@codemem/server 0.30.0-alpha.2 → 0.30.0-alpha.3

package/dist/index.js

@@ -1,12 +1,12 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, deleteProjectScopeSettingsMapping, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listProjectScopeCandidates, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
 import { homedir, networkInterfaces } from "node:os";
-import { and, count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
+import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/middleware.ts
@@ -641,14 +641,65 @@ function normalizeScope(raw) {
 	const value = String(raw ?? "").trim().toLowerCase();
 	if (value === "mine" || value === "theirs") return value;
 }
+function buildViewerMemoryFilters(store, filters) {
+	return buildFilterClausesWithContext(filters, {
+		actorId: store.actorId,
+		deviceId: store.deviceId,
+		enforceScopeVisibility: true
+	});
+}
+function countVisibleMemoryRows(store, filters) {
+	const filterResult = buildViewerMemoryFilters(store, filters);
+	const clauses = ["memory_items.active = 1", ...filterResult.clauses];
+	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM ${from} WHERE ${clauses.join(" AND ")}`).get(...filterResult.params);
+	return Number(row?.total ?? 0);
+}
+function sessionAllowsArtifactAccess(store, sessionId) {
+	const visibleCount = countVisibleMemoryRows(store, { session_id: sessionId });
+	if (visibleCount === 0) return false;
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM memory_items
+			 WHERE session_id = ? AND active = 1`).get(sessionId);
+	return visibleCount === Number(row?.total ?? 0);
+}
+function countVisiblePromptRows(store, project) {
+	const filterResult = buildViewerMemoryFilters(store, null);
+	const clauses = ["user_prompts.session_id IS NOT NULL", `EXISTS (
+			SELECT 1 FROM memory_items
+			WHERE memory_items.session_id = user_prompts.session_id
+			  AND memory_items.active = 1
+			  AND ${filterResult.clauses.join(" AND ")}
+		)`];
+	const params = [...filterResult.params];
+	if (project) {
+		clauses.unshift("user_prompts.project = ?");
+		params.unshift(project);
+	}
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM user_prompts WHERE ${clauses.join(" AND ")}`).get(...params);
+	return Number(row?.total ?? 0);
+}
+function countVisibleArtifactRows(store, project) {
+	const filterResult = buildViewerMemoryFilters(store, null);
+	const clauses = [`EXISTS (
+			SELECT 1 FROM memory_items
+			WHERE memory_items.session_id = artifacts.session_id
+			  AND memory_items.active = 1
+			  AND ${filterResult.clauses.join(" AND ")}
+		)`];
+	const params = [...filterResult.params];
+	const from = project ? "artifacts JOIN sessions ON sessions.id = artifacts.session_id" : "artifacts";
+	if (project) {
+		clauses.unshift("sessions.project = ?");
+		params.unshift(project);
+	}
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM ${from} WHERE ${clauses.join(" AND ")}`).get(...params);
+	return Number(row?.total ?? 0);
+}
 function queryMemoryPage(store, options) {
 	const filters = {};
 	if (options.project) filters.project = options.project;
 	if (options.scope) filters.ownership_scope = options.scope;
-	const filterResult = buildFilterClausesWithContext(filters, {
-		actorId: store.actorId,
-		deviceId: store.deviceId
-	});
+	const filterResult = buildViewerMemoryFilters(store, filters);
 	const where = ["memory_items.active = 1", ...filterResult.clauses].join(" AND ");
 	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
 	const rows = store.db.prepare(`SELECT memory_items.* FROM ${from}
@@ -688,9 +739,18 @@ function memoryRoutes(getStore) {
 		const store = getStore();
 		{
 			const limit = queryInt(c.req.query("limit"), 20);
-			const items = drizzle(store.db, { schema }).select().from(schema.sessions).orderBy(desc(schema.sessions.started_at)).limit(limit).all().map((row) => ({
+			const filterResult = buildViewerMemoryFilters(store, null);
+			const clauses = [
