@ours.network/cowork 1.0.5 → 1.0.7

package/dist/daemon.js

@@ -4540,8 +4540,27 @@ function isStrictRfc3339(value) {
 function normalizeRoomName(value) {
   return value.trim().normalize("NFC");
 }
+function sdkIdentityNameError(identityName) {
+  const length = Array.from(identityName).length;
+  if (length < 1 || length > MAX_ROOM_IDENTITY_NAME_CHARACTERS) {
+    return `name must be 1-${MAX_ROOM_IDENTITY_NAME_CHARACTERS} Unicode characters`;
+  }
+  if (identityName !== identityName.normalize("NFC")) return "name must use Unicode NFC normalization";
+  if (SDK_IDENTITY_NAME_FORBIDDEN.test(identityName)) {
+    return "name must not contain control, format, surrogate, line-separator, or path-separator characters";
+  }
+  if (SDK_IDENTITY_NAME_RESERVED.has(identityName)) return `name ${JSON.stringify(identityName)} is reserved`;
+  return void 0;
+}
 function roomIdentityName(roomName) {
-  return `${ROOM_IDENTITY_PREFIX}${RoomNameSchema.parse(roomName)}`;
+  const normalized = RoomNameSchema.parse(roomName);
+  const boundedTitle = Array.from(normalized).slice(0, MAX_ROOM_IDENTITY_TITLE_CHARACTERS).join("");
+  const identityName = `${ROOM_IDENTITY_PREFIX}${boundedTitle}`;
+  const detail = sdkIdentityNameError(identityName);
+  if (detail !== void 0) {
+    throw new CoworkIdentityNameError(`generated room identity name is invalid: ${detail}`);
+  }
+  return identityName;
 }
 function isPersistedRoomIdentityName(roomId, identityName) {
   if (!LowerCrockfordUlidSchema.safeParse(roomId).success || !identityName.startsWith(ROOM_IDENTITY_PREFIX)) {
@@ -4551,7 +4570,7 @@ function isPersistedRoomIdentityName(roomId, identityName) {
   return parsed.success && identityName === `${ROOM_IDENTITY_PREFIX}${parsed.data}`;
 }
 function isStandardRoomIdentityName(roomId, identityName) {
-  return isPersistedRoomIdentityName(roomId, identityName);
+  return isPersistedRoomIdentityName(roomId, identityName) && sdkIdentityNameError(identityName) === void 0;
 }
 function refineRoomLineage(room, context) {
   const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && isPersistedRoomIdentityName(room.room_id, room.identity_name) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
@@ -4681,7 +4700,7 @@ function refineMessageCategory(message, context) {
     }
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
@@ -4695,6 +4714,7 @@ var init_contracts = __esm({
     MAX_MIME_BYTES = 255;
     MAX_ROLE_BYTES = 256;
     MAX_ROOM_NAME_CHARACTERS = 64;
+    MAX_ROOM_IDENTITY_NAME_CHARACTERS = 64;
     NonEmptyStringSchema = external_exports.string().min(1);
     PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
     LowerCrockfordUlidSchema = external_exports.string().regex(
@@ -4715,6 +4735,16 @@ var init_contracts = __esm({
       }
     });
     ROOM_IDENTITY_PREFIX = "ours-cowork:";
+    MAX_ROOM_IDENTITY_TITLE_CHARACTERS = MAX_ROOM_IDENTITY_NAME_CHARACTERS - Array.from(ROOM_IDENTITY_PREFIX).length;
+    SDK_IDENTITY_NAME_FORBIDDEN = /[\\/\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/u;
+    SDK_IDENTITY_NAME_RESERVED = /* @__PURE__ */ new Set([".", "..", "contact-book", "root.json", "bindings.json"]);
+    CoworkIdentityNameError = class extends Error {
+      code = "NAME_INVALID";
+      constructor(message) {
+        super(message);
+        this.name = "CoworkIdentityNameError";
+      }
+    };
     RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
     ROOM_ROLE = "room";
     MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
@@ -5267,6 +5297,24 @@ import { createHash as createHash2 } from "node:crypto";
 import * as fs from "node:fs";
 import { join as join2 } from "node:path";
 import { brotliCompressSync, brotliDecompressSync, constants as zlibConstants } from "node:zlib";
+async function sdkNameError(code, message) {
+  const { OursError } = await import("@ours.network/sdk");
+  return new OursError(code, message);
+}
+async function isTypedNameRefusal(error) {
+  const { OursError } = await import("@ours.network/sdk");
+  if (!(error instanceof OursError)) return false;
+  const code = error.code;
