commonswarm 0.1.76 → 0.1.77

package/cswarm.cjs

@@ -65,6 +65,51 @@ var init_signal_duration = __esm({
   }
 });
 
+// src/cloud/config.ts
+function cloudTarget(url, anonKey) {
+  if (!url.trim()) {
+    throw new Error(
+      /* Not "who invited you" — self-serve signup is live and that reader has no inviter.
+       * See D-067 and the matching wording in current-target.ts. */
+      "--url is required: the service we run is https://api.commonswarm.com. A deployment uses its own base URL. Or start with cswarm accept --link-stdin because invite links carry the Cloud target; scripts and CI may pass --url and --anon-key or set SWARM_CLOUD_URL and SWARM_CLOUD_ANON_KEY."
+    );
+  }
+  const parsed = new URL(url);
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("--url must use http or https");
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error("--url must not contain credentials, a query, or a fragment");
+  }
+  if (parsed.pathname !== "/" && parsed.pathname !== "") {
+    throw new Error("--url must be the service base URL, with no path");
+  }
+  if (!anonKey.trim()) throw new Error("--anon-key is required");
+  const normalized = parsed.origin;
+  return {
+    url: normalized,
+    anonKey: anonKey.trim(),
+    profileId: (0, import_node_crypto.createHash)("sha256").update(normalized).digest("hex").slice(0, 24)
+  };
+}
+function commandEndpoint(target2) {
+  return `${target2.url}/functions/v1/command`;
+}
+function readEndpoint(target2) {
+  return `${target2.url}/functions/v1/read`;
+}
+function authStorageKey(target2) {
+  return `cswarm-${target2.profileId}-auth`;
+}
+var import_node_crypto, CLIENT_PROTOCOL_VERSION;
+var init_config = __esm({
+  "src/cloud/config.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    CLIENT_PROTOCOL_VERSION = "0.1.0";
+  }
+});
+
 // src/cloud/signal-limits.ts
 var SIGNAL_BODY_MAX, SIGNAL_ABOUT_MAX, SIGNAL_RECIPIENT_MAX;
 var init_signal_limits = __esm({
@@ -133,51 +178,6 @@ var init_agent_onboarding_contract = __esm({
   }
 });
 
-// src/cloud/config.ts
-function cloudTarget(url, anonKey) {
-  if (!url.trim()) {
-    throw new Error(
-      /* Not "who invited you" — self-serve signup is live and that reader has no inviter.
-       * See D-067 and the matching wording in current-target.ts. */
-      "--url is required: the service we run is https://api.commonswarm.com. A deployment uses its own base URL. Or start with cswarm accept --link-stdin because invite links carry the Cloud target; scripts and CI may pass --url and --anon-key or set SWARM_CLOUD_URL and SWARM_CLOUD_ANON_KEY."
-    );
-  }
-  const parsed = new URL(url);
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error("--url must use http or https");
-  }
-  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error("--url must not contain credentials, a query, or a fragment");
-  }
-  if (parsed.pathname !== "/" && parsed.pathname !== "") {
-    throw new Error("--url must be the service base URL, with no path");
-  }
-  if (!anonKey.trim()) throw new Error("--anon-key is required");
-  const normalized = parsed.origin;
-  return {
-    url: normalized,
-    anonKey: anonKey.trim(),
-    profileId: (0, import_node_crypto.createHash)("sha256").update(normalized).digest("hex").slice(0, 24)
-  };
-}
-function commandEndpoint(target2) {
-  return `${target2.url}/functions/v1/command`;
-}
-function readEndpoint(target2) {
-  return `${target2.url}/functions/v1/read`;
-}
-function authStorageKey(target2) {
-  return `cswarm-${target2.profileId}-auth`;
-}
-var import_node_crypto, CLIENT_PROTOCOL_VERSION;
-var init_config = __esm({
-  "src/cloud/config.ts"() {
-    "use strict";
-    import_node_crypto = require("node:crypto");
-    CLIENT_PROTOCOL_VERSION = "0.1.0";
-  }
-});
-
 // src/cloud/agent-credential-input.ts
 function sourceName(source) {
   return source.kind === "file" ? `agent credential file ${source.path}` : "agent credential input from stdin";
@@ -255,7 +255,7 @@ function parseAgentCredentialInput(value, source) {
     invalidKeys.push("status");
   }
   for (const key2 of ["principal_id", "token_id", "run_id"]) {
-    if (Object.hasOwn(artifact, key2) && (typeof artifact[key2] !== "string" || !UUID_RE.test(artifact[key2]))) {
+    if (Object.hasOwn(artifact, key2) && (typeof artifact[key2] !== "string" || !UUID_RE2.test(artifact[key2]))) {
       invalidKeys.push(key2);
     }
   }
@@ -291,11 +291,11 @@ function parseAgentCredentialInput(value, source) {
     durable: true
   };
 }
-var UUID_RE, AGENT_TOKEN_RE, AGENT_CREDENTIAL_MESSAGE, AGENT_CREDENTIAL_MESSAGE_D088, ACCEPTED_AGENT_CREDENTIAL_MESSAGES, AgentCredentialInputError, AGENT_CREDENTIAL_REQUIRED_FIELDS, AGENT_CREDENTIAL_OPTIONAL_FIELDS, ALLOWED_ARTIFACT_KEYS;
+var UUID_RE2, AGENT_TOKEN_RE, AGENT_CREDENTIAL_MESSAGE, AGENT_CREDENTIAL_MESSAGE_D088, ACCEPTED_AGENT_CREDENTIAL_MESSAGES, AgentCredentialInputError, AGENT_CREDENTIAL_REQUIRED_FIELDS, AGENT_CREDENTIAL_OPTIONAL_FIELDS, ALLOWED_ARTIFACT_KEYS;
 var init_agent_credential_input = __esm({
   "src/cloud/agent-credential-input.ts"() {
     "use strict";
-    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     AGENT_TOKEN_RE = /^swm_agt_[A-Za-z0-9_-]{43}$/;
     AGENT_CREDENTIAL_MESSAGE = "Agent credential minted. It is bound to this task and run so the agent's work stays scoped and attributable.";
     AGENT_CREDENTIAL_MESSAGE_D088 = "Agent credential minted. It is bound to this run, so the agent's work is attributable to it.";
@@ -412,7 +412,7 @@ function parseRecord(raw) {
   } catch {
     throw new Error("stored credential record is malformed");
   }
-  if (value.version !== 1 || typeof value.refreshToken !== "string" || value.refreshToken.length < 8 || value.refreshToken.length > 2048 || /[|\u0000-\u001f\u007f]/.test(value.refreshToken) || !Number.isSafeInteger(value.generation) || (value.generation ?? -1) < 0 || typeof value.deviceId !== "string" || !UUID_RE2.test(value.deviceId) || typeof value.userId !== "string" || !UUID_RE2.test(value.userId)) {
+  if (value.version !== 1 || typeof value.refreshToken !== "string" || value.refreshToken.length < 8 || value.refreshToken.length > 2048 || /[|\u0000-\u001f\u007f]/.test(value.refreshToken) || !Number.isSafeInteger(value.generation) || (value.generation ?? -1) < 0 || typeof value.deviceId !== "string" || !UUID_RE3.test(value.deviceId) || typeof value.userId !== "string" || !UUID_RE3.test(value.userId)) {
     throw new Error("stored credential record is malformed");
   }
   return value;
@@ -452,7 +452,7 @@ function parseProfile(raw) {
     throw new Error("stored credential profile is malformed");
   }
   const pending = value.pendingCommands;
-  if (value.version !== 1 || !(value.userId === null || typeof value.userId === "string" && UUID_RE2.test(value.userId)) || !(value.workspaceId === null || typeof value.workspaceId === "string" && UUID_RE2.test(value.workspaceId)) || !(value.email === void 0 || value.email === null || typeof value.email === "string" && value.email.length >= 3 && value.email.length <= 320 && !/[\u0000-\u001f\u007f-\u009f]/.test(value.email)) || !(value.principalId === void 0 || value.principalId === null || typeof value.principalId === "string" && UUID_RE2.test(value.principalId)) || !(value.principalName === void 0 || value.principalName === null || typeof value.principalName === "string" && value.principalName.length >= 1 && value.principalName.length <= 80 && /^[a-z0-9._@-]+$/.test(value.principalName)) || !pending || typeof pending !== "object" || Array.isArray(pending) || Object.keys(pending).length > MAX_PENDING_COMMANDS) {
+  if (value.version !== 1 || !(value.userId === null || typeof value.userId === "string" && UUID_RE3.test(value.userId)) || !(value.workspaceId === null || typeof value.workspaceId === "string" && UUID_RE3.test(value.workspaceId)) || !(value.email === void 0 || value.email === null || typeof value.email === "string" && value.email.length >= 3 && value.email.length <= 320 && !/[\u0000-\u001f\u007f-\u009f]/.test(value.email)) || !(value.principalId === void 0 || value.principalId === null || typeof value.principalId === "string" && UUID_RE3.test(value.principalId)) || !(value.principalName === void 0 || value.principalName === null || typeof value.principalName === "string" && value.principalName.length >= 1 && value.principalName.length <= 80 && /^[a-z0-9._@-]+$/.test(value.principalName)) || !pending || typeof pending !== "object" || Array.isArray(pending) || Object.keys(pending).length > MAX_PENDING_COMMANDS) {
     throw new Error("stored credential profile is malformed");
   }
   for (const [intentHash2, record3] of Object.entries(pending)) {
@@ -669,7 +669,7 @@ async function credentialStore(options) {
   return new SecureFileStore(stateDirectory2, options.target.profileId, warn);
 }
 async function agentSignalPendingStore(options) {
-  if (!UUID_RE2.test(options.principalId)) {
+  if (!UUID_RE3.test(options.principalId)) {
     throw new Error("agent principal id must be a UUID");
   }
   const configured = options.stateDirectory ?? process.env.SWARM_AGENT_STATE_DIR ?? (process.env.XDG_STATE_HOME ? (0, import_node_path.join)(process.env.XDG_STATE_HOME, "cswarm", "agent-pending") : (0, import_node_path.join)((0, import_node_os.homedir)(), ".cswarm", "agent-state"));
@@ -686,7 +686,7 @@ async function agentSignalPendingStore(options) {
   });
   return store2;
 }
-var import_node_fs, import_promises, import_node_os, import_node_path, import_node_crypto2, import_node_child_process, import_promises2, KEYCHAIN_SERVICE, LOCK_STALE_MS, LOCK_TIMEOUT_MS, MAX_KEYCHAIN_RECORD_BYTES, MAX_PROFILE_BYTES, MAX_PENDING_COMMANDS, UUID_RE2, COMMAND_ID_RE, SHA256_RE, FALLBACK_WARNING, StoredRecordOversizedError, FileLockTimeoutError, heldFileLocks, heldFileLockExitHookInstalled, LockedCredentialStore, MacKeychainStore, SecureFileStore;
+var import_node_fs, import_promises, import_node_os, import_node_path, import_node_crypto2, import_node_child_process, import_promises2, KEYCHAIN_SERVICE, LOCK_STALE_MS, LOCK_TIMEOUT_MS, MAX_KEYCHAIN_RECORD_BYTES, MAX_PROFILE_BYTES, MAX_PENDING_COMMANDS, UUID_RE3, COMMAND_ID_RE, SHA256_RE, FALLBACK_WARNING, StoredRecordOversizedError, FileLockTimeoutError, heldFileLocks, heldFileLockExitHookInstalled, LockedCredentialStore, MacKeychainStore, SecureFileStore;
 var init_storage = __esm({
   "src/cloud/storage.ts"() {
     "use strict";
@@ -703,7 +703,7 @@ var init_storage = __esm({
     MAX_KEYCHAIN_RECORD_BYTES = 126;
     MAX_PROFILE_BYTES = 64 * 1024;
     MAX_PENDING_COMMANDS = 32;
-    UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     COMMAND_ID_RE = /^[A-Za-z0-9_-]{8,72}$/;
     SHA256_RE = /^[0-9a-f]{64}$/;
     FALLBACK_WARNING = "\u26A0 no OS keychain found. Storing the rotating refresh credential in a 0600 file under a 0700 directory. This is less protected than a keychain.";
@@ -863,9 +863,9 @@ function parseAgentCredentialRecord(raw) {
   } catch {
     throw new Error("stored agent credential record is malformed");
   }
-  if (value.version !== 1 || !(value.token === null || typeof value.token === "string" && AGENT_TOKEN_RE2.test(value.token)) || !(value.tokenId === null || typeof value.tokenId === "string" && UUID_RE3.test(value.tokenId)) || !(value.principalId === null || typeof value.principalId === "string" && UUID_RE3.test(value.principalId)) || !(value.runId === null || typeof value.runId === "string" && UUID_RE3.test(value.runId)) || // A record naming a secret must name the token it belongs to, and vice versa; half of
+  if (value.version !== 1 || !(value.token === null || typeof value.token === "string" && AGENT_TOKEN_RE2.test(value.token)) || !(value.tokenId === null || typeof value.tokenId === "string" && UUID_RE4.test(value.tokenId)) || !(value.principalId === null || typeof value.principalId === "string" && UUID_RE4.test(value.principalId)) || !(value.runId === null || typeof value.runId === "string" && UUID_RE4.test(value.runId)) || // A record naming a secret must name the token it belongs to, and vice versa; half of
   // an identity is a record no reader can check the lineage of.
-  value.token === null !== (value.tokenId === null) || !(value.rootTokenId === null || typeof value.rootTokenId === "string" && UUID_RE3.test(value.rootTokenId)) || !Number.isSafeInteger(value.generation) || (value.generation ?? -1) < 0 || !Number.isSafeInteger(value.issuedAt) || (value.issuedAt ?? -1) < 0 || !(value.expiresAt === null || Number.isSafeInteger(value.expiresAt) && (value.expiresAt ?? -1) >= 0) || // A live successor with no deadline could never be renewed on time.
