@ours.network/cowork 1.0.0 → 1.0.2

package/dist/daemon.js

@@ -4116,1181 +4116,1149 @@ var init_zod = __esm({
   }
 });
 
-// src/contracts.ts
-import { createHash } from "node:crypto";
-function utf8Bounded(label, maximumBytes) {
-  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
-    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
-    `${label} must be at most ${maximumBytes} UTF-8 bytes`
-  );
-}
-function isStrictRfc3339(value) {
-  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
-  if (!match) return false;
-  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = Number(secondText);
-  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
-  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
-  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
-  if (offsetHour > 23 || offsetMinute > 59) return false;
-  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  return day >= 1 && day <= days[month - 1];
+// src/config.ts
+import * as nodeFs from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, parse, resolve } from "node:path";
+function defaultConfig(home = homedir()) {
+  return {
+    version: 1,
+    stateDir: resolve(home, ".ours-cowork"),
+    rest: { enabled: true, port: 3052 }
+  };
 }
-function normalizeRoomName(value) {
-  return value.trim().normalize("NFC");
+function loadConfig(env = process.env, io = {}) {
+  rejectRemovedEnvironment(env);
+  const fs2 = io.fs ?? nodeFs;
+  const defaults = defaultConfig(io.home);
+  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
+  let file = defaults;
+  const stat = lstatIfPresent(fs2, configPath);
+  if (stat) {
+    assertSecureFile(fs2, configPath, "config file");
+    let parsed;
+    try {
+      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
+    } catch (error) {
+      throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
+    }
+    rejectRemovedConfig(parsed, configPath);
+    try {
+      file = CoworkConfigSchema.parse(parsed);
+    } catch (error) {
+      throw new CoworkConfigError(`invalid cowork config at ${configPath}`, { cause: error });
+    }
+  } else if (env.OURS_COWORK_CONFIG !== void 0) {
+    throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
+  }
+  const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
+  try {
+    return CoworkConfigSchema.parse({
+      version: 1,
+      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
+      rest: {
+        enabled: restPort === void 0 ? file.rest.enabled : true,
+        port: restPort ?? file.rest.port
+      }
+    });
+  } catch (error) {
+    throw new CoworkConfigError("invalid effective cowork config", { cause: error });
+  }
 }
-function roomIdentityName(roomId) {
-  return `${ROOM_IDENTITY_PREFIX}${LowerCrockfordUlidSchema.parse(roomId)}`;
+function rejectRemovedEnvironment(env) {
+  const removed = [
+    "OURS_COWORK_BROKER_URL",
+    "OURS_COWORK_DAEMON_MODE",
+    "OURS_COWORK_DAEMON_ENDPOINT",
+    "OURS_COWORK_DAEMON_STATE_DIR"
+  ].filter((name) => env[name] !== void 0);
+  if (removed.length === 0) return;
+  throw new CoworkConfigError(
+    `${removed.join(", ")} ${removed.length === 1 ? "was" : "were"} removed: ours-cowork now attaches only to the shared ours daemon. Configure that daemon with @ours.network/cli and select it through the standard OURS_CONFIG, OURS_PORT, and OURS_STATE_DIR inputs.`
+  );
 }
-function roomIdentitySlug(roomName) {
-  const normalized = RoomNameSchema.parse(roomName).normalize("NFKD").replace(new RegExp("\\p{M}+", "gu"), "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  const bounded = normalized.slice(0, MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS).replace(/-+$/g, "");
-  return bounded || "room";
+function rejectRemovedConfig(value, path) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+  const removed = ["brokerUrl", "daemon"].filter((key) => Object.hasOwn(value, key));
+  if (removed.length === 0) return;
+  throw new CoworkConfigError(
+    `cowork config at ${path} contains removed ${removed.join(" and ")} ${removed.length === 1 ? "key" : "keys"}: ours-cowork now attaches only to the shared ours daemon. Remove those keys and configure the daemon with @ours.network/cli.`
+  );
 }
-function friendlyRoomIdentityName(roomId, roomName) {
-  const id = LowerCrockfordUlidSchema.parse(roomId);
-  const name = `${ROOM_IDENTITY_PREFIX}${roomIdentitySlug(roomName)}-${id}`;
-  if (name.length > MAX_ROOM_IDENTITY_NAME_CHARACTERS || !SDK_IDENTITY_NAME_PATTERN.test(name)) {
-    throw new TypeError("generated room identity name violates the shared ours daemon contract");
+function ensureRuntimeState(config, io = {}) {
+  const parsed = CoworkConfigSchema.parse(config);
+  const fs2 = io.fs ?? nodeFs;
+  const stateDir = resolve(parsed.stateDir);
+  assertSecureAncestors(fs2, stateDir, "state directory");
+  const existing = lstatIfPresent(fs2, stateDir);
+  if (!existing) {
+    createSecureDirectoryTree(fs2, stateDir, "state directory");
   }
-  return name;
-}
-function configuredRoomIdentityName(roomId, roomName, mode) {
-  return mode === "friendly" ? friendlyRoomIdentityName(roomId, roomName) : roomIdentityName(roomId);
+  assertSecureDirectory(fs2, stateDir, "state directory");
+  const roomsPath = join(stateDir, "rooms");
+  const rooms = lstatIfPresent(fs2, roomsPath);
+  if (!rooms) {
+    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
+    fsyncDirectory(fs2, stateDir);
+  }
+  assertSecureDirectory(fs2, roomsPath, "rooms directory");
+  return {
+    socketPath: join(stateDir, "management.sock"),
+    pidPath: join(stateDir, "daemon.pid"),
+    lockPath: join(stateDir, "daemon.lock")
+  };
 }
-function legacyRoomIdentityName(roomId) {
-  return `cowork-room-${LowerCrockfordUlidSchema.parse(roomId)}`;
+function parsePort(value) {
+  if (!/^[1-9][0-9]{0,4}$/.test(value)) {
+    throw new CoworkConfigError("OURS_COWORK_REST_PORT must be a decimal port from 1 to 65535");
+  }
+  const port = Number(value);
+  if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
+  return port;
 }
-function isPersistedRoomIdentityName(roomId, identityName) {
-  const id = LowerCrockfordUlidSchema.safeParse(roomId);
-  if (!id.success) return false;
-  if (identityName === roomIdentityName(id.data) || identityName === legacyRoomIdentityName(id.data)) return true;
-  const suffix = `-${id.data}`;
-  if (!identityName.startsWith(ROOM_IDENTITY_PREFIX) || !identityName.endsWith(suffix)) return false;
-  const slug = identityName.slice(ROOM_IDENTITY_PREFIX.length, -suffix.length);
-  return slug.length >= 1 && slug.length <= MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS && FRIENDLY_SLUG_PATTERN.test(slug) && identityName.length <= MAX_ROOM_IDENTITY_NAME_CHARACTERS && SDK_IDENTITY_NAME_PATTERN.test(identityName);
+function assertSecureAncestors(fs2, path, label) {
+  const absolute = isAbsolute(path) ? path : resolve(path);
+  const root = parse(absolute).root;
+  const rootOwner = fs2.lstatSync(root).uid;
+  let cursor = root;
+  const components = absolute.slice(root.length).split("/").filter(Boolean);
+  for (const [index, component] of components.entries()) {
+    cursor = join(cursor, component);
+    const stat = lstatIfPresent(fs2, cursor);
+    if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
+    if (!stat) break;
+    if (!stat.isDirectory()) {
+      if (index === components.length - 1) return;
+      throw new CoworkConfigError(`${label} ancestor is not a directory: ${cursor}`);
+    }
+    if (index < components.length - 1) assertTrustedAncestor(stat, rootOwner, cursor, label);
+  }
 }
-function isStandardRoomIdentityName(roomId, identityName) {
-  return isPersistedRoomIdentityName(roomId, identityName) && identityName !== legacyRoomIdentityName(roomId);
+function assertTrustedAncestor(stat, rootOwner, path, label) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : stat.uid;
+  const trustedStickyDirectory = (stat.mode & 512) !== 0;
+  const writableByOthers = (stat.mode & 18) !== 0;
+  const trustedOwner = stat.uid === uid || stat.uid === 0 || stat.uid === rootOwner;
+  if (writableByOthers && (!trustedStickyDirectory || !trustedOwner)) {
+    throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
+  }
 }
-function refineRoomLineage(room, context) {
-  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && isPersistedRoomIdentityName(room.room_id, room.identity_name) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
-  if (room.identity_cid === "" && !exactPacketPending) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["identity_cid"],
-      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
-    });
+function createSecureDirectoryTree(fs2, path, label) {
+  const missing = [];
+  let cursor = path;
+  while (!lstatIfPresent(fs2, cursor)) {
+    missing.push(cursor);
+    const parent = dirname(cursor);
+    if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
+    cursor = parent;
   }
-  if (room.identity_cid !== "" && room.status === "packet_pending") {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["status"],
-      message: "packet_pending status requires an empty identity_cid"
-    });
+  assertSecureAncestors(fs2, path, label);
+  for (const directory of missing.reverse()) {
+    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, directory, label);
+    fsyncDirectory(fs2, dirname(directory));
   }
-  const pendingByRecovery = /* @__PURE__ */ new Map();
-  for (const [index, invite] of room.invites.entries()) {
-    if (invite.recovery_of === void 0) continue;
-    const recoveryOf = invite.recovery_of;
-    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
-    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
-    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["invites", index, "recovery_of"],
-        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
-      });
-    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["invites", index],
-        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
-      });
-    }
-    if (invite.state === "receipt_pending") {
-      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
-      pendingByRecovery.set(recoveryOf, count);
-      if (count > 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["invites", index, "recovery_of"],
-          message: "only one receipt_pending invite may exist per recovery_of pointer"
-        });
-      }
+}
+function secureOpenedDirectory(fs2, path, label) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
+    if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
+      throw new CoworkConfigError(`${label} changed while opening`);
     }
+    fs2.fchmodSync(fd, DIRECTORY_MODE);
+    fs2.fsyncSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function defaultRoomName(roomId) {
-  return `Room ${LowerCrockfordUlidSchema.parse(roomId).slice(0, 8)}`;
-}
-function migrateRoomV1(room, mintParticipantId) {
-  return RoomSchema.parse({
-    ...room,
-    version: 2,
-    mission: { ...room.mission, briefing_version: 1 },
-    role_briefings: {},
-    rest_roles: [],
-    anonymous: false,
-    quiet_membership: false,
-    membership_epoch: 0,
-    seats: room.seats.map((seat) => ({
