@codemem/server 0.40.1 → 0.41.0

package/dist/index.js

@@ -1,14 +1,14 @@
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clonePromptPackAttempt, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
 import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
+import { homedir, hostname, networkInterfaces } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
-import { hostname, networkInterfaces } from "node:os";
 //#region src/middleware.ts
 var LOOPBACK_HOSTS = new Set([
 	"127.0.0.1",
@@ -510,6 +510,32 @@ function configRoutes(opts = {}) {
 	return app;
 }
 //#endregion
+//#region src/routes/health.ts
+function databaseReachable(getStore) {
+	try {
+		getStore().db.pragma("schema_version", { simple: true });
+		return true;
+	} catch {
+		return false;
+	}
+}
+function healthRoutes(getStore) {
+	const app = new Hono();
+	app.get("/api/health", (c) => {
+		const reachable = databaseReachable(getStore);
+		c.header("Cache-Control", "no-store");
+		return c.json({
+			service: VIEWER_SERVICE_DISCRIMINATOR,
+			version: VERSION$1,
+			pid: process.pid,
+			uptime_ms: Math.max(0, Math.floor(process.uptime() * 1e3)),
+			ready: reachable,
+			database: { reachable }
+		});
+	});
+	return app;
+}
+//#endregion
 //#region src/helpers.ts
 /**
 * Shared helpers for viewer-server routes.
@@ -1051,6 +1077,363 @@ function observerStatusRoutes(deps) {
 	return app;
 }
 //#endregion
+//#region src/routes/pack.ts
+var MAX_LEDGER_PAYLOAD_BYTES = 16 * 1024;
+var MAX_METADATA_FIELD_CHARS = 512;
+var MAX_WORKING_SET_FILES = 50;
+var MAX_WORKING_SET_PATH_CHARS = 512;
+var INVALID_JSON = Symbol("invalid-json");
+var PACK_KEYS = new Set([
+	"context",
+	"limit",
+	"token_budget",
+	"project",
+	"cwd",
+	"all_projects",
+	"working_set_files",
+	"compact",
+	"compact_detail_count",
+	"db_path",
+	"identity_target",
+	"attempt"
+]);
+var LEDGER_KEYS = new Set([
+	"action",
+	"attempt_id",
+	"started_at",
+	"source",
+	"stream_id",
+	"source_session_id",
+	"prompt_number",
+	"request_id",
+	"retrieval_status",
+	"delivery_status",
+	"failure_code",
+	"failure_stage",
+	"original_attempt_id",
+	"db_path",
+	"identity_target"
+]);
+var IDENTITY_TARGET_KEYS = new Set([
+	"device_id",
+	"actor_id_present",
+	"actor_id",
+	"config_path",
+	"runtime_root",
+	"workspace_id",
+	"home_dir",
+	"pack_compression",
+	"embedding_disabled",
+	"embedding_model"
+]);
+var BOOLEAN_IDENTITY_TARGET_KEYS = new Set(["actor_id_present", "embedding_disabled"]);
+var ATTEMPT_KEYS = new Set([
+	"attempt_id",
+	"started_at",
+	"source",
+	"stream_id",
+	"source_session_id",
+	"prompt_number",
+	"request_id"
+]);
+var FORBIDDEN_LEDGER_KEYS = new Set([
+	"body",
+	"context",
+	"pack",
+	"pack_text",
+	"path",
+	"preview",
+	"prompt",
+	"query",
+	"raw_prompt",
+	"title"
+]);
+function invalidRequest(message) {
+	return { error: {
+		code: "invalid_request",
+		message
+	} };
+}
+function viewerDbMismatch() {
+	return { error: {
+		code: "viewer_db_mismatch",
+		message: "viewer database does not match request"
+	} };
+}
+function viewerIdentityMismatch() {
+	return { error: {
+		code: "viewer_identity_mismatch",
+		message: "viewer identity does not match request"
+	} };
+}
+function viewerContractUnsupported() {
+	return { error: {
+		code: "viewer_contract_unsupported",
+		message: "viewer request contract is incompatible"
+	} };
+}
+function isRecord(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function isAbsolutePath(value) {
+	return posix.isAbsolute(value) || win32.isAbsolute(value);
+}
+function normalizeWorkingSetPath(value) {
+	const trimmed = value.trim();
+	if (!trimmed || trimmed.length > MAX_WORKING_SET_PATH_CHARS || isAbsolutePath(trimmed)) return null;
+	const normalized = posix.normalize(trimmed.replaceAll("\\", "/")).replace(/^\.\//, "");
+	if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../")) return null;
+	return normalized;
+}
