@teammy/server 0.0.0-stage → 0.0.2

package/dist/main.js

@@ -0,0 +1,1627 @@
+// apps/server/main.ts
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+
+// apps/server/static.ts
+import { join } from "node:path";
+import fastifyStatic from "@fastify/static";
+function registerWeb(server, root) {
+  server.register(fastifyStatic, {
+    root: join(root, "assets"),
+    prefix: "/assets/",
+    immutable: true,
+    maxAge: "1y",
+    index: false,
+    dotfiles: "deny"
+  });
+  for (const path of ["/", "/files", "/members", "/settings"])
+    server.get(
+      path,
+      (_request, reply) => reply.header("cache-control", "no-cache").header(
+        "content-security-policy",
+        "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'"
+      ).header("x-content-type-options", "nosniff").header("referrer-policy", "no-referrer").sendFile("index.html", root, { maxAge: 0, immutable: false })
+    );
+}
+
+// apps/server/server.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import Fastify from "fastify";
+
+// packages/protocol/index.ts
+import { z } from "zod";
+var PROTOCOL_VERSION = 1;
+var HealthSchema = z.object({ status: z.literal("ok") });
+var ServerInfoSchema = z.object({
+  name: z.literal("teammy"),
+  version: z.string().min(1),
+  protocolVersion: z.literal(PROTOCOL_VERSION),
+  capabilities: z.array(z.string())
+});
+var ErrorResponseSchema = z.object({
+  error: z.object({
+    code: z.string(),
+    message: z.string(),
+    requestId: z.string()
+  })
+});
+
+// packages/protocol/identity.ts
+import { z as z2 } from "zod";
+var NameSchema = z2.string().regex(/^[a-z][a-z0-9_-]{0,63}$/);
+var DeviceIdSchema = z2.uuid();
+var BindRequestSchema = z2.object({ deviceId: DeviceIdSchema }).strict();
+var BindingSchema = z2.object({
+  workspaceId: NameSchema,
+  memberId: NameSchema,
+  deviceId: DeviceIdSchema
+});
+var MembersSchema = z2.object({ members: z2.array(NameSchema) });
+
+// apps/server/store.ts
+import { createHash, randomBytes } from "node:crypto";
+import { join as join2 } from "node:path";
+
+// packages/state/sqlite.ts
+import { chmodSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+function transaction(db, action) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = action();
+    db.exec("COMMIT");
+    return result;
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+}
+function openDatabase(path, migrations2) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const db = new DatabaseSync(path);
+  try {
+    chmodSync(path, 384);
+    db.exec(
+      "PRAGMA busy_timeout = 5000; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;"
+    );
+    transaction(db, () => {
+      const version = Number(db.prepare("PRAGMA user_version").get().user_version);
+      if (version > migrations2.length)
+        throw new Error("Database was created by a newer Teammy version.");
+      for (let index = version; index < migrations2.length; index++) {
+        db.exec(migrations2[index]);
+        db.exec(`PRAGMA user_version = ${index + 1}`);
+      }
+    });
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+}
+
+// apps/server/errors.ts
+var HubError = class extends Error {
+  constructor(statusCode, code, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.name = "HubError";
+  }
+  statusCode;
+  code;
+};
+
+// apps/server/session-schema.ts
+var sessionMigration = String.raw`
+  CREATE TABLE sessions (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, session_key TEXT NOT NULL,
+    agent TEXT NOT NULL, native_id TEXT NOT NULL, cwd TEXT NOT NULL, title TEXT NOT NULL,
+    revision INTEGER NOT NULL, updated_at TEXT NOT NULL, message_count INTEGER NOT NULL,
+    hash TEXT NOT NULL, size INTEGER NOT NULL,
+    UNIQUE(workspace_id, owner, session_key)
+  );
+  CREATE INDEX session_listing ON sessions(workspace_id, id);
+  CREATE TABLE session_revisions (
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, session_key TEXT NOT NULL,
+    revision INTEGER NOT NULL, info_json TEXT NOT NULL,
+    PRIMARY KEY(workspace_id, owner, session_key, revision)
+  );
+  CREATE TABLE session_operations (
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, operation_id TEXT NOT NULL,
+    fingerprint TEXT NOT NULL, revision INTEGER NOT NULL,
+    PRIMARY KEY(workspace_id, owner, operation_id)
+  );
+  CREATE TABLE session_messages (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, session_key TEXT NOT NULL,
+    revision INTEGER NOT NULL, message_id TEXT NOT NULL, role TEXT NOT NULL, body TEXT NOT NULL, search_text TEXT NOT NULL
+  );
+  CREATE INDEX session_message_lookup ON session_messages(workspace_id, owner, session_key);
+  CREATE VIRTUAL TABLE session_fts USING fts5(body, tokenize='trigram');
+`;
+
+// apps/server/control-schema.ts
+var controlMigration = String.raw`
+ CREATE TABLE device_status(workspace_id TEXT NOT NULL,member_id TEXT NOT NULL,device_id TEXT NOT NULL,seen_at TEXT NOT NULL,status_json TEXT NOT NULL,PRIMARY KEY(workspace_id,member_id));
+`;
+
+// apps/server/device-schema.ts
+var deviceMigration = String.raw`
+ CREATE TABLE device_enrollments(workspace_id TEXT NOT NULL, member_id TEXT NOT NULL, operation_id TEXT NOT NULL, fingerprint TEXT NOT NULL, PRIMARY KEY(workspace_id,member_id,operation_id));
+`;
+
+// apps/server/project-schema.ts
+var projectMigration = String.raw`
+  ALTER TABLE members ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1;
+  ALTER TABLE members ADD COLUMN role TEXT NOT NULL DEFAULT 'member';
+  ALTER TABLE members ADD COLUMN display_name TEXT NOT NULL DEFAULT '';
+  ALTER TABLE members ADD COLUMN member_revision INTEGER NOT NULL DEFAULT 1;
+  UPDATE members SET enabled=0 WHERE token_hash IS NULL;
+  CREATE TABLE project_settings(id INTEGER PRIMARY KEY CHECK(id=1), config_json TEXT NOT NULL, setup_operation TEXT NOT NULL, setup_fingerprint TEXT NOT NULL);
+  CREATE TABLE web_sessions(token_hash TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, member_id TEXT NOT NULL, expires_at INTEGER NOT NULL);
+`;
+
+// apps/server/file-schema.ts
+var fileMigration = String.raw`
+  ALTER TABLE members ADD COLUMN file_revision INTEGER NOT NULL DEFAULT 0;
+  CREATE TABLE workspace_blobs (workspace_id TEXT NOT NULL, hash TEXT NOT NULL, size INTEGER NOT NULL, PRIMARY KEY(workspace_id, hash));
+  CREATE TABLE file_operations (
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, operation_id TEXT NOT NULL,
+    fingerprint TEXT NOT NULL, revision INTEGER NOT NULL,
+    PRIMARY KEY(workspace_id, owner, operation_id)
+  );
+  CREATE TABLE file_revisions (
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL,
+    operation_id TEXT NOT NULL, created_at TEXT NOT NULL, changes_json TEXT NOT NULL,
+    PRIMARY KEY(workspace_id, owner, revision)
+  );
+  CREATE TABLE current_files (
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, path TEXT NOT NULL, path_key TEXT NOT NULL,
+    hash TEXT NOT NULL, size INTEGER NOT NULL, revision INTEGER NOT NULL,
+    PRIMARY KEY(workspace_id, owner, path), UNIQUE(workspace_id, owner, path_key)
+  );
+  CREATE TABLE file_events (
+    workspace_id TEXT NOT NULL, owner TEXT NOT NULL, path TEXT NOT NULL, revision INTEGER NOT NULL,
+    hash TEXT, size INTEGER,
+    PRIMARY KEY(workspace_id, owner, path, revision)
+  );
+`;
+
+// apps/server/store.ts
+function digest(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+var migrations = [
+  String.raw`
+  CREATE TABLE members (
+    workspace_id TEXT NOT NULL,
+    member_id TEXT NOT NULL,
+    token_hash TEXT UNIQUE,
+    device_id TEXT,
+    PRIMARY KEY (workspace_id, member_id)
+  );
+`,
+  fileMigration,
+  sessionMigration,
+  projectMigration,
+  deviceMigration,
+  controlMigration
+];
+var HubStore = class {
+  constructor(directory) {
+    this.directory = directory;
+    this.db = openDatabase(join2(directory, "hub.sqlite3"), migrations);
+  }
+  directory;
+  db;
+  close() {
+    this.db.close();
+  }
+  issueMember(workspaceId, memberId, reset = false) {
+    NameSchema.parse(workspaceId);
+    NameSchema.parse(memberId);
+    const token = `tmy_${randomBytes(32).toString("hex")}`;
+    transaction(this.db, () => {
+      const exists = this.db.prepare("SELECT 1 FROM members WHERE workspace_id=? AND member_id=?").get(workspaceId, memberId);
+      if (exists && !reset)
+        throw new HubError(
+          409,
+          "MEMBER_EXISTS",
+          "Member exists; use member reset to replace its credential and device binding."