-      ...seat,
-      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
-      state: "active"
-    }))
-  });
-}
-function refineRelaySubject(record, context) {
-  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
-  if (record.message_id === void 0 === (record.file_id === void 0)) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["message_id"],
-      message: "relay records require exactly one of message_id or file_id"
-    });
+function assertSecureDirectory(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
+  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
+  if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
+  if ((stat.mode & 511) !== DIRECTORY_MODE) {
+    throw new CoworkConfigError(`${label} mode must be 0700`);
   }
+  assertOwner(stat, label);
 }
-function refineFileRecord(record, context) {
-  if (record.kind !== "file" || record.data_base64 === void 0) return;
-  const bytes = Buffer.from(record.data_base64, "base64");
-  if (bytes.toString("base64") !== record.data_base64) {
-    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
-  }
-  if (bytes.length !== record.size) {
-    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
-  }
-  const digest = createHash("sha256").update(bytes).digest("hex");
-  if (digest !== record.sha256) {
-    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
+function assertSecureFile(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
+  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
+  if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
+  if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
+  assertOwner(stat, label);
+}
+function assertOwner(stat, label) {
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+    throw new CoworkConfigError(`${label} must be owned by the current user`);
   }
 }
-function refineMessageCategory(message, context) {
-  const requires = (field, present) => {
-    if (present && message[field] === void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [field],
-        message: `${message.category} messages require ${field}`
-      });
-    }
-    if (!present && message[field] !== void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [field],
-        message: `${field} is forbidden on ${message.category} messages`
-      });
+function readSecureFile(fs2, path, label) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
+    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
+      throw new CoworkConfigError(`${label} changed while opening`);
     }
-  };
-  requires("briefing_role", message.category === "role_briefing");
-  requires("membership", message.category === "membership");
-  if (message.category === "role_briefing" && message.briefing_version === void 0) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["briefing_version"],
-      message: "role_briefing messages require briefing_version"
-    });
+    return fs2.readFileSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
   }
-  if (message.category === "chat" || message.category === "membership") {
-    if (message.briefing_version !== void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["briefing_version"],
-        message: `briefing_version is forbidden on ${message.category} messages`
-      });
-    }
+}
+function fsyncDirectory(fs2, path) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    fs2.fsyncSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, RoomIdentityNameModeSchema, ROOM_IDENTITY_PREFIX, SDK_IDENTITY_NAME_PATTERN, FRIENDLY_SLUG_PATTERN, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
-var init_contracts = __esm({
-  "src/contracts.ts"() {
+function lstatIfPresent(fs2, path) {
+  try {
+    return fs2.lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+var DIRECTORY_MODE, FILE_MODE, NO_FOLLOW, CoworkConfigSchema, CoworkConfigError;
+var init_config = __esm({
+  "src/config.ts"() {
     "use strict";
     init_zod();
-    MAX_TEXT_BYTES = 262144;
-    MAX_FILE_BYTES = 2 * 1024 * 1024;
-    MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
-    MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
-    MAX_EXTERNAL_INVITE_BYTES = 48 * 1024;
-    MAX_FILE_NAME_BYTES = 255;
-    MAX_MIME_BYTES = 255;
-    MAX_ROLE_BYTES = 256;
-    MAX_ROOM_NAME_CHARACTERS = 64;
-    MAX_ROOM_IDENTITY_NAME_CHARACTERS = 64;
-    MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS = 25;
-    NonEmptyStringSchema = external_exports.string().min(1);
-    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
-    LowerCrockfordUlidSchema = external_exports.string().regex(
-      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
-      "must be a 26-character lowercase Crockford ULID"
-    );
-    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
-    RoomNameSchema = external_exports.string().refine(
-      (value) => !/[\p{Cc}\p{Cf}]/u.test(value),
-      "room name must not contain Unicode control or format characters"
-    ).transform(normalizeRoomName).superRefine((value, context) => {
-      const length = Array.from(value).length;
-      if (length < 1 || length > MAX_ROOM_NAME_CHARACTERS) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          message: `room name must contain 1-${MAX_ROOM_NAME_CHARACTERS} Unicode characters after normalization`
-        });
-      }
-    });
-    RoomIdentityNameModeSchema = external_exports.enum(["stable_id", "friendly"]);
-    ROOM_IDENTITY_PREFIX = "ours-cowork-";
-    SDK_IDENTITY_NAME_PATTERN = /^[A-Za-z0-9 _.@-]{1,64}$/;
-    FRIENDLY_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
-    ROOM_ROLE = "room";
-    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
-    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
-    FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
-    FileMimeSchema = external_exports.string().refine(
-      (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
-      `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
-    );
-    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
-    SeatStateSchema = external_exports.enum(["pending", "active", "removed"]);
-    InviteModeSchema = external_exports.enum(["one_time", "public"]);
-    DEFAULT_ROLE = "Participant";
-    InviteStateSchema = external_exports.enum([
-      "live",
-      "consumed",
-      "revoked",
-      "replacement_required",
-      "receipt_pending"
-    ]);
-    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
-    SeatV1Schema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema
+    DIRECTORY_MODE = 448;
+    FILE_MODE = 384;
+    NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
+    CoworkConfigSchema = external_exports.object({
+      version: external_exports.literal(1),
+      stateDir: external_exports.string().min(1),
+      rest: external_exports.object({
+        enabled: external_exports.boolean(),
+        port: external_exports.number().int().min(1).max(65535)
+      }).strict()
     }).strict();
-    SeatSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema.optional(),
-      requested_at: Rfc3339Schema.optional(),
-      invite_sha256: external_exports.string().regex(/^[0-9a-f]{64}$/).optional(),
-      participant_id: LowerCrockfordUlidSchema,
-      state: SeatStateSchema,
-      alias: NonEmptyStringSchema.optional(),
-      removed_at: Rfc3339Schema.optional(),
-      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
-      replaces_seat: LowerCrockfordUlidSchema.optional(),
-      bounced_at: Rfc3339Schema.optional()
-    }).strict().superRefine((seat, context) => {
-      if (seat.state === "pending") {
-        for (const field of ["requested_at", "invite_sha256"]) {
-          if (seat[field] === void 0) {
-            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
-          }
-        }
-        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
-          if (seat[field] !== void 0) {
-            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
-          }
-        }
-      } else if (seat.state === "removed") {
-        if (seat.accepted_at === void 0 && seat.requested_at === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["accepted_at"],
-            message: "removed seats require accepted_at unless they are cancelled external admissions"
-          });
-        }
-        if (seat.removed_at === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["removed_at"],
-            message: "removed seats require removed_at"
-          });
-        }
-        if (seat.removed_epoch === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["removed_epoch"],
-            message: "removed seats require removed_epoch"
-          });
-        }
-      } else {
-        if (seat.accepted_at === void 0) {
-          context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
-        }
-        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
-          if (seat[field] !== void 0) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [field],
-              message: `${field} is reserved for removed seats`
-            });
-          }
-        }
-      }
-      if (seat.requested_at === void 0 !== (seat.invite_sha256 === void 0)) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["invite_sha256"],
-          message: "external admission metadata requires both requested_at and invite_sha256"
-        });
-      }
-    });
-    RoomInviteSchema = external_exports.object({
-      invite_id: NonEmptyStringSchema,
-      mode: InviteModeSchema,
-      role: RoleSchema,
-      min_accepts: PositiveSafeIntegerSchema,
-      accepted_cids: external_exports.array(NonEmptyStringSchema),
-      state: InviteStateSchema,
-      recovery_of: NonEmptyStringSchema.optional(),
-      recovery_confirmed: external_exports.boolean().optional(),
-      created_at: Rfc3339Schema,
-      replaces_seat: LowerCrockfordUlidSchema.optional()
-    }).strict().superRefine((invite, context) => {
-      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["min_accepts"],
-          message: "one_time invites require min_accepts === 1"
-        });
-      }
-      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_of"],
-          message: "receipt_pending invites require recovery_of"
-        });
-      }
-      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is forbidden without recovery_of"
-        });
+    CoworkConfigError = class extends Error {
+      constructor(message, options) {
+        super(message, options);
+        this.name = "CoworkConfigError";
       }
-      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is required with recovery_of"
-        });
+    };
+  }
+});
+
+// src/ours-runtime.ts
+import { randomBytes } from "node:crypto";
+function createOursHost(_config, log = () => {
+}) {
+  return new SharedOursHost(log);
+}
+function sleep(ms, signal) {
+  return new Promise((resolveSleep) => {
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", finish, { once: true });
+    function finish() {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolveSleep();
+    }
+  });
+}
+var WATCH_RETRY_MIN_MS, WATCH_RETRY_MAX_MS, STATE_RESYNC_INTERVAL_MS, attachSharedClient, SharedOursHost;
+var init_ours_runtime = __esm({
