@codemem/server 0.32.1 → 0.32.3

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -1729,7 +1729,7 @@ async function ensureDefaultSpaceForTeam(opts) {
 		remoteUrl: opts.config.syncCoordinatorUrl || null,
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
 	});
-	const [deviceId] = ensureDeviceIdentity(opts.store.db);
+	const [deviceId] = ensureDeviceIdentity(opts.store.db, { keysDir: syncKeysDir() });
 	return {
 		scope,
 		membership: await coordinatorGrantScopeMembershipAction({
@@ -1876,9 +1876,9 @@ function coordinatorAdminMutationStatus(message) {
 }
 function pairingAdvertiseAddresses(config = readCoordinatorSyncConfig()) {
 	const advertise = String(config.syncAdvertise || "auto").trim().toLowerCase();
-	if (advertise && advertise !== "auto" && advertise !== "default") return mergeAddresses([], String(config.syncAdvertise || "").split(",").map((item) => item.trim()).filter(Boolean));
-	if (config.syncHost && config.syncHost !== "0.0.0.0") return [`${config.syncHost}:${config.syncPort}`];
-	const addresses = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => !entry.internal).map((entry) => entry.address).filter((address) => address && address !== "127.0.0.1" && address !== "::1").map((address) => `${address}:${config.syncPort}`);
+	if (advertise && advertise !== "auto" && advertise !== "default") return mergeAddresses([], String(config.syncAdvertise || "").split(",").map((item) => item.trim()).filter(Boolean), { defaultHttpPort: config.syncPort });
+	if (config.syncHost && config.syncHost !== "0.0.0.0") return [normalizeAddress(formatHostPort(config.syncHost, config.syncPort))].filter(Boolean);
+	const addresses = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => !entry.internal).map((entry) => entry.address).filter((address) => address && address !== "127.0.0.1" && address !== "::1").map((address) => normalizeAddress(formatHostPort(address, config.syncPort))).filter(Boolean);
 	return [...new Set(addresses)];
 }
 function resolveCoordinatorAdminGroup(requestedGroup, status) {
@@ -2313,6 +2313,7 @@ function redactCoordinatorStatus(coordinator, showDiag) {
 	const discovered = Array.isArray(coordinator.discovered_devices) ? coordinator.discovered_devices.map((item) => {
 		if (!item || typeof item !== "object") return item;
 		const record = item;
+		const addressCount = Array.isArray(record.addresses) ? record.addresses.length : 0;
 		return {
 			device_id: record.device_id,
 			display_name: record.display_name ?? null,
@@ -2325,7 +2326,8 @@ function redactCoordinatorStatus(coordinator, showDiag) {
 			incoming_reciprocal_request_id: record.incoming_reciprocal_request_id ?? null,
 			outgoing_reciprocal_request_id: record.outgoing_reciprocal_request_id ?? null,
 			fingerprint: null,
-			addresses: []
+			addresses: [],
+			address_count: addressCount
 		};
 	}) : [];
 	return {
@@ -2341,13 +2343,32 @@ async function acceptDiscoveredPeer(store, input) {
 		error: "coordinator_not_configured",
 		detail: "Coordinator must be configured before accepting discovered peers."
 	};
-	const match = (await lookupCoordinatorPeers(store, config)).find((peer) => String(peer.device_id ?? "").trim() === input.peerDeviceId && String(peer.fingerprint ?? "").trim() === input.fingerprint);
+	const discovered = await lookupCoordinatorPeers(store, config);
+	const inputFingerprint = String(input.fingerprint ?? "").trim();
+	const candidates = discovered.filter((peer) => String(peer.device_id ?? "").trim() === input.peerDeviceId);
+	const matchingCandidates = inputFingerprint ? candidates.filter((peer) => String(peer.fingerprint ?? "").trim() === inputFingerprint) : candidates;
+	const uniqueFingerprints = new Set(matchingCandidates.map((peer) => String(peer.fingerprint ?? "").trim()).filter(Boolean));
+	if (!inputFingerprint && uniqueFingerprints.size > 1) return {
+		ok: false,
+		status: 409,
+		error: "ambiguous_discovered_peer",
+		detail: "That discovered device has multiple coordinator fingerprints. Enable diagnostics, refresh sync status, and choose the intended device before trusting it."
+	};
+	const match = matchingCandidates[0];
 	if (!match) return {
 		ok: false,
 		status: 404,
 		error: "discovered_peer_not_found",
 		detail: "That discovered device is no longer available. Refresh sync status and try again."
 	};
+	const expiresAt = String(match.expires_at ?? "").trim();
+	const expired = expiresAt ? Date.parse(expiresAt) <= Date.now() : false;
+	if (match.stale || expired) return {
+		ok: false,
+		status: 409,
+		error: "discovered_peer_stale",
+		detail: "This discovered device's coordinator presence is stale. Wait for it to come online and refresh sync status before trusting it."
