@codemem/server 0.30.0-alpha.2 → 0.30.0-alpha.4

package/dist/index.js

@@ -1,12 +1,12 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, deleteProjectScopeSettingsMapping, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listProjectScopeCandidates, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
 import { homedir, networkInterfaces } from "node:os";
-import { and, count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
+import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/middleware.ts
@@ -641,14 +641,65 @@ function normalizeScope(raw) {
 	const value = String(raw ?? "").trim().toLowerCase();
 	if (value === "mine" || value === "theirs") return value;
 }
+function buildViewerMemoryFilters(store, filters) {
+	return buildFilterClausesWithContext(filters, {
+		actorId: store.actorId,
+		deviceId: store.deviceId,
+		enforceScopeVisibility: true
+	});
+}
+function countVisibleMemoryRows(store, filters) {
+	const filterResult = buildViewerMemoryFilters(store, filters);
+	const clauses = ["memory_items.active = 1", ...filterResult.clauses];
+	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM ${from} WHERE ${clauses.join(" AND ")}`).get(...filterResult.params);
+	return Number(row?.total ?? 0);
+}
+function sessionAllowsArtifactAccess(store, sessionId) {
+	const visibleCount = countVisibleMemoryRows(store, { session_id: sessionId });
+	if (visibleCount === 0) return false;
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM memory_items
+			 WHERE session_id = ? AND active = 1`).get(sessionId);
+	return visibleCount === Number(row?.total ?? 0);
+}
+function countVisiblePromptRows(store, project) {
+	const filterResult = buildViewerMemoryFilters(store, null);
+	const clauses = ["user_prompts.session_id IS NOT NULL", `EXISTS (
+			SELECT 1 FROM memory_items
+			WHERE memory_items.session_id = user_prompts.session_id
+			  AND memory_items.active = 1
+			  AND ${filterResult.clauses.join(" AND ")}
+		)`];
+	const params = [...filterResult.params];
+	if (project) {
+		clauses.unshift("user_prompts.project = ?");
+		params.unshift(project);
+	}
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM user_prompts WHERE ${clauses.join(" AND ")}`).get(...params);
+	return Number(row?.total ?? 0);
+}
+function countVisibleArtifactRows(store, project) {
+	const filterResult = buildViewerMemoryFilters(store, null);
+	const clauses = [`EXISTS (
+			SELECT 1 FROM memory_items
+			WHERE memory_items.session_id = artifacts.session_id
+			  AND memory_items.active = 1
+			  AND ${filterResult.clauses.join(" AND ")}
+		)`];
+	const params = [...filterResult.params];
+	const from = project ? "artifacts JOIN sessions ON sessions.id = artifacts.session_id" : "artifacts";
+	if (project) {
+		clauses.unshift("sessions.project = ?");
+		params.unshift(project);
+	}
+	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM ${from} WHERE ${clauses.join(" AND ")}`).get(...params);
+	return Number(row?.total ?? 0);
+}
 function queryMemoryPage(store, options) {
 	const filters = {};
 	if (options.project) filters.project = options.project;
 	if (options.scope) filters.ownership_scope = options.scope;
-	const filterResult = buildFilterClausesWithContext(filters, {
-		actorId: store.actorId,
-		deviceId: store.deviceId
-	});
+	const filterResult = buildViewerMemoryFilters(store, filters);
 	const where = ["memory_items.active = 1", ...filterResult.clauses].join(" AND ");
 	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
 	const rows = store.db.prepare(`SELECT memory_items.* FROM ${from}
@@ -688,9 +739,18 @@ function memoryRoutes(getStore) {
 		const store = getStore();
 		{
 			const limit = queryInt(c.req.query("limit"), 20);
-			const items = drizzle(store.db, { schema }).select().from(schema.sessions).orderBy(desc(schema.sessions.started_at)).limit(limit).all().map((row) => ({
+			const filterResult = buildViewerMemoryFilters(store, null);
+			const clauses = [
+				"memory_items.session_id = sessions.id",
+				"memory_items.active = 1",
+				...filterResult.clauses
+			];
+			const items = store.db.prepare(`SELECT sessions.* FROM sessions
+					 WHERE EXISTS (SELECT 1 FROM memory_items WHERE ${clauses.join(" AND ")})
+					 ORDER BY sessions.started_at DESC
+					 LIMIT ?`).all(...filterResult.params, limit).map((row) => ({
 				...row,
-				metadata_json: fromJson(row.metadata_json)
+				metadata_json: fromJson(row.metadata_json ?? null)
 			}));
 			return c.json({ items });
 		}
@@ -698,7 +758,16 @@ function memoryRoutes(getStore) {
 	app.get("/api/projects", (c) => {
 		const store = getStore();
 		{