+  "src/ours-runtime.ts"() {
+    "use strict";
+    WATCH_RETRY_MIN_MS = 500;
+    WATCH_RETRY_MAX_MS = 3e4;
+    STATE_RESYNC_INTERVAL_MS = 2e3;
+    attachSharedClient = async (options) => {
+      const { attachOursClient } = await import("@ours.network/sdk");
+      return attachOursClient(options);
+    };
+    SharedOursHost = class {
+      log;
+      attach;
+      listeners = /* @__PURE__ */ new Set();
+      watchers = /* @__PURE__ */ new Map();
+      watchLeaseToken = `cowork-watch-${randomBytes(16).toString("hex")}`;
+      watchClient;
+      resyncTimer;
+      closed = false;
+      constructor(log = () => {
+      }, attach = attachSharedClient) {
+        this.log = log;
+        this.attach = attach;
       }
-      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "receipt_pending recovery lineage must be unconfirmed"
-        });
+      async boot() {
+        if (this.watchClient) return;
+        if (this.closed) throw new Error("shared ours daemon host cannot restart in the same process");
+        this.watchClient = await this.attach({ leaseToken: this.watchLeaseToken });
       }
-      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
-        });
+      async createClient(leaseToken = `cowork-${randomBytes(16).toString("hex")}`) {
+        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
+        return this.attach({ leaseToken });
       }
-      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["accepted_cids"],
-          message: "receipt_pending invites cannot have accepted CIDs"
-        });
+      async listIdentityNames(localNames) {
+        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
+        const rows = await this.watchClient.identities();
+        return new Set(rows.flatMap((row) => localNames.has(row.name) ? [row.name] : []));
+      }
+      onIdentityNotify(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+      }
+      trackIdentity(identityName) {
+        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
+        const existing = this.watchers.get(identityName);
+        if (existing) return () => this.untrack(identityName, existing);
+        const controller = new AbortController();
+        const watcher = { controller, work: Promise.resolve() };
+        watcher.work = this.follow(identityName, controller.signal);
+        this.watchers.set(identityName, watcher);
+        this.announce(identityName);
+        this.ensureStateResync();
+        return () => this.untrack(identityName, watcher);
+      }
+      close() {
+      }
+      async shutdown() {
+        if (this.closed) return { requiresProcessExit: false };
+        this.closed = true;
+        this.listeners.clear();
+        this.stopStateResync();
+        const watchers = [...this.watchers.values()];
+        this.watchers.clear();
+        for (const watcher of watchers) watcher.controller.abort();
+        await Promise.allSettled(watchers.map((watcher) => watcher.work));
+        const client = this.watchClient;
+        this.watchClient = void 0;
+        if (client) await client.releaseLease();
+        return { requiresProcessExit: false };
+      }
+      untrack(identityName, watcher) {
+        if (this.watchers.get(identityName) !== watcher) return;
+        this.watchers.delete(identityName);
+        watcher.controller.abort();
+        if (this.watchers.size === 0) this.stopStateResync();
+      }
+      ensureStateResync() {
+        if (this.resyncTimer) return;
+        this.resyncTimer = setInterval(() => {
+          for (const identityName of this.watchers.keys()) this.announce(identityName);
+        }, STATE_RESYNC_INTERVAL_MS);
+        this.resyncTimer.unref();
+      }
+      stopStateResync() {
+        if (!this.resyncTimer) return;
+        clearInterval(this.resyncTimer);
+        this.resyncTimer = void 0;
       }
-    });
-    MissionV1Schema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema
-    }).strict();
-    MissionSchema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema,
-      briefing_version: PositiveSafeIntegerSchema
-    }).strict();
-    RoleBriefingSchema = external_exports.object({
-      text: MissionTextSchema,
-      version: PositiveSafeIntegerSchema,
-      updated_at: Rfc3339Schema
-    }).strict();
-    RoomCommonShape = {
-      room_id: LowerCrockfordUlidSchema,
-      identity_name: NonEmptyStringSchema,
-      identity_cid: external_exports.string(),
-      state: RoomStateSchema,
-      status: NonEmptyStringSchema.optional(),
-      invites: external_exports.array(RoomInviteSchema),
-      created_at: Rfc3339Schema,
-      activated_at: Rfc3339Schema.optional(),
-      closed_at: Rfc3339Schema.optional()
-    };
-    RoomV1Schema = external_exports.object({
-      ...RoomCommonShape,
-      version: external_exports.literal(1),
-      mission: MissionV1Schema,
-      seats: external_exports.array(SeatV1Schema)
-    }).strict().superRefine(refineRoomLineage);
-    CurrentRoomSchema = external_exports.object({
-      ...RoomCommonShape,
-      room_name: RoomNameSchema,
-      version: external_exports.literal(2),
-      mission: MissionSchema,
-      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
       /**
-       * Roles a REST caller may author under. A plain array of names:
-       * the role name IS the identifier, so there is nothing per-role to store.
-       * Not a seat, not a membership: seat and membership invariants do not apply.
-       * The registry itself is an exact-name set, and reserves `room` for the
-       * room's own voice.
+       * Long-poll one identity forever, reconnecting with bounded backoff.
+       *
+       * A replacement stream primes at the daemon tip, so each reconnection also
+       * requests a full state resync. The periodic resync above covers the small
+       * request-prime race and daemon transitions that are not in the structured
+       * notification log; reconciliation is idempotent and self-coalescing.
        */
-      rest_roles: external_exports.array(RoleSchema).superRefine((roles, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, role] of roles.entries()) {
-          if (role === ROOM_ROLE) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: `role "${ROOM_ROLE}" is reserved for the room's own voice`
-            });
-          }
-          if (seen.has(role)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "REST role names must be unique within the room"
-            });
-          }
-          seen.add(role);
-        }
-      }),
-      anonymous: external_exports.boolean(),
-      quiet_membership: external_exports.boolean(),
-      membership_epoch: external_exports.number().int().nonnegative().safe(),
-      seats: external_exports.array(SeatSchema)
-    }).strict().superRefine((room, context) => {
-      refineRoomLineage(room, context);
-      const byParticipant = /* @__PURE__ */ new Map();
-      const activeAliases = /* @__PURE__ */ new Set();
-      const authorizedCids = /* @__PURE__ */ new Set();
-      for (const [index, seat] of room.seats.entries()) {
-        if (byParticipant.has(seat.participant_id)) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "participant_id"],
-            message: "participant_id must be unique within the room"
-          });
-        }
-        byParticipant.set(seat.participant_id, seat);
-        if (seat.state === "pending" || seat.state === "active") {
-          if (authorizedCids.has(seat.identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: ["seats", index, "identity"],
-              message: "at most one pending or active seat may exist per CID"
-            });
+      async follow(identityName, signal) {
+        let backoffMs = WATCH_RETRY_MIN_MS;
+        let resyncPending = false;
+        while (!signal.aborted) {
+          const client = this.watchClient;
+          if (!client) return;
+          try {
+            const stream = client.watchNotifications(identityName, { signal });
+            let step = stream.next();
+            if (resyncPending) {
+              resyncPending = false;
+              this.announce(identityName);
+            }
+            for (let settled = await step; !settled.done; settled = await step) {
+              backoffMs = WATCH_RETRY_MIN_MS;
+              this.announce(identityName);
+              step = stream.next();
+            }
+            if (!signal.aborted) {
+              resyncPending = true;
+              this.log(`[${identityName}] shared ours daemon notification watch ended; reconnecting`);
+            }
+          } catch (error) {
+            if (signal.aborted) return;
+            resyncPending = true;
+            this.log(`[${identityName}] shared ours daemon notification watch failed:`, error);
           }
-          authorizedCids.add(seat.identity);
-        }
-        if (room.anonymous && seat.alias === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "anonymous rooms require an alias on every seat"
-          });
-        }
-        if (!room.anonymous && seat.alias !== void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "aliases are reserved for anonymous rooms"
-          });
-        }
-        if (seat.state === "active" && seat.alias !== void 0) {
-          if (activeAliases.has(seat.alias)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: ["seats", index, "alias"],
-              message: "active seats must hold distinct aliases"
-            });
-          }
-          activeAliases.add(seat.alias);
-        }
-        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "removed_epoch"],
-            message: "removed_epoch cannot exceed the room membership_epoch"
-          });
-        }
-      }
-      for (const [index, seat] of room.seats.entries()) {
-        if (seat.replaces_seat === void 0) continue;
-        const predecessor = byParticipant.get(seat.replaces_seat);
-        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "replaces_seat"],
-            message: "replaces_seat must reference a removed seat in this room"
-          });
-          continue;
-        }
-        if (predecessor.role !== seat.role) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "role"],
-            message: "a replacement seat must inherit the predecessor role"
-          });
-        }
-        if (room.anonymous && seat.alias !== predecessor.alias) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "an anonymous replacement seat must inherit the predecessor alias"
-          });
-        }
-      }
-    });
-    RoomSchema = external_exports.preprocess((value) => {
-      if (typeof value !== "object" || value === null) return value;
-      const patch = {};
-      if (!Object.hasOwn(value, "room_name")) {
-        const roomId = value.room_id;
-        if (typeof roomId === "string" && LowerCrockfordUlidSchema.safeParse(roomId).success) {
-          patch.room_name = defaultRoomName(roomId);
+          if (signal.aborted) return;
+          await sleep(backoffMs, signal);
+          backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
         }
       }
-      if (!Object.hasOwn(value, "rest_roles")) patch.rest_roles = [];
