@codemem/server 0.26.1 → 0.27.0

package/dist/index.js

@@ -1,11 +1,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncProjectAllowedByFilters, syncVisibilityAllowed, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
-import { homedir } from "node:os";
+import { homedir, networkInterfaces } from "node:os";
 import { and, count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
@@ -609,7 +609,7 @@ function attachSessionFields(store, items) {
 	const bySession = /* @__PURE__ */ new Map();
 	for (const row of rows) {
 		const projectRaw = String(row.project ?? "").trim();
-		const project = projectRaw ? projectBasename$1(projectRaw) : "";
+		const project = projectRaw ? projectBasename(projectRaw) : "";
 		const cwd = String(row.cwd ?? "");
 		bySession.set(row.id, {
 			project,
@@ -629,7 +629,7 @@ function attachSessionFields(store, items) {
 * Extract the basename of a project path.
 * Strips "fatal:" prefixed values.
 */
-function projectBasename$1(raw) {
+function projectBasename(raw) {
 	if (raw.toLowerCase().startsWith("fatal:")) return "";
 	const parts = raw.replace(/\\/g, "/").split("/");
 	return parts[parts.length - 1] ?? raw;
@@ -696,7 +696,7 @@ function memoryRoutes(getStore) {
 		const store = getStore();
 		{
 			const rows = drizzle(store.db, { schema }).selectDistinct({ project: schema.sessions.project }).from(schema.sessions).where(isNotNull(schema.sessions.project)).all();
-			const projects = [...new Set(rows.map((r) => String(r.project ?? "").trim()).filter((p) => p && !p.toLowerCase().startsWith("fatal:")).map((p) => projectBasename$1(p)).filter(Boolean))].sort();
+			const projects = [...new Set(rows.map((r) => String(r.project ?? "").trim()).filter((p) => p && !p.toLowerCase().startsWith("fatal:")).map((p) => projectBasename(p)).filter(Boolean))].sort();
 			return c.json({ projects });
 		}
 	});
@@ -1418,6 +1418,41 @@ var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
 var LEGACY_SHARED_WORKSPACE_ID = "shared:legacy";
+function coordinatorAdminStatusPayload(config = readCoordinatorSyncConfig()) {
+	const groups = config.syncCoordinatorGroups;
+	const activeGroup = groups[0] ?? null;
+	const hasUrl = Boolean(config.syncCoordinatorUrl);
+	const hasGroups = groups.length > 0;
+	const hasAdminSecret = Boolean(config.syncCoordinatorAdminSecret);
+	let readiness = "ready";
+	if (!hasUrl) readiness = "not_configured";
+	else if (!hasGroups || !hasAdminSecret) readiness = "partial";
+	return {
+		readiness,
+		coordinator_url: config.syncCoordinatorUrl || null,
+		groups,
+		active_group: activeGroup,
+		has_admin_secret: hasAdminSecret,
+		has_groups: hasGroups
+	};
+}
+function pairingAdvertiseAddresses(config = readCoordinatorSyncConfig()) {
+	const advertise = String(config.syncAdvertise || "auto").trim().toLowerCase();
+	if (advertise && advertise !== "auto" && advertise !== "default") return mergeAddresses([], String(config.syncAdvertise || "").split(",").map((item) => item.trim()).filter(Boolean));
+	if (config.syncHost && config.syncHost !== "0.0.0.0") return [`${config.syncHost}:${config.syncPort}`];
+	const addresses = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => !entry.internal).map((entry) => entry.address).filter((address) => address && address !== "127.0.0.1" && address !== "::1").map((address) => `${address}:${config.syncPort}`);
+	return [...new Set(addresses)];
+}
+function resolveCoordinatorAdminGroup(requestedGroup, status) {
+	const explicit = String(requestedGroup ?? "").trim();
+	if (explicit) return explicit;
+	return status.active_group;
+}
+function parseInviteTtlHours(value) {
+	const ttlHours = Number(String(value ?? 24));
+	if (!Number.isInteger(ttlHours) || ttlHours < 1) return null;
+	return ttlHours;
+}
 function sortActiveMaintenanceJobs(jobs) {
 	return [...jobs].sort((a, b) => {
 		const aTime = a.started_at ?? a.updated_at;
@@ -1685,12 +1720,6 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		deviceId
 	};
 }
-function projectBasename(value) {
-	const project = String(value ?? "").trim().replaceAll("\\", "/");
-	if (!project) return "";
-	const parts = project.split("/").filter(Boolean);
-	return parts.length > 0 ? parts[parts.length - 1] ?? "" : "";
-}
 function parseJsonList(value) {
 	if (value == null) return [];
 	if (typeof value === "string") try {
@@ -1915,30 +1944,6 @@ async function acceptDiscoveredPeer(store, input) {
 		};
 	})();
 }
-function isSharedVisibility(payload) {
