@codemem/server 0.40.0-alpha.1 → 0.40.0

package/dist/index.d.ts

@@ -11,8 +11,8 @@ import type { ObserverClient } from "@codemem/core";
 import { MemoryStore, type RawEventSweeper, VERSION } from "@codemem/core";
 import { Hono } from "hono";
 import { type InMemoryRequestRateLimiter } from "./request-rate-limit.js";
-export type { AdvancePendingProjectSharesResult, AdvanceProjectShareOperationResult, RecipientPolicyReconciliationReadModel, RecipientPolicyReconciliationReadState, ReconcileRecipientPolicyProjectsResult, } from "./routes/sync.js";
-export { advancePendingProjectShares, advanceProjectShareOperation, createRecipientPolicyReconcilerEffects, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileRecipientPolicyProjects, } from "./routes/sync.js";
+export type { AdvancePendingProjectSharesResult, AdvanceProjectShareOperationResult, RecipientPolicyReconciliationReadModel, RecipientPolicyReconciliationReadState, ReconcileConfiguredCoordinatorEnrollmentResult, ReconcileRecipientPolicyProjectsResult, } from "./routes/sync.js";
+export { advancePendingProjectShares, advanceProjectShareOperation, createRecipientPolicyReconcilerEffects, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, } from "./routes/sync.js";
 export { VERSION };
 /** Get (or create) the shared store instance. Exported so the sweeper can share it. */
 export declare function getStore(): MemoryStore;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAiB,OAAO,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,yBAAyB,CAAC;AAQjC,YAAY,EACX,iCAAiC,EACjC,kCAAkC,EAClC,sCAAsC,EACtC,sCAAsC,EACtC,sCAAsC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,2BAA2B,EAC3B,4BAA4B,EAC5B,sCAAsC,EACtC,uCAAuC,EACvC,mCAAmC,EACnC,gCAAgC,GAChC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,CAAC;AAKnB,uFAAuF;AACvF,wBAAgB,QAAQ,IAAI,WAAW,CAKtC;AAED,mDAAmD;AACnD,wBAAgB,UAAU,IAAI,IAAI,CAGjC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,YAAY,CAAC,EAAE,MAAM,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,oBAAoB,CAAC,EAAE;QACtB,OAAO,CAAC,EAAE,0BAA0B,CAAC;QACrC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,oBAAoB,CAAC,EAAE,MAAM;QAC5B,KAAK,EACF,UAAU,GACV,SAAS,GACT,UAAU,GACV,OAAO,GACP,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,IAAI,CAAC;QACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,GAAG,IAAI,CAAC;CACT;AAED,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,8EA8D1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,UAAU,8EA8B9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAiB,OAAO,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,yBAAyB,CAAC;AAQjC,YAAY,EACX,iCAAiC,EACjC,kCAAkC,EAClC,sCAAsC,EACtC,sCAAsC,EACtC,8CAA8C,EAC9C,sCAAsC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,2BAA2B,EAC3B,4BAA4B,EAC5B,sCAAsC,EACtC,uCAAuC,EACvC,mCAAmC,EACnC,wCAAwC,EACxC,gCAAgC,GAChC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,CAAC;AAKnB,uFAAuF;AACvF,wBAAgB,QAAQ,IAAI,WAAW,CAKtC;AAED,mDAAmD;AACnD,wBAAgB,UAAU,IAAI,IAAI,CAGjC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,YAAY,CAAC,EAAE,MAAM,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,oBAAoB,CAAC,EAAE;QACtB,OAAO,CAAC,EAAE,0BAA0B,CAAC;QACrC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,oBAAoB,CAAC,EAAE,MAAM;QAC5B,KAAK,EACF,UAAU,GACV,SAAS,GACT,UAAU,GACV,OAAO,GACP,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,IAAI,CAAC;QACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,GAAG,IAAI,CAAC;CACT;AAED,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,8EA8D1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,UAAU,8EA8B9C"}

