@codemem/server 0.39.1 → 0.40.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, MemoryStore, SYNC_CAPABILITY_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coordinatorArchiveGroupAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, createCoordinatorReciprocalApproval, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getSemanticIndexDiagnostics, getSyncResetState, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, parseStrictInteger, parseSyncScopeRequest, personalScopeGrantStatusForPeer, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recordNonce, rejectInboundScopeFailures, requestJson, resolveDbPath, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -8,7 +8,7 @@ import { RateLimiter } from "limiter";
 import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { createHash, randomUUID } from "node:crypto";
-import { networkInterfaces } from "node:os";
+import { hostname, networkInterfaces } from "node:os";
 //#region src/middleware.ts
 var LOOPBACK_HOSTS = new Set([
 	"127.0.0.1",
@@ -164,7 +164,11 @@ function createInMemoryRequestRateLimiter(windowMs = 6e4) {
 * codemem/viewer_routes/config.py, scoped to the TS runtime's current needs.
 */
 var REDACTED_VALUE = "[redacted]";
-var RUNTIMES = new Set(["api_http", "claude_sidecar"]);
+var RUNTIMES = new Set([
+	"api_http",
+	"claude_sidecar",
+	"codex_sidecar"
+]);
 var AUTH_SOURCES = new Set([
 	"auto",
 	"env",
@@ -175,6 +179,7 @@ var AUTH_SOURCES = new Set([
 var HOT_RELOAD_KEYS = new Set(["raw_events_sweeper_interval_s"]);
 var PROTECTED_WRITE_KEYS = new Set([
 	"claude_command",
+	"codex_command",
 	"observer_base_url",
 	"observer_auth_file",
 	"observer_auth_command",
@@ -190,12 +195,15 @@ var SECRET_CONFIG_KEYS = new Set([
 var REMOVED_CONFIG_KEYS = new Set(["observer_rich_openai_use_responses"]);
 var ALLOWED_KEYS = [
 	"claude_command",
+	"codex_command",
 	"observer_base_url",
 	"observer_provider",
 	"observer_model",
 	"observer_tier_routing_enabled",
 	"observer_simple_model",
 	"observer_simple_temperature",
+	"observer_reasoning_effort",
+	"observer_reasoning_summary",
 	"observer_rich_model",
 	"observer_rich_temperature",
 	"observer_rich_reasoning_effort",
@@ -227,6 +235,7 @@ var ALLOWED_KEYS = [
 ];
 var DEFAULTS = {
 	claude_command: ["claude"],
+	codex_command: ["codex"],
 	observer_runtime: "api_http",
 	observer_auth_source: "auto",
 	observer_tier_routing_enabled: false,
@@ -262,9 +271,12 @@ function getEffectiveConfig(configData) {
 		...DEFAULTS,
 		...configData
 	};
+	for (const key of ["claude_command", "codex_command"]) effective[key] = coerceObserverCommand(effective[key]) ?? DEFAULTS[key];
 	for (const [key, envVar] of Object.entries(CODEMEM_CONFIG_ENV_OVERRIDES)) {
 		const val = process.env[envVar];
-		if (val != null && val !== "") effective[key] = val;
+		if (val == null || val === "") continue;
+		if (key === "claude_command" || key === "codex_command") effective[key] = coerceObserverCommand(val) ?? effective[key];
+		else effective[key] = val;
 	}
 	return effective;
 }
@@ -358,7 +370,7 @@ function validateAndApplyUpdate(configData, key, value, providers) {
 	if (key === "observer_runtime") {
 		if (typeof value !== "string") return "observer_runtime must be string";
 		const runtime = value.trim().toLowerCase();
-		if (!RUNTIMES.has(runtime)) return "observer_runtime must be one of: api_http, claude_sidecar";
+		if (!RUNTIMES.has(runtime)) return "observer_runtime must be one of: api_http, claude_sidecar, codex_sidecar";
 		configData[key] = runtime;
 		return null;
 	}
@@ -369,7 +381,7 @@ function validateAndApplyUpdate(configData, key, value, providers) {
 		configData[key] = source;
 		return null;
 	}
-	if (key === "claude_command" || key === "observer_auth_command") {
+	if (key === "claude_command" || key === "codex_command" || key === "observer_auth_command") {
 		const argv = asExecutableArgv(value);
 		if (argv == null) return `${key} must be string array`;
 		if (argv.length > 0) configData[key] = argv;
@@ -393,7 +405,7 @@ function validateAndApplyUpdate(configData, key, value, providers) {
 		configData[key] = value;
 		return null;
 	}
-	if (key === "observer_base_url" || key === "observer_model" || key === "observer_simple_model" || key === "observer_rich_model" || key === "observer_rich_reasoning_effort" || key === "observer_rich_reasoning_summary" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
+	if (key === "observer_base_url" || key === "observer_model" || key === "observer_simple_model" || key === "observer_reasoning_effort" || key === "observer_reasoning_summary" || key === "observer_rich_model" || key === "observer_rich_reasoning_effort" || key === "observer_rich_reasoning_summary" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
 		if (typeof value !== "string") return `${key} must be string`;
 		const trimmed = value.trim();
 		if (!trimmed) delete configData[key];
@@ -471,7 +483,7 @@ function configRoutes(opts = {}) {
 		}
 		const afterEffective = getEffectiveConfig(nextConfig);
 		const savedChangedKeys = ALLOWED_KEYS.filter((key) => beforeConfig[key] !== nextConfig[key]);
-		const effectiveChangedKeys = ALLOWED_KEYS.filter((key) => beforeEffective[key] !== afterEffective[key]);
+		const effectiveChangedKeys = ALLOWED_KEYS.filter((key) => !configValuesEqual(beforeEffective[key], afterEffective[key]));
 		const envOverrides = getCodememEnvOverrides();
 		const ignoredByEnvKeys = savedChangedKeys.filter((key) => !effectiveChangedKeys.includes(key) && key in envOverrides);
 		const hotReloadedKeys = applyRuntimeEffects([...new Set([
@@ -1819,6 +1831,7 @@ async function ensureDefaultSpaceForTeam(opts) {
 	return {
 		scope,
 		membership: await coordinatorGrantScopeMembershipAction({
+			effectId: `team-default-grant:${opts.groupId}:${scopeId}:${deviceId}:1`,
 			groupId: opts.groupId,
 			scopeId,
 			deviceId,
@@ -1851,6 +1864,7 @@ async function maybeGrantDefaultSpaceOnJoin(opts) {
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
 	})).find((scope) => scope.scope_id === scopeId) ?? null)?.kind !== "team_default") return null;
 	return await coordinatorGrantScopeMembershipAction({
+		effectId: `team-default-join:${opts.requestId}:${scopeId}:${opts.deviceId}:1`,
 		groupId: opts.groupId,
 		scopeId,
 		deviceId: opts.deviceId,
@@ -1892,6 +1906,30 @@ function coordinatorAdminUnavailable(status) {
 	};
 	return null;
 }
+function recipientInviteCreationUnavailable(status, kind) {
+	if (status.readiness === "not_configured") return {
+		body: {
+			error: "coordinator_not_configured",
+			status
+		},
+		httpStatus: 400
+	};
+	if (!status.has_groups) return {
+		body: {
+			error: "coordinator_group_missing",
+			status
+		},
+		httpStatus: 400
+	};
+	if (kind === "team_member" && !status.has_admin_secret) return {
+		body: {
+			error: "coordinator_admin_secret_missing",
+			status
+		},
+		httpStatus: 400
+	};
+	return null;
+}
 async function parseViewerJsonBody(c, options = {}) {
 	const raw = await c.req.text();
 	if (!raw.trim()) return options.allowEmpty ? {} : null;
@@ -1929,6 +1967,21 @@ function optionalViewerNumber(body, key) {
 	const number = typeof value === "number" ? value : Number(value);
 	return Number.isFinite(number) ? Math.trunc(number) : NaN;
 }
+function coordinatorAdminMembershipEffectId(action, attemptId, input) {
+	return `viewer-admin-membership:${action}:${createHash("sha256").update(JSON.stringify({
+		action,
+		attemptId,
+		groupId: input.groupId,
+		scopeId: input.scopeId,
+		deviceId: input.deviceId,
+		role: input.role ?? null,
+		membershipEpoch: input.membershipEpoch,
+		coordinatorId: input.coordinatorId ?? null,
+		manifestIssuerDeviceId: input.manifestIssuerDeviceId ?? null,
+		manifestHash: input.manifestHash,
+		signedManifestJson: input.signedManifestJson
+	})).digest("hex")}`;
+}
 function optionalViewerInteger(body, key) {
 	const value = body[key];
 	if (value == null || value === "") return null;
@@ -1955,7 +2008,7 @@ function parseViewerProjectMappingInput(body) {
 }
 function coordinatorAdminMutationStatus(message) {
 	if (message.includes("scope_not_found") || message.includes("membership_not_found") || message.includes("group_not_found") || message.includes("Group not found") || message.includes("Scope not found") || message.includes("device_not_enrolled_for_scope_group") || message.includes("device must be enrolled")) return 404;
-	if (message.includes("not active") || message.includes("scope_not_active") || message.includes("group_archived") || message.includes("Group is archived")) return 409;
+	if (message.includes("not active") || message.includes("scope_not_active") || message.includes("scope_membership_effect_conflict") || message.includes("group_archived") || message.includes("Group is archived")) return 409;
 	if (message.includes("Remote coordinator request failed (5") || message.includes("fetch failed") || message.includes("network") || message.includes("timed out")) return 502;
 	return 400;
 }
@@ -1976,6 +2029,1141 @@ function parseInviteTtlHours(value) {
 	if (!Number.isInteger(ttlHours) || ttlHours < 1) return null;
 	return ttlHours;
 }
+function projectInviteAcceptanceFailure(error) {
+	if (isProjectSyncEnablementError(error)) return {
+		error: error.code,
+		detail: error.detail
+	};
+	const code = error instanceof Error ? error.message : "project_invite_acceptance_failed";
+	const detailByCode = {
+		invite_already_bound: "This invitation was accepted by another device. Ask the owner to create a new invitation.",
+		invite_expired: "This invitation expired. Ask the owner to create a new invitation.",
+		invite_identity_conflict: "This invitation does not match this Identity. Ask the owner to create a new invitation for this recipient.",
+		invite_invalid: "This invitation is no longer valid. Ask the owner to create a new invitation.",
+		inviter_identity_invalid: "The owner's device identity could not be verified. Ask the owner to review the share and create a new invitation.",
+		project_invite_self_acceptance_forbidden: "The owner cannot accept this recipient invitation on the owner's device.",
+		project_invite_bootstrap_incomplete: "The owner's device is not ready to establish trust yet. Retry once, then ask the owner to review the share.",
+		project_invite_trust_state_invalid: "The owner's trust setup could not be verified. Ask the owner to review the share."
+	};
+	return {
+		error: Object.hasOwn(detailByCode, code) ? code : "project_invite_acceptance_failed",
+		detail: detailByCode[code] ?? "The invitation could not be accepted safely. Retry once, then ask the owner to review the share."