+  value.token === null !== (value.tokenId === null) || !(value.rootTokenId === null || typeof value.rootTokenId === "string" && UUID_RE4.test(value.rootTokenId)) || !Number.isSafeInteger(value.generation) || (value.generation ?? -1) < 0 || !Number.isSafeInteger(value.issuedAt) || (value.issuedAt ?? -1) < 0 || !(value.expiresAt === null || Number.isSafeInteger(value.expiresAt) && (value.expiresAt ?? -1) >= 0) || // A live successor with no deadline could never be renewed on time.
   value.token !== null && value.expiresAt === null || !(value.horizonExpiresAt === null || Number.isSafeInteger(value.horizonExpiresAt) && (value.horizonExpiresAt ?? -1) >= 0) || !(value.successorsRemaining === null || Number.isSafeInteger(value.successorsRemaining) && (value.successorsRemaining ?? -1) >= 0) || !isPendingRenewal(value.pendingRenewal)) {
     throw new Error("stored agent credential record is malformed");
   }
@@ -907,7 +907,7 @@ async function agentCredentialStore(options) {
     }
   };
 }
-var import_node_crypto3, import_node_os2, import_node_path2, UUID_RE3, AGENT_TOKEN_RE2, MAX_RECORD_BYTES;
+var import_node_crypto3, import_node_os2, import_node_path2, UUID_RE4, AGENT_TOKEN_RE2, MAX_RECORD_BYTES;
 var init_agent_credential = __esm({
   "src/cloud/agent-credential.ts"() {
     "use strict";
@@ -915,7 +915,7 @@ var init_agent_credential = __esm({
     import_node_os2 = require("node:os");
     import_node_path2 = require("node:path");
     init_storage();
-    UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     AGENT_TOKEN_RE2 = /^swm_agt_[A-Za-z0-9_-]{43}$/;
     MAX_RECORD_BYTES = 4 * 1024;
   }
@@ -936,14 +936,14 @@ function nullableTimestamp(value, field) {
   }
   return text;
 }
-function uuid(value, field) {
-  if (typeof value !== "string" || !UUID_RE4.test(value)) {
+function uuid2(value, field) {
+  if (typeof value !== "string" || !UUID_RE5.test(value)) {
     throw new Error(`renewal grant read returned malformed ${field}`);
   }
   return value.toLowerCase();
 }
 function nullableUuid(value, field) {
-  return value === null ? null : uuid(value, field);
+  return value === null ? null : uuid2(value, field);
 }
 function parseGrant(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -961,8 +961,8 @@ function parseGrant(value) {
     throw new Error("renewal grant read returned an invalid kind/horizon pair");
   }
   return {
-    renewal_grant_id: uuid(row.renewal_grant_id, "renewal_grant_id"),
-    principal_id: uuid(row.principal_id, "principal_id"),
+    renewal_grant_id: uuid2(row.renewal_grant_id, "renewal_grant_id"),
+    principal_id: uuid2(row.principal_id, "principal_id"),
     kind: row.kind,
     horizon_expires_at: horizon,
     bound_device_id: nullableUuid(row.bound_device_id, "bound_device_id"),
@@ -1037,12 +1037,12 @@ function describeRenewalGrant(grant) {
   }
   return lines;
 }
-var UUID_RE4, STANDING_IDLE_PAUSE_DAYS, STANDING_RESUME_ACTORS, STANDING_RESUME_ACTORS_SENTENCE, STANDING_GRANT_RULES;
+var UUID_RE5, STANDING_IDLE_PAUSE_DAYS, STANDING_RESUME_ACTORS, STANDING_RESUME_ACTORS_SENTENCE, STANDING_GRANT_RULES;
 var init_renewal_grants = __esm({
   "src/cloud/renewal-grants.ts"() {
     "use strict";
     init_config();
-    UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     STANDING_IDLE_PAUSE_DAYS = 14;
     STANDING_RESUME_ACTORS = [
       "a workspace owner",
@@ -1207,10 +1207,10 @@ async function requestSuccessor(options) {
       throw new RenewalMalformedResponseError("renewal response was not valid JSON");
     }
   }
-  if (options.listenerMode && response.status !== 401 && response.status !== 403 && body2.principal_id !== void 0 && body2.principal_id !== null && (typeof body2.principal_id !== "string" || !UUID_RE5.test(body2.principal_id))) {
+  if (options.listenerMode && response.status !== 401 && response.status !== 403 && body2.principal_id !== void 0 && body2.principal_id !== null && (typeof body2.principal_id !== "string" || !UUID_RE6.test(body2.principal_id))) {
     throw new RenewalMalformedResponseError("renewal response carried a malformed principal_id");
   }
-  const principalId = typeof body2.principal_id === "string" && UUID_RE5.test(body2.principal_id) ? body2.principal_id.toLowerCase() : null;
+  const principalId = typeof body2.principal_id === "string" && UUID_RE6.test(body2.principal_id) ? body2.principal_id.toLowerCase() : null;
   if (response.status === 401 || response.status === 403) {
     if (options.listenerMode) {
       if (response.status === 401 && body2.error === "unauthenticated") {
@@ -1337,7 +1337,7 @@ async function requestSuccessor(options) {
   }
   const tokenId = typeof body2.token_id === "string" ? body2.token_id : "";
   const runId = typeof body2.run_id === "string" ? body2.run_id : "";
-  if (!UUID_RE5.test(tokenId) || !UUID_RE5.test(runId) || principalId === null) {
+  if (!UUID_RE6.test(tokenId) || !UUID_RE6.test(runId) || principalId === null) {
     if (!options.listenerMode) throw new RenewalRefused(
       response.status,
       "incomplete_successor",
@@ -1409,7 +1409,7 @@ async function requestSuccessor(options) {
     ...wake === void 0 ? {} : { wake }
   };
 }
-var import_node_crypto4, AGENT_TOKEN_DEFAULT_TTL_MS, AGENT_TOKEN_MAX_TTL_MS, RENEWAL_HORIZON_DEFAULT_MS, RENEWAL_HORIZON_MAX_MS, RENEWAL_LEAD_FRACTION, RENEWAL_LEAD_FLOOR_MS, RENEWAL_LEAD_CEILING_MS, RENEWAL_PENDING_RECOVERY_MS, RENEW_TIMEOUT_MS, UUID_RE5, AGENT_TOKEN_RE3, RenewalReauthorisationRequired, RenewalRevoked, RenewalSuspended, RenewalUnsupported, RenewalSuperseded, RenewalOutcomeUnknown, RenewalMalformedResponseError, RenewalCredentialCheckError, RenewalRetryError, RenewalRefused, RenewalUpgradeRequiredError, RENEWAL_UPGRADE_LISTENER_ACTION, RENEWAL_UPGRADE_COMMAND_ACTION, REVOCATION_REASONS_LIST, REVOCATION_REASONS, REVOKED_MESSAGE, LOCALLY_EXPIRED_MESSAGE, UNEXPLAINED_REFUSAL_MESSAGE, AgentCredentialSession;
+var import_node_crypto4, AGENT_TOKEN_DEFAULT_TTL_MS, AGENT_TOKEN_MAX_TTL_MS, RENEWAL_HORIZON_DEFAULT_MS, RENEWAL_HORIZON_MAX_MS, RENEWAL_LEAD_FRACTION, RENEWAL_LEAD_FLOOR_MS, RENEWAL_LEAD_CEILING_MS, RENEWAL_PENDING_RECOVERY_MS, RENEW_TIMEOUT_MS, UUID_RE6, AGENT_TOKEN_RE3, RenewalReauthorisationRequired, RenewalRevoked, RenewalSuspended, RenewalUnsupported, RenewalSuperseded, RenewalOutcomeUnknown, RenewalMalformedResponseError, RenewalCredentialCheckError, RenewalRetryError, RenewalRefused, RenewalUpgradeRequiredError, RENEWAL_UPGRADE_LISTENER_ACTION, RENEWAL_UPGRADE_COMMAND_ACTION, REVOCATION_REASONS_LIST, REVOCATION_REASONS, REVOKED_MESSAGE, LOCALLY_EXPIRED_MESSAGE, UNEXPLAINED_REFUSAL_MESSAGE, AgentCredentialSession;
 var init_renewal = __esm({
   "src/cloud/renewal.ts"() {
     "use strict";
@@ -1426,7 +1426,7 @@ var init_renewal = __esm({
     RENEWAL_LEAD_CEILING_MS = 15 * 6e4;
     RENEWAL_PENDING_RECOVERY_MS = 60 * 6e4;
     RENEW_TIMEOUT_MS = 3e4;
-    UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     AGENT_TOKEN_RE3 = /^swm_agt_[A-Za-z0-9_-]{43}$/;
     RenewalReauthorisationRequired = class extends Error {
       constructor(reason, principalId, message) {
@@ -3575,7 +3575,7 @@ function parseSessionContext(raw) {
   const releasedAt = parseReleasedAt(row.released_at);
   const sessionKey = typeof row.session_key === "string" ? row.session_key : null;
   const keyOk = sessionKey !== null && (releasedAt !== null ? sessionKey === "" || isSessionKey(sessionKey) : isSessionKey(sessionKey));
-  if (row.version !== SESSION_CONTEXT_VERSION || typeof row.url !== "string" || !URL_RE.test(row.url) || typeof row.profile_id !== "string" || !/^[0-9a-f]{24}$/.test(row.profile_id) || typeof row.workspace_id !== "string" || !UUID_RE6.test(row.workspace_id) || typeof row.principal_id !== "string" || !UUID_RE6.test(row.principal_id) || typeof row.session_id !== "string" || !isSessionUuid(row.session_id) || typeof row.generation !== "number" || !Number.isSafeInteger(row.generation) || row.generation < 0 || sessionKey === null || !keyOk || provider === null || mode3 === null || typeof row.host_session_id !== "string" || row.host_session_id.length < 1 || row.host_session_id.length > 200 || typeof row.token_file !== "string" || !(0, import_node_path3.isAbsolute)(row.token_file) || typeof row.acquire_command_id !== "string" || !/^[A-Za-z0-9_-]{8,72}$/.test(row.acquire_command_id) || !(row.host_label === null || typeof row.host_label === "string" && row.host_label.length <= 120) || releasedAt === void 0) {
+  if (row.version !== SESSION_CONTEXT_VERSION || typeof row.url !== "string" || !URL_RE.test(row.url) || typeof row.profile_id !== "string" || !/^[0-9a-f]{24}$/.test(row.profile_id) || typeof row.workspace_id !== "string" || !UUID_RE7.test(row.workspace_id) || typeof row.principal_id !== "string" || !UUID_RE7.test(row.principal_id) || typeof row.session_id !== "string" || !isSessionUuid(row.session_id) || typeof row.generation !== "number" || !Number.isSafeInteger(row.generation) || row.generation < 0 || sessionKey === null || !keyOk || provider === null || mode3 === null || typeof row.host_session_id !== "string" || row.host_session_id.length < 1 || row.host_session_id.length > 200 || typeof row.token_file !== "string" || !(0, import_node_path3.isAbsolute)(row.token_file) || typeof row.acquire_command_id !== "string" || !/^[A-Za-z0-9_-]{8,72}$/.test(row.acquire_command_id) || !(row.host_label === null || typeof row.host_label === "string" && row.host_label.length <= 120) || releasedAt === void 0) {
     throw new SessionContextError(
       "session_context_corrupt",
       "session context fields are malformed"
@@ -3937,7 +3937,7 @@ async function releaseSessionReceiverLockIfHeld(contextPath, pid = process.pid)
   if (existing === null || existing.pid !== pid) return;
   await (0, import_promises3.unlink)(lockPath).catch(() => void 0);
 }
-var import_node_crypto7, import_promises3, import_node_os3, import_node_path3, UUID_RE6, MAX_CONTEXT_BYTES, URL_RE, SessionContextError, SESSION_ACQUIRE_BINDING_FIELDS, SESSION_RECEIVER_KINDS, RECEIVER_LOCK_MAX_BYTES;
+var import_node_crypto7, import_promises3, import_node_os3, import_node_path3, UUID_RE7, MAX_CONTEXT_BYTES, URL_RE, SessionContextError, SESSION_ACQUIRE_BINDING_FIELDS, SESSION_RECEIVER_KINDS, RECEIVER_LOCK_MAX_BYTES;
 var init_session_context = __esm({
   "src/cloud/session-context.ts"() {
     "use strict";
@@ -3949,7 +3949,7 @@ var init_session_context = __esm({
     init_session_contract();
     init_session_proof();
     init_command_client();
-    UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE7 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     MAX_CONTEXT_BYTES = 16 * 1024;
     URL_RE = /^https?:\/\/[^/\s]+$/i;
     SessionContextError = class extends Error {
@@ -4462,7 +4462,7 @@ function validatedPayload(value) {
     throw new Error("invite link target is malformed");
   }
   cloudTarget(value.url, value.anon_key);
-  if (typeof value.workspace_id !== "string" || !UUID_RE7.test(value.workspace_id)) {
+  if (typeof value.workspace_id !== "string" || !UUID_RE8.test(value.workspace_id)) {
     throw new Error("invite link workspace_id must be a UUID");
   }
   if (typeof value.invitation_token !== "string") {
@@ -4472,7 +4472,7 @@ function validatedPayload(value) {
   if (typeof value.workspace_name !== "string" || typeof value.inviter_display_name !== "string" || value.workspace_name.length > MAX_LABEL_INPUT_LENGTH || value.inviter_display_name.length > MAX_LABEL_INPUT_LENGTH) {
     throw new Error("invite link display labels are malformed");
   }
-  if (value.inviter_user_id !== void 0 && (typeof value.inviter_user_id !== "string" || !UUID_RE7.test(value.inviter_user_id))) {
+  if (value.inviter_user_id !== void 0 && (typeof value.inviter_user_id !== "string" || !UUID_RE8.test(value.inviter_user_id))) {
     throw new Error("invite link inviter_user_id must be a UUID");
   }
   return value;
@@ -4605,7 +4605,7 @@ async function requirePinnedOrigin(target2, options) {
     throw new Error(`origin confirmation did not exactly match ${host}; refusing before login`);
   }
 }
-var import_node_crypto9, MAX_LINK_PAYLOAD_BYTES, MAX_LABEL_INPUT_LENGTH, CONTROL_GLOBAL_RE, ANSI_ESCAPE_GLOBAL_RE, UUID_RE7, STRICT_BASE64URL_RE, RAW_BASE64_PAYLOAD_CANDIDATE_RE, CURRENT_INVITE_SCHEME, RETIRED_INVITE_SCHEME, INVITE_WRAPPER_ERROR, ACCEPT_INPUT_ERROR, RETIRED_CLOUD_ORIGIN, PRODUCTION_CLOUD_ORIGINS;