+				"memory_items.session_id = sessions.id",
+				"memory_items.active = 1",
+				...filterResult.clauses
+			];
+			const items = store.db.prepare(`SELECT sessions.* FROM sessions
+					 WHERE EXISTS (SELECT 1 FROM memory_items WHERE ${clauses.join(" AND ")})
+					 ORDER BY sessions.started_at DESC
+					 LIMIT ?`).all(...filterResult.params, limit).map((row) => ({
 				...row,
-				metadata_json: fromJson(row.metadata_json)
+				metadata_json: fromJson(row.metadata_json ?? null)
 			}));
 			return c.json({ items });
 		}
@@ -698,7 +758,16 @@ function memoryRoutes(getStore) {
 	app.get("/api/projects", (c) => {
 		const store = getStore();
 		{
-			const rows = drizzle(store.db, { schema }).selectDistinct({ project: schema.sessions.project }).from(schema.sessions).where(isNotNull(schema.sessions.project)).all();
+			const filterResult = buildViewerMemoryFilters(store, null);
+			const clauses = [
+				"memory_items.session_id = sessions.id",
+				"memory_items.active = 1",
+				"sessions.project IS NOT NULL",
+				...filterResult.clauses
+			];
+			const rows = store.db.prepare(`SELECT DISTINCT sessions.project AS project FROM sessions
+					 JOIN memory_items ON memory_items.session_id = sessions.id
+					 WHERE ${clauses.join(" AND ")}`).all(...filterResult.params);
 			const projects = [...new Set(rows.map((r) => String(r.project ?? "").trim()).filter((p) => p && !p.toLowerCase().startsWith("fatal:")).map((p) => projectBasename(p)).filter(Boolean))].sort();
 			return c.json({ projects });
 		}
@@ -765,10 +834,6 @@ function memoryRoutes(getStore) {
 		const store = getStore();
 		{
 			const project = c.req.query("project") || null;
-			const count = (sql, ...params) => {
-				const row = store.db.prepare(sql).get(...params);
-				return Number(row?.total ?? 0);
-			};
 			let prompts;
 			let artifacts;
 			let memories;
@@ -790,18 +855,14 @@ function memoryRoutes(getStore) {
 				return total;
 			};
 			if (project) {
-				prompts = count("SELECT COUNT(*) AS total FROM user_prompts WHERE project = ?", project);
-				artifacts = count(`SELECT COUNT(*) AS total FROM artifacts
-					 JOIN sessions ON sessions.id = artifacts.session_id
-					 WHERE sessions.project = ?`, project);
-				memories = count(`SELECT COUNT(*) AS total FROM memory_items
-					 JOIN sessions ON sessions.id = memory_items.session_id
-					 WHERE sessions.project = ?`, project);
+				prompts = countVisiblePromptRows(store, project);
+				artifacts = countVisibleArtifactRows(store, project);
+				memories = countVisibleMemoryRows(store, { project });
 				observations = countObservations(project);
 			} else {
-				prompts = count("SELECT COUNT(*) AS total FROM user_prompts");
-				artifacts = count("SELECT COUNT(*) AS total FROM artifacts");
-				memories = count("SELECT COUNT(*) AS total FROM memory_items");
+				prompts = countVisiblePromptRows(store);
+				artifacts = countVisibleArtifactRows(store);
+				memories = countVisibleMemoryRows(store);
 				observations = countObservations();
 			}
 			const total = prompts + artifacts + memories;
@@ -878,6 +939,7 @@ function memoryRoutes(getStore) {
 			if (!sessionIdStr) return c.json({ error: "session_id required" }, 400);
 			const sessionId = parseStrictInteger(sessionIdStr);
 			if (sessionId == null) return c.json({ error: "session_id must be int" }, 400);
+			if (!sessionAllowsArtifactAccess(store, sessionId)) return c.json({ error: "session not found" }, 404);
 			const rows = drizzle(store.db, { schema }).select().from(schema.artifacts).where(eq(schema.artifacts.session_id, sessionId)).all();
 			return c.json({ items: rows });
 		}
@@ -892,6 +954,7 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
+		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		const visibility = String(body.visibility ?? "").trim();
 		if (visibility !== "private" && visibility !== "shared") return c.json({ error: "visibility must be private or shared" }, 400);
