borgmcp-server 0.1.1 → 0.1.5

package/dist/store.js

@@ -1,11 +1,13 @@
-import { randomUUID } from "node:crypto";
+import { randomUUID, timingSafeEqual } from "node:crypto";
 import { statfsSync, statSync } from "node:fs";
 import { chmod, lstat, mkdir, open } from "node:fs/promises";
 import { dirname, join, parse, relative, resolve, sep } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { applyMigrations } from "./migrations.js";
+import { applyMigrations, assertMigrationsCurrent } from "./migrations.js";
 import { operatorErrors } from "./operator-error.js";
 import { assertCanonicalUuid, assertServerDerivedPrincipal, } from "./principal.js";
+import { patchRoleSectionText } from "./role-section.js";
+import { validateMessageTaxonomy } from "./message-taxonomy.js";
 export const DEFAULT_CUBE_LIMITS = Object.freeze({
     maxCubesPerClient: 100,
     maxCubesTotal: 1_000,
@@ -15,6 +17,15 @@ export const DEFAULT_STORAGE_LIMITS = Object.freeze({
     maxDatabaseBytes: 1_073_741_824,
     minFreeDiskBytes: 67_108_864,
 });
+export class InvitationCubeNotFoundError extends Error {
+}
+export class InvitationCubeAmbiguousError extends Error {
+    candidateIds;
+    constructor(candidateIds) {
+        super("Cube name is ambiguous.");
+        this.candidateIds = Object.freeze([...candidateIds]);
+    }
+}
 export class ScopedStoreError extends Error {
     code = "NOT_FOUND";
     constructor() {
@@ -22,6 +33,27 @@ export class ScopedStoreError extends Error {
         this.name = "ScopedStoreError";
     }
 }
+export class RoleConflictError extends Error {
+    code = "ROLE_ALREADY_EXISTS";
+    constructor() {
+        super("A role with that name already exists.");
+        this.name = "RoleConflictError";
+    }
+}
+export class DefaultRoleRequiredError extends Error {
+    code = "DEFAULT_ROLE_REQUIRED";
+    constructor() {
+        super("A cube must retain one default role.");
+        this.name = "DefaultRoleRequiredError";
+    }
+}
+export class RoleSectionConflictError extends Error {
+    code = "ROLE_SECTION_CONFLICT";
+    constructor() {
+        super("The role section patch conflicts with the current role text.");
+        this.name = "RoleSectionConflictError";
+    }
+}
 export class CursorExpiredError extends Error {
     code = "CURSOR_EXPIRED";
     constructor() {
@@ -29,11 +61,11 @@ export class CursorExpiredError extends Error {
         this.name = "CursorExpiredError";
     }
 }
-export class AttachConflictError extends Error {
-    code = "ATTACH_CONFLICT";
+export class AttachSessionRejectedError extends Error {
+    code = "SESSION_REJECTED";
     constructor() {
-        super("The attach request conflicts with an existing attachment.");
-        this.name = "AttachConflictError";
+        super("The saved session is not accepted for this seat.");
+        this.name = "AttachSessionRejectedError";
     }
 }
 export class StorageCapacityError extends Error {
@@ -100,8 +132,14 @@ export async function openStore(options) {
     });
     const clock = options.clock ?? (() => new Date());
     try {
-        configureDatabase(database);
-        applyMigrations(database);
+        if (options.migrationMode === "require-current") {
+            configureExistingDatabase(database);
+            assertMigrationsCurrent(database);
+        }
+        else {
+            configureDatabase(database);
+            applyMigrations(database);
+        }
     }
     catch (error) {
         database.close();
@@ -113,9 +151,10 @@ export async function openStore(options) {
         throw new Error("SQLite page size is unavailable.");
     }
     const capacityGuard = new StorageCapacityGuard(storageLimits, capacityProbe, requiredInteger(pageRow, "page_size"));
+    const activityHub = new ActivityHub();
     const maintenance = new SqliteMaintenanceStore(database, clock);
+    const liveness = new SqliteLivenessStore(database, clock, activityHub, capacityGuard);
     const credentials = new SqliteCredentialStore(database, clock, capacityGuard, options.mutationHook);
-    const activityHub = new ActivityHub();
     return Object.freeze({
         forPrincipal: (principal) => {
             assertServerDerivedPrincipal(principal);
@@ -123,6 +162,7 @@ export async function openStore(options) {
         },
         maintenance,
         credentials,
+        liveness,
         diagnostics: () => diagnostics(database),
         close: () => database.close(),
     });
@@ -230,7 +270,8 @@ class SqliteScopedStore {
     listCubes() {
         const scope = this.#scope("read");
         const rows = this.#database.prepare(`
-      SELECT c.id, c.owner_id, c.name, c.directive, c.created_at, c.updated_at
+      SELECT c.id, c.owner_id, c.name, c.directive, c.message_taxonomy,
+             c.created_at, c.updated_at
       FROM cubes AS c
       WHERE ${scope.sql}
       ORDER BY c.id
@@ -241,25 +282,43 @@ class SqliteScopedStore {
         assertCanonicalUuid(cubeId, "Cube id");
         const scope = this.#scope("read");
         const row = this.#database.prepare(`
-      SELECT c.id, c.owner_id, c.name, c.directive, c.created_at, c.updated_at
+      SELECT c.id, c.owner_id, c.name, c.directive, c.message_taxonomy,
+             c.created_at, c.updated_at
       FROM cubes AS c
       WHERE c.id = ? AND ${scope.sql}
     `).get(cubeId, ...scope.parameters);
         return row === undefined ? null : cubeRecord(cubeRow(row));
     }
     updateDirective(cubeId, directive) {
+        this.updateCube(cubeId, { directive });
+    }
+    updateCube(cubeId, input) {
         assertCanonicalUuid(cubeId, "Cube id");
-        validateDirective(directive);
+        if (input.directive === undefined && input.messageTaxonomy === undefined) {
+            throw new TypeError("At least one cube field is required.");
+        }
+        if (input.directive !== undefined)
+            validateDirective(input.directive);
+        const taxonomy = input.messageTaxonomy === undefined
+            ? undefined
+            : validateMessageTaxonomy(input.messageTaxonomy);
+        const serializedTaxonomy = taxonomy === undefined ? undefined : serializeTaxonomy(taxonomy);
         const scope = this.#scope("manage");
         this.#requireCube(cubeId, "manage");
-        this.#capacityGuard.assertCanGrow(Buffer.byteLength(directive));
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.directive ?? "") + Buffer.byteLength(serializedTaxonomy ?? ""));
         const result = this.#database.prepare(`
       UPDATE cubes AS c
-      SET directive = ?, updated_at = ?
+      SET directive = COALESCE(?, directive),
+          message_taxonomy = CASE WHEN ? = 1 THEN ? ELSE message_taxonomy END,
+          updated_at = ?