+        );
+      if (!exists && reset) throw new HubError(404, "MEMBER_NOT_FOUND", "Member does not exist.");
+      this.db.prepare(
+        `INSERT INTO members (workspace_id, member_id, token_hash) VALUES (?, ?, ?)
+        ON CONFLICT(workspace_id, member_id) DO UPDATE SET token_hash=excluded.token_hash, device_id=NULL, enabled=1, member_revision=member_revision+1`
+      ).run(workspaceId, memberId, digest(token));
+    });
+    return token;
+  }
+  revokeMember(workspaceId, memberId) {
+    const result = this.db.prepare(
+      "UPDATE members SET token_hash=NULL, device_id=NULL, enabled=0, member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+    ).run(NameSchema.parse(workspaceId), NameSchema.parse(memberId));
+    if (!result.changes) throw new HubError(404, "MEMBER_NOT_FOUND", "Member does not exist.");
+    this.db.prepare("DELETE FROM web_sessions WHERE workspace_id=? AND member_id=?").run(workspaceId, memberId);
+  }
+  identity(authorization) {
+    const match = authorization?.match(/^Bearer (tmy_[a-f0-9]{64})$/);
+    const row = match && this.db.prepare(
+      "SELECT workspace_id, member_id, device_id FROM members WHERE token_hash=? AND enabled=1"
+    ).get(digest(match[1]));
+    if (!row) throw new HubError(401, "UNAUTHORIZED", "A valid member credential is required.");
+    return {
+      workspaceId: String(row.workspace_id),
+      memberId: String(row.member_id),
+      deviceId: row.device_id
+    };
+  }
+  bind(authorization, deviceId) {
+    return transaction(this.db, () => {
+      const identity = this.identity(authorization);
+      if (identity.deviceId && identity.deviceId !== deviceId)
+        throw new HubError(
+          409,
+          "DEVICE_BOUND",
+          "This member is bound to another device. An administrator must reset the binding."
+        );
+      this.db.prepare("UPDATE members SET device_id=? WHERE workspace_id=? AND member_id=?").run(deviceId, identity.workspaceId, identity.memberId);
+      return BindingSchema.parse({ ...identity, deviceId });
+    });
+  }
+  authorize(authorization, deviceId) {
+    const identity = this.identity(authorization);
+    if (!identity.deviceId || identity.deviceId !== deviceId)
+      throw new HubError(
+        403,
+        "DEVICE_MISMATCH",
+        "Connect this device before using workspace APIs."
+      );
+    return BindingSchema.parse(identity);
+  }
+  members(identity) {
+    return this.db.prepare("SELECT member_id FROM members WHERE workspace_id=? ORDER BY member_id").all(identity.workspaceId).map((row) => String(row.member_id));
+  }
+};
+
+// apps/server/server.ts
+import { ZodError } from "zod";
+
+// packages/protocol/devices.ts
+import { z as z4 } from "zod";
+
+// packages/protocol/files.ts
+import { z as z3 } from "zod";
+var MAX_BLOB_BYTES = 10 * 1024 * 1024;
+var MAX_BATCH_FILES = 200;
+var HashSchema = z3.string().regex(/^[a-f0-9]{64}$/);
+var RevisionSchema = z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var FilePathSchema = z3.string().min(1).max(1024).refine((path) => {
+  if (path !== path.normalize("NFC") || /[\\\x00-\x1f\x7f:<>"|?*]/.test(path)) return false;
+  return path.split("/").every(
+    (part) => part.length > 0 && part.length <= 255 && part !== "." && part !== ".." && !/[. ]$/.test(part) && !/^\.teammy(?:-|$)/i.test(part) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part)
+  );
+}, "Path must be a portable, normalized relative file path.");
+var BlobRefSchema = z3.object({
+  sha256: HashSchema,
+  size: z3.number().int().min(0).max(MAX_BLOB_BYTES)
+});
+var FileChangeSchema = z3.discriminatedUnion("kind", [
+  BlobRefSchema.extend({ kind: z3.literal("upsert"), path: FilePathSchema }).strict(),
+  z3.object({ kind: z3.literal("delete"), path: FilePathSchema }).strict()
+]);
+var FileCommitSchema = z3.object({
+  operationId: z3.uuid(),
+  parentRevision: RevisionSchema,
+  changes: z3.array(FileChangeSchema).min(1).max(MAX_BATCH_FILES)
+}).strict().refine(
+  (batch) => new Set(batch.changes.map((change) => change.path)).size === batch.changes.length,
+  "Duplicate paths in a batch."
+);
+var CommitResultSchema = z3.object({ operationId: z3.uuid(), revision: RevisionSchema });
+var FileEntrySchema = BlobRefSchema.extend({
+  path: FilePathSchema,
+  revision: RevisionSchema
+});
+var ManifestSchema = z3.object({
+  revision: RevisionSchema,
+  files: z3.array(FileEntrySchema),
+  nextCursor: z3.string().nullable()
+});
+var FileRevisionSchema = z3.object({
+  revision: RevisionSchema,
+  operationId: z3.uuid(),
+  createdAt: z3.string(),
+  changes: z3.array(FileChangeSchema)
+});
+var ChangesSchema = z3.object({
+  headRevision: RevisionSchema,
+  revisions: z3.array(FileRevisionSchema)
+});
+var BlobCheckSchema = z3.object({ hashes: z3.array(HashSchema).max(MAX_BATCH_FILES) }).strict();
+var MissingBlobsSchema = z3.object({ missing: z3.array(HashSchema) });
+
+// packages/protocol/devices.ts
+var CredentialSchema = z4.string().regex(/^tmy_[a-f0-9]{64}$/);
+var EnrollmentSchema = z4.object({
+  operationId: z4.uuid(),
+  memberId: NameSchema,
+  deviceId: DeviceIdSchema,
+  credential: CredentialSchema
+}).strict();
+var EffectivePolicySchema = z4.object({
+  checkIntervalSeconds: z4.number().min(1).max(86400),
+  fileSettleSeconds: z4.number().min(0).max(86400)
+}).strict();
+var SyncSummarySchema = z4.object({
+  checkedAt: z4.string(),
+  published: z4.boolean(),
+  appliedFiles: z4.number().int().nonnegative(),
+  pendingFiles: z4.number().int().nonnegative(),
+  sessionSources: z4.number().int().nonnegative(),
+  errors: z4.array(z4.string().max(1e3)).max(20)
+}).strict();
+var DeviceStatusSchema = z4.object({
+  clientVersion: z4.string().max(64),
+  receivedRevision: RevisionSchema.nullable(),
+  appliedRevision: RevisionSchema.nullable(),
+  effectivePolicy: EffectivePolicySchema,
+  overrides: z4.array(z4.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
+  configError: z4.string().max(2e3).nullable(),
+  reportError: z4.string().max(2e3).nullable(),
+  lastSync: SyncSummarySchema.nullable()
+}).strict();
+var WebDevicesSchema = z4.object({
+  devices: z4.array(
+    z4.object({
+      memberId: NameSchema,
+      bound: z4.boolean(),
+      lastSeenAt: z4.string().nullable(),
+      status: DeviceStatusSchema.nullable()
+    })
+  )
+});
+
+// apps/server/project.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+
+// packages/protocol/project.ts
+import { z as z5 } from "zod";
+var ServerUrlSchema = z5.string().url().max(2048).refine((value) => {
+  const url = new URL(value);
+  return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
+}, "Use an HTTP(S) server URL without credentials, query or fragment.");
+var SyncPolicySchema = z5.object({
+  checkIntervalSeconds: z5.number().int().min(1).max(86400),
+  fileSettleSeconds: z5.number().int().min(0).max(86400)
+}).strict();
+var DEFAULT_POLICY = { checkIntervalSeconds: 60, fileSettleSeconds: 60 };
+var ProjectConfigSchema = z5.object({
+  schemaVersion: z5.literal(1),
+  projectId: NameSchema,
+  projectName: z5.string().trim().min(1).max(120),
+  description: z5.string().max(2e3),
+  publicServerUrl: ServerUrlSchema,
+  configRevision: RevisionSchema,
+  scopeProfile: z5.literal("workspace-and-sessions-v1"),
+  sync: SyncPolicySchema
+}).strict();
+var SetupSchema = z5.object({
+  operationId: z5.uuid(),
+  projectName: z5.string().trim().min(1).max(120),
+  description: z5.string().max(2e3).default(""),
+  publicServerUrl: ServerUrlSchema,
+  adminId: NameSchema,
+  members: z5.array(NameSchema).max(100).default([]),
+  existingWorkspaceId: NameSchema.optional(),
+  sync: SyncPolicySchema.default(DEFAULT_POLICY)
+}).strict();
+var SetupStatusSchema = z5.object({
+  initialized: z5.boolean(),
+  existingWorkspaces: z5.array(NameSchema)
+});
+var ConfigUpdateSchema = ProjectConfigSchema.pick({
+  projectName: true,
+  description: true,
+  publicServerUrl: true,
+  sync: true
+}).extend({ expectedRevision: RevisionSchema }).strict();
+var MemberSchema = z5.object({
+  id: NameSchema,
+  displayName: z5.string().max(120),
+  role: z5.enum(["admin", "member"]),
+  enabled: z5.boolean(),
+  revision: RevisionSchema,
+  bound: z5.boolean(),
+  fileRevision: RevisionSchema,
+  lastPublishedAt: z5.string().nullable()
+});
+var WebSessionSchema = z5.object({
+  workspaceId: NameSchema,
+  memberId: NameSchema,
+  displayName: z5.string(),
+  role: z5.enum(["admin", "member"])
+});