-      if (Object.keys(patch).length === 0) return value;
-      return { ...value, ...patch };
-    }, CurrentRoomSchema);
-    CreateRoomInputSchema = external_exports.object({
-      name: RoomNameSchema.optional(),
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema,
-      anonymous: external_exports.boolean().optional(),
-      quiet_membership: external_exports.boolean().optional()
-    }).strict();
-    UpdateRoomInputSchema = external_exports.object({
-      name: RoomNameSchema.optional(),
-      goal: MissionTextSchema.optional(),
-      briefing: MissionTextSchema.optional(),
-      status: NonEmptyStringSchema.optional(),
-      quiet_membership: external_exports.boolean().optional()
-    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
-    RoleBriefingSetInputSchema = external_exports.object({
-      role: RoleSchema,
-      text: MissionTextSchema
-    }).strict();
-    RoleBriefingDeleteInputSchema = external_exports.object({
-      role: RoleSchema
-    }).strict();
-    PostMessageInputSchema = external_exports.object({
-      text: MessageTextSchema
-    }).strict();
-    PostAsRoleInputSchema = external_exports.object({
-      role: RoleSchema,
-      text: MessageTextSchema
-    }).strict();
-    RestRoleInputSchema = external_exports.object({
-      role: RoleSchema
-    }).strict();
-    ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
-    AcceptExternalInviteInputSchema = external_exports.object({
-      role: RoleSchema,
-      invite: external_exports.string().refine(
-        (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
-        `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
-      ),
-      expected_cid: ContainerIdSchema.optional(),
-      replaces_seat: LowerCrockfordUlidSchema.optional()
-    }).strict();
-    AuthorSnapshotSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema
-    }).strict();
-    RecordCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      seq: PositiveSafeIntegerSchema,
-      record_id: NonEmptyStringSchema,
-      at: Rfc3339Schema
-    };
-    AppendCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      at: Rfc3339Schema
-    };
-    MembershipNoticeSchema = external_exports.object({
-      action: external_exports.enum(["remove"]),
-      alias: NonEmptyStringSchema.optional(),
-      role: RoleSchema.optional(),
-      epoch: external_exports.number().int().nonnegative().safe()
-    }).strict();
-    AuthorAliasSchema = external_exports.object({
-      participant_id: LowerCrockfordUlidSchema,
-      alias: NonEmptyStringSchema
-    }).strict();
-    ReplyReferenceSchema = external_exports.object({
-      wire_id: NonEmptyStringSchema,
-      sentence: PositiveSafeIntegerSchema.optional()
-    }).strict();
-    MessageShape = {
-      kind: external_exports.literal("message"),
-      message_id: LowerCrockfordUlidSchema,
-      author: AuthorSnapshotSchema,
-      author_alias: AuthorAliasSchema.optional(),
-      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
-      briefing_role: RoleSchema.optional(),
-      briefing_version: PositiveSafeIntegerSchema.optional(),
-      membership: MembershipNoticeSchema.optional(),
-      text: MessageTextSchema,
-      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, identity] of identities.entries()) {
-          if (seen.has(identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "recipient identities must be unique"
-            });
-          }
-          seen.add(identity);
-        }
-      }),
-      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
-      source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
-    };
-    RelayIntentShape = {
-      kind: external_exports.literal("relay_intent"),
-      message_id: LowerCrockfordUlidSchema.optional(),
-      file_id: LowerCrockfordUlidSchema.optional(),
-      recipient_identity: NonEmptyStringSchema
-    };
-    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
-    RelayResultShape = {
-      kind: external_exports.literal("relay_result"),
-      intent_record_id: NonEmptyStringSchema,
-      message_id: LowerCrockfordUlidSchema.optional(),
-      file_id: LowerCrockfordUlidSchema.optional(),
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayResultStatusSchema,
-      wire_id: NonEmptyStringSchema.optional(),
-      metadata_wire_id: NonEmptyStringSchema.optional()
-    };
-    FileShape = {
-      kind: external_exports.literal("file"),
-      file_id: LowerCrockfordUlidSchema,
-      author: AuthorSnapshotSchema,
-      author_alias: AuthorAliasSchema.optional(),
-      filename: FileNameSchema,
-      mime: FileMimeSchema,
-      size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
-      sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
-      data_base64: external_exports.string(),
-      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, identity] of identities.entries()) {
-          if (seen.has(identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "recipient identities must be unique"
-            });
-          }
-          seen.add(identity);
-        }
-      }),
-      source_file_id: external_exports.number().int().nonnegative().safe(),
-      source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
-    };
-    MembershipIntentShape = {
-      kind: external_exports.literal("membership_intent"),
-      action: external_exports.enum(["remove"]),
-      participant_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema,
-      role: RoleSchema,
-      alias: NonEmptyStringSchema.optional(),
-      epoch: PositiveSafeIntegerSchema,
-      notify: external_exports.boolean()
-    };
-    MembershipResultShape = {
-      kind: external_exports.literal("membership_result"),
-      intent_record_id: NonEmptyStringSchema,
-      participant_id: LowerCrockfordUlidSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    CloseNoticeIntentShape = {
-      kind: external_exports.literal("close_notice_intent"),
-      recipient_identity: NonEmptyStringSchema
-    };
-    CloseNoticeResultShape = {
-      kind: external_exports.literal("close_notice_result"),
-      intent_record_id: NonEmptyStringSchema,
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
-    FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
-    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
-    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
-    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
-    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
-    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
-    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
-    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
-      MessageRecordSchema,
-      FileRecordSchema,
-      RelayIntentRecordSchema,
-      RelayResultRecordSchema,
-      MembershipIntentRecordSchema,
-      MembershipResultRecordSchema,
-      CloseNoticeIntentRecordSchema,
-      CloseNoticeResultRecordSchema
-    ]);
-    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
-      if (record.record_id !== `${record.room_id}:${record.seq}`) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["record_id"],
-          message: 'record_id must equal room_id + ":" + seq'
-        });
-      }
-      if (record.kind === "message") refineMessageCategory(record, context);
-      refineRelaySubject(record, context);
-      refineFileRecord(record, context);
-    });
-    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
-    ]).superRefine((record, context) => {
-      if (record.kind === "message") refineMessageCategory(record, context);
-      refineRelaySubject(record, context);
-      refineFileRecord(record, context);
-    });
-  }
-});
-
-// src/config.ts
-import * as nodeFs from "node:fs";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join, parse, resolve } from "node:path";
-function defaultConfig(home = homedir()) {
-  return {
-    version: 1,
-    stateDir: resolve(home, ".ours-cowork"),
-    roomIdentity: { nameMode: "stable_id" },
-    rest: { enabled: true, port: 3052 }
-  };
-}
-function loadConfig(env = process.env, io = {}) {
-  rejectRemovedEnvironment(env);
-  const fs2 = io.fs ?? nodeFs;
-  const defaults = defaultConfig(io.home);
-  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
-  let file = defaults;
-  const stat = lstatIfPresent(fs2, configPath);
-  if (stat) {
-    assertSecureFile(fs2, configPath, "config file");
-    let parsed;
-    try {
-      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
-    } catch (error) {
-      throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
-    }
-    rejectRemovedConfig(parsed, configPath);
-    try {
-      file = CoworkConfigSchema.parse(parsed);
-    } catch (error) {
-      throw new CoworkConfigError(`invalid cowork config at ${configPath}`, { cause: error });
-    }
-  } else if (env.OURS_COWORK_CONFIG !== void 0) {
-    throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
-  }
-  const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
-  try {
-    return CoworkConfigSchema.parse({
-      version: 1,
-      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
-      roomIdentity: file.roomIdentity,
-      rest: {
-        enabled: restPort === void 0 ? file.rest.enabled : true,
-        port: restPort ?? file.rest.port
+      announce(identityName) {
+        for (const listener of this.listeners) {
+          try {
+            listener(identityName);
+          } catch (error) {
+            this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
+          }
+        }
       }
-    });
-  } catch (error) {
-    throw new CoworkConfigError("invalid effective cowork config", { cause: error });
+    };
   }
-}
-function rejectRemovedEnvironment(env) {
-  const removed = [
-    "OURS_COWORK_BROKER_URL",
-    "OURS_COWORK_DAEMON_MODE",
-    "OURS_COWORK_DAEMON_ENDPOINT",
-    "OURS_COWORK_DAEMON_STATE_DIR"
-  ].filter((name) => env[name] !== void 0);
-  if (removed.length === 0) return;
-  throw new CoworkConfigError(
-    `${removed.join(", ")} ${removed.length === 1 ? "was" : "were"} removed: ours-cowork now attaches only to the shared ours daemon. Configure that daemon with @ours.network/cli and select it through the standard OURS_CONFIG, OURS_PORT, and OURS_STATE_DIR inputs.`
+});
+
+// src/contracts.ts
+import { createHash } from "node:crypto";
+function utf8Bounded(label, maximumBytes) {
+  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
+    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
+    `${label} must be at most ${maximumBytes} UTF-8 bytes`
   );
 }
-function rejectRemovedConfig(value, path) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
-  const removed = ["brokerUrl", "daemon"].filter((key) => Object.hasOwn(value, key));
-  if (removed.length === 0) return;
-  throw new CoworkConfigError(
-    `cowork config at ${path} contains removed ${removed.join(" and ")} ${removed.length === 1 ? "key" : "keys"}: ours-cowork now attaches only to the shared ours daemon. Remove those keys and configure the daemon with @ours.network/cli.`
-  );
+function isStrictRfc3339(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
