@codemem/server 0.32.2 → 0.33.0-alpha.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isSummaryLikeMemory, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_CAPABILITY_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -1729,7 +1729,7 @@ async function ensureDefaultSpaceForTeam(opts) {
 		remoteUrl: opts.config.syncCoordinatorUrl || null,
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
 	});
-	const [deviceId] = ensureDeviceIdentity(opts.store.db);
+	const [deviceId] = ensureDeviceIdentity(opts.store.db, { keysDir: syncKeysDir() });
 	return {
 		scope,
 		membership: await coordinatorGrantScopeMembershipAction({
@@ -1876,9 +1876,9 @@ function coordinatorAdminMutationStatus(message) {
 }
 function pairingAdvertiseAddresses(config = readCoordinatorSyncConfig()) {
 	const advertise = String(config.syncAdvertise || "auto").trim().toLowerCase();
-	if (advertise && advertise !== "auto" && advertise !== "default") return mergeAddresses([], String(config.syncAdvertise || "").split(",").map((item) => item.trim()).filter(Boolean));
-	if (config.syncHost && config.syncHost !== "0.0.0.0") return [`${config.syncHost}:${config.syncPort}`];
-	const addresses = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => !entry.internal).map((entry) => entry.address).filter((address) => address && address !== "127.0.0.1" && address !== "::1").map((address) => `${address}:${config.syncPort}`);
+	if (advertise && advertise !== "auto" && advertise !== "default") return mergeAddresses([], String(config.syncAdvertise || "").split(",").map((item) => item.trim()).filter(Boolean), { defaultHttpPort: config.syncPort });
+	if (config.syncHost && config.syncHost !== "0.0.0.0") return [normalizeAddress(formatHostPort(config.syncHost, config.syncPort))].filter(Boolean);
+	const addresses = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => !entry.internal).map((entry) => entry.address).filter((address) => address && address !== "127.0.0.1" && address !== "::1").map((address) => normalizeAddress(formatHostPort(address, config.syncPort))).filter(Boolean);
 	return [...new Set(addresses)];
 }
 function resolveCoordinatorAdminGroup(requestedGroup, status) {
@@ -2258,8 +2258,18 @@ function peerAuthorizedScopes(store, peerDeviceId) {
 }
 function ensureLocalActorRecord(store) {
 	const d = drizzle(store.db, { schema });
-	if (d.select({ actor_id: schema.actors.actor_id }).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get()) return;
 	const now = (/* @__PURE__ */ new Date()).toISOString();
+	d.update(schema.actors).set({
+		is_local: 0,
+		updated_at: now
+	}).where(and(eq(schema.actors.is_local, 1), ne(schema.actors.actor_id, store.actorId))).run();
+	if (d.select({ actor_id: schema.actors.actor_id }).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get()) {
+		d.update(schema.actors).set({
+			is_local: 1,
+			updated_at: now
+		}).where(eq(schema.actors.actor_id, store.actorId)).run();
+		return;
+	}
 	d.insert(schema.actors).values({
 		actor_id: store.actorId,
 		display_name: store.actorDisplayName,
@@ -2313,6 +2323,7 @@ function redactCoordinatorStatus(coordinator, showDiag) {
 	const discovered = Array.isArray(coordinator.discovered_devices) ? coordinator.discovered_devices.map((item) => {
 		if (!item || typeof item !== "object") return item;
 		const record = item;
+		const addressCount = Array.isArray(record.addresses) ? record.addresses.length : 0;
 		return {
 			device_id: record.device_id,
 			display_name: record.display_name ?? null,
@@ -2325,7 +2336,8 @@ function redactCoordinatorStatus(coordinator, showDiag) {
 			incoming_reciprocal_request_id: record.incoming_reciprocal_request_id ?? null,
 			outgoing_reciprocal_request_id: record.outgoing_reciprocal_request_id ?? null,
 			fingerprint: null,
-			addresses: []
+			addresses: [],
+			address_count: addressCount
 		};
 	}) : [];
 	return {
@@ -2333,21 +2345,52 @@ function redactCoordinatorStatus(coordinator, showDiag) {
 		discovered_devices: discovered
 	};
 }
+function detailForNotConfiguredReason(reason) {
+	switch (reason) {
+		case "coordinator_url_missing": return "Configure a coordinator URL before pairing with discovered peers.";
+		case "coordinator_groups_empty": return "Join a coordinator team before pairing with discovered peers.";
+		case "sync_disabled": return "Enable sync on this device before pairing with discovered peers.";
+	}
+}
 async function acceptDiscoveredPeer(store, input) {
 	const config = readCoordinatorSyncConfig();
-	if (!config.syncEnabled || !config.syncCoordinatorUrl || config.syncCoordinatorGroups.length === 0) return {
+	let notConfiguredReason = null;
+	if (!config.syncCoordinatorUrl) notConfiguredReason = "coordinator_url_missing";
+	else if (config.syncCoordinatorGroups.length === 0) notConfiguredReason = "coordinator_groups_empty";
+	else if (!config.syncEnabled) notConfiguredReason = "sync_disabled";
+	if (notConfiguredReason) return {
 		ok: false,
 		status: 400,
 		error: "coordinator_not_configured",
-		detail: "Coordinator must be configured before accepting discovered peers."
