
+}
+function schemaBaseName(method) {
+  return method.split(".").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+}
+function errorResponseSpec(description, codes) {
+  return {
+    description,
+    content: {
+      "application/json": {
+        schema: { $ref: "#/components/schemas/RpcErrorResponse" },
+        example: {
+          version: 1,
+          id: "req-1",
+          error: { code: codes[0], message: "see the daemon response for detail" }
+        }
+      }
+    }
+  };
+}
+function documentResponseSpec(description, mediaType) {
+  return { description, content: { [mediaType]: { schema: { type: "string" } } } };
+}
+function buildOpenApiDocument() {
+  const schemas = {
+    RpcId: {
+      description: "Caller-chosen correlation id echoed in the response.",
+      oneOf: [
+        { type: "string", minLength: 1, maxLength: 256 },
+        { type: "integer", minimum: 0 }
+      ]
+    },
+    RpcError: {
+      type: "object",
+      additionalProperties: false,
+      required: ["code", "message"],
+      properties: {
+        code: {
+          type: "string",
+          enum: RPC_ERROR_CODES.map(([code]) => code),
+          description: RPC_ERROR_CODES.map(([code, text]) => `\`${code}\`: ${text}`).join(" ")
+        },
+        message: { type: "string", description: "Human-readable detail. Not machine-parsed." }
+      }
+    },
+    RpcSuccessResponse: {
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "id", "result"],
+      properties: {
+        version: { type: "integer", const: 1 },
+        id: { $ref: "#/components/schemas/RpcId" },
+        result: {
+          description: "Method-specific result. See the individual method descriptions."
+        }
+      }
+    },
+    RpcErrorResponse: {
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "id", "error"],
+      properties: {
+        version: { type: "integer", const: 1 },
+        id: {
+          description: "The request id, or null when it could not be recovered from the body.",
+          oneOf: [{ $ref: "#/components/schemas/RpcId" }, { type: "null" }]
+        },
+        error: { $ref: "#/components/schemas/RpcError" }
+      }
+    }
+  };
+  const requestSchemaNames = [];
+  const discriminatorMapping = {};
+  for (const entry of ROOM_RPC_METHODS) {
+    const base = schemaBaseName(entry.method);
+    const paramsName = `${base}Params`;
+    const requestName = `${base}Request`;
+    schemas[paramsName] = { ...entry.params, description: `Parameters for \`${entry.method}\`.` };
+    schemas[requestName] = {
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "id", "method", "params"],
+      title: entry.summary,
+      description: `${entry.description}
+
+Result: ${entry.result}`,
+      properties: {
+        version: { type: "integer", const: 1 },
+        id: { $ref: "#/components/schemas/RpcId" },
+        method: { type: "string", const: entry.method },
+        params: { $ref: `#/components/schemas/${paramsName}` }
+      },
+      examples: [{ version: 1, id: "req-1", method: entry.method, params: entry.example }]
+    };
+    requestSchemaNames.push(requestName);
+    discriminatorMapping[entry.method] = `#/components/schemas/${requestName}`;
+  }
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "ours-cowork room management API",
+      version: API_VERSION,
+      summary: "Loopback REST control surface for cowork mission rooms.",
+      description: [
+        'Every room-management operation is carried by a single REST route, `POST /rpc`, using the versioned RPC envelope `{ "version": 1, "id": ..., "method": ..., "params": ... }`. The `method` field selects the operation; the request schemas below are discriminated on it.',
+        "",
+        "The listener binds `127.0.0.1` only and has no authentication, so it accepts requests whose `Host` header is `127.0.0.1:<port>` or `localhost:<port>`, rejects cross-site fetches, and must not be exposed to other hosts through forwarding or a proxy.",
+        "",
+        "Requests must declare `Content-Type: application/json` and stay within 1 MiB. Operations that need an invite secret are not served here: they are reachable only over the daemon's private Unix socket."
+      ].join("\n"),
+      license: { name: "FSL-1.1-Apache-2.0" }
+    },
+    servers: [{ url: "/", description: "This cowork daemon, on its loopback REST port." }],
+    tags: [
+      { name: "rooms", description: "Room management over the RPC envelope." },
+      { name: "documentation", description: "The API description and its browser UI." }
+    ],
+    paths: {
+      [RPC_PATH]: {
+        post: {
+          tags: ["rooms"],
+          operationId: "roomManagementRpc",
+          summary: "Invoke a room-management method",
+          description: "Dispatches one room-management method. The HTTP status reflects the envelope outcome: 200 on success, 404 when the method is not served over REST, 500 on an internal failure, and 400 for every other error code \u2014 including `not_found`.",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  oneOf: requestSchemaNames.map((name) => ({ $ref: `#/components/schemas/${name}` })),
+                  discriminator: { propertyName: "method", mapping: discriminatorMapping }
+                }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "The method completed. `result` is method-specific.",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/RpcSuccessResponse" }
+                }
+              }
+            },
+            400: errorResponseSpec(
+              "The envelope, parameters, or room state rejected the call.",
+              [
+                "invalid_params",
+                "invalid_json",
+                "invalid_request",
+                "not_found",
+                "invalid_state",
+                "shutting_down"
+              ]
+            ),
+            403: errorResponseSpec(
+              "The Host header was not a loopback console authority, the Origin did not match it, or the fetch was cross-site.",
+              ["forbidden"]
+            ),
+            404: errorResponseSpec(
+              "The method is not part of the REST route table.",
+              ["method_not_found"]
+            ),
+            413: errorResponseSpec("The request body exceeded 1 MiB.", ["request_too_large"]),
+            415: errorResponseSpec(
+              "The request did not declare `application/json`.",
+              ["unsupported_media_type"]
+            ),
+            500: errorResponseSpec("The daemon failed to complete the operation.", ["internal"])
+          }
+        }
+      },
+      [OPENAPI_DOCUMENT_PATH]: {
+        get: {
+          tags: ["documentation"],
+          operationId: "getOpenApiDocument",
+          summary: "Fetch this OpenAPI document",
+          description: "Returns the OpenAPI 3.1 description of the room-management REST API.",
+          responses: {
+            200: {
+              description: "The OpenAPI document.",
+              content: { "application/json": { schema: { type: "object" } } }
+            }
+          }
+        }
+      },
+      [API_DOCS_PATH]: {
+        get: {
+          tags: ["documentation"],
+          operationId: "getApiDocsPage",
+          summary: "Open the API documentation UI",
+          description: `Serves the browser UI that renders \`${OPENAPI_DOCUMENT_PATH}\`.`,
+          responses: { 200: documentResponseSpec("The documentation page.", "text/html") }
+        }
+      },
+      [API_DOCS_SCRIPT_PATH]: {
+        get: {
+          tags: ["documentation"],
+          operationId: "getApiDocsScript",
+          summary: "Fetch the documentation UI script",
+          responses: { 200: documentResponseSpec("The UI script.", "text/javascript") }
+        }
+      },
+      [API_DOCS_STYLESHEET_PATH]: {
+        get: {
+          tags: ["documentation"],
+          operationId: "getApiDocsStylesheet",
+          summary: "Fetch the documentation UI stylesheet",
+          responses: { 200: documentResponseSpec("The UI stylesheet.", "text/css") }
+        }
+      }
+    },
+    components: { schemas }
+  };
+}
+function apiDocsAsset(pathname) {
+  switch (pathname) {
+    case OPENAPI_DOCUMENT_PATH:
+      return {
+        body: `${JSON.stringify(buildOpenApiDocument(), null, 2)}
+`,
+        contentType: "application/json; charset=utf-8"
+      };
+    case API_DOCS_PATH:
+      return { body: DOCS_PAGE, contentType: "text/html; charset=utf-8" };
+    case API_DOCS_SCRIPT_PATH:
+      return { body: DOCS_SCRIPT, contentType: "text/javascript; charset=utf-8" };
+    case API_DOCS_STYLESHEET_PATH:
+      return { body: DOCS_STYLESHEET, contentType: "text/css; charset=utf-8" };
+    default:
+      return void 0;
+  }
+}
+var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
+var init_openapi = __esm({
+  "src/openapi.ts"() {
+    "use strict";
+    RPC_PATH = "/rpc";
+    OPENAPI_DOCUMENT_PATH = "/openapi.json";
+    API_DOCS_PATH = "/docs";
+    API_DOCS_SCRIPT_PATH = "/docs/ui.js";
+    API_DOCS_STYLESHEET_PATH = "/docs/ui.css";
+    API_VERSION = "1";
+    EXAMPLE_ROOM_ID = "01jd7q4h9m2v8xk3znbc5regty";
+    roomIdProperty = {
+      type: "string",
+      pattern: "^[0-7][0-9a-hjkmnp-tv-z]{25}$",
+      description: "26-character lowercase Crockford ULID identifying the room."