+  return code === "NAME_INVALID" || code === "NAME_TAKEN";
+}
+function sdkErrorCode(error) {
+  if (error === null || typeof error !== "object" || !("code" in error)) return void 0;
+  return typeof error.code === "string" ? error.code : void 0;
+}
+function isTransientTransportError(error) {
+  if (error === null || typeof error !== "object" || !("code" in error)) return false;
+  return (/* @__PURE__ */ new Set(["ECONNRESET", "ECONNREFUSED", "EPIPE", "ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT"])).has(String(error.code));
+}
 function sendResult(result) {
   if (result.kind === "refused" || result.kind === "migrating") {
     return { status: "send_failed" };
@@ -5386,7 +5434,7 @@ function unpackInvite(encoded, maximumBytes) {
   if (compressed.length === 0) throw new Error("the invite blob is empty or invalid base64url");
   return Buffer.from(maximumBytes === void 0 ? brotliDecompressSync(compressed) : brotliDecompressSync(compressed, { maxOutputLength: maximumBytes }));
 }
-var LegacyCoworkStateError, PacketRegistry, SdkRoomPacket;
+var LegacyCoworkStateError, RoomIdentityMismatchError, PacketRegistry, SdkRoomPacket;
 var init_packets = __esm({
   "src/packets.ts"() {
     "use strict";
@@ -5399,6 +5447,12 @@ var init_packets = __esm({
         this.name = "LegacyCoworkStateError";
       }
     };
+    RoomIdentityMismatchError = class extends Error {
+      constructor(expected, found) {
+        super(`room identity CID mismatch during rebind: expected "${expected}", found "${found}"`);
+        this.name = "RoomIdentityMismatchError";
+      }
+    };
     PacketRegistry = class {
       packets = /* @__PURE__ */ new Map();
       trackers = /* @__PURE__ */ new Map();
@@ -5407,6 +5461,8 @@ var init_packets = __esm({
       fs;
       log;
       onNotify;
+      rebindSleep;
+      rebindRandom;
       unsubscribe;
       constructor(host, stateDir, options = {}) {
         this.host = host;
@@ -5416,6 +5472,8 @@ var init_packets = __esm({
         });
         this.onNotify = options.onNotify ?? (() => {
         });
+        this.rebindSleep = options.rebindSleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+        this.rebindRandom = options.rebindRandom ?? Math.random;
         this.unsubscribe = host.onIdentityNotify((name) => {
           const found = [...this.packets.entries()].find(([, packet2]) => packet2.name === name);
           if (!found) return;
@@ -5432,18 +5490,22 @@ var init_packets = __esm({
       get(roomId) {
         return this.packets.get(roomId);
       }
-      async create(roomId, identityName, bio = `ours-cowork mission room ${roomId}`) {
+      async preflightCreate(roomId, identityName) {
         validateRoomId(roomId);
-        this.assertStandardIdentity(roomId, identityName);
+        await this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
         if (this.packets.has(roomId)) throw new Error(`room identity "${roomId}" is already hosted`);
         const localNames = /* @__PURE__ */ new Set([identityName]);
         const available = await this.host.listIdentityNames(localNames);
         if (available.has(identityName)) {
-          throw new Error(
+          throw await sdkNameError(
+            "NAME_TAKEN",
             `shared ours daemon already contains unproven room identity "${identityName}"; refusing to adopt it without a durably recorded CID`
           );
         }
+      }
+      async create(roomId, identityName, bio = `ours-cowork mission room ${roomId}`) {
+        await this.preflightCreate(roomId, identityName);
         const client = await this.host.createClient();
         try {
           const created = await client.createIdentity({
@@ -5453,7 +5515,12 @@ var init_packets = __esm({
             localAutoAccept: true
           });
           const cid = created.info.cid;
-          const packet = new SdkRoomPacket(identityName, cid, client);
+          const packet = new SdkRoomPacket(identityName, cid, client, {
+            roomId,
+            log: this.log,
+            sleep: this.rebindSleep,
+            random: this.rebindRandom