 		try {
@@ -916,6 +979,7 @@ function memoryRoutes(getStore) {
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
 		const project = String(body.project ?? "").trim();
 		if (!project) return c.json({ error: "project must be a non-empty string" }, 400);
+		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		try {
 			const result = store.moveMemoryProject(memoryId, project);
 			return c.json(result);
@@ -936,6 +1000,7 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
+		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		const row = drizzle(store.db, { schema }).select().from(schema.memoryItems).where(eq(schema.memoryItems.id, memoryId)).get();
 		if (!row) return c.json({ error: "memory not found" }, 404);
 		if (!memoryOwnedBySelf(row, buildOwnershipContext(store))) return c.json({ error: "memory not owned by this device" }, 403);
@@ -1330,6 +1395,82 @@ function sortActiveMaintenanceJobs$1(jobs) {
 		return aKind.localeCompare(bKind);
 	});
 }
+var MEMORY_ID_METADATA_KEYS = [
+	"pack_item_ids",
+	"added_ids",
+	"removed_ids",
+	"retained_ids"
+];
+function toUsageRow(row, metadata) {
+	return {
+		id: Number(row.id ?? 0),
+		session_id: row.session_id == null ? null : Number(row.session_id),
+		event: String(row.event ?? "pack"),
+		tokens_read: Number(row.tokens_read ?? 0),
+		tokens_written: Number(row.tokens_written ?? 0),
+		tokens_saved: Number(row.tokens_saved ?? 0),
+		created_at: String(row.created_at ?? ""),
+		metadata_json: metadata
+	};
+}
+function visibleMemoryIds(store, value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((item) => typeof item === "number" ? item : Number(item)).filter((item) => Number.isInteger(item) && store.get(item) != null);
+}
+function sessionHasVisibleMemory(store, sessionId) {
+	const filterResult = buildFilterClausesWithContext({ session_id: sessionId }, {
+		actorId: store.actorId,
+		deviceId: store.deviceId,
+		enforceScopeVisibility: true
+	});
+	const clauses = ["memory_items.active = 1", ...filterResult.clauses];
+	return store.db.prepare(`SELECT 1 AS found FROM memory_items WHERE ${clauses.join(" AND ")} LIMIT 1`).get(...filterResult.params) != null;
+}
+function usageRowVisible(store, row) {
+	const packItemIds = row.metadata_json?.pack_item_ids;
+	if (Array.isArray(packItemIds)) {
+		if (packItemIds.length === 0) return row.session_id != null && sessionHasVisibleMemory(store, row.session_id);
+		return visibleMemoryIds(store, packItemIds).length > 0;
+	}
+	return row.session_id != null && sessionHasVisibleMemory(store, row.session_id);
+}
+function sanitizePackUsageMetadata(store, metadata) {
+	if (!metadata) return null;
+	const sanitized = { ...metadata };
+	for (const key of MEMORY_ID_METADATA_KEYS) if (Array.isArray(sanitized[key])) sanitized[key] = visibleMemoryIds(store, sanitized[key]);
+	return sanitized;
+}
+function summarizeUsageEvents(rows) {
+	const byEvent = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const summary = byEvent.get(row.event) ?? {
+			event: row.event,
+			total_tokens_read: 0,
+			total_tokens_written: 0,
+			total_tokens_saved: 0,
+			count: 0
+		};
+		summary.total_tokens_read += row.tokens_read;
+		summary.total_tokens_written += row.tokens_written;
+		summary.total_tokens_saved += row.tokens_saved;
+		summary.count += 1;
+		byEvent.set(row.event, summary);
+	}
+	return [...byEvent.values()].sort((a, b) => a.event.localeCompare(b.event));
+}
+function totalUsageEvents(rows) {
+	return rows.reduce((acc, row) => ({
+		tokens_read: Number(acc.tokens_read) + row.tokens_read,
+		tokens_written: Number(acc.tokens_written) + row.tokens_written,
+		tokens_saved: Number(acc.tokens_saved) + row.tokens_saved,
+		count: Number(acc.count) + 1
+	}), {
+		tokens_read: 0,
+		tokens_written: 0,
+		tokens_saved: 0,
+		count: 0
+	});
+}
 /**
 * Create stats routes. The store factory is called per-request to get a
 * fresh connection (matching the Python viewer pattern).