+var import_node_crypto9, MAX_LINK_PAYLOAD_BYTES, MAX_LABEL_INPUT_LENGTH, CONTROL_GLOBAL_RE, ANSI_ESCAPE_GLOBAL_RE, UUID_RE8, STRICT_BASE64URL_RE, RAW_BASE64_PAYLOAD_CANDIDATE_RE, CURRENT_INVITE_SCHEME, RETIRED_INVITE_SCHEME, INVITE_WRAPPER_ERROR, ACCEPT_INPUT_ERROR, RETIRED_CLOUD_ORIGIN, PRODUCTION_CLOUD_ORIGINS;
 var init_invite_link = __esm({
   "src/cloud/invite-link.ts"() {
     "use strict";
@@ -4616,7 +4616,7 @@ var init_invite_link = __esm({
     MAX_LABEL_INPUT_LENGTH = 1024;
     CONTROL_GLOBAL_RE = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g;
     ANSI_ESCAPE_GLOBAL_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
-    UUID_RE7 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE8 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     STRICT_BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
     RAW_BASE64_PAYLOAD_CANDIDATE_RE = /^[A-Za-z0-9+/_=-]+$/;
     CURRENT_INVITE_SCHEME = "cswarm://accept/";
@@ -4632,7 +4632,7 @@ var init_invite_link = __esm({
 
 // src/cloud/workspaces.ts
 function resolveWorkspaceMember(selector, members2) {
-  if (UUID_RE8.test(selector)) {
+  if (UUID_RE9.test(selector)) {
     const selected = members2.find(
       (member) => member.user_id === selector.toLowerCase()
     );
@@ -4666,7 +4666,7 @@ function sortWorkspaces(workspaces) {
   );
 }
 function checkedUuid(value, field) {
-  if (typeof value !== "string" || !UUID_RE8.test(value)) {
+  if (typeof value !== "string" || !UUID_RE9.test(value)) {
     throw new Error(`workspace read returned a malformed ${field}`);
   }
   return value.toLowerCase();
@@ -4985,13 +4985,13 @@ async function updateWorkspaceDefaultAfterClose(store2, userId, closedWorkspaceI
 }
 function workspaceOverride(explicit, environmental) {
   if (explicit !== void 0) {
-    if (!UUID_RE8.test(explicit)) {
+    if (!UUID_RE9.test(explicit)) {
       throw new Error("--workspace-id must be a UUID");
     }
     return explicit.toLowerCase();
   }
   if (environmental) {
-    if (!UUID_RE8.test(environmental)) {
+    if (!UUID_RE9.test(environmental)) {
       throw new Error("SWARM_CLOUD_WORKSPACE_ID must be a UUID");
     }
     return environmental.toLowerCase();
@@ -5051,7 +5051,7 @@ async function selectWorkspace(selector, workspaces, store2, userId) {
 function resolveWorkspaceSelector(selector, workspaces) {
   const sorted = sortWorkspaces(workspaces);
   let selected;
-  if (UUID_RE8.test(selector)) {
+  if (UUID_RE9.test(selector)) {
     const normalized = selector.toLowerCase();
     selected = sorted.find(
       (workspace) => workspace.workspace_id === normalized
@@ -5160,13 +5160,13 @@ function renderStatus(options) {
   }
   return lines.join("\n");
 }
-var UUID_RE8, ROLES, MemberSelectionError, DEFAULT_MEMBERSHIP_REVOKED, PROJECT_NOT_AVAILABLE, ARCHIVED_PROJECT_NOT_AVAILABLE, WorkspaceCliError, WorkspaceResolutionError, WorkspaceUnavailableError, WorkspaceAmbiguousNameError;
+var UUID_RE9, ROLES, MemberSelectionError, DEFAULT_MEMBERSHIP_REVOKED, PROJECT_NOT_AVAILABLE, ARCHIVED_PROJECT_NOT_AVAILABLE, WorkspaceCliError, WorkspaceResolutionError, WorkspaceUnavailableError, WorkspaceAmbiguousNameError;
 var init_workspaces = __esm({
   "src/cloud/workspaces.ts"() {
     "use strict";
     init_invite_link();
     init_renewal_grants();
-    UUID_RE8 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE9 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     ROLES = /* @__PURE__ */ new Set(["owner", "admin", "member"]);
     MemberSelectionError = class extends Error {
       constructor(code, message, matches = []) {
@@ -5303,7 +5303,7 @@ function parseSignalAttachments(value, options = {}) {
       throw new SignalAttachmentMalformedError("signal read returned a malformed attachment");
     }
     const row = valueAtPosition;
-    if (typeof row.file_id !== "string" || !UUID_RE9.test(row.file_id) || typeof row.version_n !== "number" || !Number.isSafeInteger(row.version_n) || row.version_n < 1 || typeof row.name !== "string" || row.name.length < 1 || row.name.length > 255 || typeof row.content_type !== "string" || row.content_type.length < 1 || typeof row.size_bytes !== "number" || !Number.isSafeInteger(row.size_bytes) || row.size_bytes < 0) {
+    if (typeof row.file_id !== "string" || !UUID_RE10.test(row.file_id) || typeof row.version_n !== "number" || !Number.isSafeInteger(row.version_n) || row.version_n < 1 || typeof row.name !== "string" || row.name.length < 1 || row.name.length > 255 || typeof row.content_type !== "string" || row.content_type.length < 1 || typeof row.size_bytes !== "number" || !Number.isSafeInteger(row.size_bytes) || row.size_bytes < 0) {
       throw new SignalAttachmentMalformedError("signal read returned malformed attachment metadata");
     }
     const fileId = row.file_id.toLowerCase();
@@ -5323,7 +5323,7 @@ function parseSignalAttachments(value, options = {}) {
   return attachments;
 }
 function attachmentRetrievalCommand(workspaceId2, attachment) {
-  if (!UUID_RE9.test(workspaceId2) || !UUID_RE9.test(attachment.file_id)) {
+  if (!UUID_RE10.test(workspaceId2) || !UUID_RE10.test(attachment.file_id)) {
     throw new Error("attachment retrieval command needs UUID identifiers");
   }
   if (!Number.isSafeInteger(attachment.version_n) || attachment.version_n < 1) {
@@ -5337,12 +5337,12 @@ function formatAttachmentSize(bytes) {
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
-var SIGNAL_ATTACHMENT_MAX, UUID_RE9, SignalAttachmentMalformedError;
+var SIGNAL_ATTACHMENT_MAX, UUID_RE10, SignalAttachmentMalformedError;
 var init_attachments = __esm({
   "src/cloud/attachments.ts"() {
     "use strict";
     SIGNAL_ATTACHMENT_MAX = 8;
-    UUID_RE9 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE10 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     SignalAttachmentMalformedError = class extends Error {
       name = "SignalAttachmentMalformedError";
     };
@@ -5362,7 +5362,7 @@ function plainMalformedError(message) {
   return error2;
 }
 function checkedUuid2(value, field) {
-  if (typeof value !== "string" || !UUID_RE10.test(value)) {
+  if (typeof value !== "string" || !UUID_RE11.test(value)) {
     throw new SignalMalformedError(`signal read returned a malformed ${field}`);
   }
   return value.toLowerCase();
@@ -6092,7 +6092,7 @@ async function readAgentSignalDirectory(target2, token, workspaceId2, fetcherOrO
 }
 function resolveSignalRecipient(selector, directory) {
   const resolved = Array.isArray(directory) ? { members: directory, agents: [] } : directory;
-  if (UUID_RE10.test(selector)) {
+  if (UUID_RE11.test(selector)) {
     const normalized = selector.toLowerCase();
     const member = resolved.members.find((row) => row.user_id === normalized);
     const agent = resolved.agents.find(
@@ -6170,10 +6170,10 @@ async function pollForSignals(options) {
   return { signals: [], timedOut: true };
 }
 function normalizedSignalQuery(query) {
-  if (!UUID_RE10.test(query.workspaceId)) {
+  if (!UUID_RE11.test(query.workspaceId)) {
     throw new Error("--workspace-id must be a UUID");
   }
-  if (query.in_reply_to !== void 0 && !UUID_RE10.test(query.in_reply_to)) {
+  if (query.in_reply_to !== void 0 && !UUID_RE11.test(query.in_reply_to)) {
     throw new Error("in_reply_to must be a signal UUID");
   }
   const after = checkedAfter(query.after);
@@ -6679,7 +6679,7 @@ async function runInboxFollow(options) {
     }
   }
 }
-var UUID_RE10, SIGNAL_KINDS, SIGNAL_BODY_DISPLAY_MAX, SIGNAL_ABOUT_DISPLAY_MAX, SIGNAL_READ_TIMEOUT_MS, SignalReadTimeoutError, SignalHostPortsExhaustedError, SIGNAL_WAIT_MIN_SECONDS, SIGNAL_WAIT_MAX_SECONDS, SIGNAL_WAIT_POLL_MS, SIGNAL_FOLLOW_POLL_MS, SIGNAL_FOLLOW_BACKOFF_INITIAL_MS, SIGNAL_FOLLOW_BACKOFF_MAX_MS, SIGNAL_FOLLOW_SEEN_MAX, SIGNAL_FOLLOW_POST_EMIT_MS, SIGNAL_FOLLOW_PAGE_LIMIT, SignalHttpError, SignalTransportError, LocalCredentialSecretAbsentError, ListenerCredentialStateMismatchError, SignalMalformedError, SignalRecipientError, plainHttpRetryAfterMs, plainHttpStatus, plainHttpEnvelope, plainTransportErrors, plainTransportFailureCodes, plainMalformedErrors, SENDER_OWNER_RELATIONS, SIGNAL_RECIPIENT_KINDS, READ_RETRY_ATTEMPTS, READ_RETRY_BASE_MS, SIGNAL_STATUS_UNAVAILABLE_MESSAGE, ASK_WAIT_TIMEOUT_MESSAGE, BoundedSignalIdSet, DEFAULT_REFUSAL_TOLERANCE_MS, MAX_REFUSAL_TOLERANCE_MS, CONFIRMED_CREDENTIAL_LOSS_CODES, COMMAND_CONFIRMED_CREDENTIAL_LOSS_CODES, READ_CONFIRMED_CREDENTIAL_LOSS_CODE_SET, COMMAND_CONFIRMED_CREDENTIAL_LOSS_CODE_SET;
+var UUID_RE11, SIGNAL_KINDS, SIGNAL_BODY_DISPLAY_MAX, SIGNAL_ABOUT_DISPLAY_MAX, SIGNAL_READ_TIMEOUT_MS, SignalReadTimeoutError, SignalHostPortsExhaustedError, SIGNAL_WAIT_MIN_SECONDS, SIGNAL_WAIT_MAX_SECONDS, SIGNAL_WAIT_POLL_MS, SIGNAL_FOLLOW_POLL_MS, SIGNAL_FOLLOW_BACKOFF_INITIAL_MS, SIGNAL_FOLLOW_BACKOFF_MAX_MS, SIGNAL_FOLLOW_SEEN_MAX, SIGNAL_FOLLOW_POST_EMIT_MS, SIGNAL_FOLLOW_PAGE_LIMIT, SignalHttpError, SignalTransportError, LocalCredentialSecretAbsentError, ListenerCredentialStateMismatchError, SignalMalformedError, SignalRecipientError, plainHttpRetryAfterMs, plainHttpStatus, plainHttpEnvelope, plainTransportErrors, plainTransportFailureCodes, plainMalformedErrors, SENDER_OWNER_RELATIONS, SIGNAL_RECIPIENT_KINDS, READ_RETRY_ATTEMPTS, READ_RETRY_BASE_MS, SIGNAL_STATUS_UNAVAILABLE_MESSAGE, ASK_WAIT_TIMEOUT_MESSAGE, BoundedSignalIdSet, DEFAULT_REFUSAL_TOLERANCE_MS, MAX_REFUSAL_TOLERANCE_MS, CONFIRMED_CREDENTIAL_LOSS_CODES, COMMAND_CONFIRMED_CREDENTIAL_LOSS_CODES, READ_CONFIRMED_CREDENTIAL_LOSS_CODE_SET, COMMAND_CONFIRMED_CREDENTIAL_LOSS_CODE_SET;
 var init_signals = __esm({
   "src/cloud/signals.ts"() {
     "use strict";
@@ -6689,7 +6689,7 @@ var init_signals = __esm({
     init_error_envelope();
     init_attachments();
     init_wake();
-    UUID_RE10 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE11 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     SIGNAL_KINDS = /* @__PURE__ */ new Set(["working-on", "note", "ask"]);
     SIGNAL_BODY_DISPLAY_MAX = 8e3;
     SIGNAL_ABOUT_DISPLAY_MAX = 500;
@@ -8624,7 +8624,7 @@ function datetime(args) {
   const timeRegex = args.local ? `${qualified}|${timeSource({ precision: args.precision })}` : qualified;
   return new RegExp(`^${dateSource}T(?:${timeRegex})$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid2, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, httpProtocol, e164, dateSource, date, string, integer, number, boolean, _null, lowercase, uppercase;
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, guid, uuid3, email, _emoji, ipv4, ipv6, cidrv4, cidrv6, base64, base64url, httpProtocol, e164, dateSource, date, string, integer, number, boolean, _null, lowercase, uppercase;
 var init_regexes = __esm({
   "../../../../../../../Users/yulanbot/Developer/Ridge.io/cloud-swarm/node_modules/zod/v4/core/regexes.js"() {
     cuid = /^[cC][0-9a-z]{6,}$/;
@@ -8635,7 +8635,7 @@ var init_regexes = __esm({
     nanoid = /^[a-zA-Z0-9_-]{21}$/;
     duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
     guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-    uuid2 = (version4) => {
+    uuid3 = (version4) => {
       if (!version4)
         return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
       return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version4}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
@@ -9668,9 +9668,9 @@ var init_schemas = __esm({
         const v = versionMap[def.version];
         if (v === void 0)
           throw new Error(`Invalid UUID version: "${def.version}"`);
-        def.pattern ?? (def.pattern = uuid2(v));
+        def.pattern ?? (def.pattern = uuid3(v));
       } else
-        def.pattern ?? (def.pattern = uuid2());
+        def.pattern ?? (def.pattern = uuid3());
       $ZodStringFormat.init(inst, def);
     });
     $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
@@ -24846,7 +24846,7 @@ function observationCommandId(signalId) {
   return `observe_${signalId.toLowerCase().replaceAll("-", "")}`;
 }
 function checkedUuid3(value, field) {
-  if (typeof value !== "string" || !UUID_RE11.test(value)) {
+  if (typeof value !== "string" || !UUID_RE12.test(value)) {
     throw new DeliveryMalformedResponseError(
       `delivery response returned a malformed ${field}`
     );
@@ -24957,7 +24957,7 @@ function checkedClaimCapabilities(value) {
 }
 function checkedOptionalUuidArray(value, field) {