+          });
           await packet.refresh();
           this.packets.set(roomId, packet);
           this.track(roomId, identityName);
@@ -5461,12 +5528,15 @@ var init_packets = __esm({
         } catch (error) {
           await client.releaseLease().catch(() => {
           });
+          if (await isTypedNameRefusal(error)) {
+            throw error;
+          }
           throw new Error(`failed to provision standard SDK identity for room "${roomId}"`, { cause: error });
         }
       }
       async restore(roomId, expectedCid, identityName) {
         validateRoomId(roomId);
-        this.assertStandardIdentity(roomId, identityName);
+        await this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
         if (expectedCid === void 0 || expectedCid.length === 0) {
           throw new Error(`refusing to restore room identity "${identityName}" without a durably recorded expected CID`);
@@ -5482,7 +5552,12 @@ var init_packets = __esm({
           if (expectedCid !== void 0 && bound.cid !== expectedCid) {
             throw new Error(`restored room identity CID mismatch: expected "${expectedCid}", found "${bound.cid}"`);
           }
-          const packet = new SdkRoomPacket(identityName, bound.cid, client);
+          const packet = new SdkRoomPacket(identityName, bound.cid, client, {
+            roomId,
+            log: this.log,
+            sleep: this.rebindSleep,
+            random: this.rebindRandom
+          });
           await packet.refresh();
           this.packets.set(roomId, packet);
           this.track(roomId, identityName);
@@ -5493,6 +5568,21 @@ var init_packets = __esm({
           throw error;
         }
       }
+      async rebind(roomId) {
+        validateRoomId(roomId);
+        const packet = this.packets.get(roomId);
+        if (!packet) throw new Error(`room packet "${roomId}" is not hosted`);
+        return packet.rebind();
+      }
+      /** Release one local SDK lease without deleting the persisted daemon identity. */
+      async unhost(roomId) {
+        validateRoomId(roomId);
+        const packet = this.packets.get(roomId);
+        if (!packet) return;
+        this.untrack(roomId);
+        this.packets.delete(roomId);
+        await packet.close();
+      }
       async destroy(roomId) {
         validateRoomId(roomId);
         const packet = this.packets.get(roomId);
@@ -5541,7 +5631,9 @@ var init_packets = __esm({
           throw new LegacyCoworkStateError(roomId);
         }
       }
-      assertStandardIdentity(roomId, identityName) {
+      async assertStandardIdentity(roomId, identityName) {
+        const detail = sdkIdentityNameError(identityName);
+        if (detail !== void 0) throw await sdkNameError("NAME_INVALID", `generated room identity name is invalid: ${detail}`);
         if (!isStandardRoomIdentityName(roomId, identityName)) throw new LegacyCoworkStateError(roomId);
       }
     };
@@ -5549,28 +5641,87 @@ var init_packets = __esm({
       name;
       cid;
       client;
+      roomId;
+      log;
+      rebindSleep;
+      rebindRandom;
+      rebindWork;
       contacts = [];
       hasInviteProvenance = false;
       invites = [];
       refreshWork;
       contactRefreshWork;
-      constructor(name, cid, client) {
+      constructor(name, cid, client, recovery = {}) {
+        this.roomId = recovery.roomId ?? name;
         this.name = name;
         this.cid = cid;
         this.client = client;
+        this.log = recovery.log ?? (() => {
+        });
+        this.rebindSleep = recovery.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+        this.rebindRandom = recovery.random ?? Math.random;
+      }
+      rebind() {
+        this.rebindWork ??= this.rebindUnlocked().finally(() => {
+          this.rebindWork = void 0;
+        });
+        return this.rebindWork;
+      }
+      async rebindUnlocked() {
+        this.observe("identity_rebind_detected");
+        let lastError;
+        for (let attempt = 1; attempt <= 3; attempt += 1) {
+          this.observe("identity_rebind_attempt", { attempt });
+          try {
