@codemem/server 0.22.3 → 0.23.0

package/dist/index.js

@@ -1,12 +1,12 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorReviewJoinRequestAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
 import { homedir } from "node:os";
-import { count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
+import { and, count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
 import net from "node:net";
@@ -591,14 +591,15 @@ function queryMemoryPage(store, options) {
 			 ORDER BY memory_items.created_at DESC
 			 LIMIT ? OFFSET ?`).all(...filterResult.params, options.limit + 1, options.offset).map((row) => ({
 		...row,
+		kind: canonicalMemoryKind(row.kind ?? null, row.metadata_json),
 		metadata_json: fromJson(row.metadata_json ?? null)
 	}));
 }
-function isSummaryLikeMemory(item) {
-	if (String(item.kind ?? "").toLowerCase() === "session_summary") return true;
-	const metadata = item.metadata_json ?? {};
-	if (metadata.is_summary === true) return true;
-	return String(metadata.source ?? "").trim().toLowerCase() === "observer_summary";
+function isSummaryLikeMemory$1(item) {
+	return isSummaryLikeMemory({
+		kind: item.kind,
+		metadata: item.metadata_json
+	});
 }
 function selectMemoryPage(store, options) {
 	const pageSize = Math.max(options.limit + options.offset + 10, 50);
@@ -653,7 +654,7 @@ function memoryRoutes(getStore) {
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => !isSummaryLikeMemory(item)
+				matcher: (item) => !isSummaryLikeMemory$1(item)
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
@@ -680,7 +681,7 @@ function memoryRoutes(getStore) {
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => isSummaryLikeMemory(item)
+				matcher: (item) => isSummaryLikeMemory$1(item)
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
@@ -719,7 +720,7 @@ function memoryRoutes(getStore) {
 						project: scopeProject
 					});
 					if (page.length === 0) break;
-					total += page.filter((item) => !isSummaryLikeMemory(item)).length;
+					total += page.filter((item) => !isSummaryLikeMemory$1(item)).length;
 					if (page.length < 200) break;
 					offset += page.length;
 				}
@@ -1288,6 +1289,9 @@ var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
 var LEGACY_SHARED_WORKSPACE_ID = "shared:legacy";
+function syncKeysDir() {
+	return process.env.CODEMEM_KEYS_DIR?.trim() || void 0;
+}
 function intEnvOr(name, fallback) {
 	const value = Number.parseInt(process.env[name] ?? "", 10);
 	return Number.isFinite(value) ? value : fallback;
@@ -1324,8 +1328,8 @@ function pathWithQuery(url) {
 	const parsed = new URL(url);
 	return parsed.search ? `${parsed.pathname}${parsed.search}` : parsed.pathname;
 }
-function unauthorizedPayload(reason) {
-	if (process.env.CODEMEM_SYNC_AUTH_DIAGNOSTICS === "1") return {
+function unauthorizedPayload(reason, exposeReason = false) {
+	if (exposeReason && process.env.CODEMEM_SYNC_AUTH_DIAGNOSTICS === "1") return {
 		error: "unauthorized",
 		reason
 	};
@@ -1397,6 +1401,123 @@ function authorizeSyncRequest(store, request, body) {
 		deviceId
 	};
 }
+async function authorizeBootstrapGrantRequest(store, request, body) {
+	const grantId = (request.header("X-Codemem-Bootstrap-Grant") ?? "").trim();
+	const deviceId = (request.header("X-Opencode-Device") ?? "").trim();
+	const signature = request.header("X-Opencode-Signature") ?? "";
+	const timestamp = request.header("X-Opencode-Timestamp") ?? "";
+	const nonce = request.header("X-Opencode-Nonce") ?? "";
+	if (!grantId || !deviceId || !signature || !timestamp || !nonce) return {
+		ok: false,
+		reason: "missing_bootstrap_grant_headers",
+		deviceId
+	};
+	const config = readCoordinatorSyncConfig();
+	if (!config.syncCoordinatorUrl || !config.syncCoordinatorAdminSecret) return {
+		ok: false,
+		reason: "bootstrap_grant_coordinator_not_configured",
+		deviceId
+	};
+	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	let verification;
+	try {
+		const [status, payload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
+			headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