   if (value === void 0) return;
-  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !UUID_RE11.test(item))) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !UUID_RE12.test(item))) {
     throw new DeliveryMalformedResponseError(
       `delivery response returned a malformed ${field}`
     );
@@ -25140,7 +25140,7 @@ function checkedCommandId(value) {
   return value;
 }
 function checkedUuidRequest(value, field) {
-  if (!UUID_RE11.test(value)) {
+  if (!UUID_RE12.test(value)) {
     throw new Error(`${field} must be a UUID for an agent delivery command`);
   }
 }
@@ -25212,7 +25212,7 @@ function successBody(response, text, verb) {
   }
   return body2;
 }
-var UUID_RE11, RFC3339_TIMESTAMP_RE, DELIVERY_KINDS, SENDER_OWNER_RELATIONS2, DELIVERY_ACK_OUTCOMES, DELIVERY_HANDLED_OUTCOMES, DELIVERY_PROVIDER_PROVEN_OUTCOMES, DELIVERY_REQUEST_TIMEOUT_MS, COMMAND_ID_VALIDATOR_RE, FAILED_TERMINAL_CODES_SET, H0_SEAT_CLAIM_REFUSED_CODE, H0_SEAT_LISTENER_STOP_SENTENCE, DELIVERY_FAILED_TERMINAL_CODES, DELIVERY_SESSION_PROOF_CODES, DELIVERY_SERVER_ERROR_CODES, SERVER_ERROR_CODES_SET, DELIVERY_UNKNOWN_ERROR_CODE, DeliveryTransportError, DeliveryHttpError, DeliveryProtocolError, DeliveryResponseError, DeliveryMalformedResponseError, DeliveryCommandClient;
+var UUID_RE12, RFC3339_TIMESTAMP_RE, DELIVERY_KINDS, SENDER_OWNER_RELATIONS2, DELIVERY_ACK_OUTCOMES, DELIVERY_HANDLED_OUTCOMES, DELIVERY_PROVIDER_PROVEN_OUTCOMES, DELIVERY_REQUEST_TIMEOUT_MS, COMMAND_ID_VALIDATOR_RE, FAILED_TERMINAL_CODES_SET, H0_SEAT_CLAIM_REFUSED_CODE, H0_SEAT_LISTENER_STOP_SENTENCE, DELIVERY_FAILED_TERMINAL_CODES, DELIVERY_SESSION_PROOF_CODES, DELIVERY_SERVER_ERROR_CODES, SERVER_ERROR_CODES_SET, DELIVERY_UNKNOWN_ERROR_CODE, DeliveryTransportError, DeliveryHttpError, DeliveryProtocolError, DeliveryResponseError, DeliveryMalformedResponseError, DeliveryCommandClient;
 var init_delivery = __esm({
   "src/cloud/delivery.ts"() {
     "use strict";
@@ -25222,7 +25222,7 @@ var init_delivery = __esm({
     init_wake();
     init_session_ack();
     init_session_wire();
-    UUID_RE11 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    UUID_RE12 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     RFC3339_TIMESTAMP_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|([+-]\d{2}):(\d{2}))$/i;
     DELIVERY_KINDS = /* @__PURE__ */ new Set(["ask", "note"]);
     SENDER_OWNER_RELATIONS2 = /* @__PURE__ */ new Set([
@@ -51601,7 +51601,7 @@ function capMcpResult(value) {
   if (Buffer.byteLength(raw) <= MCP_RESULT_MAX_BYTES) return value;
   return { truncated: true, message: "Result exceeds the MCP byte cap. Narrow the request." };
 }
-var MCP_ARGUMENT_NAME_ECHO_MAX, MCP_RESULT_MAX_BYTES, string3, body, requestId, UUID_LENGTH, uuid6, common, schema, MCP_TOOL_TABLE, MCP_TOOLS;
+var MCP_ARGUMENT_NAME_ECHO_MAX, MCP_RESULT_MAX_BYTES, string3, body, requestId, UUID_LENGTH, uuid7, common, schema, MCP_TOOL_TABLE, MCP_TOOLS;
 var init_tools = __esm({
   "src/mcp/tools.ts"() {
     "use strict";
@@ -51621,7 +51621,7 @@ var init_tools = __esm({
     body = string3(SIGNAL_BODY_MAX, 1);
     requestId = string3(H0_REQUEST_ID_MAX, H0_REQUEST_ID_MIN, H0_REQUEST_ID_RE.source);
     UUID_LENGTH = "00000000-0000-0000-0000-000000000000".length;
-    uuid6 = string3(UUID_LENGTH, UUID_LENGTH, ONBOARDING_UUID.source.replaceAll("a-f", "a-fA-F").replaceAll("[89ab]", "[89abAB]"));
+    uuid7 = string3(UUID_LENGTH, UUID_LENGTH, ONBOARDING_UUID.source.replaceAll("a-f", "a-fA-F").replaceAll("[89ab]", "[89abAB]"));
     common = { body, about: string3(SIGNAL_ABOUT_MAX), channel: { ...string3(CHANNEL_SLUG_MAX, 1, CHANNEL_SLUG_RE.source), not: { enum: RESERVED_CHANNEL_SLUGS } }, until: string3(void 0, void 0, SIGNAL_DURATION_RE.source), request_id: requestId };
     schema = (properties, required2 = []) => ({
       type: "object",
@@ -51631,10 +51631,10 @@ var init_tools = __esm({
     });
     MCP_TOOL_TABLE = [
       { name: "whoami", description: "Show this authenticated agent and workspace.", inputSchema: schema({}), mapResult: mapWhoami },
-      { name: "check", description: "Read new directed messages. If a result is lost, call check with its message_id to read the cached full text.", inputSchema: schema({ message_id: uuid6 }), mapResult: { fresh: mapCheck, cached: mapCachedCheck } },
+      { name: "check", description: "Read new directed messages. If a result is lost, call check with its message_id to read the cached full text.", inputSchema: schema({ message_id: uuid7 }), mapResult: { fresh: mapCheck, cached: mapCachedCheck } },
       { name: "ask", description: "Ask a teammate. Channel slugs are lowercase. Retry with the same request_id and arguments if the outcome is unknown.", inputSchema: schema({ ...common, to: string3(SIGNAL_RECIPIENT_MAX, 1) }, ["body", "request_id"]), mapResult: mapSignal },
       { name: "note", description: "Share a note. Channel slugs are lowercase. Retry with the same request_id and arguments if the outcome is unknown.", inputSchema: schema({ ...common, to: string3(SIGNAL_RECIPIENT_MAX, 1) }, ["body", "request_id"]), mapResult: mapSignal },
-      { name: "reply", description: "Reply privately to a signal. Retry with the same request_id and arguments if the outcome is unknown.", inputSchema: schema({ signal_id: uuid6, body, request_id: requestId }, ["signal_id", "body", "request_id"]), mapResult: mapSignal },
+      { name: "reply", description: "Reply privately to a signal. Retry with the same request_id and arguments if the outcome is unknown.", inputSchema: schema({ signal_id: uuid7, body, request_id: requestId }, ["signal_id", "body", "request_id"]), mapResult: mapSignal },
       { name: "working_on", description: "Share current work. Channel slugs are lowercase. Retry with the same request_id and arguments if the outcome is unknown.", inputSchema: schema(common, ["body", "request_id"]), mapResult: mapSignal },
       { name: "members", description: "List members and agents in this workspace.", inputSchema: schema({}), mapResult: mapMembers }
     ];
@@ -52009,6 +52009,67 @@ __export(cli_exports, {
 module.exports = __toCommonJS(cli_exports);
 var import_node_crypto24 = require("node:crypto");
 init_signal_duration();
+
+// src/cloud/pending-access.ts
+init_config();
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var uuid = (value) => typeof value === "string" && UUID_RE.test(value);
+function parsePendingAccess(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("pending access read returned malformed data");
+  const rows3 = value.pending;
+  if (!Array.isArray(rows3)) throw new Error("pending access read returned malformed data");
+  return rows3.map((value2) => {
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) throw new Error("pending access read returned malformed row");
+    const row = value2;
+    const common2 = uuid(row.owner_user_id) && typeof row.issuer_display === "string" && typeof row.issued_at === "string" && Number.isFinite(Date.parse(row.issued_at)) && (row.expires_at === null || typeof row.expires_at === "string" && Number.isFinite(Date.parse(row.expires_at)));
+    const classic = row.kind === "classic" && uuid(row.principal_id) && typeof row.principal_name === "string" && row.join_credential_id === null && row.seats_used === null && row.seat_cap === null;
+    const join23 = row.kind === "join" && row.principal_id === null && row.principal_name === null && uuid(row.join_credential_id) && Number.isSafeInteger(row.seats_used) && Number.isSafeInteger(row.seat_cap) && Number(row.seats_used) >= 0 && Number(row.seat_cap) > Number(row.seats_used);
+    if (!common2 || !classic && !join23) throw new Error("pending access read returned malformed row");
+    return {
+      kind: row.kind,
+      principal_id: row.principal_id,
+      principal_name: row.principal_name,
+      join_credential_id: row.join_credential_id,
+      owner_user_id: row.owner_user_id,
+      issuer_display: row.issuer_display,
+      issued_at: row.issued_at,
+      expires_at: row.expires_at,
+      seats_used: row.seats_used,
+      seat_cap: row.seat_cap
+    };
+  });
+}
+async function readPendingAccess(target2, bearer, workspaceId2, fetcher = fetch) {
+  const response = await fetcher(readEndpoint(target2), {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${bearer}`,
+      apikey: target2.anonKey,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({ resource: "pending_access", workspace_id: workspaceId2 }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) throw new Error(`pending access read failed (${response.status})`);
+  return parsePendingAccess(await response.json());
+}
+async function readPendingAccessOptional(target2, bearer, workspaceId2, fetcher = fetch) {
+  try {
+    return await readPendingAccess(target2, bearer, workspaceId2, fetcher);
+  } catch {
+    return null;
+  }
+}
+function pendingAccessAge(issuedAt, now = Date.now()) {
+  const minutes = Math.max(0, Math.floor((now - Date.parse(issuedAt)) / 6e4));
+  if (minutes < 1) return "just now";
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  return `${Math.floor(hours / 24)}d ago`;
+}
+
+// src/cli.ts
 init_signal_limits();
 init_signal_limits();
 
@@ -55820,7 +55881,7 @@ function osUsername() {
 }
 
 // src/cloud/seed.ts
-var UUID_RE12 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE13 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var P0_SCOPES = [
   "create",
   "acquire",
@@ -55845,15 +55906,15 @@ function deterministicUuid(label) {
     hex.slice(20)
   ].join("-");
 }
-function uuid3(value, label) {
-  if (!UUID_RE12.test(value)) throw new Error(`${label} must be a UUID`);
+function uuid4(value, label) {
+  if (!UUID_RE13.test(value)) throw new Error(`${label} must be a UUID`);
   return value;
 }
 async function seedDogfood(options) {
   if (!options.databaseUrl) throw new Error("DATABASE_URL is required");
-  const userId = uuid3(options.userId, "uid");
-  const deviceId = options.deviceId ? uuid3(options.deviceId, "device id") : deterministicUuid(`cloud-swarm:device:${userId}`);
-  const workspaceId2 = options.workspaceId ? uuid3(options.workspaceId, "workspace id") : deterministicUuid(`cloud-swarm:workspace:${userId}`);
+  const userId = uuid4(options.userId, "uid");
+  const deviceId = options.deviceId ? uuid4(options.deviceId, "device id") : deterministicUuid(`cloud-swarm:device:${userId}`);
+  const workspaceId2 = options.workspaceId ? uuid4(options.workspaceId, "workspace id") : deterministicUuid(`cloud-swarm:workspace:${userId}`);
   const requestedStreamId = deterministicUuid(
     `cloud-swarm:workspace-stream:${workspaceId2}`
   );
@@ -56313,7 +56374,7 @@ function acceptedResponse(result) {
   }
   return result.response;
 }
-function uuid4(value, field) {
+function uuid5(value, field) {
   if (typeof value !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
     throw new Error(`server returned a malformed ${field}`);
   }
@@ -56685,7 +56746,7 @@ function cloudAcceptOperations(target2, store2, fetcher = fetch) {
         );
         return {
           status: "accepted",
-          workspaceId: uuid4(response.workspace_id, "workspace_id")
+          workspaceId: uuid5(response.workspace_id, "workspace_id")
         };
       } catch (error2) {
         if (error2 instanceof CommandHttpError && error2.status === 403) {
@@ -56709,7 +56770,7 @@ function cloudAcceptOperations(target2, store2, fetcher = fetch) {
       if (result.response.status === "accepted") {
         return {
           status: "accepted",
-          principalId: uuid4(result.response.principal_id, "principal_id")
+          principalId: uuid5(result.response.principal_id, "principal_id")
         };
       }
       if (String(result.response.reason) === "principal_name_taken") {
@@ -56821,7 +56882,7 @@ init_signals();
 init_storage();
 init_idle_poll();
 init_wake2();
-var UUID_RE13 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE14 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CURSOR_MAX_BYTES = 4 * 1024;
 var ARRIVAL_SNIPPET_MAX = 180;
 var WATCH_LOCK_MAX_BYTES = 512;
@@ -56989,7 +57050,7 @@ function parseCursor(raw, workspaceId2, principalId) {
   }
   const row = value;
   const cursor = row.cursor;