-			const rows = drizzle(store.db, { schema }).selectDistinct({ project: schema.sessions.project }).from(schema.sessions).where(isNotNull(schema.sessions.project)).all();
+			const filterResult = buildViewerMemoryFilters(store, null);
+			const clauses = [
+				"memory_items.session_id = sessions.id",
+				"memory_items.active = 1",
+				"sessions.project IS NOT NULL",
+				...filterResult.clauses
+			];
+			const rows = store.db.prepare(`SELECT DISTINCT sessions.project AS project FROM sessions
+					 JOIN memory_items ON memory_items.session_id = sessions.id
+					 WHERE ${clauses.join(" AND ")}`).all(...filterResult.params);
 			const projects = [...new Set(rows.map((r) => String(r.project ?? "").trim()).filter((p) => p && !p.toLowerCase().startsWith("fatal:")).map((p) => projectBasename(p)).filter(Boolean))].sort();
 			return c.json({ projects });
 		}
@@ -765,10 +834,6 @@ function memoryRoutes(getStore) {
 		const store = getStore();
 		{
 			const project = c.req.query("project") || null;
-			const count = (sql, ...params) => {
-				const row = store.db.prepare(sql).get(...params);
-				return Number(row?.total ?? 0);
-			};
 			let prompts;
 			let artifacts;
 			let memories;
@@ -790,18 +855,14 @@ function memoryRoutes(getStore) {
 				return total;
 			};
 			if (project) {
-				prompts = count("SELECT COUNT(*) AS total FROM user_prompts WHERE project = ?", project);
-				artifacts = count(`SELECT COUNT(*) AS total FROM artifacts
-					 JOIN sessions ON sessions.id = artifacts.session_id
-					 WHERE sessions.project = ?`, project);
-				memories = count(`SELECT COUNT(*) AS total FROM memory_items
-					 JOIN sessions ON sessions.id = memory_items.session_id
-					 WHERE sessions.project = ?`, project);
+				prompts = countVisiblePromptRows(store, project);
+				artifacts = countVisibleArtifactRows(store, project);
+				memories = countVisibleMemoryRows(store, { project });
 				observations = countObservations(project);
 			} else {
-				prompts = count("SELECT COUNT(*) AS total FROM user_prompts");
-				artifacts = count("SELECT COUNT(*) AS total FROM artifacts");
-				memories = count("SELECT COUNT(*) AS total FROM memory_items");
+				prompts = countVisiblePromptRows(store);
+				artifacts = countVisibleArtifactRows(store);
+				memories = countVisibleMemoryRows(store);
 				observations = countObservations();
 			}
 			const total = prompts + artifacts + memories;
@@ -878,6 +939,7 @@ function memoryRoutes(getStore) {
 			if (!sessionIdStr) return c.json({ error: "session_id required" }, 400);
 			const sessionId = parseStrictInteger(sessionIdStr);
 			if (sessionId == null) return c.json({ error: "session_id must be int" }, 400);
+			if (!sessionAllowsArtifactAccess(store, sessionId)) return c.json({ error: "session not found" }, 404);
 			const rows = drizzle(store.db, { schema }).select().from(schema.artifacts).where(eq(schema.artifacts.session_id, sessionId)).all();
 			return c.json({ items: rows });
 		}
@@ -892,6 +954,7 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
+		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		const visibility = String(body.visibility ?? "").trim();
 		if (visibility !== "private" && visibility !== "shared") return c.json({ error: "visibility must be private or shared" }, 400);
 		try {
@@ -916,6 +979,7 @@ function memoryRoutes(getStore) {
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
 		const project = String(body.project ?? "").trim();
 		if (!project) return c.json({ error: "project must be a non-empty string" }, 400);
+		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		try {
 			const result = store.moveMemoryProject(memoryId, project);
 			return c.json(result);
@@ -936,6 +1000,7 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
+		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		const row = drizzle(store.db, { schema }).select().from(schema.memoryItems).where(eq(schema.memoryItems.id, memoryId)).get();
 		if (!row) return c.json({ error: "memory not found" }, 404);
 		if (!memoryOwnedBySelf(row, buildOwnershipContext(store))) return c.json({ error: "memory not owned by this device" }, 403);
@@ -1330,6 +1395,131 @@ function sortActiveMaintenanceJobs$1(jobs) {
 		return aKind.localeCompare(bKind);
 	});
 }
+var MEMORY_ID_METADATA_KEYS = [
+	"pack_item_ids",
+	"added_ids",
+	"removed_ids",
+	"retained_ids"
+];
+function toUsageRow(row, metadata) {
+	return {
+		id: Number(row.id ?? 0),
+		session_id: row.session_id == null ? null : Number(row.session_id),
+		event: String(row.event ?? "pack"),
+		tokens_read: Number(row.tokens_read ?? 0),
+		tokens_written: Number(row.tokens_written ?? 0),
+		tokens_saved: Number(row.tokens_saved ?? 0),