+		reason: notConfiguredReason,
+		detail: detailForNotConfiguredReason(notConfiguredReason)
+	};
+	const discovered = await lookupCoordinatorPeers(store, config);
+	const inputFingerprint = String(input.fingerprint ?? "").trim();
+	const candidates = discovered.filter((peer) => String(peer.device_id ?? "").trim() === input.peerDeviceId);
+	const matchingCandidates = inputFingerprint ? candidates.filter((peer) => String(peer.fingerprint ?? "").trim() === inputFingerprint) : candidates;
+	const uniqueFingerprints = new Set(matchingCandidates.map((peer) => String(peer.fingerprint ?? "").trim()).filter(Boolean));
+	if (!inputFingerprint && uniqueFingerprints.size > 1) return {
+		ok: false,
+		status: 409,
+		error: "ambiguous_discovered_peer",
+		detail: "That discovered device has multiple coordinator fingerprints. Enable diagnostics, refresh sync status, and choose the intended device before trusting it."
 	};
-	const match = (await lookupCoordinatorPeers(store, config)).find((peer) => String(peer.device_id ?? "").trim() === input.peerDeviceId && String(peer.fingerprint ?? "").trim() === input.fingerprint);
+	const match = matchingCandidates[0];
 	if (!match) return {
 		ok: false,
 		status: 404,
 		error: "discovered_peer_not_found",
 		detail: "That discovered device is no longer available. Refresh sync status and try again."
 	};
+	const expiresAt = String(match.expires_at ?? "").trim();
+	const expired = expiresAt ? Date.parse(expiresAt) <= Date.now() : false;
+	if (match.stale || expired) return {
+		ok: false,
+		status: 409,
+		error: "discovered_peer_stale",
+		detail: "This discovered device's coordinator presence is stale. Wait for it to come online and refresh sync status before trusting it."
+	};
 	const nextFingerprint = String(match.fingerprint ?? "").trim();
 	const nextPublicKey = String(match.public_key ?? "").trim();
 	const nextName = String(match.display_name ?? "").trim() || null;
@@ -2358,7 +2401,14 @@ async function acceptDiscoveredPeer(store, input) {
 		error: "discovered_peer_missing_public_key",
 		detail: "This discovered device is missing its coordinator public key. Refresh sync status and try again."
 	};
+	if (!nextFingerprint || fingerprintPublicKey(nextPublicKey) !== nextFingerprint) return {
+		ok: false,
+		status: 409,
+		error: "discovered_peer_fingerprint_mismatch",
+		detail: "This discovered device's coordinator public key does not match its fingerprint. Refresh sync status or re-enroll the device before trusting it."