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, inviteTokenDigest, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -202,6 +202,8 @@ var ALLOWED_KEYS = [
 	"observer_tier_routing_enabled",
 	"observer_simple_model",
 	"observer_simple_temperature",
+	"observer_reasoning_effort",
+	"observer_reasoning_summary",
 	"observer_rich_model",
 	"observer_rich_temperature",
 	"observer_rich_reasoning_effort",
@@ -403,7 +405,7 @@ function validateAndApplyUpdate(configData, key, value, providers) {
 		configData[key] = value;
 		return null;
 	}
-	if (key === "observer_base_url" || key === "observer_model" || key === "observer_simple_model" || key === "observer_rich_model" || key === "observer_rich_reasoning_effort" || key === "observer_rich_reasoning_summary" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
+	if (key === "observer_base_url" || key === "observer_model" || key === "observer_simple_model" || key === "observer_reasoning_effort" || key === "observer_reasoning_summary" || key === "observer_rich_model" || key === "observer_rich_reasoning_effort" || key === "observer_rich_reasoning_summary" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
 		if (typeof value !== "string") return `${key} must be string`;
 		const trimmed = value.trim();
 		if (!trimmed) delete configData[key];
@@ -2416,7 +2418,8 @@ async function shareOperationReadModels(store, operationId, includeInviteLinks =
 			o.recipient_actor_id, o.recipient_display_name, o.recipient_device_id,
 			o.recipient_device_display_name, o.invite_expires_at, o.acceptance_consumed_at,
 			o.created_at, o.updated_at, a.display_name AS actor_display_name,
-			p.name AS peer_display_name, p.last_sync_at AS device_last_seen_at
+			p.name AS peer_display_name, p.last_seen_at AS device_last_seen_at,
+			p.last_sync_at AS device_last_reached_at
 		 FROM share_operations o
 		 LEFT JOIN actors a ON a.actor_id = o.person_id
 		 LEFT JOIN sync_peers p ON p.peer_device_id = o.recipient_device_id
@@ -2448,6 +2451,7 @@ async function shareOperationReadModels(store, operationId, includeInviteLinks =
 		const deviceName = row.recipient_device_display_name || row.peer_display_name;
 		const lifecycle = projectShareLifecycle({
 			deviceLastSeenAt: row.device_last_seen_at,
+			deviceLastReachedAt: row.device_last_reached_at,
 			deviceName,
 			inviteLink,
 			now,
@@ -2674,15 +2678,44 @@ async function advancePendingProjectShares(store, options = {}) {
 	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
 	const waitingAcceptanceRetryBefore = (/* @__PURE__ */ new Date(maintenanceNow.getTime() - AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS)).toISOString();
 	const waitingRetryBefore = (/* @__PURE__ */ new Date(maintenanceNow.getTime() - AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS)).toISOString();
-	const rows = store.db.prepare(`SELECT operation_id FROM share_operations
-		 WHERE inviter_actor_id = ?
-		 AND state IN (${placeholders})
-		 AND (state <> 'waiting_for_acceptance' OR updated_at <= ?)
-		 AND (state <> 'waiting_for_device' OR updated_at <= ?)
-		 ORDER BY CASE WHEN state IN ('accepted', 'provisioning', 'initial_sync') THEN 0 ELSE 1 END,
-			CASE WHEN state IN ('waiting_for_acceptance', 'waiting_for_device')
-				THEN updated_at ELSE created_at END ASC,
-			created_at ASC, operation_id ASC
+	const rows = store.db.prepare(`SELECT operation.operation_id FROM share_operations AS operation
+		 WHERE operation.inviter_actor_id = ?
+		 AND operation.state IN (${placeholders})
+		 AND (operation.state <> 'waiting_for_acceptance' OR operation.updated_at <= ?)
+		 AND (
+			operation.state <> 'waiting_for_device'
+			OR operation.updated_at <= ?