-	if (!payload) return false;
-	let visibility = String(payload.visibility ?? "").trim().toLowerCase();
-	const metadata = payload.metadata_json && typeof payload.metadata_json === "object" && !Array.isArray(payload.metadata_json) ? payload.metadata_json : {};
-	const metadataVisibility = String(metadata.visibility ?? "").trim().toLowerCase();
-	if (!visibility && metadataVisibility) visibility = metadataVisibility;
-	if (!visibility) {
-		let workspaceKind = String(payload.workspace_kind ?? "").trim().toLowerCase();
-		let workspaceId = String(payload.workspace_id ?? "").trim().toLowerCase();
-		if (!workspaceKind) workspaceKind = String(metadata.workspace_kind ?? "").trim().toLowerCase();
-		if (!workspaceId) workspaceId = String(metadata.workspace_id ?? "").trim().toLowerCase();
-		if (workspaceKind === "shared" || workspaceId.startsWith("shared:")) visibility = "shared";
-		else return true;
-	}
-	return visibility === "shared";
-}
-function projectAllowed(projectValue, filters) {
-	const value = String(projectValue ?? "").trim();
-	const valueBase = projectBasename(value);
-	for (const blocked of filters.exclude) if (blocked === value || blocked === valueBase) return false;
-	if (filters.include.length === 0) return true;
-	for (const allowed of filters.include) if (allowed === value || allowed === valueBase) return true;
-	return false;
-}
 function filterOpsForPeer(store, peerDeviceId, ops) {
 	const filters = readPeerProjectFilters(store, peerDeviceId);
 	const allowPrivate = peerClaimedLocalActor(store, peerDeviceId);
@@ -1950,11 +1955,11 @@ function filterOpsForPeer(store, peerDeviceId, ops) {
 			continue;
 		}
 		const payload = parseOpPayload(op);
-		if (!allowPrivate && !isSharedVisibility(payload)) {
+		if (!allowPrivate && !syncVisibilityAllowed(payload)) {
 			skipped++;
 			continue;
 		}
-		if (!projectAllowed(payload && typeof payload.project === "string" ? payload.project : null, filters)) {
+		if (!syncProjectAllowedByFilters(payload && typeof payload.project === "string" ? payload.project : null, filters)) {
 			skipped++;
 			continue;
 		}
@@ -2486,6 +2491,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				redacted: true,
 				pairing_filter_hint: PAIRING_FILTER_HINT
 			});
+			const config = readCoordinatorSyncConfig();
 			const d = drizzle(store.db, { schema });
 			const deviceRow = d.select({
 				device_id: schema.syncDevice.device_id,
@@ -2513,7 +2519,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				fingerprint,
 				public_key: publicKey ?? null,
 				pairing_filter_hint: PAIRING_FILTER_HINT,
-				addresses: []
+				addresses: pairingAdvertiseAddresses(config)
 			});
 		}
 	});
@@ -2810,11 +2816,11 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const groupId = String(body.group_id ?? "").trim();
 		const coordinatorUrl = body.coordinator_url == null ? null : String(body.coordinator_url ?? "");
 		const policy = String(body.policy ?? "auto_admit").trim();
-		const ttlHours = Number.parseInt(String(body.ttl_hours ?? 24), 10);
+		const ttlHours = parseInviteTtlHours(body.ttl_hours);
 		if (!groupId) return c.json({ error: "group_id required" }, 400);
 		if (body.coordinator_url != null && typeof body.coordinator_url !== "string") return c.json({ error: "coordinator_url must be string" }, 400);
 		if (!["auto_admit", "approval_required"].includes(policy)) return c.json({ error: "policy must be auto_admit or approval_required" }, 400);
-		if (!Number.isFinite(ttlHours)) return c.json({ error: "ttl_hours must be int" }, 400);
+		if (ttlHours == null) return c.json({ error: "ttl_hours must be an integer >= 1" }, 400);
 		try {
 			const config = readCoordinatorSyncConfig();
 			const result = await coordinatorCreateInviteAction({
@@ -2851,34 +2857,571 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
 	});
-	app.post("/api/sync/join-requests/review", async (c) => {
+	app.get("/api/coordinator/admin/status", async (c) => {
+		const status = coordinatorAdminStatusPayload();
+		return c.json(status);
+	});
+	app.get("/api/coordinator/admin/groups", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const includeArchived = queryBool(c.req.query("include_archived"));
+		try {
+			const items = await coordinatorListGroupsAction({
+				includeArchived,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				items,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({
+				error: message,