+  if (!match) return false;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
+  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
+  if (offsetHour > 23 || offsetMinute > 59) return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day >= 1 && day <= days[month - 1];
 }
-function ensureRuntimeState(config, io = {}) {
-  const parsed = CoworkConfigSchema.parse(config);
-  const fs2 = io.fs ?? nodeFs;
-  const stateDir = resolve(parsed.stateDir);
-  assertSecureAncestors(fs2, stateDir, "state directory");
-  const existing = lstatIfPresent(fs2, stateDir);
-  if (!existing) {
-    createSecureDirectoryTree(fs2, stateDir, "state directory");
-  }
-  assertSecureDirectory(fs2, stateDir, "state directory");
-  const roomsPath = join(stateDir, "rooms");
-  const rooms = lstatIfPresent(fs2, roomsPath);
-  if (!rooms) {
-    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
-    fsyncDirectory(fs2, stateDir);
-  }
-  assertSecureDirectory(fs2, roomsPath, "rooms directory");
-  return {
-    socketPath: join(stateDir, "management.sock"),
-    pidPath: join(stateDir, "daemon.pid"),
-    lockPath: join(stateDir, "daemon.lock")
-  };
+function normalizeRoomName(value) {
+  return value.trim().normalize("NFC");
 }
-function parsePort(value) {
-  if (!/^[1-9][0-9]{0,4}$/.test(value)) {
-    throw new CoworkConfigError("OURS_COWORK_REST_PORT must be a decimal port from 1 to 65535");
-  }
-  const port = Number(value);
-  if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
-  return port;
+function roomIdentityName(roomName) {
+  return `${ROOM_IDENTITY_PREFIX}${RoomNameSchema.parse(roomName)}`;
 }
-function assertSecureAncestors(fs2, path, label) {
-  const absolute = isAbsolute(path) ? path : resolve(path);
-  const root = parse(absolute).root;
-  const rootOwner = fs2.lstatSync(root).uid;
-  let cursor = root;
-  const components = absolute.slice(root.length).split("/").filter(Boolean);
-  for (const [index, component] of components.entries()) {
-    cursor = join(cursor, component);
-    const stat = lstatIfPresent(fs2, cursor);
-    if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
-    if (!stat) break;
-    if (!stat.isDirectory()) {
-      if (index === components.length - 1) return;
-      throw new CoworkConfigError(`${label} ancestor is not a directory: ${cursor}`);
-    }
-    if (index < components.length - 1) assertTrustedAncestor(stat, rootOwner, cursor, label);
+function isPersistedRoomIdentityName(roomId, identityName) {
+  if (!LowerCrockfordUlidSchema.safeParse(roomId).success || !identityName.startsWith(ROOM_IDENTITY_PREFIX)) {
+    return false;
   }
+  const parsed = RoomNameSchema.safeParse(identityName.slice(ROOM_IDENTITY_PREFIX.length));
+  return parsed.success && identityName === `${ROOM_IDENTITY_PREFIX}${parsed.data}`;
 }
-function assertTrustedAncestor(stat, rootOwner, path, label) {
-  const uid = typeof process.getuid === "function" ? process.getuid() : stat.uid;
-  const trustedStickyDirectory = (stat.mode & 512) !== 0;
-  const writableByOthers = (stat.mode & 18) !== 0;
-  const trustedOwner = stat.uid === uid || stat.uid === 0 || stat.uid === rootOwner;
-  if (writableByOthers && (!trustedStickyDirectory || !trustedOwner)) {
-    throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
-  }
+function isStandardRoomIdentityName(roomId, identityName) {
+  return isPersistedRoomIdentityName(roomId, identityName);
 }
-function createSecureDirectoryTree(fs2, path, label) {
-  const missing = [];
-  let cursor = path;
-  while (!lstatIfPresent(fs2, cursor)) {
-    missing.push(cursor);
-    const parent = dirname(cursor);
-    if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
-    cursor = parent;
+function refineRoomLineage(room, context) {
+  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && isPersistedRoomIdentityName(room.room_id, room.identity_name) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
+  if (room.identity_cid === "" && !exactPacketPending) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["identity_cid"],
+      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+    });
   }
-  assertSecureAncestors(fs2, path, label);
-  for (const directory of missing.reverse()) {
-    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs2, directory, label);
-    fsyncDirectory(fs2, dirname(directory));
+  if (room.identity_cid !== "" && room.status === "packet_pending") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: "packet_pending status requires an empty identity_cid"
+    });
   }
-}
-function secureOpenedDirectory(fs2, path, label) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs2.fstatSync(fd);
-    const current = fs2.lstatSync(path);
-    if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
-      throw new CoworkConfigError(`${label} changed while opening`);
+  const pendingByRecovery = /* @__PURE__ */ new Map();
+  for (const [index, invite] of room.invites.entries()) {
+    if (invite.recovery_of === void 0) continue;
+    const recoveryOf = invite.recovery_of;
+    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
+    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
+    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index, "recovery_of"],
+        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+      });
+    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index],
+        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+      });
+    }
+    if (invite.state === "receipt_pending") {
+      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
+      pendingByRecovery.set(recoveryOf, count);
+      if (count > 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invites", index, "recovery_of"],
+          message: "only one receipt_pending invite may exist per recovery_of pointer"
+        });
+      }
     }
-    fs2.fchmodSync(fd, DIRECTORY_MODE);
-    fs2.fsyncSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
-  }
-}
-function assertSecureDirectory(fs2, path, label) {
-  const stat = fs2.lstatSync(path);
-  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
-  if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
-  if ((stat.mode & 511) !== DIRECTORY_MODE) {
-    throw new CoworkConfigError(`${label} mode must be 0700`);
   }
-  assertOwner(stat, label);
-}
-function assertSecureFile(fs2, path, label) {
-  const stat = fs2.lstatSync(path);
-  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
-  if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
-  if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
-  assertOwner(stat, label);
 }
-function assertOwner(stat, label) {
-  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
-    throw new CoworkConfigError(`${label} must be owned by the current user`);
-  }
+function defaultRoomName(roomId) {
+  return `Room ${LowerCrockfordUlidSchema.parse(roomId).slice(0, 8)}`;
 }
-function readSecureFile(fs2, path, label) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs2.fstatSync(fd);
-    const current = fs2.lstatSync(path);
-    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
-      throw new CoworkConfigError(`${label} changed while opening`);
-    }
-    return fs2.readFileSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
-  }
+function migrateRoomV1(room, mintParticipantId) {
+  return RoomSchema.parse({
+    ...room,
+    version: 2,
+    mission: { ...room.mission, briefing_version: 1 },
+    role_briefings: {},
+    rest_roles: [],
+    anonymous: false,
+    quiet_membership: false,
+    membership_epoch: 0,
+    seats: room.seats.map((seat) => ({
+      ...seat,
+      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
+      state: "active"
+    }))
+  });
 }
-function fsyncDirectory(fs2, path) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    fs2.fsyncSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
+function refineRelaySubject(record, context) {
+  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
+  if (record.message_id === void 0 === (record.file_id === void 0)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["message_id"],
+      message: "relay records require exactly one of message_id or file_id"
+    });
   }
 }
-function lstatIfPresent(fs2, path) {
-  try {
-    return fs2.lstatSync(path);
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
+function refineFileRecord(record, context) {
+  if (record.kind !== "file" || record.data_base64 === void 0) return;
+  const bytes = Buffer.from(record.data_base64, "base64");
+  if (bytes.toString("base64") !== record.data_base64) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
   }
-}
-var DIRECTORY_MODE, FILE_MODE, NO_FOLLOW, CoworkConfigSchema, CoworkConfigError;
-var init_config = __esm({
-  "src/config.ts"() {
-    "use strict";
-    init_zod();
-    init_contracts();
-    DIRECTORY_MODE = 448;
-    FILE_MODE = 384;
-    NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
-    CoworkConfigSchema = external_exports.object({
-      version: external_exports.literal(1),
-      stateDir: external_exports.string().min(1),
-      roomIdentity: external_exports.object({
-        nameMode: RoomIdentityNameModeSchema
-      }).strict().default({ nameMode: "stable_id" }),
-      rest: external_exports.object({
-        enabled: external_exports.boolean(),
-        port: external_exports.number().int().min(1).max(65535)
-      }).strict()
-    }).strict();
-    CoworkConfigError = class extends Error {
-      constructor(message, options) {
-        super(message, options);
-        this.name = "CoworkConfigError";
-      }
-    };
+  if (bytes.length !== record.size) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
+  }
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== record.sha256) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
   }
-});
-
-// src/ours-runtime.ts
-import { randomBytes } from "node:crypto";
-function createOursHost(_config, log = () => {
-}) {
-  return new SharedOursHost(log);
 }
-function sleep(ms, signal) {
-  return new Promise((resolveSleep) => {
-    const timer = setTimeout(finish, ms);
-    signal.addEventListener("abort", finish, { once: true });
-    function finish() {
-      clearTimeout(timer);
-      signal.removeEventListener("abort", finish);
-      resolveSleep();
+function refineMessageCategory(message, context) {
+  const requires = (field, present) => {
+    if (present && message[field] === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${message.category} messages require ${field}`
+      });
     }
-  });
+    if (!present && message[field] !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${field} is forbidden on ${message.category} messages`
+      });
+    }
+  };
+  requires("briefing_role", message.category === "role_briefing");
+  requires("membership", message.category === "membership");
+  if (message.category === "role_briefing" && message.briefing_version === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["briefing_version"],
+      message: "role_briefing messages require briefing_version"
+    });
+  }
+  if (message.category === "chat" || message.category === "membership") {
+    if (message.briefing_version !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["briefing_version"],