+function requestedDbMatches(store, value) {
+	if (value == null) return true;
+	if (typeof value !== "string" || !value.trim()) return null;
+	return resolve(resolveDbPath(value)) === resolve(store.dbPath);
+}
+function normalizeIdentityPath(value) {
+	if (!value?.trim()) return null;
+	return resolve(resolveDbPath(value.trim()));
+}
+function currentIdentityTarget() {
+	return {
+		device_id: process.env.CODEMEM_DEVICE_ID?.trim() || null,
+		actor_id_present: Object.hasOwn(process.env, "CODEMEM_ACTOR_ID"),
+		actor_id: process.env.CODEMEM_ACTOR_ID?.trim() || null,
+		config_path: normalizeIdentityPath(process.env.CODEMEM_CONFIG),
+		runtime_root: normalizeIdentityPath(process.env.CODEMEM_RUNTIME_ROOT),
+		workspace_id: process.env.CODEMEM_WORKSPACE_ID?.trim() || null,
+		home_dir: normalizeIdentityPath(process.env.HOME || homedir()),
+		pack_compression: process.env.CODEMEM_PACK_COMPRESSION?.trim() || null,
+		embedding_disabled: [
+			"1",
+			"true",
+			"yes"
+		].includes(String(process.env.CODEMEM_EMBEDDING_DISABLED || "").toLowerCase()),
+		embedding_model: process.env.CODEMEM_EMBEDDING_MODEL || "Xenova/bge-small-en-v1.5"
+	};
+}
+function requestedIdentityMatches(value) {
+	if (value == null) return true;
+	if (!isRecord(value)) return null;
+	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
+	const expected = currentIdentityTarget();
+	for (const key of IDENTITY_TARGET_KEYS) {
+		const requested = value[key];
+		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
+			if (typeof requested !== "boolean") return null;
+		} else if (requested !== null && typeof requested !== "string") return null;
+		if (requested !== expected[key]) return false;
+	}
+	return true;
+}
+function validateMetadataFields(payload, allowedKeys) {
+	if (Buffer.byteLength(JSON.stringify(payload), "utf8") > MAX_LEDGER_PAYLOAD_BYTES) return "ledger metadata exceeds 16384 bytes";
+	for (const key of Object.keys(payload)) {
+		if (FORBIDDEN_LEDGER_KEYS.has(key)) return `ledger metadata rejects sensitive field: ${key}`;
+		if (!allowedKeys.has(key)) return `ledger metadata contains unsupported field: ${key}`;
+	}
+	if (typeof payload.attempt_id !== "string" || payload.attempt_id.length === 0) return "ledger metadata requires attempt_id";
+	if (payload.prompt_number != null && (typeof payload.prompt_number !== "number" || !Number.isInteger(payload.prompt_number) || payload.prompt_number < 0)) return "ledger metadata prompt_number must be a non-negative integer";
+	for (const key of [
+		"attempt_id",
+		"started_at",
+		"source",
+		"stream_id",
+		"source_session_id",
+		"request_id",
+		"failure_code",
+		"failure_stage",
+		"original_attempt_id"
+	]) {
+		const field = payload[key];
+		if (field != null && (typeof field !== "string" || field.length > MAX_METADATA_FIELD_CHARS)) return `ledger metadata field ${key} is invalid`;
+		if (typeof field === "string" && isAbsolutePath(field)) return `ledger metadata rejects absolute paths in field: ${key}`;
+	}
+	return null;
+}
+function attemptMetadata(payload) {
+	return {
+		attemptId: payload.attempt_id,
+		startedAt: payload.started_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		source: payload.source ?? "opencode",
+		streamId: payload.stream_id ?? null,
+		sourceSessionId: payload.source_session_id ?? null,
+		promptNumber: payload.prompt_number ?? null,
+		requestId: payload.request_id ?? null
+	};
+}
+function validatePackRequest(value) {
+	if (!isRecord(value)) return "request body must be an object";
+	for (const key of Object.keys(value)) if (!PACK_KEYS.has(key)) return `request body contains unsupported field: ${key}`;
+	const context = typeof value.context === "string" ? value.context.trim() : "";
+	if (!context) return "context required";
+	const limit = value.limit ?? 10;
+	if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1) return "limit must be a positive int";
