@codemem/server 0.22.4 → 0.24.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorReviewJoinRequestAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -193,6 +193,15 @@ var ALLOWED_KEYS = [
 	"observer_base_url",
 	"observer_provider",
 	"observer_model",
+	"observer_tier_routing_enabled",
+	"observer_simple_model",
+	"observer_simple_temperature",
+	"observer_rich_model",
+	"observer_rich_temperature",
+	"observer_rich_openai_use_responses",
+	"observer_rich_reasoning_effort",
+	"observer_rich_reasoning_summary",
+	"observer_rich_max_output_tokens",
 	"observer_runtime",
 	"observer_auth_source",
 	"observer_auth_file",
@@ -221,6 +230,8 @@ var DEFAULTS = {
 	claude_command: ["claude"],
 	observer_runtime: "api_http",
 	observer_auth_source: "auto",
+	observer_tier_routing_enabled: false,
+	observer_rich_openai_use_responses: false,
 	observer_auth_command: [],
 	observer_auth_timeout_ms: 1500,
 	observer_auth_cache_ttl_s: 300,
@@ -319,6 +330,13 @@ function parsePositiveInt(value, allowZero = false) {
 	if (allowZero) return parsed >= 0 ? parsed : null;
 	return parsed > 0 ? parsed : null;
 }
+function parseFiniteNumber(value, allowZero = true) {
+	if (typeof value === "boolean") return null;
+	const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim().length > 0 ? Number(value.trim()) : NaN;
+	if (!Number.isFinite(parsed)) return null;
+	if (allowZero) return parsed >= 0 ? parsed : null;
+	return parsed > 0 ? parsed : null;
+}
 function asStringMap(value) {
 	if (value == null || typeof value !== "object" || Array.isArray(value)) return null;
 	const parsed = {};
@@ -388,13 +406,24 @@ function validateAndApplyUpdate(configData, key, value, providers) {
 		configData[key] = value;
 		return null;
 	}
-	if (key === "observer_base_url" || key === "observer_model" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
+	if (key === "observer_tier_routing_enabled" || key === "observer_rich_openai_use_responses") {
+		if (typeof value !== "boolean") return `${key} must be boolean`;
+		configData[key] = value;
+		return null;
+	}
+	if (key === "observer_base_url" || key === "observer_model" || key === "observer_simple_model" || key === "observer_rich_model" || key === "observer_rich_reasoning_effort" || key === "observer_rich_reasoning_summary" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
 		if (typeof value !== "string") return `${key} must be string`;
 		const trimmed = value.trim();
 		if (!trimmed) delete configData[key];
 		else configData[key] = trimmed;
 		return null;
 	}
+	if (key === "observer_simple_temperature" || key === "observer_rich_temperature") {
+		const parsed = parseFiniteNumber(value, true);
+		if (parsed == null) return `${key} must be non-negative number`;
+		configData[key] = parsed;
+		return null;
+	}
 	const allowZero = key === "observer_auth_cache_ttl_s";
 	const parsed = parsePositiveInt(value, allowZero);
 	if (parsed == null) return `${key} must be ${allowZero ? "non-negative int" : "int"}`;
@@ -591,14 +620,15 @@ function queryMemoryPage(store, options) {
 			 ORDER BY memory_items.created_at DESC
 			 LIMIT ? OFFSET ?`).all(...filterResult.params, options.limit + 1, options.offset).map((row) => ({
 		...row,
+		kind: canonicalMemoryKind(row.kind ?? null, row.metadata_json),
 		metadata_json: fromJson(row.metadata_json ?? null)
 	}));
 }
-function isSummaryLikeMemory(item) {
-	if (String(item.kind ?? "").toLowerCase() === "session_summary") return true;
-	const metadata = item.metadata_json ?? {};
-	if (metadata.is_summary === true) return true;
-	return String(metadata.source ?? "").trim().toLowerCase() === "observer_summary";
+function isSummaryLikeMemory$1(item) {
+	return isSummaryLikeMemory({
+		kind: item.kind,
+		metadata: item.metadata_json
+	});
 }
 function selectMemoryPage(store, options) {
 	const pageSize = Math.max(options.limit + options.offset + 10, 50);
@@ -653,7 +683,7 @@ function memoryRoutes(getStore) {
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => !isSummaryLikeMemory(item)
+				matcher: (item) => !isSummaryLikeMemory$1(item)
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
@@ -680,7 +710,7 @@ function memoryRoutes(getStore) {
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => isSummaryLikeMemory(item)
+				matcher: (item) => isSummaryLikeMemory$1(item)
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
@@ -719,7 +749,7 @@ function memoryRoutes(getStore) {
 						project: scopeProject
 					});
 					if (page.length === 0) break;
-					total += page.filter((item) => !isSummaryLikeMemory(item)).length;
+					total += page.filter((item) => !isSummaryLikeMemory$1(item)).length;
 					if (page.length < 200) break;