+			timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
+		});
+		if (status !== 200 || !payload) return {
+			ok: false,
+			reason: "bootstrap_grant_lookup_failed",
+			deviceId
+		};
+		verification = payload;
+	} catch {
+		return {
+			ok: false,
+			reason: "bootstrap_grant_lookup_failed",
+			deviceId
+		};
+	}
+	const grant = verification.grant;
+	const workerEnrollment = verification.worker_enrollment;
+	if (!grant || !workerEnrollment) return {
+		ok: false,
+		reason: "bootstrap_grant_invalid_payload",
+		deviceId
+	};
+	if (grant.revoked_at) return {
+		ok: false,
+		reason: "bootstrap_grant_revoked",
+		deviceId
+	};
+	if (String(workerEnrollment.device_id) !== String(grant.worker_device_id)) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_enrollment_mismatch",
+		deviceId
+	};
+	if (String(workerEnrollment.group_id) !== String(grant.group_id)) return {
+		ok: false,
+		reason: "bootstrap_grant_group_mismatch",
+		deviceId
+	};
+	if (Number(workerEnrollment.enabled) !== 1) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_disabled",
+		deviceId
+	};
+	if (grant.worker_device_id !== deviceId) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_mismatch",
+		deviceId
+	};
+	if (grant.seed_device_id !== localDeviceId) return {
+		ok: false,
+		reason: "bootstrap_grant_seed_mismatch",
+		deviceId
+	};
+	if (new Date(grant.expires_at) <= /* @__PURE__ */ new Date()) return {
+		ok: false,
+		reason: "bootstrap_grant_expired",
+		deviceId
+	};
+	let valid = false;
+	try {
+		valid = verifySignature({
+			method: request.method,
+			pathWithQuery: pathWithQuery(request.url),
+			bodyBytes: body,
+			timestamp,
+			nonce,
+			signature,
+			publicKey: String(workerEnrollment.public_key),
+			deviceId
+		});
+	} catch {
+		return {
+			ok: false,
+			reason: "bootstrap_grant_signature_verification_error",
+			deviceId
+		};
+	}
+	if (!valid) return {
+		ok: false,
+		reason: "bootstrap_grant_invalid_signature",
+		deviceId
+	};
+	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+	if (!recordNonce(store.db, deviceId, nonce, createdAt)) return {
+		ok: false,
+		reason: "nonce_replay",
+		deviceId
+	};
+	const cutoff = (/* @__PURE__ */ new Date(Date.now() - DEFAULT_TIME_WINDOW_S * 2 * 1e3)).toISOString();
+	cleanupNonces(store.db, cutoff);
+	return {
+		ok: true,
+		reason: "ok",
+		deviceId
+	};
+}
 function projectBasename(value) {
 	const project = String(value ?? "").trim().replaceAll("\\", "/");
 	if (!project) return "";
@@ -1795,29 +1916,43 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	}
 	app.get("/v1/status", (c) => {
 		const store = getStore();
-		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
-		const limited = rateLimitedResponse(c, auth.deviceId, true);
-		if (limited) return limited;
-		try {
-			let device = store.db.prepare("SELECT device_id, fingerprint FROM sync_device LIMIT 1").get();
-			if (!device) {
-				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db);
-				device = {
+		return (async () => {
+			let auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+			let preauthChecked = false;
+			let bootstrapAttempted = false;
+			if (!auth.ok) {
+				if ((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()) {
+					preauthChecked = true;
+					const bootstrapLimited = rateLimitedResponse(c, c.req.path, false);
+					if (bootstrapLimited) return bootstrapLimited;
+				} else {
+					preauthChecked = true;
+					const unauthLimited = rateLimitedResponse(c, c.req.path, false);
+					if (unauthLimited) return unauthLimited;
+				}
+				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
+				bootstrapAttempted = true;
+			}
+			if (!auth.ok) {
+				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+			}
+			const limited = rateLimitedResponse(c, auth.deviceId, true);
+			if (limited) return limited;
+			try {
+				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+				const syncReset = getSyncResetState(store.db);
+				return c.json({
 					device_id: deviceId,
-					fingerprint
-				};
+					protocol_version: SYNC_PROTOCOL_VERSION,
