@teammy/server 0.0.5 → 0.0.6

package/dist/main.js

@@ -4,6 +4,8 @@ import { setTimeout as delay } from "node:timers/promises";
 // apps/server/store.ts
 import { createHash, randomBytes } from "node:crypto";
 import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // packages/state/sqlite.ts
 import { chmodSync, mkdirSync } from "node:fs";
@@ -20,13 +22,15 @@ function transaction(db, action) {
     throw error;
   }
 }
-function openDatabase(path, migrations2) {
+function openDatabase(path, migrations2, busyTimeoutMs = 5e3) {
+  if (!Number.isSafeInteger(busyTimeoutMs) || busyTimeoutMs < 0)
+    throw new Error("Invalid SQLite busy timeout.");
   mkdirSync(dirname(path), { recursive: true, mode: 448 });
   const db = new DatabaseSync(path);
   try {
     chmodSync(path, 384);
     db.exec(
-      "PRAGMA busy_timeout = 5000; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;"
+      `PRAGMA busy_timeout = ${busyTimeoutMs}; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;`
     );
     transaction(db, () => {
       const version = Number(db.prepare("PRAGMA user_version").get().user_version);
@@ -48,7 +52,7 @@ function openDatabase(path, migrations2) {
 import { z } from "zod";
 var NameSchema = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/);
 var DeviceIdSchema = z.uuid();
-var BindRequestSchema = z.object({ deviceId: DeviceIdSchema }).strict();
+var BindRequestSchema = z.object({ deviceId: DeviceIdSchema, projectId: NameSchema.optional() }).strict();
 var BindingSchema = z.object({
   workspaceId: NameSchema,
   memberId: NameSchema,
@@ -97,6 +101,7 @@ var sessionMigration = String.raw`
   CREATE INDEX session_message_lookup ON session_messages(workspace_id, owner, session_key);
   CREATE VIRTUAL TABLE session_fts USING fts5(body, tokenize='trigram');
 `;
+var sessionOwnerIndexMigration = `CREATE INDEX session_owner_listing ON sessions(workspace_id,owner,id);`;
 
 // apps/server/control-schema.ts
 var controlMigration = String.raw`
@@ -118,6 +123,45 @@ var projectMigration = String.raw`
   CREATE TABLE project_settings(id INTEGER PRIMARY KEY CHECK(id=1), config_json TEXT NOT NULL, setup_operation TEXT NOT NULL, setup_fingerprint TEXT NOT NULL);
   CREATE TABLE web_sessions(token_hash TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, member_id TEXT NOT NULL, expires_at INTEGER NOT NULL);
 `;
+var multiProjectMigration = String.raw`
+  DROP TABLE project_settings;
+  DROP TABLE web_sessions;
+  ALTER TABLE members DROP COLUMN display_name;
+  CREATE TABLE users (
+    id TEXT PRIMARY KEY, display_name TEXT NOT NULL DEFAULT '',
+    site_role TEXT NOT NULL DEFAULT 'member', enabled INTEGER NOT NULL DEFAULT 1,
+    revision INTEGER NOT NULL DEFAULT 1
+  );
+  CREATE TABLE projects (
+    id TEXT PRIMARY KEY, config_json TEXT NOT NULL,
+    operation_id TEXT NOT NULL UNIQUE, fingerprint TEXT NOT NULL
+  );
+  CREATE TABLE site_settings (
+    id INTEGER PRIMARY KEY CHECK(id=1), config_json TEXT NOT NULL,
+    setup_operation TEXT NOT NULL, setup_fingerprint TEXT NOT NULL
+  );
+  CREATE TABLE web_sessions (
+    token_hash TEXT PRIMARY KEY, member_id TEXT NOT NULL REFERENCES users(id), expires_at INTEGER NOT NULL
+  );
+  DROP TABLE ai_profiles;
+  CREATE TABLE ai_profiles (
+    id TEXT PRIMARY KEY, revision INTEGER NOT NULL, config_json TEXT NOT NULL, secret TEXT
+  );
+`;
+var sitePolicyMigration = `
+UPDATE site_settings SET config_json=json_set(config_json,'$.sync',json(COALESCE(
+ (SELECT json_extract(config_json,'$.sync') FROM projects ORDER BY rowid LIMIT 1),
+ '{"checkIntervalSeconds":60,"fileSettleSeconds":60}'
+)));
+UPDATE projects SET config_json=json_set(config_json,
+ '$.sync',json((SELECT json_extract(config_json,'$.sync') FROM site_settings WHERE id=1)),
+ '$.configRevision',json_extract(config_json,'$.configRevision')+1)
+WHERE json_extract(config_json,'$.sync') != (SELECT json_extract(config_json,'$.sync') FROM site_settings WHERE id=1);
+`;
+var equalMembershipMigration = `
+ALTER TABLE members DROP COLUMN role;
+ALTER TABLE members ADD COLUMN display_name TEXT NOT NULL DEFAULT '';
+`;
 
 // apps/server/file-schema.ts
 var fileMigration = String.raw`
@@ -168,6 +212,11 @@ CREATE TABLE ai_attempts(job_id TEXT NOT NULL REFERENCES ai_jobs(id),number INTE
 CREATE TABLE ai_events(seq INTEGER PRIMARY KEY AUTOINCREMENT,job_id TEXT NOT NULL REFERENCES ai_jobs(id),attempt INTEGER NOT NULL,kind TEXT NOT NULL,message TEXT NOT NULL,created_at TEXT NOT NULL);
 CREATE INDEX ai_events_job ON ai_events(job_id,seq);
 `;
+var aiDefaultsMigration = `
+CREATE TABLE ai_defaults (
+ scope TEXT PRIMARY KEY, profile_id TEXT REFERENCES ai_profiles(id), revision INTEGER NOT NULL
+);
+`;
 
 // apps/server/store.ts
 function digest(token) {
@@ -189,12 +238,30 @@ var migrations = [
   deviceMigration,
   controlMigration,
   aiConfigMigration,
-  aiJobsMigration
+  aiJobsMigration,
+  multiProjectMigration,
+  aiDefaultsMigration,
+  sitePolicyMigration,
+  sessionOwnerIndexMigration,
+  equalMembershipMigration
 ];
 var HubStore = class {
   constructor(directory) {
     this.directory = directory;
-    this.db = openDatabase(join(directory, "hub.sqlite3"), migrations);
+    const path = join(directory, "hub.sqlite3");
+    if (existsSync(path)) {
+      const existing = new DatabaseSync2(path, { readOnly: true });
+      try {
+        const version = Number(existing.prepare("PRAGMA user_version").get().user_version);
+        if (version > 0 && version < 9)
+          throw new Error(
+            "Single-project data is not supported by this release. Start with a new --data-dir; existing data has been preserved."
+          );
+      } finally {
+        existing.close();
+      }
+    }
+    this.db = openDatabase(path, migrations);
   }
   directory;
   db;
@@ -206,6 +273,7 @@ var HubStore = class {
     NameSchema.parse(memberId);
     const token = `tmy_${randomBytes(32).toString("hex")}`;
     transaction(this.db, () => {
+      this.db.prepare("INSERT OR IGNORE INTO users(id) VALUES (?)").run(memberId);
       const exists = this.db.prepare("SELECT 1 FROM members WHERE workspace_id=? AND member_id=?").get(workspaceId, memberId);
       if (exists && !reset)
         throw new HubError(
@@ -226,12 +294,12 @@ var HubStore = class {
       "UPDATE members SET token_hash=NULL, device_id=NULL, enabled=0, member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
     ).run(NameSchema.parse(workspaceId), NameSchema.parse(memberId));
     if (!result.changes) throw new HubError(404, "MEMBER_NOT_FOUND", "Member does not exist.");
-    this.db.prepare("DELETE FROM web_sessions WHERE workspace_id=? AND member_id=?").run(workspaceId, memberId);
+    this.db.prepare("DELETE FROM device_status WHERE workspace_id=? AND member_id=?").run(workspaceId, memberId);
   }
   identity(authorization) {
     const match = authorization?.match(/^Bearer (tmy_[a-f0-9]{64})$/);
     const row = match && this.db.prepare(
-      "SELECT workspace_id, member_id, device_id FROM members WHERE token_hash=? AND enabled=1"
+      "SELECT m.workspace_id,m.member_id,m.device_id FROM members m JOIN users u ON u.id=m.member_id WHERE m.token_hash=? AND m.enabled=1 AND u.enabled=1"
     ).get(digest(match[1]));
     if (!row) throw new HubError(401, "UNAUTHORIZED", "A valid member credential is required.");
     return {
@@ -240,9 +308,11 @@ var HubStore = class {
       deviceId: row.device_id
     };
   }
-  bind(authorization, deviceId) {
+  bind(authorization, deviceId, projectId2) {
     return transaction(this.db, () => {
       const identity = this.identity(authorization);
+      if (projectId2 && projectId2 !== identity.workspaceId)
+        throw new HubError(403, "PROJECT_MISMATCH", "Token belongs to a different project.");
       if (identity.deviceId && identity.deviceId !== deviceId)
         throw new HubError(
           409,
@@ -269,7 +339,7 @@ var HubStore = class {
 };
 
 // apps/server/ai/jobs.ts
-import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID2 } from "node:crypto";
 
 // packages/protocol/ai.ts
 import { z as z4 } from "zod";
@@ -368,41 +438,83 @@ var SetupSchema = z3.object({
   publicServerUrl: ServerUrlSchema,
   adminId: NameSchema,
   members: z3.array(NameSchema).max(100).default([]),
-  existingWorkspaceId: NameSchema.optional(),
   sync: SyncPolicySchema.default(DEFAULT_POLICY)
 }).strict();
 var SetupStatusSchema = z3.object({
-  initialized: z3.boolean(),
-  existingWorkspaces: z3.array(NameSchema)
+  initialized: z3.boolean()
 });
 var ConfigUpdateSchema = ProjectConfigSchema.pick({
   projectName: true,
-  description: true,
-  publicServerUrl: true,
-  sync: true
-}).extend({ expectedRevision: RevisionSchema }).strict();
+  description: true
+}).extend({ expectedRevision: RevisionSchema.optional() }).strict();
 var MemberSchema = z3.object({
   id: NameSchema,
   displayName: z3.string().max(120),
-  role: z3.enum(["admin", "member"]),
   enabled: z3.boolean(),
+  accountEnabled: z3.boolean(),
   revision: RevisionSchema,
   bound: z3.boolean(),
   fileRevision: RevisionSchema,
   lastPublishedAt: z3.string().nullable()
 });
-var WebSessionSchema = z3.object({
-  workspaceId: NameSchema,
+var WebIdentitySchema = z3.object({
   memberId: NameSchema,
   displayName: z3.string(),
-  role: z3.enum(["admin", "member"])
+  siteRole: z3.enum(["admin", "member"])
+});
+var WebSessionSchema = WebIdentitySchema.extend({
+  workspaceId: NameSchema
 });
-var MemberCreateSchema = z3.object({ id: NameSchema, displayName: z3.string().trim().max(120).default("") }).strict();
+var MemberCreateSchema = z3.object({
+  id: NameSchema
+}).strict();
 var MemberUpdateSchema = z3.object({
   expectedRevision: RevisionSchema,
   displayName: z3.string().trim().max(120).optional(),
   enabled: z3.boolean().optional()
 }).strict();
+var ProjectCreateSchema = z3.object({
+  operationId: z3.uuid(),
+  projectName: z3.string().trim().min(1).max(120),
+  description: z3.string().max(2e3).default("")
+}).strict();
+var ProjectSummarySchema = z3.object({
+  projectId: NameSchema,
+  projectName: z3.string(),
+  description: z3.string()
+});
+var ProjectsSchema = z3.object({ projects: z3.array(ProjectSummarySchema) });
+var SiteConfigSchema = z3.object({
+  sync: SyncPolicySchema,
+  publicServerUrl: ServerUrlSchema,
+  revision: RevisionSchema
+});
+var SiteConfigUpdateSchema = z3.object({
+  publicServerUrl: ServerUrlSchema.optional(),
+  sync: SyncPolicySchema.optional(),
+  expectedRevision: RevisionSchema
+}).strict().refine(
+  (v) => v.publicServerUrl !== void 0 || v.sync !== void 0,
+  "Provide a setting to update."
+);
+var UserSchema = z3.object({
+  id: NameSchema,
+  displayName: z3.string(),
+  siteRole: z3.enum(["admin", "member"]),
+  enabled: z3.boolean(),
+  revision: RevisionSchema
+});
+var UserCreateSchema = z3.object({
+  id: NameSchema,
+  displayName: z3.string().trim().max(120).default(""),
+  siteRole: z3.enum(["admin", "member"]).default("member")
+}).strict();
+var UserUpdateSchema = z3.object({
+  expectedRevision: RevisionSchema,
+  displayName: z3.string().trim().max(120).optional(),
+  enabled: z3.boolean().optional(),
+  siteRole: z3.enum(["admin", "member"]).optional()
+}).strict();
 