@@ -1378,58 +1519,27 @@ function statsRoutes(getStore) {
 		const store = getStore();
 		{
 			const projectFilter = c.req.query("project") || null;
-			const recentPacksQuery = projectFilter ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
-						usage_events.tokens_read, usage_events.tokens_written, usage_events.tokens_saved,
-						usage_events.created_at, usage_events.metadata_json
-					 FROM usage_events
-					 JOIN sessions ON sessions.id = usage_events.session_id
-					 WHERE usage_events.event = 'pack' AND sessions.project = ?
-					 ORDER BY usage_events.created_at DESC
-					 LIMIT 10`) : store.db.prepare(`SELECT id, session_id, event, tokens_read, tokens_written, tokens_saved, created_at, metadata_json
-					 FROM usage_events
-					 WHERE event = 'pack'
-					 ORDER BY created_at DESC
-					 LIMIT 10`);
-			const eventsGlobal = store.db.prepare(`SELECT event,
-						SUM(tokens_read) AS total_tokens_read,
-						SUM(tokens_written) AS total_tokens_written,
-						SUM(tokens_saved) AS total_tokens_saved,
-						COUNT(*) AS count
-					 FROM usage_events GROUP BY event ORDER BY event`).all();
-			const totalsGlobal = store.db.prepare(`SELECT COALESCE(SUM(tokens_read),0) AS tokens_read,
-						COALESCE(SUM(tokens_written),0) AS tokens_written,
-						COALESCE(SUM(tokens_saved),0) AS tokens_saved,
-						COUNT(*) AS count
-					 FROM usage_events`).get();
-			let eventsFiltered = null;
-			let totalsFiltered = null;
-			if (projectFilter) {
-				eventsFiltered = store.db.prepare(`SELECT event,
-							SUM(tokens_read) AS total_tokens_read,
-							SUM(tokens_written) AS total_tokens_written,
-							SUM(tokens_saved) AS total_tokens_saved,
-							COUNT(*) AS count
-						 FROM usage_events
-						 JOIN sessions ON sessions.id = usage_events.session_id
-						 WHERE sessions.project = ?
-						 GROUP BY event ORDER BY event`).all(projectFilter);
-				totalsFiltered = store.db.prepare(`SELECT COALESCE(SUM(tokens_read),0) AS tokens_read,
-							COALESCE(SUM(tokens_written),0) AS tokens_written,
-							COALESCE(SUM(tokens_saved),0) AS tokens_saved,
-							COUNT(*) AS count
-						 FROM usage_events
-						 JOIN sessions ON sessions.id = usage_events.session_id
-						 WHERE sessions.project = ?`).get(projectFilter);
-			}
-			const recentPacks = (projectFilter ? recentPacksQuery.all(projectFilter) : recentPacksQuery.all()).map((row) => ({
-				id: Number(row.id ?? 0),
-				session_id: row.session_id == null ? null : Number(row.session_id),
-				event: String(row.event ?? "pack"),
-				tokens_read: Number(row.tokens_read ?? 0),
-				tokens_written: Number(row.tokens_written ?? 0),
-				tokens_saved: Number(row.tokens_saved ?? 0),
-				created_at: String(row.created_at ?? ""),
-				metadata_json: parseMetadataJson(row.metadata_json)
+			const loadUsageRows = (project) => {
+				return (project ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
+									usage_events.tokens_read, usage_events.tokens_written, usage_events.tokens_saved,
+									usage_events.created_at, usage_events.metadata_json
+								 FROM usage_events
+								 JOIN sessions ON sessions.id = usage_events.session_id
+								 WHERE sessions.project = ?