+		created_at: String(row.created_at ?? ""),
+		metadata_json: metadata
+	};
+}
+function metadataMemoryIds(value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((item) => typeof item === "number" ? item : Number(item)).filter((item) => Number.isInteger(item) && item > 0);
+}
+function chunkNumbers(values, chunkSize = 500) {
+	const chunks = [];
+	for (let start = 0; start < values.length; start += chunkSize) chunks.push(values.slice(start, start + chunkSize));
+	return chunks;
+}
+function visibleMemoryIdSet(store, memoryIds) {
+	if (memoryIds.size === 0) return /* @__PURE__ */ new Set();
+	const filterResult = buildFilterClausesWithContext(null, {
+		actorId: store.actorId,
+		deviceId: store.deviceId,
+		enforceScopeVisibility: true
+	});
+	const visibleIds = /* @__PURE__ */ new Set();
+	for (const chunk of chunkNumbers([...memoryIds])) {
+		const clauses = [
+			"memory_items.active = 1",
+			`memory_items.id IN (${chunk.map(() => "?").join(", ")})`,
+			...filterResult.clauses
+		];
+		const rows = store.db.prepare(`SELECT memory_items.id FROM memory_items WHERE ${clauses.join(" AND ")}`).all(...chunk, ...filterResult.params);
+		for (const row of rows) visibleIds.add(Number(row.id));
+	}
+	return visibleIds;
+}
+function visibleSessionIdSet(store, sessionIds) {
+	if (sessionIds.size === 0) return /* @__PURE__ */ new Set();
+	const filterResult = buildFilterClausesWithContext(null, {
+		actorId: store.actorId,
+		deviceId: store.deviceId,
+		enforceScopeVisibility: true
+	});
+	const visibleIds = /* @__PURE__ */ new Set();
+	for (const chunk of chunkNumbers([...sessionIds])) {
+		const clauses = [
+			"memory_items.active = 1",
+			`memory_items.session_id IN (${chunk.map(() => "?").join(", ")})`,
+			...filterResult.clauses
+		];
+		const rows = store.db.prepare(`SELECT DISTINCT memory_items.session_id AS session_id
+				 FROM memory_items
+				 WHERE ${clauses.join(" AND ")}`).all(...chunk, ...filterResult.params);
+		for (const row of rows) if (typeof row.session_id === "number") visibleIds.add(row.session_id);
+	}
+	return visibleIds;
+}
+function buildUsageVisibility(store, rows) {
+	const memoryIds = /* @__PURE__ */ new Set();
+	const sessionIds = /* @__PURE__ */ new Set();
+	for (const row of rows) {
+		if (typeof row.session_id === "number") sessionIds.add(row.session_id);
+		for (const key of MEMORY_ID_METADATA_KEYS) for (const memoryId of metadataMemoryIds(row.metadata_json?.[key])) memoryIds.add(memoryId);
+	}
+	return {
+		visibleMemoryIds: visibleMemoryIdSet(store, memoryIds),
+		visibleSessionIds: visibleSessionIdSet(store, sessionIds)
+	};
+}
+function usageRowVisible(row, visibility) {
+	const rowSessionVisible = row.session_id == null || visibility.visibleSessionIds.has(row.session_id);
+	const packItemIds = row.metadata_json?.pack_item_ids;
+	if (Array.isArray(packItemIds)) {
+		if (packItemIds.length === 0) return row.session_id != null && visibility.visibleSessionIds.has(row.session_id);
+		return rowSessionVisible && metadataMemoryIds(packItemIds).some((memoryId) => visibility.visibleMemoryIds.has(memoryId));
+	}
+	return row.session_id != null && visibility.visibleSessionIds.has(row.session_id);
+}
+function sanitizePackUsageMetadata(metadata, visibility) {
+	if (!metadata) return null;
+	const sanitized = { ...metadata };
+	for (const key of MEMORY_ID_METADATA_KEYS) if (Array.isArray(sanitized[key])) sanitized[key] = metadataMemoryIds(sanitized[key]).filter((memoryId) => visibility.visibleMemoryIds.has(memoryId));
+	return sanitized;
+}
+function summarizeUsageEvents(rows) {
+	const byEvent = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const summary = byEvent.get(row.event) ?? {
+			event: row.event,
+			total_tokens_read: 0,
+			total_tokens_written: 0,
+			total_tokens_saved: 0,
+			count: 0
+		};
+		summary.total_tokens_read += row.tokens_read;
+		summary.total_tokens_written += row.tokens_written;
+		summary.total_tokens_saved += row.tokens_saved;
+		summary.count += 1;
+		byEvent.set(row.event, summary);
+	}
+	return [...byEvent.values()].sort((a, b) => a.event.localeCompare(b.event));
+}
+function totalUsageEvents(rows) {
+	return rows.reduce((acc, row) => ({
+		tokens_read: Number(acc.tokens_read) + row.tokens_read,
+		tokens_written: Number(acc.tokens_written) + row.tokens_written,
+		tokens_saved: Number(acc.tokens_saved) + row.tokens_saved,
+		count: Number(acc.count) + 1
+	}), {
+		tokens_read: 0,
+		tokens_written: 0,
+		tokens_saved: 0,
+		count: 0
+	});
+}
 /**
 * Create stats routes. The store factory is called per-request to get a
 * fresh connection (matching the Python viewer pattern).