+    };
+    roleProperty = {
+      type: "string",
+      description: "Invite role. At most 256 UTF-8 bytes."
+    };
+    restRoleProperty = {
+      type: "string",
+      description: "REST-addressable role name, matched by exact bytes. At most 256 UTF-8 bytes. The name `room` is reserved for the room's own voice."
+    };
+    missionTextProperty = (what) => ({
+      type: "string",
+      description: `${what}. At most 262144 UTF-8 bytes.`
+    });
+    roomNameProperty = {
+      type: "string",
+      description: "Friendly room name: 1-64 Unicode characters after trimming and NFC normalization, with no Unicode control or format characters. Duplicates are allowed."
+    };
+    inviteModeProperty = {
+      type: "string",
+      enum: ["one_time", "public"],
+      description: "Invitation mode. `one_time` requires `min_accepts` to be 1."
+    };
+    notifyProperty = {
+      type: "boolean",
+      description: "Announce the membership change to the room. Defaults to the room's quiet setting."
+    };
+    ROOM_RPC_METHODS = [
+      {
+        method: "room.create",
+        summary: "Create a room",
+        description: "Provisions a room, its durable metadata, and its room packet. The room stays in the provisioning state until its invitation requirements are satisfied.",
+        params: params({
+          name: roomNameProperty,
+          goal: missionTextProperty("Mission goal"),
+          briefing: missionTextProperty("Mission briefing"),
+          anonymous: {
+            type: "boolean",
+            description: "Project participants under aliases instead of contact identities."
+          },
+          quiet_membership: {
+            type: "boolean",
+            description: "Suppress membership announcements for this room by default."
+          }
+        }, ["goal", "briefing"]),
+        result: "The created room record, including `room_id`, `room_name`, `state`, mission, invites, and seats.",
+        example: { goal: "Ship the release", briefing: "Coordinate the 1.0 cut.", name: "Release" }
+      },
+      {
+        method: "room.settings",
+        summary: "Update room settings",
+        description: "Updates mutable room settings. At least one setting besides `room_id` is required; omitted settings are left unchanged.",
+        params: params({
+          room_id: roomIdProperty,
+          name: roomNameProperty,
+          goal: missionTextProperty("Replacement mission goal"),
+          briefing: missionTextProperty("Replacement mission briefing"),
+          status: { type: "string", minLength: 1, description: "Operator status line." },
+          quiet_membership: {
+            type: "boolean",
+            description: "Suppress membership announcements for this room."
+          }
+        }, ["room_id"]),
+        result: "The updated room record.",
+        example: { room_id: EXAMPLE_ROOM_ID, name: "Release cut" }
+      },
+      {
+        method: "room.briefing.role.set",
+        summary: "Set a role briefing",
+        description: "Creates or replaces the briefing for one role and bumps its briefing version.",
+        params: params({
+          room_id: roomIdProperty,
+          role: roleProperty,
+          text: missionTextProperty("Role briefing text")
+        }, ["room_id", "role", "text"]),
+        result: "The updated room record with the stored role briefing.",
+        example: { room_id: EXAMPLE_ROOM_ID, role: "Reviewer", text: "Review every merge request." }
+      },
+      {
+        method: "room.briefing.role.delete",
+        summary: "Delete a role briefing",
+        description: "Removes the briefing for one role.",
+        params: params({ room_id: roomIdProperty, role: roleProperty }, ["room_id", "role"]),
+        result: "The updated room record without the removed role briefing.",
+        example: { room_id: EXAMPLE_ROOM_ID, role: "Reviewer" }
+      },
+      {
+        method: "room.invite",
+        summary: "Mint an invitation requirement",
+        description: "Mints one invitation requirement and returns its receipt. The invite secret is returned once in `blob` and is never stored in room metadata or replayed by any later call.",
+        params: params({
+          room_id: roomIdProperty,
+          mode: inviteModeProperty,
+          role: roleProperty,
+          min_accepts: {
+            type: "integer",
+            minimum: 1,
+            description: "Acceptances required before the requirement is satisfied. Must be 1 for `one_time` invites."
+          }
+        }, ["room_id", "mode", "min_accepts"]),
+        result: "An invite receipt: `room_id`, the recorded `invite`, the one-shot `blob` secret, and `reusable`.",
+        example: { room_id: EXAMPLE_ROOM_ID, mode: "one_time", role: "Reviewer", min_accepts: 1 }
+      },
+      {
+        method: "room.participant.remove",
+        summary: "Remove a participant",
+        description: "Removes one participant seat, bumps the membership epoch, and severs the contact. The receipt reports what actually happened, including retained key material.",
+        params: params({
+          room_id: roomIdProperty,
+          participant: {
+            type: "string",
+            minLength: 1,
+            description: "Participant id, identity, display name, or alias."
+          },
+          notify: notifyProperty
+        }, ["room_id", "participant"]),
+        result: "A removal receipt with `participant_id`, `epoch`, `status`, `notified`, and `key_material_retained`.",
+        example: { room_id: EXAMPLE_ROOM_ID, participant: "Reviewer-1", notify: true }
+      },
+      {
+        method: "room.participant.replace",
+        summary: "Replace a participant",
+        description: "Removes one participant seat and mints a replacement invitation requirement in the same operation.",
+        params: params({
+          room_id: roomIdProperty,
+          participant: {
+            type: "string",
+            minLength: 1,
+            description: "Participant id, identity, display name, or alias."
+          },
+          notify: notifyProperty,
+          mode: inviteModeProperty,
+          min_accepts: {
+            type: "integer",
+            minimum: 1,
+            description: "Acceptances required for the replacement invitation requirement."