+var MemberCreateSchema = z5.object({ id: NameSchema, displayName: z5.string().trim().max(120).default("") }).strict();
+var MemberUpdateSchema = z5.object({
+  expectedRevision: RevisionSchema,
+  displayName: z5.string().trim().max(120).optional(),
+  enabled: z5.boolean().optional()
+}).strict();
+
+// apps/server/project.ts
+var digest2 = (value) => createHash2("sha256").update(value).digest("hex");
+var ProjectRepository = class {
+  constructor(hub) {
+    this.hub = hub;
+  }
+  hub;
+  status() {
+    return {
+      initialized: Boolean(this.hub.db.prepare("SELECT 1 FROM project_settings").get()),
+      existingWorkspaces: this.hub.db.prepare("SELECT DISTINCT workspace_id FROM members ORDER BY workspace_id").all().map((r) => String(r.workspace_id))
+    };
+  }
+  config(identity) {
+    const row = this.hub.db.prepare("SELECT config_json FROM project_settings WHERE id=1").get();
+    if (!row)
+      throw new HubError(409, "SETUP_REQUIRED", "Initialize the project in the browser first.");
+    const config = ProjectConfigSchema.parse(JSON.parse(String(row.config_json)));
+    if (identity && identity.workspaceId !== config.projectId)
+      throw new HubError(
+        404,
+        "PROJECT_NOT_FOUND",
+        "This workspace has no Web project configuration."
+      );
+    return config;
+  }
+  setup(input) {
+    const value = SetupSchema.parse(input);
+    const fingerprint = digest2(JSON.stringify(value));
+    return transaction(this.hub.db, () => {
+      const prior = this.hub.db.prepare("SELECT setup_operation,setup_fingerprint FROM project_settings").get();
+      if (prior) {
+        if (prior.setup_operation === value.operationId && prior.setup_fingerprint === fingerprint)
+          return this.config();
+        throw new HubError(
+          409,
+          "ALREADY_INITIALIZED",
+          "Project initialization has already completed."
+        );
+      }
+      const existing = this.status().existingWorkspaces;
+      if (existing.length && !value.existingWorkspaceId)
+        throw new HubError(
+          400,
+          "WORKSPACE_REQUIRED",
+          "Select an existing workspace to preserve its data."
+        );
+      if (value.existingWorkspaceId && !existing.includes(value.existingWorkspaceId))
+        throw new HubError(400, "WORKSPACE_NOT_FOUND", "Existing workspace was not found.");
+      const projectId = value.existingWorkspaceId ?? `proj-${randomBytes2(8).toString("hex")}`;
+      for (const id of /* @__PURE__ */ new Set([value.adminId, ...value.members])) {
+        this.hub.db.prepare("INSERT OR IGNORE INTO members(workspace_id,member_id) VALUES (?,?)").run(projectId, id);
+      }
+      this.hub.db.prepare(
+        "UPDATE members SET role='admin',enabled=1,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+      ).run(projectId, value.adminId);
+      const config = ProjectConfigSchema.parse({
+        schemaVersion: 1,
+        projectId,
+        projectName: value.projectName,
+        description: value.description,
+        publicServerUrl: value.publicServerUrl,
+        configRevision: 1,
+        scopeProfile: "workspace-and-sessions-v1",
+        sync: value.sync
+      });
+      this.hub.db.prepare("INSERT INTO project_settings VALUES (1,?,?,?)").run(JSON.stringify(config), value.operationId, fingerprint);
+      return config;
+    });
+  }
+  login(id) {
+    const { projectId } = this.config();
+    const row = this.hub.db.prepare("SELECT 1 FROM members WHERE workspace_id=? AND member_id=? AND enabled=1").get(projectId, id);
+    if (!row)
+      throw new HubError(401, "UNKNOWN_MEMBER", "Member ID does not exist or has been disabled.");
+    const token = randomBytes2(32).toString("hex");
+    this.hub.db.prepare("DELETE FROM web_sessions WHERE expires_at<=?").run(Date.now());
+    this.hub.db.prepare("INSERT INTO web_sessions VALUES (?,?,?,?)").run(digest2(token), projectId, id, Date.now() + 7 * 864e5);
+    return { token, session: this.session(token) };
+  }
+  session(token) {
+    const row = token && /^[a-f0-9]{64}$/.test(token) ? this.hub.db.prepare(
+      `SELECT s.workspace_id,s.member_id,m.display_name,m.role FROM web_sessions s JOIN members m USING(workspace_id,member_id) WHERE s.token_hash=? AND s.expires_at>? AND m.enabled=1`
+    ).get(digest2(token), Date.now()) : void 0;
+    if (!row)
+      throw new HubError(401, "LOGIN_REQUIRED", "Please sign in with an existing member ID.");
+    return {
+      workspaceId: String(row.workspace_id),
+      memberId: String(row.member_id),
+      displayName: String(row.display_name || row.member_id),
+      role: row.role
+    };
+  }
+  logout(token) {
+    if (token)
+      this.hub.db.prepare("DELETE FROM web_sessions WHERE token_hash=?").run(digest2(token));
+  }
+  admin(identity) {
+    if (identity.role !== "admin")
+      throw new HubError(403, "ADMIN_REQUIRED", "This action requires an administrator.");
+  }
+  updateConfig(identity, input) {
+    this.admin(identity);
+    const value = ConfigUpdateSchema.parse(input);
+    return transaction(this.hub.db, () => {
+      const current = this.config(identity);
+      if (current.configRevision !== value.expectedRevision)
+        throw new HubError(409, "STALE_CONFIG", "Project settings changed; reload before saving.");
+      const { expectedRevision: _, ...fields } = value;
+      const next = { ...current, ...fields };
+      if (JSON.stringify(next) !== JSON.stringify(current)) next.configRevision++;
+      this.hub.db.prepare("UPDATE project_settings SET config_json=? WHERE id=1").run(JSON.stringify(next));
+      return next;
+    });
+  }
+  members(identity) {
+    return this.hub.db.prepare(
+      `SELECT m.*, (SELECT MAX(created_at) FROM file_revisions f WHERE f.workspace_id=m.workspace_id AND f.owner=m.member_id) last_published FROM members m WHERE workspace_id=? ORDER BY member_id`
+    ).all(identity.workspaceId).map(
+      (row) => MemberSchema.parse({
+        id: row.member_id,
+        displayName: row.display_name || row.member_id,
+        role: row.role,
+        enabled: Boolean(row.enabled),
+        revision: row.member_revision,
+        bound: Boolean(row.device_id),
+        fileRevision: row.file_revision,
+        lastPublishedAt: row.last_published ?? null
+      })
+    );
+  }
+  createMember(identity, input) {
+    this.admin(identity);
+    const value = MemberCreateSchema.parse(input);
+    const result = this.hub.db.prepare("INSERT OR IGNORE INTO members(workspace_id,member_id,display_name) VALUES (?,?,?)").run(identity.workspaceId, value.id, value.displayName);
+    if (!result.changes) throw new HubError(409, "MEMBER_EXISTS", "Member ID already exists.");
+    return this.members(identity).find((m) => m.id === value.id);
+  }
+  updateMember(identity, id, input) {
+    const value = MemberUpdateSchema.parse(input);
+    if (identity.role !== "admin" && (id !== identity.memberId || value.enabled !== void 0))
+      throw new HubError(403, "FORBIDDEN", "You can only edit your own display name.");
+    return transaction(this.hub.db, () => {
+      const row = this.hub.db.prepare("SELECT * FROM members WHERE workspace_id=? AND member_id=?").get(identity.workspaceId, id);
+      if (!row) throw new HubError(404, "MEMBER_NOT_FOUND", "Member not found.");
+      if (row.member_revision !== value.expectedRevision)
+        throw new HubError(409, "STALE_MEMBER", "Member changed; reload before saving.");
+      if (value.enabled === false && row.role === "admin" && row.enabled) {
+        const count = this.hub.db.prepare(
+          "SELECT COUNT(*) n FROM members WHERE workspace_id=? AND role='admin' AND enabled=1"
+        ).get(identity.workspaceId);
+        if (Number(count.n) <= 1)
+          throw new HubError(409, "LAST_ADMIN", "Keep at least one enabled administrator.");
+      }
+      this.hub.db.prepare(
+        "UPDATE members SET display_name=?,enabled=?,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+      ).run(
+        value.displayName ?? row.display_name,
+        value.enabled === void 0 ? row.enabled : Number(value.enabled),
+        identity.workspaceId,
+        id
+      );
+      if (value.enabled === false) this.clearAccess(identity.workspaceId, id);
+      return this.members(identity).find((m) => m.id === id);
+    });
+  }
+  clearAccess(workspace, id) {
+    this.hub.db.prepare(
+      "UPDATE members SET token_hash=NULL,device_id=NULL WHERE workspace_id=? AND member_id=?"