@@ -1378,58 +1568,32 @@ function statsRoutes(getStore) {
 		const store = getStore();
 		{
 			const projectFilter = c.req.query("project") || null;
-			const recentPacksQuery = projectFilter ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
-						usage_events.tokens_read, usage_events.tokens_written, usage_events.tokens_saved,
-						usage_events.created_at, usage_events.metadata_json
-					 FROM usage_events
-					 JOIN sessions ON sessions.id = usage_events.session_id
-					 WHERE usage_events.event = 'pack' AND sessions.project = ?
-					 ORDER BY usage_events.created_at DESC
-					 LIMIT 10`) : store.db.prepare(`SELECT id, session_id, event, tokens_read, tokens_written, tokens_saved, created_at, metadata_json
-					 FROM usage_events
-					 WHERE event = 'pack'
-					 ORDER BY created_at DESC
-					 LIMIT 10`);
-			const eventsGlobal = store.db.prepare(`SELECT event,
-						SUM(tokens_read) AS total_tokens_read,
-						SUM(tokens_written) AS total_tokens_written,
-						SUM(tokens_saved) AS total_tokens_saved,
-						COUNT(*) AS count
-					 FROM usage_events GROUP BY event ORDER BY event`).all();
-			const totalsGlobal = store.db.prepare(`SELECT COALESCE(SUM(tokens_read),0) AS tokens_read,
-						COALESCE(SUM(tokens_written),0) AS tokens_written,
-						COALESCE(SUM(tokens_saved),0) AS tokens_saved,
-						COUNT(*) AS count
-					 FROM usage_events`).get();
-			let eventsFiltered = null;
-			let totalsFiltered = null;
-			if (projectFilter) {
-				eventsFiltered = store.db.prepare(`SELECT event,
-							SUM(tokens_read) AS total_tokens_read,
-							SUM(tokens_written) AS total_tokens_written,
-							SUM(tokens_saved) AS total_tokens_saved,
-							COUNT(*) AS count
-						 FROM usage_events
-						 JOIN sessions ON sessions.id = usage_events.session_id
-						 WHERE sessions.project = ?
-						 GROUP BY event ORDER BY event`).all(projectFilter);
-				totalsFiltered = store.db.prepare(`SELECT COALESCE(SUM(tokens_read),0) AS tokens_read,
-							COALESCE(SUM(tokens_written),0) AS tokens_written,
-							COALESCE(SUM(tokens_saved),0) AS tokens_saved,
-							COUNT(*) AS count
-						 FROM usage_events
-						 JOIN sessions ON sessions.id = usage_events.session_id
-						 WHERE sessions.project = ?`).get(projectFilter);
-			}
-			const recentPacks = (projectFilter ? recentPacksQuery.all(projectFilter) : recentPacksQuery.all()).map((row) => ({
-				id: Number(row.id ?? 0),
-				session_id: row.session_id == null ? null : Number(row.session_id),
-				event: String(row.event ?? "pack"),
-				tokens_read: Number(row.tokens_read ?? 0),
-				tokens_written: Number(row.tokens_written ?? 0),
-				tokens_saved: Number(row.tokens_saved ?? 0),
-				created_at: String(row.created_at ?? ""),
-				metadata_json: parseMetadataJson(row.metadata_json)
+			const loadUsageRows = (project) => {
+				return (project ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
+									usage_events.tokens_read, usage_events.tokens_written, usage_events.tokens_saved,
+									usage_events.created_at, usage_events.metadata_json
+								 FROM usage_events
+								 JOIN sessions ON sessions.id = usage_events.session_id
+								 WHERE sessions.project = ?