+          }
+        }, ["room_id", "participant"]),
+        result: "An invite receipt for the replacement, extended with the `removal` receipt.",
+        example: { room_id: EXAMPLE_ROOM_ID, participant: "Reviewer-1", mode: "one_time" }
+      },
+      {
+        method: "room.revoke",
+        summary: "Revoke an invitation requirement",
+        description: "Revokes one live invitation requirement so it can no longer admit a seat.",
+        params: params({
+          room_id: roomIdProperty,
+          invite_id: { type: "string", minLength: 1, description: "Recorded invite identifier." }
+        }, ["room_id", "invite_id"]),
+        result: "The updated room record with the invite marked revoked.",
+        example: { room_id: EXAMPLE_ROOM_ID, invite_id: "inv-01" }
+      },
+      {
+        method: "room.recover",
+        summary: "Recover unusable invitations",
+        description: "Mints recovery invitations for requirements whose secret can no longer admit a seat. Each recovery must be confirmed before it replaces the original.",
+        params: params({ room_id: roomIdProperty }, ["room_id"]),
+        result: "The list of recovery invite receipts, each carrying `recovery_of`.",
+        example: { room_id: EXAMPLE_ROOM_ID }
+      },
+      {
+        method: "room.recover.confirm",
+        summary: "Confirm a recovery invitation",
+        description: "Confirms that a recovery invitation was handed over, retiring the invitation requirement it recovers.",
+        params: params({
+          room_id: roomIdProperty,
+          recovery_of: { type: "string", minLength: 1, description: "Invite id being recovered." },
+          invite_id: { type: "string", minLength: 1, description: "Recovery invite id to confirm." }
+        }, ["room_id", "recovery_of", "invite_id"]),
+        result: "The updated room record with the confirmed recovery.",
+        example: { room_id: EXAMPLE_ROOM_ID, recovery_of: "inv-01", invite_id: "inv-02" }
+      },
+      {
+        method: "room.list",
+        summary: "List rooms",
+        description: "Lists every room held on this host. Takes no parameters.",
+        params: params({}, []),
+        result: "An array of room records.",
+        example: {}
+      },
+      {
+        method: "room.show",
+        summary: "Show one room",
+        description: "Returns the complete durable record for one room.",
+        params: params({ room_id: roomIdProperty }, ["room_id"]),
+        result: "The room record.",
+        example: { room_id: EXAMPLE_ROOM_ID }
+      },
+      {
+        method: "room.participants",
+        summary: "List participants",
+        description: "Returns the room's seats, including pending, active, and removed states.",
+        params: params({ room_id: roomIdProperty }, ["room_id"]),
+        result: "An array of seat records.",
+        example: { room_id: EXAMPLE_ROOM_ID }
+      },
+      {
+        method: "room.history",
+        summary: "Read room history",
+        description: "Reads one page of the room's ordered communication archive. The operator view returns every record kind; the participant view returns message records only, with routing identities removed and authors reduced to alias form in anonymous rooms.",
+        params: params({
+          room_id: roomIdProperty,
+          after: {
+            type: "integer",
+            minimum: 0,
+            description: "Return records with a sequence number greater than this value."
+          },
+          limit: { type: "integer", minimum: 1, description: "Maximum number of records to return." },
+          view: {
+            type: "string",
+            enum: ["operator", "participant"],
+            description: "History projection. Defaults to the operator view."
+          }
+        }, ["room_id"]),
+        result: "An array of communication records, byte-bounded to one page.",
+        example: { room_id: EXAMPLE_ROOM_ID, after: 0, limit: 50, view: "operator" }
+      },
+      {
+        method: "room.message",
+        summary: "Post an operator message",
+        description: "Appends an operator message to the room archive and relays it to active seats. Authorship is assigned by the daemon.",
+        params: params({
+          room_id: roomIdProperty,
+          text: missionTextProperty("Message text")
+        }, ["room_id", "text"]),
+        result: "The appended message record with its `seq` and `record_id`.",
+        example: { room_id: EXAMPLE_ROOM_ID, text: "Standup at 10:00." }
+      },
+      {
+        method: "room.say",
+        summary: "Post a message as a registered role",
+        description: "Appends a message authored under one of the room's REST-addressable roles and relays it to active seats. The message carries the room's identity and the role as its label; the role must already be registered with `room.role.rest.add`. A room with no active seats accepts the message and relays it to nobody.",
+        params: params({
+          room_id: roomIdProperty,
+          role: restRoleProperty,
+          text: missionTextProperty("Message text")
+        }, ["room_id", "role", "text"]),
+        result: "The appended message record with its `seq` and `record_id`.",
+        example: { room_id: EXAMPLE_ROOM_ID, role: "Reviewer", text: "Reviewed the release diff." }
+      },
+      {
+        method: "room.role.rest.add",
+        summary: "Register a REST-addressable role",
+        description: "Makes a role available to `room.say`. Registering an already-registered role changes nothing. The name `room` is reserved for the room's own voice. A role may also be held by a participant: a role is a display label, not a channel.",
+        params: params({ room_id: roomIdProperty, role: restRoleProperty }, ["room_id", "role"]),
+        result: "The updated room record, including `rest_roles`.",
+        example: { room_id: EXAMPLE_ROOM_ID, role: "Reviewer" }
+      },
+      {
+        method: "room.role.rest.remove",
+        summary: "Unregister a REST-addressable role",
+        description: "Stops accepting `room.say` for this role. Removing a role that is not registered changes nothing, and messages the role already authored are left untouched.",
+        params: params({ room_id: roomIdProperty, role: restRoleProperty }, ["room_id", "role"]),
+        result: "The updated room record, including `rest_roles`.",
+        example: { room_id: EXAMPLE_ROOM_ID, role: "Reviewer" }
+      },
+      {
+        method: "room.close",
+        summary: "Close a room",
+        description: "Closes the room forward-only. The plaintext local archive is left in place.",
+        params: params({ room_id: roomIdProperty }, ["room_id"]),
+        result: "The closed room record.",
+        example: { room_id: EXAMPLE_ROOM_ID }
+      },
+      {
+        method: "room.delete",
+        summary: "Delete a room",
+        description: "Removes this host's local room state after the room is closed. The scope is this host only.",
+        params: params({
+          room_id: roomIdProperty,
+          confirm: { type: "boolean", const: true, description: "Must be `true`." }
+        }, ["room_id", "confirm"]),
+        result: 'A delete receipt: `{ "version": 1, "room_id": "...", "deleted": true, "scope": "this_host" }`.',
+        example: { room_id: EXAMPLE_ROOM_ID, confirm: true }
+      }
+    ];
+    RPC_ERROR_CODES = [
+      ["invalid_json", "The request body was not valid JSON."],
+      ["invalid_request", "The RPC envelope did not match the strict envelope schema."],
+      ["invalid_params", "The `params` object failed method validation."],
+      ["not_found", "The referenced room or record does not exist."],
+      ["invalid_state", "The room is not in a state that permits the operation."],
+      ["shutting_down", "The daemon stopped accepting work."],
+      ["method_not_found", "The method is not served over REST."],
+      ["unsupported_media_type", "The request did not declare `application/json`."],
+      ["forbidden", "The request origin or Host header was not the loopback console origin."],
+      ["request_too_large", "The request body exceeded 1 MiB."],
+      ["internal", "The daemon failed to complete the operation."]