+        message: `briefing_version is forbidden on ${message.category} messages`
+      });
+    }
+  }
 }
-var WATCH_RETRY_MIN_MS, WATCH_RETRY_MAX_MS, STATE_RESYNC_INTERVAL_MS, attachSharedClient, SharedOursHost;
-var init_ours_runtime = __esm({
-  "src/ours-runtime.ts"() {
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var init_contracts = __esm({
+  "src/contracts.ts"() {
     "use strict";
-    WATCH_RETRY_MIN_MS = 500;
-    WATCH_RETRY_MAX_MS = 3e4;
-    STATE_RESYNC_INTERVAL_MS = 2e3;
-    attachSharedClient = async (options) => {
-      const { attachOursClient } = await import("@ours.network/sdk");
-      return attachOursClient(options);
-    };
-    SharedOursHost = class {
-      log;
-      attach;
-      listeners = /* @__PURE__ */ new Set();
-      watchers = /* @__PURE__ */ new Map();
-      watchLeaseToken = `cowork-watch-${randomBytes(16).toString("hex")}`;
-      watchClient;
-      resyncTimer;
-      closed = false;
-      constructor(log = () => {
-      }, attach = attachSharedClient) {
-        this.log = log;
-        this.attach = attach;
-      }
-      async boot() {
-        if (this.watchClient) return;
-        if (this.closed) throw new Error("shared ours daemon host cannot restart in the same process");
-        this.watchClient = await this.attach({ leaseToken: this.watchLeaseToken });
+    init_zod();
+    MAX_TEXT_BYTES = 262144;
+    MAX_FILE_BYTES = 2 * 1024 * 1024;
+    MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
+    MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
+    MAX_EXTERNAL_INVITE_BYTES = 48 * 1024;
+    MAX_FILE_NAME_BYTES = 255;
+    MAX_MIME_BYTES = 255;
+    MAX_ROLE_BYTES = 256;
+    MAX_ROOM_NAME_CHARACTERS = 64;
+    NonEmptyStringSchema = external_exports.string().min(1);
+    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
+    LowerCrockfordUlidSchema = external_exports.string().regex(
+      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+      "must be a 26-character lowercase Crockford ULID"
+    );
+    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
+    RoomNameSchema = external_exports.string().refine(
+      (value) => !/[\p{Cc}\p{Cf}]/u.test(value),
+      "room name must not contain Unicode control or format characters"
+    ).transform(normalizeRoomName).superRefine((value, context) => {
+      const length = Array.from(value).length;
+      if (length < 1 || length > MAX_ROOM_NAME_CHARACTERS) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `room name must contain 1-${MAX_ROOM_NAME_CHARACTERS} Unicode characters after normalization`
+        });
       }
-      async createClient(leaseToken = `cowork-${randomBytes(16).toString("hex")}`) {
-        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
-        return this.attach({ leaseToken });
+    });
+    ROOM_IDENTITY_PREFIX = "ours-cowork:";
+    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
+    ROOM_ROLE = "room";
+    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
+    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
+    FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
+    FileMimeSchema = external_exports.string().refine(
+      (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
+      `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
+    );
+    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
+    SeatStateSchema = external_exports.enum(["pending", "active", "removed"]);
+    InviteModeSchema = external_exports.enum(["one_time", "public"]);
+    DEFAULT_ROLE = "Participant";
+    InviteStateSchema = external_exports.enum([
+      "live",
+      "consumed",
+      "revoked",
+      "replacement_required",
+      "receipt_pending"
+    ]);
+    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
+    SeatV1Schema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema
+    }).strict();
+    SeatSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema.optional(),
+      requested_at: Rfc3339Schema.optional(),
+      invite_sha256: external_exports.string().regex(/^[0-9a-f]{64}$/).optional(),
+      participant_id: LowerCrockfordUlidSchema,
+      state: SeatStateSchema,
+      alias: NonEmptyStringSchema.optional(),
+      removed_at: Rfc3339Schema.optional(),
+      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional(),
+      bounced_at: Rfc3339Schema.optional()
+    }).strict().superRefine((seat, context) => {
+      if (seat.state === "pending") {
+        for (const field of ["requested_at", "invite_sha256"]) {
+          if (seat[field] === void 0) {
+            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
+          }
+        }
+        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
+          }
+        }
+      } else if (seat.state === "removed") {
+        if (seat.accepted_at === void 0 && seat.requested_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["accepted_at"],
+            message: "removed seats require accepted_at unless they are cancelled external admissions"
+          });
+        }
+        if (seat.removed_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_at"],
+            message: "removed seats require removed_at"
+          });
+        }
+        if (seat.removed_epoch === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_epoch"],
+            message: "removed seats require removed_epoch"
+          });
+        }
+      } else {
+        if (seat.accepted_at === void 0) {
+          context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
+        }
+        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [field],
+              message: `${field} is reserved for removed seats`
+            });
+          }
+        }
       }
-      async listIdentityNames(localNames) {
-        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
-        const rows = await this.watchClient.identities();
-        return new Set(rows.flatMap((row) => localNames.has(row.name) ? [row.name] : []));
+      if (seat.requested_at === void 0 !== (seat.invite_sha256 === void 0)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invite_sha256"],
+          message: "external admission metadata requires both requested_at and invite_sha256"
+        });
       }
-      onIdentityNotify(listener) {
-        this.listeners.add(listener);
-        return () => this.listeners.delete(listener);
+    });
+    RoomInviteSchema = external_exports.object({
+      invite_id: NonEmptyStringSchema,
+      mode: InviteModeSchema,
+      role: RoleSchema,
+      min_accepts: PositiveSafeIntegerSchema,
+      accepted_cids: external_exports.array(NonEmptyStringSchema),
+      state: InviteStateSchema,
+      recovery_of: NonEmptyStringSchema.optional(),
+      recovery_confirmed: external_exports.boolean().optional(),
+      created_at: Rfc3339Schema,
+      replaces_seat: LowerCrockfordUlidSchema.optional()
+    }).strict().superRefine((invite, context) => {
+      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["min_accepts"],
+          message: "one_time invites require min_accepts === 1"
+        });
       }
-      trackIdentity(identityName) {
-        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
-        const existing = this.watchers.get(identityName);
-        if (existing) return () => this.untrack(identityName, existing);
-        const controller = new AbortController();
-        const watcher = { controller, work: Promise.resolve() };
-        watcher.work = this.follow(identityName, controller.signal);
-        this.watchers.set(identityName, watcher);
-        this.announce(identityName);
-        this.ensureStateResync();
-        return () => this.untrack(identityName, watcher);
+      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_of"],
+          message: "receipt_pending invites require recovery_of"
+        });
       }
-      close() {
+      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is forbidden without recovery_of"
+        });
       }
-      async shutdown() {
-        if (this.closed) return { requiresProcessExit: false };
-        this.closed = true;
-        this.listeners.clear();
-        this.stopStateResync();
-        const watchers = [...this.watchers.values()];
-        this.watchers.clear();
-        for (const watcher of watchers) watcher.controller.abort();
-        await Promise.allSettled(watchers.map((watcher) => watcher.work));
-        const client = this.watchClient;
-        this.watchClient = void 0;
-        if (client) await client.releaseLease();
-        return { requiresProcessExit: false };
+      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is required with recovery_of"
+        });
       }
-      untrack(identityName, watcher) {
-        if (this.watchers.get(identityName) !== watcher) return;
-        this.watchers.delete(identityName);
-        watcher.controller.abort();
-        if (this.watchers.size === 0) this.stopStateResync();
+      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "receipt_pending recovery lineage must be unconfirmed"
+        });
       }
-      ensureStateResync() {
-        if (this.resyncTimer) return;
-        this.resyncTimer = setInterval(() => {
-          for (const identityName of this.watchers.keys()) this.announce(identityName);
-        }, STATE_RESYNC_INTERVAL_MS);
-        this.resyncTimer.unref();
+      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
+        });
       }
-      stopStateResync() {
-        if (!this.resyncTimer) return;
-        clearInterval(this.resyncTimer);
-        this.resyncTimer = void 0;
+      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["accepted_cids"],
+          message: "receipt_pending invites cannot have accepted CIDs"
+        });
       }
+    });
+    MissionV1Schema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema
+    }).strict();
+    MissionSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      briefing_version: PositiveSafeIntegerSchema
+    }).strict();
+    RoleBriefingSchema = external_exports.object({
+      text: MissionTextSchema,
+      version: PositiveSafeIntegerSchema,
+      updated_at: Rfc3339Schema
+    }).strict();
+    RoomCommonShape = {
+      room_id: LowerCrockfordUlidSchema,
+      identity_name: NonEmptyStringSchema,
+      identity_cid: external_exports.string(),
+      state: RoomStateSchema,
+      status: NonEmptyStringSchema.optional(),
+      invites: external_exports.array(RoomInviteSchema),
+      created_at: Rfc3339Schema,
+      activated_at: Rfc3339Schema.optional(),
+      closed_at: Rfc3339Schema.optional()
+    };
+    RoomV1Schema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(1),
+      mission: MissionV1Schema,
+      seats: external_exports.array(SeatV1Schema)
+    }).strict().superRefine(refineRoomLineage);
+    CurrentRoomSchema = external_exports.object({
+      ...RoomCommonShape,
+      room_name: RoomNameSchema,
+      version: external_exports.literal(2),
+      mission: MissionSchema,
+      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
       /**
-       * Long-poll one identity forever, reconnecting with bounded backoff.