+								 ORDER BY usage_events.created_at DESC`).all(project) : store.db.prepare(`SELECT id, session_id, event, tokens_read, tokens_written, tokens_saved,
+									created_at, metadata_json
+								 FROM usage_events
+								 ORDER BY created_at DESC`).all()).map((row) => toUsageRow(row, parseMetadataJson(row.metadata_json)));
+			};
+			const loadedGlobalRows = loadUsageRows();
+			const globalVisibility = buildUsageVisibility(store, loadedGlobalRows);
+			const globalRows = loadedGlobalRows.filter((row) => usageRowVisible(row, globalVisibility));
+			const loadedFilteredRows = projectFilter ? loadUsageRows(projectFilter) : null;
+			const filteredVisibility = loadedFilteredRows ? buildUsageVisibility(store, loadedFilteredRows) : null;
+			const filteredRows = loadedFilteredRows ? loadedFilteredRows.filter((row) => usageRowVisible(row, filteredVisibility ?? globalVisibility)) : null;
+			const eventsGlobal = summarizeUsageEvents(globalRows);
+			const totalsGlobal = totalUsageEvents(globalRows);
+			const eventsFiltered = filteredRows ? summarizeUsageEvents(filteredRows) : null;
+			const totalsFiltered = filteredRows ? totalUsageEvents(filteredRows) : null;
+			const recentVisibility = filteredVisibility ?? globalVisibility;
+			const recentPacks = (filteredRows ?? globalRows).filter((row) => row.event === "pack").slice(0, 10).map((row) => ({
+				...row,
+				metadata_json: sanitizePackUsageMetadata(row.metadata_json, recentVisibility)
 			}));
 			return c.json({
 				project: projectFilter,
@@ -1450,6 +1614,16 @@ function statsRoutes(getStore) {
 /**
 * Sync routes — status, peers, actors, attempts, pairing, mutations.
 */
+function safeSkippedSyncDetail(detail) {
+	if (!detail) return null;
+	return {
+		reason: detail.reason,
+		skipped_count: detail.skipped_count,
+		scope_id: detail.scope_id ?? null,
+		project: detail.project ?? null,
+		visibility: detail.visibility ?? null
+	};
+}
 var SYNC_STALE_AFTER_SECONDS = 600;
 var SYNC_PROTOCOL_VERSION = "2";
 var LEGACY_SYNC_ACTOR_DISPLAY_NAME = "Legacy synced peer";
@@ -1559,12 +1733,37 @@ function optionalViewerString(body, key) {
 	if (value == null) return null;
 	return String(value).trim() || null;
 }
+function optionalViewerStrictString(body, key) {
+	const value = body[key];
+	if (value == null) return null;
+	if (typeof value !== "string") throw new Error(`${key} must be string`);
+	return value.trim() || null;
+}
+function optionalViewerStringList(body, key) {
+	const value = body[key];
+	if (value == null) return [];
+	if (!Array.isArray(value)) throw new Error(`${key} must be an array of strings`);
+	return [...new Set(value.map((item) => {
+		if (typeof item !== "string") throw new Error(`${key} must be an array of strings`);
+		return item.trim();
+	}).filter(Boolean))];
+}
 function optionalViewerNumber(body, key) {
 	const value = body[key];
 	if (value == null || value === "") return null;
 	const number = typeof value === "number" ? value : Number(value);
 	return Number.isFinite(number) ? Math.trunc(number) : NaN;
 }
+function optionalViewerInteger(body, key) {
+	const value = body[key];
+	if (value == null || value === "") return null;
+	const number = typeof value === "number" ? value : Number(value);
+	return Number.isInteger(number) ? number : NaN;
+}
+function missingGuardrailConfirmations(warnings, confirmedTokens) {
+	const confirmed = new Set(confirmedTokens);
+	return warnings.filter((warning) => warning.requires_confirmation && (!warning.confirmation_token || !confirmed.has(warning.confirmation_token)));
+}
 function coordinatorAdminMutationStatus(message) {
 	if (message.includes("scope_not_found") || message.includes("membership_not_found") || message.includes("group_not_found") || message.includes("Group not found") || message.includes("Scope not found") || message.includes("device_not_enrolled_for_scope_group") || message.includes("device must be enrolled")) return 404;
 	if (message.includes("not active") || message.includes("scope_not_active") || message.includes("group_archived") || message.includes("Group is archived")) return 409;
@@ -1672,6 +1871,43 @@ function unauthorizedPayload(reason, exposeReason = false) {
 	};
 	return { error: "unauthorized" };
 }
+var SYNC_AUTH_STORE_BUSY_REASON = "sync_auth_store_busy";
+function isSqliteBusy(err) {
+	if (!err || typeof err !== "object") return false;
+	const code = "code" in err ? String(err.code ?? "") : "";
+	const message = err instanceof Error ? err.message : "";
+	return code === "SQLITE_BUSY" || message.includes("database is locked");
+}
+function recordSyncAuthNonce(store, deviceId, nonce, createdAt) {
+	try {
+		if (!recordNonce(store.db, deviceId, nonce, createdAt)) return {
+			ok: false,
+			reason: "nonce_replay",
+			deviceId
+		};
+	} catch (err) {
+		if (isSqliteBusy(err)) return {
+			ok: false,