+				status
+			}, 502);
+		}
+	});
+	app.post("/api/coordinator/admin/groups", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
 		let body;
 		try {
 			body = await c.req.json();
 		} catch {
-			return c.json({ error: "invalid json" }, 400);
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
 		}
-		const requestId = String(body.request_id ?? "").trim();
-		const action = String(body.action ?? "").trim();
-		if (!requestId) return c.json({ error: "request_id required" }, 400);
-		if (!["approve", "deny"].includes(action)) return c.json({ error: "action must be approve or deny" }, 400);
+		const groupId = String(body.group_id ?? "").trim();
+		const displayName = String(body.display_name ?? "").trim() || null;
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorCreateGroupAction({
+				groupId,
+				displayName,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/groups/:group_id/rename", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
+		}
+		const displayName = String(body.display_name ?? "").trim();
+		if (!displayName) return c.json({
+			error: "display_name required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorRenameGroupAction({
+				groupId,
+				displayName,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!group) return c.json({
+				error: "group_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/groups/:group_id/archive", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorArchiveGroupAction({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!group) return c.json({
+				error: "group_not_found_or_already_archived",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/groups/:group_id/unarchive", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = String(c.req.param("group_id") ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			const group = await coordinatorUnarchiveGroupAction({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!group) return c.json({
+				error: "group_not_found_or_not_archived",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				group,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/invites", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
+		}
+		const groupId = resolveCoordinatorAdminGroup(String(body.group_id ?? "").trim(), status);
+		const coordinatorUrl = body.coordinator_url == null ? null : String(body.coordinator_url ?? "");
+		const policy = String(body.policy ?? "auto_admit").trim();
+		const ttlHours = parseInviteTtlHours(body.ttl_hours);
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		if (body.coordinator_url != null && typeof body.coordinator_url !== "string") return c.json({
+			error: "coordinator_url must be string",
+			status
+		}, 400);
+		if (!["auto_admit", "approval_required"].includes(policy)) return c.json({
+			error: "policy must be auto_admit or approval_required",
+			status
+		}, 400);
+		if (ttlHours == null) return c.json({
+			error: "ttl_hours must be an integer >= 1",
+			status
+		}, 400);
+		try {
+			const result = await coordinatorCreateInviteAction({
+				groupId,
+				coordinatorUrl,
+				policy,
+				ttlHours,
+				createdBy: null,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				...result,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.get("/api/coordinator/admin/join-requests", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id_required",
+			status
+		}, 400);
+		try {
+			const items = await coordinatorListJoinRequestsAction({
+				groupId,
+				remoteUrl: status.coordinator_url,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				items,
+				group_id: groupId,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({
+				error: message,
+				status
+			}, 502);
+		}
+	});
+	app.post("/api/coordinator/admin/join-requests/:request_id/approve", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const requestId = String(c.req.param("request_id") ?? "").trim();
+		if (!requestId) return c.json({
+			error: "request_id required",
+			status
+		}, 400);
+		try {
+			const result = await coordinatorReviewJoinRequestAction({
+				requestId,
+				approve: true,
+				reviewedBy: null,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!result) return c.json({
+				error: "join request not found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				request: result,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json({
+				error: message,
+				status
+			}, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