+    ];
+    DOCS_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ours-cowork room management API</title>
+<link rel="stylesheet" href="${API_DOCS_STYLESHEET_PATH}">
+</head>
+<body>
+<main id="api-docs" data-document="${OPENAPI_DOCUMENT_PATH}" data-rpc="${RPC_PATH}">
+<p class="loading">Loading <code>${OPENAPI_DOCUMENT_PATH}</code>&hellip;</p>
+</main>
+<script src="${API_DOCS_SCRIPT_PATH}"></script>
+</body>
+</html>
+`;
+    DOCS_STYLESHEET = `:root { color-scheme: light dark; --line: #8883; --accent: #2563eb; }
+* { box-sizing: border-box; }
+body { margin: 0; font: 15px/1.5 ui-sans-serif, system-ui, sans-serif; }
+main { margin: 0 auto; max-width: 60rem; padding: 2rem 1.25rem 4rem; }
+h1 { font-size: 1.6rem; margin: 0 0 .25rem; }
+h2 { font-size: 1.15rem; margin: 2rem 0 .5rem; }
+code, pre, textarea { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .86em; }
+pre { background: #8881; border-radius: 6px; margin: 0; overflow-x: auto; padding: .6rem .75rem; }
+.subtitle { color: #8889; margin: 0 0 1rem; }
+.intro { border-left: 3px solid var(--accent); padding-left: .9rem; white-space: pre-wrap; }
+.route { border: 1px solid var(--line); border-radius: 8px; margin-bottom: .5rem; padding: .6rem .8rem; }
+.verb { background: var(--accent); border-radius: 4px; color: #fff; font-size: .72rem;
+  font-weight: 700; letter-spacing: .04em; margin-right: .5rem; padding: .12rem .4rem; }
+details.method { border: 1px solid var(--line); border-radius: 8px; margin-bottom: .5rem; }
+details.method > summary { cursor: pointer; padding: .6rem .8rem; }
+details.method[open] > summary { border-bottom: 1px solid var(--line); }
+summary .name { font-family: ui-monospace, monospace; font-weight: 600; }
+summary .summary-text { color: #8889; margin-left: .6rem; }
+.body { padding: .8rem; }
+.description { margin: 0 0 .8rem; white-space: pre-wrap; }
+table { border-collapse: collapse; margin-bottom: .8rem; width: 100%; }
+th, td { border-bottom: 1px solid var(--line); padding: .35rem .5rem; text-align: left;
+  vertical-align: top; }
+th { font-size: .78rem; letter-spacing: .04em; text-transform: uppercase; }
+td.param { font-family: ui-monospace, monospace; white-space: nowrap; }
+.required { color: #b91c1c; font-size: .75rem; margin-left: .3rem; }
+textarea { border: 1px solid var(--line); border-radius: 6px; padding: .5rem; width: 100%; }
+button { background: var(--accent); border: 0; border-radius: 6px; color: #fff; cursor: pointer;
+  font: inherit; margin: .5rem 0; padding: .4rem 1rem; }
+.status { font-weight: 600; margin: .5rem 0 .35rem; }
+.status.failed { color: #b91c1c; }
+.error { color: #b91c1c; }
+`;
+    DOCS_SCRIPT = `'use strict';
+(function () {
+  var root = document.getElementById('api-docs');
+  var documentUrl = root.dataset.document;
+  var rpcUrl = root.dataset.rpc;
+
+  function element(tag, className, text) {
+    var node = document.createElement(tag);
+    if (className) node.className = className;
+    if (text !== undefined) node.textContent = text;
+    return node;
+  }
+
+  function resolveRef(spec, ref) {
+    return ref.replace(/^#\\//, '').split('/').reduce(function (node, part) {
+      return node === undefined ? undefined : node[part];
+    }, spec);
+  }
+
+  function typeLabel(schema) {
+    if (!schema) return 'any';
+    if (schema.const !== undefined) return JSON.stringify(schema.const);
+    if (schema.enum) return schema.enum.map(function (value) { return JSON.stringify(value); }).join(' | ');
+    return schema.type || 'any';
+  }
+
+  function parameterTable(schema) {
+    var properties = (schema && schema.properties) || {};
+    var names = Object.keys(properties);
+    if (names.length === 0) return element('p', 'description', 'No parameters.');
+    var required = (schema && schema.required) || [];
+    var table = document.createElement('table');
+    var head = table.insertRow();
+    ['Parameter', 'Type', 'Description'].forEach(function (label) {
+      head.appendChild(element('th', null, label));
+    });
+    names.forEach(function (name) {
+      var property = properties[name];
+      var row = table.insertRow();
+      var cell = element('td', 'param', name);
+      if (required.indexOf(name) >= 0) cell.appendChild(element('span', 'required', 'required'));
+      row.appendChild(cell);
+      row.appendChild(element('td', null, typeLabel(property)));
+      row.appendChild(element('td', null, property.description || ''));
+    });
+    return table;
+  }
+
+  function tryItPanel(example) {
+    var panel = document.createElement('div');
+    var input = document.createElement('textarea');
+    input.rows = Math.min(14, JSON.stringify(example, null, 2).split('\\n').length + 1);
+    input.value = JSON.stringify(example, null, 2);
+    input.setAttribute('aria-label', 'Request body');
+    var send = element('button', null, 'Send request');
+    var output = document.createElement('div');
+    send.addEventListener('click', function () {
+      var body = input.value;
+      try { JSON.parse(body); } catch (error) {
+        output.textContent = '';
+        output.appendChild(element('p', 'status failed', 'Request body is not valid JSON.'));
+        return;
+      }
+      send.disabled = true;
+      output.textContent = '';
+      output.appendChild(element('p', 'status', 'Sending\\u2026'));
+      fetch(rpcUrl, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: body,
+      }).then(function (response) {
+        return response.text().then(function (text) { return { status: response.status, text: text }; });
+      }).then(function (result) {
+        var pretty = result.text;
+        try { pretty = JSON.stringify(JSON.parse(result.text), null, 2); } catch (error) { /* raw */ }
+        output.textContent = '';
+        output.appendChild(element(
+          'p',
+          result.status === 200 ? 'status' : 'status failed',
+          'HTTP ' + result.status
+        ));
+        output.appendChild(element('pre', null, pretty));
+      }).catch(function (error) {
+        output.textContent = '';
+        output.appendChild(element('p', 'status failed', 'Request failed: ' + error));
+      }).then(function () { send.disabled = false; });
+    });
+    panel.appendChild(element('h3', null, 'Try it'));
+    panel.appendChild(input);
+    panel.appendChild(send);
+    panel.appendChild(output);
+    return panel;
+  }
+
+  function methodPanel(spec, ref) {
+    var schema = resolveRef(spec, ref);
+    var method = schema.properties.method.const;
+    var panel = element('details', 'method');
+    var summary = document.createElement('summary');
+    summary.appendChild(element('span', 'name', method));
+    summary.appendChild(element('span', 'summary-text', schema.title || ''));
+    panel.appendChild(summary);
+    var body = element('div', 'body');
+    body.appendChild(element('p', 'description', schema.description || ''));
+    body.appendChild(parameterTable(resolveRef(spec, schema.properties.params.$ref)));
+    body.appendChild(tryItPanel((schema.examples && schema.examples[0]) || {
+      version: 1, id: 'req-1', method: method, params: {},
+    }));
+    panel.appendChild(body);
+    return panel;
+  }
+
+  function renderRoutes(spec) {
+    var section = document.createDocumentFragment();
+    Object.keys(spec.paths).forEach(function (path) {
+      Object.keys(spec.paths[path]).forEach(function (verb) {
+        var operation = spec.paths[path][verb];
+        var route = element('div', 'route');
+        var heading = document.createElement('div');
+        heading.appendChild(element('span', 'verb', verb.toUpperCase()));
+        heading.appendChild(element('code', null, path));
+        route.appendChild(heading);
+        route.appendChild(element('p', 'description', operation.summary || ''));
+        section.appendChild(route);
+      });
+    });
+    return section;