 // packages/protocol/ai.ts
 var AiProfileSchema = z4.object({
@@ -428,6 +540,17 @@ var AiProfileUpdateSchema = z4.object({
   apiKey: z4.string().min(1).max(4096).nullable().optional()
 }).strict();
 var AiProfilesSchema = z4.object({ profiles: z4.array(AiPublicProfileSchema) });
+var AiDefaultUpdateSchema = z4.object({
+  expectedRevision: z4.number().int().nonnegative(),
+  profileId: NameSchema.nullable()
+}).strict();
+var AiDefaultSchema = z4.object({
+  revision: z4.number().int().nonnegative(),
+  profileId: NameSchema.nullable(),
+  effectiveProfileId: NameSchema.nullable(),
+  source: z4.enum(["site", "project", "none"]),
+  available: z4.boolean()
+});
 var AiProbeSchema = z4.object({ mode: z4.enum(["text", "tools", "json"]) }).strict();
 var AiProbeResultSchema = z4.object({
   ok: z4.literal(true),
@@ -444,7 +567,7 @@ var AiSelectionSchema = z4.object({
 }).strict().refine((s) => s.kind === "directory" || s.path !== "", "A file path is required.");
 var AiJobCreateSchema = z4.object({
   operationId: z4.uuid(),
-  profileId: NameSchema,
+  profileId: NameSchema.optional(),
   workflow: z4.enum(["file-summary", "directory-analysis"]),
   selection: AiSelectionSchema,
   question: z4.string().trim().max(2e3).default("")
@@ -521,14 +644,357 @@ var AiAttemptSchema = z4.object({
 });
 var AiJobDetailSchema = z4.object({ job: AiJobSchema, attempts: z4.array(AiAttemptSchema) });
 