       WHERE c.id = ? AND ${scope.sql}
-    `).run(directive, this.#now(), cubeId, ...scope.parameters);
+    `).run(input.directive ?? null, serializedTaxonomy === undefined ? 0 : 1, serializedTaxonomy ?? null, this.#now(), cubeId, ...scope.parameters);
         if (result.changes !== 1)
             throw new ScopedStoreError();
+        const cube = this.getCube(cubeId);
+        if (cube === null)
+            throw new ScopedStoreError();
+        return cube;
     }
     appendActivity(cubeId, message) {
         const entry = this.appendLog(cubeId, { message });
@@ -293,21 +352,269 @@ class SqliteScopedStore {
     listRoles(cubeId) {
         this.#requireCube(cubeId, "read");
         const rows = this.#database.prepare(`
-      SELECT id, cube_id, name, short_description, is_default, is_human_seat,
-             role_class, created_at
+      SELECT id, cube_id, name, short_description, detailed_description,
+             is_default, is_mandatory, is_human_seat, can_broadcast,
+             receives_all_direct, role_class, created_at
       FROM roles WHERE cube_id = ? ORDER BY name, id
     `).all(cubeId);
         return rows.map(roleRecord);
     }
+    createRole(cubeId, input) {
+        assertCanonicalUuid(cubeId, "Cube id");
+        validateRoleName(input.name);
+        const shortDescription = input.shortDescription ?? "";
+        const detailedDescription = input.detailedDescription ?? "";
+        validateRoleShortDescription(shortDescription);
+        assertRoleTextWriteAllowed(detailedDescription);
+        for (const value of [
+            input.isDefault,
+            input.isMandatory,
+            input.isHumanSeat,
+            input.canBroadcast,
+            input.receivesAllDirect,
+        ]) {
+            if (value !== undefined && typeof value !== "boolean")
+                throw new TypeError("Role flags must be boolean.");
+        }
+        validateRoleClass(input.roleClass);
+        const isDefault = input.isDefault ?? false;
+        const isMandatory = input.isMandatory ?? false;
+        const isHumanSeat = input.isHumanSeat ?? false;
+        const canBroadcast = input.canBroadcast ?? false;
+        const receivesAllDirect = input.receivesAllDirect ?? false;
+        this.#requireCube(cubeId, "manage");
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.name) + Buffer.byteLength(shortDescription) +
+            Buffer.byteLength(detailedDescription) + 8_192);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            this.#requireCube(cubeId, "manage");
+            const duplicate = this.#database.prepare("SELECT 1 AS present FROM roles WHERE cube_id = ? AND name = ?").get(cubeId, input.name);
+            if (duplicate !== undefined)
+                throw new RoleConflictError();
+            if (isDefault) {
+                this.#database.prepare("UPDATE roles SET is_default = 0 WHERE cube_id = ? AND is_default = 1")
+                    .run(cubeId);
+                this.#mutationHook?.("role.demote-default");
+            }
+            const id = randomUUID();
+            this.#database.prepare(`
+        INSERT INTO roles (
+          id, cube_id, name, short_description, detailed_description,
+          is_default, is_mandatory, is_human_seat, can_broadcast,
+          receives_all_direct, role_class, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(id, cubeId, input.name, shortDescription, detailedDescription, booleanInteger(isDefault), booleanInteger(isMandatory), booleanInteger(isHumanSeat), booleanInteger(canBroadcast), booleanInteger(receivesAllDirect), input.roleClass ?? "worker", this.#now());
+            this.#mutationHook?.("role.insert");
+            const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(id, cubeId);
+            if (row === undefined)
+                throw new ScopedStoreError();
+            this.#database.exec("COMMIT");
+            this.#mutationHook?.("role.after-commit");
+            return roleRecord(row);
+        }
+        catch (error) {
+            try {
+                this.#database.exec("ROLLBACK");
+            }
+            catch { /* Preserve the original failure. */ }
+            throw error;
+        }
+    }
+    updateRole(cubeId, roleId, input) {
+        assertCanonicalUuid(cubeId, "Cube id");
+        assertCanonicalUuid(roleId, "Role id");
+        if (Object.values(input).every((value) => value === undefined)) {
+            throw new TypeError("At least one role field is required.");
+        }
+        if (input.name !== undefined)
+            validateRoleName(input.name);
+        if (input.shortDescription !== undefined)
+            validateRoleShortDescription(input.shortDescription);
+        if (input.detailedDescription !== undefined && typeof input.detailedDescription !== "string") {
+            throw new TypeError("Role detailed description must be text.");
+        }
+        for (const value of [
+            input.isDefault,
+            input.isMandatory,
+            input.isHumanSeat,
+            input.canBroadcast,
+            input.receivesAllDirect,
+        ]) {
+            if (value !== undefined && typeof value !== "boolean")
+                throw new TypeError("Role flags must be boolean.");
+        }
+        validateRoleClass(input.roleClass);
+        this.#requireCube(cubeId, "manage");
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.name ?? "") + Buffer.byteLength(input.shortDescription ?? "") +
+            Buffer.byteLength(input.detailedDescription ?? "") + 8_192);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            this.#requireCube(cubeId, "manage");
+            const existingRow = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (existingRow === undefined)
+                throw new ScopedStoreError();
+            const existing = roleRecord(existingRow);
+            if (input.isDefault === false && existing.is_default) {
+                throw new DefaultRoleRequiredError();
+            }
+            if (input.name !== undefined && input.name !== existing.name) {
+                const duplicate = this.#database.prepare("SELECT 1 AS present FROM roles WHERE cube_id = ? AND name = ? AND id <> ?").get(cubeId, input.name, roleId);
+                if (duplicate !== undefined)
+                    throw new RoleConflictError();
+            }
+            if (input.isDefault === true && !existing.is_default) {
+                this.#database.prepare("UPDATE roles SET is_default = 0 WHERE cube_id = ? AND is_default = 1")
+                    .run(cubeId);
+                this.#mutationHook?.("role.demote-default");
+            }
+            const nextDetailedDescription = input.detailedDescription ?? existing.detailed_description;
+            assertRoleTextWriteAllowed(nextDetailedDescription, existing.detailed_description);
+            this.#database.prepare(`
+        UPDATE roles SET
+          name = ?, short_description = ?, detailed_description = ?, is_default = ?,
+          is_mandatory = ?, is_human_seat = ?, can_broadcast = ?, receives_all_direct = ?,
+          role_class = ?
+        WHERE id = ? AND cube_id = ?