+	const tokenBudget = value.token_budget ?? null;
+	if (tokenBudget !== null && (typeof tokenBudget !== "number" || !Number.isInteger(tokenBudget) || tokenBudget < 0)) return "token_budget must be a non-negative int";
+	if (value.all_projects != null && typeof value.all_projects !== "boolean") return "all_projects must be a boolean";
+	if (value.project != null && (typeof value.project !== "string" || !value.project.trim())) return "project must be a non-empty string";
+	if (value.cwd != null && (typeof value.cwd !== "string" || !value.cwd.trim() || !isAbsolute(value.cwd))) return "cwd must be an absolute path";
+	if (value.working_set_files != null && !Array.isArray(value.working_set_files)) return "working_set_files must be an array of repository-relative strings";
+	const workingSetValues = value.working_set_files ?? [];
+	if (workingSetValues.length > MAX_WORKING_SET_FILES) return `working_set_files must contain at most ${MAX_WORKING_SET_FILES} entries`;
+	const workingSetFiles = [];
+	for (const entry of workingSetValues) {
+		if (typeof entry !== "string") return "working_set_files must be an array of repository-relative strings";
+		const normalized = normalizeWorkingSetPath(entry);
+		if (!normalized) return "working_set_files contains an invalid repository-relative path";
+		if (!workingSetFiles.includes(normalized)) workingSetFiles.push(normalized);
+	}
+	if (value.compact != null && typeof value.compact !== "boolean") return "compact must be a boolean";
+	if (value.compact_detail_count != null && (typeof value.compact_detail_count !== "number" || !Number.isInteger(value.compact_detail_count) || value.compact_detail_count < 0)) return "compact_detail_count must be a non-negative int";
+	let attempt;
+	if (value.attempt != null) {
+		if (!isRecord(value.attempt)) return "attempt must be an object";
+		const attemptError = validateMetadataFields(value.attempt, ATTEMPT_KEYS);
+		if (attemptError) return attemptError;
+		attempt = value.attempt;
+	}
+	const filters = {};
+	if (value.all_projects !== true) {
+		const envProject = process.env.CODEMEM_PROJECT?.trim() || null;
+		const requestCwd = value.cwd;
+		const requestProject = value.project;
+		const project = resolveProject(requestCwd ?? process.cwd(), requestProject ?? (requestCwd == null ? envProject : void 0));
+		if (project) filters.project = project;
+	}
+	if (workingSetFiles.length > 0) filters.working_set_paths = workingSetFiles;
+	let renderOptions;
+	if (value.compact != null || value.compact_detail_count != null) renderOptions = {
+		compact: value.compact === true || value.compact_detail_count != null,
+		...value.compact_detail_count != null ? { compactDetailCount: value.compact_detail_count } : {}
+	};
+	return {
+		context,
+		limit,
+		tokenBudget,
+		filters,
+		renderOptions,
+		attempt
+	};
+}
+function ledgerFailureStatus(reason) {
+	if (reason === "idempotency_conflict") return 409;
+	if (reason === "attempt_not_found") return 422;
+	if (reason === "storage_unavailable") return 503;
+	return 400;
+}
+function dispatchLedger(store, payload) {
+	const action = payload.action;
+	if (action !== "record" && action !== "delivery" && action !== "cache_reuse") return "ledger action is invalid";
+	const metadata = attemptMetadata(payload);
+	if (action === "delivery") {
+		const status = payload.delivery_status;
+		if (status !== "handed_off" && status !== "failed" && status !== "unknown") return "delivery action requires a valid delivery_status";
+		return tryUpdateRetrievalDelivery(store.db, metadata.attemptId, status);
+	}
+	if (action === "cache_reuse") {
+		if (typeof payload.original_attempt_id !== "string" || !payload.original_attempt_id) return "cache_reuse action requires original_attempt_id";
+		return clonePromptPackAttempt(store.db, payload.original_attempt_id, metadata);
+	}