+			OR (
+				NOT EXISTS (
+					SELECT 1 FROM share_operation_steps AS step
+					WHERE step.operation_id = operation.operation_id
+					AND step.step_key = 'capability_preflight'
+					AND step.status <> 'completed'
+					AND (
+						step.status = 'running'
+						OR step.safe_error_code IN (
+							'waiting_for_device', 'device_offline', 'recipient_offline'
+						)
+					)
+				)
+				AND EXISTS (
+					SELECT 1 FROM sync_attempts AS attempt
+					WHERE attempt.id = (
+						SELECT latest.id FROM sync_attempts AS latest
+						WHERE latest.peer_device_id = operation.recipient_device_id
+						ORDER BY latest.started_at DESC, latest.id DESC
+						LIMIT 1
+					)
+					AND attempt.ok = 1
+					AND julianday(COALESCE(attempt.finished_at, attempt.started_at)) >
+						julianday(operation.updated_at)
+				)
+			)
+		 )
+		 ORDER BY CASE WHEN operation.state IN ('accepted', 'provisioning', 'initial_sync') THEN 0 ELSE 1 END,
+			CASE WHEN operation.state IN ('waiting_for_acceptance', 'waiting_for_device')
+				THEN operation.updated_at ELSE operation.created_at END ASC,
+			operation.created_at ASC, operation.operation_id ASC
 		 LIMIT ?`).all(store.actorId, ...AUTOMATIC_SHARE_OPERATION_STATES, waitingAcceptanceRetryBefore, waitingRetryBefore, limit);
 	const advanceOperation = options.advanceOperation ?? advanceProjectShareOperation;
 	const result = {
@@ -2776,6 +2809,61 @@ async function advancePendingProjectShares(store, options = {}) {
 	}
 	return result;
 }
+async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
+	const config = options.config ?? readCoordinatorSyncConfig();
+	const remoteUrl = config.syncCoordinatorUrl.trim();
+	const adminSecret = config.syncCoordinatorAdminSecret.trim();
+	if (!remoteUrl || !adminSecret || config.syncCoordinatorGroups.length === 0) return {
+		skipped: true,
+		groupsProcessed: 0,
+		failedGroups: 0,
+		devicesAdded: 0,
+		membershipsAdded: 0,
+		identitiesAdded: 0,
+		unchanged: 0,
+		issues: 0
+	};
+	const listDevices = options.listDevices ?? coordinatorListDevicesAction;
+	const listConsumedTeamInvites = options.listConsumedTeamInvites ?? coordinatorListConsumedTeamInvitesAction;
+	const reconcileSnapshot = options.reconcileSnapshot ?? ((input) => reconcileCoordinatorEnrollmentSnapshot(store.db, input));
+	const total = {
+		skipped: false,
+		groupsProcessed: 0,
+		failedGroups: 0,
+		devicesAdded: 0,
+		membershipsAdded: 0,
+		identitiesAdded: 0,
+		unchanged: 0,
+		issues: 0
+	};
+	for (const groupId of config.syncCoordinatorGroups) try {
+		const [enrollments, consumedTeamInvites] = await Promise.all([listDevices({
+			groupId,
+			remoteUrl,
+			adminSecret
+		}), listConsumedTeamInvites({
+			groupId,
+			remoteUrl,
+			adminSecret
+		})]);
+		const result = reconcileSnapshot({
+			coordinatorId: buildBaseUrl(remoteUrl),
+			groupId,
+			enrollments,
+			consumedTeamInvites,
+			localDeviceId: store.deviceId
+		});
+		total.groupsProcessed += 1;
+		total.devicesAdded += result.devicesAdded;
+		total.membershipsAdded += result.membershipsAdded;
+		total.identitiesAdded += result.identitiesAdded;
+		total.unchanged += result.unchanged;
+		total.issues += result.issues.length;
+	} catch {
+		total.failedGroups += 1;
+	}
+	return total;
+}
 var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
 var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
 var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
@@ -2802,9 +2890,37 @@ function recipientPolicySnapshotFingerprint(scopeId, scopeMembershipEpoch, membe
 	const canonical = memberships.toSorted((left, right) => left.deviceId.localeCompare(right.deviceId) || left.status.localeCompare(right.status) || left.membershipEpoch - right.membershipEpoch).map((membership) => `${membership.deviceId}\u0000${membership.status}\u0000${membership.membershipEpoch}`).join("
");
 	return `recipient-policy-coordinator-snapshot-v2:${createHash("sha256").update(`${scopeId}\u0000${scopeMembershipEpoch}\u0000${canonical}`).digest("hex")}`;