+      `).run(input.name ?? existing.name, input.shortDescription ?? existing.short_description, nextDetailedDescription, booleanInteger(input.isDefault ?? existing.is_default), booleanInteger(input.isMandatory ?? existing.is_mandatory), booleanInteger(input.isHumanSeat ?? existing.is_human_seat), booleanInteger(input.canBroadcast ?? existing.can_broadcast), booleanInteger(input.receivesAllDirect ?? existing.receives_all_direct), input.roleClass ?? existing.role_class, roleId, cubeId);
+            const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (row === undefined)
+                throw new ScopedStoreError();
+            this.#database.exec("COMMIT");
+            this.#mutationHook?.("role.after-commit");
+            return roleRecord(row);
+        }
+        catch (error) {
+            try {
+                this.#database.exec("ROLLBACK");
+            }
+            catch { /* Preserve the original failure. */ }
+            throw error;
+        }
+    }
+    patchRoleSection(cubeId, roleId, input) {
+        assertCanonicalUuid(cubeId, "Cube id");
+        assertCanonicalUuid(roleId, "Role id");
+        this.#requireCube(cubeId, "manage");
+        this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.heading) +
+            ("body" in input ? Buffer.byteLength(input.body) : 0) + 8_192);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            this.#requireCube(cubeId, "manage");
+            const existingRow = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (existingRow === undefined)
+                throw new ScopedStoreError();
+            const existing = roleRecord(existingRow);
+            let detailedDescription;
+            try {
+                detailedDescription = patchRoleSectionText(existing.detailed_description, input);
+            }
+            catch (error) {
+                if (error instanceof TypeError)
+                    throw error;
+                throw new RoleSectionConflictError();
+            }
+            assertRoleTextWriteAllowed(detailedDescription, existing.detailed_description);
+            this.#database.prepare("UPDATE roles SET detailed_description = ? WHERE id = ? AND cube_id = ?").run(detailedDescription, roleId, cubeId);
+            const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+            if (row === undefined)
+                throw new ScopedStoreError();
+            this.#database.exec("COMMIT");
+            this.#mutationHook?.("role.after-commit");
+            return roleRecord(row);
+        }
+        catch (error) {
+            try {
+                this.#database.exec("ROLLBACK");
+            }
+            catch { /* Preserve the original failure. */ }
+            throw error;
+        }
+    }
     listDrones(cubeId) {
         this.#requireCube(cubeId, "read");
         const rows = this.#database.prepare(`
-      SELECT id, cube_id, role_id, label, COALESCE(last_seen, created_at) AS last_seen,
-             hostname, created_at
-      FROM drones WHERE cube_id = ? AND evicted_at IS NULL ORDER BY label, id
+      SELECT drone.id, drone.cube_id, drone.role_id, drone.label,
+             COALESCE(drone.last_seen, drone.created_at) AS last_seen,
+             drone.hostname, drone.created_at,
+             CASE WHEN client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+               THEN 'participant' ELSE 'observer' END AS posture
+      FROM drones AS drone
+      LEFT JOIN clients AS client ON client.id = drone.client_id
+      LEFT JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL
+      ORDER BY drone.label, drone.id
     `).all(cubeId);
         return rows.map(droneRecord);
     }
+    listDronesSince(cubeId, since) {
+        this.#requireCube(cubeId, "read");
+        let createdAt;
+        let anchorId = null;
+        if (/^[0-9a-f]{8}-[0-9a-f-]{27}$/iu.test(since)) {
+            const anchor = this.#database.prepare("SELECT id, created_at FROM activity_log WHERE id = ? AND cube_id = ?").get(since, cubeId);
+            if (anchor === undefined)
+                throw new ScopedStoreError();
+            anchorId = requiredText(anchor, "id");
+            createdAt = requiredText(anchor, "created_at");
+        }
+        else {
+            validateTimestamp(since);
+            createdAt = since;
+        }
+        const rows = this.#database.prepare(`
+      SELECT drone.id, drone.cube_id, drone.role_id, drone.label,
+             COALESCE(drone.last_seen, drone.created_at) AS last_seen,
+             drone.hostname, drone.created_at,
+             CASE WHEN client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+               THEN 'participant' ELSE 'observer' END AS posture,
+             (SELECT MAX(post.created_at) FROM activity_log AS post
+              WHERE post.cube_id = drone.cube_id AND post.drone_id = drone.id) AS last_log_post_at,
+             EXISTS (SELECT 1 FROM activity_log AS response
+              WHERE response.cube_id = drone.cube_id AND response.drone_id = drone.id
+                AND (response.created_at > ? OR
+                   (? IS NOT NULL AND response.created_at = ? AND response.id > ?))) AS seen_since
+      FROM drones AS drone
+      LEFT JOIN clients AS client ON client.id = drone.client_id
+      LEFT JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL
+      ORDER BY drone.label, drone.id
+    `).all(createdAt, anchorId, createdAt, anchorId, cubeId);
+        return {
+            since: createdAt,
+            drones: rows.map((row) => ({
+                ...droneRecord(row),
+                last_log_post_at: nullableText(row, "last_log_post_at"),
+                seen_since: requiredInteger(row, "seen_since") === 1,
+            })),
+        };
+    }
     appendLog(cubeId, input) {
         assertCanonicalUuid(cubeId, "Cube id");
         if (input.message.length === 0 || Buffer.byteLength(input.message) > 10_240) {
@@ -353,11 +660,24 @@ class SqliteScopedStore {
       `).run(id, droneId, this.#principal.kind, this.#principal.id, input.message, createdAt, visibility, cubeId, ...scope.parameters);
             if (inserted.changes !== 1)
                 throw new ScopedStoreError();
+            if (droneId !== null) {
+                this.#database.prepare(`
+          UPDATE drones SET last_seen = ? WHERE id = ? AND cube_id = ? AND evicted_at IS NULL
+        `).run(createdAt, droneId, cubeId);
+                this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
+            }
             if (recipients.length > 0) {
                 const valid = this.#database.prepare(`
-          SELECT COUNT(*) AS count FROM drones
-          WHERE cube_id = ? AND evicted_at IS NULL
-            AND id IN (${recipients.map(() => "?").join(", ")})
+          SELECT COUNT(*) AS count
+          FROM drones AS recipient
+          JOIN clients AS recipient_client ON recipient_client.id = recipient.client_id
+          JOIN client_cube_grants AS recipient_grant
+            ON recipient_grant.client_id = recipient.client_id
+            AND recipient_grant.cube_id = recipient.cube_id
+          WHERE recipient.cube_id = ? AND recipient.evicted_at IS NULL
+            AND recipient_client.revoked_at IS NULL
+            AND recipient_grant.access IN ('write', 'manage')
+            AND recipient.id IN (${recipients.map(() => "?").join(", ")})
         `).get(cubeId, ...recipients);
                 if (valid === undefined)
                     throw new Error("Recipient count query returned no row.");
@@ -387,6 +707,7 @@ class SqliteScopedStore {
             throw new Error("Activity read limit must be an integer from 1 to 500.");
         }
         this.#validateCursor(cubeId, cursor);
+        const broadcastOnly = !this.#allowsDirectedWork(cubeId);
         const cursorSql = cursor === null
             ? { sql: "1 = 1", parameters: [] }
             : {
@@ -397,6 +718,7 @@ class SqliteScopedStore {
       SELECT l.id
       FROM activity_log AS l
       WHERE l.cube_id = ? AND ${cursorSql.sql}
+        AND (${broadcastOnly ? "l.visibility = 'broadcast'" : "1 = 1"})
       ORDER BY l.created_at, l.id
       LIMIT ?
     `).all(cubeId, ...cursorSql.parameters, limit + 1);
@@ -405,13 +727,15 @@ class SqliteScopedStore {
         const nextCursor = entries.length === 0
             ? cursor
             : { id: entries.at(-1).id, created_at: entries.at(-1).created_at };
-        const behind = nextCursor === null ? this.#countAfter(cubeId, null) : this.#countAfter(cubeId, nextCursor);
+        const behind = nextCursor === null
+            ? this.#countAfter(cubeId, null, broadcastOnly)
+            : this.#countAfter(cubeId, nextCursor, broadcastOnly);
         return {
             entries,
             cursor: nextCursor,
             behind_by: behind,
             has_more: behind > 0,
-            claims: this.#claims(cubeId),
+            claims: this.#claims(cubeId, broadcastOnly),
         };
     }
     acknowledge(cubeId, entryId, kind) {
@@ -419,18 +743,58 @@ class SqliteScopedStore {
         assertCanonicalUuid(entryId, "Activity entry id");
         if (kind !== "ack" && kind !== "claim")
             throw new Error("Unknown acknowledgement kind.");
-        const exists = this.#database.prepare("SELECT 1 AS present FROM activity_log WHERE id = ? AND cube_id = ?").get(entryId, cubeId);
-        if (exists === undefined)
+        const original = this.#database.prepare(`
+      SELECT drone_id, message, visibility FROM activity_log WHERE id = ? AND cube_id = ?