-  if (row.version !== 1 || row.workspace_id !== workspaceId2.toLowerCase() || row.principal_id !== principalId.toLowerCase() || !(cursor === null || typeof cursor === "object" && !Array.isArray(cursor) && typeof cursor.created_at === "string" && Number.isFinite(Date.parse(cursor.created_at)) && typeof cursor.id === "string" && UUID_RE13.test(cursor.id))) {
+  if (row.version !== 1 || row.workspace_id !== workspaceId2.toLowerCase() || row.principal_id !== principalId.toLowerCase() || !(cursor === null || typeof cursor === "object" && !Array.isArray(cursor) && typeof cursor.created_at === "string" && Number.isFinite(Date.parse(cursor.created_at)) && typeof cursor.id === "string" && UUID_RE14.test(cursor.id))) {
     throw new Error("stored arrival cursor is malformed");
   }
   if (cursor === null) return null;
@@ -57001,7 +57062,7 @@ function parseCursor(raw, workspaceId2, principalId) {
 function fileArrivalCursorStore(options) {
   const workspaceId2 = options.workspaceId.toLowerCase();
   const principalId = options.principalId.toLowerCase();
-  if (!UUID_RE13.test(workspaceId2) || !UUID_RE13.test(principalId)) {
+  if (!UUID_RE14.test(workspaceId2) || !UUID_RE14.test(principalId)) {
     throw new Error("arrival cursor identity must use workspace and principal UUIDs");
   }
   const location2 = arrivalCursorPath(
@@ -57270,7 +57331,7 @@ init_idle_poll();
 // src/cloud/delivery-receipts.ts
 init_config();
 init_signals();
-var UUID_RE14 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE15 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var DeliveryReceiptReadError = class extends Error {
   constructor(code, message, status = null) {
     super(message);
@@ -57288,8 +57349,8 @@ var ACK_OUTCOMES = /* @__PURE__ */ new Set([
   "expired",
   "failed_terminal"
 ]);
-function uuid5(value, field) {
-  if (typeof value !== "string" || !UUID_RE14.test(value)) {
+function uuid6(value, field) {
+  if (typeof value !== "string" || !UUID_RE15.test(value)) {
     throw new DeliveryReceiptReadError(
       "protocol",
       `delivery receipt returned a malformed ${field}`
@@ -57337,7 +57398,7 @@ function parseDeliveryReceipt(value) {
   const row = value;
   if (Object.hasOwn(row, "recipient_user_id")) {
     return {
-      recipient_user_id: uuid5(row.recipient_user_id, "recipient_user_id"),
+      recipient_user_id: uuid6(row.recipient_user_id, "recipient_user_id"),
       ...Object.hasOwn(row, "display_name") ? { display_name: displayName(row.display_name, "display_name") } : {},
       seen_at: nullableTimestamp2(row.seen_at, "seen_at")
     };
@@ -57362,7 +57423,7 @@ function parseDeliveryReceipt(value) {
     );
   }
   return {
-    recipient_agent_principal_id: uuid5(
+    recipient_agent_principal_id: uuid6(
       row.recipient_agent_principal_id,
       "recipient_agent_principal_id"
     ),
@@ -57402,8 +57463,8 @@ function parseBroadcastAgent(value) {
       "delivery receipt returned malformed legacy agent compatibility fields"
     );
   }
-  const principalId = uuid5(row.principal_id, "principal_id");
-  const recipientPrincipalId = uuid5(
+  const principalId = uuid6(row.principal_id, "principal_id");
+  const recipientPrincipalId = uuid6(
     row.recipient_agent_principal_id,
     "recipient_agent_principal_id"
   );
@@ -57604,8 +57665,8 @@ async function readAgentDeliveryReceipts(target2, token, workspaceId2, signalId,
           },
           body: JSON.stringify({
             resource: "delivery_receipts",
-            workspace_id: uuid5(workspaceId2, "workspace_id"),
-            signal_id: uuid5(signalId, "signal_id")
+            workspace_id: uuid6(workspaceId2, "workspace_id"),
+            signal_id: uuid6(signalId, "signal_id")
           }),
           signal
         }),
@@ -57986,9 +58047,9 @@ init_command_client();
 init_signals();
 init_attachments();
 init_types2();
-var UUID_RE15 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE16 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function listenerReplyCommandId(signalId, effectOrdinal = 0) {
-  if (!UUID_RE15.test(signalId)) {
+  if (!UUID_RE16.test(signalId)) {
     throw new Error("listener signal id must be a UUID");
   }
   if (!Number.isSafeInteger(effectOrdinal) || effectOrdinal < 0) {
@@ -58049,7 +58110,7 @@ var import_node_os8 = require("node:os");
 var import_node_path13 = require("node:path");
 var import_node_util3 = require("node:util");
 init_storage();
-var UUID_RE16 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE17 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var COMMAND_ID_RE2 = /^[A-Za-z0-9_-]{8,72}$/;
 var MAX_EFFECT_BYTES = 1024 * 1024;
 var STATES = /* @__PURE__ */ new Set([
@@ -58099,7 +58160,7 @@ function defaultListenerStateDirectory() {
   return process.env.XDG_STATE_HOME ? (0, import_node_path13.join)(process.env.XDG_STATE_HOME, "cswarm", "listeners") : (0, import_node_path13.join)((0, import_node_os8.homedir)(), ".cswarm", "listeners");
 }
 function listenerInstanceKey(input) {
-  if (!UUID_RE16.test(input.workspaceId) || !UUID_RE16.test(input.principalId)) {
+  if (!UUID_RE17.test(input.workspaceId) || !UUID_RE17.test(input.principalId)) {
     throw new Error("listener workspace and principal ids must be UUIDs");
   }
   if (!input.profileId || input.profileId.includes("\0")) {
@@ -58132,7 +58193,7 @@ function parseListenerEffectRecord(raw, expectedId) {
   }
   const row = value;
   rejectSensitiveKeys(row);
-  if (typeof row.version !== "number" || row.version !== 1 && row.version !== 2 || typeof row.signalId !== "string" || row.signalId.toLowerCase() !== expectedId || !UUID_RE16.test(row.signalId)) {
+  if (typeof row.version !== "number" || row.version !== 1 && row.version !== 2 || typeof row.signalId !== "string" || row.signalId.toLowerCase() !== expectedId || !UUID_RE17.test(row.signalId)) {
     throw new Error("stored listener effect is malformed");
   }
   if (row.version === 1) {
@@ -58147,7 +58208,7 @@ function upcastV1Ask(row) {
   if (row.effectOrdinal !== 0 || typeof row.commandId !== "string" || !COMMAND_ID_RE2.test(row.commandId) || typeof row.askBody !== "string" || row.askBody.length < 1 || typeof row.askUntil !== "string" || !Number.isFinite(Date.parse(row.askUntil)) || typeof row.senderOwnerRelation !== "string" || !RELATIONS.has(row.senderOwnerRelation) || typeof row.state !== "string" || !STATES.has(row.state) || !integer2(row.promptAttempts) || !integer2(row.postAttempts) || !nullableString2(row.replyBody, 2e3) || typeof row.replyTruncated !== "boolean" || !nullableString2(row.replySignalId, 64) || !nullableString2(row.failureCode, 96) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt))) {
     throw new Error("stored listener effect is malformed");
   }
-  if (row.replySignalId !== null && !UUID_RE16.test(row.replySignalId)) {
+  if (row.replySignalId !== null && !UUID_RE17.test(row.replySignalId)) {
     throw new Error("stored listener effect is malformed");
   }
   return {
@@ -58186,7 +58247,7 @@ function parseV2Record(row) {
     if (typeof row.commandId !== "string" || !COMMAND_ID_RE2.test(row.commandId) || row.state === "observed") {
       throw new Error("stored listener effect is malformed");
     }
-    if (row.replySignalId !== null && !UUID_RE16.test(row.replySignalId)) {
+    if (row.replySignalId !== null && !UUID_RE17.test(row.replySignalId)) {
       throw new Error("stored listener effect is malformed");
     }
   }
@@ -58210,7 +58271,7 @@ function parseV2Record(row) {
   };
 }
 function newObservedNoteRecord(input) {
-  if (!UUID_RE16.test(input.signalId)) {
+  if (!UUID_RE17.test(input.signalId)) {
     throw new Error("listener note signal id must be a UUID");
   }
   if (input.body.length < 1) {
@@ -58344,7 +58405,7 @@ var FileListenerEffectStore = class {
     );
   }
   checkedId(signalId) {
-    if (!UUID_RE16.test(signalId)) {
+    if (!UUID_RE17.test(signalId)) {
       throw new Error("listener signal id must be a UUID");
     }
     return signalId.toLowerCase();
@@ -58363,7 +58424,7 @@ init_types2();
 // src/listener/main-routing.ts
 var import_node_path14 = require("node:path");
 init_storage();
-var UUID_RE17 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE18 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var MAX_QUEUE_BYTES = 1024 * 1024;
 var QUEUE_FILE = "pending-for-main.json";
 var QUEUE_LOCK = "pending-for-main";
@@ -58473,7 +58534,7 @@ function parseEntry(value, rejectUnknownKeys) {
   if (rejectUnknownKeys && Object.keys(row).some((key2) => !ENTRY_KEYS.has(key2))) {
     throw new Error("stored pending-for-main entry is malformed");
   }
-  if (typeof row.signalId !== "string" || !UUID_RE17.test(row.signalId) || typeof row.workspaceId !== "string" || !UUID_RE17.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE17.test(row.principalId) || typeof row.fromId !== "string" || !UUID_RE17.test(row.fromId) || row.fromKind !== "user" && row.fromKind !== "agent" || !(row.kind === void 0 || row.kind === "ask" || row.kind === "note") || !(row.senderName === null || typeof row.senderName === "string" && row.senderName.length <= 200) || typeof row.body !== "string" || row.body.length < 1 || !(row.attachmentCount === void 0 || typeof row.attachmentCount === "number" && Number.isSafeInteger(row.attachmentCount) && row.attachmentCount >= 1 && row.attachmentCount <= 8) || !checkedTimestamp2(row.createdAt) || !checkedTimestamp2(row.queuedAt) || !(row.observationPending === void 0 || row.observationPending === true)) {
+  if (typeof row.signalId !== "string" || !UUID_RE18.test(row.signalId) || typeof row.workspaceId !== "string" || !UUID_RE18.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE18.test(row.principalId) || typeof row.fromId !== "string" || !UUID_RE18.test(row.fromId) || row.fromKind !== "user" && row.fromKind !== "agent" || !(row.kind === void 0 || row.kind === "ask" || row.kind === "note") || !(row.senderName === null || typeof row.senderName === "string" && row.senderName.length <= 200) || typeof row.body !== "string" || row.body.length < 1 || !(row.attachmentCount === void 0 || typeof row.attachmentCount === "number" && Number.isSafeInteger(row.attachmentCount) && row.attachmentCount >= 1 && row.attachmentCount <= 8) || !checkedTimestamp2(row.createdAt) || !checkedTimestamp2(row.queuedAt) || !(row.observationPending === void 0 || row.observationPending === true)) {
     throw new Error("stored pending-for-main entry is malformed");
   }
   return {
@@ -58673,7 +58734,7 @@ var ListenerH0SeatError = class extends Error {
     this.name = "ListenerH0SeatError";
   }
 };
-var UUID_RE18 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE19 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var ListenerCapabilityError = class _ListenerCapabilityError extends Error {
   static CODES = Object.freeze([
     "sender_relation_capability_missing",
@@ -59060,7 +59121,7 @@ async function runListenerRuntime(options) {
       new Error("listener instance id and delivery journal must be configured together")
     );
   }
-  if (hasInstanceId && !UUID_RE18.test(options.listenerInstanceId)) {
+  if (hasInstanceId && !UUID_RE19.test(options.listenerInstanceId)) {
     return await closeBeforeStart(
       options.model,
       new Error("listener instance id must be a UUID")
@@ -60474,7 +60535,7 @@ init_storage();
 init_wake2();
 init_delivery();
 init_credential_redaction();
-var UUID_RE19 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE20 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var SEMVER_RE2 = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 var MAX_STATUS_BYTES = 32 * 1024;
 var MAX_CONTROL_BYTES = 8 * 1024;
@@ -60632,7 +60693,7 @@ function parseHeldBackDeliveries(value) {
     for (const key2 of Object.keys(entry2)) {
       if (key2 !== "signalId" && key2 !== "at" && key2 !== "reason") return null;
     }
-    if (typeof entry2.signalId !== "string" || !UUID_RE19.test(entry2.signalId) || typeof entry2.at !== "string" || !Number.isFinite(Date.parse(entry2.at)) || typeof entry2.reason !== "string" || !LISTENER_DELIVERY_HOLD_RELEASE_REASONS.includes(
+    if (typeof entry2.signalId !== "string" || !UUID_RE20.test(entry2.signalId) || typeof entry2.at !== "string" || !Number.isFinite(Date.parse(entry2.at)) || typeof entry2.reason !== "string" || !LISTENER_DELIVERY_HOLD_RELEASE_REASONS.includes(
       entry2.reason
     )) {
       return null;
@@ -60696,13 +60757,13 @@ function parseStatus(raw, rejectUnknownKeys = false) {
       throw new Error("stored listener status is malformed");