-       *
-       * A replacement stream primes at the daemon tip, so each reconnection also
-       * requests a full state resync. The periodic resync above covers the small
-       * request-prime race and daemon transitions that are not in the structured
-       * notification log; reconciliation is idempotent and self-coalescing.
+       * Roles a REST caller may author under. A plain array of names:
+       * the role name IS the identifier, so there is nothing per-role to store.
+       * Not a seat, not a membership: seat and membership invariants do not apply.
+       * The registry itself is an exact-name set, and reserves `room` for the
+       * room's own voice.
        */
-      async follow(identityName, signal) {
-        let backoffMs = WATCH_RETRY_MIN_MS;
-        let resyncPending = false;
-        while (!signal.aborted) {
-          const client = this.watchClient;
-          if (!client) return;
-          try {
-            const stream = client.watchNotifications(identityName, { signal });
-            let step = stream.next();
-            if (resyncPending) {
-              resyncPending = false;
-              this.announce(identityName);
-            }
-            for (let settled = await step; !settled.done; settled = await step) {
-              backoffMs = WATCH_RETRY_MIN_MS;
-              this.announce(identityName);
-              step = stream.next();
-            }
-            if (!signal.aborted) {
-              resyncPending = true;
-              this.log(`[${identityName}] shared ours daemon notification watch ended; reconnecting`);
-            }
-          } catch (error) {
-            if (signal.aborted) return;
-            resyncPending = true;
-            this.log(`[${identityName}] shared ours daemon notification watch failed:`, error);
+      rest_roles: external_exports.array(RoleSchema).superRefine((roles, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, role] of roles.entries()) {
+          if (role === ROOM_ROLE) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: `role "${ROOM_ROLE}" is reserved for the room's own voice`
+            });
           }
-          if (signal.aborted) return;
-          await sleep(backoffMs, signal);
-          backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
+          if (seen.has(role)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "REST role names must be unique within the room"
+            });
+          }
+          seen.add(role);
+        }
+      }),
+      anonymous: external_exports.boolean(),
+      quiet_membership: external_exports.boolean(),
+      membership_epoch: external_exports.number().int().nonnegative().safe(),
+      seats: external_exports.array(SeatSchema)
+    }).strict().superRefine((room, context) => {
+      refineRoomLineage(room, context);
+      const byParticipant = /* @__PURE__ */ new Map();
+      const activeAliases = /* @__PURE__ */ new Set();
+      const authorizedCids = /* @__PURE__ */ new Set();
+      for (const [index, seat] of room.seats.entries()) {
+        if (byParticipant.has(seat.participant_id)) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "participant_id"],
+            message: "participant_id must be unique within the room"
+          });
+        }
+        byParticipant.set(seat.participant_id, seat);
+        if (seat.state === "pending" || seat.state === "active") {
+          if (authorizedCids.has(seat.identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["seats", index, "identity"],
+              message: "at most one pending or active seat may exist per CID"
+            });
+          }
+          authorizedCids.add(seat.identity);
+        }
+        if (room.anonymous && seat.alias === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "anonymous rooms require an alias on every seat"
+          });
+        }
+        if (!room.anonymous && seat.alias !== void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "aliases are reserved for anonymous rooms"
+          });
+        }
+        if (seat.state === "active" && seat.alias !== void 0) {
+          if (activeAliases.has(seat.alias)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["seats", index, "alias"],
+              message: "active seats must hold distinct aliases"
+            });
+          }
+          activeAliases.add(seat.alias);
+        }
+        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "removed_epoch"],
+            message: "removed_epoch cannot exceed the room membership_epoch"
+          });
+        }
+      }
+      for (const [index, seat] of room.seats.entries()) {
+        if (seat.replaces_seat === void 0) continue;
+        const predecessor = byParticipant.get(seat.replaces_seat);
+        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "replaces_seat"],
+            message: "replaces_seat must reference a removed seat in this room"
+          });
+          continue;
+        }
+        if (predecessor.role !== seat.role) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "role"],
+            message: "a replacement seat must inherit the predecessor role"
+          });
+        }
+        if (room.anonymous && seat.alias !== predecessor.alias) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "an anonymous replacement seat must inherit the predecessor alias"
+          });
         }
       }
-      announce(identityName) {
-        for (const listener of this.listeners) {
-          try {
-            listener(identityName);
-          } catch (error) {
-            this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
-          }
+    });
+    RoomSchema = external_exports.preprocess((value) => {
+      if (typeof value !== "object" || value === null) return value;
+      const patch = {};
+      if (!Object.hasOwn(value, "room_name")) {
+        const roomId = value.room_id;
+        if (typeof roomId === "string" && LowerCrockfordUlidSchema.safeParse(roomId).success) {
+          patch.room_name = defaultRoomName(roomId);
         }
       }
+      if (!Object.hasOwn(value, "rest_roles")) patch.rest_roles = [];
+      if (Object.keys(patch).length === 0) return value;
+      return { ...value, ...patch };
+    }, CurrentRoomSchema);
+    CreateRoomInputSchema = external_exports.object({
+      name: RoomNameSchema.optional(),
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      anonymous: external_exports.boolean().optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict();
+    UpdateRoomInputSchema = external_exports.object({
+      name: RoomNameSchema.optional(),
+      goal: MissionTextSchema.optional(),
+      briefing: MissionTextSchema.optional(),
+      status: NonEmptyStringSchema.optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
+    RoleBriefingSetInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MissionTextSchema
+    }).strict();
+    RoleBriefingDeleteInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
+    PostMessageInputSchema = external_exports.object({
+      text: MessageTextSchema
+    }).strict();
+    PostAsRoleInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MessageTextSchema
+    }).strict();
+    RestRoleInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
+    ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+    AcceptExternalInviteInputSchema = external_exports.object({
+      role: RoleSchema,
+      invite: external_exports.string().refine(
+        (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
+        `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
+      ),
+      expected_cid: ContainerIdSchema.optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional()
+    }).strict();
+    AuthorSnapshotSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema
+    }).strict();
+    RecordCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      seq: PositiveSafeIntegerSchema,
+      record_id: NonEmptyStringSchema,
+      at: Rfc3339Schema
+    };
+    AppendCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      at: Rfc3339Schema
+    };
+    MembershipNoticeSchema = external_exports.object({
+      action: external_exports.enum(["remove"]),
+      alias: NonEmptyStringSchema.optional(),
+      role: RoleSchema.optional(),
+      epoch: external_exports.number().int().nonnegative().safe()
+    }).strict();
+    AuthorAliasSchema = external_exports.object({
+      participant_id: LowerCrockfordUlidSchema,
+      alias: NonEmptyStringSchema
+    }).strict();
+    ReplyReferenceSchema = external_exports.object({
+      wire_id: NonEmptyStringSchema,
+      sentence: PositiveSafeIntegerSchema.optional()
+    }).strict();
+    MessageShape = {
+      kind: external_exports.literal("message"),
+      message_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+      briefing_role: RoleSchema.optional(),
+      briefing_version: PositiveSafeIntegerSchema.optional(),
+      membership: MembershipNoticeSchema.optional(),
+      text: MessageTextSchema,
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
+          }
+          seen.add(identity);
+        }
+      }),
+      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+      source_wire_id: NonEmptyStringSchema.optional(),
+      source_reply_to: ReplyReferenceSchema.optional()
+    };
+    RelayIntentShape = {
+      kind: external_exports.literal("relay_intent"),
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema
+    };
+    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+    RelayResultShape = {
+      kind: external_exports.literal("relay_result"),
+      intent_record_id: NonEmptyStringSchema,
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayResultStatusSchema,
+      wire_id: NonEmptyStringSchema.optional(),
+      metadata_wire_id: NonEmptyStringSchema.optional()
+    };
+    FileShape = {
+      kind: external_exports.literal("file"),
+      file_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      filename: FileNameSchema,
+      mime: FileMimeSchema,
+      size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
+      sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+      data_base64: external_exports.string(),
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
+          }
+          seen.add(identity);
+        }
+      }),
+      source_file_id: external_exports.number().int().nonnegative().safe(),
+      source_wire_id: NonEmptyStringSchema.optional(),
+      source_reply_to: ReplyReferenceSchema.optional()
+    };
+    MembershipIntentShape = {
+      kind: external_exports.literal("membership_intent"),
+      action: external_exports.enum(["remove"]),
+      participant_id: LowerCrockfordUlidSchema,
+      recipient_identity: NonEmptyStringSchema,
+      role: RoleSchema,
+      alias: NonEmptyStringSchema.optional(),
+      epoch: PositiveSafeIntegerSchema,
+      notify: external_exports.boolean()
+    };
+    MembershipResultShape = {
+      kind: external_exports.literal("membership_result"),
+      intent_record_id: NonEmptyStringSchema,
+      participant_id: LowerCrockfordUlidSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    CloseNoticeIntentShape = {
+      kind: external_exports.literal("close_notice_intent"),
+      recipient_identity: NonEmptyStringSchema
+    };
+    CloseNoticeResultShape = {
+      kind: external_exports.literal("close_notice_result"),
+      intent_record_id: NonEmptyStringSchema,
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