+	};
 	const groupIds = Array.isArray(match.groups) ? match.groups.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
+	const freshGroupIds = Array.isArray(match.fresh_groups) ? match.fresh_groups.map((value) => String(value ?? "").trim()).filter(Boolean) : [];
 	let groupId;
 	if (input.expectedGroupId) {
 		if (!groupIds.includes(input.expectedGroupId)) return {
@@ -2367,6 +2417,12 @@ async function acceptDiscoveredPeer(store, input) {
 			error: "peer_not_in_group",
 			detail: "This discovered device is not visible through the specified coordinator group. Refresh sync status and try again."
 		};
+		if (!freshGroupIds.includes(input.expectedGroupId)) return {
+			ok: false,
+			status: 409,
+			error: "discovered_peer_stale",
+			detail: "This discovered device's coordinator presence is stale for the specified group. Wait for it to come online and refresh sync status before trusting it."
+		};
 		groupId = input.expectedGroupId;
 	} else {
 		if (groupIds.length !== 1) return {
@@ -2400,7 +2456,7 @@ async function acceptDiscoveredPeer(store, input) {
 			return [];
 		}
 	})();
-	const addressesJson = JSON.stringify(mergeAddresses(existingAddresses, nextAddresses));
+	const addressesJson = JSON.stringify(mergeAddresses(nextAddresses, existingAddresses));
 	await createCoordinatorReciprocalApproval(store, config, {
 		groupId,
 		requestedDeviceId: input.peerDeviceId
@@ -2502,19 +2558,25 @@ function claimedLocalActorScopeStatus(store, row) {
 * When showDiag is false, sensitive fields (fingerprint, last_error, addresses)
 * are redacted.
 */
-function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer) {
+function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, localDeviceId) {
 	const peerId = String(row.peer_device_id ?? "");
 	const recentOps = recentOpsByPeer?.get(peerId) ?? {
 		in: 0,
 		out: 0
 	};
 	const scopeRejections = scopeRejectionsByPeer?.get(peerId);
+	const addresses = safeJsonList(row.addresses_json);
+	const perScopeSync = listPerPeerScopeSyncState(store.db, {
+		localDeviceId: localDeviceId ?? null,
+		peerDeviceId: peerId
+	});
 	return {
 		peer_device_id: row.peer_device_id,
 		name: row.name,
 		fingerprint: showDiag ? row.pinned_fingerprint : null,
 		pinned: Boolean(row.pinned_fingerprint),
-		addresses: showDiag ? safeJsonList(row.addresses_json) : [],
+		addresses: showDiag ? addresses : [],
+		address_count: addresses.length,
 		last_seen_at: row.last_seen_at,
 		last_sync_at: row.last_sync_at,
 		last_error: showDiag ? row.last_error : null,
@@ -2524,6 +2586,7 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		actor_id: row.actor_id ?? null,
 		actor_display_name: row.actor_display_name ?? null,
 		authorized_scopes: peerAuthorizedScopes(store, peerId),
+		per_scope_sync: perScopeSync,
 		project_scope: { ...currentProjectScope(row, readPeerProjectFilters(store, String(row.peer_device_id ?? ""))) },
 		recent_ops: {
 			in: recentOps.in,
@@ -2538,6 +2601,18 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		discovered_via_group_id: typeof row.discovered_via_group_id === "string" ? row.discovered_via_group_id : null
 	};
 }
+function redactSyncAttemptError(error) {
+	if (!String(error ?? "").trim()) return null;
+	return "sync attempt failed; enable diagnostics for details";
+}
+function mapSyncAttemptRow(row, showDiag, addresses) {
+	return {
+		...row,
+		error: showDiag ? row.error : redactSyncAttemptError(row.error),
+		status: attemptStatus(row),
+		address: showDiag && addresses?.length ? addresses[0] : null
+	};
+}
 var SYNC_SCOPE_REJECTION_WINDOW_SECONDS = 1440 * 60;
 function recentScopeRejectionsByPeer(store) {
 	const cutoff = (/* @__PURE__ */ new Date(Date.now() - SYNC_SCOPE_REJECTION_WINDOW_SECONDS * 1e3)).toISOString();
@@ -2853,6 +2928,20 @@ var PEERS_QUERY = `
 	ORDER BY name, peer_device_id
 `;
 /**
+* Compute the negotiated sync capability for a request by combining the
+* server's local capability with the value the caller advertised in the
+* `X-Codemem-Sync-Capability` header. Routes use this to decide whether to
+* honor scoped-sync wire features such as explicit `scope_id` parameters
+* and `/v1/status` `authorized_scopes` enumeration.