+// apps/server/project.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+
+// apps/server/site.ts
+import { randomBytes as randomBytes2, createHash as createHash2 } from "node:crypto";
+var digest2 = (value) => createHash2("sha256").update(value).digest("hex");
+function requireSiteAdmin(identity) {
+  if (identity.siteRole !== "admin")
+    throw new HubError(403, "SITE_ADMIN_REQUIRED", "Site administrator access required.");
+}
+var SiteRepository = class {
+  constructor(hub) {
+    this.hub = hub;
+  }
+  hub;
+  status() {
+    return {
+      initialized: Boolean(this.hub.db.prepare("SELECT 1 FROM site_settings").get())
+    };
+  }
+  config() {
+    const row = this.hub.db.prepare("SELECT config_json FROM site_settings WHERE id=1").get();
+    if (!row) throw new HubError(409, "SETUP_REQUIRED", "Initialize the server first.");
+    return SiteConfigSchema.parse(JSON.parse(String(row.config_json)));
+  }
+  updateConfig(identity, input) {
+    requireSiteAdmin(identity);
+    const value = SiteConfigUpdateSchema.parse(input);
+    return transaction(this.hub.db, () => {
+      const current = this.config();
+      if (current.revision !== value.expectedRevision)
+        throw new HubError(409, "STALE_CONFIG", "Settings changed; reload before saving.");
+      const next = {
+        ...current,
+        publicServerUrl: value.publicServerUrl ?? current.publicServerUrl,
+        sync: value.sync ?? current.sync
+      };
+      if (JSON.stringify(next) === JSON.stringify(current)) return current;
+      next.revision++;
+      this.hub.db.prepare("UPDATE site_settings SET config_json=? WHERE id=1").run(JSON.stringify(next));
+      for (const row of this.hub.db.prepare("SELECT id,config_json FROM projects").all()) {
+        const config = ProjectConfigSchema.parse(JSON.parse(String(row.config_json)));
+        config.publicServerUrl = next.publicServerUrl;
+        config.sync = next.sync;
+        config.configRevision++;
+        this.hub.db.prepare("UPDATE projects SET config_json=? WHERE id=?").run(JSON.stringify(config), row.id);
+      }
+      return next;
+    });
+  }
+  login(id) {
+    const row = this.hub.db.prepare("SELECT 1 FROM users WHERE id=? AND enabled=1").get(id);
+    if (!row)
+      throw new HubError(401, "UNKNOWN_MEMBER", "Member ID does not exist or has been disabled.");
+    const token = randomBytes2(32).toString("hex");
+    this.hub.db.prepare("DELETE FROM web_sessions WHERE expires_at<=?").run(Date.now());
+    this.hub.db.prepare("INSERT INTO web_sessions VALUES (?,?,?)").run(digest2(token), id, Date.now() + 7 * 864e5);
+    return { token, session: this.identity(token) };
+  }
+  identity(token) {
+    const row = token && /^[a-f0-9]{64}$/.test(token) ? this.hub.db.prepare(
+      `SELECT u.* FROM web_sessions s JOIN users u ON u.id=s.member_id WHERE s.token_hash=? AND s.expires_at>? AND u.enabled=1`
+    ).get(digest2(token), Date.now()) : void 0;
+    if (!row)
+      throw new HubError(401, "LOGIN_REQUIRED", "Please sign in with an existing member ID.");
+    return {
+      memberId: String(row.id),
+      displayName: String(row.display_name || row.id),
+      siteRole: row.site_role
+    };
+  }
+  logout(token) {
+    if (token)
+      this.hub.db.prepare("DELETE FROM web_sessions WHERE token_hash=?").run(digest2(token));
+  }
+  users(identity) {
+    requireSiteAdmin(identity);
+    return this.hub.db.prepare("SELECT * FROM users ORDER BY id").all().map(
+      (row) => UserSchema.parse({
+        id: row.id,
+        displayName: row.display_name || row.id,
+        siteRole: row.site_role,
+        enabled: Boolean(row.enabled),
+        revision: row.revision
+      })
+    );
+  }
+  createUser(identity, input) {
+    requireSiteAdmin(identity);
+    const value = UserCreateSchema.parse(input);
+    if (!this.hub.db.prepare("INSERT OR IGNORE INTO users(id,display_name,site_role) VALUES (?,?,?)").run(value.id, value.displayName, value.siteRole).changes)
+      throw new HubError(409, "USER_EXISTS", "User already exists.");
+    return this.users(identity).find((u) => u.id === value.id);
+  }
+  updateUser(identity, id, input) {
+    requireSiteAdmin(identity);
+    const value = UserUpdateSchema.parse(input);
+    return transaction(this.hub.db, () => {
+      const row = this.hub.db.prepare("SELECT * FROM users WHERE id=?").get(id);
+      if (!row) throw new HubError(404, "USER_NOT_FOUND", "User not found.");
+      if (row.revision !== value.expectedRevision)
+        throw new HubError(409, "STALE_MEMBER", "User changed; reload before saving.");
+      if ((value.enabled === false || value.siteRole === "member") && row.site_role === "admin" && row.enabled && Number(
+        this.hub.db.prepare("SELECT COUNT(*) n FROM users WHERE site_role='admin' AND enabled=1").get().n
+      ) <= 1)
+        throw new HubError(409, "LAST_ADMIN", "Keep at least one enabled site administrator.");
+      this.hub.db.prepare(
+        "UPDATE users SET display_name=?,enabled=?,site_role=?,revision=revision+1 WHERE id=?"
+      ).run(
+        value.displayName ?? row.display_name,
+        value.enabled === void 0 ? row.enabled : Number(value.enabled),
+        value.siteRole ?? row.site_role,
+        id
+      );
+      if (value.enabled === false) {
+        this.hub.db.prepare("DELETE FROM web_sessions WHERE member_id=?").run(id);
+        this.hub.db.prepare(
+          "UPDATE members SET token_hash=NULL,device_id=NULL,member_revision=member_revision+1 WHERE member_id=?"
+        ).run(id);
+        this.hub.db.prepare("DELETE FROM device_status WHERE member_id=?").run(id);
+      }
+      return this.users(identity).find((u) => u.id === id);
+    });
+  }
+  renameSelf(identity, displayName) {
+    this.hub.db.prepare("UPDATE users SET display_name=?,revision=revision+1 WHERE id=?").run(displayName, identity.memberId);
+    return { ...identity, displayName: displayName || identity.memberId };
+  }
+};
+
+// apps/server/project.ts
+var ProjectRepository = class {
+  constructor(hub) {
+    this.hub = hub;
+    this.site = new SiteRepository(hub);
+  }
+  hub;
+  site;
+  config(identity) {
+    const row = this.hub.db.prepare("SELECT config_json FROM projects WHERE id=?").get(identity.workspaceId);
+    if (!row) throw new HubError(404, "PROJECT_NOT_FOUND", "Project not found.");
+    return ProjectConfigSchema.parse(JSON.parse(String(row.config_json)));
+  }
+  insertProject(value, creator, url) {
+    const fingerprint = digest2(JSON.stringify([creator, value]));
+    const prior = this.hub.db.prepare("SELECT id,fingerprint FROM projects WHERE operation_id=?").get(value.operationId);
+    if (prior) {
+      if (prior.fingerprint !== fingerprint)
+        throw new HubError(
+          409,
+          "OPERATION_MISMATCH",
+          "Operation was reused with different content."
+        );
+      return this.config({ workspaceId: String(prior.id), memberId: creator });
+    }
+    const config = ProjectConfigSchema.parse({
+      schemaVersion: 1,
+      projectId: `proj-${randomBytes3(8).toString("hex")}`,
+      projectName: value.projectName,
+      description: value.description,
+      publicServerUrl: url,
+      configRevision: 1,
+      scopeProfile: "workspace-and-sessions-v1",
+      sync: this.site.config().sync
+    });
+    this.hub.db.prepare("INSERT INTO projects VALUES (?,?,?,?)").run(config.projectId, JSON.stringify(config), value.operationId, fingerprint);
+    this.hub.db.prepare("INSERT INTO members(workspace_id,member_id) VALUES (?,?)").run(config.projectId, creator);
+    return config;
+  }
+  setup(input) {
+    const value = SetupSchema.parse(input);
+    const fingerprint = digest2(JSON.stringify(value));
+    return transaction(this.hub.db, () => {
+      const prior = this.hub.db.prepare("SELECT setup_operation,setup_fingerprint FROM site_settings").get();
+      if (prior) {
+        if (prior.setup_operation === value.operationId && prior.setup_fingerprint === fingerprint) {
+          const row = this.hub.db.prepare("SELECT id FROM projects WHERE operation_id=?").get(value.operationId);
+          return this.config({ workspaceId: String(row.id), memberId: value.adminId });
+        }
+        throw new HubError(
+          409,
+          "ALREADY_INITIALIZED",
+          "Server initialization has already completed."
+        );
+      }
+      this.hub.db.prepare("INSERT INTO site_settings VALUES (1,?,?,?)").run(
+        JSON.stringify({ publicServerUrl: value.publicServerUrl, revision: 1, sync: value.sync }),
+        value.operationId,
+        fingerprint
+      );
+      for (const id of /* @__PURE__ */ new Set([value.adminId, ...value.members]))
+        this.hub.db.prepare("INSERT OR IGNORE INTO users(id) VALUES (?)").run(id);
+      this.hub.db.prepare("UPDATE users SET site_role='admin',enabled=1 WHERE id=?").run(value.adminId);
+      const config = this.insertProject(
+        ProjectCreateSchema.parse({
+          operationId: value.operationId,
+          projectName: value.projectName,
+          description: value.description
+        }),
+        value.adminId,
+        value.publicServerUrl
+      );
+      for (const id of new Set(value.members))
+        this.hub.db.prepare("INSERT OR IGNORE INTO members(workspace_id,member_id) VALUES (?,?)").run(config.projectId, id);
+      return config;
+    });
+  }
+  createProject(identity, input) {
+    requireSiteAdmin(identity);
+    const value = ProjectCreateSchema.parse(input);
+    return transaction(
+      this.hub.db,
+      () => this.insertProject(value, identity.memberId, this.site.config().publicServerUrl)
+    );
+  }
+  projects(identity) {
+    return this.hub.db.prepare(
+      `SELECT p.config_json FROM projects p JOIN members m ON m.workspace_id=p.id AND m.member_id=? WHERE m.enabled=1 ORDER BY p.rowid`
+    ).all(identity.memberId).map((row) => {
+      const config = ProjectConfigSchema.parse(JSON.parse(String(row.config_json)));
+      return {
+        projectId: config.projectId,
+        projectName: config.projectName,
+        description: config.description
+      };
+    });
+  }
+  session(token, workspaceId) {
+    const identity = this.site.identity(token);
+    NameSchema.parse(workspaceId);
+    const row = this.hub.db.prepare(
+      "SELECT m.enabled FROM projects p LEFT JOIN members m ON m.workspace_id=p.id AND m.member_id=? WHERE p.id=?"
+    ).get(identity.memberId, workspaceId);
+    if (!row?.enabled)
+      throw new HubError(404, "PROJECT_NOT_FOUND", "Project not found or access was removed.");
+    return {
+      ...identity,
+      workspaceId
+    };
+  }
+  requireMember(identity) {
+    if (!this.hub.db.prepare(
+      "SELECT 1 FROM members m JOIN users u ON u.id=m.member_id WHERE workspace_id=? AND member_id=? AND m.enabled=1 AND u.enabled=1"
+    ).get(identity.workspaceId, identity.memberId))
+      throw new HubError(404, "PROJECT_NOT_FOUND", "Project not found or access was removed.");
+  }
+  updateConfig(identity, input) {
+    this.requireMember(identity);
+    const value = ConfigUpdateSchema.parse(input);
+    return transaction(this.hub.db, () => {
+      const current = this.config(identity);
+      if (value.expectedRevision !== void 0 && current.configRevision !== value.expectedRevision)
+        throw new HubError(409, "STALE_CONFIG", "Project settings changed; reload before saving.");
+      const { expectedRevision: _, ...fields } = value;
+      const next = { ...current, ...fields };
+      if (JSON.stringify(next) !== JSON.stringify(current)) next.configRevision++;
+      this.hub.db.prepare("UPDATE projects SET config_json=? WHERE id=?").run(JSON.stringify(next), identity.workspaceId);
+      return next;
+    });
+  }
+  members(identity) {
+    return this.hub.db.prepare(
+      `SELECT m.*,COALESCE(NULLIF(m.display_name,''),NULLIF(u.display_name,''),m.member_id) member_name,u.enabled user_enabled,(SELECT MAX(created_at) FROM file_revisions f WHERE f.workspace_id=m.workspace_id AND f.owner=m.member_id) last_published FROM members m JOIN users u ON u.id=m.member_id WHERE m.workspace_id=? ORDER BY m.member_id`
+    ).all(identity.workspaceId).map(
+      (row) => MemberSchema.parse({
+        id: row.member_id,
+        displayName: row.member_name,
+        enabled: Boolean(row.enabled),
+        accountEnabled: Boolean(row.user_enabled),
+        revision: row.member_revision,
+        bound: Boolean(row.device_id),
+        fileRevision: row.file_revision,
+        lastPublishedAt: row.last_published ?? null
+      })
+    );
+  }
+  createMember(identity, input) {
+    this.requireMember(identity);
+    const value = MemberCreateSchema.parse(input);
+    return transaction(this.hub.db, () => {
+      if (!this.hub.db.prepare("SELECT 1 FROM users WHERE id=? AND enabled=1").get(value.id))
+        throw new HubError(
+          404,
+          "USER_NOT_FOUND",
+          "Ask a site administrator to create or enable this user first."
+        );
+      const result = this.hub.db.prepare(
+        "INSERT INTO members(workspace_id,member_id) VALUES (?,?) ON CONFLICT(workspace_id,member_id) DO UPDATE SET enabled=1,member_revision=member_revision+1 WHERE enabled=0"
+      ).run(identity.workspaceId, value.id);
+      if (!result.changes)
+        throw new HubError(409, "MEMBER_EXISTS", "Member already belongs to this project.");
+      return this.members(identity).find((m) => m.id === value.id);
+    });
+  }
+  updateMember(identity, id, input) {
+    const value = MemberUpdateSchema.parse(input);
+    this.requireMember(identity);
+    if (value.enabled !== void 0) requireSiteAdmin(identity);
+    return transaction(this.hub.db, () => {
+      const row = this.hub.db.prepare("SELECT * FROM members WHERE workspace_id=? AND member_id=?").get(identity.workspaceId, id);
+      if (!row) throw new HubError(404, "MEMBER_NOT_FOUND", "Member not found.");
+      if (row.member_revision !== value.expectedRevision)
+        throw new HubError(409, "STALE_MEMBER", "Member changed; reload before saving.");
+      this.hub.db.prepare(
+        "UPDATE members SET enabled=?,display_name=?,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+      ).run(
+        value.enabled === void 0 ? row.enabled : Number(value.enabled),
+        value.displayName ?? row.display_name,
+        identity.workspaceId,
+        id
+      );
+      if (value.enabled === false) this.clearAccess(identity.workspaceId, id);
+      return this.members(identity).find((m) => m.id === id);
+    });
+  }
+  leave(identity, workspaceId) {
+    return transaction(this.hub.db, () => {
+      const row = this.hub.db.prepare("SELECT 1 FROM members WHERE workspace_id=? AND member_id=?").get(workspaceId, identity.memberId);
+      if (!row) throw new HubError(404, "PROJECT_NOT_FOUND", "Project not found.");
+      this.hub.db.prepare(
+        "UPDATE members SET enabled=0,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=? AND enabled=1"
+      ).run(workspaceId, identity.memberId);
+      this.clearAccess(workspaceId, identity.memberId);
+      return { ok: true };
+    });
+  }
+  clearAccess(workspace, id) {
+    this.hub.db.prepare(
+      "UPDATE members SET token_hash=NULL,device_id=NULL WHERE workspace_id=? AND member_id=?"
+    ).run(workspace, id);
+    this.hub.db.prepare("DELETE FROM device_status WHERE workspace_id=? AND member_id=?").run(workspace, id);
+  }
+  resetDevice(identity, id) {
+    this.requireMember(identity);
+    requireSiteAdmin(identity);
+    if (!this.hub.db.prepare("SELECT 1 FROM members WHERE workspace_id=? AND member_id=?").get(identity.workspaceId, id))
+      throw new HubError(404, "MEMBER_NOT_FOUND", "Member not found.");
+    transaction(this.hub.db, () => {
+      this.clearAccess(identity.workspaceId, id);
+      this.hub.db.prepare(
+        "UPDATE members SET member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
+      ).run(identity.workspaceId, id);
+    });
+    return { ok: true };
+  }
+};
+
 // apps/server/ai/config.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4 } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
-function requireAiAdmin(session) {
-  if (session.role !== "admin")
-    throw new HubError(403, "ADMIN_REQUIRED", "Administrator access required.");
-}
 var AiConfig = class {
   constructor(hub) {
     this.hub = hub;
@@ -538,7 +1004,7 @@ var AiConfig = class {
     const path = join2(this.hub.directory, "ai-secret.key");
     if (create) {
       try {
-        writeFileSync(path, randomBytes2(32), { flag: "wx", mode: 384 });
+        writeFileSync(path, randomBytes4(32), { flag: "wx", mode: 384 });
       } catch (e) {
         if (e.code !== "EEXIST") throw e;
       }
@@ -547,75 +1013,136 @@ var AiConfig = class {
     if (key.length !== 32) throw new Error("Invalid AI secret encryption key.");
     return key;
   }
-  encrypt(value, workspace, id) {
-    const iv = randomBytes2(12), cipher = createCipheriv("aes-256-gcm", this.key(true), iv);
-    cipher.setAAD(Buffer.from(JSON.stringify([workspace, id])));
+  encrypt(value, id) {
+    const iv = randomBytes4(12), cipher = createCipheriv("aes-256-gcm", this.key(true), iv);
+    cipher.setAAD(Buffer.from(JSON.stringify(["site", id])));
     const body = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
     return [iv, cipher.getAuthTag(), body].map((b) => b.toString("base64")).join(".");
   }
-  list(workspace) {
-    return this.hub.db.prepare("SELECT * FROM ai_profiles WHERE workspace_id=? ORDER BY id").all(workspace).map((row) => ({
+  list() {
+    return this.hub.db.prepare("SELECT * FROM ai_profiles ORDER BY id").all().map((row) => ({
       ...AiProfileSchema.parse(JSON.parse(String(row.config_json))),
       revision: Number(row.revision),
       keyConfigured: !!row.secret
     }));
   }
-  get(workspace, id) {
-    const profile = this.list(workspace).find((p) => p.id === id);
+  get(id) {
+    const profile = this.list().find((p) => p.id === id);
     if (!profile) throw new HubError(404, "AI_PROFILE_NOT_FOUND", "Model profile not found.");
     const { keyConfigured: _, ...result } = profile;
     return result;
   }
-  secret(workspace, id) {
-    const row = this.hub.db.prepare("SELECT secret FROM ai_profiles WHERE workspace_id=? AND id=?").get(workspace, id);
+  secret(id) {
+    const row = this.hub.db.prepare("SELECT secret FROM ai_profiles WHERE id=?").get(id);
     if (!row?.secret) return "";
     const [iv, tag, body] = String(row.secret).split(".").map((s) => Buffer.from(s, "base64"));
     const cipher = createDecipheriv("aes-256-gcm", this.key(), iv);
-    cipher.setAAD(Buffer.from(JSON.stringify([workspace, id])));
+    cipher.setAAD(Buffer.from(JSON.stringify(["site", id])));
     cipher.setAuthTag(tag);
     return Buffer.concat([cipher.update(body), cipher.final()]).toString("utf8");
   }
   save(session, value) {
-    requireAiAdmin(session);
+    requireSiteAdmin(session);
     const input = AiProfileUpdateSchema.parse(value), { profile } = input;
     return transaction(this.hub.db, () => {
-      const old = this.hub.db.prepare("SELECT * FROM ai_profiles WHERE workspace_id=? AND id=?").get(session.workspaceId, profile.id);
+      const old = this.hub.db.prepare("SELECT * FROM ai_profiles WHERE id=?").get(profile.id);
       if ((old ? Number(old.revision) : 0) !== input.expectedRevision)
         throw new HubError(
           409,
           "AI_CONFIG_CONFLICT",
           "Model configuration changed; reload before saving."
         );
-      if (!old && this.list(session.workspaceId).length >= 20)
+      if (!old && this.list().length >= 20)
         throw new HubError(400, "AI_PROFILE_LIMIT", "At most 20 model profiles are supported.");
-      const secret = input.apiKey === void 0 ? old?.secret ?? null : input.apiKey === null ? null : this.encrypt(input.apiKey, session.workspaceId, profile.id);
+      const secret = input.apiKey === void 0 ? old?.secret ?? null : input.apiKey === null ? null : this.encrypt(input.apiKey, profile.id);
       this.hub.db.prepare(
-        "INSERT INTO ai_profiles VALUES(?,?,?,?,?) ON CONFLICT(workspace_id,id) DO UPDATE SET revision=excluded.revision,config_json=excluded.config_json,secret=excluded.secret"
-      ).run(
-        session.workspaceId,
-        profile.id,
-        input.expectedRevision + 1,
-        JSON.stringify(profile),
-        secret
-      );
-      return this.list(session.workspaceId).find((p) => p.id === profile.id);
+        "INSERT INTO ai_profiles VALUES(?,?,?,?) ON CONFLICT(id) DO UPDATE SET revision=excluded.revision,config_json=excluded.config_json,secret=excluded.secret"
+      ).run(profile.id, input.expectedRevision + 1, JSON.stringify(profile), secret);
+      return this.list().find((p) => p.id === profile.id);
+    });
+  }
+};
+
+// apps/server/ai/defaults.ts
+var AiDefaults = class {
+  constructor(hub) {
+    this.hub = hub;
+  }
+  hub;
+  read(scope) {
+    const row = this.hub.db.prepare("SELECT * FROM ai_defaults WHERE scope=?").get(scope);
+    return {
+      profileId: row?.profile_id ? String(row.profile_id) : null,
+      revision: Number(row?.revision ?? 0)
+    };
+  }
+  view(projectId2) {
+    const site = this.read("site");
+    const own = projectId2 ? this.read(`project:${projectId2}`) : site;
+    const effectiveProfileId = own.profileId ?? site.profileId;
+    return {
+      ...own,
+      effectiveProfileId,
+      source: projectId2 && own.profileId ? "project" : site.profileId ? "site" : "none",
+      available: !!effectiveProfileId && new AiConfig(this.hub).get(effectiveProfileId).enabled
+    };
+  }
+  site() {
+    return this.view();
+  }
+  project(projectId2) {
+    return this.view(projectId2);
+  }
+  save(scope, value) {
+    const input = AiDefaultUpdateSchema.parse(value);
+    transaction(this.hub.db, () => {
+      if (this.read(scope).revision !== input.expectedRevision)
+        throw new HubError(
+          409,
+          "AI_CONFIG_CONFLICT",
+          "Model default changed; reload before saving."
+        );
+      if (input.profileId && !new AiConfig(this.hub).get(input.profileId).enabled)
+        throw new HubError(400, "AI_PROFILE_DISABLED", "Model profile is disabled.");
+      this.hub.db.prepare(
+        `INSERT INTO ai_defaults VALUES(?,?,?) ON CONFLICT(scope) DO UPDATE SET profile_id=excluded.profile_id,revision=excluded.revision`
+      ).run(scope, input.profileId, input.expectedRevision + 1);
     });
   }
+  saveSite(identity, value) {
+    requireSiteAdmin(identity);
+    this.save("site", value);
+    return this.site();
+  }
+  saveProject(identity, value) {
+    new ProjectRepository(this.hub).requireMember(identity);
+    this.save(`project:${identity.workspaceId}`, value);
+    return this.project(identity.workspaceId);
+  }
+  resolve(projectId2, explicit) {
+    const id = explicit ?? this.project(projectId2).effectiveProfileId;
+    if (!id)
+      throw new HubError(400, "AI_DEFAULT_REQUIRED", "Select a model or configure a default.");
+    const profile = new AiConfig(this.hub).get(id);
+    if (!profile.enabled)
+      throw new HubError(400, "AI_PROFILE_DISABLED", "Model profile is disabled.");
+    return profile;
+  }
 };
 