     };
+    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
+    FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
+    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
+    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
+    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
+    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
+    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
+    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
+      MessageRecordSchema,
+      FileRecordSchema,
+      RelayIntentRecordSchema,
+      RelayResultRecordSchema,
+      MembershipIntentRecordSchema,
+      MembershipResultRecordSchema,
+      CloseNoticeIntentRecordSchema,
+      CloseNoticeResultRecordSchema
+    ]);
+    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
+      if (record.record_id !== `${record.room_id}:${record.seq}`) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["record_id"],
+          message: 'record_id must equal room_id + ":" + seq'
+        });
+      }
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
+    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
+    ]).superRefine((record, context) => {
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
   }
 });
 
@@ -5464,7 +5432,7 @@ var init_packets = __esm({
       get(roomId) {
         return this.packets.get(roomId);
       }
-      async create(roomId, identityName = `ours-cowork-${roomId}`, bio = `ours-cowork mission room ${roomId}`) {
+      async create(roomId, identityName, bio = `ours-cowork mission room ${roomId}`) {
         validateRoomId(roomId);
         this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
@@ -5496,7 +5464,7 @@ var init_packets = __esm({
           throw new Error(`failed to provision standard SDK identity for room "${roomId}"`, { cause: error });
         }
       }
-      async restore(roomId, expectedCid, identityName = `ours-cowork-${roomId}`) {
+      async restore(roomId, expectedCid, identityName) {
         validateRoomId(roomId);
         this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
@@ -5582,6 +5550,7 @@ var init_packets = __esm({
       cid;
       client;
       contacts = [];
+      hasInviteProvenance = false;
       invites = [];
       refreshWork;
       contactRefreshWork;
@@ -5607,8 +5576,12 @@ var init_packets = __esm({
         return this.contactRefreshWork;
       }
       async refreshContactsUnlocked() {
-        const contacts = await this.client.listContacts();
-        this.contacts = contacts.contacts.map((contact) => ({ ...contact }));
+        const listed = await this.client.listContacts();
+        this.hasInviteProvenance = listed.origins !== void 0;
+        this.contacts = listed.contacts.map((contact) => ({
+          ...contact,
+          ...listed.origins?.[contact.container_id] === void 0 ? {} : { accepted_via_invite_id: listed.origins[contact.container_id] }
+        }));
       }
       async mintInvite(mode) {
         const result = await this.client.generateInvite({ mode });
@@ -5634,6 +5607,9 @@ var init_packets = __esm({
       listInvites() {
         return this.invites.map((invite) => ({ ...invite }));
       }
+      get supportsInviteProvenance() {
+        return this.hasInviteProvenance;
+      }
       listContacts() {
         return this.contacts.map((contact) => ({ ...contact }));
       }
@@ -5993,7 +5969,12 @@ var init_intake = __esm({
         const seats = room.seats.map((candidate) => candidate.participant_id === removed.participant_id ? { ...candidate, bounced_at: this.now() } : candidate);
         await this.store.save(RoomSchema.parse({ ...room, seats }));
         try {
-          const unsigned = { version: 1, kind: "room_not_member", room_id: roomId };
+          const unsigned = {
+            version: 1,
+            kind: "room_not_member",
+            room_id: roomId,
+            room_name: room.room_name
+          };
           await sendRoomBody(packet, item.sender_id, unsigned);
         } catch {
         }
@@ -6082,6 +6063,7 @@ var init_intake = __esm({
               version: 1,
               kind: "room_file",
               room_id: roomId,
+              room_name: room.room_name,
               file_id: file.file_id,
               author,
               filename: file.filename,
@@ -6131,6 +6113,7 @@ var init_intake = __esm({
             version: 1,
             kind: wireKind(message.category),
             room_id: roomId,
+            room_name: room.room_name,
             message_id: message.message_id,
             // An anonymous author leaves the archive only in alias form.
             author: message.author_alias === void 0 ? message.author : {
@@ -6282,7 +6265,6 @@ var init_service = __esm({
       nextMessageId;
       intake;
       provisioningCheckpoint;
-      identityNameMode;
       constructor(store, packets, options = {}) {
         this.store = store;
         this.packets = packets;
@@ -6291,7 +6273,6 @@ var init_service = __esm({
         this.nextMessageId = options.messageId ?? generateUlid;
         this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
         });
-        this.identityNameMode = options.identityNameMode ?? "stable_id";
         this.intake = new IntakePump(store, packets, {
           now: this.nowValue,
           messageId: this.nextMessageId
@@ -6301,7 +6282,7 @@ var init_service = __esm({
         const settings = CreateRoomInputSchema.parse(input);
         const roomId = LowerCrockfordUlidSchema.parse(this.nextRoomId());
         const roomName = settings.name ?? defaultRoomName(roomId);
-        const identityName = configuredRoomIdentityName(roomId, roomName, this.identityNameMode);
+        const identityName = roomIdentityName(roomName);
         return this.lock(roomId, async () => {
           const provisional = RoomSchema.parse({
             version: 2,
@@ -6472,9 +6453,9 @@ var init_service = __esm({
         return this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "create an invite for");
-          if (room.invites.some((invite) => invite.state === "live" || invite.state === "receipt_pending")) {
+          if (!this.packet(id).supportsInviteProvenance && room.invites.some((invite) => invite.state === "live" || invite.state === "receipt_pending")) {
             throw new RoomServiceError(
-              "standard SDK rooms permit one live invitation at a time so every accepted contact has unambiguous room admission metadata"
+              "the installed ours SDK does not expose authenticated invite provenance; revoke or consume the current invitation before creating another"
             );
           }
           return this.mintInviteUnlocked(room, {
@@ -6560,12 +6541,12 @@ var init_service = __esm({
         return receipt;
       }
       async mintInviteUnlocked(room, request) {
-        if (room.invites.some((invite2) => invite2.state === "live" || invite2.state === "receipt_pending")) {
+        const packet = this.packet(room.room_id);
+        if (!packet.supportsInviteProvenance && room.invites.some((invite2) => invite2.state === "live" || invite2.state === "receipt_pending")) {
           throw new RoomServiceError(
-            "standard SDK rooms permit one live invitation at a time; revoke or consume the current invitation first"
+            "the installed ours SDK does not expose authenticated invite provenance; revoke or consume the current invitation first"
           );
         }
-        const packet = this.packet(room.room_id);
         const minted = await packet.mintInvite(request.mode);
         const invite = RoomInviteSchema.parse({
           invite_id: minted.invite_id,
@@ -7164,7 +7145,12 @@ var init_service = __esm({
         if (room.state === "closed" || room.state === "closing") return room;
         const contactsByCid = /* @__PURE__ */ new Map();
         for (const contact of packet.listContacts()) {
-          if (!contactsByCid.has(contact.container_id)) contactsByCid.set(contact.container_id, contact.name);
+          if (contactsByCid.has(contact.container_id)) continue;
+          const authenticatedInvite = contact.accepted_via_invite_id;
+          contactsByCid.set(contact.container_id, {
+            displayName: contact.name,
+            ...authenticatedInvite === void 0 ? {} : { inviteId: authenticatedInvite }
+          });
         }
         const inviteById = new Map(room.invites.map((invite) => [invite.invite_id, invite]));
         const existingCids = new Set(room.seats.filter((seat) => seat.state === "active" || seat.state === "pending").map((seat) => seat.identity));
@@ -7180,13 +7166,13 @@ var init_service = __esm({
         const seatsWithActivations = [...room.seats];
         for (const [seatIndex, seat] of room.seats.entries()) {
           if (seat.state !== "pending") continue;
-          const displayName = contactsByCid.get(seat.identity);
-          if (displayName === void 0) continue;
+          const contact = contactsByCid.get(seat.identity);
+          if (contact === void 0) continue;
           const { alias: _alias, replaces_seat: _replacesSeat, ...base } = seat;
           const activated = {
             ...base,
             state: "active",
-            display_name: displayName,
+            display_name: contact.displayName,
             accepted_at: this.now(),
             ..._replacesSeat === void 0 ? {} : { replaces_seat: _replacesSeat },
             ...room.anonymous ? { alias: _alias } : {}
@@ -7196,11 +7182,13 @@ var init_service = __esm({
         }
         const newSeats = [];
         const eligibleInvites = room.invites.filter((invite) => invite.state === "live" && (invite.recovery_of === void 0 || invite.recovery_confirmed === true));
-        const admissionInvite = eligibleInvites.length === 1 ? eligibleInvites[0] : void 0;
-        for (const [cid, displayName] of contactsByCid) {
+        const legacyAdmissionInvite = !packet.supportsInviteProvenance && eligibleInvites.length === 1 ? eligibleInvites[0] : void 0;
+        for (const [cid, contact] of contactsByCid) {
           if (existingCids.has(cid)) continue;
-          const invite = admissionInvite;
+          const invite = contact.inviteId === void 0 ? legacyAdmissionInvite : inviteById.get(contact.inviteId);
           if (!invite) continue;
+          if (invite.state !== "live") continue;
+          if (invite.recovery_of !== void 0 && invite.recovery_confirmed !== true) continue;
           const removedAt = lastRemovedAt.get(cid);
           if (removedAt !== void 0 && invite.created_at <= removedAt) continue;
           const seated = [...seatsWithActivations, ...newSeats];
@@ -7208,7 +7196,7 @@ var init_service = __esm({
           if (invite.replaces_seat !== void 0 && !predecessor) continue;
           newSeats.push({
             identity: cid,
-            display_name: displayName,
+            display_name: contact.displayName,
             role: invite.role,
             invite_id: invite.invite_id,
             accepted_at: this.now(),
@@ -10124,8 +10112,7 @@ var init_daemon_runtime = __esm({
           );
           this.service = this.options.service ?? new RoomService(
             this.store,
-            this.registry,
-            { identityNameMode: config.roomIdentity?.nameMode ?? "stable_id" }
+            this.registry
           );
           serviceRef = this.service;
           this.hostStartAttempted = true;