+*
+* Unsigned headers are fine here: the server is computing what it is
+* willing to do, not granting access. Per-scope authorization is enforced
+* separately via the membership cache when a scope_id is actually used.
+*/
+function negotiatedSyncCapability(c) {
+	return negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(c.req.header(SYNC_CAPABILITY_HEADER) ?? null));
+}
+/**
 * Peer-to-peer sync protocol routes (/v1/*).
 *
 * These are mounted on the sync listener (0.0.0.0:7337) and are
@@ -2895,22 +2984,31 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				if (bootstrapAttempted) {
+					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
+				}
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
 			try {
 				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				const syncReset = getSyncResetState(store.db);
-				return c.json({
+				const authorizedScopes = isScopedSyncCapability(negotiatedSyncCapability(c)) ? listAuthorizedScopesForPeer(store.db, {
+					localDeviceId: deviceId,
+					peerDeviceId: auth.deviceId
+				}) : null;
+				const response = {
 					device_id: deviceId,
 					protocol_version: SYNC_PROTOCOL_VERSION,
 					fingerprint,
 					sync_reset: addSyncScopeToBoundary(syncReset, null),
 					sync_capability: LOCAL_SYNC_CAPABILITY
-				});
+				};
+				if (authorizedScopes !== null) response.authorized_scopes = authorizedScopes;
+				return c.json(response);
 			} catch {
 				return c.json({ error: "internal_error" }, 500);
 			}
@@ -2920,14 +3018,21 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
 		try {
 			const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
-			const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0);
-			if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY), 409);
+			const negotiated = negotiatedSyncCapability(c);
+			const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+			const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
+				db: store.db,
+				localDeviceId,
+				negotiatedCapability: negotiated,
+				peerDeviceId
+			});
+			if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
 			const since = c.req.query("since") ?? null;
 			const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
 			const rawGeneration = c.req.query("generation");
@@ -2935,14 +3040,14 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			const snapshotId = c.req.query("snapshot_id") ?? null;
 			const baselineCursor = c.req.query("baseline_cursor") ?? null;
 			const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 1e3)) : 200;
-			const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 			const result = loadReplicationOpsForPeer(store.db, {
 				since,
 				limit,
 				deviceId: localDeviceId,
 				generation: Number.isFinite(generation) ? generation : null,
 				snapshotId,
-				baselineCursor
+				baselineCursor,
+				scopeId: scopeRequest.mode === "scoped" ? scopeRequest.scope_id : void 0
 			});
 			if (result.reset_required) return c.json({
 				error: "reset_required",
@@ -2990,16 +3095,26 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant=${(c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()} path=${c.req.path}`);
+				if (bootstrapAttempted) {
+					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
+				}
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason), 401);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
 			try {
 				const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
-				const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0);
-				if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY), 409);
+				const negotiated = negotiatedSyncCapability(c);
+				const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+				const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
+					db: store.db,
+					localDeviceId,
+					negotiatedCapability: negotiated,
+					peerDeviceId: auth.deviceId
+				});
+				if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
 				const rawGeneration = c.req.query("generation");
 				const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
 				const snapshotId = c.req.query("snapshot_id") ?? null;
@@ -3015,7 +3130,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 					baselineCursor,
 					pageToken,
 					limit,
-					peerDeviceId: auth.deviceId
+					peerDeviceId: auth.deviceId,
+					scopeId: scopeRequest.mode === "scoped" ? scopeRequest.scope_id : void 0