     }
   }
-  const nullableUuid3 = (candidate) => candidate === null || typeof candidate === "string" && UUID_RE19.test(candidate);
+  const nullableUuid3 = (candidate) => candidate === null || typeof candidate === "string" && UUID_RE20.test(candidate);
   const nullableCount = (candidate) => candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0;
   const nullableTimestamp3 = (candidate) => candidate === null || typeof candidate === "string" && Number.isFinite(Date.parse(candidate));
   const readHealth = row.readHealth === void 0 ? void 0 : parseListenerReadHealth(row.readHealth, rejectUnknownKeys);
   const heldBackDeliveries = row.heldBackDeliveries === void 0 ? void 0 : parseHeldBackDeliveries(row.heldBackDeliveries);
   const wake = row.wake === void 0 ? void 0 : parseListenerWake(row.wake, rejectUnknownKeys);
-  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE19.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE19.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE19.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !LISTENER_STATUS_STATES.includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid3(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || !(row.lastErrorDetail === void 0 || row.lastErrorDetail === null || typeof row.lastErrorDetail === "string" && row.lastErrorDetail.length > 0 && row.lastErrorDetail.length <= 2048 && !SECRET_SHAPE_RE.test(row.lastErrorDetail)) || !(row.lastErrorReasonCode === void 0 || row.lastErrorReasonCode === null || typeof row.lastErrorReasonCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorReasonCode)) || !(row.providerExecutable === void 0 || row.providerExecutable === null || typeof row.providerExecutable === "string" && (0, import_node_path15.isAbsolute)(row.providerExecutable)) || !(row.providerVersion === void 0 || row.providerVersion === null || typeof row.providerVersion === "string" && SEMVER_RE2.test(row.providerVersion)) || !(row.providerLastMeasuredVersion === void 0 || row.providerLastMeasuredVersion === null || typeof row.providerLastMeasuredVersion === "string" && SEMVER_RE2.test(row.providerLastMeasuredVersion)) || !(row.providerBundledAgentSdkVersion === void 0 || row.providerBundledAgentSdkVersion === null || typeof row.providerBundledAgentSdkVersion === "string" && SEMVER_RE2.test(row.providerBundledAgentSdkVersion)) || !(row.providerBundledClaudeCodeVersion === void 0 || row.providerBundledClaudeCodeVersion === null || typeof row.providerBundledClaudeCodeVersion === "string" && SEMVER_RE2.test(row.providerBundledClaudeCodeVersion)) || !(row.providerMinimumRequiredVersion === void 0 || row.providerMinimumRequiredVersion === null || typeof row.providerMinimumRequiredVersion === "string" && SEMVER_RE2.test(row.providerMinimumRequiredVersion)) || !(row.cswarmVersion === void 0 || row.cswarmVersion === null || typeof row.cswarmVersion === "string" && SEMVER_RE2.test(row.cswarmVersion)) || (row.providerVersion === null || row.providerVersion === void 0) !== (row.providerLastMeasuredVersion === null || row.providerLastMeasuredVersion === void 0) || !(row.lastWorkerStderrTail === void 0 || row.lastWorkerStderrTail === null || typeof row.lastWorkerStderrTail === "string" && row.lastWorkerStderrTail.length > 0 && row.lastWorkerStderrTail.length <= 2048 && !SECRET_SHAPE_RE.test(row.lastWorkerStderrTail)) || typeof row.logPath !== "string" || !(0, import_node_path15.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp3(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp3(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp3(row.lastAckAt)) || !(row.lastAckOutcome === void 0 || row.lastAckOutcome === null || typeof row.lastAckOutcome === "string" && deliveryOutcomes.has(row.lastAckOutcome)) || !(row.consecutiveAckFailureCount === void 0 || nullableCount(row.consecutiveAckFailureCount)) || !(row.lastAckSignalId === void 0 || row.lastAckSignalId === null || typeof row.lastAckSignalId === "string" && UUID_RE19.test(row.lastAckSignalId)) || !(row.currentDeliverySignalId === void 0 || row.currentDeliverySignalId === null || typeof row.currentDeliverySignalId === "string" && UUID_RE19.test(row.currentDeliverySignalId)) || !(row.currentDeliverySince === void 0 || nullableTimestamp3(row.currentDeliverySince)) || heldBackDeliveries === null || !(row.pendingDeliveryCountAt === void 0 || nullableTimestamp3(row.pendingDeliveryCountAt)) || !(row.routeMode === void 0 || typeof row.routeMode === "string" && isStoredListenerRouteMode(row.routeMode)) || !(row.deferOverChars === void 0 || row.deferOverChars === null || typeof row.deferOverChars === "number" && Number.isSafeInteger(row.deferOverChars) && row.deferOverChars >= 1 && row.deferOverChars <= 1e4) || !(row.pendingForMainCount === void 0 || typeof row.pendingForMainCount === "number" && Number.isSafeInteger(row.pendingForMainCount) && row.pendingForMainCount >= 0) || !(row.droppedForMainCount === void 0 || typeof row.droppedForMainCount === "number" && Number.isSafeInteger(row.droppedForMainCount) && row.droppedForMainCount >= 0) || readHealth === null || wake === null || !(row.connectionsOpened === void 0 || typeof row.connectionsOpened === "number" && Number.isSafeInteger(row.connectionsOpened) && row.connectionsOpened >= 0) || !(row.connectionReuseRatio === void 0 || typeof row.connectionReuseRatio === "number" && Number.isFinite(row.connectionReuseRatio) && row.connectionReuseRatio >= 0) || !(row.activityPublishFailures === void 0 || typeof row.activityPublishFailures === "number" && Number.isSafeInteger(row.activityPublishFailures) && row.activityPublishFailures >= 0) || !(row.activityLastErrorCode === void 0 || row.activityLastErrorCode === null || typeof row.activityLastErrorCode === "string" && STATUS_ACTIVITY_ERROR_CODES.has(
+  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE20.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE20.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE20.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !LISTENER_STATUS_STATES.includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid3(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || !(row.lastErrorDetail === void 0 || row.lastErrorDetail === null || typeof row.lastErrorDetail === "string" && row.lastErrorDetail.length > 0 && row.lastErrorDetail.length <= 2048 && !SECRET_SHAPE_RE.test(row.lastErrorDetail)) || !(row.lastErrorReasonCode === void 0 || row.lastErrorReasonCode === null || typeof row.lastErrorReasonCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorReasonCode)) || !(row.providerExecutable === void 0 || row.providerExecutable === null || typeof row.providerExecutable === "string" && (0, import_node_path15.isAbsolute)(row.providerExecutable)) || !(row.providerVersion === void 0 || row.providerVersion === null || typeof row.providerVersion === "string" && SEMVER_RE2.test(row.providerVersion)) || !(row.providerLastMeasuredVersion === void 0 || row.providerLastMeasuredVersion === null || typeof row.providerLastMeasuredVersion === "string" && SEMVER_RE2.test(row.providerLastMeasuredVersion)) || !(row.providerBundledAgentSdkVersion === void 0 || row.providerBundledAgentSdkVersion === null || typeof row.providerBundledAgentSdkVersion === "string" && SEMVER_RE2.test(row.providerBundledAgentSdkVersion)) || !(row.providerBundledClaudeCodeVersion === void 0 || row.providerBundledClaudeCodeVersion === null || typeof row.providerBundledClaudeCodeVersion === "string" && SEMVER_RE2.test(row.providerBundledClaudeCodeVersion)) || !(row.providerMinimumRequiredVersion === void 0 || row.providerMinimumRequiredVersion === null || typeof row.providerMinimumRequiredVersion === "string" && SEMVER_RE2.test(row.providerMinimumRequiredVersion)) || !(row.cswarmVersion === void 0 || row.cswarmVersion === null || typeof row.cswarmVersion === "string" && SEMVER_RE2.test(row.cswarmVersion)) || (row.providerVersion === null || row.providerVersion === void 0) !== (row.providerLastMeasuredVersion === null || row.providerLastMeasuredVersion === void 0) || !(row.lastWorkerStderrTail === void 0 || row.lastWorkerStderrTail === null || typeof row.lastWorkerStderrTail === "string" && row.lastWorkerStderrTail.length > 0 && row.lastWorkerStderrTail.length <= 2048 && !SECRET_SHAPE_RE.test(row.lastWorkerStderrTail)) || typeof row.logPath !== "string" || !(0, import_node_path15.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp3(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp3(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp3(row.lastAckAt)) || !(row.lastAckOutcome === void 0 || row.lastAckOutcome === null || typeof row.lastAckOutcome === "string" && deliveryOutcomes.has(row.lastAckOutcome)) || !(row.consecutiveAckFailureCount === void 0 || nullableCount(row.consecutiveAckFailureCount)) || !(row.lastAckSignalId === void 0 || row.lastAckSignalId === null || typeof row.lastAckSignalId === "string" && UUID_RE20.test(row.lastAckSignalId)) || !(row.currentDeliverySignalId === void 0 || row.currentDeliverySignalId === null || typeof row.currentDeliverySignalId === "string" && UUID_RE20.test(row.currentDeliverySignalId)) || !(row.currentDeliverySince === void 0 || nullableTimestamp3(row.currentDeliverySince)) || heldBackDeliveries === null || !(row.pendingDeliveryCountAt === void 0 || nullableTimestamp3(row.pendingDeliveryCountAt)) || !(row.routeMode === void 0 || typeof row.routeMode === "string" && isStoredListenerRouteMode(row.routeMode)) || !(row.deferOverChars === void 0 || row.deferOverChars === null || typeof row.deferOverChars === "number" && Number.isSafeInteger(row.deferOverChars) && row.deferOverChars >= 1 && row.deferOverChars <= 1e4) || !(row.pendingForMainCount === void 0 || typeof row.pendingForMainCount === "number" && Number.isSafeInteger(row.pendingForMainCount) && row.pendingForMainCount >= 0) || !(row.droppedForMainCount === void 0 || typeof row.droppedForMainCount === "number" && Number.isSafeInteger(row.droppedForMainCount) && row.droppedForMainCount >= 0) || readHealth === null || wake === null || !(row.connectionsOpened === void 0 || typeof row.connectionsOpened === "number" && Number.isSafeInteger(row.connectionsOpened) && row.connectionsOpened >= 0) || !(row.connectionReuseRatio === void 0 || typeof row.connectionReuseRatio === "number" && Number.isFinite(row.connectionReuseRatio) && row.connectionReuseRatio >= 0) || !(row.activityPublishFailures === void 0 || typeof row.activityPublishFailures === "number" && Number.isSafeInteger(row.activityPublishFailures) && row.activityPublishFailures >= 0) || !(row.activityLastErrorCode === void 0 || row.activityLastErrorCode === null || typeof row.activityLastErrorCode === "string" && STATUS_ACTIVITY_ERROR_CODES.has(
     row.activityLastErrorCode
   )) || !(row.idlePollMs === void 0 || row.idlePollMs === null || typeof row.idlePollMs === "number" && Number.isSafeInteger(row.idlePollMs) && row.idlePollMs >= 0) || !(row.pushReconcileWaitMs === void 0 || row.pushReconcileWaitMs === null || typeof row.pushReconcileWaitMs === "number" && Number.isSafeInteger(row.pushReconcileWaitMs) && row.pushReconcileWaitMs >= 0) || !(row.nextAttemptAt === void 0 || nullableTimestamp3(row.nextAttemptAt)) || !(row.credentialStopAt === void 0 || nullableTimestamp3(row.credentialStopAt)) || !(row.renewalExpiresAt === void 0 || nullableTimestamp3(row.renewalExpiresAt)) || !(row.credentialCheckEdge === void 0 || row.credentialCheckEdge === null || row.credentialCheckEdge === "read" || row.credentialCheckEdge === "command") || !(row.claimRetryCount === void 0 || typeof row.claimRetryCount === "number" && Number.isSafeInteger(row.claimRetryCount) && row.claimRetryCount >= 0) || !(row.projectDirectory === void 0 || typeof row.projectDirectory === "string" && (0, import_node_path15.isAbsolute)(row.projectDirectory)) || !(row.targetUrl === void 0 || typeof row.targetUrl === "string" && (() => {
     try {
@@ -61177,7 +61238,7 @@ init_credential_redaction();
 init_session_proof();
 init_types2();
 init_wake2();
-var UUID_RE20 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE21 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var LISTENER_RESTART_MAX_ATTEMPTS = 5;
 var LISTENER_RESTART_INITIAL_MS = 1e3;
 var LISTENER_RESTART_MAX_MS = 6e4;
@@ -61419,7 +61480,7 @@ async function runListenerSupervisor(options) {
     // before the socket can answer, before any status/event persistence.