+			reason: SYNC_AUTH_STORE_BUSY_REASON,
+			deviceId
+		};
+		throw err;
+	}
+	const cutoff = (/* @__PURE__ */ new Date(Date.now() - DEFAULT_TIME_WINDOW_S * 2 * 1e3)).toISOString();
+	try {
+		cleanupNonces(store.db, cutoff);
+	} catch (err) {
+		if (!isSqliteBusy(err)) throw err;
+	}
+	return null;
+}
+function isSyncAuthStoreBusy(auth) {
+	return !auth.ok && auth.reason === SYNC_AUTH_STORE_BUSY_REASON;
+}
+function syncAuthStoreBusyResponse(c) {
+	c.header("Retry-After", "1");
+	return c.json({ error: SYNC_AUTH_STORE_BUSY_REASON }, 503);
+}
 function authorizeSyncRequest(store, request, body) {
 	const deviceId = (request.header("X-Opencode-Device") ?? "").trim();
 	const signature = request.header("X-Opencode-Signature") ?? "";
@@ -1724,14 +1960,8 @@ function authorizeSyncRequest(store, request, body) {
 		reason: "invalid_signature",
 		deviceId
 	};
-	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-	if (!recordNonce(store.db, deviceId, nonce, createdAt)) return {
-		ok: false,
-		reason: "nonce_replay",
-		deviceId
-	};
-	const cutoff = (/* @__PURE__ */ new Date(Date.now() - DEFAULT_TIME_WINDOW_S * 2 * 1e3)).toISOString();
-	cleanupNonces(store.db, cutoff);
+	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
+	if (nonceResult) return nonceResult;
 	return {
 		ok: true,
 		reason: "ok",
@@ -1841,14 +2071,8 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_invalid_signature",
 		deviceId
 	};
-	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-	if (!recordNonce(store.db, deviceId, nonce, createdAt)) return {
-		ok: false,
-		reason: "nonce_replay",
-		deviceId
-	};
-	const cutoff = (/* @__PURE__ */ new Date(Date.now() - DEFAULT_TIME_WINDOW_S * 2 * 1e3)).toISOString();
-	cleanupNonces(store.db, cutoff);
+	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
+	if (nonceResult) return nonceResult;
 	return {
 		ok: true,
 		reason: "ok",
@@ -1892,6 +2116,42 @@ function currentProjectScope(row, effective) {
 		inherits_global: row.projects_include_json == null && row.projects_exclude_json == null
 	};
 }
+function cleanPeerScopeText(value) {
+	return String(value ?? "").trim() || null;
+}
+function peerAuthorizedScopes(store, peerDeviceId) {
+	const deviceId = peerDeviceId.trim();
+	if (!deviceId) return [];
+	return store.db.prepare(`SELECT
+				rs.scope_id,
+				rs.label,
+				rs.kind,
+				rs.authority_type,
+				rs.coordinator_id,
+				rs.group_id,
+				sm.role,
+				sm.membership_epoch,
+				sm.updated_at
+			 FROM scope_memberships sm
+			 JOIN replication_scopes rs ON rs.scope_id = sm.scope_id
+			 WHERE sm.device_id = ?
+			   AND sm.status = 'active'
+			   AND rs.status = 'active'
+			   AND sm.membership_epoch >= rs.membership_epoch
+			 ORDER BY CASE WHEN rs.authority_type = 'local' THEN 1 ELSE 0 END,
+			          rs.label COLLATE NOCASE,
+			          rs.scope_id`).all(deviceId).map((row) => ({
+		scope_id: String(row.scope_id ?? ""),
+		label: String(row.label ?? row.scope_id ?? ""),
+		kind: String(row.kind ?? "user"),
+		authority_type: String(row.authority_type ?? "local"),
+		coordinator_id: cleanPeerScopeText(row.coordinator_id),
+		group_id: cleanPeerScopeText(row.group_id),
+		role: String(row.role ?? "member"),
+		membership_epoch: Number(row.membership_epoch ?? 0),
+		updated_at: cleanPeerScopeText(row.updated_at)
+	}));
+}
 function ensureLocalActorRecord(store) {
 	const d = drizzle(store.db, { schema });
 	if (d.select({ actor_id: schema.actors.actor_id }).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get()) return;
@@ -2114,7 +2374,8 @@ function filterOpsForPeer(store, peerDeviceId, localDeviceId, ops, options = {})
 	});
 	return {
 		allowed,
-		skipped: skipped?.skipped_count ?? 0
+		skipped: skipped?.skipped_count ?? 0,
+		skippedDetail: skipped ? safeSkippedSyncDetail(skipped) : null
 	};
 }
 function claimedLocalActorScopeStatus(store, row) {
@@ -2155,9 +2416,10 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		last_error: showDiag ? row.last_error : null,
 		has_error: Boolean(row.last_error),
 		claimed_local_actor: Boolean(row.claimed_local_actor),
-		claimed_local_actor_scope: showDiag ? claimedLocalActorScopeStatus(store, row) : null,
+		claimed_local_actor_scope: claimedLocalActorScopeStatus(store, row),
 		actor_id: row.actor_id ?? null,
 		actor_display_name: row.actor_display_name ?? null,
+		authorized_scopes: peerAuthorizedScopes(store, peerId),
 		project_scope: { ...currentProjectScope(row, readPeerProjectFilters(store, String(row.peer_device_id ?? ""))) },
 		recent_ops: {
 			in: recentOps.in,
@@ -2184,6 +2446,21 @@ function recentScopeRejectionsByPeer(store) {
 	}
 	return map;
 }
+function legacySharedReviewSummary(store) {
+	const row = store.db.prepare(`SELECT COUNT(*) AS memory_count,
+			        MAX(updated_at) AS last_updated_at
+			 FROM memory_items
+			 WHERE scope_id = ?