+	};
+}
+var PROJECT_INVITE_TTL_HOURS = 168;
+var PROJECT_INVITE_BODY_KEYS = new Set([
+	"teammate_name",
+	"project_ids",
+	"reviewed_project_set_digest"
+]);
+function projectInviteStringList(body, key) {
+	const value = body[key];
+	if (!Array.isArray(value)) throw new Error(`${key}_must_be_string_array`);
+	if (value.length > 100) throw new Error(`${key}_too_large`);
+	const items = value.map((item) => {
+		if (typeof item !== "string") throw new Error(`${key}_must_be_string_array`);
+		return item.trim();
+	});
+	if (items.some((item) => !item)) throw new Error(`${key}_contains_empty_value`);
+	if (new Set(items).size !== items.length) throw new Error(`${key}_contains_duplicates`);
+	return items;
+}
+function assertProjectInviteBody(body, creating) {
+	const allowed = creating ? PROJECT_INVITE_BODY_KEYS : new Set(["teammate_name", "project_ids"]);
+	if (Object.keys(body).some((key) => !allowed.has(key))) throw new Error("unexpected_project_invite_fields");
+	if (typeof body.teammate_name !== "string") throw new Error("teammate_name_must_be_string");
+	if (creating && typeof body.reviewed_project_set_digest !== "string") throw new Error("reviewed_project_set_digest_required");
+	if (creating && !/^[a-f0-9]{64}$/u.test(String(body.reviewed_project_set_digest).trim())) throw new Error("reviewed_project_set_digest_invalid");
+}
+function projectInviteStatus(config = readCoordinatorSyncConfig()) {
+	const status = coordinatorAdminStatusPayload(config);
+	if (status.readiness !== "ready") throw new Error("team_sharing_not_configured");
+	if (status.groups.length !== 1) throw new Error("team_selection_ambiguous");
+	if (!status.active_group) throw new Error("team_sharing_not_configured");
+	return {
+		groupId: status.active_group,
+		config
+	};
+}
+function recipientInviteKind(value) {
+	if (value === "team_member" || value === "add_device") return value;
+	throw new Error("recipient_invite_kind_invalid");
+}
+function localOnboardingBinding(store, deviceName, options = {}) {
+	const deviceId = options.materializeActor === false ? ensureStableStoreDeviceIdentity(store) : ensureStableStoreIdentity(store);
+	const devicePublicKey = String(store.db.prepare("SELECT public_key FROM sync_device WHERE device_id = ?").pluck().get(deviceId) ?? "").trim();
+	if (!devicePublicKey) throw new Error("device_public_key_missing");
+	const config = readCodememConfigFile();
+	return {
+		deviceId,
+		devicePublicKey,
+		deviceDisplayName: friendlyDeviceName({
+			explicitName: deviceName ?? String(config.sync_device_name ?? ""),
+			osName: hostname(),
+			fallbackSeed: deviceId
+		})
+	};
+}
+function recipientInviteOnboardingPreview(store, body, invitationId) {
+	const kind = recipientInviteKind(body.kind ?? body.invite_kind);
+	const binding = localOnboardingBinding(store, optionalViewerString(body, "device_name"));
+	const teamId = optionalViewerStrictString(body, "policy_team_id");
+	const targetIdentityId = optionalViewerStrictString(body, "target_identity_id");
+	if (kind === "team_member") {
+		if (!teamId || targetIdentityId) throw new Error("recipient_invite_metadata_invalid");
+		return previewRecipientPolicyOnboarding(store.db, {
+			version: 1,
+			journey: "team",
+			invitationId,
+			identityId: store.actorId,
+			...binding,
+			teamId
+		});
+	}
+	if (!targetIdentityId || teamId) throw new Error("recipient_invite_metadata_invalid");
+	return previewRecipientPolicyOnboarding(store.db, {
+		version: 1,
+		journey: "add_device",
+		invitationId,
+		identityId: targetIdentityId,
+		...binding
+	});
+}
+function recipientInviteReviewedIntent(store, kind, targetId, preview) {
+	if (kind === "team_member") {
+		if (preview.journey !== "team" || !preview.team || preview.team.teamId !== targetId) throw new Error("recipient_invite_intent_mismatch");
+		return {
+			version: 1,
+			journey: "team",
+			team: preview.team,
+			projects: preview.projects,
+			excludedProjects: []
+		};
+	}
+	if (preview.journey !== "add_device" || preview.binding.identityId !== targetId) throw new Error("recipient_invite_intent_mismatch");
+	const targetIdentity = store.db.prepare(`SELECT display_name FROM actors
+			 WHERE actor_id = ? AND status = 'active' AND merged_into_actor_id IS NULL`).get(targetId);
+	if (!targetIdentity?.display_name) throw new Error("identity_not_found");
+	return {
+		version: 1,
+		journey: "add_device",
+		targetIdentity: {
+			identityId: targetId,
+			displayName: targetIdentity.display_name
+		},
+		projects: preview.projects,
+		excludedProjects: preview.excludedProjects
+	};
+}
+function recipientInviteOnboardingPreviewFromReviewedIntent(store, body, invitationId, reviewedIntent) {
+	const kind = recipientInviteKind(body.kind ?? body.invite_kind);
+	const binding = localOnboardingBinding(store, optionalViewerString(body, "device_name"), { materializeActor: false });
+	const teamId = optionalViewerStrictString(body, "policy_team_id");
+	const targetIdentityId = optionalViewerStrictString(body, "target_identity_id");
+	const assignedIdentityId = optionalViewerStrictString(body, "assigned_identity_id");
+	if (kind === "team_member") {
+		if (!teamId || !assignedIdentityId || targetIdentityId) throw new Error("recipient_invite_metadata_invalid");
+		return previewRecipientPolicyOnboardingFromReviewedIntent(reviewedIntent, {
+			version: 1,
+			journey: "team",
+			invitationId,
+			identityId: assignedIdentityId,
+			...binding,
+			teamId
+		});
+	}
+	if (!targetIdentityId || teamId || assignedIdentityId) throw new Error("recipient_invite_metadata_invalid");
+	return previewRecipientPolicyOnboardingFromReviewedIntent(reviewedIntent, {
+		version: 1,
+		journey: "add_device",
+		invitationId,
+		identityId: targetIdentityId,
+		...binding
+	});
+}
+var SAFE_RECIPIENT_INVITE_ERRORS = new Set([
+	"invite_already_bound",
+	"invite_expired",
+	"invite_identity_conflict",
+	"invite_invalid",
+	"recipient_invite_intent_mismatch",
+	"recipient_invite_review_unavailable",
+	"reviewed_onboarding_stale"
+]);
+function safeRecipientInviteError(value, fallback = "invite_invalid") {
+	const code = value instanceof Error ? value.message : String(value ?? "").trim();
+	return SAFE_RECIPIENT_INVITE_ERRORS.has(code) ? code : fallback;
+}
+function recipientInvitePreviewId(kind, targetId) {
+	return `recipient-invite-preview:${kind}:${targetId}`;
+}
+function recipientPolicyCapabilityFromStatus(payload) {
+	if (!isScopedSyncCapability(normalizeSyncCapability(payload.sync_capability))) return "unsupported";
+	return supportsSyncFeature(payload.sync_features, "reassign_scope") ? "supported" : "unsupported";
+}
+async function peerSupportsSyncRequirements(store, deviceId, requirements) {
+	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	if (deviceId === localDeviceId) return "supported";
+	const row = store.db.prepare("SELECT addresses_json, pinned_fingerprint, public_key FROM sync_peers WHERE peer_device_id = ?").get(deviceId);
+	const expectedFingerprint = String(row?.pinned_fingerprint ?? "").trim() || (row?.public_key ? fingerprintPublicKey(row.public_key) : "");
+	const addresses = safeJsonList(row?.addresses_json ?? null);
+	for (const address of addresses) try {
+		const url = `${buildBaseUrl(address)}/v1/status`;
+		const [status, payload] = await requestJson("GET", url, {
+			headers: {
+				...buildAuthHeaders({
+					deviceId: localDeviceId,
+					method: "GET",
+					url,
+					bodyBytes: Buffer.alloc(0),
+					keysDir: syncKeysDir()
+				}),
+				[SYNC_CAPABILITY_HEADER]: LOCAL_SYNC_CAPABILITY,
+				[SYNC_FEATURES_HEADER]: LOCAL_SYNC_FEATURES.join(",")
+			},
+			timeoutS: 5
+		});
+		if (status < 200 || status >= 300) continue;
+		if (String(payload?.device_id ?? "").trim() !== deviceId) continue;
+		if (expectedFingerprint && String(payload?.fingerprint ?? "").trim() !== expectedFingerprint) continue;
+		if (requirements.scoped && requirements.reassignScope && recipientPolicyCapabilityFromStatus(payload ?? {}) !== "supported") return "unsupported";
+		if (requirements.scoped && !isScopedSyncCapability(normalizeSyncCapability(payload?.sync_capability))) return "unsupported";
+		if (requirements.reassignScope && !supportsSyncFeature(payload?.sync_features, "reassign_scope")) return "unsupported";
+		return "supported";
+	} catch {}
+	return "undetermined";
+}
+async function peerSupportsReassignScope(store, deviceId) {
+	return peerSupportsSyncRequirements(store, deviceId, {
+		scoped: false,
+		reassignScope: true
+	});
+}
+function resolveProjectInviteSelection(store, requestedIds, initiatingDeviceId) {
+	if (requestedIds.length === 0) throw new Error("project_selection_empty");
+	const requested = new Set(requestedIds);
+	const byIdentity = /* @__PURE__ */ new Map();
+	let offset = 0;
+	while (byIdentity.size < requested.size) {
+		const page = listProjectScopeInventory(store.db, {
+			limit: 250,
+			offset
+		});
+		for (const project of page.projects) if (requested.has(project.workspace_identity)) byIdentity.set(project.workspace_identity, project);
+		if (!page.has_more) break;
+		offset += page.limit;
+	}
+	return requestedIds.map((projectId) => {
+		const project = byIdentity.get(projectId);
+		if (!project) throw new Error("project_selection_unknown");
+		if (project.guardrail_warnings.some((warning) => warning.code === "basename_collision_review" && warning.requires_confirmation)) throw new Error("project_selection_ambiguous");
+		if (project.read_only || project.identity_source === "unmapped" || project.memory_count == null || project.guardrail_warnings.some((warning) => warning.requires_confirmation)) throw new Error("project_selection_unsupported");
+		return {
+			canonicalIdentity: project.workspace_identity,
+			displayName: project.display_project,
+			identitySource: project.identity_source,
+			existingMemoryCount: countShareableProjectMemories(store.db, {
+				canonicalIdentity: project.workspace_identity,
+				initiatingDeviceId
+			})
+		};
+	});
+}
+function resolveSharePerson(store, teammateName) {
+	const matches = store.db.prepare(`SELECT actor_id, display_name, status
+			 FROM actors
+			 WHERE status IN ('active', 'pending') AND lower(trim(display_name)) = lower(?)
+			 ORDER BY actor_id`).all(teammateName);
+	if (matches.length > 1) throw new Error("teammate_match_ambiguous");
+	const match = matches[0];
+	if (match) return match.status === "pending" ? {
+		kind: "pending",
+		personId: match.actor_id,
+		displayName: match.display_name
+	} : {
+		kind: "existing",
+		personId: match.actor_id,
+		displayName: match.display_name
+	};
+	return {
+		kind: "pending",
+		displayName: teammateName
+	};
+}
+function projectInvitePlan(store, body, createdAt, inviteExpiresAt) {
+	const teammateName = normalizeTeammateName(String(body.teammate_name));
+	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	store.adoptEnsuredDeviceIdentity(localDeviceId);
+	const projects = resolveProjectInviteSelection(store, projectInviteStringList(body, "project_ids"), localDeviceId);
+	const { groupId, config } = projectInviteStatus();
+	return {
+		plan: planShareOperation({
+			inviterActorId: store.actorId,
+			inviterDeviceIds: [localDeviceId],
+			person: resolveSharePerson(store, teammateName),
+			projects,
+			coordinatorGroupId: groupId,
+			createdAt,
+			inviteExpiresAt
+		}),
+		config
+	};
+}
+function projectInvitePreview(plan) {
+	return {
+		operation_id: plan.operationId,
+		teammate: {
+			display_name: plan.teammateName,
+			match: plan.personKind,
+			...plan.personKind === "existing" ? { person_id: plan.personId } : {}
+		},
+		projects: plan.projects.map((project) => ({
+			project_id: project.canonicalIdentity,
+			display_name: project.displayName,
+			existing_memory_count: project.existingMemoryCount
+		})),
+		existing_memory_count: plan.projects.reduce((total, project) => total + project.existingMemoryCount, 0),
+		future_memories_shared: true,
+		history_policy: plan.historyPolicy,
+		reviewed_project_set_digest: plan.reviewedProjectSetDigest
+	};
+}
+async function coordinatorProjectInvitePayload(operationId) {
+	const { groupId, config } = projectInviteStatus();
+	const [status, payload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/project-invites/${encodeURIComponent(operationId)}?group_id=${encodeURIComponent(groupId)}`, {
+		headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
+		timeoutS: 10
+	}).catch((cause) => {
+		const error = new Error("coordinator_unavailable", { cause });
+		Object.assign(error, { status: 503 });
+		throw error;
+	});
+	if (status < 200 || status >= 300) {
+		const error = new Error(String(payload?.error ?? "operation_read_failed"));
+		Object.assign(error, { status });
+		throw error;
+	}
+	if (!payload || payload.operation_id !== operationId || payload.group_id !== groupId) {
+		const error = /* @__PURE__ */ new Error("operation_scope_mismatch");
+		Object.assign(error, { status: 409 });
+		throw error;
+	}
+	return {
+		groupId,
+		config,
+		payload
+	};
+}
+async function reconcileProjectInviteAcceptance(store, operationId) {
+	const owner = store.db.prepare("SELECT inviter_actor_id FROM share_operations WHERE operation_id = ?").pluck().get(operationId);
+	if (!owner) throw new Error("operation_not_found");
+	if (owner !== store.actorId) throw new Error("operation_scope_mismatch");
+	ensureLocalActorRecord(store);
+	const { groupId, payload } = await coordinatorProjectInvitePayload(operationId);
+	if (payload.state === "waiting_for_acceptance") return {
+		accepted: false,
+		payload
+	};
+	if (payload.state !== "accepted") {
+		const error = /* @__PURE__ */ new Error("operation_state_invalid");
+		Object.assign(error, { status: 409 });
+		throw error;
+	}
+	if ([
+		"reviewed_project_set_digest",
+		"recipient_actor_id",
+		"recipient_display_name",
+		"recipient_device_id",
+		"recipient_device_display_name",
+		"recipient_public_key",
+		"recipient_fingerprint",
+		"consumed_at",
+		"trust_state"
+	].some((key) => typeof payload[key] !== "string" || !String(payload[key]).trim())) {
+		const error = /* @__PURE__ */ new Error("operation_acceptance_invalid");
+		Object.assign(error, { status: 409 });
+		throw error;
+	}
+	const trustState = String(payload.trust_state);
+	const bootstrapGrantId = typeof payload.bootstrap_grant_id === "string" && payload.bootstrap_grant_id.trim() ? payload.bootstrap_grant_id : null;
+	if (trustState !== "pending_inviter_device" && trustState !== "bootstrap_grant_created" || trustState === "bootstrap_grant_created" !== Boolean(bootstrapGrantId)) {
+		const error = /* @__PURE__ */ new Error("operation_trust_state_invalid");
+		Object.assign(error, { status: 409 });
+		throw error;
+	}
+	const projects = parseAcceptedProjectIntent(payload.projects);
+	reconcileShareOperationAcceptance(store.db, {
+		operationId,
+		localInviterActorId: store.actorId,
+		coordinatorGroupId: groupId,
+		reviewedProjectSetDigest: String(payload.reviewed_project_set_digest),
+		recipientActorId: String(payload.recipient_actor_id),
+		recipientDisplayName: String(payload.recipient_display_name),
+		recipientDeviceId: String(payload.recipient_device_id),
+		recipientDeviceDisplayName: String(payload.recipient_device_display_name),
+		recipientPublicKey: String(payload.recipient_public_key),
+		recipientFingerprint: String(payload.recipient_fingerprint),
+		consumedAt: String(payload.consumed_at),
+		trustState,
+		bootstrapGrantId,
+		projects
+	});
+	return {
+		accepted: true,
+		payload
+	};
+}
+async function shareOperationReadModels(store, operationId, includeInviteLinks = true) {
+	const rows = store.db.prepare(`SELECT o.operation_id, o.state, o.person_id, o.teammate_name,
+			o.recipient_actor_id, o.recipient_display_name, o.recipient_device_id,
+			o.recipient_device_display_name, o.invite_expires_at, o.acceptance_consumed_at,
+			o.created_at, o.updated_at, a.display_name AS actor_display_name,
+			p.name AS peer_display_name, p.last_seen_at AS device_last_seen_at,
+			p.last_sync_at AS device_last_reached_at
+		 FROM share_operations o
+		 LEFT JOIN actors a ON a.actor_id = o.person_id
+		 LEFT JOIN sync_peers p ON p.peer_device_id = o.recipient_device_id
+		 WHERE o.inviter_actor_id = ? AND (? IS NULL OR o.operation_id = ?)