+								 ORDER BY usage_events.created_at DESC`).all(project) : store.db.prepare(`SELECT id, session_id, event, tokens_read, tokens_written, tokens_saved,
+									created_at, metadata_json
+								 FROM usage_events
+								 ORDER BY created_at DESC`).all()).map((row) => toUsageRow(row, parseMetadataJson(row.metadata_json))).filter((row) => usageRowVisible(store, row));
+			};
+			const globalRows = loadUsageRows();
+			const filteredRows = projectFilter ? loadUsageRows(projectFilter) : null;
+			const eventsGlobal = summarizeUsageEvents(globalRows);
+			const totalsGlobal = totalUsageEvents(globalRows);
+			const eventsFiltered = filteredRows ? summarizeUsageEvents(filteredRows) : null;
+			const totalsFiltered = filteredRows ? totalUsageEvents(filteredRows) : null;
+			const recentPacks = (filteredRows ?? globalRows).filter((row) => row.event === "pack").slice(0, 10).map((row) => ({
+				...row,
+				metadata_json: sanitizePackUsageMetadata(store, row.metadata_json)
 			}));
 			return c.json({
 				project: projectFilter,
@@ -1450,6 +1560,16 @@ function statsRoutes(getStore) {
 /**
 * Sync routes — status, peers, actors, attempts, pairing, mutations.
 */
+function safeSkippedSyncDetail(detail) {
+	if (!detail) return null;
+	return {
+		reason: detail.reason,
+		skipped_count: detail.skipped_count,
+		scope_id: detail.scope_id ?? null,
+		project: detail.project ?? null,
+		visibility: detail.visibility ?? null
+	};
+}
 var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
@@ -1559,12 +1679,37 @@ function optionalViewerString(body, key) {
 	if (value == null) return null;
 	return String(value).trim() || null;
 }
+function optionalViewerStrictString(body, key) {
+	const value = body[key];
+	if (value == null) return null;
+	if (typeof value !== "string") throw new Error(`${key} must be string`);
+	return value.trim() || null;
+}
+function optionalViewerStringList(body, key) {
+	const value = body[key];
+	if (value == null) return [];
+	if (!Array.isArray(value)) throw new Error(`${key} must be an array of strings`);
+	return [...new Set(value.map((item) => {
+		if (typeof item !== "string") throw new Error(`${key} must be an array of strings`);
+		return item.trim();
+	}).filter(Boolean))];
+}
 function optionalViewerNumber(body, key) {
 	const value = body[key];
 	if (value == null || value === "") return null;
 	const number = typeof value === "number" ? value : Number(value);
 	return Number.isFinite(number) ? Math.trunc(number) : NaN;
 }
+function optionalViewerInteger(body, key) {
+	const value = body[key];
+	if (value == null || value === "") return null;
+	const number = typeof value === "number" ? value : Number(value);
+	return Number.isInteger(number) ? number : NaN;
+}
+function missingGuardrailConfirmations(warnings, confirmedTokens) {
+	const confirmed = new Set(confirmedTokens);
+	return warnings.filter((warning) => warning.requires_confirmation && (!warning.confirmation_token || !confirmed.has(warning.confirmation_token)));
+}
 function coordinatorAdminMutationStatus(message) {
 	if (message.includes("scope_not_found") || message.includes("membership_not_found") || message.includes("group_not_found") || message.includes("Group not found") || message.includes("Scope not found") || message.includes("device_not_enrolled_for_scope_group") || message.includes("device must be enrolled")) return 404;
 	if (message.includes("not active") || message.includes("scope_not_active") || message.includes("group_archived") || message.includes("Group is archived")) return 409;
@@ -1892,6 +2037,42 @@ function currentProjectScope(row, effective) {
 		inherits_global: row.projects_include_json == null && row.projects_exclude_json == null
 	};
 }
+function cleanPeerScopeText(value) {
+	return String(value ?? "").trim() || null;
+}
+function peerAuthorizedScopes(store, peerDeviceId) {
+	const deviceId = peerDeviceId.trim();
+	if (!deviceId) return [];
+	return store.db.prepare(`SELECT
+				rs.scope_id,
+				rs.label,
+				rs.kind,
+				rs.authority_type,
+				rs.coordinator_id,
+				rs.group_id,
+				sm.role,
+				sm.membership_epoch,
+				sm.updated_at
+			 FROM scope_memberships sm
+			 JOIN replication_scopes rs ON rs.scope_id = sm.scope_id
+			 WHERE sm.device_id = ?