 					offset += page.length;
 				}
@@ -1288,6 +1318,9 @@ var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
 var LEGACY_SHARED_WORKSPACE_ID = "shared:legacy";
+function syncKeysDir() {
+	return process.env.CODEMEM_KEYS_DIR?.trim() || void 0;
+}
 function intEnvOr(name, fallback) {
 	const value = Number.parseInt(process.env[name] ?? "", 10);
 	return Number.isFinite(value) ? value : fallback;
@@ -1324,8 +1357,8 @@ function pathWithQuery(url) {
 	const parsed = new URL(url);
 	return parsed.search ? `${parsed.pathname}${parsed.search}` : parsed.pathname;
 }
-function unauthorizedPayload(reason) {
-	if (process.env.CODEMEM_SYNC_AUTH_DIAGNOSTICS === "1") return {
+function unauthorizedPayload(reason, exposeReason = false) {
+	if (exposeReason && process.env.CODEMEM_SYNC_AUTH_DIAGNOSTICS === "1") return {
 		error: "unauthorized",
 		reason
 	};
@@ -1397,6 +1430,123 @@ function authorizeSyncRequest(store, request, body) {
 		deviceId
 	};
 }
+async function authorizeBootstrapGrantRequest(store, request, body) {
+	const grantId = (request.header("X-Codemem-Bootstrap-Grant") ?? "").trim();
+	const deviceId = (request.header("X-Opencode-Device") ?? "").trim();
+	const signature = request.header("X-Opencode-Signature") ?? "";
+	const timestamp = request.header("X-Opencode-Timestamp") ?? "";
+	const nonce = request.header("X-Opencode-Nonce") ?? "";
+	if (!grantId || !deviceId || !signature || !timestamp || !nonce) return {
+		ok: false,
+		reason: "missing_bootstrap_grant_headers",
+		deviceId
+	};
+	const config = readCoordinatorSyncConfig();
+	if (!config.syncCoordinatorUrl || !config.syncCoordinatorAdminSecret) return {
+		ok: false,
+		reason: "bootstrap_grant_coordinator_not_configured",
+		deviceId
+	};
+	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	let verification;
+	try {
+		const [status, payload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
+			headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
+			timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
+		});
+		if (status !== 200 || !payload) return {
+			ok: false,
+			reason: "bootstrap_grant_lookup_failed",
+			deviceId
+		};
+		verification = payload;
+	} catch {
+		return {
+			ok: false,
+			reason: "bootstrap_grant_lookup_failed",
+			deviceId
+		};
+	}
+	const grant = verification.grant;
+	const workerEnrollment = verification.worker_enrollment;
+	if (!grant || !workerEnrollment) return {
+		ok: false,
+		reason: "bootstrap_grant_invalid_payload",
+		deviceId
+	};
+	if (grant.revoked_at) return {
+		ok: false,
+		reason: "bootstrap_grant_revoked",
+		deviceId
+	};
+	if (String(workerEnrollment.device_id) !== String(grant.worker_device_id)) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_enrollment_mismatch",
+		deviceId
+	};
+	if (String(workerEnrollment.group_id) !== String(grant.group_id)) return {
+		ok: false,
+		reason: "bootstrap_grant_group_mismatch",
+		deviceId
+	};
+	if (Number(workerEnrollment.enabled) !== 1) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_disabled",
+		deviceId
+	};
+	if (grant.worker_device_id !== deviceId) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_mismatch",
+		deviceId
+	};
+	if (grant.seed_device_id !== localDeviceId) return {
+		ok: false,
+		reason: "bootstrap_grant_seed_mismatch",
+		deviceId
+	};
+	if (new Date(grant.expires_at) <= /* @__PURE__ */ new Date()) return {
+		ok: false,
+		reason: "bootstrap_grant_expired",
+		deviceId
+	};
+	let valid = false;
+	try {
+		valid = verifySignature({
+			method: request.method,
+			pathWithQuery: pathWithQuery(request.url),
+			bodyBytes: body,
+			timestamp,
+			nonce,
+			signature,
+			publicKey: String(workerEnrollment.public_key),
+			deviceId
+		});
+	} catch {
+		return {
+			ok: false,
+			reason: "bootstrap_grant_signature_verification_error",
+			deviceId
+		};
+	}
+	if (!valid) return {
+		ok: false,
+		reason: "bootstrap_grant_invalid_signature",
+		deviceId
+	};
+	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+	if (!recordNonce(store.db, deviceId, nonce, createdAt)) return {
+		ok: false,
+		reason: "nonce_replay",
+		deviceId
+	};
+	const cutoff = (/* @__PURE__ */ new Date(Date.now() - DEFAULT_TIME_WINDOW_S * 2 * 1e3)).toISOString();
+	cleanupNonces(store.db, cutoff);
+	return {
+		ok: true,
+		reason: "ok",
+		deviceId
+	};
+}
 function projectBasename(value) {
 	const project = String(value ?? "").trim().replaceAll("\\", "/");
 	if (!project) return "";
@@ -1795,29 +1945,43 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	}
 	app.get("/v1/status", (c) => {
 		const store = getStore();
-		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
-		const limited = rateLimitedResponse(c, auth.deviceId, true);