+  }
+
+  function render(spec) {
+    root.textContent = '';
+    root.appendChild(element('h1', null, spec.info.title));
+    root.appendChild(element('p', 'subtitle', 'API version ' + spec.info.version + ' \\u00b7 OpenAPI ' + spec.openapi));
+    root.appendChild(element('p', 'intro', spec.info.description || ''));
+    root.appendChild(element('h2', null, 'Routes'));
+    root.appendChild(renderRoutes(spec));
+    root.appendChild(element('h2', null, 'Room management methods'));
+    var alternatives = spec.paths[rpcUrl].post.requestBody.content['application/json'].schema.oneOf;
+    alternatives.forEach(function (alternative) {
+      root.appendChild(methodPanel(spec, alternative.$ref));
+    });
+  }
+
+  fetch(documentUrl).then(function (response) {
+    if (!response.ok) throw new Error('HTTP ' + response.status);
+    return response.json();
+  }).then(render).catch(function (error) {
+    root.textContent = '';
+    root.appendChild(element('p', 'error', 'Could not load ' + documentUrl + ': ' + error));
+  });
+}());
+`;
+  }
+});
+
 // src/web.ts
-import * as nodeFs3 from "node:fs";
+import * as nodeFs4 from "node:fs";
 import { extname, join as join5 } from "node:path";
-function loadWebAssets(root, fs3 = nodeFs3) {
+function loadWebAssets(root, fs2 = nodeFs4) {
   let rootIdentity;
   try {
-    rootIdentity = observeDirectory(fs3, root, "web asset root");
+    rootIdentity = observeDirectory(fs2, root, "web asset root");
   } catch (error) {
     if (error.code === "ENOENT") return /* @__PURE__ */ new Map();
     throw error;
   }
   const manifest = /* @__PURE__ */ new Map();
-  manifest.set("/", loadAsset(fs3, join5(root, "index.html"), false, [rootIdentity]));
+  manifest.set("/", loadAsset(fs2, join5(root, "index.html"), false, [rootIdentity]));
   const assetsDirectory = join5(root, "assets");
-  assertDirectoryIdentity(fs3, rootIdentity);
-  const assetsIdentity = observeDirectory(fs3, assetsDirectory, "web assets directory");
-  assertDirectoryIdentity(fs3, rootIdentity);
+  assertDirectoryIdentity(fs2, rootIdentity);
+  const assetsIdentity = observeDirectory(fs2, assetsDirectory, "web assets directory");
+  assertDirectoryIdentity(fs2, rootIdentity);
   const directories = [rootIdentity, assetsIdentity];
-  assertDirectoryIdentities(fs3, directories);
-  const assetEntries = fs3.readdirSync(assetsDirectory, { withFileTypes: true });
-  assertDirectoryIdentities(fs3, directories);
+  assertDirectoryIdentities(fs2, directories);
+  const assetEntries = fs2.readdirSync(assetsDirectory, { withFileTypes: true });
+  assertDirectoryIdentities(fs2, directories);
   for (const entry of assetEntries) {
     if (!entry.isFile() || entry.isSymbolicLink()) continue;
     const path = join5(assetsDirectory, entry.name);
-    manifest.set(`/assets/${entry.name}`, loadAsset(fs3, path, true, directories));
+    manifest.set(`/assets/${entry.name}`, loadAsset(fs2, path, true, directories));
   }
-  assertDirectoryIdentities(fs3, directories);
+  assertDirectoryIdentities(fs2, directories);
   return manifest;
 }
 function createStaticWebHandler(assets) {
@@ -8151,44 +9499,44 @@ function createStaticWebHandler(assets) {
     return true;
   };
 }
-function loadAsset(fs3, path, immutable, directories) {
-  assertDirectoryIdentities(fs3, directories);
-  const observed = fs3.lstatSync(path);
-  assertDirectoryIdentities(fs3, directories);
+function loadAsset(fs2, path, immutable, directories) {
+  assertDirectoryIdentities(fs2, directories);
+  const observed = fs2.lstatSync(path);
+  assertDirectoryIdentities(fs2, directories);
   if (observed.isSymbolicLink() || !observed.isFile() || observed.nlink !== 1) {
     throw new Error(`web asset must be a non-symbolic-link regular file: ${path}`);
   }
   let fd;
   try {
-    fd = fs3.openSync(path, nodeFs3.constants.O_RDONLY | NO_FOLLOW3);
-    const opened = fs3.fstatSync(fd);
-    assertDirectoryIdentities(fs3, directories);
+    fd = fs2.openSync(path, nodeFs4.constants.O_RDONLY | NO_FOLLOW3);
+    const opened = fs2.fstatSync(fd);
+    assertDirectoryIdentities(fs2, directories);
     if (!opened.isFile() || opened.nlink !== 1 || opened.dev !== observed.dev || opened.ino !== observed.ino) {
       throw new Error(`web asset changed while opening: ${path}`);
     }
-    const bytes = fs3.readFileSync(fd);
-    assertDirectoryIdentities(fs3, directories);
+    const bytes = fs2.readFileSync(fd);
+    assertDirectoryIdentities(fs2, directories);
     return {
       bytes,
       contentType: CONTENT_TYPES.get(extname(path).toLowerCase()) ?? "application/octet-stream",
       immutable
     };
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function observeDirectory(fs3, path, label) {
-  const stat = fs3.lstatSync(path);
+function observeDirectory(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     throw new Error(`${label} must be a non-symbolic-link directory`);
   }
   return { path, label, dev: stat.dev, ino: stat.ino };
 }
-function assertDirectoryIdentities(fs3, directories) {
-  for (const directory of directories) assertDirectoryIdentity(fs3, directory);
+function assertDirectoryIdentities(fs2, directories) {
+  for (const directory of directories) assertDirectoryIdentity(fs2, directory);
 }
-function assertDirectoryIdentity(fs3, expected) {
-  const current = fs3.lstatSync(expected.path);
+function assertDirectoryIdentity(fs2, expected) {
+  const current = fs2.lstatSync(expected.path);
   if (current.isSymbolicLink() || !current.isDirectory() || current.dev !== expected.dev || current.ino !== expected.ino) {
     throw new Error(`${expected.label} changed during web asset loading`);
   }
@@ -8227,7 +9575,7 @@ var NO_FOLLOW3, CONTENT_SECURITY_POLICY, CONTENT_TYPES;
 var init_web = __esm({
   "src/web.ts"() {
     "use strict";
-    NO_FOLLOW3 = nodeFs3.constants.O_NOFOLLOW ?? 0;
+    NO_FOLLOW3 = nodeFs4.constants.O_NOFOLLOW ?? 0;
     CONTENT_SECURITY_POLICY = [
       "default-src 'self'",
       "script-src 'self'",
@@ -8264,12 +9612,12 @@ var init_web = __esm({
 import { randomBytes as randomBytes4 } from "node:crypto";
 import * as http from "node:http";
 import * as net from "node:net";
-import * as nodeFs4 from "node:fs";
-import { basename, dirname as dirname3, join as join6 } from "node:path";
+import * as nodeFs5 from "node:fs";
+import { basename, dirname as dirname5, join as join6 } from "node:path";
 function createServiceRoutes(service) {
   return {
-    "room.create": { auth: true, run: (params) => service.createRoom(params) },
-    "room.settings": { auth: true, run: (params) => {
+    "room.create": { auth: true, run: (params2) => service.createRoom(params2) },
+    "room.settings": { auth: true, run: (params2) => {
       const { room_id, ...input } = external_exports.object({
         room_id: external_exports.string(),
         name: external_exports.unknown().optional(),
@@ -8277,68 +9625,86 @@ function createServiceRoutes(service) {
         briefing: external_exports.unknown().optional(),
         status: external_exports.unknown().optional(),
         quiet_membership: external_exports.unknown().optional()
-      }).strict().parse(params);
+      }).strict().parse(params2);
       return service.updateRoom(room_id, input);
     } },
-    "room.briefing.role.set": { auth: true, run: (params) => {
-      const { room_id, ...input } = RoleBriefingSetParams.parse(params);
+    "room.briefing.role.set": { auth: true, run: (params2) => {
+      const { room_id, ...input } = RoleBriefingSetParams.parse(params2);
       return service.setRoleBriefing(room_id, input);
     } },
-    "room.briefing.role.delete": { auth: true, run: (params) => {
-      const { room_id, ...input } = RoleBriefingDeleteParams.parse(params);
+    "room.briefing.role.delete": { auth: true, run: (params2) => {
+      const { room_id, ...input } = RoleBriefingDeleteParams.parse(params2);