+			   AND sm.status = 'active'
+			   AND rs.status = 'active'
+			   AND sm.membership_epoch >= rs.membership_epoch
+			 ORDER BY CASE WHEN rs.authority_type = 'local' THEN 1 ELSE 0 END,
+			          rs.label COLLATE NOCASE,
+			          rs.scope_id`).all(deviceId).map((row) => ({
+		scope_id: String(row.scope_id ?? ""),
+		label: String(row.label ?? row.scope_id ?? ""),
+		kind: String(row.kind ?? "user"),
+		authority_type: String(row.authority_type ?? "local"),
+		coordinator_id: cleanPeerScopeText(row.coordinator_id),
+		group_id: cleanPeerScopeText(row.group_id),
+		role: String(row.role ?? "member"),
+		membership_epoch: Number(row.membership_epoch ?? 0),
+		updated_at: cleanPeerScopeText(row.updated_at)
+	}));
+}
 function ensureLocalActorRecord(store) {
 	const d = drizzle(store.db, { schema });
 	if (d.select({ actor_id: schema.actors.actor_id }).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get()) return;
@@ -2114,7 +2295,8 @@ function filterOpsForPeer(store, peerDeviceId, localDeviceId, ops, options = {})
 	});
 	return {
 		allowed,
-		skipped: skipped?.skipped_count ?? 0
+		skipped: skipped?.skipped_count ?? 0,
+		skippedDetail: skipped ? safeSkippedSyncDetail(skipped) : null
 	};
 }
 function claimedLocalActorScopeStatus(store, row) {
@@ -2155,9 +2337,10 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		last_error: showDiag ? row.last_error : null,
 		has_error: Boolean(row.last_error),
 		claimed_local_actor: Boolean(row.claimed_local_actor),
-		claimed_local_actor_scope: showDiag ? claimedLocalActorScopeStatus(store, row) : null,
+		claimed_local_actor_scope: claimedLocalActorScopeStatus(store, row),
 		actor_id: row.actor_id ?? null,
 		actor_display_name: row.actor_display_name ?? null,
+		authorized_scopes: peerAuthorizedScopes(store, peerId),
 		project_scope: { ...currentProjectScope(row, readPeerProjectFilters(store, String(row.peer_device_id ?? ""))) },
 		recent_ops: {
 			in: recentOps.in,
@@ -2366,7 +2549,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				retained_floor_cursor: boundary.retained_floor_cursor,
 				ops: filtered.allowed,
 				next_cursor: nextCursor,
-				skipped: filtered.skipped
+				skipped: filtered.skipped,
+				skipped_detail: filtered.skippedDetail
 			});
 		} catch {
 			return c.json({ error: "internal_error" }, 500);
@@ -2483,6 +2667,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		return c.json({
 			...result,
 			skipped,
+			skipped_detail: filtered.skippedDetail,
 			sync_capability: LOCAL_SYNC_CAPABILITY,
 			scope_id: scopeRequest.scope_id
 		});
@@ -2585,6 +2770,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				statusPayload.daemon_running = runtimeStatus.phase === "starting" || daemonRunning;
 				statusPayload.daemon_detail = runtimeStatus.detail ?? daemonDetail;
 			}
+			const coordinatorSnapshot = await coordinatorStatusSnapshot(store, config);
+			const coordinator = traceSync("coordinator", () => redactCoordinatorStatus(coordinatorSnapshot, showDiag));
 			const peerRows = traceSync("peerRows", () => store.db.prepare(PEERS_QUERY).all());
 			const recentOpsByPeer = traceSync("recentPeerOps", () => recentPeerOps(store));
 			const scopeRejectionsByPeer = traceSync("recentScopeRejectionsByPeer", () => recentScopeRejectionsByPeer(store));
@@ -2631,8 +2818,6 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			};
 			const legacyDevices = traceSync("legacyDevices", () => store.claimableLegacyDeviceIds());
 			const sharingReview = traceSync("sharingReview", () => store.sharingReviewSummary(project));
-			const coordinatorSnapshot = await coordinatorStatusSnapshot(store, config);
-			const coordinator = traceSync("coordinator", () => redactCoordinatorStatus(coordinatorSnapshot, showDiag));