 }
+function recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt) {
+	const expiresAt = enrollment.presence_expires_at;
+	const capabilities = enrollment.presence_capabilities;
+	if (typeof expiresAt !== "string" || !capabilities) return null;
+	const expiresAtMs = Date.parse(expiresAt);
+	const observedAtMs = Date.parse(observedAt);
+	if (!Number.isFinite(expiresAtMs) || !Number.isFinite(observedAtMs) || new Date(expiresAtMs).toISOString() !== expiresAt || expiresAtMs <= observedAtMs || capabilities.sync_capability !== "scoped" || !Array.isArray(capabilities.sync_features) || !capabilities.sync_features.every((feature) => typeof feature === "string") || !capabilities.sync_features.includes("reassign_scope")) return null;
+	return expiresAtMs;
+}
+function recipientPolicyEnrollmentValueIsValid(value) {
+	return typeof value === "string" && value.length > 0 && value === value.trim();
+}
 function createRecipientPolicyReconcilerEffects(store, options = {}) {
 	const config = options.config ?? readCoordinatorSyncConfig();
 	const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const listDevices = options.listDevices ?? coordinatorListDevicesAction;
+	const listReviewedRecipientInviteEvidence = options.listReviewedRecipientInviteEvidence ?? coordinatorListReviewedRecipientInviteEvidenceAction;
+	const reviewedRecipientInviteEvidence = /* @__PURE__ */ new Map();
+	const loadReviewedRecipientInviteEvidence = (groupId) => {
+		let evidence = reviewedRecipientInviteEvidence.get(groupId);
+		if (!evidence) {
+			evidence = listReviewedRecipientInviteEvidence({
+				groupId,
+				remoteUrl: config.syncCoordinatorUrl || null,
+				adminSecret: config.syncCoordinatorAdminSecret || null
+			});
+			reviewedRecipientInviteEvidence.set(groupId, evidence);
+		}
+		return evidence;
+	};
+	const boundaryEnrollments = /* @__PURE__ */ new Map();
 	const target = (scopeId) => recipientPolicyCoordinatorBoundary(store, scopeId);
 	const coordinatorOptions = (scopeId) => {
 		const boundary = target(scopeId);
@@ -2836,7 +2952,7 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 			}).catch(() => {
 				throw new Error("recipient_policy_snapshot_not_fresh");
 			})).map((membership) => {
-				if (membership.status !== "active" && membership.status !== "revoked") throw new Error("recipient_policy_snapshot_invalid");
+				if (typeof membership.device_id !== "string" || membership.status !== "active" && membership.status !== "revoked") throw new Error("recipient_policy_snapshot_invalid");
 				const status = membership.status;
 				return {
 					deviceId: membership.device_id,
@@ -2853,10 +2969,56 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 				memberships: snapshotMemberships
 			};
 		},
-		probeCapability: (deviceId) => peerSupportsSyncRequirements(store, deviceId, {
-			scoped: true,
-			reassignScope: true
-		}),
+		listBoundaryEnrollments: async ({ scopeId }) => {
+			const targetOptions = coordinatorOptions(scopeId);
+			const observedAt = now();
+			const enrollments = await listDevices({
+				groupId: targetOptions.groupId,
+				includeDisabled: true,
+				remoteUrl: targetOptions.remoteUrl,
+				adminSecret: targetOptions.adminSecret
+			}).catch(() => {
+				throw new Error("recipient_policy_snapshot_not_fresh");
+			});
+			const presenceCapabilityExpiries = new Map(enrollments.map((enrollment) => [enrollment.device_id, recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt)]));
+			const mapped = enrollments.map((enrollment) => {
+				if (enrollment.group_id !== targetOptions.groupId || !recipientPolicyEnrollmentValueIsValid(enrollment.device_id) || !recipientPolicyEnrollmentValueIsValid(enrollment.public_key) || !recipientPolicyEnrollmentValueIsValid(enrollment.fingerprint) || fingerprintPublicKey(enrollment.public_key) !== enrollment.fingerprint || enrollment.enabled !== 0 && enrollment.enabled !== 1 || enrollment.identity_id !== null && !recipientPolicyEnrollmentValueIsValid(enrollment.identity_id)) throw new Error("recipient_policy_snapshot_invalid");