+		 ORDER BY o.created_at DESC, o.operation_id`).all(store.actorId, operationId ?? null, operationId ?? null);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return Promise.all(rows.map(async (row) => {
+		const projects = store.db.prepare(`SELECT canonical_project_identity AS project_id, display_name, existing_memory_count
+				 FROM share_operation_projects WHERE operation_id = ? ORDER BY ordinal`).all(row.operation_id);
+		const steps = store.db.prepare(`SELECT step_key, status, attempt_count, started_at, last_attempt_at,
+						safe_error_code, updated_at FROM share_operation_steps WHERE operation_id = ?`).all(row.operation_id).map((step) => ({
+			attemptCount: step.attempt_count,
+			lastAttemptAt: step.last_attempt_at,
+			safeErrorCode: step.safe_error_code,
+			startedAt: step.started_at,
+			status: step.status,
+			stepKey: step.step_key,
+			updatedAt: step.updated_at
+		}));
+		let inviteLink = null;
+		let projectedState = row.state;
+		if (includeInviteLinks && row.state === "waiting_for_acceptance") try {
+			const remote = await coordinatorProjectInvitePayload(row.operation_id);
+			if (remote.payload.state === "accepted") projectedState = "accepted";
+			inviteLink = typeof remote.payload.invite_link === "string" && remote.payload.invite_link.trim() ? remote.payload.invite_link : null;
+		} catch {}
+		const personId = row.recipient_actor_id || row.person_id;
+		const personName = row.recipient_display_name || row.actor_display_name || row.teammate_name;
+		const deviceName = row.recipient_device_display_name || row.peer_display_name;
+		const lifecycle = projectShareLifecycle({
+			deviceLastSeenAt: row.device_last_seen_at,
+			deviceLastReachedAt: row.device_last_reached_at,
+			deviceName,
+			inviteLink,
+			now,
+			personName,
+			state: projectedState,
+			steps
+		});
+		return {
+			operation_id: row.operation_id,
+			person: {
+				actor_id: personId,
+				display_name: personName
+			},
+			devices: row.recipient_device_id && deviceName ? [{
+				device_id: row.recipient_device_id,
+				display_name: deviceName,
+				last_seen_at: row.device_last_seen_at
+			}] : [],
+			projects,
+			project_count: projects.length,
+			lifecycle: {
+				state: lifecycle.lifecycle,
+				label: lifecycle.label,
+				explanation: lifecycle.explanation,
+				primary_action: lifecycle.primaryAction?.kind === "copy_invite" ? {
+					kind: "copy_invite",
+					label: lifecycle.primaryAction.label,
+					invite_link: lifecycle.primaryAction.inviteLink
+				} : !includeInviteLinks && lifecycle.lifecycle === "waiting_for_acceptance" ? {
+					kind: "copy_invite",
+					label: "Copy invite"
+				} : lifecycle.primaryAction
+			},
+			timestamps: {
+				created_at: row.created_at,
+				updated_at: row.updated_at,
+				accepted_at: row.acceptance_consumed_at,
+				invite_expires_at: row.invite_expires_at
+			}
+		};
+	}));
+}
+async function executeProjectShareProvisioning(store, operationId) {
+	const { groupId, config } = projectInviteStatus();
+	const coordinatorId = config.syncCoordinatorUrl || null;
+	if (!coordinatorId) throw new Error("coordinator_not_configured");
+	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	return executeShareProvisioning(store.db, {
+		operationId,
+		initiatingDeviceId: localDeviceId
+	}, {
+		createOrGetBoundary: async (project, expectedGroupId) => {
+			if (expectedGroupId !== groupId) throw new Error("operation_scope_mismatch");
+			const readExisting = async () => (await coordinatorListScopesAction({
+				groupId,
+				includeInactive: true,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			})).find((scope) => scope.scope_id === project.boundaryId) ?? null;
+			const existing = await readExisting();
+			if (existing) return existing;
+			try {
+				return await coordinatorCreateScopeAction({
+					groupId,
+					scopeId: project.boundaryId,
+					label: project.displayName,
+					kind: "managed_project",
+					authorityType: "coordinator",
+					coordinatorId,
+					membershipEpoch: 1,
+					status: "active",
+					remoteUrl: config.syncCoordinatorUrl || null,
+					adminSecret: config.syncCoordinatorAdminSecret || null
+				});
+			} catch (error) {
+				const reread = await readExisting();
+				if (reread) return reread;
+				throw error;
+			}
+		},
+		grantMembership: ({ effectId, groupId: expectedGroupId, scopeId, deviceId, role }) => {
+			if (expectedGroupId !== groupId) throw new Error("operation_scope_mismatch");
+			return coordinatorGrantScopeMembershipAction({
+				effectId,
+				groupId,
+				scopeId,
+				deviceId,
+				role,
+				membershipEpoch: 1,
+				coordinatorId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+		},
+		supportsReassignScope: (deviceId) => peerSupportsReassignScope(store, deviceId),
+		refreshAuthorization: async (expectedGroupId) => {
+			if (expectedGroupId !== groupId) throw new Error("operation_scope_mismatch");
+			if ((await refreshConfiguredScopeMembershipCache(store.db, config, { keysDir: syncKeysDir() })).groups.find((item) => item.groupId === groupId)?.status !== "refreshed") throw new Error("authorization_refresh_failed");
+		},
+		runInitialSync: (recipientDeviceId) => runSyncPass(store.db, recipientDeviceId, {
+			keysDir: syncKeysDir(),
+			scanner: store.scanner,
+			refreshAuthorization: true
+		})
+	});
+}
+async function advanceProjectShareOperation(store, operationId) {
+	const operation = store.db.prepare("SELECT state, inviter_actor_id, recipient_device_id FROM share_operations WHERE operation_id = ?").get(operationId);
+	if (!operation) throw new Error("operation_not_found");
+	if (operation.inviter_actor_id !== store.actorId) throw new Error("operation_scope_mismatch");
+	if (operation.state === "cancelled") return {
+		advanced: false,
+		state: "cancelled"
+	};
+	if (!operation.recipient_device_id) {
+		if (!(await reconcileProjectInviteAcceptance(store, operationId)).accepted) return {
+			advanced: false,
+			state: "waiting_for_acceptance"
+		};
+	}
+	if ((await executeProjectShareProvisioning(store, operationId)).superseded) return {
+		advanced: false,
+		state: "cancelled"
+	};
+	return {
+		advanced: true,
+		state: "active"
+	};
+}
+var AUTOMATIC_SHARE_OPERATION_STATES = [
+	"waiting_for_acceptance",
+	"accepted",
+	"provisioning",
+	"initial_sync",
+	"waiting_for_device"
+];
+var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 30 * 1e3;
+var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 300 * 1e3;
+var TERMINAL_SHARE_MAINTENANCE_ERRORS = new Set([
+	"coordinator_not_configured",
+	"team_sharing_not_configured",
+	"team_selection_ambiguous",
+	"initiating_device_not_reviewed",
+	"inviter_project_access_ambiguous",
+	"managed_boundary_plan_missing",
+	"operation_device_binding_missing",
+	"operation_intent_invalid",
+	"provisioning_membership_plan_invalid",
+	"device_binding_conflict",
+	"intent_conflict",
+	"inviter_identity_conflict"
+]);
+var PROJECT_INVITE_OWNER_CONFLICT_ERRORS = new Set([
+	"operation_scope_mismatch",
+	"operation_state_invalid",
+	"operation_acceptance_invalid",
+	"operation_trust_state_invalid",
+	"operation_intent_invalid",
+	"operation_intent_mismatch",
+	"recipient_fingerprint_mismatch",
+	"recipient_device_identity_conflict",
+	"recipient_actor_conflict",
+	"pending_person_identity_conflict",
+	"device_binding_conflict",
+	"intent_conflict",
+	"inviter_identity_conflict"
+]);
+var TERMINAL_RECONCILIATION_ERRORS = new Set([
+	"coordinator_not_configured",
+	"team_sharing_not_configured",
+	"team_selection_ambiguous",
+	"operation_not_found",
+	...PROJECT_INVITE_OWNER_CONFLICT_ERRORS
+]);
+function errorStatus(error) {
+	const value = error && typeof error === "object" ? error.status : null;
+	return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599 ? value : null;
+}
+function projectInviteOwnerErrorResponse(error, fallback) {
+	const message = error instanceof Error ? error.message : "";
+	const status = errorStatus(error);
+	if (message === "operation_not_found" && (status == null || status === 404)) return {
+		code: message,
+		status: 404
+	};
+	if (PROJECT_INVITE_OWNER_CONFLICT_ERRORS.has(message) && (status == null || status === 409)) return {
+		code: message,
+		status: 409
+	};
+	if (status != null && status >= 500 && message !== "coordinator_unavailable") return {
+		code: "coordinator_upstream_failed",
+		status: 502
+	};
+	if (message === "coordinator_unavailable" || status === 408 || status === 429 || status === 503) return {
+		code: "coordinator_unavailable",
+		status: 503
+	};
+	return fallback;
+}
+function isRetryableReconciliationError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (TERMINAL_RECONCILIATION_ERRORS.has(message)) return false;
+	const status = errorStatus(error);
+	return status == null || status === 408 || status === 429 || status >= 500;
+}
+function safeReconciliationErrorCode(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return TERMINAL_RECONCILIATION_ERRORS.has(message) ? message : "operation_read_failed";
+}
+function recordInviteReconciliationFailure(store, operationId, error, now) {
+	const safeErrorCode = safeReconciliationErrorCode(error);
+	const retryable = isRetryableReconciliationError(error);
+	store.db.prepare(`UPDATE share_operation_steps SET
+			status = CASE WHEN ? = 1 THEN 'pending' ELSE 'failed' END,
+			attempt_count = attempt_count + 1, last_attempt_at = ?, safe_error_code = ?, updated_at = ?
+			WHERE operation_id = ? AND step_key = 'invite_consumption'`).run(retryable ? 1 : 0, now, safeErrorCode, now, operationId);
+	const outcome = retryable ? "retry_scheduled" : "needs_attention";
+	store.db.prepare("UPDATE share_operations SET state = ?, updated_at = ? WHERE operation_id = ?").run(outcome === "needs_attention" ? "needs_attention" : "waiting_for_acceptance", now, operationId);
+	return outcome;
+}
+async function advancePendingProjectShares(store, options = {}) {
+	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 3), 10));
+	const placeholders = AUTOMATIC_SHARE_OPERATION_STATES.map(() => "?").join(", ");
+	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
+	const waitingAcceptanceRetryBefore = (/* @__PURE__ */ new Date(maintenanceNow.getTime() - AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS)).toISOString();
+	const waitingRetryBefore = (/* @__PURE__ */ new Date(maintenanceNow.getTime() - AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS)).toISOString();
+	const rows = store.db.prepare(`SELECT operation.operation_id FROM share_operations AS operation
+		 WHERE operation.inviter_actor_id = ?