+            const bound = await this.client.chooseIdentity({ name: this.name, force: false });
+            if (bound.cid !== this.cid) {
+              throw new RoomIdentityMismatchError(this.cid, bound.cid);
+            }
+            await this.refreshUnlocked();
+            this.observe("identity_rebind_succeeded", { attempt });
+            return { name: this.name, cid: this.cid, status: "rebound" };
+          } catch (error) {
+            lastError = error;
+            const code = sdkErrorCode(error);
+            if (error instanceof RoomIdentityMismatchError || !isTransientTransportError(error) || attempt === 3) {
+              this.observe("identity_rebind_failed", {
+                attempt,
+                code: code ?? (error instanceof RoomIdentityMismatchError ? "CID_MISMATCH" : "RECOVERY_FAILED")
+              });
+              throw error;
+            }
+            const delay_ms = Math.round(100 * 2 ** (attempt - 1) * (0.75 + this.rebindRandom() * 0.5));
+            this.observe("identity_rebind_retry", { attempt, delay_ms });
+            await this.rebindSleep(delay_ms);
+          }
+        }
+        throw lastError;
+      }
+      async runBound(operation) {
+        try {
+          return await operation();
+        } catch (error) {
+          const code = sdkErrorCode(error);
+          if (code !== "NOT_BOUND" && code !== "BINDING_REASSIGNED") throw error;
+          await this.rebind();
+          return operation();
+        }
+      }
+      observe(event, detail = {}) {
+        this.log(JSON.stringify({ event, room_id: this.roomId, identity_name: this.name, identity_cid: this.cid, ...detail }));
       }
       refresh() {
-        this.refreshWork ??= this.refreshUnlocked().finally(() => {
+        this.refreshWork ??= this.runBound(() => this.refreshUnlocked()).finally(() => {
           this.refreshWork = void 0;
         });
         return this.refreshWork;
       }
       async refreshUnlocked() {
-        await this.refreshContacts();
+        await this.refreshContactsUnlocked();
         this.invites = (await this.client.listInvites()).flatMap((invite) => invite.mode === "one_time" || invite.mode === "public" ? [{ invite_id: invite.invite_id, mode: invite.mode }] : []);
       }
       refreshContacts() {
-        this.contactRefreshWork ??= this.refreshContactsUnlocked().finally(() => {
+        this.contactRefreshWork ??= this.runBound(() => this.refreshContactsUnlocked()).finally(() => {
           this.contactRefreshWork = void 0;
         });
         return this.contactRefreshWork;
@@ -5584,13 +5735,13 @@ var init_packets = __esm({
         }));
       }
       async mintInvite(mode) {
-        const result = await this.client.generateInvite({ mode });
+        const result = await this.runBound(() => this.client.generateInvite({ mode }));
         await this.refresh();
         return { blob: result.blob, invite_id: result.inviteId, reusable: mode === "public" };
       }
       async addContact(invite) {
         const decoded = unpackInvite(invite, MAX_EXTERNAL_INVITE_BYTES);
-        const result = await this.client.addContact({ invite });
+        const result = await this.runBound(() => this.client.addContact({ invite }));
         await this.refresh();
         return {
           invite_id: createHash2("sha256").update(decoded).digest("hex"),
@@ -5600,7 +5751,7 @@ var init_packets = __esm({
         };
       }
       async revokeInvite(inviteId) {
-        const result = await this.client.revokeInvite({ invite_id: inviteId });
+        const result = await this.runBound(() => this.client.revokeInvite({ invite_id: inviteId }));
         await this.refresh();
         return { revoked: result.revoked };
       }
@@ -5615,9 +5766,9 @@ var init_packets = __esm({
       }
       async listUnreadMessages(limit) {
         validateBatchLimit(limit);
-        const metadata = (await this.client.listIncomingMessages()).filter((message) => message.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