+    `).get(entryId, cubeId);
+        if (original === undefined)
             throw new ScopedStoreError();
         this.#capacityGuard.assertCanGrow(512);
         const claimant = this.#principal.kind === "drone-session"
             ? this.#principal.droneId
             : this.#principal.id;
-        this.#database.prepare(`
+        const ackAt = this.#now();
+        const inserted = this.#database.prepare(`
       INSERT OR IGNORE INTO activity_acks (
         entry_id, principal_kind, principal_id, kind, created_at, claimant_drone_id
       ) VALUES (?, ?, ?, ?, ?, ?)
-    `).run(entryId, this.#principal.kind, this.#principal.id, kind, this.#now(), claimant);
+    `).run(entryId, this.#principal.kind, this.#principal.id, kind, ackAt, claimant);
+        if (inserted.changes !== 1 || this.#principal.kind !== "drone-session")
+            return;
+        const claimantDroneId = this.#principal.droneId;
+        const actor = this.#database.prepare(`
+      SELECT drone.label, role.name AS role_name
+      FROM drones AS drone JOIN roles AS role ON role.id = drone.role_id
+      WHERE drone.id = ? AND drone.cube_id = ? AND drone.evicted_at IS NULL
+    `).get(claimantDroneId, cubeId);
+        const preview = activityPreview(requiredText(original, "message"));
+        const originalAuthor = nullableText(original, "drone_id");
+        const recipients = kind === "ack"
+            ? originalAuthor === null ? [] : [originalAuthor]
+            : this.#claimAudience(cubeId, entryId, requiredText(original, "visibility"))
+                .filter((droneId) => droneId !== claimantDroneId);
+        if (recipients.length === 0)
+            return;
+        const roleName = actor === undefined ? null : requiredText(actor, "role_name");
+        const notification = {
+            kind,
+            id: randomUUID(),
+            cube_id: cubeId,
+            drone_id: claimantDroneId,
+            drone_label: actor === undefined ? null : requiredText(actor, "label"),
+            role_name: roleName,
+            message: `[${kind.toUpperCase()}] ${preview}`,
+            created_at: ackAt,
+            visibility: "direct",
+            recipient_drone_ids: recipients,
+            log_entry_id: entryId,
+            ack_kind: kind,
+            ack_at: ackAt,
+            entry_preview: preview,
+            ...(kind === "ack"
+                ? { author_drone_id: recipients[0] }
+                : { claimant_drone_id: claimantDroneId, claimant_role: roleName }),
+        };
+        this.#activityHub.publish(cubeId, notification);
     }
     recordDecision(cubeId, input) {
         this.#requireCube(cubeId, "manage");
@@ -480,7 +844,6 @@ class SqliteScopedStore {
             throw new ScopedStoreError();
         assertCanonicalUuid(input.cubeId, "Cube id");
         assertCanonicalUuid(input.roleId, "Role id");
-        assertCanonicalUuid(input.retryKey, "Retry key");
         if (input.priorDroneId !== undefined)
             assertCanonicalUuid(input.priorDroneId, "Prior drone id");
         assertCanonicalUuid(input.droneId, "Drone id");
@@ -508,81 +871,95 @@ class SqliteScopedStore {
       `).get(input.cubeId, input.roleId, ...scope.parameters);
             if (roleRow === undefined)
                 throw new ScopedStoreError();
-            const retryBinding = this.#database.prepare(`
-        SELECT binding.cube_id AS binding_cube_id,
-               binding.requested_role_id AS binding_requested_role_id,
-               binding.prior_drone_id, drone.id, drone.label,
-               drone.attach_generation, drone.evicted_at
-        FROM seat_attach_bindings AS binding
-        JOIN drones AS drone ON drone.id = binding.drone_id
-        WHERE binding.client_id = ? AND binding.retry_key = ?
-      `).get(this.#principal.id, input.retryKey);
+            const bound = this.#database.prepare(`
+        SELECT credential.verifier_digest, credential.revoked_at AS credential_revoked_at,
+               session.id AS session_id, session.client_id, session.cube_id, session.drone_id,
+               session.expires_at, session.revoked_at AS session_revoked_at,
+               drone.role_id, drone.label, drone.evicted_at
+        FROM drone_session_credentials AS credential
+        JOIN drone_sessions AS session ON session.id = credential.session_id
+        JOIN drones AS drone ON drone.id = session.drone_id
+          AND drone.client_id = session.client_id AND drone.cube_id = session.cube_id
+        WHERE credential.lookup_digest = ?
+      `).get(input.credentialDigest.lookup);
+            if (bound !== undefined) {
+                const verifier = requiredBuffer(bound, "verifier_digest");
+                if (!timingSafeEqual(verifier, input.credentialDigest.verifier) ||
+                    optionalText(bound, "credential_revoked_at") !== null ||
+                    optionalText(bound, "session_revoked_at") !== null ||
+                    optionalText(bound, "evicted_at") !== null ||
+                    requiredText(bound, "expires_at") <= now ||
+                    requiredText(bound, "client_id") !== this.#principal.id ||
+                    requiredText(bound, "cube_id") !== input.cubeId ||
+                    requiredText(bound, "role_id") !== input.roleId ||
+                    (input.priorDroneId !== undefined &&
+                        requiredText(bound, "drone_id") !== input.priorDroneId)) {
+                    throw new AttachSessionRejectedError();
+                }
+                const droneId = requiredText(bound, "drone_id");
+                this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
+                this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
+                const attachedRoleRow = this.#database.prepare(`
+          SELECT id AS role_id, name AS role_name, role_class, is_human_seat
+          FROM roles WHERE id = ? AND cube_id = ?
+        `).get(requiredText(bound, "role_id"), input.cubeId);
+                if (attachedRoleRow === undefined)
+                    throw new Error("Attached drone role is unavailable.");
+                const roleClass = requiredText(attachedRoleRow, "role_class");
+                if (roleClass !== "queen" && roleClass !== "worker") {
+                    throw new Error("Database contains invalid role class.");
+                }
+                this.#database.exec("COMMIT");
+                return {
+                    cube: {
+                        id: requiredText(roleRow, "cube_id"),
+                        name: requiredText(roleRow, "cube_name"),
+                    },
+                    role: {
+                        id: requiredText(attachedRoleRow, "role_id"),
+                        name: requiredText(attachedRoleRow, "role_name"),
+                        role_class: roleClass,
+                        is_human_seat: requiredInteger(attachedRoleRow, "is_human_seat") === 1,
+                    },
+                    drone: { id: droneId, label: requiredText(bound, "label") },
+                    sessionId: requiredText(bound, "session_id"),
+                    expiresAt: requiredText(bound, "expires_at"),
+                    result: "reused",
+                };
+            }
+            const priorSeat = input.priorDroneId === undefined ? undefined : this.#database.prepare(`
+        SELECT id, role_id, label FROM drones
+        WHERE id = ? AND client_id = ? AND cube_id = ? AND evicted_at IS NULL
+      `).get(input.priorDroneId, this.#principal.id, input.cubeId);
             let droneId;
             let droneLabel;
-            let reattached;
-            let generation;
-            if (retryBinding !== undefined) {
-                if (optionalText(retryBinding, "evicted_at") != null)
-                    throw new ScopedStoreError();
-                if (requiredText(retryBinding, "binding_cube_id") !== input.cubeId ||
-                    requiredText(retryBinding, "binding_requested_role_id") !== input.roleId ||
-                    nullableText(retryBinding, "prior_drone_id") !== (input.priorDroneId ?? null)) {
-                    throw new AttachConflictError();
+            if (priorSeat !== undefined) {
+                const priorSeatId = requiredText(priorSeat, "id");
+                if (requiredText(priorSeat, "role_id") !== input.roleId) {
+                    throw new AttachSessionRejectedError();
                 }
-                droneId = requiredText(retryBinding, "id");
-                droneLabel = requiredText(retryBinding, "label");
-                generation = requiredInteger(retryBinding, "attach_generation") + 1;
-                this.#database.prepare(`
-          UPDATE drones SET last_seen = ?, attach_generation = ? WHERE id = ?