 				});
 				return c.json({
 					scope_id: scopeRequest.scope_id,
@@ -3041,7 +3157,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -3053,8 +3169,15 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		} catch {
 			return c.json({ error: "invalid_json" }, 400);
 		}
-		const scopeRequest = parseSyncScopeRequest(body.scope_id, Object.hasOwn(body, "scope_id"));
-		if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY), 409);
+		const negotiated = negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(body.sync_capability));
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const scopeRequest = parseSyncScopeRequest(body.scope_id, Object.hasOwn(body, "scope_id"), {
+			db: store.db,
+			localDeviceId,
+			negotiatedCapability: negotiated,
+			peerDeviceId
+		});
+		if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
 		if (!Array.isArray(body.ops)) return c.json({ error: "invalid_ops" }, 400);
 		if (body.ops.length > MAX_SYNC_OPS) return c.json({ error: "too_many_ops" }, 413);
 		const normalizedOps = extractReplicationOps(body);
@@ -3063,11 +3186,9 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			reason: "device_id_mismatch",
 			op_id: op.op_id
 		}, 400);
-		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-		const negotiatedCapability = negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(body.sync_capability));
 		const filtered = filterOpsForPeer(store, peerDeviceId, localDeviceId, normalizedOps, { applyScopeFilter: false });
 		const rejected = rejectInboundScopeFailures(store.db, normalizedOps, localDeviceId, {
-			enabled: negotiatedCapability !== "unsupported",
+			enabled: negotiated !== "unsupported",
 			peerDeviceId
 		});
 		if (rejected) return c.json({
@@ -3191,7 +3312,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const recentOpsByPeer = traceSync("recentPeerOps", () => recentPeerOps(store));
 			const scopeRejectionsByPeer = traceSync("recentScopeRejectionsByPeer", () => recentScopeRejectionsByPeer(store));
 			const peersItems = peerRows.map((row) => {
-				const peer = mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer);
+				const peer = mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, deviceRow?.device_id ?? null);
 				peer.status = peerStatus(peer);
 				return peer;
 			});
@@ -3215,14 +3336,9 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				if (addrs.length) peerAddressMap.set(String(peerRow.peer_device_id ?? ""), addrs);
 			});
 			const attemptsItems = attemptRows.map((row) => {
-				const addrs = showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0;
-				return {
-					...row,
-					status: attemptStatus(row),
-					address: addrs?.length ? addrs[0] : null
-				};
+				return mapSyncAttemptRow(row, showDiag, showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0);
 			});
-			const latestAttemptError = String(attemptsItems[0]?.error || "").trim();
+			const latestAttemptError = String(attemptRows[0]?.error || "").trim();
 			const statusBlock = {
 				...statusPayload,
 				background_maintenance: summarizeMaintenanceJobs(listMaintenanceJobs(store.db), showDiag),
@@ -3282,7 +3398,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const rows = store.db.prepare(PEERS_QUERY).all();
 			const recentOpsByPeer = recentPeerOps(store);
 			const scopeRejectionsByPeer = recentScopeRejectionsByPeer(store);
-			const peers = rows.map((row) => mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer));
+			const localDeviceId = drizzle(store.db, { schema }).select({ device_id: schema.syncDevice.device_id }).from(schema.syncDevice).limit(1).get()?.device_id ?? null;
+			const peers = rows.map((row) => mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, localDeviceId));
 			return c.json({
 				items: peers,
 				redacted: !showDiag
@@ -3348,7 +3465,12 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				peer_sync_capability: schema.syncAttempts.peer_sync_capability,
 				negotiated_sync_capability: schema.syncAttempts.negotiated_sync_capability
 			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(limit).all();
-			return c.json({ items: rows });
+			const showDiag = queryBool(c.req.query("includeDiagnostics"));
+			const items = rows.map((row) => mapSyncAttemptRow(row, showDiag));
+			return c.json({
+				items,
+				redacted: !showDiag
+			});
 		}
 	});
 	app.get("/api/sync/pairing", (c) => {