+	};
 	const nextFingerprint = String(match.fingerprint ?? "").trim();
 	const nextPublicKey = String(match.public_key ?? "").trim();
 	const nextName = String(match.display_name ?? "").trim() || null;
@@ -2358,7 +2379,14 @@ async function acceptDiscoveredPeer(store, input) {
 		error: "discovered_peer_missing_public_key",
 		detail: "This discovered device is missing its coordinator public key. Refresh sync status and try again."
 	};
+	if (!nextFingerprint || fingerprintPublicKey(nextPublicKey) !== nextFingerprint) return {
+		ok: false,
+		status: 409,
+		error: "discovered_peer_fingerprint_mismatch",
+		detail: "This discovered device's coordinator public key does not match its fingerprint. Refresh sync status or re-enroll the device before trusting it."
+	};
 	const groupIds = Array.isArray(match.groups) ? match.groups.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
+	const freshGroupIds = Array.isArray(match.fresh_groups) ? match.fresh_groups.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
 	let groupId;
 	if (input.expectedGroupId) {
 		if (!groupIds.includes(input.expectedGroupId)) return {
@@ -2367,6 +2395,12 @@ async function acceptDiscoveredPeer(store, input) {
 			error: "peer_not_in_group",
 			detail: "This discovered device is not visible through the specified coordinator group. Refresh sync status and try again."
 		};
+		if (!freshGroupIds.includes(input.expectedGroupId)) return {
+			ok: false,
+			status: 409,
+			error: "discovered_peer_stale",
+			detail: "This discovered device's coordinator presence is stale for the specified group. Wait for it to come online and refresh sync status before trusting it."
+		};
 		groupId = input.expectedGroupId;
 	} else {
 		if (groupIds.length !== 1) return {
@@ -2400,7 +2434,7 @@ async function acceptDiscoveredPeer(store, input) {
 			return [];
 		}
 	})();
-	const addressesJson = JSON.stringify(mergeAddresses(existingAddresses, nextAddresses));
+	const addressesJson = JSON.stringify(mergeAddresses(nextAddresses, existingAddresses));
 	await createCoordinatorReciprocalApproval(store, config, {
 		groupId,
 		requestedDeviceId: input.peerDeviceId
@@ -2509,12 +2543,14 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		out: 0
 	};
 	const scopeRejections = scopeRejectionsByPeer?.get(peerId);
+	const addresses = safeJsonList(row.addresses_json);
 	return {
 		peer_device_id: row.peer_device_id,
 		name: row.name,
 		fingerprint: showDiag ? row.pinned_fingerprint : null,
 		pinned: Boolean(row.pinned_fingerprint),
-		addresses: showDiag ? safeJsonList(row.addresses_json) : [],
+		addresses: showDiag ? addresses : [],
+		address_count: addresses.length,
 		last_seen_at: row.last_seen_at,
 		last_sync_at: row.last_sync_at,
 		last_error: showDiag ? row.last_error : null,
@@ -2538,6 +2574,18 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		discovered_via_group_id: typeof row.discovered_via_group_id === "string" ? row.discovered_via_group_id : null
 	};
 }
+function redactSyncAttemptError(error) {
+	if (!String(error ?? "").trim()) return null;
+	return "sync attempt failed; enable diagnostics for details";
+}
+function mapSyncAttemptRow(row, showDiag, addresses) {
+	return {
+		...row,
+		error: showDiag ? row.error : redactSyncAttemptError(row.error),
+		status: attemptStatus(row),
+		address: showDiag && addresses?.length ? addresses[0] : null
+	};
+}
 var SYNC_SCOPE_REJECTION_WINDOW_SECONDS = 1440 * 60;
 function recentScopeRejectionsByPeer(store) {
 	const cutoff = (/* @__PURE__ */ new Date(Date.now() - SYNC_SCOPE_REJECTION_WINDOW_SECONDS * 1e3)).toISOString();
@@ -2895,9 +2943,12 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				if (bootstrapAttempted) {
+					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
+				}
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
@@ -2920,7 +2971,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -2990,9 +3041,12 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				if (bootstrapAttempted) {
+					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
+				}
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
@@ -3041,7 +3095,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -3215,14 +3269,9 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				if (addrs.length) peerAddressMap.set(String(peerRow.peer_device_id ?? ""), addrs);
 			});
 			const attemptsItems = attemptRows.map((row) => {
-				const addrs = showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0;
-				return {
-					...row,
-					status: attemptStatus(row),
-					address: addrs?.length ? addrs[0] : null
-				};
+				return mapSyncAttemptRow(row, showDiag, showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0);
 			});