-        `).run(now, generation, droneId);
-                reattached = true;
+                const occupied = this.#database.prepare(`
+          SELECT 1 FROM drone_sessions AS session
+          JOIN drone_session_credentials AS credential ON credential.session_id = session.id
+          WHERE session.drone_id = ? AND session.client_id = ? AND session.cube_id = ?
+            AND session.revoked_at IS NULL AND credential.revoked_at IS NULL
+            AND session.expires_at > ?
+        `).get(priorSeatId, this.#principal.id, input.cubeId, now);
+                if (occupied !== undefined)
+                    throw new AttachSessionRejectedError();
+                droneId = priorSeatId;
+                droneLabel = requiredText(priorSeat, "label");
+                this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
             }
             else {
-                const priorSeat = input.priorDroneId === undefined ? undefined : this.#database.prepare(`
-          SELECT id, label, attach_generation
-          FROM drones
-          WHERE id = ? AND client_id = ? AND cube_id = ? AND evicted_at IS NULL
-        `).get(input.priorDroneId, this.#principal.id, input.cubeId);
-                if (priorSeat !== undefined) {
-                    droneId = requiredText(priorSeat, "id");
-                    droneLabel = requiredText(priorSeat, "label");
-                    generation = requiredInteger(priorSeat, "attach_generation") + 1;
-                    this.#database.prepare(`
-            UPDATE drones SET last_seen = ?, attach_generation = ? WHERE id = ?
-          `).run(now, generation, droneId);
-                    reattached = true;
-                }
-                else {
-                    droneId = input.droneId;
-                    droneLabel = seatLabel(requiredText(roleRow, "role_name"), droneId);
-                    this.#database.prepare(`
-            INSERT INTO drones (
-              id, cube_id, role_id, client_id, label, created_at, last_seen, retry_key,
-              attach_generation
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)
-          `).run(droneId, input.cubeId, input.roleId, this.#principal.id, droneLabel, now, now, input.retryKey);
-                    reattached = false;
-                    generation = 1;
-                }
-                this.#database.prepare(`
-          INSERT INTO seat_attach_bindings (
-            client_id, retry_key, cube_id, requested_role_id, drone_id, prior_drone_id, created_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?)
-        `).run(this.#principal.id, input.retryKey, input.cubeId, input.roleId, droneId, input.priorDroneId ?? null, now);
-            }
-            const oldSessions = this.#database.prepare("SELECT id FROM drone_sessions WHERE drone_id = ? AND client_id = ? AND cube_id = ?").all(droneId, this.#principal.id, input.cubeId)
-                .map((row) => requiredText(row, "id"));
-            if (oldSessions.length > 0) {
-                const placeholders = oldSessions.map(() => "?").join(", ");
-                this.#database.prepare(`
-          UPDATE drone_session_credentials SET revoked_at = ?
-          WHERE session_id IN (${placeholders}) AND revoked_at IS NULL
-        `).run(now, ...oldSessions);
+                droneId = input.droneId;
+                droneLabel = seatLabel(requiredText(roleRow, "role_name"), droneId);
                 this.#database.prepare(`
-          UPDATE drone_sessions SET revoked_at = ?
-          WHERE id IN (${placeholders}) AND revoked_at IS NULL
-        `).run(now, ...oldSessions);
+          INSERT INTO drones (id, cube_id, role_id, client_id, label, created_at, last_seen)
+          VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run(droneId, input.cubeId, input.roleId, this.#principal.id, droneLabel, now, now);
             }
+            this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
             this.#database.prepare(`
         INSERT INTO drone_sessions (
           id, client_id, cube_id, drone_id, created_at, expires_at
@@ -618,9 +995,7 @@ class SqliteScopedStore {
                 drone: { id: droneId, label: droneLabel },
                 sessionId: input.sessionId,
                 expiresAt: input.expiresAt,
-                generation,
-                reattached,
-                revokedSessionIds: oldSessions,
+                result: "created",
             };
         }
         catch (error) {
@@ -633,7 +1008,47 @@ class SqliteScopedStore {
     }
     subscribeActivity(cubeId, listener) {
         this.#requireCube(cubeId, "read");
-        return this.#activityHub.subscribe(cubeId, listener);
+        return this.#activityHub.subscribe(cubeId, (entry) => {
+            if ("kind" in entry) {
+                if (this.#principal.kind === "drone-session" &&
+                    entry.recipient_drone_ids.includes(this.#principal.droneId))
+                    listener(entry);
+                return;
+            }
+            if (entry.visibility === "broadcast" || this.#allowsDirectedWork(cubeId))
+                listener(entry);
+        });
+    }
+    #claimAudience(cubeId, entryId, visibility) {
+        if (visibility === "direct") {
+            return this.#database.prepare(`
+        SELECT recipient.drone_id
+        FROM activity_log_recipients AS recipient
+        JOIN drones AS drone ON drone.id = recipient.drone_id
+        JOIN clients AS client ON client.id = drone.client_id
+        JOIN client_cube_grants AS grant_row
+          ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+        WHERE recipient.entry_id = ? AND drone.cube_id = ? AND drone.evicted_at IS NULL
+          AND client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+        ORDER BY recipient.drone_id
+      `).all(entryId, cubeId).map((row) => requiredText(row, "drone_id"));
+        }
+        return this.#database.prepare(`
+      SELECT drone.id AS drone_id
+      FROM drones AS drone
+      JOIN clients AS client ON client.id = drone.client_id
+      JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL AND client.revoked_at IS NULL
+        AND grant_row.access IN ('write', 'manage')
+      ORDER BY drone.id
+    `).all(cubeId).map((row) => requiredText(row, "drone_id"));
+    }
+    #allowsDirectedWork(cubeId) {
+        const scope = this.#scope("write");
+        return this.#database.prepare(`
+      SELECT 1 AS allowed FROM cubes AS c WHERE c.id = ? AND ${scope.sql}
+    `).get(cubeId, ...scope.parameters) !== undefined;
     }
     #requireCube(cubeId, access) {
         assertCanonicalUuid(cubeId, "Cube id");
@@ -641,8 +1056,17 @@ class SqliteScopedStore {
         const row = this.#database.prepare(`
       SELECT 1 AS present FROM cubes AS c WHERE c.id = ? AND ${scope.sql}
     `).get(cubeId, ...scope.parameters);
-        if (row === undefined)
-            throw new ScopedStoreError();
+        if (row !== undefined)
+            return;
+        if (access === "manage") {
+            const visibleScope = this.#scope("read");
+            const visible = this.#database.prepare(`
+        SELECT 1 AS present FROM cubes AS c WHERE c.id = ? AND ${visibleScope.sql}
+      `).get(cubeId, ...visibleScope.parameters);
+            if (visible !== undefined)
+                throw new AccessDeniedError();
+        }
+        throw new ScopedStoreError();
     }
     #nextActivityTimestamp(cubeId) {
         const now = this.#clock().getTime();
@@ -697,12 +1121,14 @@ class SqliteScopedStore {
         if (valid === undefined)
             throw new ScopedStoreError();
     }
-    #countAfter(cubeId, cursor) {
+    #countAfter(cubeId, cursor, broadcastOnly) {
+        const visibility = broadcastOnly ? "AND visibility = 'broadcast'" : "";
         const row = cursor === null
-            ? this.#database.prepare("SELECT COUNT(*) AS count FROM activity_log WHERE cube_id = ?").get(cubeId)
+            ? this.#database.prepare(`SELECT COUNT(*) AS count FROM activity_log WHERE cube_id = ? ${visibility}`).get(cubeId)
             : this.#database.prepare(`
           SELECT COUNT(*) AS count FROM activity_log
           WHERE cube_id = ? AND (created_at > ? OR (created_at = ? AND id > ?))