+			   AND active = 1
+			   AND deleted_at IS NULL`).get(LEGACY_SHARED_REVIEW_SCOPE_ID);
+	const memoryCount = Number(row?.memory_count ?? 0);
+	return {
+		scope_id: LEGACY_SHARED_REVIEW_SCOPE_ID,
+		memory_count: memoryCount,
+		has_data: memoryCount > 0,
+		last_updated_at: row?.last_updated_at ?? null
+	};
+}
 var SYNC_DIRECTION_WINDOW_SECONDS = 1440 * 60;
 function recentPeerOps(store) {
 	const cutoff = (/* @__PURE__ */ new Date(Date.now() - SYNC_DIRECTION_WINDOW_SECONDS * 1e3)).toISOString();
@@ -2255,7 +2532,8 @@ var PEERS_QUERY = `
 	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.addresses_json,
 	       p.last_seen_at, p.last_sync_at, p.last_error,
 	       p.projects_include_json, p.projects_exclude_json, p.claimed_local_actor,
-	       p.actor_id, a.display_name AS actor_display_name
+	       p.actor_id, p.discovered_via_coordinator_id, p.discovered_via_group_id,
+	       a.display_name AS actor_display_name
 	FROM sync_peers AS p
 	LEFT JOIN actors AS a ON a.actor_id = p.actor_id
 	ORDER BY name, peer_device_id
@@ -2285,6 +2563,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const store = getStore();
 		return (async () => {
 			let auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			let preauthChecked = false;
 			let bootstrapAttempted = false;
 			if (!auth.ok) {
@@ -2300,6 +2579,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
 				bootstrapAttempted = true;
 			}
+			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
 				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
@@ -2325,6 +2605,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	app.get("/v1/ops", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
@@ -2366,7 +2647,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				retained_floor_cursor: boundary.retained_floor_cursor,
 				ops: filtered.allowed,
 				next_cursor: nextCursor,
-				skipped: filtered.skipped
+				skipped: filtered.skipped,
+				skipped_detail: filtered.skippedDetail
 			});
 		} catch {
 			return c.json({ error: "internal_error" }, 500);
@@ -2376,6 +2658,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const store = getStore();
 		return (async () => {
 			let auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
+			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			let preauthChecked = false;
 			let bootstrapAttempted = false;
 			if (!auth.ok) {
@@ -2391,6 +2674,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
 				bootstrapAttempted = true;
 			}
+			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
 				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
@@ -2442,6 +2726,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const raw = await readBoundedRequestBytes(c.req.raw, MAX_SYNC_BODY_BYTES);
 		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
+		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
@@ -2483,6 +2768,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		return c.json({
 			...result,
 			skipped,
+			skipped_detail: filtered.skippedDetail,
 			sync_capability: LOCAL_SYNC_CAPABILITY,
 			scope_id: scopeRequest.scope_id
 		});
@@ -2585,6 +2871,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				statusPayload.daemon_running = runtimeStatus.phase === "starting" || daemonRunning;
 				statusPayload.daemon_detail = runtimeStatus.detail ?? daemonDetail;
 			}
+			const coordinatorSnapshot = await coordinatorStatusSnapshot(store, config);
+			const coordinator = traceSync("coordinator", () => redactCoordinatorStatus(coordinatorSnapshot, showDiag));
 			const peerRows = traceSync("peerRows", () => store.db.prepare(PEERS_QUERY).all());
 			const recentOpsByPeer = traceSync("recentPeerOps", () => recentPeerOps(store));
 			const scopeRejectionsByPeer = traceSync("recentScopeRejectionsByPeer", () => recentScopeRejectionsByPeer(store));
@@ -2630,9 +2918,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				ping: {}
 			};
 			const legacyDevices = traceSync("legacyDevices", () => store.claimableLegacyDeviceIds());
+			const legacyReview = traceSync("legacySharedReview", () => legacySharedReviewSummary(store));
 			const sharingReview = traceSync("sharingReview", () => store.sharingReviewSummary(project));