+		 AND operation.state IN (${placeholders})
+		 AND (operation.state <> 'waiting_for_acceptance' OR operation.updated_at <= ?)
+		 AND (
+			operation.state <> 'waiting_for_device'
+			OR operation.updated_at <= ?
+			OR (
+				NOT EXISTS (
+					SELECT 1 FROM share_operation_steps AS step
+					WHERE step.operation_id = operation.operation_id
+					AND step.step_key = 'capability_preflight'
+					AND step.status <> 'completed'
+					AND (
+						step.status = 'running'
+						OR step.safe_error_code IN (
+							'waiting_for_device', 'device_offline', 'recipient_offline'
+						)
+					)
+				)
+				AND EXISTS (
+					SELECT 1 FROM sync_attempts AS attempt
+					WHERE attempt.id = (
+						SELECT latest.id FROM sync_attempts AS latest
+						WHERE latest.peer_device_id = operation.recipient_device_id
+						ORDER BY latest.started_at DESC, latest.id DESC
+						LIMIT 1
+					)
+					AND attempt.ok = 1
+					AND julianday(COALESCE(attempt.finished_at, attempt.started_at)) >
+						julianday(operation.updated_at)
+				)
+			)
+		 )
+		 ORDER BY CASE WHEN operation.state IN ('accepted', 'provisioning', 'initial_sync') THEN 0 ELSE 1 END,
+			CASE WHEN operation.state IN ('waiting_for_acceptance', 'waiting_for_device')
+				THEN operation.updated_at ELSE operation.created_at END ASC,
+			operation.created_at ASC, operation.operation_id ASC
+		 LIMIT ?`).all(store.actorId, ...AUTOMATIC_SHARE_OPERATION_STATES, waitingAcceptanceRetryBefore, waitingRetryBefore, limit);
+	const advanceOperation = options.advanceOperation ?? advanceProjectShareOperation;
+	const result = {
+		processed: 0,
+		advanced: 0,
+		waiting: 0,
+		attention: 0,
+		failed: 0,
+		items: []
+	};
+	for (const row of rows) {
+		result.processed += 1;
+		try {
+			const advanced = await advanceOperation(store, row.operation_id);
+			if (!advanced.advanced) {
+				if (advanced.state === "cancelled") {
+					result.items.push({
+						operationId: row.operation_id,
+						outcome: "superseded"
+					});
+					continue;
+				}
+				store.db.prepare("UPDATE share_operations SET updated_at = ? WHERE operation_id = ?").run(maintenanceNow.toISOString(), row.operation_id);
+				result.waiting += 1;
+				result.items.push({
+					operationId: row.operation_id,
+					outcome: "waiting_for_acceptance"
+				});
+				continue;
+			}
+			result.advanced += 1;
+			result.items.push({
+				operationId: row.operation_id,
+				outcome: "advanced"
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const state = store.db.prepare("SELECT state FROM share_operations WHERE operation_id = ?").pluck().get(row.operation_id);
+			if (state === "cancelled") {
+				result.items.push({
+					operationId: row.operation_id,
+					outcome: "superseded"
+				});
+				continue;
+			}
+			if (message === "waiting_for_device" || state === "waiting_for_device") {
+				result.waiting += 1;
+				result.items.push({
+					operationId: row.operation_id,
+					outcome: "waiting_for_device"
+				});
+				continue;
+			}
+			if (state === "needs_attention") {
+				result.attention += 1;
+				result.items.push({
+					operationId: row.operation_id,
+					outcome: "needs_attention",
+					error: message
+				});
+				continue;
+			}
+			if (state === "waiting_for_acceptance") {
+				const outcome = recordInviteReconciliationFailure(store, row.operation_id, error, maintenanceNow.toISOString());
+				if (outcome === "needs_attention") result.attention += 1;
+				else result.waiting += 1;
+				result.items.push({
+					operationId: row.operation_id,
+					outcome,
+					error: message
+				});
+				continue;
+			}
+			if (TERMINAL_SHARE_MAINTENANCE_ERRORS.has(message)) {
+				store.db.prepare("UPDATE share_operations SET state = 'needs_attention', updated_at = ? WHERE operation_id = ?").run(maintenanceNow.toISOString(), row.operation_id);
+				result.attention += 1;
+				result.items.push({
+					operationId: row.operation_id,
+					outcome: "needs_attention",
+					error: message
+				});
+				continue;
+			}
+			result.failed += 1;
+			result.items.push({
+				operationId: row.operation_id,
+				outcome: "failed",
+				error: message
+			});
+		}
+	}
+	return result;
+}
+async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
+	const config = options.config ?? readCoordinatorSyncConfig();
+	const remoteUrl = config.syncCoordinatorUrl.trim();
+	const adminSecret = config.syncCoordinatorAdminSecret.trim();
+	if (!remoteUrl || !adminSecret || config.syncCoordinatorGroups.length === 0) return {
+		skipped: true,
+		groupsProcessed: 0,
+		failedGroups: 0,
+		devicesAdded: 0,
+		membershipsAdded: 0,
+		identitiesAdded: 0,
+		unchanged: 0,
+		issues: 0
+	};
+	const listDevices = options.listDevices ?? coordinatorListDevicesAction;
+	const listConsumedTeamInvites = options.listConsumedTeamInvites ?? coordinatorListConsumedTeamInvitesAction;
+	const reconcileSnapshot = options.reconcileSnapshot ?? ((input) => reconcileCoordinatorEnrollmentSnapshot(store.db, input));
+	const total = {
+		skipped: false,
+		groupsProcessed: 0,
+		failedGroups: 0,
+		devicesAdded: 0,
+		membershipsAdded: 0,
+		identitiesAdded: 0,
+		unchanged: 0,
+		issues: 0
+	};
+	for (const groupId of config.syncCoordinatorGroups) try {
+		const [enrollments, consumedTeamInvites] = await Promise.all([listDevices({
+			groupId,
+			remoteUrl,
+			adminSecret
+		}), listConsumedTeamInvites({
+			groupId,
+			remoteUrl,
+			adminSecret
+		})]);
+		const result = reconcileSnapshot({
+			coordinatorId: buildBaseUrl(remoteUrl),
+			groupId,
+			enrollments,
+			consumedTeamInvites,
+			localDeviceId: store.deviceId
+		});
+		total.groupsProcessed += 1;
+		total.devicesAdded += result.devicesAdded;
+		total.membershipsAdded += result.membershipsAdded;
+		total.identitiesAdded += result.identitiesAdded;
+		total.unchanged += result.unchanged;
+		total.issues += result.issues.length;
+	} catch {
+		total.failedGroups += 1;
+	}
+	return total;
+}
+var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
+var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
+var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
+var RECIPIENT_POLICY_WAITING_ERRORS = new Set([
+	"recipient_policy_capability_undetermined",
+	"recipient_policy_parity_incomplete",
+	"recipient_policy_snapshot_not_fresh"
+]);
+function recipientPolicyCoordinatorBoundary(store, scopeId) {
+	const row = store.db.prepare(`SELECT coordinator_id, group_id, membership_epoch FROM replication_scopes
+			 WHERE scope_id = ? AND kind = 'managed_project' AND authority_type = 'coordinator'
+			 AND status = 'active'`).get(scopeId);
+	const coordinatorId = String(row?.coordinator_id ?? "").trim();
+	const groupId = String(row?.group_id ?? "").trim();
+	const membershipEpoch = Number(row?.membership_epoch);
+	if (!coordinatorId || !groupId || !Number.isSafeInteger(membershipEpoch) || membershipEpoch < 0) throw new Error("recipient_policy_active_managed_scope_required");
+	return {
+		coordinatorId,
+		groupId,
+		membershipEpoch
+	};
+}
+function recipientPolicySnapshotFingerprint(scopeId, scopeMembershipEpoch, memberships) {
+	const canonical = memberships.toSorted((left, right) => left.deviceId.localeCompare(right.deviceId) || left.status.localeCompare(right.status) || left.membershipEpoch - right.membershipEpoch).map((membership) => `${membership.deviceId}\u0000${membership.status}\u0000${membership.membershipEpoch}`).join("
");
+	return `recipient-policy-coordinator-snapshot-v2:${createHash("sha256").update(`${scopeId}\u0000${scopeMembershipEpoch}\u0000${canonical}`).digest("hex")}`;
+}
+function recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt) {
+	const expiresAt = enrollment.presence_expires_at;
+	const capabilities = enrollment.presence_capabilities;
+	if (typeof expiresAt !== "string" || !capabilities) return null;
+	const expiresAtMs = Date.parse(expiresAt);
+	const observedAtMs = Date.parse(observedAt);
+	if (!Number.isFinite(expiresAtMs) || !Number.isFinite(observedAtMs) || new Date(expiresAtMs).toISOString() !== expiresAt || expiresAtMs <= observedAtMs || capabilities.sync_capability !== "scoped" || !Array.isArray(capabilities.sync_features) || !capabilities.sync_features.every((feature) => typeof feature === "string") || !capabilities.sync_features.includes("reassign_scope")) return null;
+	return expiresAtMs;
+}
+function recipientPolicyEnrollmentValueIsValid(value) {
+	return typeof value === "string" && value.length > 0 && value === value.trim();
+}
+function createRecipientPolicyReconcilerEffects(store, options = {}) {
+	const config = options.config ?? readCoordinatorSyncConfig();
+	const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const listDevices = options.listDevices ?? coordinatorListDevicesAction;
+	const listReviewedRecipientInviteEvidence = options.listReviewedRecipientInviteEvidence ?? coordinatorListReviewedRecipientInviteEvidenceAction;
+	const reviewedRecipientInviteEvidence = /* @__PURE__ */ new Map();
+	const loadReviewedRecipientInviteEvidence = (groupId) => {
+		let evidence = reviewedRecipientInviteEvidence.get(groupId);
+		if (!evidence) {
+			evidence = listReviewedRecipientInviteEvidence({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			reviewedRecipientInviteEvidence.set(groupId, evidence);
+		}
+		return evidence;
+	};
+	const boundaryEnrollments = /* @__PURE__ */ new Map();
+	const target = (scopeId) => recipientPolicyCoordinatorBoundary(store, scopeId);
+	const coordinatorOptions = (scopeId) => {
+		const boundary = target(scopeId);
+		const remoteUrl = config.syncCoordinatorUrl?.trim();
+		const adminSecret = config.syncCoordinatorAdminSecret?.trim();
+		if (!remoteUrl || !adminSecret) throw new Error("recipient_policy_effect_failed");
+		if (!config.syncCoordinatorGroups.includes(boundary.groupId)) throw new Error("recipient_policy_effect_failed");
+		try {
+			if (buildBaseUrl(boundary.coordinatorId) !== buildBaseUrl(remoteUrl)) throw new Error("recipient_policy_effect_failed");
+		} catch {
+			throw new Error("recipient_policy_effect_failed");
+		}
+		return {
+			...boundary,
+			remoteUrl,
+			adminSecret
+		};
+	};
+	return {
+		now,
+		snapshot: async ({ scopeId }) => {
+			const targetOptions = coordinatorOptions(scopeId);
+			const snapshotMemberships = (await coordinatorListScopeMembershipsAction({
+				groupId: targetOptions.groupId,
+				scopeId,
+				includeRevoked: true,
+				remoteUrl: targetOptions.remoteUrl,
+				adminSecret: targetOptions.adminSecret
+			}).catch(() => {
+				throw new Error("recipient_policy_snapshot_not_fresh");
+			})).map((membership) => {
+				if (typeof membership.device_id !== "string" || membership.status !== "active" && membership.status !== "revoked") throw new Error("recipient_policy_snapshot_invalid");
+				const status = membership.status;
+				return {
+					deviceId: membership.device_id,
+					status,
+					membershipEpoch: membership.membership_epoch
+				};
+			});
+			return {
+				authoritative: true,
+				scopeId,
+				scopeMembershipEpoch: targetOptions.membershipEpoch,
+				fingerprint: recipientPolicySnapshotFingerprint(scopeId, targetOptions.membershipEpoch, snapshotMemberships),
+				observedAt: now(),
+				memberships: snapshotMemberships
+			};
+		},
+		listBoundaryEnrollments: async ({ scopeId }) => {
+			const targetOptions = coordinatorOptions(scopeId);
+			const observedAt = now();
+			const enrollments = await listDevices({
+				groupId: targetOptions.groupId,
+				includeDisabled: true,
+				remoteUrl: targetOptions.remoteUrl,
+				adminSecret: targetOptions.adminSecret
+			}).catch(() => {
+				throw new Error("recipient_policy_snapshot_not_fresh");
+			});
+			const presenceCapabilityExpiries = new Map(enrollments.map((enrollment) => [enrollment.device_id, recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt)]));
+			const mapped = enrollments.map((enrollment) => {
+				if (enrollment.group_id !== targetOptions.groupId || !recipientPolicyEnrollmentValueIsValid(enrollment.device_id) || !recipientPolicyEnrollmentValueIsValid(enrollment.public_key) || !recipientPolicyEnrollmentValueIsValid(enrollment.fingerprint) || fingerprintPublicKey(enrollment.public_key) !== enrollment.fingerprint || enrollment.enabled !== 0 && enrollment.enabled !== 1 || enrollment.identity_id !== null && !recipientPolicyEnrollmentValueIsValid(enrollment.identity_id)) throw new Error("recipient_policy_snapshot_invalid");
+				return {
+					deviceId: enrollment.device_id,
+					identityId: enrollment.identity_id,
+					publicKey: enrollment.public_key,
+					fingerprint: enrollment.fingerprint,
+					enabled: enrollment.enabled === 1
+				};
+			});
+			boundaryEnrollments.set(scopeId, new Map(mapped.flatMap((enrollment) => enrollment.enabled && enrollment.identityId !== null ? [[enrollment.deviceId, {