+            ${visibility}
         `).get(cubeId, cursor.created_at, cursor.created_at, cursor.id);
         if (row === undefined)
             throw new Error("Activity count query returned no row.");
@@ -724,7 +1150,7 @@ class SqliteScopedStore {
     `).all(entryId);
         return enrichedActivityRecord(row, recipientRows.map((recipient) => requiredText(recipient, "drone_id")));
     }
-    #claims(cubeId) {
+    #claims(cubeId, broadcastOnly) {
         return this.#database.prepare(`
       SELECT acknowledgement.entry_id AS log_entry_id,
              acknowledgement.claimant_drone_id,
@@ -738,6 +1164,7 @@ class SqliteScopedStore {
       LEFT JOIN roles AS role ON role.id = drone.role_id AND role.cube_id = drone.cube_id
       WHERE entry.cube_id = ? AND acknowledgement.kind = 'claim'
         AND acknowledgement.claimant_drone_id IS NOT NULL
+        AND (${broadcastOnly ? "entry.visibility = 'broadcast'" : "1 = 1"})
       ORDER BY acknowledgement.created_at, acknowledgement.entry_id,
                acknowledgement.claimant_drone_id
     `).all(cubeId).map(claimRecord);
@@ -868,7 +1295,7 @@ class SqliteMaintenanceStore {
             for (const table of [
                 "cube_create_bindings", "activity_acks", "activity_log_recipients", "activity_log",
                 "decisions", "expired_activity_cursors", "drone_session_credentials", "drone_sessions",
-                "seat_attach_bindings", "drones", "roles", "client_cube_grants", "cubes", "client_server_capabilities",
+                "drones", "roles", "client_cube_grants", "cubes", "client_server_capabilities",
                 "enrollment_claims", "client_credentials", "owner_enrollment_state", "clients",
                 "enrollment_invitations",
             ])
@@ -1011,6 +1438,70 @@ class ActivityHub {
         }
     }
 }
+class SqliteLivenessStore {
+    database;
+    clock;
+    hub;
+    capacityGuard;
+    constructor(database, clock, hub, capacityGuard) {
+        this.database = database;
+        this.clock = clock;
+        this.hub = hub;
+        this.capacityGuard = capacityGuard;
+    }
+    scan(options = {}) {
+        const now = this.clock();
+        const silentBefore = new Date(now.getTime() - (options.silentMs ?? 600_000)).toISOString();
+        const cooldownBefore = new Date(now.getTime() - (options.cooldownMs ?? 600_000)).toISOString();
+        const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 25), 25));
+        const candidates = this.database.prepare(`
+      SELECT drone.id AS drone_id, drone.cube_id, COALESCE(state.attempts, 0) AS attempts
+      FROM drones AS drone
+      JOIN clients AS client ON client.id = drone.client_id AND client.revoked_at IS NULL
+      JOIN client_cube_grants AS grant_row ON grant_row.client_id = drone.client_id
+        AND grant_row.cube_id = drone.cube_id AND grant_row.access IN ('write', 'manage')
+      LEFT JOIN silent_seat_ping_state AS state ON state.drone_id = drone.id
+      WHERE drone.evicted_at IS NULL AND COALESCE(drone.last_seen, drone.created_at) < ?
+        AND COALESCE(state.attempts, 0) < 3
+        AND (state.last_ping_at IS NULL OR state.last_ping_at < ?)
+        AND EXISTS (SELECT 1 FROM drone_sessions AS session
+          WHERE session.drone_id = drone.id AND session.revoked_at IS NULL AND session.expires_at > ?)
+      ORDER BY COALESCE(drone.last_seen, drone.created_at), drone.id LIMIT ?
+    `).all(silentBefore, cooldownBefore, now.toISOString(), limit);
+        const published = [];
+        for (const candidate of candidates) {
+            const droneId = requiredText(candidate, "drone_id");
+            const cubeId = requiredText(candidate, "cube_id");
+            const message = "[HEARTBEAT-PING] No recent activity; confirm this seat is responsive.";
+            this.capacityGuard.assertCanGrow(256);
+            const id = randomUUID();
+            const createdAt = now.toISOString();
+            this.database.exec("BEGIN IMMEDIATE");
+            try {
+                this.database.prepare(`INSERT INTO silent_seat_ping_state (drone_id, attempts, last_ping_at)
+          VALUES (?, 1, ?) ON CONFLICT(drone_id) DO UPDATE
+          SET attempts = attempts + 1, last_ping_at = excluded.last_ping_at
+        `).run(droneId, now.toISOString());
+                this.database.exec("COMMIT");
+            }
+            catch (error) {
+                try {
+                    this.database.exec("ROLLBACK");
+                }
+                catch { /* Preserve original failure. */ }
+                throw error;
+            }
+            const entry = {
+                kind: "heartbeat_ping",
+                id, cube_id: cubeId, drone_id: null, message, visibility: "direct", created_at: createdAt,
+                drone_label: null, role_name: null, recipient_drone_ids: [droneId],
+            };
+            this.hub.publish(cubeId, entry);
+            published.push(entry);
+        }
+        return published;
+    }
+}
 class SqliteCredentialStore {
     #database;
     #clock;
@@ -1046,6 +1537,33 @@ class SqliteCredentialStore {
         validateTimestamp(input.expiresAt);
         this.#database.exec("BEGIN IMMEDIATE");
         try {
+            let scope = null;
+            if (input.cubeSelector !== undefined) {
+                if (input.purpose !== "client" || input.access === undefined) {
+                    throw new Error("Only client invitations may carry a complete cube scope.");
+                }
+                if (input.access !== "read" && input.access !== "write" && input.access !== "manage") {
+                    throw new Error("Unknown cube access grant.");
+                }
+                const rows = input.cubeSelector.kind === "id"
+                    ? this.#database.prepare("SELECT id, name FROM cubes WHERE id = ?").all(input.cubeSelector.value)
+                    : this.#database.prepare("SELECT id, name FROM cubes WHERE name = ? ORDER BY id").all(input.cubeSelector.value);
+                if (rows.length === 0)
+                    throw new InvitationCubeNotFoundError();
+                if (rows.length > 1) {
+                    throw new InvitationCubeAmbiguousError(rows.map((row) => requiredText(row, "id")));
+                }
+                const cubeId = requiredText(rows[0], "id");
+                assertCanonicalUuid(cubeId, "Resolved cube id");
+                scope = {
+                    cubeId,
+                    cubeName: requiredText(rows[0], "name"),
+                    access: input.access,
+                };
+            }
+            else if (input.access !== undefined) {
+                throw new Error("Invitation access requires a cube selector.");
+            }
             let ownerEpoch = null;
             if (input.purpose === "owner") {
                 const state = this.#database.prepare("SELECT epoch, claimed_client_id FROM owner_enrollment_state WHERE singleton = 1").get();
@@ -1070,10 +1588,12 @@ class SqliteCredentialStore {
             }
             this.#database.prepare(`
         INSERT INTO enrollment_invitations (
-          id, lookup_digest, verifier_digest, expires_at, created_at, purpose, owner_epoch
-        ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      `).run(input.id, input.digest.lookup, input.digest.verifier, input.expiresAt, this.#now(), input.purpose, ownerEpoch);
+          id, lookup_digest, verifier_digest, expires_at, created_at, purpose, owner_epoch,
+          cube_id, access
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(input.id, input.digest.lookup, input.digest.verifier, input.expiresAt, this.#now(), input.purpose, ownerEpoch, scope?.cubeId ?? null, scope?.access ?? null);
             this.#database.exec("COMMIT");
+            return scope;
         }
         catch (error) {
             try {
@@ -1093,7 +1613,7 @@ class SqliteCredentialStore {
              COALESCE(invitation.expires_at, '') AS expires_at,
              invitation.consumed_at, invitation.revoked_at,
              COALESCE(invitation.purpose, 'client') AS purpose,
-             invitation.owner_epoch
+             invitation.owner_epoch, invitation.cube_id, invitation.access
       FROM (SELECT 1) AS seed
       LEFT JOIN enrollment_invitations AS invitation ON invitation.lookup_digest = ?