 // apps/server/ai/snapshots.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 
 // apps/server/files.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { join as join4 } from "node:path";
 
 // packages/storage/local-blob-store.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash3, randomUUID } from "node:crypto";
 import { link, mkdir, open, readFile, unlink } from "node:fs/promises";
 import { dirname as dirname2, join as join3, resolve } from "node:path";
 function hash(content) {
-  return createHash2("sha256").update(content).digest("hex");
+  return createHash3("sha256").update(content).digest("hex");
 }
 function hasCode(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
@@ -705,7 +1232,7 @@ var FileRepository = class {
   }
   async upload(authorization, device, hash2, bytes) {
     this.hub.authorize(authorization, device);
-    if (createHash3("sha256").update(bytes).digest("hex") !== HashSchema.parse(hash2))
+    if (createHash4("sha256").update(bytes).digest("hex") !== HashSchema.parse(hash2))
       throw new HubError(400, "HASH_MISMATCH", "Content does not match its SHA-256.");
     const ref = await this.blobs.put(bytes);
     transaction(this.hub.db, () => {
@@ -731,7 +1258,7 @@ var FileRepository = class {
     const changes = [...batch.changes].sort(
       (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0
     );
-    const fingerprint = createHash3("sha256").update(JSON.stringify({ parentRevision: batch.parentRevision, changes })).digest("hex");
+    const fingerprint = createHash4("sha256").update(JSON.stringify({ parentRevision: batch.parentRevision, changes })).digest("hex");
     return transaction(this.hub.db, () => {
       const identity = this.hub.authorize(authorization, device);
       const { workspaceId: workspace, memberId: owner } = identity;
@@ -948,7 +1475,7 @@ var FileRepository = class {
 
 // apps/server/ai/snapshots.ts
 function snapshotDigest(files) {
-  return createHash4("sha256").update(JSON.stringify(files.map((f) => [f.path, f.sha256]))).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(files.map((f) => [f.path, f.sha256]))).digest("hex");
 }
 function captureSnapshot(hub, identity, selection) {
   const repository = new FileRepository(hub);
@@ -1026,7 +1553,7 @@ var SnapshotReader = class {
     if (entry.size > 256 * 1024)
       throw new HubError(413, "AI_FILE_LIMIT", "File exceeds the 256 KiB analysis limit.");
     const bytes = await new FileRepository(this.hub).download(this.identity, entry.sha256);
-    if (bytes.byteLength !== entry.size || createHash4("sha256").update(bytes).digest("hex") !== entry.sha256)
+    if (bytes.byteLength !== entry.size || createHash5("sha256").update(bytes).digest("hex") !== entry.sha256)
       throw new HubError(500, "AI_CONTENT_CORRUPT", "Snapshot content verification failed.");
     let text;
     try {
@@ -1212,7 +1739,7 @@ var AiJobs = class {
     this.hub.db.prepare("INSERT INTO ai_events(job_id,attempt,kind,message,created_at) VALUES(?,?,?,?,?)").run(id, attempt, kind, message.slice(0, 2e3), now());
   }
   operation(session, operationId, input, action) {
-    const fingerprint = createHash5("sha256").update(JSON.stringify(input)).digest("hex");
+    const fingerprint = createHash6("sha256").update(JSON.stringify(input)).digest("hex");
     return transaction(this.hub.db, () => {
       const old = this.hub.db.prepare(
         "SELECT * FROM ai_operations WHERE workspace_id=? AND requester=? AND operation_id=?"
@@ -1242,7 +1769,7 @@ var AiJobs = class {
         ).get(session.workspaceId).n
       );
       if (pending >= 50) throw new HubError(429, "AI_QUEUE_FULL", "Too many pending AI tasks.");
-      const profile = new AiConfig(this.hub).get(session.workspaceId, input.profileId);
+      const profile = new AiDefaults(this.hub).resolve(session.workspaceId, input.profileId);
       if (!profile.enabled)
         throw new HubError(400, "AI_PROFILE_DISABLED", "Model profile is disabled.");
       const snapshot = captureSnapshot(this.hub, session, input.selection), id2 = randomUUID2(), date = now();
@@ -1266,7 +1793,7 @@ var AiJobs = class {
     return this.get(session.workspaceId, id);
   }
   own(session, row) {
-    if (session.role !== "admin" && session.memberId !== row.requester)
+    if (session.siteRole !== "admin" && session.memberId !== row.requester)
       throw new HubError(
         403,
         "AI_TASK_FORBIDDEN",
@@ -1822,18 +2349,22 @@ async function runAiCycle(hub, stop) {
   const jobs = new AiJobs(hub), job = jobs.claim();
   if (!job) return false;
   const lost = new AbortController(), signal = AbortSignal.any([stop, lost.signal, AbortSignal.timeout(12e4)]);
+  const requesterActive = () => Boolean(
+    hub.db.prepare(
+      "SELECT (u.enabled AND m.enabled=1) enabled FROM users u LEFT JOIN members m ON m.member_id=u.id AND m.workspace_id=? WHERE u.id=?"
+    ).get(job.workspace, job.requester)?.enabled
+  );
   const timer = setInterval(() => {
     try {
-      if (!jobs.heartbeat(job)) lost.abort();
+      if (!requesterActive() || !jobs.heartbeat(job)) lost.abort();
     } catch {
       lost.abort();
     }
   }, 1e3);
   try {
-    const active = hub.db.prepare("SELECT enabled FROM members WHERE workspace_id=? AND member_id=?").get(job.workspace, job.requester);
-    if (!active?.enabled)
+    if (!requesterActive())
       throw new HubError(403, "AI_REQUESTER_DISABLED", "Requester is disabled.");
-    const config = new AiConfig(hub), profile = config.get(job.workspace, job.profile.id);
+    const config = new AiConfig(hub), profile = config.get(job.profile.id);
     if (!profile.enabled)
       throw new HubError(400, "AI_PROFILE_DISABLED", "Model profile is disabled.");
     if (profile.baseUrl !== job.profile.baseUrl || profile.protocol !== job.profile.protocol)
@@ -1846,7 +2377,7 @@ async function runAiCycle(hub, stop) {
       job.snapshot,
       Math.max(2048, job.profile.contextWindow - job.profile.maxOutputTokens - 4e3)
     );
-    const key = config.secret(job.workspace, profile.id);
+    const key = config.secret(profile.id);
     const output = job.request.workflow === "file-summary" ? await summarizeFile(job, reader, key, signal) : await analyzeDirectory(
       job,
       reader,
@@ -1854,6 +2385,8 @@ async function runAiCycle(hub, stop) {
       signal,
       (kind, message) => jobs.progress(job, kind, message)
     );
+    if (!requesterActive())
+      throw new HubError(403, "AI_REQUESTER_DISABLED", "Requester is disabled.");
     signal.throwIfAborted();
     jobs.finish(job, output.result, null, output.usage);
   } catch (error) {
@@ -1890,190 +2423,6 @@ import { parseArgs } from "node:util";
 // apps/server/ai/job-routes.ts
 import { z as z7 } from "zod";
 