+	if (payload.retrieval_status !== "skipped" && payload.retrieval_status !== "failed" || typeof payload.failure_code !== "string" || !payload.failure_code || typeof payload.failure_stage !== "string" || !payload.failure_stage) return "record action requires retrieval_status, failure_code, and failure_stage";
+	return recordPromptPackTerminal(store.db, metadata, payload.retrieval_status, payload.failure_code, payload.failure_stage);
+}
+function packTransportRoutes(getStore) {
+	const app = new Hono();
+	app.get("/api/prompt-pack-profile", (c) => {
+		try {
+			const store = getStore();
+			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			return c.json({
+				service: "codemem-viewer",
+				protocol_version: 1,
+				db_path: resolve(store.dbPath),
+				identity_target: currentIdentityTarget()
+			});
+		} catch {
+			return c.json({ error: {
+				code: "profile_failed",
+				message: "viewer profile could not be read"
+			} }, 500);
+		}
+	});
+	app.post("/api/pack", async (c) => {
+		const parsed = await c.req.json().catch(() => INVALID_JSON);
+		if (parsed === INVALID_JSON) return c.json(invalidRequest("invalid json body"), 400);
+		const request = validatePackRequest(parsed);
+		if (typeof request === "string") {
+			if (request.startsWith("request body contains unsupported field:")) return c.json(viewerContractUnsupported(), 409);
+			return c.json(invalidRequest(request), 400);
+		}
+		try {
+			const store = getStore();
+			const dbMatches = requestedDbMatches(store, parsed.db_path);
+			if (dbMatches == null) return c.json(invalidRequest("db_path must be a non-empty string"), 400);
+			if (!dbMatches) return c.json(viewerDbMismatch(), 409);
+			const identityMatches = requestedIdentityMatches(parsed.identity_target);
+			if (identityMatches === "unsupported") return c.json(viewerContractUnsupported(), 409);
+			if (identityMatches == null) return c.json(invalidRequest("identity_target is invalid"), 400);
+			if (!identityMatches) return c.json(viewerIdentityMismatch(), 409);
+			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			if (!request.attempt) {
+				const pack = await store.buildMemoryPackAsync(request.context, request.limit, request.tokenBudget, request.filters, request.renderOptions);
+				return c.json(pack);
+			}
+			const artifacts = await store.buildMemoryPackWithTraceAsync(request.context, request.limit, request.tokenBudget, request.filters, request.renderOptions);
+			let ledgerArtifactFingerprint;
+			try {
+				ledgerArtifactFingerprint = promptPackArtifactFingerprint(store.db, request.context, request.filters, artifacts);
+			} catch {}
+			let ledgerOutcome;
+			try {
+				ledgerOutcome = recordPromptPackArtifacts(store.db, attemptMetadata(request.attempt), request.context, request.filters, artifacts);
+			} catch {}
+			return c.json({
+				...artifacts.response,
+				...ledgerArtifactFingerprint ? { ledger_artifact_fingerprint: ledgerArtifactFingerprint } : {},
+				...ledgerOutcome?.ok === false && ledgerOutcome.reason === "idempotency_conflict" ? { ledger_outcome: ledgerOutcome } : {}
+			});
+		} catch {
+			return c.json({ error: {
+				code: "pack_failed",
+				message: "memory pack could not be built"
+			} }, 500);
+		}
+	});
+	app.post("/api/prompt-pack-ledger", async (c) => {
+		const parsed = await c.req.json().catch(() => INVALID_JSON);
+		if (parsed === INVALID_JSON) return c.json(invalidRequest("invalid json body"), 400);
+		if (!isRecord(parsed)) return c.json(invalidRequest("request body must be an object"), 400);
+		const validationError = validateMetadataFields(parsed, LEDGER_KEYS);
+		if (validationError) {
+			if (validationError.startsWith("ledger metadata contains unsupported field:")) return c.json(viewerContractUnsupported(), 409);
+			return c.json(invalidRequest(validationError), 400);
+		}
+		try {
+			const store = getStore();
+			const dbMatches = requestedDbMatches(store, parsed.db_path);
+			if (dbMatches == null) return c.json(invalidRequest("db_path must be a non-empty string"), 400);