+    ).run(workspace, id);
+    this.hub.db.prepare("DELETE FROM web_sessions WHERE workspace_id=? AND member_id=?").run(workspace, id);
+  }
+  resetDevice(identity, id) {
+    this.admin(identity);
+    const result = this.hub.db.prepare(
+      "UPDATE members SET token_hash=NULL,device_id=NULL,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+    ).run(identity.workspaceId, id);
+    if (!result.changes) throw new HubError(404, "MEMBER_NOT_FOUND", "Member not found.");
+    this.hub.db.prepare("DELETE FROM device_status WHERE workspace_id=? AND member_id=?").run(identity.workspaceId, id);
+    return { ok: true };
+  }
+};
+
+// apps/server/web-auth.ts
+function cookieToken(request) {
+  return request.headers.cookie?.split(";").map((p) => p.trim()).find((p) => p.startsWith("teammy_session="))?.slice("teammy_session=".length);
+}
+function webMutation(request) {
+  if (request.headers["x-teammy-web"] !== "1")
+    throw new HubError(403, "WEB_REQUEST_REQUIRED", "Missing Web request header.");
+  const origin = request.headers.origin;
+  if (origin) {
+    let host;
+    try {
+      host = new URL(origin).host;
+    } catch {
+      throw new HubError(403, "ORIGIN_MISMATCH", "Invalid request origin.");
+    }
+    if (host !== request.headers.host)
+      throw new HubError(403, "ORIGIN_MISMATCH", "Request origin does not match this server.");
+  }
+}
+function authorizeRead(store, request) {
+  if (request.headers.authorization)
+    return store.authorize(
+      request.headers.authorization,
+      typeof request.headers["x-teammy-device"] === "string" ? request.headers["x-teammy-device"] : void 0
+    );
+  return new ProjectRepository(store).session(cookieToken(request));
+}
+
+// apps/server/control-routes.ts
+function registerControlRoutes(server, store) {
+  server.put("/api/v1/devices/self/status", async (request) => {
+    const device = request.headers["x-teammy-device"];
+    const identity = store.authorize(
+      request.headers.authorization,
+      typeof device === "string" ? device : void 0
+    );
+    new ProjectRepository(store).config(identity);
+    const status = DeviceStatusSchema.parse(request.body);
+    store.db.prepare(
+      "INSERT INTO device_status VALUES (?,?,?,?,?) ON CONFLICT(workspace_id,member_id) DO UPDATE SET device_id=excluded.device_id,seen_at=excluded.seen_at,status_json=excluded.status_json"
+    ).run(
+      identity.workspaceId,
+      identity.memberId,
+      identity.deviceId,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      JSON.stringify(status)
+    );
+    return { ok: true };
+  });
+  server.get("/api/v1/web/devices", async (request) => {
+    const identity = new ProjectRepository(store).session(cookieToken(request));
+    const devices = store.db.prepare(
+      "SELECT m.member_id,m.device_id,d.seen_at,d.status_json FROM members m LEFT JOIN device_status d ON d.workspace_id=m.workspace_id AND d.member_id=m.member_id AND d.device_id=m.device_id WHERE m.workspace_id=? ORDER BY m.member_id"
+    ).all(identity.workspaceId).map((row) => ({
+      memberId: String(row.member_id),
+      bound: Boolean(row.device_id),
+      lastSeenAt: row.seen_at === null ? null : String(row.seen_at),
+      status: row.status_json ? DeviceStatusSchema.parse(JSON.parse(String(row.status_json))) : null
+    }));
+    return { devices };
+  });
+}
+
+// apps/server/devices.ts
+var DeviceRepository = class {
+  constructor(hub) {
+    this.hub = hub;
+  }
+  hub;
+  enroll(input) {
+    const value = EnrollmentSchema.parse(input);
+    return transaction(this.hub.db, () => {
+      const { projectId } = new ProjectRepository(this.hub).config();
+      const member = this.hub.db.prepare("SELECT * FROM members WHERE workspace_id=? AND member_id=? AND enabled=1").get(projectId, value.memberId);
+      if (!member)
+        throw new HubError(401, "UNKNOWN_MEMBER", "Member ID does not exist or has been disabled.");
+      const fingerprint = digest2(JSON.stringify(value));
+      const prior = this.hub.db.prepare(
+        "SELECT fingerprint FROM device_enrollments WHERE workspace_id=? AND member_id=? AND operation_id=?"
+      ).get(projectId, value.memberId, value.operationId);
+      if (prior && prior.fingerprint !== fingerprint)
+        throw new HubError(
+          409,
+          "OPERATION_MISMATCH",
+          "Enrollment operation was reused with different content."
+        );
+      const tokenHash = digest2(value.credential);
+      if (prior) {
+        if (member.token_hash !== tokenHash || member.device_id !== value.deviceId)
+          throw new HubError(
+            409,
+            "ENROLLMENT_REVOKED",
+            "This enrollment was reset. Reconnect explicitly to create a new request."
+          );
+      } else {
+        if (member.device_id)
+          throw new HubError(
+            409,
+            "DEVICE_BOUND",
+            "This member already has a device. Reset it in the Web member settings before reconnecting."