+				return {
+					deviceId: enrollment.device_id,
+					identityId: enrollment.identity_id,
+					publicKey: enrollment.public_key,
+					fingerprint: enrollment.fingerprint,
+					enabled: enrollment.enabled === 1
+				};
+			});
+			boundaryEnrollments.set(scopeId, new Map(mapped.flatMap((enrollment) => enrollment.enabled && enrollment.identityId !== null ? [[enrollment.deviceId, {
+				identityId: enrollment.identityId,
+				publicKey: enrollment.publicKey,
+				fingerprint: enrollment.fingerprint,
+				presenceCapabilityExpiresAtMs: presenceCapabilityExpiries.get(enrollment.deviceId) ?? null
+			}]] : [])));
+			return mapped;
+		},
+		probeCapability: async ({ deviceId, scopeId }) => {
+			if (deviceId === store.deviceId) return "supported";
+			const targetOptions = coordinatorOptions(scopeId);
+			const enrollment = boundaryEnrollments.get(scopeId)?.get(deviceId);
+			if (!enrollment) return "undetermined";
+			const peer = store.db.prepare("SELECT pinned_fingerprint, public_key FROM sync_peers WHERE peer_device_id = ?").get(deviceId);
+			if (peer) {
+				const peerPublicKey = String(peer.public_key ?? "").trim();
+				const peerFingerprint = String(peer.pinned_fingerprint ?? "").trim() || (peerPublicKey ? fingerprintPublicKey(peerPublicKey) : "");
+				if ((peerFingerprint || peerPublicKey) && (peerFingerprint !== enrollment.fingerprint || peerPublicKey && peerPublicKey !== enrollment.publicKey)) return "undetermined";
+			}
+			const observed = await peerSupportsSyncRequirements(store, deviceId, {
+				scoped: true,
+				reassignScope: true
+			});
+			if (observed !== "undetermined") return observed;
+			const observedAtMs = Date.parse(now());
+			if (enrollment.presenceCapabilityExpiresAtMs == null || !Number.isFinite(observedAtMs) || enrollment.presenceCapabilityExpiresAtMs <= observedAtMs) return "undetermined";
+			return (await loadReviewedRecipientInviteEvidence(targetOptions.groupId).catch(() => [])).some((invite) => invite.group_id === targetOptions.groupId && invite.bound_device_id === deviceId && invite.recipient_actor_id === enrollment.identityId && invite.bound_public_key === enrollment.publicKey && invite.bound_fingerprint === enrollment.fingerprint) ? "supported" : "undetermined";
+		},
 		revoke: async (input) => {
 			const targetOptions = coordinatorOptions(input.scopeId);
 			await coordinatorRevokeScopeMembershipAction({
@@ -2896,6 +3058,7 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 		refresh: async ({ scopeId }) => {
 			const boundary = target(scopeId);
 			if ((await refreshConfiguredScopeMembershipCache(store.db, config, { keysDir: syncKeysDir() })).groups.find((item) => item.groupId === boundary.groupId)?.status !== "refreshed") throw new Error("recipient_policy_effect_failed");
+			await refreshAuthorizedCoordinatorPeerTrust(store, config);
 		}
 	};
 }
@@ -3199,7 +3362,7 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		deviceId
 	};
 	const config = readCoordinatorSyncConfig();
-	if (!config.syncCoordinatorUrl || !config.syncCoordinatorAdminSecret) return {
+	if (!config.syncCoordinatorUrl) return {
 		ok: false,
 		reason: "bootstrap_grant_coordinator_not_configured",
 		deviceId
@@ -3207,11 +3370,31 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 	let verification;
 	try {
-		const [status, payload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
-			headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
-			timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
-		});
-		if (status !== 200 || !payload) return {
+		let payload = null;
+		if (config.syncCoordinatorAdminSecret) {
+			const [status, adminPayload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
+				headers: { "X-Codemem-Coordinator-Admin": config.syncCoordinatorAdminSecret },
+				timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
+			});
+			if (status === 200) payload = adminPayload;