+        const metadata = (await this.runBound(() => this.client.listIncomingMessages())).filter((message) => message.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
         return Promise.all(metadata.map(async (listed) => {
-          const history = await this.client.getHistoryItem({ wire_id: listed.wire_id });
+          const history = await this.runBound(() => this.client.getHistoryItem({ wire_id: listed.wire_id }));
           if (history === null) throw new Error(`SDK history is missing unread message ${listed.wire_id}`);
           assertListedMessage(listed, history);
           return messageItem(history);
@@ -5625,7 +5776,7 @@ var init_packets = __esm({
       }
       async acknowledgeMessage(expected, onUnexpected) {
         for (; ; ) {
-          const pulled = await this.client.getMessages({ limit: 1 });
+          const pulled = await this.runBound(() => this.client.getMessages({ limit: 1 }));
           if (pulled.messages.length > 1) throw new Error("SDK returned more than one message for limit 1");
           const [history] = pulled.messages;
           if (history === void 0) return;
@@ -5639,31 +5790,31 @@ var init_packets = __esm({
       }
       async listUnreadFiles(limit) {
         validateBatchLimit(limit);
-        const unread = (await this.client.listIncomingFiles()).filter((file) => file.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
-        return Promise.all(unread.map(async (file) => fileItem(file, await this.client.fetchFile(file.wire_id))));
+        const unread = (await this.runBound(() => this.client.listIncomingFiles())).filter((file) => file.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
+        return Promise.all(unread.map(async (file) => fileItem(file, await this.runBound(() => this.client.fetchFile(file.wire_id)))));
       }
       async acknowledgeFile(expected) {
-        const pulled = await this.client.getFiles({ wire_ids: [expected.wire_id] });
+        const pulled = await this.runBound(() => this.client.getFiles({ wire_ids: [expected.wire_id] }));
         if (pulled.files.length !== 1) {
           throw new Error(`SDK did not acknowledge selected file ${expected.wire_id}`);
         }
         assertReceivedFile(expected, pulled.files[0]);
       }
       async send(contactCid, body, replyTo) {
-        return sendResult(await this.client.sendMessage({
+        return sendResult(await this.runBound(() => this.client.sendMessage({
           contact: contactCid,
           text: body,
           ...replyTo === void 0 ? {} : {
             reply_to_wire_id: replyTo.wire_id,
             ...replyTo.sentence === void 0 ? {} : { reply_to_sentence: replyTo.sentence }
           }
-        }));
+        })));
       }
       async sendFile(contactCid, filename, mime, data, replyTo) {
         const validName = FileNameSchema.parse(filename);
         const validMime = FileMimeSchema.parse(mime);
         if (data.length > MAX_FILE_BYTES) throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
-        return sendResult(await this.client.sendFile({
+        return sendResult(await this.runBound(() => this.client.sendFile({
           contact: contactCid,
           data_base64: data.toString("base64"),
           filename: validName,
@@ -5672,10 +5823,10 @@ var init_packets = __esm({
             reply_to_wire_id: replyTo.wire_id,
             ...replyTo.sentence === void 0 ? {} : { reply_to_sentence: replyTo.sentence }
           }
-        }));
+        })));
       }
       async removeContact(contactCid) {
-        const result = await this.client.removeContact({ contact: contactCid });
+        const result = await this.runBound(() => this.client.removeContact({ contact: contactCid }));
         const notified = result.notified === true;
         this.contacts = this.contacts.filter((contact) => contact.container_id !== contactCid);
         return { status: notified ? "queued" : "send_failed", notified, key_material_retained: true };
@@ -6243,6 +6394,12 @@ function byteBoundedHistoryPage(records) {
   }
   return page;
 }
+async function isCleanIdentityRefusal(error) {
+  const { OursError } = await import("@ours.network/sdk");