     `).get(lookup);
@@ -1118,7 +1638,8 @@ class SqliteCredentialStore {
                COALESCE(invitation.purpose, 'client') AS purpose,
                invitation.owner_epoch,
                COALESCE(invitation.expires_at, '') AS expires_at,
-               invitation.consumed_at, invitation.revoked_at
+               invitation.consumed_at, invitation.revoked_at,
+               invitation.cube_id, invitation.access
         FROM (SELECT 1) AS seed
         LEFT JOIN enrollment_invitations AS invitation ON invitation.id = ?
       `).get(input.invitationId);
@@ -1166,6 +1687,12 @@ class SqliteCredentialStore {
             const ownerEpoch = invitation["owner_epoch"] === null
                 ? null
                 : requiredInteger(invitation, "owner_epoch");
+            const cubeId = nullableText(invitation, "cube_id");
+            const accessValue = nullableText(invitation, "access");
+            const access = accessValue === null ? null : cubeAccess(accessValue);
+            if ((cubeId === null) !== (access === null) || (cubeId !== null && purpose !== "client")) {
+                throw new Error("Invalid invitation cube scope.");
+            }
             if (purpose === "owner") {
                 const state = this.#database.prepare(`
           SELECT epoch, claimed_client_id FROM owner_enrollment_state WHERE singleton = 1
@@ -1176,6 +1703,10 @@ class SqliteCredentialStore {
                     return null;
                 }
             }
+            if (cubeId !== null && this.#database.prepare("SELECT 1 FROM cubes WHERE id = ?").get(cubeId) === undefined) {
+                this.#database.exec("ROLLBACK");
+                return null;
+            }
             this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.requestedClientName ?? "") + 8_192);
             this.#database.prepare("INSERT INTO clients (id, name, created_at) VALUES (?, ?, ?)").run(input.clientId, input.requestedClientName ?? "Local client", now);
             this.#mutationHook?.("enrollment.insert-client");
@@ -1192,6 +1723,13 @@ class SqliteCredentialStore {
         `).run(input.clientId, now);
                 this.#mutationHook?.("enrollment.insert-capability");
             }
+            if (cubeId !== null && access !== null) {
+                this.#database.prepare(`
+          INSERT INTO client_cube_grants (client_id, cube_id, access, created_at)
+          VALUES (?, ?, ?, ?)
+        `).run(input.clientId, cubeId, access, now);
+                this.#mutationHook?.("enrollment.insert-grant");
+            }
             this.#database.prepare(`
         INSERT INTO enrollment_claims (
           invitation_id, retry_key, client_id, requested_client_name,
@@ -1255,9 +1793,8 @@ class SqliteCredentialStore {
       SELECT credential.id, credential.lookup_digest, credential.verifier_digest,
              credential.session_id, session.client_id, session.cube_id, session.drone_id,
              session.expires_at,
-             COALESCE(
-               credential.revoked_at, session.revoked_at, client.revoked_at, drone.evicted_at
-             ) AS revoked_at
+             COALESCE(credential.revoked_at, session.revoked_at, client.revoked_at) AS revoked_at,
+             drone.evicted_at
       FROM drone_session_credentials AS credential
       JOIN drone_sessions AS session ON session.id = credential.session_id
       JOIN clients AS client ON client.id = session.client_id
@@ -1268,6 +1805,20 @@ class SqliteCredentialStore {
     `).get(lookup);
         return row === undefined ? null : storedDroneSessionDigest(row);
     }
+    findActiveDroneSessionExpiry(sessionId) {
+        assertCanonicalUuid(sessionId, "Drone session id");
+        const row = this.#database.prepare(`
+      SELECT session.expires_at
+      FROM drone_sessions AS session
+      JOIN clients AS client ON client.id = session.client_id
+      JOIN drones AS drone ON drone.id = session.drone_id
+        AND drone.client_id = session.client_id
+        AND drone.cube_id = session.cube_id
+      WHERE session.id = ? AND session.revoked_at IS NULL
+        AND client.revoked_at IS NULL AND drone.evicted_at IS NULL
+    `).get(sessionId);
+        return row === undefined ? null : requiredText(row, "expires_at");
+    }
     rotateClientCredential(input) {
         assertCanonicalUuid(input.clientId, "Client id");
         assertCanonicalUuid(input.credentialId, "Credential id");
@@ -1283,6 +1834,16 @@ class SqliteCredentialStore {
             this.#database.prepare(`
         UPDATE client_credentials SET revoked_at = ?
         WHERE client_id = ? AND revoked_at IS NULL
+      `).run(now, input.clientId);
+            this.#database.prepare(`
+        UPDATE drone_session_credentials SET revoked_at = ?
+        WHERE revoked_at IS NULL AND session_id IN (
+          SELECT id FROM drone_sessions WHERE client_id = ?
+        )
+      `).run(now, input.clientId);
+            this.#database.prepare(`
+        UPDATE drone_sessions SET revoked_at = ?