 			let joinRequests = [];
 			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
 				joinRequests = await listCoordinatorJoinRequests(config);
@@ -2821,7 +3006,9 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const result = await runSyncPass(store.db, peerId, { scanner: store.scanner });
 			items.push({
 				peer_device_id: peerId,
-				...result
+				...result,
+				skippedOut: void 0,
+				skipped_out: safeSkippedSyncDetail(result.skippedOut)
 			});
 		}
 		return c.json({ items });
@@ -2855,6 +3042,78 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			project_scope: currentProjectScope(row, readPeerProjectFilters(store, peerDeviceId))
 		});
 	});
+	app.get("/api/sync/sharing-domains/settings", (c) => {
+		const store = getStore();
+		const limit = Math.max(1, queryInt(c.req.query("limit"), 250));
+		return c.json({
+			scopes: listSharingDomainSettingsScopes(store.db),
+			mappings: listProjectScopeSettingsMappings(store.db),
+			projects: listProjectScopeCandidates(store.db, { limit }),
+			local_default_scope_id: LOCAL_DEFAULT_SCOPE_ID
+		});
+	});
+	app.put("/api/sync/sharing-domains/project-mappings", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body) return c.json({ error: "invalid json" }, 400);
+		try {
+			const id = optionalViewerInteger(body, "id");
+			const priority = optionalViewerInteger(body, "priority");
+			if (Number.isNaN(id)) return c.json({ error: "id must be an integer" }, 400);
+			if (Number.isNaN(priority)) return c.json({ error: "priority must be an integer" }, 400);
+			const workspaceIdentity = optionalViewerStrictString(body, "workspace_identity");
+			const projectPattern = optionalViewerStrictString(body, "project_pattern");
+			const scopeId = optionalViewerStrictString(body, "scope_id") ?? "";
+			const source = optionalViewerStrictString(body, "source") ?? "user";
+			const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
+			const mappingInput = {
+				id,
+				workspace_identity: workspaceIdentity,
+				project_pattern: projectPattern,
+				scope_id: scopeId,
+				priority,
+				source
+			};
+			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput);
+			if (analysis.requested_workspace_identity?.startsWith("unmapped:") && scopeId !== LOCAL_DEFAULT_SCOPE_ID) return c.json({
+				error: "unmapped_project_local_only",
+				message: "Unmapped projects need a stable path, git remote, or workspace id before assigning a non-local Sharing domain.",
+				guardrail_warnings: analysis.warnings
+			}, 400);
+			const missingConfirmations = missingGuardrailConfirmations(analysis.warnings, confirmedGuardrailTokens);
+			if (missingConfirmations.length > 0) {
+				const missingCodes = [...new Set(missingConfirmations.map((warning) => warning.code))];
+				const missingTokens = [...new Set(missingConfirmations.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0);
+				return c.json({
+					error: "guardrail_confirmation_required",
+					required_guardrails: missingCodes,
+					required_guardrail_tokens: missingTokens,
+					guardrail_warnings: analysis.warnings
+				}, 409);
+			}
+			const mapping = upsertProjectScopeSettingsMapping(store.db, { ...mappingInput });
+			return c.json({
+				ok: true,
+				mapping,
+				guardrail_warnings: analysis.warnings
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
+	});
+	app.delete("/api/sync/sharing-domains/project-mappings/:id", (c) => {
+		const store = getStore();
+		const id = Number(c.req.param("id"));
+		try {
+			const deleted = deleteProjectScopeSettingsMapping(store.db, id);
+			return c.json({
+				ok: true,
+				deleted
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
+	});
 	app.post("/api/sync/peers/identity", async (c) => {
 		const store = getStore();
 		ensureLocalActorRecord(store);