+		}
+	});
+	app.post("/api/coordinator/admin/join-requests/:request_id/deny", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const requestId = String(c.req.param("request_id") ?? "").trim();
+		if (!requestId) return c.json({
+			error: "request_id required",
+			status
+		}, 400);
 		try {
-			const config = readCoordinatorSyncConfig();
 			const result = await coordinatorReviewJoinRequestAction({
 				requestId,
-				approve: action === "approve",
+				approve: false,
 				reviewedBy: null,
 				remoteUrl: config.syncCoordinatorUrl || null,
 				adminSecret: config.syncCoordinatorAdminSecret || null
 			});
-			if (!result) return c.json({ error: "join request not found" }, 404);
+			if (!result) return c.json({
+				error: "join request not found",
+				status
+			}, 404);
 			return c.json({
 				ok: true,
-				request: result
+				request: result,
+				status
 			});
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			return c.json({ error: message }, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
+			return c.json({
+				error: message,
+				status
+			}, message.includes("request_not_found") || message.includes("not found") ? 404 : 400);
+		}
+	});
+	app.get("/api/coordinator/admin/devices", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id_required",
+			status
+		}, 400);
+		try {
+			const items = await coordinatorListDevicesAction({
+				groupId,
+				includeDisabled: queryBool(c.req.query("include_disabled")),
+				remoteUrl: status.coordinator_url,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			return c.json({
+				items,
+				group_id: groupId,
+				status
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "unknown";
+			return c.json({
+				error: message,
+				status
+			}, 502);
+		}
+	});
+	app.post("/api/coordinator/admin/devices/:device_id/rename", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		if (!deviceId) return c.json({
+			error: "device_id required",
+			status
+		}, 400);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid json",
+				status
+			}, 400);
+		}
+		const groupId = resolveCoordinatorAdminGroup(String(body.group_id ?? "").trim(), status);
+		const displayName = String(body.display_name ?? "").trim();
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		if (!displayName) return c.json({
+			error: "display_name required",
+			status
+		}, 400);
+		try {
+			const device = await coordinatorRenameDeviceAction({
+				groupId,
+				deviceId,
+				displayName,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			if (!device) return c.json({
+				error: "device_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				device,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/devices/:device_id/disable", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		if (!deviceId) return c.json({
+			error: "device_id required",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			if (!await coordinatorDisableDeviceAction({
+				groupId,
+				deviceId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})) return c.json({
+				error: "device_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				device_id: deviceId,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
+		}
+	});
+	app.post("/api/coordinator/admin/devices/:device_id/remove", async (c) => {
+		const config = readCoordinatorSyncConfig();
+		const status = coordinatorAdminStatusPayload(config);
+		if (status.readiness === "not_configured") return c.json({
+			error: "coordinator_not_configured",
+			status
+		}, 400);
+		if (!status.has_admin_secret) return c.json({
+			error: "coordinator_admin_secret_missing",
+			status
+		}, 400);
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		if (!deviceId) return c.json({
+			error: "device_id required",
+			status
+		}, 400);
+		const groupId = resolveCoordinatorAdminGroup(c.req.query("group_id"), status);
+		if (!groupId) return c.json({
+			error: "group_id required",
+			status
+		}, 400);
+		try {
+			if (!await coordinatorRemoveDeviceAction({
+				groupId,
+				deviceId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})) return c.json({
+				error: "device_not_found",
+				status
+			}, 404);
+			return c.json({
+				ok: true,
+				device_id: deviceId,
+				status
+			});
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : String(error),
+				status
+			}, 400);
 		}
 	});
 	app.get("/api/sync/bootstrap-grants", async (c) => {