       return service.deleteRoleBriefing(room_id, input);
     } },
-    "room.invite": { auth: true, run: (params) => {
+    "room.invite": { auth: true, run: (params2) => {
       const { room_id, ...input } = external_exports.object({
         room_id: external_exports.string(),
         mode: external_exports.unknown(),
         role: external_exports.unknown().optional(),
         min_accepts: external_exports.unknown()
-      }).strict().parse(params);
+      }).strict().parse(params2);
       return service.createInvite(room_id, input);
     } },
-    "room.participant.remove": { auth: true, run: (params) => {
-      const { room_id, ...input } = ParticipantRemoveParams.parse(params);
+    "room.participant.remove": { auth: true, run: (params2) => {
+      const { room_id, ...input } = ParticipantRemoveParams.parse(params2);
       return service.removeParticipant(room_id, input);
     } },
-    "room.participant.replace": { auth: true, run: (params) => {
-      const { room_id, ...input } = ParticipantReplaceParams.parse(params);
+    "room.participant.replace": { auth: true, run: (params2) => {
+      const { room_id, ...input } = ParticipantReplaceParams.parse(params2);
       return service.replaceParticipant(room_id, input);
     } },
-    "room.revoke": { auth: true, run: (params) => {
-      const value = InviteRevokeParams.parse(params);
+    "room.revoke": { auth: true, run: (params2) => {
+      const value = InviteRevokeParams.parse(params2);
       return service.revokeInvite(value.room_id, value.invite_id);
     } },
-    "room.recover": { auth: true, run: (params) => service.recoverInvites(RoomIdParams.parse(params).room_id) },
-    "room.recover.confirm": { auth: true, run: (params) => {
-      const value = RecoverConfirmParams.parse(params);
+    "room.recover": { auth: true, run: (params2) => service.recoverInvites(RoomIdParams.parse(params2).room_id) },
+    "room.recover.confirm": { auth: true, run: (params2) => {
+      const value = RecoverConfirmParams.parse(params2);
       return service.confirmRecoveredInvite(value.room_id, value.recovery_of, value.invite_id);
     } },
-    "room.list": { auth: true, run: (params) => {
-      external_exports.object({}).strict().parse(params);
+    "room.list": { auth: true, run: (params2) => {
+      external_exports.object({}).strict().parse(params2);
       return service.listRooms();
     } },
-    "room.show": { auth: true, run: (params) => service.showRoom(RoomIdParams.parse(params).room_id) },
-    "room.participants": { auth: true, run: (params) => service.participants(RoomIdParams.parse(params).room_id) },
-    "room.history": { auth: true, run: (params) => {
-      const { room_id, ...options } = HistoryParams.parse(params);
+    "room.show": { auth: true, run: (params2) => service.showRoom(RoomIdParams.parse(params2).room_id) },
+    "room.participants": { auth: true, run: (params2) => service.participants(RoomIdParams.parse(params2).room_id) },
+    "room.history": { auth: true, run: (params2) => {
+      const { room_id, ...options } = HistoryParams.parse(params2);
       return service.history(room_id, options);
     } },
-    "room.message": { auth: true, run: (params) => {
-      const { room_id, ...input } = external_exports.object({ room_id: external_exports.string(), text: external_exports.unknown() }).strict().parse(params);
+    "room.message": { auth: true, run: (params2) => {
+      const { room_id, ...input } = external_exports.object({ room_id: external_exports.string(), text: external_exports.unknown() }).strict().parse(params2);
       return service.postMessage(room_id, input);
     } },
-    "room.close": { auth: true, run: (params) => service.closeRoom(RoomIdParams.parse(params).room_id) },
-    "room.delete": { auth: true, run: (params) => {
-      const { room_id, ...input } = external_exports.object({ room_id: external_exports.string(), confirm: external_exports.unknown() }).strict().parse(params);
+    // Role authorship: served over REST, which is the point of the feature. No
+    // secret is ingested in either direction, so the Unix-only rule does not apply.
+    "room.say": { auth: true, run: (params2) => {
+      const { room_id, ...input } = external_exports.object({
+        room_id: external_exports.string(),
+        role: external_exports.unknown(),
+        text: external_exports.unknown()
+      }).strict().parse(params2);
+      return service.postAsRole(room_id, input);
+    } },
+    "room.role.rest.add": { auth: true, run: (params2) => {
+      const { room_id, ...input } = RestRoleParams.parse(params2);
+      return service.addRestRole(room_id, input);
+    } },
+    "room.role.rest.remove": { auth: true, run: (params2) => {
+      const { room_id, ...input } = RestRoleParams.parse(params2);
+      return service.removeRestRole(room_id, input);
+    } },
+    "room.close": { auth: true, run: (params2) => service.closeRoom(RoomIdParams.parse(params2).room_id) },
+    "room.delete": { auth: true, run: (params2) => {
+      const { room_id, ...input } = external_exports.object({ room_id: external_exports.string(), confirm: external_exports.unknown() }).strict().parse(params2);
       return service.deleteRoom(room_id, input);
     } }
   };
 }
 function createPrivateServiceRoutes(service) {
   return {
-    "room.accept": { auth: true, run: (params) => {
-      const { room_id, ...input } = ExternalInviteAcceptParams.parse(params);
+    "room.accept": { auth: true, run: (params2) => {
+      const { room_id, ...input } = ExternalInviteAcceptParams.parse(params2);
       return service.acceptExternalInvite(room_id, input);
     } }
   };
@@ -8358,6 +9724,23 @@ function isJsonMediaType(value) {
   const mediaType = value.split(";", 1)[0]?.trim().toLowerCase();
   return mediaType === "application/json" || mediaType?.startsWith("application/") === true && mediaType.endsWith("+json");
 }
+async function serveApiDocs(request, response) {
+  const pathname = safePathname(request.url);
+  if (pathname === void 0) return false;
+  const asset = apiDocsAsset(pathname);
+  if (!asset) return false;
+  const body = Buffer.from(asset.body, "utf8");
+  response.writeHead(200, {
+    "content-type": asset.contentType,
+    "content-length": body.length,
+    "cache-control": "no-cache",
+    "content-security-policy": CONTENT_SECURITY_POLICY,
+    "x-content-type-options": "nosniff"
+  });
+  response.end(body);
+  await responseFinished2(response);
+  return true;
+}
 function sendJson(response, status, value) {
   const body = Buffer.from(JSON.stringify(value), "utf8");
   response.writeHead(status, {
@@ -8470,11 +9853,12 @@ function responseFinished2(response) {
     response.once("error", rejectResponse);
   });
 }
-var MAX_REQUEST_BYTES, HTTP_HEADERS_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, HTTP_BODY_IDLE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, MAX_STALE_PRIVATE_SOCKET_CLEANUP, RpcIdSchema, RpcRequestSchema, RpcDispatcher, RoomIdParams, InviteRevokeParams, RecoverConfirmParams, HistoryParams, RoleBriefingSetParams, RoleBriefingDeleteParams, ParticipantRemoveParams, ParticipantReplaceParams, ExternalInviteAcceptParams, TransportServer;
+var MAX_REQUEST_BYTES, HTTP_HEADERS_TIMEOUT_MS, HTTP_REQUEST_TIMEOUT_MS, HTTP_BODY_IDLE_TIMEOUT_MS, HTTP_KEEP_ALIVE_TIMEOUT_MS, MAX_STALE_PRIVATE_SOCKET_CLEANUP, RpcIdSchema, RpcRequestSchema, RpcDispatcher, RoomIdParams, InviteRevokeParams, RecoverConfirmParams, HistoryParams, RoleBriefingSetParams, RoleBriefingDeleteParams, RestRoleParams, ParticipantRemoveParams, ParticipantReplaceParams, ExternalInviteAcceptParams, TransportServer;
 var init_transports = __esm({
   "src/transports.ts"() {
     "use strict";
     init_zod();
+    init_openapi();
     init_web();
     MAX_REQUEST_BYTES = 1024 * 1024;
     HTTP_HEADERS_TIMEOUT_MS = 5e3;
