@codemem/server 0.26.0 → 0.26.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncProjectAllowedByFilters, syncVisibilityAllowed, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -609,7 +609,7 @@ function attachSessionFields(store, items) {
 	const bySession = /* @__PURE__ */ new Map();
 	for (const row of rows) {
 		const projectRaw = String(row.project ?? "").trim();
-		const project = projectRaw ? projectBasename$1(projectRaw) : "";
+		const project = projectRaw ? projectBasename(projectRaw) : "";
 		const cwd = String(row.cwd ?? "");
 		bySession.set(row.id, {
 			project,
@@ -629,7 +629,7 @@ function attachSessionFields(store, items) {
 * Extract the basename of a project path.
 * Strips "fatal:" prefixed values.
 */
-function projectBasename$1(raw) {
+function projectBasename(raw) {
 	if (raw.toLowerCase().startsWith("fatal:")) return "";
 	const parts = raw.replace(/\\/g, "/").split("/");
 	return parts[parts.length - 1] ?? raw;
@@ -696,7 +696,7 @@ function memoryRoutes(getStore) {
 		const store = getStore();
 		{
 			const rows = drizzle(store.db, { schema }).selectDistinct({ project: schema.sessions.project }).from(schema.sessions).where(isNotNull(schema.sessions.project)).all();
-			const projects = [...new Set(rows.map((r) => String(r.project ?? "").trim()).filter((p) => p && !p.toLowerCase().startsWith("fatal:")).map((p) => projectBasename$1(p)).filter(Boolean))].sort();
+			const projects = [...new Set(rows.map((r) => String(r.project ?? "").trim()).filter((p) => p && !p.toLowerCase().startsWith("fatal:")).map((p) => projectBasename(p)).filter(Boolean))].sort();
 			return c.json({ projects });
 		}
 	});
@@ -1418,6 +1418,34 @@ var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
 var LEGACY_SHARED_WORKSPACE_ID = "shared:legacy";
+function coordinatorAdminStatusPayload(config = readCoordinatorSyncConfig()) {
+	const groups = config.syncCoordinatorGroups;
+	const activeGroup = groups[0] ?? null;
+	const hasUrl = Boolean(config.syncCoordinatorUrl);
+	const hasGroups = groups.length > 0;
+	const hasAdminSecret = Boolean(config.syncCoordinatorAdminSecret);
+	let readiness = "ready";
+	if (!hasUrl) readiness = "not_configured";
+	else if (!hasGroups || !hasAdminSecret) readiness = "partial";
+	return {
+		readiness,
+		coordinator_url: config.syncCoordinatorUrl || null,
+		groups,
+		active_group: activeGroup,
+		has_admin_secret: hasAdminSecret,
+		has_groups: hasGroups
+	};
+}
+function resolveCoordinatorAdminGroup(requestedGroup, status) {
+	const explicit = String(requestedGroup ?? "").trim();
+	if (explicit) return explicit;
+	return status.active_group;
+}
+function parseInviteTtlHours(value) {
+	const ttlHours = Number(String(value ?? 24));
+	if (!Number.isInteger(ttlHours) || ttlHours < 1) return null;
+	return ttlHours;
+}
 function sortActiveMaintenanceJobs(jobs) {
 	return [...jobs].sort((a, b) => {
 		const aTime = a.started_at ?? a.updated_at;
@@ -1685,12 +1713,6 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		deviceId
 	};
 }
-function projectBasename(value) {
-	const project = String(value ?? "").trim().replaceAll("\\", "/");
-	if (!project) return "";
-	const parts = project.split("/").filter(Boolean);
-	return parts.length > 0 ? parts[parts.length - 1] ?? "" : "";
-}
 function parseJsonList(value) {
 	if (value == null) return [];
 	if (typeof value === "string") try {
@@ -1915,30 +1937,6 @@ async function acceptDiscoveredPeer(store, input) {
 		};
 	})();
 }
-function isSharedVisibility(payload) {
-	if (!payload) return false;
-	let visibility = String(payload.visibility ?? "").trim().toLowerCase();
-	const metadata = payload.metadata_json && typeof payload.metadata_json === "object" && !Array.isArray(payload.metadata_json) ? payload.metadata_json : {};
-	const metadataVisibility = String(metadata.visibility ?? "").trim().toLowerCase();
-	if (!visibility && metadataVisibility) visibility = metadataVisibility;
-	if (!visibility) {
-		let workspaceKind = String(payload.workspace_kind ?? "").trim().toLowerCase();
-		let workspaceId = String(payload.workspace_id ?? "").trim().toLowerCase();
-		if (!workspaceKind) workspaceKind = String(metadata.workspace_kind ?? "").trim().toLowerCase();
-		if (!workspaceId) workspaceId = String(metadata.workspace_id ?? "").trim().toLowerCase();
-		if (workspaceKind === "shared" || workspaceId.startsWith("shared:")) visibility = "shared";
-		else return true;
-	}
-	return visibility === "shared";
-}
-function projectAllowed(projectValue, filters) {
-	const value = String(projectValue ?? "").trim();
-	const valueBase = projectBasename(value);
-	for (const blocked of filters.exclude) if (blocked === value || blocked === valueBase) return false;
-	if (filters.include.length === 0) return true;
-	for (const allowed of filters.include) if (allowed === value || allowed === valueBase) return true;
-	return false;
-}
 function filterOpsForPeer(store, peerDeviceId, ops) {
 	const filters = readPeerProjectFilters(store, peerDeviceId);
 	const allowPrivate = peerClaimedLocalActor(store, peerDeviceId);
@@ -1950,11 +1948,11 @@ function filterOpsForPeer(store, peerDeviceId, ops) {
 			continue;
 		}
 		const payload = parseOpPayload(op);
-		if (!allowPrivate && !isSharedVisibility(payload)) {