+				identityId: enrollment.identityId,
+				publicKey: enrollment.publicKey,
+				fingerprint: enrollment.fingerprint,
+				presenceCapabilityExpiresAtMs: presenceCapabilityExpiries.get(enrollment.deviceId) ?? null
+			}]] : [])));
+			return mapped;
+		},
+		probeCapability: async ({ deviceId, scopeId }) => {
+			if (deviceId === store.deviceId) return "supported";
+			const targetOptions = coordinatorOptions(scopeId);
+			const enrollment = boundaryEnrollments.get(scopeId)?.get(deviceId);
+			if (!enrollment) return "undetermined";
+			const peer = store.db.prepare("SELECT pinned_fingerprint, public_key FROM sync_peers WHERE peer_device_id = ?").get(deviceId);
+			if (peer) {
+				const peerPublicKey = String(peer.public_key ?? "").trim();
+				const peerFingerprint = String(peer.pinned_fingerprint ?? "").trim() || (peerPublicKey ? fingerprintPublicKey(peerPublicKey) : "");
+				if ((peerFingerprint || peerPublicKey) && (peerFingerprint !== enrollment.fingerprint || peerPublicKey && peerPublicKey !== enrollment.publicKey)) return "undetermined";
+			}
+			const observed = await peerSupportsSyncRequirements(store, deviceId, {
+				scoped: true,
+				reassignScope: true
+			});
+			if (observed !== "undetermined") return observed;
+			const observedAtMs = Date.parse(now());
+			if (enrollment.presenceCapabilityExpiresAtMs == null || !Number.isFinite(observedAtMs) || enrollment.presenceCapabilityExpiresAtMs <= observedAtMs) return "undetermined";
+			return (await loadReviewedRecipientInviteEvidence(targetOptions.groupId).catch(() => [])).some((invite) => invite.group_id === targetOptions.groupId && invite.bound_device_id === deviceId && invite.recipient_actor_id === enrollment.identityId && invite.bound_public_key === enrollment.publicKey && invite.bound_fingerprint === enrollment.fingerprint) ? "supported" : "undetermined";
+		},
+		revoke: async (input) => {
+			const targetOptions = coordinatorOptions(input.scopeId);
+			await coordinatorRevokeScopeMembershipAction({
+				effectId: input.effectId,
+				groupId: targetOptions.groupId,
+				scopeId: input.scopeId,
+				deviceId: input.deviceId,
+				remoteUrl: targetOptions.remoteUrl,
+				adminSecret: targetOptions.adminSecret
+			});
+			return {
+				effectId: input.effectId,
+				scopeId: input.scopeId,
+				deviceId: input.deviceId,
+				status: "revoked"
+			};
+		},
+		grant: async (input) => {
+			const targetOptions = coordinatorOptions(input.scopeId);
+			const membership = await coordinatorGrantScopeMembershipAction({
+				effectId: input.effectId,
+				groupId: targetOptions.groupId,
+				scopeId: input.scopeId,
+				deviceId: input.deviceId,
+				role: input.role,
+				coordinatorId: targetOptions.coordinatorId,
+				remoteUrl: targetOptions.remoteUrl,
+				adminSecret: targetOptions.adminSecret
+			});
+			return {
+				effectId: input.effectId,
+				scopeId: membership.scope_id,
+				deviceId: membership.device_id,
+				status: membership.status === "active" ? "active" : "revoked"
+			};
+		},
+		refresh: async ({ scopeId }) => {
+			const boundary = target(scopeId);
+			if ((await refreshConfiguredScopeMembershipCache(store.db, config, { keysDir: syncKeysDir() })).groups.find((item) => item.groupId === boundary.groupId)?.status !== "refreshed") throw new Error("recipient_policy_effect_failed");
+			await refreshAuthorizedCoordinatorPeerTrust(store, config);
+		}
+	};
+}
+async function reconcileRecipientPolicyProjects(store, options = {}) {
+	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT), RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT));
+	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
+	const backoffMs = Math.max(0, Math.trunc(options.backoffMs ?? RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS));
+	const retryBefore = new Date(maintenanceNow.getTime() - backoffMs).toISOString();
+	const rows = store.db.prepare(`WITH projects AS (
+				SELECT DISTINCT canonical_project_identity FROM project_recipients
+				UNION
+				SELECT canonical_project_identity FROM recipient_policy_authority_states
+			)
+			 SELECT projects.canonical_project_identity
+			 FROM projects
+			 LEFT JOIN recipient_policy_authority_states authority
+			  ON authority.canonical_project_identity = projects.canonical_project_identity
+			 WHERE authority.safe_error_code IS NULL OR authority.last_attempt_at IS NULL
+			  OR authority.last_attempt_at <= ?
+			 ORDER BY CASE WHEN authority.last_attempt_at IS NULL THEN 0 ELSE 1 END,
+			  authority.last_attempt_at, projects.canonical_project_identity
+			 LIMIT ?`).all(retryBefore, limit);
+	const effects = options.effects ?? createRecipientPolicyReconcilerEffects(store);
+	const reconcileProject = options.reconcileProject ?? reconcileRecipientPolicyProject;
+	const result = {
+		processed: 0,
+		active: 0,
+		waiting: 0,
+		attention: 0,
+		failed: 0,
+		items: []
+	};
+	for (const row of rows) {
+		result.processed += 1;
+		try {
+			const outcome = await reconcileProject(store.db, {
+				canonicalProjectIdentity: row.canonical_project_identity,
+				leaseOwner: options.leaseOwner ?? `recipient-policy-maintenance:${store.deviceId || process.pid}`
+			}, effects);
+			if (outcome.status === "active") result.active += 1;
+			else if (outcome.status === "needs_attention") result.attention += 1;
+			else result.waiting += 1;
+			result.items.push({
+				canonicalProjectIdentity: row.canonical_project_identity,
+				status: outcome.status,
+				safeErrorCode: outcome.safeErrorCode
+			});
+		} catch {
+			result.failed += 1;
+			result.items.push({
+				canonicalProjectIdentity: row.canonical_project_identity,
+				status: "failed",
+				safeErrorCode: "recipient_policy_reconciliation_failed"
+			});
+		}
+	}
+	return result;
+}
+function recipientPolicyReadState(authority) {
+	if (!authority) return "pending";
+	if (authority.safeErrorCode && RECIPIENT_POLICY_WAITING_ERRORS.has(authority.safeErrorCode)) return "waiting";
+	if (authority.safeErrorCode || authority.authorityState === "rolled_back") return "needs_attention";
+	if (authority.authorityState === "active") return "active";
+	if (authority.authorityState === "eligible") return "verifying";
+	return "pending";
+}
+function recipientPolicyReadCopy(state) {
+	if (state === "active") return {
+		label: "Recipient policy active",
+		explanation: "Recipient policy now controls future access for this Project."
+	};
+	if (state === "verifying") return {
+		label: "Verifying recipient policy",
+		explanation: "Current access matches recipient policy and needs one more stable check."
+	};
+	if (state === "waiting") return {
+		label: "Waiting to reconcile",
+		explanation: "Waiting for devices or a fresh coordinator snapshot. No partial grant is applied."
+	};
+	if (state === "needs_attention") return {
+		label: "Reconciliation needs attention",
+		explanation: "Legacy scope enforcement remains in control until this Project is safe to retry."
+	};
+	return {
+		label: "Recipient policy pending",
+		explanation: "Legacy scope enforcement remains in control while reconciliation is pending."
+	};
+}
+function listRecipientPolicyReconciliationStatus(store) {
+	return {
+		version: 1,
+		items: store.db.prepare(`SELECT DISTINCT canonical_project_identity FROM project_recipients WHERE status = 'active'
+				 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states
+				 ORDER BY canonical_project_identity`).all().map((row) => row.canonical_project_identity).map((canonicalProjectIdentity) => {
+			const state = recipientPolicyReadState(getRecipientPolicyAuthorityState(store.db, canonicalProjectIdentity));
+			return {
+				canonicalProjectIdentity,
+				state,
+				...recipientPolicyReadCopy(state),
+				deliveredCopiesMayRemain: true,
+				revocationWarning: SCOPE_MEMBERSHIP_REVOCATION_LIMITATION
+			};
+		})
+	};
+}
 function sortActiveMaintenanceJobs(jobs) {
 	return [...jobs].sort((a, b) => {
 		const aTime = a.started_at ?? a.updated_at;
@@ -2017,6 +3205,11 @@ function redactSemanticIndexDiagnostics(diagnostics, showDiagnostics) {
 function syncKeysDir() {
 	return process.env.CODEMEM_KEYS_DIR?.trim() || void 0;
 }
+/** Strip control/format characters and cap length so attacker-controlled
+* headers cannot forge log lines when included in diagnostics. */
+function loggableHeaderValue(value) {
+	return (value ?? "").replace(/[\p{Cc}\p{Cf}]/gu, "").slice(0, 64).trim() || "unknown";
+}
 function intEnvOr(name, fallback) {
 	const value = Number.parseInt(process.env[name] ?? "", 10);
 	return Number.isFinite(value) ? value : fallback;
@@ -2169,7 +3362,7 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		deviceId
 	};
 	const config = readCoordinatorSyncConfig();
-	if (!config.syncCoordinatorUrl || !config.syncCoordinatorAdminSecret) return {
+	if (!config.syncCoordinatorUrl) return {
 		ok: false,
 		reason: "bootstrap_grant_coordinator_not_configured",
 		deviceId
@@ -2177,11 +3370,31 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 	let verification;
 	try {
-		const [status, payload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
-			headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
-			timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
-		});
-		if (status !== 200 || !payload) return {
+		let payload = null;
+		if (config.syncCoordinatorAdminSecret) {
+			const [status, adminPayload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
+				headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
+				timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
+			});
+			if (status === 200) payload = adminPayload;
+		} else for (const groupId of config.syncCoordinatorGroups) {
+			const lookupUrl = `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/bootstrap-grants/${encodeURIComponent(grantId)}?group_id=${encodeURIComponent(groupId)}`;
+			const [status, signedPayload] = await requestJson("GET", lookupUrl, {
+				headers: buildAuthHeaders({
+					deviceId: localDeviceId,
+					method: "GET",
+					url: lookupUrl,
+					bodyBytes: Buffer.alloc(0),
+					keysDir: syncKeysDir()
+				}),
+				timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
+			});
+			if (status === 200) {
+				payload = signedPayload;
+				break;
+			}
+		}
+		if (!payload) return {
 			ok: false,
 			reason: "bootstrap_grant_lookup_failed",
 			deviceId
@@ -2201,6 +3414,11 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_invalid_payload",
 		deviceId
 	};
+	if (config.syncCoordinatorGroups.length > 0 && !config.syncCoordinatorGroups.includes(String(grant.group_id))) return {
+		ok: false,
+		reason: "bootstrap_grant_group_mismatch",
+		deviceId
+	};
 	if (grant.revoked_at) return {
 		ok: false,
 		reason: "bootstrap_grant_revoked",
@@ -2221,6 +3439,13 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_worker_disabled",
 		deviceId
 	};
+	const workerPublicKey = String(workerEnrollment.public_key ?? "").trim();
+	const workerFingerprint = String(workerEnrollment.fingerprint ?? "").trim();
+	if (!workerPublicKey || fingerprintPublicKey(workerPublicKey) !== workerFingerprint) return {
+		ok: false,
+		reason: "bootstrap_grant_worker_identity_invalid",
+		deviceId
+	};
 	if (grant.worker_device_id !== deviceId) return {
 		ok: false,
 		reason: "bootstrap_grant_worker_mismatch",
@@ -2245,7 +3470,7 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 			timestamp,
 			nonce,
 			signature,
-			publicKey: String(workerEnrollment.public_key),
+			publicKey: workerPublicKey,
 			deviceId
 		});
 	} catch {
@@ -2260,8 +3485,19 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_invalid_signature",
 		deviceId
 	};
+	if (!isPeerTrustBindingCompatible(store.db, deviceId, workerPublicKey, workerFingerprint)) return {
+		ok: false,
+		reason: "bootstrap_grant_peer_trust_conflict",
+		deviceId
+	};
 	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
 	if (nonceResult) return nonceResult;
+	updatePeerAddresses(store.db, deviceId, [], {
+		name: String(workerEnrollment.display_name ?? "").trim() || void 0,
+		pinnedFingerprint: workerFingerprint,
+		publicKey: workerPublicKey,
+		replaceTrust: true
+	});
 	return {
 		ok: true,
 		reason: "ok",
@@ -2348,8 +3584,12 @@ function ensureLocalActorRecord(store) {
 		is_local: 0,
 		updated_at: now
 	}).where(and(eq(schema.actors.is_local, 1), ne(schema.actors.actor_id, store.actorId))).run();
-	if (d.select({ actor_id: schema.actors.actor_id }).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get()) {
-		d.update(schema.actors).set({
+	const existing = d.select({
+		actor_id: schema.actors.actor_id,
+		is_local: schema.actors.is_local
+	}).from(schema.actors).where(eq(schema.actors.actor_id, store.actorId)).get();
+	if (existing) {
+		if (existing.is_local !== 1) d.update(schema.actors).set({
 			is_local: 1,
 			updated_at: now