+					fingerprint,
+					sync_reset: syncReset
+				});
+			} catch {
+				return c.json({ error: "internal_error" }, 500);
 			}
-			const syncReset = getSyncResetState(store.db);
-			return c.json({
-				device_id: device.device_id,
-				protocol_version: SYNC_PROTOCOL_VERSION,
-				fingerprint: device.fingerprint,
-				sync_reset: syncReset
-			});
-		} catch {
-			return c.json({ error: "internal_error" }, 500);
-		}
+		})();
 	});
 	app.get("/v1/ops", (c) => {
 		const store = getStore();
@@ -1834,15 +1969,11 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			const snapshotId = c.req.query("snapshot_id") ?? null;
 			const baselineCursor = c.req.query("baseline_cursor") ?? null;
 			const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 1e3)) : 200;
-			let localDeviceId = store.db.prepare("SELECT device_id FROM sync_device LIMIT 1").get();
-			if (!localDeviceId) {
-				const [deviceId] = ensureDeviceIdentity(store.db);
-				localDeviceId = { device_id: deviceId };
-			}
+			const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 			const result = loadReplicationOpsForPeer(store.db, {
 				since,
 				limit,
-				deviceId: localDeviceId.device_id,
+				deviceId: localDeviceId,
 				generation: Number.isFinite(generation) ? generation : null,
 				snapshotId,
 				baselineCursor
@@ -1869,42 +2000,63 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	});
 	app.get("/v1/snapshot", (c) => {
 		const store = getStore();
-		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
-		const limited = rateLimitedResponse(c, auth.deviceId, true);
-		if (limited) return limited;
-		try {
-			const rawGeneration = c.req.query("generation");
-			const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
-			const snapshotId = c.req.query("snapshot_id") ?? null;
-			const baselineCursor = c.req.query("baseline_cursor") ?? null;
-			const pageToken = c.req.query("page_token") ?? null;
-			const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
-			const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 1e3)) : 200;
-			if (generation == null || !Number.isFinite(generation)) return c.json({ error: "missing_generation" }, 400);
-			if (!snapshotId) return c.json({ error: "missing_snapshot_id" }, 400);
-			const result = loadMemorySnapshotPageForPeer(store.db, {
-				generation,
-				snapshotId,
-				baselineCursor,
-				pageToken,
-				limit,
-				peerDeviceId: auth.deviceId
-			});
-			return c.json({
-				generation: result.boundary.generation,
-				snapshot_id: result.boundary.snapshot_id,
-				baseline_cursor: result.boundary.baseline_cursor,
-				retained_floor_cursor: result.boundary.retained_floor_cursor,
-				items: result.items,
-				next_page_token: result.nextPageToken,
-				has_more: result.hasMore
-			});
-		} catch (err) {
-			const message = err instanceof Error ? err.message : "";
-			if (message === "generation_mismatch" || message === "boundary_mismatch") return c.json({ error: message }, 409);
-			return c.json({ error: "internal_error" }, 500);
-		}
+		return (async () => {
+			let auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+			let preauthChecked = false;
+			let bootstrapAttempted = false;
+			if (!auth.ok) {
+				if ((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()) {
+					preauthChecked = true;
+					const bootstrapLimited = rateLimitedResponse(c, c.req.path, false);
+					if (bootstrapLimited) return bootstrapLimited;
+				} else {
+					preauthChecked = true;
+					const unauthLimited = rateLimitedResponse(c, c.req.path, false);
+					if (unauthLimited) return unauthLimited;
+				}
+				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
+				bootstrapAttempted = true;
+			}
+			if (!auth.ok) {
+				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+			}
+			const limited = rateLimitedResponse(c, auth.deviceId, true);
+			if (limited) return limited;
+			try {
+				const rawGeneration = c.req.query("generation");
+				const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
+				const snapshotId = c.req.query("snapshot_id") ?? null;