-// apps/server/project.ts
-import { createHash as createHash6, randomBytes as randomBytes3 } from "node:crypto";
-var digest2 = (value) => createHash6("sha256").update(value).digest("hex");
-var ProjectRepository = class {
-  constructor(hub) {
-    this.hub = hub;
-  }
-  hub;
-  status() {
-    return {
-      initialized: Boolean(this.hub.db.prepare("SELECT 1 FROM project_settings").get()),
-      existingWorkspaces: this.hub.db.prepare("SELECT DISTINCT workspace_id FROM members ORDER BY workspace_id").all().map((r) => String(r.workspace_id))
-    };
-  }
-  config(identity) {
-    const row = this.hub.db.prepare("SELECT config_json FROM project_settings WHERE id=1").get();
-    if (!row)
-      throw new HubError(409, "SETUP_REQUIRED", "Initialize the project in the browser first.");
-    const config = ProjectConfigSchema.parse(JSON.parse(String(row.config_json)));
-    if (identity && identity.workspaceId !== config.projectId)
-      throw new HubError(
-        404,
-        "PROJECT_NOT_FOUND",
-        "This workspace has no Web project configuration."
-      );
-    return config;
-  }
-  setup(input) {
-    const value = SetupSchema.parse(input);
-    const fingerprint = digest2(JSON.stringify(value));
-    return transaction(this.hub.db, () => {
-      const prior = this.hub.db.prepare("SELECT setup_operation,setup_fingerprint FROM project_settings").get();
-      if (prior) {
-        if (prior.setup_operation === value.operationId && prior.setup_fingerprint === fingerprint)
-          return this.config();
-        throw new HubError(
-          409,
-          "ALREADY_INITIALIZED",
-          "Project initialization has already completed."
-        );
-      }
-      const existing = this.status().existingWorkspaces;
-      if (existing.length && !value.existingWorkspaceId)
-        throw new HubError(
-          400,
-          "WORKSPACE_REQUIRED",
-          "Select an existing workspace to preserve its data."
-        );
-      if (value.existingWorkspaceId && !existing.includes(value.existingWorkspaceId))
-        throw new HubError(400, "WORKSPACE_NOT_FOUND", "Existing workspace was not found.");
-      const projectId = value.existingWorkspaceId ?? `proj-${randomBytes3(8).toString("hex")}`;
-      for (const id of /* @__PURE__ */ new Set([value.adminId, ...value.members])) {
-        this.hub.db.prepare("INSERT OR IGNORE INTO members(workspace_id,member_id) VALUES (?,?)").run(projectId, id);
-      }
-      this.hub.db.prepare(
-        "UPDATE members SET role='admin',enabled=1,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
-      ).run(projectId, value.adminId);
-      const config = ProjectConfigSchema.parse({
-        schemaVersion: 1,
-        projectId,
-        projectName: value.projectName,
-        description: value.description,
-        publicServerUrl: value.publicServerUrl,
-        configRevision: 1,
-        scopeProfile: "workspace-and-sessions-v1",
-        sync: value.sync
-      });
-      this.hub.db.prepare("INSERT INTO project_settings VALUES (1,?,?,?)").run(JSON.stringify(config), value.operationId, fingerprint);
-      return config;
-    });
-  }
-  login(id) {
-    const { projectId } = this.config();
-    const row = this.hub.db.prepare("SELECT 1 FROM members WHERE workspace_id=? AND member_id=? AND enabled=1").get(projectId, id);
-    if (!row)
-      throw new HubError(401, "UNKNOWN_MEMBER", "Member ID does not exist or has been disabled.");
-    const token = randomBytes3(32).toString("hex");
-    this.hub.db.prepare("DELETE FROM web_sessions WHERE expires_at<=?").run(Date.now());
-    this.hub.db.prepare("INSERT INTO web_sessions VALUES (?,?,?,?)").run(digest2(token), projectId, id, Date.now() + 7 * 864e5);
-    return { token, session: this.session(token) };
-  }
-  session(token) {
-    const row = token && /^[a-f0-9]{64}$/.test(token) ? this.hub.db.prepare(
-      `SELECT s.workspace_id,s.member_id,m.display_name,m.role FROM web_sessions s JOIN members m USING(workspace_id,member_id) WHERE s.token_hash=? AND s.expires_at>? AND m.enabled=1`
-    ).get(digest2(token), Date.now()) : void 0;
-    if (!row)
-      throw new HubError(401, "LOGIN_REQUIRED", "Please sign in with an existing member ID.");
-    return {
-      workspaceId: String(row.workspace_id),
-      memberId: String(row.member_id),
-      displayName: String(row.display_name || row.member_id),
-      role: row.role
-    };
-  }
-  logout(token) {
-    if (token)
-      this.hub.db.prepare("DELETE FROM web_sessions WHERE token_hash=?").run(digest2(token));
-  }
-  admin(identity) {
-    if (identity.role !== "admin")
-      throw new HubError(403, "ADMIN_REQUIRED", "This action requires an administrator.");
-  }
-  updateConfig(identity, input) {
-    this.admin(identity);
-    const value = ConfigUpdateSchema.parse(input);
-    return transaction(this.hub.db, () => {
-      const current = this.config(identity);
-      if (current.configRevision !== value.expectedRevision)
-        throw new HubError(409, "STALE_CONFIG", "Project settings changed; reload before saving.");
-      const { expectedRevision: _, ...fields } = value;
-      const next = { ...current, ...fields };
-      if (JSON.stringify(next) !== JSON.stringify(current)) next.configRevision++;
-      this.hub.db.prepare("UPDATE project_settings SET config_json=? WHERE id=1").run(JSON.stringify(next));
-      return next;
-    });
-  }
-  members(identity) {
-    return this.hub.db.prepare(
-      `SELECT m.*, (SELECT MAX(created_at) FROM file_revisions f WHERE f.workspace_id=m.workspace_id AND f.owner=m.member_id) last_published FROM members m WHERE workspace_id=? ORDER BY member_id`
-    ).all(identity.workspaceId).map(
-      (row) => MemberSchema.parse({
-        id: row.member_id,
-        displayName: row.display_name || row.member_id,
-        role: row.role,
-        enabled: Boolean(row.enabled),
-        revision: row.member_revision,
-        bound: Boolean(row.device_id),
-        fileRevision: row.file_revision,
-        lastPublishedAt: row.last_published ?? null
-      })
-    );
-  }
-  createMember(identity, input) {
-    this.admin(identity);
-    const value = MemberCreateSchema.parse(input);
-    const result = this.hub.db.prepare("INSERT OR IGNORE INTO members(workspace_id,member_id,display_name) VALUES (?,?,?)").run(identity.workspaceId, value.id, value.displayName);
-    if (!result.changes) throw new HubError(409, "MEMBER_EXISTS", "Member ID already exists.");
-    return this.members(identity).find((m) => m.id === value.id);
-  }
-  updateMember(identity, id, input) {
-    const value = MemberUpdateSchema.parse(input);
-    if (identity.role !== "admin" && (id !== identity.memberId || value.enabled !== void 0))
-      throw new HubError(403, "FORBIDDEN", "You can only edit your own display name.");
-    return transaction(this.hub.db, () => {
-      const row = this.hub.db.prepare("SELECT * FROM members WHERE workspace_id=? AND member_id=?").get(identity.workspaceId, id);
-      if (!row) throw new HubError(404, "MEMBER_NOT_FOUND", "Member not found.");
-      if (row.member_revision !== value.expectedRevision)
-        throw new HubError(409, "STALE_MEMBER", "Member changed; reload before saving.");
-      if (value.enabled === false && row.role === "admin" && row.enabled) {
-        const count = this.hub.db.prepare(
-          "SELECT COUNT(*) n FROM members WHERE workspace_id=? AND role='admin' AND enabled=1"
-        ).get(identity.workspaceId);
-        if (Number(count.n) <= 1)
-          throw new HubError(409, "LAST_ADMIN", "Keep at least one enabled administrator.");
-      }
-      this.hub.db.prepare(
-        "UPDATE members SET display_name=?,enabled=?,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
-      ).run(
-        value.displayName ?? row.display_name,
-        value.enabled === void 0 ? row.enabled : Number(value.enabled),
-        identity.workspaceId,
-        id
-      );
-      if (value.enabled === false) this.clearAccess(identity.workspaceId, id);
-      return this.members(identity).find((m) => m.id === id);
-    });
-  }
-  clearAccess(workspace, id) {
-    this.hub.db.prepare(
-      "UPDATE members SET token_hash=NULL,device_id=NULL WHERE workspace_id=? AND member_id=?"
-    ).run(workspace, id);
-    this.hub.db.prepare("DELETE FROM web_sessions WHERE workspace_id=? AND member_id=?").run(workspace, id);
-  }
-  resetDevice(identity, id) {
-    this.admin(identity);
-    const result = this.hub.db.prepare(
-      "UPDATE members SET token_hash=NULL,device_id=NULL,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
-    ).run(identity.workspaceId, id);
-    if (!result.changes) throw new HubError(404, "MEMBER_NOT_FOUND", "Member not found.");
-    this.hub.db.prepare("DELETE FROM device_status WHERE workspace_id=? AND member_id=?").run(identity.workspaceId, id);
-    return { ok: true };
-  }
-};
-
 // apps/server/web-auth.ts
 function cookieToken(request) {
   return request.headers.cookie?.split(";").map((p) => p.trim()).find((p) => p.startsWith("teammy_session="))?.slice("teammy_session=".length);
@@ -2093,51 +2442,64 @@ function webMutation(request) {
       throw new HubError(403, "ORIGIN_MISMATCH", "Request origin does not match this server.");
   }
 }
+function projectId(request) {
+  const id = request.params.projectId;
+  if (!id) throw new HubError(400, "PROJECT_REQUIRED", "Use an explicit project URL.");
+  return id;
+}
+function authorizeWeb(store, request) {
+  return new ProjectRepository(store).session(cookieToken(request), projectId(request));
+}
+function authorizeDevice(store, request) {
+  const identity = store.authorize(
+    request.headers.authorization,
+    typeof request.headers["x-teammy-device"] === "string" ? request.headers["x-teammy-device"] : void 0
+  );
+  const target = request.params.projectId;
+  if (target && target !== identity.workspaceId)
+    throw new HubError(403, "PROJECT_MISMATCH", "Device credential belongs to another project.");
+  return identity;
+}
 function authorizeRead(store, request) {
-  if (request.headers.authorization)
-    return store.authorize(
-      request.headers.authorization,
-      typeof request.headers["x-teammy-device"] === "string" ? request.headers["x-teammy-device"] : void 0
-    );
-  return new ProjectRepository(store).session(cookieToken(request));
+  return request.headers.authorization ? authorizeDevice(store, request) : authorizeWeb(store, request);
 }
 