+          );
+        this.hub.db.prepare(
+          "UPDATE members SET token_hash=?,device_id=?,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+        ).run(tokenHash, value.deviceId, projectId, value.memberId);
+        this.hub.db.prepare("INSERT INTO device_enrollments VALUES (?,?,?,?)").run(projectId, value.memberId, value.operationId, fingerprint);
+      }
+      return { workspaceId: projectId, memberId: value.memberId, deviceId: value.deviceId };
+    });
+  }
+};
+
+// apps/server/project-routes.ts
+import { z as z6 } from "zod";
+function registerProjectRoutes(server, store) {
+  const project = new ProjectRepository(store);
+  server.post(
+    "/api/v1/devices/enroll",
+    async (request) => new DeviceRepository(store).enroll(EnrollmentSchema.parse(request.body))
+  );
+  server.get("/api/v1/setup", async () => project.status());
+  server.post(
+    "/api/v1/setup",
+    { onRequest: async (request) => webMutation(request) },
+    async (request) => project.setup(SetupSchema.parse(request.body))
+  );
+  server.post(
+    "/api/v1/web/session",
+    { onRequest: async (request) => webMutation(request) },
+    async (request, reply) => {
+      const { id } = z6.object({ id: NameSchema }).strict().parse(request.body);
+      const { token, session } = project.login(id);
+      const secure = request.protocol === "https" || request.headers.origin?.startsWith("https://");
+      reply.header(
+        "set-cookie",
+        `teammy_session=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=604800${secure ? "; Secure" : ""}`
+      );
+      return session;
+    }
+  );
+  server.get("/api/v1/web/session", async (request) => project.session(cookieToken(request)));
+  server.delete("/api/v1/web/session", async (request, reply) => {
+    webMutation(request);
+    project.logout(cookieToken(request));
+    reply.header("set-cookie", "teammy_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0");
+    return { ok: true };
+  });
+  server.get("/api/v1/project/config", async (request, reply) => {
+    const config = project.config(authorizeRead(store, request));
+    const etag = `"project-${config.configRevision}"`;
+    reply.header("cache-control", "private, no-cache").header("etag", etag);
+    if (request.headers["if-none-match"] === etag) return reply.code(304).send();
+    return config;
+  });
+  server.patch("/api/v1/project/config", async (request) => {
+    webMutation(request);
+    return project.updateConfig(
+      project.session(cookieToken(request)),
+      ConfigUpdateSchema.parse(request.body)
+    );
+  });
+  server.get("/api/v1/web/members", async (request) => ({
+    members: project.members(project.session(cookieToken(request)))
+  }));
+  server.post("/api/v1/web/members", async (request) => {
+    webMutation(request);
+    return project.createMember(
+      project.session(cookieToken(request)),
+      MemberCreateSchema.parse(request.body)
+    );
+  });
+  server.patch("/api/v1/web/members/:id", async (request) => {
+    webMutation(request);
+    const { id } = z6.object({ id: NameSchema }).parse(request.params);
+    return project.updateMember(
+      project.session(cookieToken(request)),
+      id,
+      MemberUpdateSchema.parse(request.body)
+    );
+  });
+  server.post("/api/v1/web/members/:id/device-reset", async (request) => {
+    webMutation(request);
+    const { id } = z6.object({ id: NameSchema }).parse(request.params);
+    return project.resetDevice(project.session(cookieToken(request)), id);
+  });
+}
+
+// apps/server/session-routes.ts
+import { z as z8 } from "zod";
+
+// packages/protocol/sessions.ts
+import { createHash as createHash3 } from "node:crypto";
+import { z as z7 } from "zod";
+var AgentSchema = z7.enum(["claude-code", "codex", "cursor", "pi", "dsh"]);
+var SessionSnapshotSchema = z7.object({
+  formatVersion: z7.literal(1),
+  adapterVersion: z7.literal(1),
+  agent: AgentSchema,
+  nativeId: z7.string().min(1).max(512),
+  cwd: z7.string().min(1).max(4096),
+  messages: z7.array(
+    z7.object({
+      id: z7.string().min(1).max(1024),
+      role: z7.enum(["user", "assistant"]),
+      text: z7.string().min(1).max(2 * 1024 * 1024),
+      source: z7.string().min(1).max(1024)
+    }).strict()
+  ).max(5e4)
+}).strict().refine(
+  (s) => new Set(s.messages.map((m) => m.id)).size === s.messages.length,
+  "Duplicate message IDs."
+);
+function sessionKey(agent, nativeId) {
+  return createHash3("sha256").update(JSON.stringify([agent, nativeId])).digest("hex");
+}
+var SessionCommitSchema = z7.object({
+  operationId: z7.uuid(),
+  sessionKey: HashSchema,
+  parentRevision: RevisionSchema,
+  blob: BlobRefSchema
+}).strict();
+var SessionInfoSchema = z7.object({
+  owner: NameSchema,
+  sessionKey: HashSchema,
+  agent: AgentSchema,
+  nativeId: z7.string(),
+  cwd: z7.string(),
+  title: z7.string(),
+  revision: RevisionSchema,
+  updatedAt: z7.string(),
+  messageCount: z7.number().int().nonnegative(),
+  blob: BlobRefSchema
+});
+var SessionListSchema = z7.object({
+  sessions: z7.array(SessionInfoSchema),
+  nextCursor: RevisionSchema.nullable()
+});
+var SessionSearchSchema = z7.object({
+  matches: z7.array(
+    z7.object({
+      owner: NameSchema,
+      sessionKey: HashSchema,
+      revision: RevisionSchema,
+      messageId: z7.string(),
+      role: z7.enum(["user", "assistant"]),
+      snippet: z7.string()
+    })
+  ),
+  nextCursor: RevisionSchema.nullable()
+});
+
+// apps/server/sessions.ts
+import { createHash as createHash6 } from "node:crypto";
+
+// apps/server/files.ts
+import { createHash as createHash5 } from "node:crypto";
+import { join as join4 } from "node:path";
+
+// packages/storage/local-blob-store.ts
+import { createHash as createHash4, randomUUID } from "node:crypto";
+import { link, mkdir, open, readFile, unlink } from "node:fs/promises";
+import { dirname as dirname2, join as join3, resolve } from "node:path";
+function hash(content) {
+  return createHash4("sha256").update(content).digest("hex");
+}
+function hasCode(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+var BlobIntegrityError = class extends Error {
+  constructor(sha256) {
+    super(`Stored content failed integrity verification: ${sha256}`);
+    this.sha256 = sha256;
+    this.name = "BlobIntegrityError";
+  }
+  sha256;
+};
+var LocalBlobStore = class {
+  root;
+  constructor(root) {
+    this.root = resolve(root);
+  }
+  async put(content) {
+    const bytes = Buffer.from(content);
+    const sha256 = hash(bytes);
+    const target = this.pathFor(sha256);
+    await mkdir(dirname2(target), { recursive: true, mode: 448 });
+    const temporary = `${target}.${randomUUID()}.tmp`;
+    const file = await open(temporary, "wx", 384);
+    try {
+      try {
+        await file.writeFile(bytes);
+        await file.sync();
+      } finally {
+        await file.close();
+      }
+      try {
+        await link(temporary, target);
+      } catch (error) {
+        if (!hasCode(error, "EEXIST")) throw error;
+        await this.get(sha256);
+      }
+      if (process.platform !== "win32") {
+        let directory = dirname2(target);
+        for (; ; ) {
+          const handle = await open(directory, "r");
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
+          if (directory === dirname2(this.root)) break;
+          directory = dirname2(directory);
+        }
+      }
+    } finally {
+      await unlink(temporary);
+    }
+    return { sha256, size: bytes.byteLength };
+  }
+  async get(sha256) {
+    const target = this.pathFor(sha256);
+    let content;
+    try {
+      content = await readFile(target);
+    } catch (error) {
+      if (hasCode(error, "ENOENT")) return void 0;
+      throw error;
+    }
+    if (hash(content) !== sha256) throw new BlobIntegrityError(sha256);
+    return content;
+  }
+  pathFor(sha256) {
+    if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Invalid SHA-256 content identifier.");
+    return join3(this.root, "sha256", sha256.slice(0, 2), sha256);
+  }
+};
+
+// apps/server/files.ts
+var FileRepository = class {
+  constructor(hub) {
+    this.hub = hub;
+    this.blobs = new LocalBlobStore(join4(hub.directory, "blobs"));
+  }
+  hub;
+  blobs;
+  missing(identity, hashes) {
+    const query = this.hub.db.prepare(
+      "SELECT 1 FROM workspace_blobs WHERE workspace_id=? AND hash=?"