     initialize: prepare ? async () => {
       const selected = await prepare(proposedInstanceId);
-      if (!selected || typeof selected !== "object" || typeof selected.instanceId !== "string" || !UUID_RE20.test(selected.instanceId)) {
+      if (!selected || typeof selected !== "object" || typeof selected.instanceId !== "string" || !UUID_RE21.test(selected.instanceId)) {
         throw new Error("listener prepare returned an invalid instance id");
       }
       status = { ...status, instanceId: selected.instanceId };
@@ -62129,7 +62190,7 @@ async function waitForListenerReady(paths, options = {}) {
 var import_node_path16 = require("node:path");
 var import_node_util4 = require("node:util");
 init_storage();
-var UUID_RE21 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var UUID_RE22 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var COMMAND_ID_RE3 = /^[A-Za-z0-9_-]{8,72}$/;
 var SIGNAL_FINGERPRINT_RE = /^[0-9a-f]{64}$/;
 var MAX_JOURNAL_BYTES = 8192;
@@ -62235,7 +62296,7 @@ var ALLOWED_ERROR_CODES = /* @__PURE__ */ new Set([
   "credential_unavailable"
 ]);
 function claimCommandId(listenerInstanceId, claimOrdinal) {
-  if (!UUID_RE21.test(listenerInstanceId)) {
+  if (!UUID_RE22.test(listenerInstanceId)) {
     throw new Error("stored delivery journal is malformed");
   }
   if (!Number.isSafeInteger(claimOrdinal) || claimOrdinal < 0) {
@@ -62250,7 +62311,7 @@ function claimCommandId(listenerInstanceId, claimOrdinal) {
   return id;
 }
 function ackCommandId(leaseId) {
-  if (!UUID_RE21.test(leaseId)) {
+  if (!UUID_RE22.test(leaseId)) {
     throw new Error("stored delivery journal is malformed");
   }
   const cleanLease = leaseId.toLowerCase().replace(/-/g, "");
@@ -62333,19 +62394,19 @@ function parseJournalRecord(raw, expectedWorkspaceId, expectedPrincipalId, rejec
   if (row.version !== 1) {
     throw new Error("stored delivery journal is malformed");
   }
-  if (typeof row.workspaceId !== "string" || !UUID_RE21.test(row.workspaceId) || row.workspaceId !== row.workspaceId.toLowerCase()) {
+  if (typeof row.workspaceId !== "string" || !UUID_RE22.test(row.workspaceId) || row.workspaceId !== row.workspaceId.toLowerCase()) {
     throw new Error("stored delivery journal is malformed");
   }
   if (expectedWorkspaceId && row.workspaceId !== expectedWorkspaceId.toLowerCase()) {
     throw new Error("stored delivery journal is malformed");
   }
-  if (typeof row.principalId !== "string" || !UUID_RE21.test(row.principalId) || row.principalId !== row.principalId.toLowerCase()) {
+  if (typeof row.principalId !== "string" || !UUID_RE22.test(row.principalId) || row.principalId !== row.principalId.toLowerCase()) {
     throw new Error("stored delivery journal is malformed");
   }
   if (expectedPrincipalId && row.principalId !== expectedPrincipalId.toLowerCase()) {
     throw new Error("stored delivery journal is malformed");
   }
-  if (typeof row.listenerInstanceId !== "string" || !UUID_RE21.test(row.listenerInstanceId) || row.listenerInstanceId !== row.listenerInstanceId.toLowerCase()) {
+  if (typeof row.listenerInstanceId !== "string" || !UUID_RE22.test(row.listenerInstanceId) || row.listenerInstanceId !== row.listenerInstanceId.toLowerCase()) {
     throw new Error("stored delivery journal is malformed");
   }
   if (!Number.isSafeInteger(row.nextClaimOrdinal) || row.nextClaimOrdinal < 0) {
@@ -62419,10 +62480,10 @@ function parseJournalRecord(raw, expectedWorkspaceId, expectedPrincipalId, rejec
     if (active.claimLastAttemptAt === null) {
       throw new Error("stored delivery journal is malformed");
     }
-    if (typeof active.signalId !== "string" || !UUID_RE21.test(active.signalId) || active.signalId !== active.signalId.toLowerCase()) {
+    if (typeof active.signalId !== "string" || !UUID_RE22.test(active.signalId) || active.signalId !== active.signalId.toLowerCase()) {
       throw new Error("stored delivery journal is malformed");
     }
-    if (typeof active.leaseId !== "string" || !UUID_RE21.test(active.leaseId) || active.leaseId !== active.leaseId.toLowerCase()) {
+    if (typeof active.leaseId !== "string" || !UUID_RE22.test(active.leaseId) || active.leaseId !== active.leaseId.toLowerCase()) {
       throw new Error("stored delivery journal is malformed");
     }
     if (!isValidIsoTimestamp(active.leasedUntil) || Date.parse(active.leasedUntil) <= Date.parse(active.claimCreatedAt)) {
@@ -62514,7 +62575,7 @@ var FileListenerDeliveryJournal = class {
       ["profileId", "workspaceId", "principalId"],
       "delivery journal configuration rejected"
     );
-    if (typeof options.profileId !== "string" || !options.profileId || options.profileId.includes("\0") || typeof options.workspaceId !== "string" || !UUID_RE21.test(options.workspaceId) || typeof options.principalId !== "string" || !UUID_RE21.test(options.principalId)) {
+    if (typeof options.profileId !== "string" || !options.profileId || options.profileId.includes("\0") || typeof options.workspaceId !== "string" || !UUID_RE22.test(options.workspaceId) || typeof options.principalId !== "string" || !UUID_RE22.test(options.principalId)) {
       throw new Error("delivery journal configuration rejected");
     }
     if (options.stateDirectory !== void 0) {
@@ -62628,7 +62689,7 @@ var FileListenerDeliveryJournal = class {
       ["signalId", "leaseId", "leasedUntil"],
       "delivery journal mutation rejected"
     );
-    if (typeof input.signalId !== "string" || !UUID_RE21.test(input.signalId) || typeof input.leaseId !== "string" || !UUID_RE21.test(input.leaseId) || !isValidIsoTimestamp(input.leasedUntil) || input.signalFingerprint !== void 0 && (typeof input.signalFingerprint !== "string" || !SIGNAL_FINGERPRINT_RE.test(input.signalFingerprint))) {
+    if (typeof input.signalId !== "string" || !UUID_RE22.test(input.signalId) || typeof input.leaseId !== "string" || !UUID_RE22.test(input.leaseId) || !isValidIsoTimestamp(input.leasedUntil) || input.signalFingerprint !== void 0 && (typeof input.signalFingerprint !== "string" || !SIGNAL_FINGERPRINT_RE.test(input.signalFingerprint))) {
       throw new Error("delivery journal mutation rejected");
     }
     const canonicalSignalId = input.signalId.toLowerCase();
@@ -62760,7 +62821,7 @@ async function openListenerDeliveryJournal(options) {
     ["profileId", "workspaceId", "principalId", "proposedListenerInstanceId"],
     "delivery journal configuration rejected"
   );
-  if (typeof options.profileId !== "string" || !options.profileId || options.profileId.includes("\0") || typeof options.workspaceId !== "string" || !UUID_RE21.test(options.workspaceId) || typeof options.principalId !== "string" || !UUID_RE21.test(options.principalId) || typeof options.proposedListenerInstanceId !== "string" || !UUID_RE21.test(options.proposedListenerInstanceId)) {
+  if (typeof options.profileId !== "string" || !options.profileId || options.profileId.includes("\0") || typeof options.workspaceId !== "string" || !UUID_RE22.test(options.workspaceId) || typeof options.principalId !== "string" || !UUID_RE22.test(options.principalId) || typeof options.proposedListenerInstanceId !== "string" || !UUID_RE22.test(options.proposedListenerInstanceId)) {
     throw new Error("delivery journal configuration rejected");
   }
   if (options.stateDirectory !== void 0) {
@@ -62971,7 +63032,7 @@ init_agent_check_budget();
 // src/listener/brain-digest.ts
 var import_node_path18 = require("node:path");
 init_storage();
-var UUID_RE22 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE23 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var TOPIC_RE = /^[a-z0-9][a-z0-9._-]*$/;
 var BRAIN_DIGEST_FILE = "brain-digest.json";
 var BRAIN_DIGEST_LOCK = "brain-digest";
@@ -62991,7 +63052,7 @@ function parseState(raw) {
   }
   const row = value;
   const topicVersions = row.topicVersions;
-  if (row.version !== 1 || typeof row.principalId !== "string" || !UUID_RE22.test(row.principalId) || !topicVersions || typeof topicVersions !== "object" || Array.isArray(topicVersions) || Object.keys(topicVersions).length > MAX_BRAIN_DIGEST_TOPICS) {
+  if (row.version !== 1 || typeof row.principalId !== "string" || !UUID_RE23.test(row.principalId) || !topicVersions || typeof topicVersions !== "object" || Array.isArray(topicVersions) || Object.keys(topicVersions).length > MAX_BRAIN_DIGEST_TOPICS) {
     throw new Error("stored brain digest state is malformed");
   }
   for (const [topic, version4] of Object.entries(topicVersions)) {
@@ -63034,7 +63095,7 @@ function renderBrainDigest(topicCount, topics) {
 var FileBrainDigestStore = class {
   constructor(instanceDirectory, principalId) {
     this.instanceDirectory = instanceDirectory;
-    if (!(0, import_node_path18.isAbsolute)(instanceDirectory) || !UUID_RE22.test(principalId)) {
+    if (!(0, import_node_path18.isAbsolute)(instanceDirectory) || !UUID_RE23.test(principalId)) {
       throw new Error("brain digest state needs an absolute listener directory and principal UUID");
     }
     this.principalId = principalId.toLowerCase();
@@ -63081,7 +63142,7 @@ var FileBrainDigestStore = class {
 };
 
 // src/listener/hook.ts
-var UUID_RE23 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE24 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var TOKEN_RE = /^swm_agt_[A-Za-z0-9_-]{43}$/;
 var INSTANCE_KEY_RE = /^[0-9a-f]{64}$/;
 var MAX_HOOK_CREDENTIAL_BYTES = 8 * 1024;
@@ -63146,7 +63207,7 @@ function parseListenerCredential(raw, rejectUnknownKeys = false) {
     throw new Error("stored listener hook credential is malformed");
   }
   const row = value;
-  if (!(rejectUnknownKeys ? exactKeys2(row, LISTENER_CREDENTIAL_KEYS) : hasRequiredKeys(row, LISTENER_CREDENTIAL_KEYS)) || row.version !== 1 || typeof row.profileId !== "string" || !/^[0-9a-f]{24}$/.test(row.profileId) || typeof row.targetUrl !== "string" || typeof row.anonKey !== "string" || row.anonKey.length < 1 || row.anonKey.length > 4096 || typeof row.workspaceId !== "string" || !UUID_RE23.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE23.test(row.principalId) || typeof row.credential !== "string" || !TOKEN_RE.test(row.credential) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt))) {
+  if (!(rejectUnknownKeys ? exactKeys2(row, LISTENER_CREDENTIAL_KEYS) : hasRequiredKeys(row, LISTENER_CREDENTIAL_KEYS)) || row.version !== 1 || typeof row.profileId !== "string" || !/^[0-9a-f]{24}$/.test(row.profileId) || typeof row.targetUrl !== "string" || typeof row.anonKey !== "string" || row.anonKey.length < 1 || row.anonKey.length > 4096 || typeof row.workspaceId !== "string" || !UUID_RE24.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE24.test(row.principalId) || typeof row.credential !== "string" || !TOKEN_RE.test(row.credential) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt))) {
     throw new Error("stored listener hook credential is malformed");
   }
   const target2 = cloudTarget(row.targetUrl, row.anonKey);
@@ -63204,7 +63265,7 @@ function parseSurface(raw, rejectUnknownKeys = false) {
     throw new Error("stored listener hook surface state is malformed");
   }
   const row = value;
-  if (rejectUnknownKeys && Object.keys(row).some((key2) => !HOOK_SURFACE_KEYS.has(key2)) || row.version !== 1 || !Array.isArray(row.surfacedSignalIds) || row.surfacedSignalIds.length > HOOK_SURFACED_IDS_MAX || row.surfacedSignalIds.some((id) => typeof id !== "string" || !UUID_RE23.test(id)) || !(row.reportedDroppedCount === void 0 || typeof row.reportedDroppedCount === "number" && Number.isSafeInteger(row.reportedDroppedCount) && row.reportedDroppedCount >= 0) || !(row.credentialFailureReported === void 0 || typeof row.credentialFailureReported === "boolean")) {
+  if (rejectUnknownKeys && Object.keys(row).some((key2) => !HOOK_SURFACE_KEYS.has(key2)) || row.version !== 1 || !Array.isArray(row.surfacedSignalIds) || row.surfacedSignalIds.length > HOOK_SURFACED_IDS_MAX || row.surfacedSignalIds.some((id) => typeof id !== "string" || !UUID_RE24.test(id)) || !(row.reportedDroppedCount === void 0 || typeof row.reportedDroppedCount === "number" && Number.isSafeInteger(row.reportedDroppedCount) && row.reportedDroppedCount >= 0) || !(row.credentialFailureReported === void 0 || typeof row.credentialFailureReported === "boolean")) {
     throw new Error("stored listener hook surface state is malformed");
   }
   const ids = row.surfacedSignalIds.map((id) => String(id).toLowerCase());
@@ -63235,7 +63296,7 @@ var FileHookSurfaceStore = class {
     const unseen = [];
     for (const item of items) {
       const signalId = item.signalId.toLowerCase();
-      if (!UUID_RE23.test(signalId) || seen.has(signalId)) continue;
+      if (!UUID_RE24.test(signalId) || seen.has(signalId)) continue;