+			if (!dbMatches) return c.json(viewerDbMismatch(), 409);
+			const identityMatches = requestedIdentityMatches(parsed.identity_target);
+			if (identityMatches === "unsupported") return c.json(viewerContractUnsupported(), 409);
+			if (identityMatches == null) return c.json(invalidRequest("identity_target is invalid"), 400);
+			if (!identityMatches) return c.json(viewerIdentityMismatch(), 409);
+			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			const outcome = dispatchLedger(store, parsed);
+			if (typeof outcome === "string") return c.json(invalidRequest(outcome), 400);
+			if (outcome.ok) return c.json(outcome);
+			return c.json(outcome, ledgerFailureStatus(outcome.reason));
+		} catch {
+			return c.json({ error: {
+				code: "ledger_failed",
+				message: "prompt-pack ledger operation failed"
+			} }, 500);
+		}
+	});
+	return app;
+}
+//#endregion
 //#region src/routes/raw-events.ts
 /**
 * Raw events routes — GET & POST /api/raw-events, GET /api/raw-events/status,
@@ -2127,7 +2510,7 @@ function recipientInviteOnboardingPreview(store, body, invitationId) {
 		invitationId,
 		identityId: targetIdentityId,
 		...binding
-	});
+	}, { addDeviceTeamEligibility: "prospective_device" });
 }
 function recipientInviteReviewedIntent(store, kind, targetId, preview) {
 	if (kind === "team_member") {
@@ -2213,6 +2596,7 @@ async function peerSupportsSyncRequirements(store, deviceId, requirements) {
 			headers: {
 				...buildAuthHeaders({
 					deviceId: localDeviceId,
+					dbPath: store.dbPath,
 					method: "GET",
 					url,
 					bodyBytes: Buffer.alloc(0),
@@ -2549,10 +2933,14 @@ async function executeProjectShareProvisioning(store, operationId) {
 		supportsReassignScope: (deviceId) => peerSupportsReassignScope(store, deviceId),
 		refreshAuthorization: async (expectedGroupId) => {
 			if (expectedGroupId !== groupId) throw new Error("operation_scope_mismatch");
-			if ((await refreshConfiguredScopeMembershipCache(store.db, config, { keysDir: syncKeysDir() })).groups.find((item) => item.groupId === groupId)?.status !== "refreshed") throw new Error("authorization_refresh_failed");
+			if ((await refreshConfiguredScopeMembershipCache(store.db, config, {
+				keysDir: syncKeysDir(),
+				dbPath: store.dbPath
+			})).groups.find((item) => item.groupId === groupId)?.status !== "refreshed") throw new Error("authorization_refresh_failed");
 		},
 		runInitialSync: (recipientDeviceId) => runSyncPass(store.db, recipientDeviceId, {
 			keysDir: syncKeysDir(),
+			dbPath: store.dbPath,
 			scanner: store.scanner,
 			refreshAuthorization: true
 		})
@@ -2809,6 +3197,30 @@ async function advancePendingProjectShares(store, options = {}) {
 	}
 	return result;
 }
+function coordinatorEnrollmentFailureCode(error) {
+	const message = (error instanceof Error ? error.message : String(error)).trim();
+	const httpStatus = message.match(/\((\d{3})(?::|\))/u)?.[1];
+	if (httpStatus) return `http_${httpStatus}`;
+	if (new Set([
+		"coordinator_consumed_team_invite_invalid",
+		"coordinator_device_list_malformed",
+		"coordinator_group_id_invalid",
+		"coordinator_id_invalid",
+		"coordinator_invite_group_mismatch",
+		"coordinator_invite_list_malformed",
+		"reconciliation_time_invalid"
+	]).has(message)) return message;
+	if (/timeout|timed out|abort/iu.test(message)) return "request_timeout";
+	if (/fetch failed|network|econn|enotfound/iu.test(message)) return "network_error";
+	return "unexpected_error";
+}
+function coordinatorEnrollmentFailure(groupId, stage, error) {
+	return {
+		groupId: /^[A-Za-z0-9._-]{1,64}$/u.test(groupId) ? groupId : `group_${createHash("sha256").update(groupId).digest("hex").slice(0, 12)}`,
+		stage,
+		code: coordinatorEnrollmentFailureCode(error)
+	};
+}
 async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 	const config = options.config ?? readCoordinatorSyncConfig();