+    );
+    return hashes.filter((hash2) => !query.get(identity.workspaceId, hash2));
+  }
+  async upload(authorization, device, hash2, bytes) {
+    this.hub.authorize(authorization, device);
+    if (createHash5("sha256").update(bytes).digest("hex") !== HashSchema.parse(hash2))
+      throw new HubError(400, "HASH_MISMATCH", "Content does not match its SHA-256.");
+    const ref = await this.blobs.put(bytes);
+    transaction(this.hub.db, () => {
+      const identity = this.hub.authorize(authorization, device);
+      this.hub.db.prepare("INSERT OR IGNORE INTO workspace_blobs(workspace_id, hash, size) VALUES (?, ?, ?)").run(identity.workspaceId, ref.sha256, ref.size);
+    });
+    return ref;
+  }
+  async download(identity, hash2) {
+    if (this.missing(identity, [hash2]).length)
+      throw new HubError(404, "BLOB_NOT_FOUND", "Content is not available in this workspace.");
+    const bytes = await this.blobs.get(hash2);
+    if (!bytes) throw new HubError(500, "BLOB_MISSING", "Stored content is unavailable.");
+    return bytes;
+  }
+  head(identity, owner) {
+    const row = this.hub.db.prepare("SELECT file_revision FROM members WHERE workspace_id=? AND member_id=?").get(identity.workspaceId, owner);
+    if (!row) throw new HubError(404, "MEMBER_NOT_FOUND", "Member is not part of this workspace.");
+    return Number(row.file_revision);
+  }
+  commit(authorization, device, input) {
+    const batch = FileCommitSchema.parse(input);
+    const changes = [...batch.changes].sort(
+      (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0
+    );
+    const fingerprint = createHash5("sha256").update(JSON.stringify({ parentRevision: batch.parentRevision, changes })).digest("hex");
+    return transaction(this.hub.db, () => {
+      const identity = this.hub.authorize(authorization, device);
+      const { workspaceId: workspace, memberId: owner } = identity;
+      const prior = this.hub.db.prepare(
+        "SELECT fingerprint, revision FROM file_operations WHERE workspace_id=? AND owner=? AND operation_id=?"
+      ).get(workspace, owner, batch.operationId);
+      if (prior) {
+        if (prior.fingerprint !== fingerprint)
+          throw new HubError(
+            409,
+            "OPERATION_MISMATCH",
+            "Operation ID was already used with different content."
+          );
+        return { operationId: batch.operationId, revision: Number(prior.revision) };
+      }
+      const head = this.head(identity, owner);
+      if (head !== batch.parentRevision)
+        throw new HubError(
+          409,
+          "STALE_REVISION",
+          "Publication must be based on the latest confirmed directory revision."
+        );
+      const current = new Map(
+        this.hub.db.prepare("SELECT path, hash, size FROM current_files WHERE workspace_id=? AND owner=?").all(workspace, owner).map((row) => [String(row.path), { hash: String(row.hash), size: Number(row.size) }])
+      );
+      const effective = [];
+      for (const change of changes) {
+        const previous = current.get(change.path);
+        if (change.kind === "delete") {
+          if (previous) {
+            current.delete(change.path);
+            effective.push(change);
+          }
+        } else {
+          const blob = this.hub.db.prepare("SELECT size FROM workspace_blobs WHERE workspace_id=? AND hash=?").get(workspace, change.sha256);
+          if (!blob || Number(blob.size) !== change.size)
+            throw new HubError(
+              409,
+              "BLOB_REQUIRED",
+              "Upload all referenced content before publishing."
+            );
+          current.set(change.path, { hash: change.sha256, size: change.size });
+          if (!previous || previous.hash !== change.sha256) effective.push(change);
+        }
+      }
+      const keys = /* @__PURE__ */ new Set();
+      for (const path of current.keys()) {
+        const key = path.toLowerCase();
+        if (keys.has(key))
+          throw new HubError(
+            409,
+            "PATH_COLLISION",
+            "Paths must be distinct on case-insensitive filesystems."
+          );
+        keys.add(key);
+      }
+      for (const key of keys) {
+        const parts = key.split("/");
+        for (let length = 1; length < parts.length; length++) {
+          if (keys.has(parts.slice(0, length).join("/")))
+            throw new HubError(409, "PATH_COLLISION", "A file cannot also be a parent directory.");
+        }
+      }
+      const revision = effective.length ? head + 1 : head;
+      if (effective.length) {
+        for (const change of effective)
+          if (change.kind === "delete")
+            this.hub.db.prepare("DELETE FROM current_files WHERE workspace_id=? AND owner=? AND path=?").run(workspace, owner, change.path);
+        for (const change of effective) {
+          if (change.kind === "upsert")
+            this.hub.db.prepare(
+              `INSERT INTO current_files VALUES (?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT(workspace_id, owner, path) DO UPDATE SET hash=excluded.hash, size=excluded.size, revision=excluded.revision`
+            ).run(
+              workspace,
+              owner,
+              change.path,
+              change.path.toLowerCase(),
+              change.sha256,
+              change.size,
+              revision
+            );
+          this.hub.db.prepare("INSERT INTO file_events VALUES (?, ?, ?, ?, ?, ?)").run(
+            workspace,
+            owner,
+            change.path,
+            revision,
+            change.kind === "upsert" ? change.sha256 : null,
+            change.kind === "upsert" ? change.size : null
+          );
+        }
+        this.hub.db.prepare("INSERT INTO file_revisions VALUES (?, ?, ?, ?, ?, ?)").run(
+          workspace,
+          owner,
+          revision,
+          batch.operationId,
+          (/* @__PURE__ */ new Date()).toISOString(),
+          JSON.stringify(effective)
+        );
+        this.hub.db.prepare("UPDATE members SET file_revision=? WHERE workspace_id=? AND member_id=?").run(revision, workspace, owner);
+      }
+      this.hub.db.prepare("INSERT INTO file_operations VALUES (?, ?, ?, ?, ?)").run(workspace, owner, batch.operationId, fingerprint, revision);
+      return { operationId: batch.operationId, revision };
+    });
+  }
+  manifest(identity, owner, revision, after = "", limit = 200) {
+    const head = this.head(identity, owner);
+    const target = revision ?? head;
+    if (target > head)
+      throw new HubError(400, "INVALID_REVISION", "Requested revision has not been published.");
+    const rows = this.hub.db.prepare(
+      `SELECT e.path, e.hash, e.size, e.revision FROM file_events e JOIN
+      (SELECT path, MAX(revision) revision FROM file_events WHERE workspace_id=? AND owner=? AND revision<=? GROUP BY path) latest
+      ON e.path=latest.path AND e.revision=latest.revision
+      WHERE e.workspace_id=? AND e.owner=? AND e.hash IS NOT NULL AND e.path>? ORDER BY e.path LIMIT ?`
+    ).all(identity.workspaceId, owner, target, identity.workspaceId, owner, after, limit + 1);
+    const files = rows.slice(0, limit).map(
+      (row) => FileEntrySchema.parse({
+        path: row.path,
+        sha256: row.hash,
+        size: row.size,
+        revision: row.revision
+      })
+    );
+    return { revision: target, files, nextCursor: rows.length > limit ? files.at(-1).path : null };
+  }
+  changes(identity, owner, after, limit = 100) {
+    const headRevision = this.head(identity, owner);
+    if (after > headRevision)
+      throw new HubError(400, "INVALID_REVISION", "Local revision is ahead of the server.");
+    const revisions = this.hub.db.prepare(
+      "SELECT revision, operation_id, created_at, changes_json FROM file_revisions WHERE workspace_id=? AND owner=? AND revision>? AND revision<=? ORDER BY revision LIMIT ?"
+    ).all(identity.workspaceId, owner, after, headRevision, limit).map((row) => ({
+      revision: Number(row.revision),
+      operationId: String(row.operation_id),
+      createdAt: String(row.created_at),
+      changes: JSON.parse(String(row.changes_json))
+    }));
+    return { headRevision, revisions };
+  }
+};
+
+// apps/server/sessions.ts
+var SessionRepository = class {
+  constructor(hub) {
+    this.hub = hub;
+  }
+  hub;
+  async commit(authorization, device, input) {
+    const request = SessionCommitSchema.parse(input);
+    const identity = this.hub.authorize(authorization, device);
+    const bytes = await new FileRepository(this.hub).download(identity, request.blob.sha256);
+    if (bytes.byteLength !== request.blob.size)
+      throw new HubError(400, "SIZE_MISMATCH", "Snapshot size mismatch.");
+    let snapshot;
+    try {
+      snapshot = SessionSnapshotSchema.parse(
+        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes))
+      );
+    } catch {
+      throw new HubError(400, "INVALID_SNAPSHOT", "Invalid normalized session snapshot.");
+    }
+    if (sessionKey(snapshot.agent, snapshot.nativeId) !== request.sessionKey)
+      throw new HubError(400, "SESSION_MISMATCH", "Snapshot identity mismatch.");
+    const fingerprint = createHash6("sha256").update(JSON.stringify([request.sessionKey, request.parentRevision, request.blob])).digest("hex");
+    return transaction(this.hub.db, () => {
+      const { workspaceId: workspace, memberId: owner } = this.hub.authorize(authorization, device);
+      const db = this.hub.db;
+      const prior = db.prepare(
+        "SELECT fingerprint, revision FROM session_operations WHERE workspace_id=? AND owner=? AND operation_id=?"