+		if (!allowPrivate && !syncVisibilityAllowed(payload)) {
 			skipped++;
 			continue;
 		}
-		if (!projectAllowed(payload && typeof payload.project === "string" ? payload.project : null, filters)) {
+		if (!syncProjectAllowedByFilters(payload && typeof payload.project === "string" ? payload.project : null, filters)) {
 			skipped++;
 			continue;
 		}
@@ -2272,30 +2270,40 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 	app.get("/api/sync/status", async (c) => {
 		const store = getStore();
 		{
+			const traceSync = (label, fn) => {
+				if (process.env.CODEMEM_TRACE_SYNC_STATUS !== "1") return fn();
+				const startedAt = Date.now();
+				console.warn(`[codemem sync-status] ${label} start`);
+				try {
+					return fn();
+				} finally {
+					console.warn(`[codemem sync-status] ${label} ${Date.now() - startedAt}ms`);
+				}
+			};
 			const showDiag = queryBool(c.req.query("includeDiagnostics"));
 			const includeJoinRequests = queryBool(c.req.query("includeJoinRequests"));
 			const project = c.req.query("project") || null;
-			const config = readCoordinatorSyncConfig();
-			const syncReset = getSyncResetState(store.db);
+			const config = traceSync("readCoordinatorSyncConfig", () => readCoordinatorSyncConfig());
+			const syncReset = traceSync("getSyncResetState", () => getSyncResetState(store.db));
 			const d = drizzle(store.db, { schema });
-			const deviceRow = d.select({
+			const deviceRow = traceSync("deviceRow", () => d.select({
 				device_id: schema.syncDevice.device_id,
 				fingerprint: schema.syncDevice.fingerprint
-			}).from(schema.syncDevice).limit(1).get();
-			const daemonState = d.select().from(schema.syncDaemonState).where(eq(schema.syncDaemonState.id, 1)).get();
-			const peerCountRow = d.select({ total: count() }).from(schema.syncPeers).get();
+			}).from(schema.syncDevice).limit(1).get());
+			const daemonState = traceSync("daemonState", () => d.select().from(schema.syncDaemonState).where(eq(schema.syncDaemonState.id, 1)).get());
+			const peerCountRow = traceSync("peerCountRow", () => d.select({ total: count() }).from(schema.syncPeers).get());
 			let retentionState;
 			try {
-				retentionState = d.select().from(schema.syncRetentionState).where(eq(schema.syncRetentionState.id, 1)).get();
+				retentionState = traceSync("retentionState", () => d.select().from(schema.syncRetentionState).where(eq(schema.syncRetentionState.id, 1)).get());
 			} catch {
 				retentionState = void 0;
 			}
-			const lastSyncRow = d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get();
-			const semanticIndex = redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db), showDiag);
+			const lastSyncRow = traceSync("lastSyncRow", () => d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get());
+			const semanticIndex = traceSync("semanticIndex", () => redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db, { fastCounts: !showDiag }), showDiag));
 			const lastError = daemonState?.last_error;
 			const lastErrorAt = daemonState?.last_error_at;
 			const lastOkAt = daemonState?.last_ok_at;
-			const viewerBinding = readViewerBinding(store.dbPath);
+			const viewerBinding = traceSync("readViewerBinding", () => readViewerBinding(store.dbPath));
 			const daemonRunning = viewerBinding ? await portOpen(viewerBinding.host, viewerBinding.port) : false;
 			const daemonDetail = viewerBinding ? daemonRunning ? `viewer pidfile at ${viewerBinding.host}:${viewerBinding.port}` : `pidfile present but ${viewerBinding.host}:${viewerBinding.port} is unreachable` : null;
 			let daemonStateValue = "ok";
@@ -2346,14 +2354,14 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				statusPayload.daemon_running = runtimeStatus.phase === "starting" || daemonRunning;
 				statusPayload.daemon_detail = runtimeStatus.detail ?? daemonDetail;
 			}
-			const peersItems = store.db.prepare(PEERS_QUERY).all().map((row) => {
+			const peersItems = traceSync("peerRows", () => store.db.prepare(PEERS_QUERY).all()).map((row) => {
 				const peer = mapPeerRow(store, row, showDiag);
 				peer.status = peerStatus(peer);
 				return peer;
 			});
 			const peersMap = {};
 			for (const peer of peersItems) peersMap[String(peer.peer_device_id)] = peer.status;
-			const attemptRows = d.select({
+			const attemptRows = traceSync("attemptRows", () => d.select({
 				peer_device_id: schema.syncAttempts.peer_device_id,
 				ok: schema.syncAttempts.ok,
 				error: schema.syncAttempts.error,
@@ -2361,9 +2369,9 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				finished_at: schema.syncAttempts.finished_at,
 				ops_in: schema.syncAttempts.ops_in,
 				ops_out: schema.syncAttempts.ops_out
-			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(25).all();
+			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(25).all());
 			const peerAddressMap = /* @__PURE__ */ new Map();
-			store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all().forEach((peerRow) => {
+			traceSync("peerAddressRows", () => store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all()).forEach((peerRow) => {
 				const addrs = safeJsonList(peerRow.addresses_json);
 				if (addrs.length) peerAddressMap.set(String(peerRow.peer_device_id ?? ""), addrs);
 			});