+				const baselineCursor = c.req.query("baseline_cursor") ?? null;
+				const pageToken = c.req.query("page_token") ?? null;
+				const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
+				const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200;
+				if (generation == null || !Number.isFinite(generation)) return c.json({ error: "missing_generation" }, 400);
+				if (!snapshotId) return c.json({ error: "missing_snapshot_id" }, 400);
+				const result = loadMemorySnapshotPageForPeer(store.db, {
+					generation,
+					snapshotId,
+					baselineCursor,
+					pageToken,
+					limit,
+					peerDeviceId: auth.deviceId
+				});
+				return c.json({
+					generation: result.boundary.generation,
+					snapshot_id: result.boundary.snapshot_id,
+					baseline_cursor: result.boundary.baseline_cursor,
+					retained_floor_cursor: result.boundary.retained_floor_cursor,
+					items: result.items,
+					next_page_token: result.nextPageToken,
+					has_more: result.hasMore
+				});
+			} catch (err) {
+				const message = err instanceof Error ? err.message : "";
+				if (message === "generation_mismatch" || message === "boundary_mismatch") return c.json({ error: message }, 409);
+				return c.json({ error: "internal_error" }, 500);
+			}
+		})();
 	});
 	app.post("/v1/ops", async (c) => {
 		const store = getStore();
@@ -1931,13 +2083,9 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			reason: "device_id_mismatch",
 			op_id: op.op_id
 		}, 400);
-		let localDeviceId = store.db.prepare("SELECT device_id FROM sync_device LIMIT 1").get();
-		if (!localDeviceId) {
-			const [deviceId] = ensureDeviceIdentity(store.db);
-			localDeviceId = { device_id: deviceId };
-		}
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 		const filteredInbound = filterOpsForPeer(store, peerDeviceId, normalizedOps);
-		const result = applyReplicationOps(store.db, filteredInbound.allowed, localDeviceId.device_id);
+		const result = applyReplicationOps(store.db, filteredInbound.allowed, localDeviceId);
 		return c.json({
 			...result,
 			skipped: result.skipped + filteredInbound.skipped
@@ -2036,7 +2184,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			});
 			const peersMap = {};
 			for (const peer of peersItems) peersMap[String(peer.peer_device_id)] = peer.status;
-			const attemptsItems = d.select({
+			const attemptRows = d.select({
 				peer_device_id: schema.syncAttempts.peer_device_id,
 				ok: schema.syncAttempts.ok,
 				error: schema.syncAttempts.error,
@@ -2044,11 +2192,20 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				finished_at: schema.syncAttempts.finished_at,
 				ops_in: schema.syncAttempts.ops_in,
 				ops_out: schema.syncAttempts.ops_out
-			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(25).all().map((row) => ({
-				...row,
-				status: attemptStatus(row),
-				address: null
-			}));
+			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(25).all();
+			const peerAddressMap = /* @__PURE__ */ new Map();
+			store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all().forEach((peerRow) => {
+				const addrs = safeJsonList(peerRow.addresses_json);
+				if (addrs.length) peerAddressMap.set(String(peerRow.peer_device_id ?? ""), addrs);
+			});
+			const attemptsItems = attemptRows.map((row) => {
+				const addrs = showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0;
+				return {
+					...row,
+					status: attemptStatus(row),
+					address: addrs?.length ? addrs[0] : null
+				};
+			});
 			const latestAttemptError = String(attemptsItems[0]?.error || "").trim();
 			const statusBlock = {
 				...statusPayload,
@@ -2118,7 +2275,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const d = drizzle(store.db, { schema });
 			const includeMerged = queryBool(c.req.query("includeMerged"));
 			const query = d.select().from(schema.actors);
-			const rows = includeMerged ? query.orderBy(schema.actors.display_name).all() : query.where(ne(schema.actors.status, "merged")).orderBy(schema.actors.display_name).all();