+      ).get(workspace, owner, request.operationId);
+      if (prior) {
+        if (prior.fingerprint !== fingerprint)
+          throw new HubError(
+            409,
+            "OPERATION_MISMATCH",
+            "Operation ID already used with different content."
+          );
+        return { operationId: request.operationId, revision: Number(prior.revision) };
+      }
+      const current = db.prepare(
+        "SELECT revision, hash FROM sessions WHERE workspace_id=? AND owner=? AND session_key=?"
+      ).get(workspace, owner, request.sessionKey);
+      const head = Number(current?.revision ?? 0);
+      if (head !== request.parentRevision)
+        throw new HubError(
+          409,
+          "STALE_REVISION",
+          "Session changed on the server; inspect the current revision before retrying."
+        );
+      const revision = current?.hash === request.blob.sha256 ? head : head + 1;
+      if (revision !== head) {
+        const info = {
+          owner,
+          sessionKey: request.sessionKey,
+          agent: snapshot.agent,
+          nativeId: snapshot.nativeId,
+          cwd: snapshot.cwd,
+          title: (snapshot.messages.find((m) => m.role === "user")?.text ?? snapshot.nativeId).slice(0, 200),
+          revision,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          messageCount: snapshot.messages.length,
+          blob: request.blob
+        };
+        db.prepare(
+          `INSERT INTO sessions(workspace_id, owner, session_key, agent, native_id, cwd, title, revision, updated_at, message_count, hash, size)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(workspace_id, owner, session_key) DO UPDATE SET cwd=excluded.cwd, title=excluded.title, revision=excluded.revision, updated_at=excluded.updated_at, message_count=excluded.message_count, hash=excluded.hash, size=excluded.size`
+        ).run(
+          workspace,
+          owner,
+          request.sessionKey,
+          info.agent,
+          info.nativeId,
+          info.cwd,
+          info.title,
+          revision,
+          info.updatedAt,
+          info.messageCount,
+          info.blob.sha256,
+          info.blob.size
+        );
+        db.prepare("INSERT INTO session_revisions VALUES (?, ?, ?, ?, ?)").run(
+          workspace,
+          owner,
+          request.sessionKey,
+          revision,
+          JSON.stringify(info)
+        );
+        db.prepare(
+          "DELETE FROM session_fts WHERE rowid IN (SELECT id FROM session_messages WHERE workspace_id=? AND owner=? AND session_key=?)"
+        ).run(workspace, owner, request.sessionKey);
+        db.prepare(
+          "DELETE FROM session_messages WHERE workspace_id=? AND owner=? AND session_key=?"
+        ).run(workspace, owner, request.sessionKey);
+        const insert = db.prepare(
+          "INSERT INTO session_messages(workspace_id, owner, session_key, revision, message_id, role, body, search_text) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+        );
+        const index = db.prepare("INSERT INTO session_fts(rowid, body) VALUES (?, ?)");
+        for (const message of snapshot.messages) {
+          const lower = message.text.toLowerCase();
+          const result = insert.run(
+            workspace,
+            owner,
+            request.sessionKey,
+            revision,
+            message.id,
+            message.role,
+            message.text,
+            lower
+          );
+          index.run(result.lastInsertRowid, lower);
+        }
+      }
+      db.prepare("INSERT INTO session_operations VALUES (?, ?, ?, ?, ?)").run(
+        workspace,
+        owner,
+        request.operationId,
+        fingerprint,
+        revision
+      );
+      return { operationId: request.operationId, revision };
+    });
+  }
+  read(identity, owner, key, revision) {
+    const row = revision === void 0 ? this.hub.db.prepare(
+      `SELECT r.info_json FROM session_revisions r JOIN sessions s USING(workspace_id, owner, session_key, revision)
+          WHERE r.workspace_id=? AND r.owner=? AND r.session_key=?`
+    ).get(identity.workspaceId, owner, key) : this.hub.db.prepare(
+      "SELECT info_json FROM session_revisions WHERE workspace_id=? AND owner=? AND session_key=? AND revision=?"
+    ).get(identity.workspaceId, owner, key, revision);
+    if (!row)
+      throw new HubError(
+        404,
+        "SESSION_NOT_FOUND",
+        "Session revision is not available in this workspace."
+      );
+    return SessionInfoSchema.parse(JSON.parse(String(row.info_json)));
+  }
+  list(identity, after, limit) {
+    const rows = this.hub.db.prepare(
+      `SELECT s.id, r.info_json FROM sessions s JOIN session_revisions r USING(workspace_id, owner, session_key, revision)
+      WHERE s.workspace_id=? AND s.id>? ORDER BY s.id LIMIT ?`
+    ).all(identity.workspaceId, after, limit + 1);
+    return {
+      sessions: rows.slice(0, limit).map((row) => SessionInfoSchema.parse(JSON.parse(String(row.info_json)))),
+      nextCursor: rows.length > limit ? Number(rows[limit - 1].id) : null
+    };
+  }
+  search(identity, query, after, limit) {
+    const lower = query.toLowerCase();
+    const indexed = [...lower].length >= 3;
+    const rows = this.hub.db.prepare(
+      `SELECT * FROM session_messages WHERE workspace_id=? AND id>? AND instr(search_text, ?)>0
+      ${indexed ? "AND id IN (SELECT rowid FROM session_fts WHERE session_fts MATCH ?)" : ""} ORDER BY id LIMIT ?`
+    ).all(
+      identity.workspaceId,
+      after,
+      lower,
+      ...indexed ? [`"${lower.replaceAll('"', '""')}"`] : [],
+      limit + 1
+    );
+    return {
+      matches: rows.slice(0, limit).map((row) => {
+        const start = Math.max(0, String(row.search_text).indexOf(lower) - 100);
+        return {
+          owner: String(row.owner),
+          sessionKey: String(row.session_key),
+          revision: Number(row.revision),
+          messageId: String(row.message_id),
+          role: String(row.role),
+          snippet: String(row.body).slice(start, start + 500)
+        };
+      }),
+      nextCursor: rows.length > limit ? Number(rows[limit - 1].id) : null
+    };
+  }
+};
+
+// apps/server/session-routes.ts
+function registerSessionRoutes(server, store) {
+  const sessions = new SessionRepository(store);
+  const device = (request) => typeof request.headers["x-teammy-device"] === "string" ? request.headers["x-teammy-device"] : void 0;
+  const authorize = (request) => store.authorize(request.headers.authorization, device(request));
+  const guard = {
+    onRequest: async (request) => {
+      authorize(request);
+    }
+  };
+  const pagination = z8.object({
+    after: z8.coerce.number().pipe(RevisionSchema).default(0),
+    limit: z8.coerce.number().int().min(1).max(100).default(50)
+  });
+  server.post(
+    "/api/v1/sessions/commits",
+    guard,
+    (request) => sessions.commit(
+      request.headers.authorization,
+      device(request),
+      SessionCommitSchema.parse(request.body)
+    )
+  );
+  server.get("/api/v1/sessions", guard, async (request) => {
+    const q = pagination.parse(request.query);
+    return sessions.list(authorize(request), q.after, q.limit);
+  });
+  server.get("/api/v1/sessions/search", guard, async (request) => {
+    const q = pagination.extend({
+      q: z8.string().min(1).max(500).refine((s) => !s.includes("\0"))
+    }).parse(request.query);
+    return sessions.search(authorize(request), q.q, q.after, q.limit);
+  });
+  server.get("/api/v1/sessions/:owner/:key", guard, async (request) => {
+    const p = z8.object({ owner: NameSchema, key: HashSchema }).parse(request.params);
+    const q = z8.object({ revision: z8.coerce.number().pipe(RevisionSchema).optional() }).parse(request.query);
+    return sessions.read(authorize(request), p.owner, p.key, q.revision);
+  });
+}
+
+// apps/server/file-routes.ts
+import { z as z9 } from "zod";
+function registerFileRoutes(server, store) {
+  const files = new FileRepository(store);
+  const device = (request) => {
+    const value = request.headers["x-teammy-device"];
+    return typeof value === "string" ? value : void 0;
+  };
+  const authorize = (request) => store.authorize(request.headers.authorization, device(request));
+  const guard = {
+    onRequest: async (request) => {
+      authorize(request);
+    }
+  };
+  server.addContentTypeParser(
+    "application/octet-stream",
+    { parseAs: "buffer", bodyLimit: MAX_BLOB_BYTES },
+    (_request, body, done) => done(null, body)
+  );
+  server.post("/api/v1/blobs/check", guard, async (request) => ({