@@ -8557,6 +9941,10 @@ var init_transports = __esm({
       room_id: external_exports.string(),
       role: external_exports.string()
     }).strict();
+    RestRoleParams = external_exports.object({
+      room_id: external_exports.string(),
+      role: external_exports.string()
+    }).strict();
     ParticipantRemoveParams = external_exports.object({
       room_id: external_exports.string(),
       participant: external_exports.string(),
@@ -8594,7 +9982,7 @@ var init_transports = __esm({
       protectedPrivateReplacement;
       constructor(options) {
         this.options = options;
-        this.fs = options.fs ?? nodeFs4;
+        this.fs = options.fs ?? nodeFs5;
         this.staticHandler = options.staticHandler ?? createStaticWebHandler(/* @__PURE__ */ new Map());
       }
       get restAddress() {
@@ -8741,6 +10129,7 @@ var init_transports = __esm({
           if (request.url !== "/rpc") {
             if (request.method === "GET") {
               activateResponse();
+              if (await serveApiDocs(request, response)) return;
               if (await this.staticHandler(request, response)) return;
             }
             activateResponse();
@@ -8889,7 +10278,7 @@ var init_transports = __esm({
         throw new Error(`private management socket changed during removal; replacement protected at ${quarantined.path}`);
       }
       async cleanupStalePrivateSockets() {
-        const directory = dirname3(this.options.socketPath);
+        const directory = dirname5(this.options.socketPath);
         const prefix = `${basename(this.options.socketPath)}.private-`;
         const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
         const candidates = this.fs.readdirSync(directory).filter((name) => name.startsWith(prefix)).sort().slice(0, MAX_STALE_PRIVATE_SOCKET_CLEANUP);
@@ -8997,24 +10386,24 @@ __export(daemon_runtime_exports, {
   removeDaemonPid: () => removeDaemonPid,
   writeDaemonPid: () => writeDaemonPid
 });
-import * as nodeFs5 from "node:fs";
+import * as nodeFs6 from "node:fs";
 import { join as join7 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function isIntakeNotification(event) {
   return event === "message_received" || event === "file_received" || event === "contact_accepted" || event === "contact_added";
 }
 function createDaemonControlRoutes(control) {
   if (!/^[0-9a-f]{32}$/.test(control.session)) throw new TypeError("invalid daemon control session");
-  const requireExact = (params, keys) => {
-    if (Object.keys(params).length !== keys.length || keys.some((key) => !Object.hasOwn(params, key))) {
+  const requireExact = (params2, keys) => {
+    if (Object.keys(params2).length !== keys.length || keys.some((key) => !Object.hasOwn(params2, key))) {
       throw new TypeError("invalid daemon control parameters");
     }
   };
   return {
     "daemon.status": {
       auth: true,
-      run(params) {
-        requireExact(params, []);
+      run(params2) {
+        requireExact(params2, []);
         return {
           version: 1,
           protocol: "cowork-supervisor-control",
@@ -9025,9 +10414,9 @@ function createDaemonControlRoutes(control) {
     },
     "daemon.shutdown": {
       auth: true,
-      async run(params) {
-        requireExact(params, ["session"]);
-        if (params.session !== control.session) throw new TypeError("daemon control session changed");
+      async run(params2) {
+        requireExact(params2, ["session"]);
+        if (params2.session !== control.session) throw new TypeError("daemon control session changed");
         if (!await control.requestSupervisorShutdown()) throw new Error("supervisor IPC rejected shutdown request");
         return { accepted: true, session: control.session };
       }
@@ -9035,7 +10424,7 @@ function createDaemonControlRoutes(control) {
   };
 }
 function acquireDaemonLock(stateDir, options = {}) {
-  const fs3 = options.fs ?? nodeFs5;
+  const fs2 = options.fs ?? nodeFs6;
   const pid = options.pid ?? process.pid;
   const alive = options.isProcessAlive ?? isProcessAlive;
   const path = join7(stateDir, "daemon.lock");
@@ -9043,22 +10432,22 @@ function acquireDaemonLock(stateDir, options = {}) {
     let fd;
     let created = false;
     try {
-      fd = fs3.openSync(path, nodeFs5.constants.O_CREAT | nodeFs5.constants.O_EXCL | nodeFs5.constants.O_WRONLY | NO_FOLLOW4, FILE_MODE3);
+      fd = fs2.openSync(path, nodeFs6.constants.O_CREAT | nodeFs6.constants.O_EXCL | nodeFs6.constants.O_WRONLY | NO_FOLLOW4, FILE_MODE3);
       created = true;
-      fs3.fchmodSync(fd, FILE_MODE3);
-      writeAll(fs3, fd, Buffer.from(`${pid}
+      fs2.fchmodSync(fd, FILE_MODE3);
+      writeAll(fs2, fd, Buffer.from(`${pid}
 `, "ascii"));
-      fs3.fsyncSync(fd);
-      const owned = fs3.fstatSync(fd);
-      fs3.closeSync(fd);
+      fs2.fsyncSync(fd);
+      const owned = fs2.fstatSync(fd);
+      fs2.closeSync(fd);
       fd = void 0;
-      fsyncDirectory2(fs3, stateDir);
+      fsyncDirectory2(fs2, stateDir);
       const pidPath = join7(stateDir, "daemon.pid");
-      if (lstatIfPresent2(fs3, pidPath)) {
-        const pidOwner = readSecurePid(fs3, pidPath, "daemon PID");
+      if (lstatIfPresent2(fs2, pidPath)) {
+        const pidOwner = readSecurePid(fs2, pidPath, "daemon PID");
         if (alive(pidOwner)) {
-          fs3.unlinkSync(path);
-          fsyncDirectory2(fs3, stateDir);
+          fs2.unlinkSync(path);
+          fsyncDirectory2(fs2, stateDir);
           throw new Error(`cowork daemon is already running with PID ${pidOwner}`);
         }
       }
@@ -9067,90 +10456,90 @@ function acquireDaemonLock(stateDir, options = {}) {
         release() {
           if (released) return;
           released = true;
-          const current = lstatIfPresent2(fs3, path);
+          const current = lstatIfPresent2(fs2, path);
           if (!current || current.dev !== owned.dev || current.ino !== owned.ino) return;
-          const content = readSecurePid(fs3, path, "daemon lock");
+          const content = readSecurePid(fs2, path, "daemon lock");
           if (content !== pid) return;
-          fs3.unlinkSync(path);
-          fsyncDirectory2(fs3, stateDir);
+          fs2.unlinkSync(path);
+          fsyncDirectory2(fs2, stateDir);
         }
       };
     } catch (error) {
       if (fd !== void 0) try {
-        fs3.closeSync(fd);
+        fs2.closeSync(fd);
       } catch {
       }
       if (error.code !== "EEXIST") {
         if (created) {
           try {
-            fs3.unlinkSync(path);
-            fsyncDirectory2(fs3, stateDir);
+            fs2.unlinkSync(path);
+            fsyncDirectory2(fs2, stateDir);
           } catch {
           }
         }
         throw error;
       }
-      const observed = fs3.lstatSync(path);
-      const owner = readSecurePid(fs3, path, "daemon lock");
+      const observed = fs2.lstatSync(path);
+      const owner = readSecurePid(fs2, path, "daemon lock");
       if (alive(owner)) throw new Error(`cowork daemon is already running with PID ${owner}`);
-      const current = fs3.lstatSync(path);
+      const current = fs2.lstatSync(path);
       if (current.dev !== observed.dev || current.ino !== observed.ino) continue;
-      fs3.unlinkSync(path);
-      fsyncDirectory2(fs3, stateDir);
+      fs2.unlinkSync(path);
+      fsyncDirectory2(fs2, stateDir);
     }
   }
   throw new Error("daemon lock changed repeatedly while acquiring it");
 }
-function writeDaemonPid(stateDir, fs3 = nodeFs5, pid = process.pid) {
+function writeDaemonPid(stateDir, fs2 = nodeFs6, pid = process.pid) {
   const path = join7(stateDir, "daemon.pid");
-  const existing = lstatIfPresent2(fs3, path);
+  const existing = lstatIfPresent2(fs2, path);
   if (existing) {
-    const owner = readSecurePid(fs3, path, "daemon PID");
+    const owner = readSecurePid(fs2, path, "daemon PID");