       seen.add(signalId);
       unseen.push(item);
     }
@@ -63266,7 +63327,7 @@ var FileHookSurfaceStore = class {
       const unseen = [];
       for (const item of items) {
         const signalId = item.signalId.toLowerCase();
-        if (!UUID_RE23.test(signalId) || seen.has(signalId)) continue;
+        if (!UUID_RE24.test(signalId) || seen.has(signalId)) continue;
         seen.add(signalId);
         unseen.push(item);
       }
@@ -63289,7 +63350,7 @@ var FileHookSurfaceStore = class {
       const seen = new Set(state.surfacedSignalIds);
       for (const signalId of options.signalIds ?? []) {
         const checked = signalId.toLowerCase();
-        if (UUID_RE23.test(checked)) seen.add(checked);
+        if (UUID_RE24.test(checked)) seen.add(checked);
       }
       await writeSecureJsonFile(
         this.path,
@@ -63418,7 +63479,7 @@ async function discoverContexts(stateDirectory2, principalIds, isListenerLive =
     }
     selectedPrincipals = availablePrincipals;
   } else {
-    if (principalIds.some((principalId) => !UUID_RE23.test(principalId))) {
+    if (principalIds.some((principalId) => !UUID_RE24.test(principalId))) {
       return { contexts: [], requiresPrincipalScope: false };
     }
     selectedPrincipals = new Set(principalIds.map((principalId) => principalId.toLowerCase()));
@@ -65669,10 +65730,10 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "write",
   "allow-duplicate-name"
 ]);
-var UUID_RE24 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE25 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function packageVersion() {
-  if ("0.1.76".length > 0) {
-    return "0.1.76";
+  if ("0.1.77".length > 0) {
+    return "0.1.77";
   }
   try {
     const value = JSON.parse(
@@ -66491,7 +66552,7 @@ async function workspaceId(args, cloud, human, options = {}) {
     warn: options.warn ?? writeWorkspaceWarning
   });
 }
-function uuid7(value, field) {
+function uuid8(value, field) {
   if (value === void 0 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
     throw new Error(`server returned a malformed ${field}`);
   }
@@ -66596,7 +66657,7 @@ async function runNew(args) {
     throw error2;
   }
   const response = acceptedConnect("workspace creation", result);
-  const created = uuid7(response.workspace_id, "workspace_id");
+  const created = uuid8(response.workspace_id, "workspace_id");
   if (created !== proposedId) {
     throw new Error(
       "the server confirmed a different workspace than this command created; run cswarm workspaces before doing anything else"
@@ -66612,7 +66673,7 @@ async function runNew(args) {
       project: {
         workspace_id: created,
         name,
-        stream_id: typeof response.stream_id === "string" && UUID_RE24.test(response.stream_id) ? response.stream_id : null
+        stream_id: typeof response.stream_id === "string" && UUID_RE25.test(response.stream_id) ? response.stream_id : null
       }
     });
     return;
@@ -66885,7 +66946,7 @@ async function runInvite(args) {
     );
   }
   assertInvitationToken(response.invitation_token);
-  const responseWorkspaceId = uuid7(response.workspace_id, "workspace_id");
+  const responseWorkspaceId = uuid8(response.workspace_id, "workspace_id");
   if (typeof response.workspace_name !== "string" || typeof response.inviter_display_name !== "string") {
     throw new Error(
       "the invitation was created without its fresh display labels; run invite again to issue a complete link"
@@ -66905,7 +66966,7 @@ async function runInvite(args) {
   printJson({
     message: "Invitation created. Share the one-time link below with its intended recipient. It can be accepted once before it expires; use a GitHub account with a distinct verified email for a second person.",
     status: response.status,
-    invitation_id: uuid7(response.invitation_id, "invitation_id"),
+    invitation_id: uuid8(response.invitation_id, "invitation_id"),
     invite_link: inviteLink
   });
 }
@@ -67017,7 +67078,7 @@ async function runLegacyAccept(args) {
       { kind: "accept_invitation", token: invitationToken }
     )
   );
-  const acceptedWorkspace = uuid7(response.workspace_id, "workspace_id");
+  const acceptedWorkspace = uuid8(response.workspace_id, "workspace_id");
   await writeWorkspaceDefault(human.store, human.userId, acceptedWorkspace);
   await writeCurrentTarget(cloud);
   printJson({
@@ -67170,7 +67231,7 @@ async function runPrincipal(args) {
         "Agent identity created. It makes this machine's agent auditable inside the shared workspace. Its name is visible to everyone in the workspace, so avoid naming it after anything private."
       ),
       status: response.status,
-      principal_id: uuid7(response.principal_id, "principal_id")
+      principal_id: uuid8(response.principal_id, "principal_id")
     });
     return;
   }
@@ -67297,8 +67358,8 @@ async function runToken(args) {
   );
   printJson(agentCredentialArtifact({
     principalId,
-    tokenId: uuid7(response.token_id, "token_id"),
-    runId: uuid7(response.run_id, "run_id"),
+    tokenId: uuid8(response.token_id, "token_id"),
+    runId: uuid8(response.run_id, "run_id"),
     token: response.agent_token,
     expiresAt
   }));
@@ -67452,7 +67513,7 @@ async function runLinkNew(args) {
     2
   );
   const taskId = args.required("task-id");
-  if (!UUID_RE24.test(taskId)) {
+  if (!UUID_RE25.test(taskId)) {
     throw new Error("--task-id must be the work item's UUID");
   }
   const site = capabilitySiteOrigin(
@@ -67482,11 +67543,11 @@ async function runLinkNew(args) {
   );
   if (response.capability_token === void 0) {
     throw new Error(
-      `this link was created on a prior attempt, and its credential is shown only in a fresh response \u2014 the server keeps just a hash, so it cannot be shown again; run cswarm link new to issue another, then run cswarm link revoke --capability-id ${uuid7(response.capability_id, "capability_id")} to withdraw the one you cannot see`
+      `this link was created on a prior attempt, and its credential is shown only in a fresh response \u2014 the server keeps just a hash, so it cannot be shown again; run cswarm link new to issue another, then run cswarm link revoke --capability-id ${uuid8(response.capability_id, "capability_id")} to withdraw the one you cannot see`
     );
   }
   assertCapabilityToken(response.capability_token);
-  const capabilityId = uuid7(response.capability_id, "capability_id");
+  const capabilityId = uuid8(response.capability_id, "capability_id");
   const expiresAt = capabilityTimestamp(response.expires_at, "expires_at");
   const url = capabilityUrl(site, response.capability_token);
   if (args.has("json")) {
@@ -67512,7 +67573,7 @@ async function runLinkRevoke(args) {
     2
   );
   const capabilityId = args.required("capability-id");
-  if (!UUID_RE24.test(capabilityId)) {
+  if (!UUID_RE25.test(capabilityId)) {
     throw new Error(
       "--capability-id must be the id printed when the link was created"
     );
@@ -67530,7 +67591,7 @@ async function runLinkRevoke(args) {
       { kind: "revoke_capability_url", capability_id: capabilityId }
     )
   );
-  const revoked = uuid7(response.capability_id, "capability_id");
+  const revoked = uuid8(response.capability_id, "capability_id");
   const revokedAt = capabilityTimestamp(response.revoked_at, "revoked_at");
   const message = renderCapabilityRevoke(revoked, revokedAt);
   if (args.has("json")) {
@@ -68241,7 +68302,7 @@ async function runReply(args) {
     );
   }
   const signalId = args.positionals[1];
-  if (signalId === void 0 || !UUID_RE24.test(signalId)) {
+  if (signalId === void 0 || !UUID_RE25.test(signalId)) {
     throw new Error("reply requires the signal UUID being answered");
   }
   const body2 = await resolveSignalBody(args, 2, allowedFlags);
@@ -68341,7 +68402,7 @@ function workspaceLabel(directory) {
 function renderWorkspace(id, name) {
   return name === null ? id : `${name} (${id})`;
 }
-function renderRoster(directory, memberNames, workspace) {
+function renderRoster(directory, memberNames, workspace, pending = []) {
   const lines = [];
   if (workspace !== void 0) {
     lines.push(`Workspace: ${renderWorkspace(workspace.workspaceId, workspace.workspaceName)}`);
@@ -68369,6 +68430,15 @@ function renderRoster(directory, memberNames, workspace) {
     );
   }
   lines.push("");
+  lines.push(pending === null ? "Invited, not connected: could not load" : "Invited, not connected:");
+  if (pending !== null && pending.length === 0) lines.push("- none yet");
+  for (const entry2 of pending ?? []) {
+    const name = entry2.kind === "classic" ? sanitizeDisplayLabel(entry2.principal_name ?? "", "Unnamed agent") : "Agent connect code";
+    const id = entry2.principal_id ?? entry2.join_credential_id;
+    const seats = entry2.kind === "join" ? ` \xB7 ${entry2.seats_used}/${entry2.seat_cap} seats used \xB7 issued by ${sanitizeDisplayLabel(entry2.issuer_display, "Workspace member")}` : "";
+    lines.push(`- ${name} (${id}) \xB7 ${pendingAccessAge(entry2.issued_at)}${seats}`);
+  }
+  lines.push("");
   lines.push('Address an agent by the id in brackets: cswarm ask "\u2026" --to <id>');
   return `${lines.join("\n")}
 `;
@@ -68390,6 +68460,12 @@ async function runMembers(args) {
     selected.selectedWorkspace,
     selected
   );
+  const pending = await readPendingAccessOptional(
+    cloud,
+    selected.bearer,
+    selected.selectedWorkspace,
+    selected.fetcher
+  );
   const memberNames = new Map(
     directory.members.map((member) => [
       member.user_id,
@@ -68415,7 +68491,9 @@ async function runMembers(args) {
              * it. Report null rather than inventing an owner. */
             owner_user_id: agent.owner_user_id ?? null,
             owner_name: agent.owner_user_id === void 0 ? null : memberNames.get(agent.owner_user_id) ?? null
-          }))
+          })),
+          pending,
+          ...pending === null ? { pending_error: "could not load" } : {}
         },
         null,
         2
@@ -68427,7 +68505,7 @@ async function runMembers(args) {
   process.stdout.write(renderRoster(directory, memberNames, {
     workspaceId: selected.selectedWorkspace,
     workspaceName: workspaceLabel(directory)
-  }));
+  }, pending));
 }
 async function runWhoami(args) {
   args.assertShape([
@@ -68877,7 +68955,7 @@ async function runReceipt(args) {
     ...SESSION_CONTEXT_FLAGS
   ], 2);
   const signalId = args.positionals[1];
-  if (!UUID_RE24.test(signalId)) {
+  if (!UUID_RE25.test(signalId)) {
     throw new Error("signal-id must be a UUID");
   }
   if (!hasAgentCredential(args)) {
@@ -69037,7 +69115,7 @@ async function runInboxFollowCommand(args) {
   }
 }
 function listenerUuid(value, flag) {
-  if (!value || !UUID_RE24.test(value)) {
+  if (!value || !UUID_RE25.test(value)) {
     throw new Error(`--${flag} must be a UUID`);
   }
   return value.toLowerCase();
@@ -70710,7 +70788,7 @@ async function runSession(args) {
     const human = await humanCredential(args, cloud2);
     const workspace = await workspaceId(args, cloud2, human);
     const principalId = args.required("principal-id");
-    if (!UUID_RE24.test(principalId)) {
+    if (!UUID_RE25.test(principalId)) {
       throw new Error("--principal-id must be a UUID");
     }
     const result2 = await runHumanSessionLifecycle(action, {
@@ -71183,7 +71261,7 @@ async function runHook(args) {
   if (command2 === "check") {
     args.assertShape(["cooldown", "principal-id"], 2);
     const rawPrincipalIds = args.all("principal-id");
-    if (rawPrincipalIds.some((principalId2) => !UUID_RE24.test(principalId2))) return;
+    if (rawPrincipalIds.some((principalId2) => !UUID_RE25.test(principalId2))) return;
     const principalIds = rawPrincipalIds.map((principalId2) => principalId2.toLowerCase());
     const rawCooldown = args.optional("cooldown");
     const cooldownSeconds = rawCooldown === void 0 ? void 0 : Number(rawCooldown);
@@ -71311,7 +71389,7 @@ async function fileRows(context) {
   );
 }
 async function resolveFileSelector(context, selector) {
-  if (UUID_RE24.test(selector)) return selector.toLowerCase();
+  if (UUID_RE25.test(selector)) return selector.toLowerCase();
   const rows3 = await fileRows(context);
   const match = rows3.find(
     (row) => row.name.toLowerCase() === selector.toLowerCase()
@@ -71757,7 +71835,7 @@ async function channelRows(context) {
   }
 }
 function channelSelectorKind(selector) {
-  if (UUID_RE24.test(selector)) return "id";
+  if (UUID_RE25.test(selector)) return "id";
   const problem = channelSelectorProblem(selector);
   if (problem !== null) throw new Error(problem);
   return "name";