+			const rows = includeMerged ? query.orderBy(schema.actors.display_name).all() : query.where(and(ne(schema.actors.status, "merged"), ne(schema.actors.status, "deactivated"))).orderBy(schema.actors.display_name).all();
 			return c.json({ items: rows });
 		}
 	});
@@ -2162,7 +2319,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				publicKey = String(deviceRow.public_key);
 				fingerprint = String(deviceRow.fingerprint);
 			} else try {
-				const [id, fp] = ensureDeviceIdentity(store.db);
+				const [id, fp] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				deviceId = id;
 				fingerprint = fp;
 				publicKey = d.select({ public_key: schema.syncDevice.public_key }).from(schema.syncDevice).where(eq(schema.syncDevice.device_id, id)).get()?.public_key ?? "";
@@ -2371,7 +2528,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		if (!primary || !secondary) return c.json({ error: "actor not found" }, 404);
 		if (primary.status !== "active") return c.json({ error: "primary actor not active" }, 409);
 		if (secondary.status !== "active") return c.json({ error: "secondary actor not active" }, 409);
-		if (secondary.is_local) return c.json({ error: "cannot merge local actor" }, 409);
+		if (secondary.is_local && secondary.actor_id === store.actorId) return c.json({ error: "cannot merge this device's own local actor" }, 409);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const mergedCount = store.db.transaction(() => {
 			const peerUpdate = d.update(schema.syncPeers).set({ actor_id: primaryActorId }).where(eq(schema.syncPeers.actor_id, secondaryActorId)).run();
@@ -2385,6 +2542,29 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		})();
 		return c.json({ merged_count: mergedCount });
 	});
+	app.post("/api/sync/actors/deactivate", async (c) => {
+		const store = getStore();
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const actorId = String(body.actor_id ?? "").trim();
+		if (!actorId) return c.json({ error: "actor_id required" }, 400);
+		if (actorId === store.actorId) return c.json({ error: "cannot deactivate this device's own local actor" }, 409);
+		const d = drizzle(store.db, { schema });
+		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
+		if (!actor) return c.json({ error: "actor not found" }, 404);
+		if (actor.status !== "active") return c.json({ error: "actor not active" }, 409);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		d.update(schema.actors).set({
+			status: "deactivated",
+			updated_at: now
+		}).where(eq(schema.actors.actor_id, actorId)).run();
+		d.update(schema.syncPeers).set({ actor_id: null }).where(eq(schema.syncPeers.actor_id, actorId)).run();
+		return c.json({ ok: true });
+	});
 	app.post("/api/sync/legacy-devices/claim", async (c) => {
 		const store = getStore();
 		let body;
@@ -2520,6 +2700,47 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: message }, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
 		}
 	});
+	app.get("/api/sync/bootstrap-grants", async (c) => {
+		const groupId = String(c.req.query("group_id") ?? "").trim();
+		if (!groupId) return c.json({ error: "group_id_required" }, 400);
+		const config = readCoordinatorSyncConfig();
+		try {
+			const items = await coordinatorListBootstrapGrantsAction({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({ items });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({ error: message }, 500);
+		}
+	});
+	app.post("/api/sync/bootstrap-grants/revoke", async (c) => {
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const grantId = String(body.grant_id ?? "").trim();
+		if (!grantId) return c.json({ error: "grant_id_required" }, 400);
+		const config = readCoordinatorSyncConfig();
+		try {
+			if (!await coordinatorRevokeBootstrapGrantAction({
+				grantId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})) return c.json({ error: "grant_not_found" }, 404);
+			return c.json({
+				ok: true,
+				grant_id: grantId
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({ error: message }, 500);
+		}
+	});
 	app.delete("/api/sync/peers/:peer_device_id", (c) => {
 		const store = getStore();
 		{