-		if (limited) return limited;
-		try {
-			let device = store.db.prepare("SELECT device_id, fingerprint FROM sync_device LIMIT 1").get();
-			if (!device) {
-				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db);
-				device = {
+		return (async () => {
+			let auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+			let preauthChecked = false;
+			let bootstrapAttempted = false;
+			if (!auth.ok) {
+				if ((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()) {
+					preauthChecked = true;
+					const bootstrapLimited = rateLimitedResponse(c, c.req.path, false);
+					if (bootstrapLimited) return bootstrapLimited;
+				} else {
+					preauthChecked = true;
+					const unauthLimited = rateLimitedResponse(c, c.req.path, false);
+					if (unauthLimited) return unauthLimited;
+				}
+				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
+				bootstrapAttempted = true;
+			}
+			if (!auth.ok) {
+				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+			}
+			const limited = rateLimitedResponse(c, auth.deviceId, true);
+			if (limited) return limited;
+			try {
+				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+				const syncReset = getSyncResetState(store.db);
+				return c.json({
 					device_id: deviceId,
-					fingerprint
-				};
+					protocol_version: SYNC_PROTOCOL_VERSION,
+					fingerprint,
+					sync_reset: syncReset
+				});
+			} catch {
+				return c.json({ error: "internal_error" }, 500);
 			}
-			const syncReset = getSyncResetState(store.db);
-			return c.json({
-				device_id: device.device_id,
-				protocol_version: SYNC_PROTOCOL_VERSION,
-				fingerprint: device.fingerprint,
-				sync_reset: syncReset
-			});
-		} catch {
-			return c.json({ error: "internal_error" }, 500);
-		}
+		})();
 	});
 	app.get("/v1/ops", (c) => {
 		const store = getStore();
@@ -1834,15 +1998,11 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			const snapshotId = c.req.query("snapshot_id") ?? null;
 			const baselineCursor = c.req.query("baseline_cursor") ?? null;
 			const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 1e3)) : 200;
-			let localDeviceId = store.db.prepare("SELECT device_id FROM sync_device LIMIT 1").get();
-			if (!localDeviceId) {
-				const [deviceId] = ensureDeviceIdentity(store.db);
-				localDeviceId = { device_id: deviceId };
-			}
+			const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 			const result = loadReplicationOpsForPeer(store.db, {
 				since,
 				limit,
-				deviceId: localDeviceId.device_id,
+				deviceId: localDeviceId,
 				generation: Number.isFinite(generation) ? generation : null,
 				snapshotId,
 				baselineCursor
@@ -1869,42 +2029,63 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	});
 	app.get("/v1/snapshot", (c) => {
 		const store = getStore();
-		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
-		const limited = rateLimitedResponse(c, auth.deviceId, true);
-		if (limited) return limited;
-		try {
-			const rawGeneration = c.req.query("generation");
-			const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
-			const snapshotId = c.req.query("snapshot_id") ?? null;
-			const baselineCursor = c.req.query("baseline_cursor") ?? null;
-			const pageToken = c.req.query("page_token") ?? null;
-			const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
-			const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200;
-			if (generation == null || !Number.isFinite(generation)) return c.json({ error: "missing_generation" }, 400);
-			if (!snapshotId) return c.json({ error: "missing_snapshot_id" }, 400);
-			const result = loadMemorySnapshotPageForPeer(store.db, {
-				generation,
-				snapshotId,
-				baselineCursor,
-				pageToken,
-				limit,
-				peerDeviceId: auth.deviceId
-			});
-			return c.json({
-				generation: result.boundary.generation,
-				snapshot_id: result.boundary.snapshot_id,
-				baseline_cursor: result.boundary.baseline_cursor,
-				retained_floor_cursor: result.boundary.retained_floor_cursor,
-				items: result.items,
-				next_page_token: result.nextPageToken,
-				has_more: result.hasMore
-			});
-		} catch (err) {
-			const message = err instanceof Error ? err.message : "";
-			if (message === "generation_mismatch" || message === "boundary_mismatch") return c.json({ error: message }, 409);
-			return c.json({ error: "internal_error" }, 500);
-		}
+		return (async () => {
+			let auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+			let preauthChecked = false;
+			let bootstrapAttempted = false;
+			if (!auth.ok) {
+				if ((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()) {
+					preauthChecked = true;
+					const bootstrapLimited = rateLimitedResponse(c, c.req.path, false);