@@ -3356,19 +3478,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		{
 			const config = readCoordinatorSyncConfig();
 			const d = drizzle(store.db, { schema });
-			const deviceRow = d.select({
-				device_id: schema.syncDevice.device_id,
-				public_key: schema.syncDevice.public_key,
-				fingerprint: schema.syncDevice.fingerprint
-			}).from(schema.syncDevice).limit(1).get();
 			let deviceId;
 			let publicKey;
 			let fingerprint;
-			if (deviceRow) {
-				deviceId = String(deviceRow.device_id);
-				publicKey = String(deviceRow.public_key);
-				fingerprint = String(deviceRow.fingerprint);
-			} else try {
+			try {
 				const [id, fp] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				deviceId = id;
 				fingerprint = fp;
@@ -3829,15 +3942,15 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const peerDeviceId = String(body.peer_device_id ?? "").trim();
 		const fingerprint = String(body.fingerprint ?? "").trim();
 		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
-		if (!fingerprint) return c.json({ error: "fingerprint required" }, 400);
 		try {
 			const result = await acceptDiscoveredPeer(store, {
 				peerDeviceId,
-				fingerprint
+				fingerprint: fingerprint || void 0
 			});
 			if (!result.ok) return c.json({
 				error: result.error,
-				detail: result.detail
+				detail: result.detail,
+				...result.reason ? { reason: result.reason } : {}
 			}, { status: result.status });
 			return c.json({
 				ok: true,
@@ -3898,9 +4011,16 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		const pairingResult = tryParsePairingPayload(rawValue.match(/echo\s+['"]([A-Za-z0-9+/=]+)['"]\s*\|\s*base64\s+-d\s*\|\s*codemem/)?.[1]?.trim() || rawValue);
 		if (pairingResult?.kind === "invalid-pair") return c.json({ error: pairingResult.error }, 400);
 		if (pairingResult?.kind === "pair") try {
+			const existing = drizzle(store.db, { schema }).select({ pinned_fingerprint: schema.syncPeers.pinned_fingerprint }).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, pairingResult.device_id)).get();
+			const existingFingerprint = String(existing?.pinned_fingerprint ?? "").trim();
+			if (existingFingerprint && existingFingerprint !== pairingResult.fingerprint) return c.json({
+				error: "peer_conflict",
+				detail: "Pairing payload conflicts with the existing trusted fingerprint for this device. Remove or repair the old peer before accepting this pairing payload."
+			}, 409);
 			updatePeerAddresses(store.db, pairingResult.device_id, pairingResult.addresses, {
 				pinnedFingerprint: pairingResult.fingerprint,
-				publicKey: pairingResult.public_key
+				publicKey: pairingResult.public_key,
+				replaceTrust: true
 			});
 			return c.json({
 				ok: true,
@@ -4866,9 +4986,11 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const peerDeviceId = String(body.peer_device_id ?? "").trim();
 			const publicKey = String(body.peer_public_key ?? "").trim();
 			const name = String(body.name ?? "").trim() || null;
-			const fingerprint = String(body.fingerprint ?? "").trim() || null;
-			const addresses = (Array.isArray(body.peer_addresses) ? body.peer_addresses : []).map((item) => String(item ?? "").trim()).filter((item) => item.length > 0);
+			const requestedFingerprint = String(body.fingerprint ?? "").trim();
+			const addresses = mergeAddresses([], (Array.isArray(body.peer_addresses) ? body.peer_addresses : []).map((item) => String(item ?? "").trim()).filter((item) => item.length > 0));
 			if (!peerDeviceId || !publicKey) return c.json({ error: "peer_device_id_and_public_key_required" }, 400);
+			const fingerprint = requestedFingerprint || fingerprintPublicKey(publicKey);
+			if (fingerprintPublicKey(publicKey) !== fingerprint) return c.json({ error: "fingerprint_mismatch" }, 400);
 			const manualInclude = overrideInclude && overrideInclude.length > 0 ? JSON.stringify(overrideInclude) : null;
 			const manualExclude = overrideExclude && overrideExclude.length > 0 ? JSON.stringify(overrideExclude) : null;
 			const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -4928,7 +5050,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			if (result.ok) return c.json(result);
 			return c.json({
 				error: result.error,
-				detail: result.detail
+				detail: result.detail,
+				...result.reason ? { reason: result.reason } : {}
 			}, result.status);
 		} catch (error) {
 			return c.json({