+        WHERE client_id = ? AND revoked_at IS NULL
       `).run(now, input.clientId);
             this.#database.prepare(`
         INSERT INTO client_credentials (
@@ -1332,9 +1893,7 @@ async function prepareDatabasePath(path) {
     if (path === ":memory:")
         throw new Error("The server store requires a file-backed database.");
     const databasePath = resolve(path);
-    const directory = dirname(databasePath);
-    await ensureDirectoryTree(directory);
-    await chmod(directory, 0o700);
+    const directory = await preparePrivateDataDirectory(dirname(databasePath));
     try {
         const handle = await open(databasePath, "ax", 0o600);
         await handle.close();
@@ -1352,6 +1911,12 @@ async function prepareDatabasePath(path) {
     await chmod(databasePath, 0o600);
     return databasePath;
 }
+export async function preparePrivateDataDirectory(path) {
+    const directory = resolve(path);
+    await ensureDirectoryTree(directory);
+    await chmod(directory, 0o700);
+    return directory;
+}
 async function ensureDirectoryTree(directory) {
     const { root } = parse(directory);
     let current = root;
@@ -1405,6 +1970,18 @@ function configureDatabase(database) {
         throw new Error("SQLite WAL mode is required.");
     }
 }
+function configureExistingDatabase(database) {
+    database.exec(`
+    PRAGMA foreign_keys = ON;
+    PRAGMA synchronous = FULL;
+    PRAGMA trusted_schema = OFF;
+    PRAGMA secure_delete = ON;
+    PRAGMA busy_timeout = 5000;
+  `);
+    if (readPragma(database, "journal_mode") !== "wal") {
+        throw new Error("SQLite WAL mode is required.");
+    }
+}
 function diagnostics(database) {
     const journalMode = readPragma(database, "journal_mode");
     const foreignKeys = readPragma(database, "foreign_keys");
@@ -1425,6 +2002,7 @@ function cubeRecord(row) {
         ownerId: row.owner_id,
         name: row.name,
         directive: row.directive,
+        messageTaxonomy: parseTaxonomy(row.message_taxonomy),
         createdAt: row.created_at,
         updatedAt: row.updated_at,
     };
@@ -1446,6 +2024,7 @@ function cubeRow(row) {
         owner_id: requiredText(row, "owner_id"),
         name: requiredText(row, "name"),
         directive: requiredText(row, "directive"),
+        message_taxonomy: nullableText(row, "message_taxonomy"),
         created_at: requiredText(row, "created_at"),
         updated_at: requiredText(row, "updated_at"),
     };
@@ -1523,8 +2102,12 @@ function roleRecord(row) {
         cube_id: requiredText(row, "cube_id"),
         name: requiredText(row, "name"),
         short_description: requiredText(row, "short_description"),
+        detailed_description: requiredText(row, "detailed_description"),
         is_default: requiredInteger(row, "is_default") === 1,
+        is_mandatory: requiredInteger(row, "is_mandatory") === 1,
         is_human_seat: requiredInteger(row, "is_human_seat") === 1,
+        can_broadcast: requiredInteger(row, "can_broadcast") === 1,
+        receives_all_direct: requiredInteger(row, "receives_all_direct") === 1,
         role_class: roleClass,
         created_at: requiredText(row, "created_at"),
     };
@@ -1538,6 +2121,10 @@ function createCubeRecord(row) {
     };
 }
 function droneRecord(row) {
+    const posture = requiredText(row, "posture");
+    if (posture !== "observer" && posture !== "participant") {
+        throw new Error("Database contains invalid drone posture.");
+    }
     return {
         id: requiredText(row, "id"),
         cube_id: requiredText(row, "cube_id"),
@@ -1545,6 +2132,7 @@ function droneRecord(row) {
         label: requiredText(row, "label"),
         last_seen: requiredText(row, "last_seen"),
         hostname: nullableText(row, "hostname"),
+        posture,
         created_at: requiredText(row, "created_at"),
     };
 }
@@ -1591,7 +2179,19 @@ function storedInvitationDigest(row) {
     }
     const epochValue = row["owner_epoch"];
     const ownerEpoch = epochValue === null ? null : requiredInteger(row, "owner_epoch");
-    return { ...digest, purpose, ownerEpoch };
+    const cubeId = nullableText(row, "cube_id");
+    const accessValue = nullableText(row, "access");
+    const access = accessValue === null ? null : cubeAccess(accessValue);
+    if ((cubeId === null) !== (access === null) || (cubeId !== null && purpose !== "client")) {
+        throw new Error("Database contains invalid invitation cube scope.");
+    }
+    return { ...digest, purpose, ownerEpoch, cubeId, access };
+}
+function cubeAccess(value) {
+    if (value !== "read" && value !== "write" && value !== "manage") {
+        throw new Error("Database contains invalid cube access.");
+    }
+    return value;
 }
 function enrollmentClaimResult(purpose, clientId) {
     return purpose === "owner"
@@ -1624,6 +2224,7 @@ function storedDroneSessionDigest(row) {
         cubeId: requiredText(row, "cube_id"),
         droneId: requiredText(row, "drone_id"),
         expiresAt: requiredText(row, "expires_at"),
+        evictedAt: nullableText(row, "evicted_at"),
     };
 }
 function requiredBuffer(row, key) {
@@ -1659,6 +2260,30 @@ function validatePresentationName(value) {
         throw new Error("Presentation name is invalid.");
     }
 }
+function validateRoleName(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 64) {
+        throw new Error("Role name must contain 1 to 64 characters.");
+    }
+}
+function validateRoleShortDescription(value) {
+    if (typeof value !== "string" || value.length > 1_024) {
+        throw new Error("Role short description must contain at most 1024 characters.");
+    }
+}
+export const MAX_ROLE_DETAILED_DESCRIPTION_CHARS = 51_200;
+export function assertRoleTextWriteAllowed(value, previous) {
+    if (typeof value !== "string")
+        throw new TypeError("Role detailed description must be text.");
+    if (value.length <= MAX_ROLE_DETAILED_DESCRIPTION_CHARS)
+        return;
+    if (previous !== undefined && previous.length > MAX_ROLE_DETAILED_DESCRIPTION_CHARS &&
+        value.length < previous.length)
+        return;
+    throw new RangeError("Role detailed description is too large.");
+}
+function booleanInteger(value) {
+    return value ? 1 : 0;
+}
 function validateBoundedText(value, name, maxBytes) {
     if (value.length === 0 || Buffer.byteLength(value) > maxBytes) {
         throw new Error(`${name} must contain 1 to ${maxBytes} bytes.`);
@@ -1678,6 +2303,33 @@ function validateDirective(value) {
         throw new Error("Cube directive exceeds 100000 bytes.");
     }
 }
+function activityPreview(message) {
+    return message.replace(/\s+/gu, " ").trim().slice(0, 200);
+}
+function validateRoleClass(value) {
+    if (value !== undefined && value !== "queen" && value !== "worker") {
+        throw new TypeError("Role class must be queen or worker.");
+    }
+}
+function serializeTaxonomy(value) {
+    if (value === null)
+        return null;
+    const serialized = JSON.stringify(value);
+    if (Buffer.byteLength(serialized) > 100_000) {
+        throw new RangeError("Message taxonomy exceeds 100000 bytes.");
+    }
+    return serialized;
+}
+function parseTaxonomy(value) {
+    if (value === null)
+        return null;
+    try {
+        return validateMessageTaxonomy(JSON.parse(value));
+    }
+    catch {
+        throw new Error("Database contains invalid message taxonomy.");
+    }
+}
 function validateDigest(digest) {
     validateLookup(digest.lookup);
     if (digest.verifier.length !== 32)