+  if (!(error instanceof OursError)) return false;
+  const code = error.code;
+  return code === "NAME_INVALID" || code === "NAME_TAKEN";
+}
 function activeSeats(room) {
   return room.seats.filter((seat) => seat.state === "active");
 }
@@ -6328,6 +6485,7 @@ var init_service = __esm({
       nextMessageId;
       intake;
       provisioningCheckpoint;
+      identityNameTails = /* @__PURE__ */ new Map();
       constructor(store, packets, options = {}) {
         this.store = store;
         this.packets = packets;
@@ -6346,7 +6504,8 @@ var init_service = __esm({
         const roomId = LowerCrockfordUlidSchema.parse(this.nextRoomId());
         const roomName = settings.name ?? defaultRoomName(roomId);
         const identityName = roomIdentityName(roomName);
-        return this.lock(roomId, async () => {
+        return this.lockIdentityName(identityName, () => this.lock(roomId, async () => {
+          await this.packets.preflightCreate(roomId, identityName);
           const provisional = RoomSchema.parse({
             version: 2,
             room_id: roomId,
@@ -6369,15 +6528,30 @@ var init_service = __esm({
             created_at: this.now()
           });
           await this.store.create(provisional);
-          const packet = await this.packets.create(
-            roomId,
-            identityName,
-            `ours-cowork mission room ${roomId}`
-          );
+          let packet;
+          try {
+            packet = await this.packets.create(
+              roomId,
+              identityName,
+              `ours-cowork mission room ${roomId}`
+            );
+          } catch (error) {
+            if (await isCleanIdentityRefusal(error)) {
+              try {
+                await this.store.discardPendingProvisioning(roomId, identityName);
+              } catch (rollbackError) {
+                throw new AggregateError(
+                  [error, rollbackError],
+                  `room "${roomId}" identity provisioning was refused and its fresh sentinel could not be discarded`
+                );
+              }
+            }
+            throw error;
+          }
           this.provisioningCheckpoint("metadata");
           const { status: _packetPending, ...created } = provisional;
           return this.store.save(RoomSchema.parse({ ...created, identity_cid: packet.cid }));
-        });
+        }));
       }
       async recoverRoom(roomId) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
@@ -6392,10 +6566,39 @@ var init_service = __esm({
         const id = LowerCrockfordUlidSchema.parse(roomId);
         return this.lock(id, async () => this.recoverPacketUnlocked(id, await this.store.load(id)));
       }
+      /** Canonical operator recovery for an established room identity lease. */
+      async rebindIdentity(roomId) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        let room = await this.store.load(id);
+        if (room.state === "closed" || room.state === "closing") {
+          throw new RoomServiceError(`cannot rebind room "${id}" while it is ${room.state}`);
+        }
+        if (this.isPacketPending(room) || !this.packets.get(id)) {
+          room = await this.recoverPacket(id);
+        } else {
+          if (!this.packets.rebind) throw new RoomServiceError("room packet registry does not support explicit rebind");
+          await this.packets.rebind(id);
+        }
+        await this.reconcileRoom(id);
+        await this.resumePending(id);
+        return {
+          room_id: id,
+          identity_name: room.identity_name,
+          identity_cid: room.identity_cid,
+          status: "rebound",
+          fanout: "resumed"
+        };
+      }
       async recoverPacketUnlocked(id, initial) {
         let room = initial;
         if (room.state === "closed") return room;
-        const packetPending = this.isPacketPending(room);
+        let packetPending = this.isPacketPending(room);
+        if (packetPending && isPersistedRoomIdentityName(id, room.identity_name) && !isStandardRoomIdentityName(id, room.identity_name)) {