+					if (bootstrapLimited) return bootstrapLimited;
+				} else {
+					preauthChecked = true;
+					const unauthLimited = rateLimitedResponse(c, c.req.path, false);
+					if (unauthLimited) return unauthLimited;
+				}
+				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
+				bootstrapAttempted = true;
+			}
+			if (!auth.ok) {
+				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+			}
+			const limited = rateLimitedResponse(c, auth.deviceId, true);
+			if (limited) return limited;
+			try {
+				const rawGeneration = c.req.query("generation");
+				const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
+				const snapshotId = c.req.query("snapshot_id") ?? null;
+				const baselineCursor = c.req.query("baseline_cursor") ?? null;
+				const pageToken = c.req.query("page_token") ?? null;
+				const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
+				const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200;
+				if (generation == null || !Number.isFinite(generation)) return c.json({ error: "missing_generation" }, 400);
+				if (!snapshotId) return c.json({ error: "missing_snapshot_id" }, 400);
+				const result = loadMemorySnapshotPageForPeer(store.db, {
+					generation,
+					snapshotId,
+					baselineCursor,
+					pageToken,
+					limit,
+					peerDeviceId: auth.deviceId
+				});
+				return c.json({
+					generation: result.boundary.generation,
+					snapshot_id: result.boundary.snapshot_id,
+					baseline_cursor: result.boundary.baseline_cursor,
+					retained_floor_cursor: result.boundary.retained_floor_cursor,
+					items: result.items,
+					next_page_token: result.nextPageToken,
+					has_more: result.hasMore
+				});
+			} catch (err) {
+				const message = err instanceof Error ? err.message : "";
+				if (message === "generation_mismatch" || message === "boundary_mismatch") return c.json({ error: message }, 409);
+				return c.json({ error: "internal_error" }, 500);
+			}
+		})();
 	});
 	app.post("/v1/ops", async (c) => {
 		const store = getStore();
@@ -1931,13 +2112,9 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			reason: "device_id_mismatch",
 			op_id: op.op_id
 		}, 400);
-		let localDeviceId = store.db.prepare("SELECT device_id FROM sync_device LIMIT 1").get();
-		if (!localDeviceId) {
-			const [deviceId] = ensureDeviceIdentity(store.db);
-			localDeviceId = { device_id: deviceId };
-		}
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 		const filteredInbound = filterOpsForPeer(store, peerDeviceId, normalizedOps);
-		const result = applyReplicationOps(store.db, filteredInbound.allowed, localDeviceId.device_id);
+		const result = applyReplicationOps(store.db, filteredInbound.allowed, localDeviceId);
 		return c.json({
 			...result,
 			skipped: result.skipped + filteredInbound.skipped
@@ -2171,7 +2348,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				publicKey = String(deviceRow.public_key);
 				fingerprint = String(deviceRow.fingerprint);
 			} else try {
-				const [id, fp] = ensureDeviceIdentity(store.db);
+				const [id, fp] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				deviceId = id;
 				fingerprint = fp;
 				publicKey = d.select({ public_key: schema.syncDevice.public_key }).from(schema.syncDevice).where(eq(schema.syncDevice.device_id, id)).get()?.public_key ?? "";
@@ -2552,6 +2729,47 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: message }, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
 		}
 	});
+	app.get("/api/sync/bootstrap-grants", async (c) => {
+		const groupId = String(c.req.query("group_id") ?? "").trim();
+		if (!groupId) return c.json({ error: "group_id_required" }, 400);
+		const config = readCoordinatorSyncConfig();
+		try {
+			const items = await coordinatorListBootstrapGrantsAction({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({ items });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({ error: message }, 500);
+		}
+	});
+	app.post("/api/sync/bootstrap-grants/revoke", async (c) => {
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid json" }, 400);
+		}
+		const grantId = String(body.grant_id ?? "").trim();
+		if (!grantId) return c.json({ error: "grant_id_required" }, 400);
+		const config = readCoordinatorSyncConfig();
+		try {
+			if (!await coordinatorRevokeBootstrapGrantAction({
+				grantId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})) return c.json({ error: "grant_not_found" }, 404);
+			return c.json({
+				ok: true,
+				grant_id: grantId
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({ error: message }, 500);
+		}
+	});
 	app.delete("/api/sync/peers/:peer_device_id", (c) => {
 		const store = getStore();
 		{