 	const remoteUrl = config.syncCoordinatorUrl.trim();
@@ -2817,6 +3229,7 @@ async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 		skipped: true,
 		groupsProcessed: 0,
 		failedGroups: 0,
+		failures: [],
 		devicesAdded: 0,
 		membershipsAdded: 0,
 		identitiesAdded: 0,
@@ -2830,14 +3243,15 @@ async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 		skipped: false,
 		groupsProcessed: 0,
 		failedGroups: 0,
+		failures: [],
 		devicesAdded: 0,
 		membershipsAdded: 0,
 		identitiesAdded: 0,
 		unchanged: 0,
 		issues: 0
 	};
-	for (const groupId of config.syncCoordinatorGroups) try {
-		const [enrollments, consumedTeamInvites] = await Promise.all([listDevices({
+	for (const groupId of config.syncCoordinatorGroups) {
+		const [enrollmentsResult, consumedTeamInvitesResult] = await Promise.allSettled([listDevices({
 			groupId,
 			remoteUrl,
 			adminSecret
@@ -2846,21 +3260,30 @@ async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 			remoteUrl,
 			adminSecret
 		})]);
-		const result = reconcileSnapshot({
-			coordinatorId: buildBaseUrl(remoteUrl),
-			groupId,
-			enrollments,
-			consumedTeamInvites,
-			localDeviceId: store.deviceId
-		});
-		total.groupsProcessed += 1;
-		total.devicesAdded += result.devicesAdded;
-		total.membershipsAdded += result.membershipsAdded;
-		total.identitiesAdded += result.identitiesAdded;
-		total.unchanged += result.unchanged;
-		total.issues += result.issues.length;
-	} catch {
-		total.failedGroups += 1;
+		if (enrollmentsResult.status === "rejected") total.failures.push(coordinatorEnrollmentFailure(groupId, "list_devices", enrollmentsResult.reason));
+		if (consumedTeamInvitesResult.status === "rejected") total.failures.push(coordinatorEnrollmentFailure(groupId, "list_consumed_team_invites", consumedTeamInvitesResult.reason));
+		if (enrollmentsResult.status === "rejected" || consumedTeamInvitesResult.status === "rejected") {
+			total.failedGroups += 1;
+			continue;
+		}
+		try {
+			const result = reconcileSnapshot({
+				coordinatorId: buildBaseUrl(remoteUrl),
+				groupId,
+				enrollments: enrollmentsResult.value,
+				consumedTeamInvites: consumedTeamInvitesResult.value,
+				localDeviceId: store.deviceId
+			});
+			total.groupsProcessed += 1;
+			total.devicesAdded += result.devicesAdded;
+			total.membershipsAdded += result.membershipsAdded;
+			total.identitiesAdded += result.identitiesAdded;
+			total.unchanged += result.unchanged;
+			total.issues += result.issues.length;
+		} catch (error) {
+			total.failedGroups += 1;
+			total.failures.push(coordinatorEnrollmentFailure(groupId, "reconcile_snapshot", error));
+		}
 	}
 	return total;
 }
@@ -3057,7 +3480,10 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 		},
 		refresh: async ({ scopeId }) => {
 			const boundary = target(scopeId);
-			if ((await refreshConfiguredScopeMembershipCache(store.db, config, { keysDir: syncKeysDir() })).groups.find((item) => item.groupId === boundary.groupId)?.status !== "refreshed") throw new Error("recipient_policy_effect_failed");
+			if ((await refreshConfiguredScopeMembershipCache(store.db, config, {
+				keysDir: syncKeysDir(),
+				dbPath: store.dbPath
+			})).groups.find((item) => item.groupId === boundary.groupId)?.status !== "refreshed") throw new Error("recipient_policy_effect_failed");
 			await refreshAuthorizedCoordinatorPeerTrust(store, config);
 		}
 	};
@@ -3382,6 +3808,7 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 			const [status, signedPayload] = await requestJson("GET", lookupUrl, {
 				headers: buildAuthHeaders({
 					deviceId: localDeviceId,
+					dbPath: store.dbPath,
 					method: "GET",
 					url: lookupUrl,
 					bodyBytes: Buffer.alloc(0),
@@ -3916,6 +4343,8 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 		last_seen_at: row.last_seen_at,
 		last_sync_at: row.last_sync_at,
 		last_error: showDiag ? row.last_error : null,