+          const storedCreationName = room.identity_name.slice(ROOM_IDENTITY_PREFIX.length);
+          const correctedIdentityName = roomIdentityName(storedCreationName);
+          room = await this.store.save(RoomSchema.parse({ ...room, identity_name: correctedIdentityName }));
+          packetPending = this.isPacketPending(room);
+        }
         let packet = this.packets.get(id);
         if (packet) {
           if (!packetPending && packet.cid !== room.identity_cid) {
@@ -7074,6 +7277,11 @@ var init_service = __esm({
           if (room.state === "closed") {
             return this.store.save(room);
           }
+          if (this.isPacketPending(room)) {
+            throw new RoomServiceError(
+              `cannot close room "${id}" while its identity CID is unproven; run room rebind first, or verify and remove a colliding orphan identity before retrying recovery`
+            );
+          }
           if (room.state === "closing") {
             room = await this.store.save(room);
           } else {
@@ -7549,6 +7757,17 @@ var init_service = __esm({
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
       }
+      async lockIdentityName(identityName, work) {
+        const previous = this.identityNameTails.get(identityName) ?? Promise.resolve();
+        const result = previous.then(work, work);
+        const tail = result.then(() => void 0, () => void 0);
+        this.identityNameTails.set(identityName, tail);
+        try {
+          return await result;
+        } finally {
+          if (this.identityNameTails.get(identityName) === tail) this.identityNameTails.delete(identityName);
+        }
+      }
       packet(roomId) {
         const packet = this.packets.get(roomId);
         if (!packet) throw new RoomServiceError(`room packet "${roomId}" is not hosted`);
@@ -7895,6 +8114,45 @@ var init_storage = __esm({
           synchronous: db.pragma("synchronous", { simple: true })
         })));
       }
+      /** Roll back only a fresh, empty provisioning sentinel after a proven no-side-effect SDK refusal. */
+      async discardPendingProvisioning(roomId, expectedIdentityName) {
+        const id = this.roomId(roomId);
+        await this.mutex(id, () => {
+          this.ensureBaseDirectories();
+          const roomDir = this.roomDirectory(id);
+          this.ensurePrivateDirectory(roomDir, false, `room "${id}" directory`);
+          const room = this.loadUnlocked(id);
+          if (room.state !== "provisioning" || room.status !== "packet_pending" || room.identity_cid !== "" || room.identity_name !== expectedIdentityName || room.invites.length !== 0 || room.seats.length !== 0) {
+            throw new CoworkStorageError(`room "${id}" is not the exact empty provisioning sentinel`);
+          }
+          const blobs = this.blobsDirectory(id);
+          this.ensurePrivateDirectory(blobs, false, `room "${id}" blobs directory`);
+          if (this.fs.readdirSync(blobs).length !== 0) {
+            throw new CoworkStorageError(`room "${id}" provisioning sentinel has file blobs`);
+          }
+          const recordCount = this.withDatabase(id, (db) => db.prepare(
+            "SELECT COUNT(*) AS count FROM records"
+          ).get().count);
+          if (recordCount !== 0) throw new CoworkStorageError(`room "${id}" provisioning sentinel has archive records`);
+          const expected = /* @__PURE__ */ new Set(["archive.sqlite3", "archive.sqlite3-wal", "archive.sqlite3-shm", "blobs", "room.json"]);
+          const unexpected = this.fs.readdirSync(roomDir).filter((name) => !expected.has(name));
+          if (unexpected.length !== 0) {
+            throw new CoworkStorageError(`room "${id}" provisioning sentinel has unexpected residue: ${unexpected.join(", ")}`);
+          }
+          for (const name of ["archive.sqlite3-wal", "archive.sqlite3-shm", "archive.sqlite3", "room.json"]) {
+            const path = join3(roomDir, name);
+            if (this.lstatIfPresent(path)) {
+              this.assertRegularFile(path, name);
+              this.fs.unlinkSync(path);
+            }
+          }
+          this.fs.rmdirSync(blobs);