 // apps/server/ai/job-routes.ts
 function registerAiJobRoutes(server, hub) {
-  const project = new ProjectRepository(hub), jobs = new AiJobs(hub);
+  const jobs = new AiJobs(hub);
   const id = (params) => z7.object({ id: z7.uuid() }).parse(params).id;
-  server.get("/api/v1/ai/jobs", async (req) => {
-    const session = project.session(cookieToken(req)), query = z7.object({
+  server.get("/ai/jobs", async (req) => {
+    const session = authorizeWeb(hub, req), query = z7.object({
       after: z7.string().regex(/^\d{0,15}$/).default("")
     }).parse(req.query);
     return jobs.list(session.workspaceId, query.after);
   });
-  server.post("/api/v1/ai/jobs", async (req) => {
+  server.post("/ai/jobs", async (req) => {
     webMutation(req);
-    return jobs.create(project.session(cookieToken(req)), AiJobCreateSchema.parse(req.body));
+    return jobs.create(authorizeWeb(hub, req), AiJobCreateSchema.parse(req.body));
   });
   server.get(
-    "/api/v1/ai/jobs/:id",
-    async (req) => jobs.get(project.session(cookieToken(req)).workspaceId, id(req.params))
+    "/ai/jobs/:id",
+    async (req) => jobs.get(authorizeWeb(hub, req).workspaceId, id(req.params))
   );
-  server.get("/api/v1/ai/jobs/:id/events", async (req) => {
+  server.get("/ai/jobs/:id/events", async (req) => {
     const query = z7.object({ after: z7.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).default(0) }).parse(req.query);
-    return jobs.events(project.session(cookieToken(req)).workspaceId, id(req.params), query.after);
+    return jobs.events(authorizeWeb(hub, req).workspaceId, id(req.params), query.after);
   });
-  server.post("/api/v1/ai/jobs/:id/cancel", async (req) => {
+  server.post("/ai/jobs/:id/cancel", async (req) => {
     webMutation(req);
-    return jobs.cancel(project.session(cookieToken(req)), id(req.params));
+    return jobs.cancel(authorizeWeb(hub, req), id(req.params));
   });
-  server.post("/api/v1/ai/jobs/:id/retry", async (req) => {
+  server.post("/ai/jobs/:id/retry", async (req) => {
     webMutation(req);
     return jobs.retry(
-      project.session(cookieToken(req)),
+      authorizeWeb(hub, req),
       id(req.params),
       z7.object({ operationId: z7.uuid() }).strict().parse(req.body).operationId
     );
   });
-  server.get("/api/v1/ai/jobs/:id/source", async (req) => {
-    const session = project.session(cookieToken(req)), jobId = id(req.params);
+  server.get("/ai/jobs/:id/source", async (req) => {
+    const session = authorizeWeb(hub, req), jobId = id(req.params);
     jobs.get(session.workspaceId, jobId);
     const query = z7.object({ path: z7.string().max(1024), startLine: z7.coerce.number().int().min(1).default(1) }).parse(req.query);
     const row = hub.db.prepare("SELECT snapshot_json FROM ai_jobs WHERE id=? AND workspace_id=?").get(jobId, session.workspaceId);
@@ -2152,15 +2514,35 @@ function registerAiJobRoutes(server, hub) {
 
 // apps/server/ai/routes.ts
 function registerAiRoutes(server, store) {
-  const project = new ProjectRepository(store), config = new AiConfig(store);
+  const project = new SiteRepository(store), config = new AiConfig(store);
+  const defaults = new AiDefaults(store);
+  server.get("/api/v1/ai/default", async (request) => {
+    project.identity(cookieToken(request));
+    return defaults.site();
+  });
+  server.put("/api/v1/ai/default", async (request) => {
+    webMutation(request);
+    return defaults.saveSite(
+      project.identity(cookieToken(request)),
+      AiDefaultUpdateSchema.parse(request.body)
+    );
+  });
+  server.get(
+    "/api/v1/projects/:projectId/ai/default",
+    async (req) => defaults.project(authorizeWeb(store, req).workspaceId)
+  );
+  server.put("/api/v1/projects/:projectId/ai/default", async (req) => {
+    webMutation(req);
+    return defaults.saveProject(authorizeWeb(store, req), AiDefaultUpdateSchema.parse(req.body));
+  });
   let probing = false;
   server.get("/api/v1/ai/profiles", async (request) => {
-    const session = project.session(cookieToken(request));
-    return { profiles: config.list(session.workspaceId) };
+    project.identity(cookieToken(request));
+    return { profiles: config.list() };
   });
   server.put("/api/v1/ai/profiles/:id", async (request) => {
     webMutation(request);
-    const session = project.session(cookieToken(request));
+    const session = project.identity(cookieToken(request));
     const id = NameSchema.parse(request.params.id);
     const input = AiProfileUpdateSchema.parse(request.body);
     if (id !== input.profile.id) throw new HubError(400, "INVALID_REQUEST", "Profile ID mismatch.");
@@ -2168,12 +2550,9 @@ function registerAiRoutes(server, store) {
   });
   server.post("/api/v1/ai/profiles/:id/test", async (request, reply) => {
     webMutation(request);
-    const session = project.session(cookieToken(request));
-    requireAiAdmin(session);
-    const profile = config.get(
-      session.workspaceId,
-      NameSchema.parse(request.params.id)
-    );
+    const session = project.identity(cookieToken(request));
+    requireSiteAdmin(session);
+    const profile = config.get(NameSchema.parse(request.params.id));
     const { mode } = AiProbeSchema.parse(request.body);
     if (probing) throw new HubError(429, "AI_TEST_BUSY", "Another connection test is running.");
     probing = true;
@@ -2185,7 +2564,7 @@ function registerAiRoutes(server, store) {
     try {
       return await probeModel(
         profile,
-        config.secret(session.workspaceId, profile.id),
+        config.secret(profile.id),
         mode,
         AbortSignal.any([controller.signal, AbortSignal.timeout(3e4)])
       );
@@ -2223,7 +2602,14 @@ function registerWeb(server, root) {
     "/settings",
     "/dashboard",
     "/sessions",
-    "/account"
+    "/account",
+    "/projects",
+    "/site-settings",
+    "/projects/:projectId/dashboard",
+    "/projects/:projectId/files",
+    "/projects/:projectId/sessions",
+    "/projects/:projectId/members",
+    "/projects/:projectId/settings"
   ])
     server.get(
       path,
@@ -2264,6 +2650,7 @@ import { z as z9 } from "zod";
 var CredentialSchema = z9.string().regex(/^tmy_[a-f0-9]{64}$/);
 var EnrollmentSchema = z9.object({
   operationId: z9.uuid(),
+  projectId: NameSchema,
   memberId: NameSchema,
   deviceId: DeviceIdSchema,
   credential: CredentialSchema
@@ -2303,12 +2690,8 @@ var WebDevicesSchema = z9.object({
 
 // apps/server/control-routes.ts
 function registerControlRoutes(server, store) {
-  server.put("/api/v1/devices/self/status", async (request) => {
-    const device = request.headers["x-teammy-device"];
-    const identity = store.authorize(
-      request.headers.authorization,
-      typeof device === "string" ? device : void 0
-    );
+  server.put("/devices/self/status", async (request) => {
+    const identity = authorizeDevice(store, request);
     new ProjectRepository(store).config(identity);
     const status = DeviceStatusSchema.parse(request.body);
     store.db.prepare(
@@ -2322,8 +2705,8 @@ function registerControlRoutes(server, store) {
     );
     return { ok: true };
   });
-  server.get("/api/v1/web/devices", async (request) => {
-    const identity = new ProjectRepository(store).session(cookieToken(request));
+  server.get("/web/devices", async (request) => {
+    const identity = authorizeWeb(store, request);
     const devices = store.db.prepare(
       "SELECT m.member_id,m.device_id,d.seen_at,d.status_json FROM members m LEFT JOIN device_status d ON d.workspace_id=m.workspace_id AND d.member_id=m.member_id AND d.device_id=m.device_id WHERE m.workspace_id=? ORDER BY m.member_id"
     ).all(identity.workspaceId).map((row) => ({
@@ -2336,6 +2719,71 @@ function registerControlRoutes(server, store) {
   });
 }
 
+// apps/server/project-routes.ts
+import { z as z10 } from "zod";
+function registerProjectRoutes(server, store) {
+  const project = new ProjectRepository(store), site = new SiteRepository(store);
+  server.get("/api/v1/projects", async (request) => ({
+    projects: project.projects(site.identity(cookieToken(request)))
+  }));
+  server.post("/api/v1/projects", async (request) => {
+    webMutation(request);
+    return project.createProject(
+      site.identity(cookieToken(request)),
+      ProjectCreateSchema.parse(request.body)
+    );
+  });
+}
+function registerProjectScopeRoutes(server, store) {
+  const project = new ProjectRepository(store);
+  server.delete("/membership", async (request) => {
+    webMutation(request);
+    return project.leave(project.site.identity(cookieToken(request)), projectId(request));
+  });
+  server.get("/identity", async (request) => authorizeWeb(store, request));
+  server.get("/project/config", async (request, reply) => {
+    const config = project.config(authorizeRead(store, request));
+    const etag = `"project-${config.projectId}-${config.configRevision}"`;
+    reply.header("cache-control", "private, no-cache").header("etag", etag);
+    if (request.headers["if-none-match"] === etag) return reply.code(304).send();
+    return config;
+  });
+  server.patch("/project/config", async (request) => {
+    webMutation(request);
+    return project.updateConfig(
+      authorizeWeb(store, request),
+      ConfigUpdateSchema.parse(request.body)
+    );
+  });
+  server.get("/web/members", async (request) => ({
+    members: project.members(authorizeWeb(store, request))
+  }));
+  server.post("/web/members", async (request) => {
+    webMutation(request);
+    return project.createMember(
+      authorizeWeb(store, request),
+      MemberCreateSchema.parse(request.body)
+    );
+  });
+  server.patch("/web/members/:id", async (request) => {
+    webMutation(request);
+    const { id } = z10.object({ id: NameSchema }).parse(request.params);
+    return project.updateMember(
+      authorizeWeb(store, request),
+      id,
+      MemberUpdateSchema.parse(request.body)
+    );
+  });
+  server.post("/web/members/:id/device-reset", async (request) => {
+    webMutation(request);
+    const { id } = z10.object({ id: NameSchema }).parse(request.params);
+    return project.resetDevice(authorizeWeb(store, request), id);
+  });
+}
+
+// apps/server/site-routes.ts
+import { z as z11 } from "zod";
+
 // apps/server/devices.ts
 var DeviceRepository = class {
   constructor(hub) {
@@ -2345,14 +2793,17 @@ var DeviceRepository = class {
   enroll(input) {
     const value = EnrollmentSchema.parse(input);
     return transaction(this.hub.db, () => {
-      const { projectId } = new ProjectRepository(this.hub).config();
-      const member = this.hub.db.prepare("SELECT * FROM members WHERE workspace_id=? AND member_id=? AND enabled=1").get(projectId, value.memberId);
+      const { projectId: projectId2 } = value;
+      new ProjectRepository(this.hub).config({ workspaceId: projectId2, memberId: value.memberId });
+      const member = this.hub.db.prepare(
+        "SELECT m.* FROM members m JOIN users u ON u.id=m.member_id WHERE m.workspace_id=? AND m.member_id=? AND m.enabled=1 AND u.enabled=1"
+      ).get(projectId2, value.memberId);
       if (!member)
         throw new HubError(401, "UNKNOWN_MEMBER", "Member ID does not exist or has been disabled.");
       const fingerprint = digest2(JSON.stringify(value));
       const prior = this.hub.db.prepare(
         "SELECT fingerprint FROM device_enrollments WHERE workspace_id=? AND member_id=? AND operation_id=?"
-      ).get(projectId, value.memberId, value.operationId);
+      ).get(projectId2, value.memberId, value.operationId);
       if (prior && prior.fingerprint !== fingerprint)
         throw new HubError(
           409,
@@ -2376,23 +2827,28 @@ var DeviceRepository = class {
           );
         this.hub.db.prepare(
           "UPDATE members SET token_hash=?,device_id=?,member_revision=member_revision+1 WHERE workspace_id=? AND member_id=?"
-        ).run(tokenHash, value.deviceId, projectId, value.memberId);
-        this.hub.db.prepare("INSERT INTO device_enrollments VALUES (?,?,?,?)").run(projectId, value.memberId, value.operationId, fingerprint);
+        ).run(tokenHash, value.deviceId, projectId2, value.memberId);
+        this.hub.db.prepare("INSERT INTO device_enrollments VALUES (?,?,?,?)").run(projectId2, value.memberId, value.operationId, fingerprint);
       }
-      return { workspaceId: projectId, memberId: value.memberId, deviceId: value.deviceId };
+      return { workspaceId: projectId2, memberId: value.memberId, deviceId: value.deviceId };
     });
   }
 };
 