+		runtime_version: row.runtime_version ?? null,
+		runtime_version_observed_at: row.runtime_version_observed_at ?? null,
 		has_error: Boolean(row.last_error),
 		claimed_local_actor: Boolean(row.claimed_local_actor),
 		claimed_local_actor_scope: claimedLocalActorScopeStatus(store, row),
@@ -4329,6 +4758,7 @@ function readViewerBinding(dbPath) {
 var PEERS_QUERY = `
 	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.addresses_json,
 	       p.last_seen_at, p.last_sync_at, p.last_error,
+	       p.runtime_version, p.runtime_version_observed_at,
 	       p.projects_include_json, p.projects_exclude_json, p.claimed_local_actor,
 	       p.actor_id, p.discovered_via_coordinator_id, p.discovered_via_group_id,
 	       a.display_name AS actor_display_name
@@ -4408,7 +4838,10 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
 			try {
-				if (c.req.header(SYNC_AUTHORIZATION_REFRESH_HEADER) === "1" && supportsSyncFeature(c.req.header(SYNC_FEATURES_HEADER), "reassign_scope")) await refreshConfiguredScopeMembershipCache(store.db, void 0, { keysDir: syncKeysDir() });
+				if (c.req.header(SYNC_AUTHORIZATION_REFRESH_HEADER) === "1" && supportsSyncFeature(c.req.header(SYNC_FEATURES_HEADER), "reassign_scope")) await refreshConfiguredScopeMembershipCache(store.db, void 0, {
+					keysDir: syncKeysDir(),
+					dbPath: store.dbPath
+				});
 				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				const syncReset = getSyncResetState(store.db);
 				const authorizedScopes = isScopedSyncCapability(negotiatedSyncCapability(c)) ? listAuthorizedScopesForPeer(store.db, {
@@ -4419,6 +4852,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 					device_id: deviceId,
 					protocol_version: SYNC_PROTOCOL_VERSION,
 					fingerprint,
+					runtime_version: VERSION$1,
 					sync_reset: addSyncScopeToBoundary(syncReset, null),
 					sync_capability: LOCAL_SYNC_CAPABILITY,
 					sync_features: LOCAL_SYNC_FEATURES
@@ -4988,6 +5422,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		for (const peerId of peerIds) {
 			const result = await runSyncPass(store.db, peerId, {
 				keysDir: syncKeysDir(),
+				dbPath: store.dbPath,
 				scanner: store.scanner
 			});
 			items.push({
@@ -7247,6 +7682,27 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 	return app;
 }
 //#endregion
+//#region src/routes/update-status.ts
+function updateStatusRoutes(options = {}) {
+	const getUpdateStatus$1 = options.getUpdateStatus ?? getUpdateStatus;
+	const app = new Hono();
+	app.get("/api/update-status", async (c) => {
+		try {
+			const status = await getUpdateStatus$1({
+				currentVersion: VERSION$1,
+				installKind: detectInstallKind({
+					entryPath: process.argv[1] ?? "",
+					env: process.env
+				})
+			});
+			return c.json(status);
+		} catch {
+			return c.json({ error: "Update status unavailable." }, 503);
+		}
+	});
+	return app;
+}
+//#endregion
 //#region src/index.ts
 /**
 * @codemem/server — HTTP server (viewer, sync, API).
@@ -7277,8 +7733,10 @@ function createApp(opts) {
 	const app = new Hono();
 	app.use("*", preflightHandler());
 	app.use("*", originGuard());
+	app.route("/", healthRoutes(storeFactory));
 	app.route("/", statsRoutes(storeFactory));
 	app.route("/", memoryRoutes(storeFactory));
+	app.route("/", packTransportRoutes(storeFactory));
 	app.route("/", observerStatusRoutes({
 		getStore: storeFactory,
 		getSweeper: () => sweeper,
@@ -7287,6 +7745,7 @@ function createApp(opts) {
 	app.route("/", configRoutes({ getSweeper: () => sweeper }));
 	app.route("/", rawEventsRoutes(storeFactory, sweeper));
 	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus));
+	app.route("/", updateStatusRoutes({ getUpdateStatus: opts?.getUpdateStatus }));
 	const staticRoot = process.env.CODEMEM_VIEWER_STATIC_DIR ?? join(import.meta.dirname ?? ".", "../static");
 	app.use("/assets/*", async (c, next) => {
 		c.header("Cache-Control", "no-cache");