     if (isProcessAlive(owner) && owner !== pid) throw new Error(`cowork daemon PID file belongs to live PID ${owner}`);
-    const current = fs3.lstatSync(path);
+    const current = fs2.lstatSync(path);
     if (current.dev !== existing.dev || current.ino !== existing.ino) throw new Error("daemon PID file changed during stale-owner check");
-    fs3.unlinkSync(path);
+    fs2.unlinkSync(path);
   }
   let fd;
   let created = false;
   try {
-    fd = fs3.openSync(path, nodeFs5.constants.O_CREAT | nodeFs5.constants.O_EXCL | nodeFs5.constants.O_WRONLY | NO_FOLLOW4, FILE_MODE3);
+    fd = fs2.openSync(path, nodeFs6.constants.O_CREAT | nodeFs6.constants.O_EXCL | nodeFs6.constants.O_WRONLY | NO_FOLLOW4, FILE_MODE3);
     created = true;
-    fs3.fchmodSync(fd, FILE_MODE3);
-    writeAll(fs3, fd, Buffer.from(`${pid}
+    fs2.fchmodSync(fd, FILE_MODE3);
+    writeAll(fs2, fd, Buffer.from(`${pid}
 `, "ascii"));
-    fs3.fsyncSync(fd);
+    fs2.fsyncSync(fd);
   } catch (error) {
     if (fd !== void 0) {
       try {
-        fs3.closeSync(fd);
+        fs2.closeSync(fd);
       } catch {
       }
       fd = void 0;
     }
     if (created) try {
-      fs3.unlinkSync(path);
+      fs2.unlinkSync(path);
     } catch {
     }
     throw error;
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
-  fsyncDirectory2(fs3, stateDir);
+  fsyncDirectory2(fs2, stateDir);
 }
-function removeDaemonPid(stateDir, fs3 = nodeFs5, pid = process.pid) {
+function removeDaemonPid(stateDir, fs2 = nodeFs6, pid = process.pid) {
   const path = join7(stateDir, "daemon.pid");
-  const observed = lstatIfPresent2(fs3, path);
+  const observed = lstatIfPresent2(fs2, path);
   if (!observed) return;
-  const owner = readSecurePid(fs3, path, "daemon PID");
+  const owner = readSecurePid(fs2, path, "daemon PID");
   if (owner !== pid) return;
-  const current = fs3.lstatSync(path);
+  const current = fs2.lstatSync(path);
   if (current.dev !== observed.dev || current.ino !== observed.ino) return;
-  fs3.unlinkSync(path);
-  fsyncDirectory2(fs3, stateDir);
+  fs2.unlinkSync(path);
+  fsyncDirectory2(fs2, stateDir);
 }
-function readSecurePid(fs3, path, label) {
-  const stat = fs3.lstatSync(path);
+function readSecurePid(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
   if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1 || (stat.mode & 511) !== FILE_MODE3) {
     throw new Error(`${label} must be a 0600 single-link regular file`);
   }
@@ -9160,15 +10549,15 @@ function readSecurePid(fs3, path, label) {
   let fd;
   let text;
   try {
-    fd = fs3.openSync(path, nodeFs5.constants.O_RDONLY | NO_FOLLOW4);
-    const opened = fs3.fstatSync(fd);
-    const current = fs3.lstatSync(path);
+    fd = fs2.openSync(path, nodeFs6.constants.O_RDONLY | NO_FOLLOW4);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
     if (opened.dev !== stat.dev || opened.ino !== stat.ino || current.dev !== opened.dev || current.ino !== opened.ino) {
       throw new Error(`${label} changed while opening`);
     }
-    text = fs3.readFileSync(fd, "utf8");
+    text = fs2.readFileSync(fd, "utf8");
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
   if (!/^[1-9][0-9]*\n$/.test(text)) throw new Error(`${label} contains an invalid PID`);
   const pid = Number(text.trim());
@@ -9183,26 +10572,26 @@ function isProcessAlive(pid) {
     return error.code === "EPERM";
   }
 }
-function writeAll(fs3, fd, bytes) {
+function writeAll(fs2, fd, bytes) {
   let offset = 0;
   while (offset < bytes.length) {
-    const written = fs3.writeSync(fd, bytes, offset, bytes.length - offset, null);
+    const written = fs2.writeSync(fd, bytes, offset, bytes.length - offset, null);
     if (written <= 0) throw new Error("write made no progress");
     offset += written;
   }
 }
-function fsyncDirectory2(fs3, path) {
+function fsyncDirectory2(fs2, path) {
   let fd;
   try {
-    fd = fs3.openSync(path, nodeFs5.constants.O_RDONLY | NO_FOLLOW4);
-    fs3.fsyncSync(fd);
+    fd = fs2.openSync(path, nodeFs6.constants.O_RDONLY | NO_FOLLOW4);
+    fs2.fsyncSync(fd);
   } finally {
-    if (fd !== void 0) fs3.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function lstatIfPresent2(fs3, path) {
+function lstatIfPresent2(fs2, path) {
   try {
-    return fs3.lstatSync(path);
+    return fs2.lstatSync(path);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -9213,18 +10602,18 @@ function requiresExitFrom(error) {
 }
 var FILE_MODE3, NO_FOLLOW4, DaemonBootCancelledError, DaemonShutdownError, CoworkDaemon;
 var init_daemon_runtime = __esm({
-  "src/daemon-runtime.ts"() {
+  async "src/daemon-runtime.ts"() {
     "use strict";
+    await init_adapt();
     init_config();
     init_config();
-    init_ours_runtime();
-    init_packets();
-    init_service();
+    await init_packets();
+    await init_service();
     init_storage();
     init_transports();
     init_web();
     FILE_MODE3 = 384;
-    NO_FOLLOW4 = nodeFs5.constants.O_NOFOLLOW ?? 0;
+    NO_FOLLOW4 = nodeFs6.constants.O_NOFOLLOW ?? 0;
     DaemonBootCancelledError = class extends Error {
       constructor() {
         super("cowork daemon boot cancelled by shutdown");
@@ -9276,7 +10665,7 @@ var init_daemon_runtime = __esm({
         this.options.onStage?.("post-lock");
         this.checkpoint();
         try {
-          this.host = this.options.host ?? createOursHost(config, this.options.log);
+          this.host = this.options.host ?? new AdaptHost(config.brokerUrl, this.options.log);
           this.store = this.options.store ?? new CoworkStore(config.stateDir);
           let serviceRef = this.options.service;
           this.registry = this.options.registry ?? new PacketRegistry(
@@ -9327,7 +10716,7 @@ var init_daemon_runtime = __esm({
           const unixDispatcher = new RpcDispatcher(unixRoutes);
           const restDispatcher = new RpcDispatcher(serviceRoutes);
           const staticHandler = createStaticWebHandler(loadWebAssets(
-            fileURLToPath(new URL("./web/", import.meta.url))
+            fileURLToPath2(new URL("./web/", import.meta.url))
           ));
           this.transports = this.options.transports ?? new TransportServer({
             socketPath: runtime.socketPath,
@@ -9570,7 +10959,7 @@ async function runWorker() {
     await acknowledge();
     return shutdownComplete;
   }
-  const runtime = await Promise.resolve().then(() => (init_daemon_runtime(), daemon_runtime_exports));
+  const runtime = await init_daemon_runtime().then(() => daemon_runtime_exports);
   if (shutdownRequested) {
     await acknowledge();
     return shutdownComplete;
@@ -9665,13 +11054,13 @@ var init_daemon_process = __esm({
 import { fork } from "node:child_process";
 import { randomBytes as randomBytes6 } from "node:crypto";
 import { resolve as resolve3 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 async function runSupervisor(options = {}) {
   const workerEnv = { ...process.env };
   delete workerEnv.NODE_OPTIONS;
   workerEnv.OURS_COWORK_DAEMON_WORKER = "1";
   workerEnv.OURS_COWORK_SUPERVISOR_PID = String(process.pid);
-  const child = fork(fileURLToPath2(import.meta.url), [], {
+  const child = fork(fileURLToPath3(import.meta.url), [], {
     env: workerEnv,
     stdio: options.quiet ? ["ignore", "ignore", "ignore", "ipc"] : ["inherit", "inherit", "inherit", "ipc"],
     execArgv: [],
@@ -9847,7 +11236,7 @@ var init_daemon = __esm({
       }
     };
     invokedPath = process.argv[1] ? resolve3(process.argv[1]) : void 0;
-    if (invokedPath === fileURLToPath2(import.meta.url)) {
+    if (invokedPath === fileURLToPath3(import.meta.url)) {
       void Promise.resolve().then(() => (init_daemon_process(), daemon_process_exports)).then(({ runDaemonProcess: runDaemonProcess2 }) => runDaemonProcess2()).catch((error) => {
         console.error(error instanceof Error ? error.stack ?? error.message : String(error));
         process.exitCode = 1;