 		}).where(eq(schema.actors.actor_id, store.actorId)).run();
@@ -2365,6 +3605,16 @@ function ensureLocalActorRecord(store) {
 		updated_at: now
 	}).run();
 }
+function ensureStableStoreIdentity(store) {
+	const deviceId = ensureStableStoreDeviceIdentity(store);
+	ensureLocalActorRecord(store);
+	return deviceId;
+}
+function ensureStableStoreDeviceIdentity(store) {
+	const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	store.adoptEnsuredDeviceIdentity(deviceId);
+	return deviceId;
+}
 function findPeerDeviceIdForAddress(store, address) {
 	const rows = store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all();
 	for (const row of rows) if (safeJsonList(row.addresses_json).includes(address)) return String(row.peer_device_id ?? "").trim() || null;
@@ -2615,7 +3865,8 @@ async function acceptDiscoveredPeer(store, input) {
 function filterOpsForPeer(store, peerDeviceId, localDeviceId, ops, options = {}) {
 	const [allowed, , skipped] = filterReplicationOpsForSyncWithStatus(store.db, ops, peerDeviceId, {
 		localDeviceId,
-		applyScopeFilter: options.applyScopeFilter
+		applyScopeFilter: options.applyScopeFilter,
+		supportsReassignScope: options.supportsReassignScope
 	});
 	return {
 		allowed,
@@ -3132,6 +4383,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			let preauthChecked = false;
 			let bootstrapAttempted = false;
+			let deviceAuthReason = null;
 			if (!auth.ok) {
 				if ((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()) {
 					preauthChecked = true;
@@ -3142,19 +4394,21 @@ function syncProtocolRoutes(getStore, opts = {}) {
 					const unauthLimited = rateLimitedResponse(c, c.req.path, false);
 					if (unauthLimited) return unauthLimited;
 				}
+				deviceAuthReason = auth.reason;
 				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
 				bootstrapAttempted = true;
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
 				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
-				if (bootstrapAttempted && grantPresent) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
-				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
+				if (bootstrapAttempted && (grantPresent || deviceAuthReason != null && deviceAuthReason !== "missing_headers")) console.warn(`[sync] peer auth failed: reason=${auth.reason} device_auth_reason=${deviceAuthReason ?? "none"} grant_present=${grantPresent} path=${c.req.path} device=${loggableHeaderValue(c.req.header("X-Opencode-Device"))}`);
+				const wireReason = bootstrapAttempted && grantPresent ? "bootstrap_grant_invalid" : deviceAuthReason ?? auth.reason;
 				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
 			try {
+				if (c.req.header(SYNC_AUTHORIZATION_REFRESH_HEADER) === "1" && supportsSyncFeature(c.req.header(SYNC_FEATURES_HEADER), "reassign_scope")) await refreshConfiguredScopeMembershipCache(store.db, void 0, { keysDir: syncKeysDir() });
 				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				const syncReset = getSyncResetState(store.db);
 				const authorizedScopes = isScopedSyncCapability(negotiatedSyncCapability(c)) ? listAuthorizedScopesForPeer(store.db, {
@@ -3166,7 +4420,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 					protocol_version: SYNC_PROTOCOL_VERSION,
 					fingerprint,
 					sync_reset: addSyncScopeToBoundary(syncReset, null),
-					sync_capability: LOCAL_SYNC_CAPABILITY
+					sync_capability: LOCAL_SYNC_CAPABILITY,
+					sync_features: LOCAL_SYNC_FEATURES
 				};
 				if (authorizedScopes !== null) response.authorized_scopes = authorizedScopes;
 				return c.json(response);
@@ -3216,7 +4471,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				...addSyncScopeToBoundary(result.reset, scopeRequest.scope_id)
 			}, 409);
 			const { ops, nextCursor, boundary } = result;
-			const filtered = filterOpsForPeer(store, peerDeviceId, localDeviceId, ops);
+			const filtered = filterOpsForPeer(store, peerDeviceId, localDeviceId, ops, { supportsReassignScope: supportsSyncFeature(c.req.header(SYNC_FEATURES_HEADER), "reassign_scope") });
 			return c.json({
 				reset_required: false,
 				sync_capability: LOCAL_SYNC_CAPABILITY,
@@ -3241,6 +4496,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			let preauthChecked = false;
 			let bootstrapAttempted = false;
+			let deviceAuthReason = null;
 			if (!auth.ok) {
 				if ((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim()) {
 					preauthChecked = true;
@@ -3251,14 +4507,15 @@ function syncProtocolRoutes(getStore, opts = {}) {
 					const unauthLimited = rateLimitedResponse(c, c.req.path, false);
 					if (unauthLimited) return unauthLimited;
 				}
+				deviceAuthReason = auth.reason;
 				auth = await authorizeBootstrapGrantRequest(store, c.req, Buffer.alloc(0));
 				bootstrapAttempted = true;
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
 				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
-				if (bootstrapAttempted && grantPresent) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
-				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
+				if (bootstrapAttempted && (grantPresent || deviceAuthReason != null && deviceAuthReason !== "missing_headers")) console.warn(`[sync] peer auth failed: reason=${auth.reason} device_auth_reason=${deviceAuthReason ?? "none"} grant_present=${grantPresent} path=${c.req.path} device=${loggableHeaderValue(c.req.header("X-Opencode-Device"))}`);
+				const wireReason = bootstrapAttempted && grantPresent ? "bootstrap_grant_invalid" : deviceAuthReason ?? auth.reason;
 				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
@@ -3340,12 +4597,23 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		if (!Array.isArray(body.ops)) return c.json({ error: "invalid_ops" }, 400);
 		if (body.ops.length > MAX_SYNC_OPS) return c.json({ error: "too_many_ops" }, 413);
 		const normalizedOps = extractReplicationOps(body);
+		const peerFeatures = normalizeSyncFeatures(body.sync_features);
+		const reassignOps = normalizedOps.filter((op) => op.op_type === "reassign_scope");
+		if (reassignOps.length > 0 && !peerFeatures.includes("reassign_scope")) return c.json({ error: "reassign_capability_required" }, 409);
+		try {
+			for (const op of reassignOps) parseReassignScopePayload(op);
+		} catch {
+			return c.json({ error: "reassign_payload_invalid" }, 400);
+		}
 		for (const op of normalizedOps) if (op.device_id !== peerDeviceId || op.clock_device_id !== peerDeviceId) return c.json({
 			error: "invalid_op_device",
 			reason: "device_id_mismatch",
 			op_id: op.op_id
 		}, 400);
-		const filtered = filterOpsForPeer(store, peerDeviceId, localDeviceId, normalizedOps, { applyScopeFilter: false });
+		const filtered = filterOpsForPeer(store, peerDeviceId, localDeviceId, normalizedOps, {
+			applyScopeFilter: false,
+			supportsReassignScope: peerFeatures.includes("reassign_scope")
+		});
 		const rejected = rejectInboundScopeFailures(store.db, normalizedOps, localDeviceId, {
 			enabled: negotiated !== "unsupported",
 			peerDeviceId
@@ -3411,6 +4679,23 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			}
 			const lastSyncRow = traceSync("lastSyncRow", () => d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get());
 			const semanticIndex = traceSync("semanticIndex", () => redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db), showDiag));
+			const enrollmentIssueSummary = traceSync("coordinatorEnrollmentIssues", () => getCoordinatorEnrollmentReconciliationIssueSummary(store.db));
+			const enrollmentIssueStatus = {
+				counts: enrollmentIssueSummary.counts,
+				...showDiag ? { issues: enrollmentIssueSummary.issues.map((issue) => ({
+					coordinator_id: issue.coordinatorId,
+					group_id: issue.groupId,
+					kind: issue.kind,
+					reference_id: issue.referenceId,
+					code: issue.code,
+					status: issue.status,
+					first_seen_at: issue.firstSeenAt,
+					last_seen_at: issue.lastSeenAt,
+					resolved_at: issue.resolvedAt,
+					occurrence_count: issue.occurrenceCount,
+					updated_at: issue.updatedAt
+				})) } : {}
+			};
 			const lastError = daemonState?.last_error;
 			const lastErrorAt = daemonState?.last_error_at;
 			const lastOkAt = daemonState?.last_ok_at;
@@ -3438,6 +4723,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 					last_error_at: retentionState?.last_error_at ?? null
 				},
 				semantic_index: semanticIndex,
+				coordinator_enrollment_reconciliation_issues: enrollmentIssueStatus,
 				peer_count: Number(peerCountRow?.total ?? 0),
 				last_sync_at: lastSyncRow?.last_sync_at ?? null,
 				daemon_state: daemonStateValue,
@@ -3510,6 +4796,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const legacyDevices = traceSync("legacyDevices", () => store.claimableLegacyDeviceIds());
 			const legacyReview = traceSync("legacySharedReview", () => legacySharedReviewSummary(store));
 			const sharingReview = traceSync("sharingReview", () => store.sharingReviewSummary(project));
+			const recipientPolicyReconciliation = traceSync("recipientPolicyReconciliation", () => listRecipientPolicyReconciliationStatus(store));
 			let joinRequests = [];
 			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
 				joinRequests = await listCoordinatorJoinRequests(config);
@@ -3545,6 +4832,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				legacy_devices: legacyDevices,
 				legacy_shared_review: legacyReview,
 				sharing_review: sharingReview,
+				recipient_policy_reconciliation: recipientPolicyReconciliation,
 				coordinator
 			};
 			if (includeJoinRequests && showDiag) responsePayload.join_requests = joinRequests;
@@ -3698,7 +4986,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		else peerIds = store.db.prepare("SELECT peer_device_id FROM sync_peers").all().map((row) => String(row.peer_device_id ?? "").trim()).filter(Boolean);
 		const items = [];
 		for (const peerId of peerIds) {
-			const result = await runSyncPass(store.db, peerId, { scanner: store.scanner });
+			const result = await runSyncPass(store.db, peerId, {
+				keysDir: syncKeysDir(),
+				scanner: store.scanner
+			});
 			items.push({
 				peer_device_id: peerId,
 				...result,
@@ -3747,18 +5038,245 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			local_default_scope_id: LOCAL_DEFAULT_SCOPE_ID
 		});
 	});
-	app.get("/api/sync/projects", (c) => {
+	app.get("/api/sync/recipient-policy/v1/projection", (c) => {
+		const store = getStore();
+		return c.json(listLegacyRecipientPolicyProjections(store.db, {
+			localActorId: store.actorId,
+			localDeviceId: store.deviceId
+		}));
+	});
+	app.get("/api/sync/recipient-policy/v1/review", (c) => {
+		const store = getStore();
+		ensureLocalActorRecord(store);
+		return c.json(listRecipientPolicyReview(store.db, {
+			localActorId: store.actorId,
+			localDeviceId: store.deviceId
+		}));
+	});
+	app.get("/api/sync/recipient-policy/v1/intent", (c) => {
+		const store = getStore();
+		return c.json(listRecipientPolicyIntent(store.db));
+	});
+	app.get("/api/sync/recipient-policy/v1/reconciliation-status", (c) => {
+		return c.json(listRecipientPolicyReconciliationStatus(getStore()));
+	});
+	app.post("/api/sync/recipient-policy/v1/edges/preview", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		try {
+			return c.json(previewRecipientPolicyEdges(store.db, body));
+		} catch (error) {
+			if (error instanceof RecipientPolicyEdgeRequestError) {
+				if (error.status === "not_found") return c.json({ error: error.errorCode }, 404);
+				return c.json({ error: error.errorCode }, 400);
+			}
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "edge_preview_busy" }, 503);
+			}
+			return c.json({ error: "edge_preview_failed" }, 500);
+		}
+	});
+	app.post("/api/sync/recipient-policy/v1/edges/commit", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		try {
+			const result = commitRecipientPolicyEdges(store.db, body);
+			if (result.status === "invalid") return c.json(result, 400);
+			if (result.status === "not_found") return c.json(result, 404);
+			if (result.status === "stale" || result.status === "conflict") return c.json(result, 409);
+			return c.json(result);
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "edge_commit_busy" }, 503);
+			}
+			return c.json({
+				version: 1,
+				status: "conflict",
+				reviewedPolicyDigest: "",
+				errorCode: "edge_commit_conflict",
+				outcomes: [],
+				writeCount: 0,
+				idempotent: false
+			}, 409);
+		}
+	});
+	app.post("/api/sync/recipient-policy/v1/invites/preview", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body) return c.json({ error: "request_invalid" }, 400);
+		try {
+			const kind = recipientInviteKind(body.kind ?? body.invite_kind);
+			const unavailable = recipientInviteCreationUnavailable(coordinatorAdminStatusPayload(readCoordinatorSyncConfig()), kind);
+			if (unavailable) return c.json(unavailable.body, unavailable.httpStatus);