-			const coordinatorSnapshot = await coordinatorStatusSnapshot(store, config);
-			const coordinator = traceSync("coordinator", () => redactCoordinatorStatus(coordinatorSnapshot, showDiag));
 			let joinRequests = [];
 			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
 				joinRequests = await listCoordinatorJoinRequests(config);
@@ -2666,6 +2953,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				peers: peersItems,
 				attempts: attemptsItems.slice(0, 5),
 				legacy_devices: legacyDevices,
+				legacy_shared_review: legacyReview,
 				sharing_review: sharingReview,
 				coordinator
 			};
@@ -2821,7 +3109,9 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const result = await runSyncPass(store.db, peerId, { scanner: store.scanner });
 			items.push({
 				peer_device_id: peerId,
-				...result
+				...result,
+				skippedOut: void 0,
+				skipped_out: safeSkippedSyncDetail(result.skippedOut)
 			});
 		}
 		return c.json({ items });
@@ -2855,6 +3145,78 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			project_scope: currentProjectScope(row, readPeerProjectFilters(store, peerDeviceId))
 		});
 	});
+	app.get("/api/sync/sharing-domains/settings", (c) => {
+		const store = getStore();
+		const limit = Math.max(1, queryInt(c.req.query("limit"), 250));
+		return c.json({
+			scopes: listSharingDomainSettingsScopes(store.db),
+			mappings: listProjectScopeSettingsMappings(store.db),
+			projects: listProjectScopeCandidates(store.db, { limit }),
+			local_default_scope_id: LOCAL_DEFAULT_SCOPE_ID
+		});
+	});
+	app.put("/api/sync/sharing-domains/project-mappings", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body) return c.json({ error: "invalid json" }, 400);
+		try {
+			const id = optionalViewerInteger(body, "id");
+			const priority = optionalViewerInteger(body, "priority");
+			if (Number.isNaN(id)) return c.json({ error: "id must be an integer" }, 400);
+			if (Number.isNaN(priority)) return c.json({ error: "priority must be an integer" }, 400);
+			const workspaceIdentity = optionalViewerStrictString(body, "workspace_identity");
+			const projectPattern = optionalViewerStrictString(body, "project_pattern");
+			const scopeId = optionalViewerStrictString(body, "scope_id") ?? "";
+			const source = optionalViewerStrictString(body, "source") ?? "user";
+			const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
+			const mappingInput = {
+				id,
+				workspace_identity: workspaceIdentity,
+				project_pattern: projectPattern,
+				scope_id: scopeId,
+				priority,
+				source
+			};
+			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput);
+			if (analysis.requested_workspace_identity?.startsWith("unmapped:") && scopeId !== LOCAL_DEFAULT_SCOPE_ID) return c.json({
+				error: "unmapped_project_local_only",
+				message: "Unmapped projects need a stable path, git remote, or workspace id before assigning a non-local Sharing domain.",
+				guardrail_warnings: analysis.warnings
+			}, 400);
+			const missingConfirmations = missingGuardrailConfirmations(analysis.warnings, confirmedGuardrailTokens);
+			if (missingConfirmations.length > 0) {
+				const missingCodes = [...new Set(missingConfirmations.map((warning) => warning.code))];
+				const missingTokens = [...new Set(missingConfirmations.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0);
+				return c.json({
+					error: "guardrail_confirmation_required",
+					required_guardrails: missingCodes,
+					required_guardrail_tokens: missingTokens,
+					guardrail_warnings: analysis.warnings
+				}, 409);
+			}
+			const mapping = upsertProjectScopeSettingsMapping(store.db, { ...mappingInput });
+			return c.json({
+				ok: true,
+				mapping,
+				guardrail_warnings: analysis.warnings
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
+	});
+	app.delete("/api/sync/sharing-domains/project-mappings/:id", (c) => {
+		const store = getStore();
+		const id = Number(c.req.param("id"));
+		try {
+			const deleted = deleteProjectScopeSettingsMapping(store.db, id);
+			return c.json({
+				ok: true,
+				deleted
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
+	});
 	app.post("/api/sync/peers/identity", async (c) => {
 		const store = getStore();
 		ensureLocalActorRecord(store);