@@ -2384,9 +2392,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				sync: {},
 				ping: {}
 			};
-			const legacyDevices = store.claimableLegacyDeviceIds();
-			const sharingReview = store.sharingReviewSummary(project);
-			const coordinator = redactCoordinatorStatus(await coordinatorStatusSnapshot(store, config), showDiag);
+			const legacyDevices = traceSync("legacyDevices", () => store.claimableLegacyDeviceIds());
+			const sharingReview = traceSync("sharingReview", () => store.sharingReviewSummary(project));
+			const coordinatorSnapshot = await coordinatorStatusSnapshot(store, config);
+			const coordinator = traceSync("coordinator", () => redactCoordinatorStatus(coordinatorSnapshot, showDiag));
 			let joinRequests = [];
 			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
 				joinRequests = await listCoordinatorJoinRequests(config);
@@ -2799,11 +2808,11 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const groupId = String(body.group_id ?? "").trim();
 		const coordinatorUrl = body.coordinator_url == null ? null : String(body.coordinator_url ?? "");
 		const policy = String(body.policy ?? "auto_admit").trim();
-		const ttlHours = Number.parseInt(String(body.ttl_hours ?? 24), 10);
+		const ttlHours = parseInviteTtlHours(body.ttl_hours);
 		if (!groupId) return c.json({ error: "group_id required" }, 400);
 		if (body.coordinator_url != null && typeof body.coordinator_url !== "string") return c.json({ error: "coordinator_url must be string" }, 400);
 		if (!["auto_admit", "approval_required"].includes(policy)) return c.json({ error: "policy must be auto_admit or approval_required" }, 400);
-		if (!Number.isFinite(ttlHours)) return c.json({ error: "ttl_hours must be int" }, 400);
+		if (ttlHours == null) return c.json({ error: "ttl_hours must be an integer >= 1" }, 400);
 		try {
 			const config = readCoordinatorSyncConfig();
 			const result = await coordinatorCreateInviteAction({
@@ -2840,34 +2849,571 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
 	});
-	app.post("/api/sync/join-requests/review", async (c) => {
+	app.get("/api/coordinator/admin/status", async (c) => {
+		const status = coordinatorAdminStatusPayload();
+		return c.json(status);
+	});
+	app.get("/api/coordinator/admin/groups", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const includeArchived = queryBool(c.req.query("include_archived"));
+		try {
+			const items = await coordinatorListGroupsAction({
+				includeArchived,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				items,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({
+				error: message,
+				status
+			}, 502);
+		}
+	});
+	app.post("/api/coordinator/admin/groups", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
 		let body;
 		try {
 			body = await c.req.json();
 		} catch {
-			return c.json({ error: "invalid json" }, 400);
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
 		}
-		const requestId = String(body.request_id ?? "").trim();
-		const action = String(body.action ?? "").trim();
-		if (!requestId) return c.json({ error: "request_id required" }, 400);
-		if (!["approve", "deny"].includes(action)) return c.json({ error: "action must be approve or deny" }, 400);
+		const groupId = String(body.group_id ?? "").trim();
+		const displayName = String(body.display_name ?? "").trim() || null;
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorCreateGroupAction({
+				groupId,
+				displayName,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/groups/:group_id/rename", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
+		}
+		const displayName = String(body.display_name ?? "").trim();
+		if (!displayName) return c.json({
+			error: "display_name required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorRenameGroupAction({
+				groupId,
+				displayName,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!group) return c.json({
+				error: "group_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/groups/:group_id/archive", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorArchiveGroupAction({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!group) return c.json({
+				error: "group_not_found_or_already_archived",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/groups/:group_id/unarchive", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorUnarchiveGroupAction({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!group) return c.json({
+				error: "group_not_found_or_not_archived",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/invites", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
+		}
+		const groupId = resolveCoordinatorAdminGroup(String(body.group_id ?? "").trim(), status);
+		const coordinatorUrl = body.coordinator_url == null ? null : String(body.coordinator_url ?? "");
+		const policy = String(body.policy ?? "auto_admit").trim();
+		const ttlHours = parseInviteTtlHours(body.ttl_hours);
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		if (body.coordinator_url != null && typeof body.coordinator_url !== "string") return c.json({
+			error: "coordinator_url must be string",
+			status
+		}, 400);
+		if (!["auto_admit", "approval_required"].includes(policy)) return c.json({