+		} else for (const groupId of config.syncCoordinatorGroups) {
+			const lookupUrl = `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/bootstrap-grants/${encodeURIComponent(grantId)}?group_id=${encodeURIComponent(groupId)}`;
+			const [status, signedPayload] = await requestJson("GET", lookupUrl, {
+				headers: buildAuthHeaders({
+					deviceId: localDeviceId,
+					method: "GET",
+					url: lookupUrl,
+					bodyBytes: Buffer.alloc(0),
+					keysDir: syncKeysDir()
+				}),
+				timeoutS: Math.max(1, config.syncCoordinatorTimeoutS)
+			});
+			if (status === 200) {
+				payload = signedPayload;
+				break;
+			}
+		}
+		if (!payload) return {
 			ok: false,
 			reason: "bootstrap_grant_lookup_failed",
 			deviceId
@@ -3231,6 +3414,11 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_invalid_payload",
 		deviceId
 	};
+	if (config.syncCoordinatorGroups.length > 0 && !config.syncCoordinatorGroups.includes(String(grant.group_id))) return {
+		ok: false,
+		reason: "bootstrap_grant_group_mismatch",
+		deviceId
+	};
 	if (grant.revoked_at) return {
 		ok: false,
 		reason: "bootstrap_grant_revoked",
@@ -3297,6 +3485,11 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_invalid_signature",
 		deviceId
 	};
+	if (!isPeerTrustBindingCompatible(store.db, deviceId, workerPublicKey, workerFingerprint)) return {
+		ok: false,
+		reason: "bootstrap_grant_peer_trust_conflict",
+		deviceId
+	};
 	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
 	if (nonceResult) return nonceResult;
 	updatePeerAddresses(store.db, deviceId, [], {
@@ -4486,6 +4679,23 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			}
 			const lastSyncRow = traceSync("lastSyncRow", () => d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get());
 			const semanticIndex = traceSync("semanticIndex", () => redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db), showDiag));
+			const enrollmentIssueSummary = traceSync("coordinatorEnrollmentIssues", () => getCoordinatorEnrollmentReconciliationIssueSummary(store.db));
+			const enrollmentIssueStatus = {
+				counts: enrollmentIssueSummary.counts,
+				...showDiag ? { issues: enrollmentIssueSummary.issues.map((issue) => ({
+					coordinator_id: issue.coordinatorId,
+					group_id: issue.groupId,
+					kind: issue.kind,
+					reference_id: issue.referenceId,
+					code: issue.code,
+					status: issue.status,
+					first_seen_at: issue.firstSeenAt,
+					last_seen_at: issue.lastSeenAt,
+					resolved_at: issue.resolvedAt,
+					occurrence_count: issue.occurrenceCount,
+					updated_at: issue.updatedAt
+				})) } : {}
+			};
 			const lastError = daemonState?.last_error;
 			const lastErrorAt = daemonState?.last_error_at;
 			const lastOkAt = daemonState?.last_ok_at;
@@ -4513,6 +4723,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 					last_error_at: retentionState?.last_error_at ?? null
 				},
 				semantic_index: semanticIndex,
+				coordinator_enrollment_reconciliation_issues: enrollmentIssueStatus,
 				peer_count: Number(peerCountRow?.total ?? 0),
 				last_sync_at: lastSyncRow?.last_sync_at ?? null,
 				daemon_state: daemonStateValue,
@@ -4948,6 +5159,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				inviteKind: kind,
 				policyTeamId: kind === "team_member" ? targetId : null,
 				targetIdentityId: kind === "add_device" ? targetId : null,
+				inviterDeviceId: kind === "add_device" ? preview.binding.deviceId : null,
 				reviewedPreviewDigest,
 				reviewedIntent
 			}) : await coordinatorCreateAddDeviceInviteAction({
@@ -7123,6 +7335,6 @@ function createSyncApp(opts) {
 	return app;
 }
 //#endregion
-export { VERSION, advancePendingProjectShares, advanceProjectShareOperation, closeStore, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileRecipientPolicyProjects };
+export { VERSION, advancePendingProjectShares, advanceProjectShareOperation, closeStore, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects };
 
 //# sourceMappingURL=index.js.map