+          this.fsyncDirectory(roomDir);
+          this.fs.rmdirSync(roomDir);
+          this.fsyncDirectory(this.roomsDirectory());
+          this.reconciledBlobRooms.delete(id);
+        });
+      }
       async delete(roomId) {
         const id = this.roomId(roomId);
         await this.mutex(id, () => {
@@ -8765,6 +9023,14 @@ var init_openapi = __esm({
         result: "The updated room record with the confirmed recovery.",
         example: { room_id: EXAMPLE_ROOM_ID, recovery_of: "inv-01", invite_id: "inv-02" }
       },
+      {
+        method: "room.rebind",
+        summary: "Rebind an established room identity",
+        description: "Safely restores the exact persisted room identity with a non-force lease claim and CID proof, then resumes durable room fanout. It never creates or renames an identity.",
+        params: params({ room_id: roomIdProperty }, ["room_id"]),
+        result: "A structured rebind receipt after identity proof, reconciliation, and pending fanout resumption.",
+        example: { room_id: EXAMPLE_ROOM_ID }
+      },
       {
         method: "room.list",
         summary: "List rooms",
@@ -9298,6 +9564,7 @@ function createServiceRoutes(service) {
       const value = RecoverConfirmParams.parse(params2);
       return service.confirmRecoveredInvite(value.room_id, value.recovery_of, value.invite_id);
     } },
+    "room.rebind": { auth: true, run: (params2) => service.rebindIdentity(RoomIdParams.parse(params2).room_id) },
     "room.list": { auth: true, run: (params2) => {
       external_exports.object({}).strict().parse(params2);
       return service.listRooms();
@@ -10330,21 +10597,43 @@ var init_daemon_runtime = __esm({
           const rooms = await this.store.list();
           this.checkpoint();
           const recoverable = rooms.filter((room) => room.state !== "closed");
+          const healthy = new Set(recoverable.map((room) => room.room_id));
+          const recoverPhase = async (roomId, phase, work) => {
+            if (!healthy.has(roomId)) return;
+            try {
+              await work();
+              this.checkpoint();
+            } catch (error) {
+              healthy.delete(roomId);
+              const unhost = this.registry?.unhost;
+              if (unhost) {
+                await unhost.call(this.registry, roomId).catch((unhostError) => {
+                  this.options.log?.(JSON.stringify({
+                    event: "startup_room_unhost_failed",
+                    room_id: roomId,
+                    error: unhostError instanceof Error ? unhostError.message : String(unhostError)
+                  }));
+                });
+              }
+              this.options.log?.(JSON.stringify({
+                event: "startup_room_recovery_failed",
+                room_id: roomId,
+                phase,
+                error: error instanceof Error ? error.message : String(error)
+              }));
+            }
+          };
           for (const room of recoverable) {
-            await this.service.recoverPacket(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "restore", () => this.service.recoverPacket(room.room_id));
           }
           for (const room of recoverable.filter((candidate) => candidate.state !== "closing")) {
-            await this.service.reconcileRoom(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "reconcile", () => this.service.reconcileRoom(room.room_id));
           }
           for (const room of recoverable.filter((candidate) => candidate.state === "closing")) {
-            await this.service.closeRoom(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "close", () => this.service.closeRoom(room.room_id));
           }
           for (const room of recoverable.filter((candidate) => candidate.state !== "closing")) {
-            await this.service.resumePending(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "fanout", () => this.service.resumePending(room.room_id));
           }
           const realService = this.service;
           const serviceRoutes = createServiceRoutes(realService);