+			error: "policy must be auto_admit or approval_required",
+			status
+		}, 400);
+		if (ttlHours == null) return c.json({
+			error: "ttl_hours must be an integer >= 1",
+			status
+		}, 400);
+		try {
+			const result = await coordinatorCreateInviteAction({
+				groupId,
+				coordinatorUrl,
+				policy,
+				ttlHours,
+				createdBy: null,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				...result,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.get("/api/coordinator/admin/join-requests", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id_required",
+			status
+		}, 400);
+		try {
+			const items = await coordinatorListJoinRequestsAction({
+				groupId,
+				remoteUrl: status.coordinator_url,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				items,
+				group_id: groupId,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({
+				error: message,
+				status
+			}, 502);
+		}
+	});
+	app.post("/api/coordinator/admin/join-requests/:request_id/approve", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const requestId = String(c.req.param("request_id") ?? "").trim();
+		if (!requestId) return c.json({
+			error: "request_id required",
+			status
+		}, 400);
 		try {
-			const config = readCoordinatorSyncConfig();
 			const result = await coordinatorReviewJoinRequestAction({
 				requestId,
-				approve: action === "approve",
+				approve: true,
 				reviewedBy: null,
 				remoteUrl: config.syncCoordinatorUrl || null,
 				adminSecret: config.syncCoordinatorAdminSecret || null
 			});
-			if (!result) return c.json({ error: "join request not found" }, 404);
+			if (!result) return c.json({
+				error: "join request not found",
+				status
+			}, 404);
 			return c.json({
 				ok: true,
-				request: result
+				request: result,
+				status
 			});
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			return c.json({ error: message }, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
+			return c.json({
+				error: message,
+				status
+			}, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
+		}
+	});
+	app.post("/api/coordinator/admin/join-requests/:request_id/deny", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const requestId = String(c.req.param("request_id") ?? "").trim();
+		if (!requestId) return c.json({
+			error: "request_id required",
+			status
+		}, 400);
+		try {
+			const result = await coordinatorReviewJoinRequestAction({
+				requestId,
+				approve: false,
+				reviewedBy: null,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!result) return c.json({
+				error: "join request not found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				request: result,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json({
+				error: message,
+				status
+			}, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
+		}
+	});
+	app.get("/api/coordinator/admin/devices", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id_required",
+			status
+		}, 400);
+		try {
+			const items = await coordinatorListDevicesAction({
+				groupId,
+				includeDisabled: queryBool(c.req.query("include_disabled")),
+				remoteUrl: status.coordinator_url,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				items,
+				group_id: groupId,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({
+				error: message,
+				status
+			}, 502);
+		}
+	});
+	app.post("/api/coordinator/admin/devices/:device_id/rename", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		if (!deviceId) return c.json({
+			error: "device_id required",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
+		}
+		const groupId = resolveCoordinatorAdminGroup(String(body.group_id ?? "").trim(), status);
+		const displayName = String(body.display_name ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		if (!displayName) return c.json({
+			error: "display_name required",
+			status
+		}, 400);
+		try {
+			const device = await coordinatorRenameDeviceAction({
+				groupId,
+				deviceId,
+				displayName,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!device) return c.json({
+				error: "device_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				device,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/devices/:device_id/disable", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		if (!deviceId) return c.json({
+			error: "device_id required",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			if (!await coordinatorDisableDeviceAction({
+				groupId,
+				deviceId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})) return c.json({
+				error: "device_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				device_id: deviceId,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/devices/:device_id/remove", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		if (!deviceId) return c.json({
+			error: "device_id required",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			if (!await coordinatorRemoveDeviceAction({
+				groupId,
+				deviceId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})) return c.json({
+				error: "device_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				device_id: deviceId,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
 		}
 	});
 	app.get("/api/sync/bootstrap-grants", async (c) => {