-// apps/server/project-routes.ts
-import { z as z10 } from "zod";
-function registerProjectRoutes(server, store) {
+// apps/server/site-routes.ts
+function registerSiteRoutes(server, store) {
   const project = new ProjectRepository(store);
-  server.post(
-    "/api/v1/devices/enroll",
-    async (request) => new DeviceRepository(store).enroll(EnrollmentSchema.parse(request.body))
-  );
-  server.get("/api/v1/setup", async () => project.status());
+  const site = new SiteRepository(store);
+  server.post("/api/v1/devices/enroll", async (request) => {
+    if (request.body && typeof request.body === "object" && !("projectId" in request.body))
+      throw new HubError(
+        400,
+        "PROJECT_REQUIRED",
+        "Upgrade the client and connect with --project ID from the project settings."
+      );
+    return new DeviceRepository(store).enroll(EnrollmentSchema.parse(request.body));
+  });
+  server.get("/api/v1/setup", async () => site.status());
   server.post(
     "/api/v1/setup",
     { onRequest: async (request) => webMutation(request) },
@@ -2402,8 +2858,8 @@ function registerProjectRoutes(server, store) {
     "/api/v1/web/session",
     { onRequest: async (request) => webMutation(request) },
     async (request, reply) => {
-      const { id } = z10.object({ id: NameSchema }).strict().parse(request.body);
-      const { token, session } = project.login(id);
+      const { id } = z11.object({ id: NameSchema }).strict().parse(request.body);
+      const { token, session } = site.login(id);
       const secure = request.protocol === "https" || request.headers.origin?.startsWith("https://");
       reply.header(
         "set-cookie",
@@ -2412,114 +2868,116 @@ function registerProjectRoutes(server, store) {
       return session;
     }
   );
-  server.get("/api/v1/web/session", async (request) => project.session(cookieToken(request)));
+  server.get("/api/v1/web/session", async (request) => site.identity(cookieToken(request)));
+  server.patch("/api/v1/web/session", async (request) => {
+    webMutation(request);
+    const identity = site.identity(cookieToken(request));
+    const { displayName } = z11.object({ displayName: z11.string().trim().max(120) }).strict().parse(request.body);
+    return site.renameSelf(identity, displayName);
+  });
   server.delete("/api/v1/web/session", async (request, reply) => {
     webMutation(request);
-    project.logout(cookieToken(request));
+    site.logout(cookieToken(request));
     reply.header("set-cookie", "teammy_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0");
     return { ok: true };
   });
-  server.get("/api/v1/project/config", async (request, reply) => {
-    const config = project.config(authorizeRead(store, request));
-    const etag = `"project-${config.configRevision}"`;
-    reply.header("cache-control", "private, no-cache").header("etag", etag);
-    if (request.headers["if-none-match"] === etag) return reply.code(304).send();
-    return config;
+  server.get("/api/v1/site/config", async (request) => {
+    requireSiteAdmin(site.identity(cookieToken(request)));
+    return site.config();
   });
-  server.patch("/api/v1/project/config", async (request) => {
+  server.patch("/api/v1/site/config", async (request) => {
     webMutation(request);
-    return project.updateConfig(
-      project.session(cookieToken(request)),
-      ConfigUpdateSchema.parse(request.body)
+    return site.updateConfig(
+      site.identity(cookieToken(request)),
+      SiteConfigUpdateSchema.parse(request.body)
     );
   });
-  server.get("/api/v1/web/members", async (request) => ({
-    members: project.members(project.session(cookieToken(request)))
+  server.get("/api/v1/users", async (request) => ({
+    users: site.users(site.identity(cookieToken(request)))
   }));
-  server.post("/api/v1/web/members", async (request) => {
+  server.post("/api/v1/users", async (request) => {
     webMutation(request);
-    return project.createMember(
-      project.session(cookieToken(request)),
-      MemberCreateSchema.parse(request.body)
+    return site.createUser(
+      site.identity(cookieToken(request)),
+      UserCreateSchema.parse(request.body)
     );
   });
-  server.patch("/api/v1/web/members/:id", async (request) => {
+  server.patch("/api/v1/users/:id", async (request) => {
     webMutation(request);
-    const { id } = z10.object({ id: NameSchema }).parse(request.params);
-    return project.updateMember(
-      project.session(cookieToken(request)),
-      id,
-      MemberUpdateSchema.parse(request.body)
+    return site.updateUser(
+      site.identity(cookieToken(request)),
+      NameSchema.parse(request.params.id),
+      UserUpdateSchema.parse(request.body)
     );
   });
-  server.post("/api/v1/web/members/:id/device-reset", async (request) => {
-    webMutation(request);
-    const { id } = z10.object({ id: NameSchema }).parse(request.params);
-    return project.resetDevice(project.session(cookieToken(request)), id);
-  });
 }
 
 // apps/server/session-routes.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // packages/protocol/sessions.ts
-import { z as z11 } from "zod";
-var AgentSchema = z11.enum(["claude-code", "codex", "cursor", "pi", "dsh"]);
-var SessionSnapshotSchema = z11.object({
-  formatVersion: z11.literal(1),
-  adapterVersion: z11.literal(1),
+import { z as z12 } from "zod";
+var AgentSchema = z12.enum(["claude-code", "codex", "cursor", "pi", "dsh"]);
+var SessionSnapshotSchema = z12.object({
+  formatVersion: z12.literal(1),
+  adapterVersion: z12.literal(1),
   agent: AgentSchema,
-  nativeId: z11.string().min(1).max(512),
-  cwd: z11.string().min(1).max(4096),
-  messages: z11.array(
-    z11.object({
-      id: z11.string().min(1).max(1024),
-      role: z11.enum(["user", "assistant"]),
-      text: z11.string().min(1).max(2 * 1024 * 1024),
-      source: z11.string().min(1).max(1024)
+  nativeId: z12.string().min(1).max(512),
+  cwd: z12.string().min(1).max(4096),
+  messages: z12.array(
+    z12.object({
+      id: z12.string().min(1).max(1024),
+      role: z12.enum(["user", "assistant"]),
+      text: z12.string().min(1).max(2 * 1024 * 1024),
+      source: z12.string().min(1).max(1024)
     }).strict()
   ).max(5e4)
 }).strict().refine(
   (s) => new Set(s.messages.map((m) => m.id)).size === s.messages.length,
   "Duplicate message IDs."
 );
-var SessionCommitSchema = z11.object({
-  operationId: z11.uuid(),
+var SessionCommitSchema = z12.object({
+  operationId: z12.uuid(),
   sessionKey: HashSchema,
   parentRevision: RevisionSchema,
   blob: BlobRefSchema
 }).strict();
-var SessionInfoSchema = z11.object({
+var SessionInfoSchema = z12.object({
   owner: NameSchema,
   sessionKey: HashSchema,
   agent: AgentSchema,
-  nativeId: z11.string(),
-  cwd: z11.string(),
-  title: z11.string(),
+  nativeId: z12.string(),
+  cwd: z12.string(),
+  title: z12.string(),
   revision: RevisionSchema,
-  updatedAt: z11.string(),
-  messageCount: z11.number().int().nonnegative(),
+  updatedAt: z12.string(),
+  messageCount: z12.number().int().nonnegative(),
   blob: BlobRefSchema
 });
-var SessionListSchema = z11.object({
-  sessions: z11.array(SessionInfoSchema),
+var SessionListSchema = z12.object({
+  sessions: z12.array(SessionInfoSchema),
   nextCursor: RevisionSchema.nullable()
 });
-var SessionStatsSchema = z11.object({
-  totalSessions: z11.number().int().nonnegative(),
-  totalMessages: z11.number().int().nonnegative(),
-  memberCount: z11.number().int().nonnegative(),
-  updatedAt: z11.string().nullable()
+var SessionStatsSchema = z12.object({
+  totalSessions: z12.number().int().nonnegative(),
+  totalMessages: z12.number().int().nonnegative(),
+  memberCount: z12.number().int().nonnegative(),
+  updatedAt: z12.string().nullable()
 });
-var SessionSearchSchema = z11.object({
-  matches: z11.array(
-    z11.object({
+var SessionScopeSchema = z12.object({
+  owner: NameSchema.optional(),
+  sessionKey: HashSchema.optional()
+}).strict().refine((v) => !v.sessionKey || !!v.owner, "A session scope requires an owner.");
+var SessionSearchSchema = z12.object({
+  matches: z12.array(
+    z12.object({
       owner: NameSchema,
       sessionKey: HashSchema,
       revision: RevisionSchema,
-      messageId: z11.string(),
-      role: z11.enum(["user", "assistant"]),
-      snippet: z11.string()
+      messageId: z12.string(),
+      role: z12.enum(["user", "assistant"]),
+      snippet: z12.string(),
+      title: z12.string()
     })
   ),
   nextCursor: RevisionSchema.nullable()
@@ -2680,26 +3138,31 @@ var SessionRepository = class {
       ).get(identity.workspaceId)
     );
   }
-  list(identity, after, limit) {
+  list(identity, after, limit, owner) {
     const rows = this.hub.db.prepare(
       `SELECT s.id, r.info_json FROM sessions s JOIN session_revisions r USING(workspace_id, owner, session_key, revision)
-      WHERE s.workspace_id=? AND s.id>? ORDER BY s.id LIMIT ?`
-    ).all(identity.workspaceId, after, limit + 1);
+      WHERE s.workspace_id=? AND s.id>? ${owner ? "AND s.owner=?" : ""} ORDER BY s.id LIMIT ?`
+    ).all(identity.workspaceId, after, ...owner ? [owner] : [], limit + 1);
     return {
       sessions: rows.slice(0, limit).map((row) => SessionInfoSchema.parse(JSON.parse(String(row.info_json)))),
       nextCursor: rows.length > limit ? Number(rows[limit - 1].id) : null
     };
   }
-  search(identity, query, after, limit) {
+  search(identity, query, after, limit, scope = {}) {
+    SessionScopeSchema.parse(scope);
     const lower = query.toLowerCase();
     const indexed = [...lower].length >= 3;
     const rows = this.hub.db.prepare(
-      `SELECT * FROM session_messages WHERE workspace_id=? AND id>? AND instr(search_text, ?)>0
-      ${indexed ? "AND id IN (SELECT rowid FROM session_fts WHERE session_fts MATCH ?)" : ""} ORDER BY id LIMIT ?`
+      `SELECT m.*,s.title,s.native_id FROM session_messages m JOIN sessions s USING(workspace_id,owner,session_key)
+      WHERE m.workspace_id=? AND m.id>? AND instr(m.search_text, ?)>0
+      ${scope.owner ? "AND m.owner=?" : ""} ${scope.sessionKey ? "AND m.session_key=?" : ""}
+      ${indexed ? "AND m.id IN (SELECT rowid FROM session_fts WHERE session_fts MATCH ?)" : ""} ORDER BY m.id LIMIT ?`
     ).all(
       identity.workspaceId,
       after,
       lower,
+      ...scope.owner ? [scope.owner] : [],
+      ...scope.sessionKey ? [scope.sessionKey] : [],
       ...indexed ? [`"${lower.replaceAll('"', '""')}"`] : [],
       limit + 1
     );
@@ -2712,7 +3175,8 @@ var SessionRepository = class {
           revision: Number(row.revision),
           messageId: String(row.message_id),
           role: String(row.role),
-          snippet: String(row.body).slice(start, start + 500)
+          snippet: String(row.body).slice(start, start + 500),
+          title: String(row.title || row.native_id)
         };
       }),
       nextCursor: rows.length > limit ? Number(rows[limit - 1].id) : null
@@ -2724,18 +3188,18 @@ var SessionRepository = class {
 function registerSessionRoutes(server, store) {
   const sessions = new SessionRepository(store);
   const device = (request) => typeof request.headers["x-teammy-device"] === "string" ? request.headers["x-teammy-device"] : void 0;
-  const authorize = (request) => store.authorize(request.headers.authorization, device(request));
+  const authorize = (request) => authorizeDevice(store, request);
   const guard = {
     onRequest: async (request) => {
       authorize(request);
     }
   };
-  const pagination = z12.object({
-    after: z12.coerce.number().pipe(RevisionSchema).default(0),
-    limit: z12.coerce.number().int().min(1).max(100).default(50)
+  const pagination = z13.object({
+    after: z13.coerce.number().pipe(RevisionSchema).default(0),
+    limit: z13.coerce.number().int().min(1).max(100).default(50)
   });
   server.post(
-    "/api/v1/sessions/commits",
+    "/sessions/commits",
     guard,
     (request) => sessions.commit(
       request.headers.authorization,
@@ -2743,36 +3207,41 @@ function registerSessionRoutes(server, store) {
       SessionCommitSchema.parse(request.body)
     )
   );
-  server.get("/api/v1/sessions", async (request) => {
-    const q = pagination.parse(request.query);
-    return sessions.list(authorizeRead(store, request), q.after, q.limit);
+  server.get("/sessions", async (request) => {
+    const q = pagination.extend({ owner: NameSchema.optional() }).parse(request.query);
+    return sessions.list(authorizeRead(store, request), q.after, q.limit, q.owner);
   });
-  server.get(
-    "/api/v1/sessions/stats",
-    async (request) => sessions.stats(authorizeRead(store, request))
-  );
-  server.get("/api/v1/sessions/search", async (request) => {
+  server.get("/sessions/stats", async (request) => sessions.stats(authorizeRead(store, request)));
+  server.get("/sessions/search", async (request) => {
     const q = pagination.extend({
-      q: z12.string().min(1).max(500).refine((s) => !s.includes("\0"))
+      owner: NameSchema.optional(),
+      sessionKey: HashSchema.optional(),
+      q: z13.string().min(1).max(500).refine((s) => !s.includes("\0"))
     }).parse(request.query);
-    return sessions.search(authorizeRead(store, request), q.q, q.after, q.limit);
+    return sessions.search(
+      authorizeRead(store, request),
+      q.q,
+      q.after,
+      q.limit,
+      SessionScopeSchema.parse({ owner: q.owner, sessionKey: q.sessionKey })
+    );
   });
-  server.get("/api/v1/sessions/:owner/:key", async (request) => {
-    const p = z12.object({ owner: NameSchema, key: HashSchema }).parse(request.params);
-    const q = z12.object({ revision: z12.coerce.number().pipe(RevisionSchema).optional() }).parse(request.query);
+  server.get("/sessions/:owner/:key", async (request) => {
+    const p = z13.object({ owner: NameSchema, key: HashSchema }).parse(request.params);
+    const q = z13.object({ revision: z13.coerce.number().pipe(RevisionSchema).optional() }).parse(request.query);
     return sessions.read(authorizeRead(store, request), p.owner, p.key, q.revision);
   });
 }
 