+			const targetId = kind === "team_member" ? optionalViewerStrictString(body, "policy_team_id") : optionalViewerStrictString(body, "target_identity_id");
+			if (!targetId) throw new Error("recipient_invite_metadata_invalid");
+			if (kind === "add_device" && targetId !== store.actorId) throw new Error("invite_identity_conflict");
+			const preview = recipientInviteOnboardingPreview(store, body, recipientInvitePreviewId(kind, targetId));
+			return c.json({
+				kind,
+				preview
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "recipient_invite_invalid" }, 400);
+		}
+	});
+	app.post("/api/sync/recipient-policy/v1/invites", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body) return c.json({ error: "request_invalid" }, 400);
+		try {
+			const kind = recipientInviteKind(body.kind ?? body.invite_kind);
+			const config = readCoordinatorSyncConfig();
+			const status = coordinatorAdminStatusPayload(config);
+			const unavailable = recipientInviteCreationUnavailable(status, kind);
+			if (unavailable) return c.json(unavailable.body, unavailable.httpStatus);
+			const targetId = kind === "team_member" ? optionalViewerStrictString(body, "policy_team_id") : optionalViewerStrictString(body, "target_identity_id");
+			if (!targetId) throw new Error("recipient_invite_metadata_invalid");
+			if (kind === "add_device" && targetId !== store.actorId) throw new Error("invite_identity_conflict");
+			const preview = recipientInviteOnboardingPreview(store, body, recipientInvitePreviewId(kind, targetId));
+			const reviewedDigest = optionalViewerStrictString(body, "reviewed_onboarding_digest");
+			if (!reviewedDigest) throw new Error("reviewed_onboarding_digest_required");
+			if (reviewedDigest !== preview.reviewedOnboardingDigest) return c.json({
+				error: "reviewed_onboarding_stale",
+				preview
+			}, 409);
+			const reviewedIntent = recipientInviteReviewedIntent(store, kind, targetId, preview);
+			const reviewedPreviewDigest = await recipientReviewedIntentDigest(reviewedIntent);
+			const groupId = resolveCoordinatorAdminGroup(optionalViewerString(body, "group_id"), status);
+			const ttlHours = parseInviteTtlHours(body.ttl_hours);
+			if (!groupId) throw new Error("group_id_required");
+			if (ttlHours == null) throw new Error("ttl_hours_invalid");
+			const result = kind === "team_member" || status.has_admin_secret ? await coordinatorCreateInviteAction({
+				groupId,
+				coordinatorUrl: config.syncCoordinatorUrl || null,
+				policy: "auto_admit",
+				ttlHours,
+				createdBy: store.actorId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null,
+				inviteKind: kind,
+				policyTeamId: kind === "team_member" ? targetId : null,
+				targetIdentityId: kind === "add_device" ? targetId : null,
+				inviterDeviceId: kind === "add_device" ? preview.binding.deviceId : null,
+				reviewedPreviewDigest,
+				reviewedIntent
+			}) : await coordinatorCreateAddDeviceInviteAction({
+				groupId,
+				coordinatorUrl: config.syncCoordinatorUrl || null,
+				ttlHours,
+				deviceId: preview.binding.deviceId,
+				keysDir: syncKeysDir(),
+				remoteUrl: config.syncCoordinatorUrl || null,
+				reviewedPreviewDigest,
+				reviewedIntent
+			});
+			return c.json({
+				ok: true,
+				kind,
+				preview,
+				invite: result
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "recipient_invite_failed" }, 400);
+		}
+	});
+	app.post("/api/sync/recipient-policy/v1/migrate", async (c) => {
+		const store = getStore();
+		const value = await parseViewerJsonBody(c);
+		if (!value || typeof value !== "object" || Array.isArray(value)) return c.json({ error: "request_invalid" }, 400);
+		const body = value;
+		if (Object.keys(body).some((key) => key !== "dryRun") || Object.hasOwn(body, "dryRun") && typeof body.dryRun !== "boolean") return c.json({ error: "request_invalid" }, 400);
+		return c.json(migrateRecipientPolicyIntent(store.db, {
+			localActorId: store.actorId,
+			localDeviceId: store.deviceId
+		}, { dryRun: body.dryRun === true }));
+	});
+	const parseReviewRequest = (value) => {
+		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+		const body = value;
+		const allowedKeys = new Set([
+			"reviewItemId",
+			"sourceFingerprint",
+			"decision",
+			"decisionInput"
+		]);
+		if (Object.keys(body).some((key) => !allowedKeys.has(key)) || typeof body.reviewItemId !== "string" || typeof body.sourceFingerprint !== "string" || typeof body.decision !== "string") return null;
+		return {
+			reviewItemId: body.reviewItemId,
+			sourceFingerprint: body.sourceFingerprint,
+			decision: body.decision,
+			...Object.hasOwn(body, "decisionInput") ? { decisionInput: body.decisionInput } : {}
+		};
+	};
+	app.post("/api/sync/recipient-policy/v1/review/resolve", async (c) => {
+		const store = getStore();
+		const request = parseReviewRequest(await parseViewerJsonBody(c));
+		if (!request) return c.json({ error: "request_invalid" }, 400);
+		ensureLocalActorRecord(store);
+		const result = resolveRecipientPolicyReview(store.db, {
+			localActorId: store.actorId,
+			localDeviceId: store.deviceId
+		}, request);
+		if (result.status === "stale" || result.status === "conflict") return c.json(result, 409);
+		if (result.status === "not_found") return c.json(result, 404);
+		if (result.status === "invalid") return c.json(result, 400);
+		return c.json(result);
+	});
+	app.post("/api/sync/recipient-policy/v1/review/resolve-bulk", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body || !Array.isArray(body.requests) || body.requests.length === 0 || body.requests.length > 100) return c.json({ error: "request_invalid" }, 400);
+		const requests = body.requests.map(parseReviewRequest);
+		if (requests.some((request) => request == null)) return c.json({ error: "request_invalid" }, 400);
+		ensureLocalActorRecord(store);
+		const result = resolveRecipientPolicyReviewBulk(store.db, {
+			localActorId: store.actorId,
+			localDeviceId: store.deviceId
+		}, requests);
+		return c.json(result, result.results.some((item) => item.status !== "applied") ? 207 : 200);
+	});
+	app.get("/api/sync/projects", async (c) => {
 		const store = getStore();
 		const limit = Math.max(1, queryInt(c.req.query("limit"), 50));
 		const offset = Math.max(0, queryInt(c.req.query("offset"), 0));
-		return c.json(listProjectScopeInventory(store.db, {
+		const inventory = listProjectScopeInventory(store.db, {
 			identitySource: c.req.query("identity_source"),
 			limit,
 			offset,
 			query: c.req.query("q"),
 			scopeId: c.req.query("scope_id"),
 			status: c.req.query("status")
-		}));
+		});
+		const operations = await shareOperationReadModels(store, void 0, false);
+		const operationById = new Map(operations.map((operation) => [operation.operation_id, operation]));
+		const sharingByProject = /* @__PURE__ */ new Map();
+		const reviewed = store.db.prepare(`SELECT p.operation_id, p.canonical_project_identity
+			 FROM share_operation_projects p
+			 JOIN share_operations o ON o.operation_id = p.operation_id
+			 WHERE o.inviter_actor_id = ? ORDER BY o.created_at, p.ordinal`).all(store.actorId);
+		for (const item of reviewed) {
+			const operation = operationById.get(item.operation_id);
+			if (!operation) continue;
+			const current = sharingByProject.get(item.canonical_project_identity) ?? [];
+			current.push({
+				person: operation.person,
+				lifecycle: {
+					state: operation.lifecycle.state,
+					label: operation.lifecycle.label,
+					explanation: operation.lifecycle.explanation
+				}
+			});
+			sharingByProject.set(item.canonical_project_identity, current);
+		}
+		return c.json({
+			...inventory,
+			projects: inventory.projects.map((project) => ({
+				...project,
+				sharing: sharingByProject.get(project.workspace_identity) ?? []
+			}))
+		});
 	});
 	app.post("/api/sync/projects/reassign-project", async (c) => {
 		const store = getStore();
@@ -3808,6 +5326,175 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: message }, message.includes("not found") ? 404 : 400);
 		}
 	});
+	app.post("/api/sync/project-invites/preview", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body) return c.json({ error: "invalid_json" }, 400);
+		try {
+			assertProjectInviteBody(body, false);
+			const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+			const { plan } = projectInvitePlan(store, body, createdAt, new Date(new Date(createdAt).getTime() + PROJECT_INVITE_TTL_HOURS * 3600 * 1e3).toISOString());
+			return c.json(projectInvitePreview(plan));
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "project_invite_invalid" }, 400);
+		}
+	});
+	app.post("/api/sync/project-invites", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body) return c.json({ error: "invalid_json" }, 400);
+		try {
+			assertProjectInviteBody(body, true);
+			const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+			const { plan, config } = projectInvitePlan(store, body, createdAt, new Date(new Date(createdAt).getTime() + PROJECT_INVITE_TTL_HOURS * 3600 * 1e3).toISOString());
+			if (String(body.reviewed_project_set_digest).trim() !== plan.reviewedProjectSetDigest) return c.json({ error: "reviewed_project_set_changed" }, 409);
+			const existingState = (() => {
+				try {
+					return store.db.prepare("SELECT state FROM share_operations WHERE operation_id = ?").pluck().get(plan.operationId);
+				} catch {
+					return;
+				}
+			})();
+			if (existingState && existingState !== "waiting_for_acceptance") return c.json({ error: "operation_state_invalid" }, 409);
+			const result = await coordinatorCreateInviteAction({
+				groupId: plan.coordinatorGroupId,
+				coordinatorUrl: config.syncCoordinatorUrl || null,
+				policy: "auto_admit",
+				ttlHours: PROJECT_INVITE_TTL_HOURS,
+				createdBy: store.actorId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null,
+				operationId: plan.operationId,
+				reviewedProjectSetDigest: plan.reviewedProjectSetDigest,
+				inviterActorId: plan.inviterActorId,
+				inviterDisplayName: store.actorDisplayName,
+				inviterDeviceId: plan.inviterDeviceIds[0],
+				pendingPersonId: plan.personId,
+				projectSummaries: plan.projects.map((project) => ({
+					display_name: project.displayName,
+					existing_memory_count: project.existingMemoryCount
+				})),
+				projectIntent: plan.projects.map((project) => ({
+					canonical_identity: project.canonicalIdentity,
+					display_name: project.displayName,
+					existing_memory_count: project.existingMemoryCount
+				}))
+			});
+			if (String(result.operation_id ?? "").trim() !== plan.operationId || String(result.reviewed_project_set_digest ?? "").trim() !== plan.reviewedProjectSetDigest) throw new Error("coordinator_invite_intent_mismatch");
+			const payload = result.payload;
+			if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("coordinator_invite_payload_missing");
+			const token = String(payload.token ?? "").trim();
+			const expiresAt = String(payload.expires_at ?? "").trim();
+			const link = String(result.link ?? "").trim();
+			const encoded = String(result.encoded ?? "").trim();
+			if (!token || !expiresAt || !link || !encoded) throw new Error("coordinator_invite_payload_invalid");
+			const persistedPlan = {
+				...plan,
+				inviteExpiresAt: new Date(expiresAt).toISOString()
+			};
+			persistShareOperation(store.db, persistedPlan, {
+				inviteId: String(result.invite_id ?? "").trim() || null,
+				tokenDigest: inviteTokenDigest(token)
+			});
+			return c.json({
+				ok: true,
+				...projectInvitePreview(persistedPlan),
+				invite: {
+					link,
+					encoded,
+					expires_at: persistedPlan.inviteExpiresAt
+				}
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "project_invite_failed" }, 400);
+		}
+	});
+	app.get("/api/sync/project-invites/:operationId", async (c) => {
+		const operationId = String(c.req.param("operationId") ?? "").trim();
+		if (!/^share_[a-f0-9]{40}$/u.test(operationId)) return c.json({ error: "operation_id_invalid" }, 400);
+		try {
+			const { payload } = await coordinatorProjectInvitePayload(operationId);
+			return c.json(payload.state === "accepted" ? {
+				...payload,
+				state: "pending_setup"
+			} : payload);
+		} catch (error) {
+			const mapped = projectInviteOwnerErrorResponse(error, {
+				code: "operation_read_failed",
+				status: 400
+			});
+			return c.json({ error: mapped.code }, mapped.status);
+		}
+	});
+	app.post("/api/sync/project-invites/:operationId/reconcile", async (c) => {
+		const store = getStore();
+		const operationId = String(c.req.param("operationId") ?? "").trim();
+		if (!/^share_[a-f0-9]{40}$/u.test(operationId)) return c.json({ error: "operation_id_invalid" }, 400);
+		try {
+			const result = await reconcileProjectInviteAcceptance(store, operationId);
+			return c.json({
+				ok: true,