+    missing: files.missing(authorize(request), BlobCheckSchema.parse(request.body).hashes)
+  }));
+  server.put("/api/v1/blobs/:hash", { ...guard, bodyLimit: MAX_BLOB_BYTES }, async (request) => {
+    const { hash: hash2 } = z9.object({ hash: HashSchema }).parse(request.params);
+    if (!Buffer.isBuffer(request.body))
+      throw Object.assign(new Error("Expected binary content"), { statusCode: 400 });
+    return files.upload(request.headers.authorization, device(request), hash2, request.body);
+  });
+  server.get("/api/v1/blobs/:hash", async (request, reply) => {
+    const { hash: hash2 } = z9.object({ hash: HashSchema }).parse(request.params);
+    return reply.type("application/octet-stream").send(Buffer.from(await files.download(authorizeRead(store, request), hash2)));
+  });
+  server.post(
+    "/api/v1/files/commits",
+    guard,
+    async (request) => files.commit(
+      request.headers.authorization,
+      device(request),
+      FileCommitSchema.parse(request.body)
+    )
+  );
+  server.get("/api/v1/files/:owner/manifest", async (request) => {
+    const { owner } = z9.object({ owner: NameSchema }).parse(request.params);
+    const query = z9.object({
+      revision: z9.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
+      after: z9.string().max(1024).default(""),
+      limit: z9.coerce.number().int().min(1).max(500).default(200)
+    }).parse(request.query);
+    return files.manifest(
+      authorizeRead(store, request),
+      owner,
+      query.revision,
+      query.after,
+      query.limit
+    );
+  });
+  server.get("/api/v1/files/:owner/changes", async (request) => {
+    const { owner } = z9.object({ owner: NameSchema }).parse(request.params);
+    const query = z9.object({
+      after: z9.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).default(0),
+      limit: z9.coerce.number().int().min(1).max(100).default(100)
+    }).parse(request.query);
+    return files.changes(authorizeRead(store, request), owner, query.after, query.limit);
+  });
+}
+
+// apps/server/server.ts
+function buildServer(options) {
+  const server = Fastify({
+    logger: options.logger ? { redact: ["req.headers.authorization", "req.headers.cookie"] } : false,
+    requestIdHeader: false,
+    genReqId: () => randomUUID2(),
+    bodyLimit: 1024 * 1024,
+    requestTimeout: 3e4
+  });
+  const store = options.dataDir ? new HubStore(options.dataDir) : void 0;
+  if (store) server.addHook("onClose", async () => store.close());
+  server.addHook("onRequest", async (request, reply) => {
+    reply.header("x-request-id", request.id);
+    if (request.url.startsWith("/api/")) reply.header("cache-control", "no-store");
+  });
+  server.setNotFoundHandler((request, reply) => {
+    const body = {
+      error: { code: "NOT_FOUND", message: "Endpoint not found.", requestId: request.id }
+    };
+    return reply.code(404).send(body);
+  });
+  server.setErrorHandler((error, request, reply) => {
+    const candidate = error.statusCode;
+    const status = error instanceof ZodError ? 400 : candidate && candidate >= 400 && candidate < 500 ? candidate : 500;
+    if (status === 500) request.log.error({ err: error }, "Request failed");
+    const body = {
+      error: {
+        code: error instanceof HubError ? error.code : status === 500 ? "INTERNAL_ERROR" : "INVALID_REQUEST",
+        message: error instanceof HubError ? error.message : status === 500 ? "Internal server error." : "Invalid request.",
+        requestId: request.id
+      }
+    };
+    return reply.code(status).send(body);
+  });
+  server.get("/healthz", async () => ({ status: "ok" }));
+  server.get("/api/v1/server", async () => ({
+    name: "teammy",
+    version: options.version,
+    protocolVersion: PROTOCOL_VERSION,
+    capabilities: [
+      "health",
+      "server-info",
+      ...store ? [
+        "identity",
+        "blobs",
+        "file-revisions",
+        "session-revisions",
+        "session-search",
+        "project-config",
+        "web-identity",
+        "device-status"
+      ] : []
+    ]
+  }));
+  if (store) {
+    registerProjectRoutes(server, store);
+    registerControlRoutes(server, store);
+    registerFileRoutes(server, store);
+    registerSessionRoutes(server, store);
+    server.post(
+      "/api/v1/bind",
+      async (request) => store.bind(request.headers.authorization, BindRequestSchema.parse(request.body).deviceId)
+    );
+    server.get("/api/v1/members", async (request) => {
+      const device = request.headers["x-teammy-device"];
+      const identity = store.authorize(
+        request.headers.authorization,
+        typeof device === "string" ? device : void 0
+      );
+      return { members: store.members(identity) };
+    });
+  }
+  if (options.webDir) registerWeb(server, options.webDir);
+  return server;
+}
+
+// apps/server/main.ts
+import { homedir } from "node:os";
+import { join as join5, resolve as resolve2 } from "node:path";
+var help = `teammy-server \u2014 the Teammy collaboration hub
+
+Usage: teammy-server [--host HOST] [--port PORT]
+       teammy-server member <add|reset|revoke> --workspace ID --member ID [--data-dir DIR]
+
+Options:
+  --host HOST    Bind address (default: 127.0.0.1)
+  --port PORT    Listen port, 0 for an available port (default: 4317)
+  -h, --help     Show this help
+  -v, --version  Show the installed server version
+  --data-dir DIR  State directory (default: ~/.teammy/server)
+
+member add/reset prints a member token once to stdout. reset revokes the old token
+and releases the device binding; published content is preserved. revoke disables access.
+
+Endpoints:
+  GET /healthz         Process health
+  GET /api/v1/server   Server version and implemented capabilities
+
+Open the server URL to initialize the Web dashboard and preset member IDs.
+File synchronization and session collection/search are available; AI summaries are pending.
+`;
+async function runServerCli(args, version) {
+  try {
+    if (args[0] === "member") {
+      const action = args[1];
+      if (!action || !["add", "reset", "revoke"].includes(action))
+        throw new Error("Use member add, reset, or revoke.");
+      const { values: values2 } = parseArgs({
+        args: args.slice(2),
+        options: {
+          workspace: { type: "string" },
+          member: { type: "string" },
+          "data-dir": { type: "string", default: join5(homedir(), ".teammy", "server") }
+        }
+      });
+      if (!values2.workspace || !values2.member)
+        throw new Error("--workspace and --member are required.");
+      const store = new HubStore(resolve2(values2["data-dir"]));
+      try {
+        if (action === "revoke") store.revokeMember(values2.workspace, values2.member);
+        else
+          process.stdout.write(
+            `${store.issueMember(values2.workspace, values2.member, action === "reset")}
+`
+          );
+      } finally {
+        store.close();
+      }
+      return 0;
+    }
+    const { values } = parseArgs({
+      args,
+      options: {
+        help: { type: "boolean", short: "h" },
+        version: { type: "boolean", short: "v" },
+        host: { type: "string", default: "127.0.0.1" },
+        port: { type: "string", default: "4317" },
+        "data-dir": { type: "string", default: join5(homedir(), ".teammy", "server") }
+      }
+    });
+    if (values.help) {
+      process.stdout.write(help);
+      return 0;
+    }
+    if (values.version) {
+      process.stdout.write(`${version}
+`);
+      return 0;
+    }
+    const portText = values.port;
+    if (!/^\d+$/.test(portText) || Number(portText) > 65535) {
+      throw new Error("Port must be an integer between 0 and 65535.");
+    }
+    if (!values.host?.trim()) throw new Error("Host must not be empty.");
+    const server = buildServer({
+      version,
+      logger: true,
+      dataDir: resolve2(values["data-dir"]),
+      webDir: fileURLToPath(new URL("./web/", import.meta.url))
+    });
+    try {
+      await server.listen({ host: values.host, port: Number(portText) });
+    } catch (error) {
+      await server.close();
+      throw error;
+    }
+    const shutdown = () => {
+      process.off("SIGINT", shutdown);
+      process.off("SIGTERM", shutdown);
+      void server.close().catch((error) => {
+        server.log.error({ err: error }, "Server shutdown failed");
+        process.exitCode = 1;
+      });
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+    return 0;
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : "Unable to start server."}
+`);
+    return 1;
+  }
+}
+export {
+  runServerCli
+};