 // apps/server/file-routes.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function registerFileRoutes(server, store) {
   const files = new FileRepository(store);
   const device = (request) => {
     const value = request.headers["x-teammy-device"];
     return typeof value === "string" ? value : void 0;
   };
-  const authorize = (request) => store.authorize(request.headers.authorization, device(request));
+  const authorize = (request) => authorizeDevice(store, request);
   const guard = {
     onRequest: async (request) => {
       authorize(request);
@@ -2783,21 +3252,21 @@ function registerFileRoutes(server, store) {
     { parseAs: "buffer", bodyLimit: MAX_BLOB_BYTES },
     (_request, body, done) => done(null, body)
   );
-  server.post("/api/v1/blobs/check", guard, async (request) => ({
+  server.post("/blobs/check", guard, async (request) => ({
     missing: files.missing(authorize(request), BlobCheckSchema.parse(request.body).hashes)
   }));
-  server.put("/api/v1/blobs/:hash", { ...guard, bodyLimit: MAX_BLOB_BYTES }, async (request) => {
-    const { hash: hash2 } = z13.object({ hash: HashSchema }).parse(request.params);
+  server.put("/blobs/:hash", { ...guard, bodyLimit: MAX_BLOB_BYTES }, async (request) => {
+    const { hash: hash2 } = z14.object({ hash: HashSchema }).parse(request.params);
     if (!Buffer.isBuffer(request.body))
       throw Object.assign(new Error("Expected binary content"), { statusCode: 400 });
     return files.upload(request.headers.authorization, device(request), hash2, request.body);
   });
-  server.get("/api/v1/blobs/:hash", async (request, reply) => {
-    const { hash: hash2 } = z13.object({ hash: HashSchema }).parse(request.params);
+  server.get("/blobs/:hash", async (request, reply) => {
+    const { hash: hash2 } = z14.object({ hash: HashSchema }).parse(request.params);
     return reply.type("application/octet-stream").send(Buffer.from(await files.download(authorizeRead(store, request), hash2)));
   });
   server.post(
-    "/api/v1/files/commits",
+    "/files/commits",
     guard,
     async (request) => files.commit(
       request.headers.authorization,
@@ -2805,12 +3274,12 @@ function registerFileRoutes(server, store) {
       FileCommitSchema.parse(request.body)
     )
   );
-  server.get("/api/v1/files/:owner/manifest", async (request) => {
-    const { owner } = z13.object({ owner: NameSchema }).parse(request.params);
-    const query = z13.object({
-      revision: z13.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
-      after: z13.string().max(1024).default(""),
-      limit: z13.coerce.number().int().min(1).max(500).default(200)
+  server.get("/files/:owner/manifest", async (request) => {
+    const { owner } = z14.object({ owner: NameSchema }).parse(request.params);
+    const query = z14.object({
+      revision: z14.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
+      after: z14.string().max(1024).default(""),
+      limit: z14.coerce.number().int().min(1).max(500).default(200)
     }).parse(request.query);
     return files.manifest(
       authorizeRead(store, request),
@@ -2820,29 +3289,29 @@ function registerFileRoutes(server, store) {
       query.limit
     );
   });
-  server.get("/api/v1/files/:owner/entry", async (request) => {
-    const { owner } = z13.object({ owner: NameSchema }).parse(request.params);
-    const q = z13.object({
+  server.get("/files/:owner/entry", async (request) => {
+    const { owner } = z14.object({ owner: NameSchema }).parse(request.params);
+    const q = z14.object({
       path: FilePathSchema,
-      revision: z13.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional()
+      revision: z14.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional()
     }).parse(request.query);
     return files.entry(authorizeRead(store, request), owner, q.path, q.revision);
   });
-  server.get("/api/v1/files/:owner/tree", async (request) => {
-    const { owner } = z13.object({ owner: NameSchema }).parse(request.params);
-    const q = z13.object({
-      path: z13.union([z13.literal(""), FilePathSchema]).default(""),
-      revision: z13.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
-      after: z13.string().max(255).default(""),
-      limit: z13.coerce.number().int().min(1).max(200).default(100)
+  server.get("/files/:owner/tree", async (request) => {
+    const { owner } = z14.object({ owner: NameSchema }).parse(request.params);
+    const q = z14.object({
+      path: z14.union([z14.literal(""), FilePathSchema]).default(""),
+      revision: z14.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
+      after: z14.string().max(255).default(""),
+      limit: z14.coerce.number().int().min(1).max(200).default(100)
     }).parse(request.query);
     return files.tree(authorizeRead(store, request), owner, q.path, q.revision, q.after, q.limit);
   });
-  server.get("/api/v1/files/:owner/changes", async (request) => {
-    const { owner } = z13.object({ owner: NameSchema }).parse(request.params);
-    const query = z13.object({
-      after: z13.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).default(0),
-      limit: z13.coerce.number().int().min(1).max(100).default(100)
+  server.get("/files/:owner/changes", async (request) => {
+    const { owner } = z14.object({ owner: NameSchema }).parse(request.params);
+    const query = z14.object({
+      after: z14.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).default(0),
+      limit: z14.coerce.number().int().min(1).max(100).default(100)
     }).parse(request.query);
     return files.changes(authorizeRead(store, request), owner, query.after, query.limit);
   });
@@ -2897,6 +3366,7 @@ function buildServer(options) {
         "session-revisions",
         "session-search",
         "project-config",
+        "multi-project",
         "web-identity",
         "device-status",
         "ai-profiles",
@@ -2905,23 +3375,24 @@ function buildServer(options) {
     ]
   }));
   if (store) {
+    registerSiteRoutes(server, store);
     registerProjectRoutes(server, store);
     registerAiRoutes(server, store);
-    registerAiJobRoutes(server, store);
-    registerControlRoutes(server, store);
-    registerFileRoutes(server, store);
-    registerSessionRoutes(server, store);
-    server.post(
-      "/api/v1/bind",
-      async (request) => store.bind(request.headers.authorization, BindRequestSchema.parse(request.body).deviceId)
-    );
-    server.get("/api/v1/members", async (request) => {
-      const device = request.headers["x-teammy-device"];
-      const identity = store.authorize(
-        request.headers.authorization,
-        typeof device === "string" ? device : void 0
-      );
-      return { members: store.members(identity) };
+    const projectRoutes = async (scope) => {
+      registerProjectScopeRoutes(scope, store);
+      registerAiJobRoutes(scope, store);
+      registerControlRoutes(scope, store);
+      registerFileRoutes(scope, store);
+      registerSessionRoutes(scope, store);
+      scope.get("/members", async (request) => ({
+        members: store.members(authorizeDevice(store, request))
+      }));
+    };
+    server.register(projectRoutes, { prefix: "/api/v1/projects/:projectId" });
+    server.register(projectRoutes, { prefix: "/api/v1" });
+    server.post("/api/v1/bind", async (request) => {
+      const input = BindRequestSchema.parse(request.body);
+      return store.bind(request.headers.authorization, input.deviceId, input.projectId);
     });
   }
   if (options.webDir) registerWeb(server, options.webDir);