-			const latestAttemptError = String(attemptsItems[0]?.error || "").trim();
+			const latestAttemptError = String(attemptRows[0]?.error || "").trim();
 			const statusBlock = {
 				...statusPayload,
 				background_maintenance: summarizeMaintenanceJobs(listMaintenanceJobs(store.db), showDiag),
@@ -3348,7 +3397,12 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				peer_sync_capability: schema.syncAttempts.peer_sync_capability,
 				negotiated_sync_capability: schema.syncAttempts.negotiated_sync_capability
 			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(limit).all();
-			return c.json({ items: rows });
+			const showDiag = queryBool(c.req.query("includeDiagnostics"));
+			const items = rows.map((row) => mapSyncAttemptRow(row, showDiag));
+			return c.json({
+				items,
+				redacted: !showDiag
+			});
 		}
 	});
 	app.get("/api/sync/pairing", (c) => {
@@ -3356,19 +3410,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		{
 			const config = readCoordinatorSyncConfig();
 			const d = drizzle(store.db, { schema });
-			const deviceRow = d.select({
-				device_id: schema.syncDevice.device_id,
-				public_key: schema.syncDevice.public_key,
-				fingerprint: schema.syncDevice.fingerprint
-			}).from(schema.syncDevice).limit(1).get();
 			let deviceId;
 			let publicKey;
 			let fingerprint;
-			if (deviceRow) {
-				deviceId = String(deviceRow.device_id);
-				publicKey = String(deviceRow.public_key);
-				fingerprint = String(deviceRow.fingerprint);
-			} else try {
+			try {
 				const [id, fp] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				deviceId = id;
 				fingerprint = fp;
@@ -3829,11 +3874,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const peerDeviceId = String(body.peer_device_id ?? "").trim();
 		const fingerprint = String(body.fingerprint ?? "").trim();
 		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
-		if (!fingerprint) return c.json({ error: "fingerprint required" }, 400);
 		try {
 			const result = await acceptDiscoveredPeer(store, {
 				peerDeviceId,
-				fingerprint
+				fingerprint: fingerprint || void 0
 			});
 			if (!result.ok) return c.json({
 				error: result.error,
@@ -3898,9 +3942,16 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const pairingResult = tryParsePairingPayload(rawValue.match(/echo\s+['"]([A-Za-z0-9+/=]+)['"]\s*\|\s*base64\s+-d\s*\|\s*codemem/)?.[1]?.trim() || rawValue);
 		if (pairingResult?.kind === "invalid-pair") return c.json({ error: pairingResult.error }, 400);
 		if (pairingResult?.kind === "pair") try {
+			const existing = drizzle(store.db, { schema }).select({ pinned_fingerprint: schema.syncPeers.pinned_fingerprint }).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, pairingResult.device_id)).get();
+			const existingFingerprint = String(existing?.pinned_fingerprint ?? "").trim();
+			if (existingFingerprint && existingFingerprint !== pairingResult.fingerprint) return c.json({
+				error: "peer_conflict",
+				detail: "Pairing payload conflicts with the existing trusted fingerprint for this device. Remove or repair the old peer before accepting this pairing payload."
+			}, 409);
 			updatePeerAddresses(store.db, pairingResult.device_id, pairingResult.addresses, {
 				pinnedFingerprint: pairingResult.fingerprint,
-				publicKey: pairingResult.public_key
+				publicKey: pairingResult.public_key,
+				replaceTrust: true
 			});
 			return c.json({
 				ok: true,
@@ -4866,9 +4917,11 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const peerDeviceId = String(body.peer_device_id ?? "").trim();
 			const publicKey = String(body.peer_public_key ?? "").trim();
 			const name = String(body.name ?? "").trim() || null;
-			const fingerprint = String(body.fingerprint ?? "").trim() || null;
-			const addresses = (Array.isArray(body.peer_addresses) ? body.peer_addresses : []).map((item) => String(item ?? "").trim()).filter((item) => item.length > 0);
+			const requestedFingerprint = String(body.fingerprint ?? "").trim();
+			const addresses = mergeAddresses([], (Array.isArray(body.peer_addresses) ? body.peer_addresses : []).map((item) => String(item ?? "").trim()).filter((item) => item.length > 0));
 			if (!peerDeviceId || !publicKey) return c.json({ error: "peer_device_id_and_public_key_required" }, 400);
+			const fingerprint = requestedFingerprint || fingerprintPublicKey(publicKey);
+			if (fingerprintPublicKey(publicKey) !== fingerprint) return c.json({ error: "fingerprint_mismatch" }, 400);
 			const manualInclude = overrideInclude && overrideInclude.length > 0 ? JSON.stringify(overrideInclude) : null;
 			const manualExclude = overrideExclude && overrideExclude.length > 0 ? JSON.stringify(overrideExclude) : null;
 			const now = (/* @__PURE__ */ new Date()).toISOString();