+				operation_id: operationId,
+				reconciled: result.accepted,
+				state: result.accepted ? "pending_setup" : "waiting_for_acceptance"
+			});
+		} catch (error) {
+			const mapped = projectInviteOwnerErrorResponse(error, {
+				code: "operation_reconcile_failed",
+				status: 409
+			});
+			return c.json({ error: mapped.code }, mapped.status);
+		}
+	});
+	app.get("/api/sync/share-operations", async (c) => {
+		const items = await shareOperationReadModels(getStore(), void 0, false);
+		return c.json({ items });
+	});
+	app.get("/api/sync/share-operations/:operationId", async (c) => {
+		const store = getStore();
+		const operationId = String(c.req.param("operationId") ?? "").trim();
+		if (!/^share_[a-f0-9]{40}$/u.test(operationId)) return c.json({ error: "operation_id_invalid" }, 400);
+		const [item] = await shareOperationReadModels(store, operationId);
+		return item ? c.json(item) : c.json({ error: "operation_not_found" }, 404);
+	});
+	const advanceProjectShare = async (c) => {
+		const store = getStore();
+		const operationId = String(c.req.param("operationId") ?? "").trim();
+		if (!/^share_[a-f0-9]{40}$/u.test(operationId)) return c.json({ error: "operation_id_invalid" }, 400);
+		try {
+			const advanced = await advanceProjectShareOperation(store, operationId);
+			if (!advanced.advanced) return c.json({ error: advanced.state === "cancelled" ? "operation_superseded" : "invitation_not_accepted" }, 409);
+			const [operation] = await shareOperationReadModels(store, operationId);
+			return c.json({
+				ok: true,
+				operation
+			});
+		} catch (error) {
+			const code = error instanceof Error ? error.message : "provisioning_failed";
+			if (store.db.prepare("SELECT state FROM share_operations WHERE operation_id = ?").pluck().get(operationId) === "cancelled") return c.json({ error: "operation_superseded" }, 409);
+			return c.json({ error: code }, code === "operation_not_found" ? 404 : 409);
+		}
+	};
+	app.post("/api/sync/share-operations/:operationId/advance", advanceProjectShare);
+	app.post("/api/sync/project-invites/:operationId/provision", async (c) => {
+		const store = getStore();
+		const operationId = String(c.req.param("operationId") ?? "").trim();
+		if (!/^share_[a-f0-9]{40}$/u.test(operationId)) return c.json({ error: "operation_id_invalid" }, 400);
+		try {
+			const plan = await executeProjectShareProvisioning(store, operationId);
+			if (plan.superseded) return c.json({ error: "operation_superseded" }, 409);
+			return c.json({
+				ok: true,
+				operation_id: operationId,
+				state: "active",
+				plan
+			});
+		} catch (error) {
+			const code = error instanceof Error ? error.message : "provisioning_failed";
+			if (store.db.prepare("SELECT state FROM share_operations WHERE operation_id = ?").pluck().get(operationId) === "cancelled") return c.json({ error: "operation_superseded" }, 409);
+			return c.json({ error: code }, code === "operation_not_found" ? 404 : 409);
+		}
+	});
 	app.post("/api/sync/legacy-shared-review/reassign", async (c) => {
 		const store = getStore();
 		const body = await parseViewerJsonBody(c);
@@ -4173,6 +5860,73 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
 	});
+	app.post("/api/sync/invites/inspect", async (c) => {
+		const store = getStore();
+		const body = await parseViewerJsonBody(c);
+		if (!body || typeof body.invite !== "string") return c.json({ error: "invite_invalid" }, 400);
+		try {
+			const payload = decodeInvitePayload(extractInvitePayload(body.invite));
+			const recipientInvite = payload.kind === "team_member" || payload.kind === "add_device";
+			if (recipientInvite) ensureStableStoreDeviceIdentity(store);
+			else ensureStableStoreIdentity(store);
+			if (!payload.operation_id && !recipientInvite) return c.json({ kind: "legacy_team_invite" });
+			const [status, inspected] = await requestJson("POST", `${buildBaseUrl(payload.coordinator_url)}/v1/invites/inspect`, {
+				body: { token: payload.token },
+				timeoutS: 10
+			});
+			if (status < 200 || status >= 300) return c.json({ error: recipientInvite ? safeRecipientInviteError(inspected?.error) : String(inspected?.error ?? "invite_invalid") }, status === 410 ? 410 : 400);
+			const config = readCodememConfigFile();
+			const identityId = recipientInvite ? recipientInviteAuthoritativeIdentityId({
+				kind: payload.kind,
+				assigned_identity_id: inspected?.assigned_identity_id,
+				target_identity_id: inspected?.target_identity_id
+			}) : store.actorId;
+			const expectedTarget = payload.kind === "team_member" ? String(inspected?.policy_team_id ?? "").trim() : String(inspected?.target_identity_id ?? "").trim();
+			if (recipientInvite) {
+				if (String(inspected?.kind ?? "").trim() !== payload.kind || !expectedTarget || String(inspected?.reviewed_preview_digest ?? "").trim() !== String(payload.reviewed_preview_digest ?? "").trim() || payload.kind === "team_member" && expectedTarget !== payload.policy_team_id || payload.kind === "team_member" && (identityId !== String(payload.assigned_identity_id ?? "").trim() || !identityId) || payload.kind === "add_device" && expectedTarget !== payload.target_identity_id) return c.json({ error: "recipient_invite_intent_mismatch" }, 409);
+				if (inspected?.reviewed_intent == null) return c.json({ error: "recipient_invite_review_unavailable" }, 409);
+				let reviewedIntent;
+				try {
+					reviewedIntent = await verifyRecipientReviewedIntent(inspected.reviewed_intent, {
+						target: payload.kind === "team_member" ? {
+							kind: "team_member",
+							policyTeamId: expectedTarget
+						} : {
+							kind: "add_device",
+							targetIdentityId: expectedTarget
+						},
+						digest: String(payload.reviewed_preview_digest ?? "").trim()
+					});
+				} catch {
+					return c.json({ error: "recipient_invite_intent_mismatch" }, 409);
+				}
+				const preview = recipientInviteOnboardingPreviewFromReviewedIntent(store, {
+					kind: payload.kind,
+					policy_team_id: payload.kind === "team_member" ? expectedTarget : null,
+					assigned_identity_id: payload.kind === "team_member" ? identityId : null,
+					target_identity_id: payload.kind === "add_device" ? identityId : null,
+					device_name: optionalViewerString(body, "device_name")
+				}, String(payload.token), reviewedIntent);
+				return c.json({
+					...inspected,
+					recipient_name: reviewedIntent.journey === "add_device" ? reviewedIntent.targetIdentity.displayName : store.actorDisplayName,
+					device_name: preview.binding.deviceDisplayName,
+					onboarding: preview
+				});
+			}
+			return c.json({
+				...inspected,
+				recipient_name: store.actorDisplayName,
+				device_name: friendlyDeviceName({
+					explicitName: String(config.sync_device_name ?? ""),
+					osName: hostname(),
+					fallbackSeed: store.deviceId
+				})
+			});
+		} catch (error) {
+			return c.json({ error: safeRecipientInviteError(error) }, 400);
+		}
+	});
 	app.post("/api/sync/invites/import", async (c) => {
 		const store = getStore();
 		let body;
@@ -4205,16 +5959,49 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		} catch (error) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
+		let projectInvite = false;
+		let recipientInvite = false;
 		try {
+			const decoded = decodeInvitePayload(extractInvitePayload(rawValue));
+			projectInvite = Boolean(decoded.operation_id);
+			recipientInvite = decoded.kind === "team_member" || decoded.kind === "add_device";
+			if (recipientInvite) ensureStableStoreDeviceIdentity(store);
+			else ensureStableStoreIdentity(store);
+			const reviewedOnboardingDigest = typeof body.reviewed_onboarding_digest === "string" ? body.reviewed_onboarding_digest.trim() : "";
+			if (recipientInvite && !reviewedOnboardingDigest) return c.json({ error: "reviewed_onboarding_digest_required" }, 400);
 			const result = await coordinatorImportInviteAction({
 				inviteValue: rawValue,
-				dbPath: store.dbPath
+				dbPath: store.dbPath,
+				recipientActorId: recipientInvite ? null : store.actorId,
+				recipientDisplayName: typeof body.recipient_name === "string" ? body.recipient_name : store.actorDisplayName,
+				deviceDisplayName: typeof body.device_name === "string" ? body.device_name : null,
+				reviewedOnboardingDigest: reviewedOnboardingDigest || null
 			});
+			const type = recipientInvite ? "recipient_onboarding" : projectInvite ? "project_share" : "team_join";
+			if (recipientInvite) {
+				const persistedIdentityId = String(result.identity_id ?? "").trim();
+				if (!store.refreshPersistedLocalIdentity(persistedIdentityId)) return c.json({
+					...result,
+					type,
+					setup_state: "restart_required",
+					restart_required: true,
+					detail: "The invitation was accepted and the reviewed Identity was persisted, but this process could not safely adopt it. Restart codemem before continuing."
+				}, 200);
+			}
+			if ((projectInvite || recipientInvite) && getSyncRuntimeStatus?.()?.phase === "disabled") return c.json({
+				...result,
+				type,
+				setup_state: "restart_required",
+				restart_required: true,
+				detail: projectInvite ? "The invitation was accepted and sync was enabled. Restart codemem to start the sync service; Project setup remains pending until the first sync finishes." : "The invitation was accepted and sync was enabled. Restart codemem to start the sync service and receive the reviewed Projects."
+			}, 200);
 			return c.json({
 				...result,
-				type: "team_join"
+				type
 			});
 		} catch (error) {
+			if (projectInvite) return c.json(projectInviteAcceptanceFailure(error), 400);
+			if (recipientInvite) return c.json({ error: safeRecipientInviteError(error) }, 400);
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
 	});
@@ -4659,17 +6446,34 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			error: "membership_epoch must be number",
 			status
 		}, 400);
+		const role = optionalViewerString(body, "role");
+		const coordinatorId = optionalViewerString(body, "coordinator_id");
+		const manifestIssuerDeviceId = optionalViewerString(body, "manifest_issuer_device_id");
+		const manifestHash = optionalViewerString(body, "manifest_hash");
+		const signedManifestJson = optionalViewerString(body, "signed_manifest_json");
+		const effectId = optionalViewerString(body, "effect_id") ?? coordinatorAdminMembershipEffectId("grant", randomUUID(), {
+			groupId,
+			scopeId,
+			deviceId,
+			role,
+			membershipEpoch,
+			coordinatorId,
+			manifestIssuerDeviceId,
+			manifestHash,
+			signedManifestJson
+		});
 		try {
 			const membership = await coordinatorGrantScopeMembershipAction({
+				effectId,
 				groupId,
 				scopeId,
 				deviceId,
-				role: optionalViewerString(body, "role"),
+				role,
 				membershipEpoch,
-				coordinatorId: optionalViewerString(body, "coordinator_id"),
-				manifestIssuerDeviceId: optionalViewerString(body, "manifest_issuer_device_id"),
-				manifestHash: optionalViewerString(body, "manifest_hash"),
-				signedManifestJson: optionalViewerString(body, "signed_manifest_json"),
+				coordinatorId,
+				manifestIssuerDeviceId,
+				manifestHash,
+				signedManifestJson,
 				remoteUrl: config.syncCoordinatorUrl || null,
 				adminSecret: config.syncCoordinatorAdminSecret || null
 			});
@@ -4718,14 +6522,25 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			error: "membership_epoch must be number",
 			status
 		}, 400);
+		const manifestHash = optionalViewerString(body, "manifest_hash");
+		const signedManifestJson = optionalViewerString(body, "signed_manifest_json");
+		const effectId = optionalViewerString(body, "effect_id") ?? coordinatorAdminMembershipEffectId("revoke", randomUUID(), {
+			groupId,
+			scopeId,
+			deviceId,
+			membershipEpoch,
+			manifestHash,
+			signedManifestJson
+		});
 		try {
 			if (!await coordinatorRevokeScopeMembershipAction({
+				effectId,
 				groupId,
 				scopeId,
 				deviceId,
 				membershipEpoch,
-				manifestHash: optionalViewerString(body, "manifest_hash"),
-				signedManifestJson: optionalViewerString(body, "signed_manifest_json"),
+				manifestHash,
+				signedManifestJson,
 				remoteUrl: config.syncCoordinatorUrl || null,
 				adminSecret: config.syncCoordinatorAdminSecret || null
 			})) return c.json({
@@ -4878,6 +6693,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 					store: getStore(),
 					config,
 					groupId: result.group_id,
+					requestId,
 					deviceId: result.device_id
 				});
 			} catch (grantError) {
@@ -5519,6 +7335,6 @@ function createSyncApp(opts) {
 	return app;
 }
 //#endregion
-export { VERSION, closeStore, createApp, createSyncApp, getStore };
+export { VERSION, advancePendingProjectShares, advanceProjectShareOperation, closeStore, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects };
 
 //# sourceMappingURL=index.js.map