@codemem/server 0.42.0 → 0.43.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, PROMPT_TRANSPORT_PROTOCOL_RANGE, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildViewerIdentityTarget, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, PROMPT_TRANSPORT_PROTOCOL_RANGE, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildViewerIdentityTarget, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, finishLegacyTeamSetupActivation, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inviteTokenDigest, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -28,7 +28,8 @@ function isLoopbackOrigin(origin) {
 	}
 	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
 	if (url.username || url.password) return false;
-	return LOOPBACK_HOSTS.has(url.hostname);
+	const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+	return LOOPBACK_HOSTS.has(hostname);
 }
 /** HTTP methods that mutate state and require origin validation. */
 var UNSAFE_METHODS = new Set([
@@ -61,7 +62,8 @@ function isUnsafeMissingOrigin(c) {
 *
 * Ports Python's `reject_cross_origin(missing_origin_policy="reject_if_unsafe")`:
 *
-* - GET/HEAD/OPTIONS: allowed from any origin (viewer is local-only).
+* - GET/HEAD/OPTIONS: allowed from any origin unless the caller marks a
+*   side-effecting GET path prefix as unsafe.
 * - POST/DELETE/PATCH/PUT:
 *   - Origin present + loopback → allowed (browser on localhost)
 *   - Origin present + non-loopback → rejected 403
@@ -72,20 +74,21 @@ function isUnsafeMissingOrigin(c) {
 * Access-Control-Allow-Origin is set — the browser doesn't need it.
 * For valid loopback origins, ACAO is echoed back.
 */
-function originGuard() {
+function originGuard(options) {
 	return createMiddleware(async (c, next) => {
 		const origin = c.req.header("Origin");
 		const method = c.req.method;
-		if (UNSAFE_METHODS.has(method)) {
+		const unsafeGet = (method === "GET" || method === "HEAD") && options?.unsafeGetPathPrefixes?.some((prefix) => c.req.path.startsWith(prefix));
+		if (UNSAFE_METHODS.has(method) || unsafeGet) {
 			if (origin) {
 				if (!isLoopbackOrigin(origin)) return c.json({ error: "forbidden" }, 403);
 				c.header("Access-Control-Allow-Origin", origin);
-				c.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+				c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 				c.header("Access-Control-Allow-Headers", "Content-Type");
 			} else if (isUnsafeMissingOrigin(c)) return c.json({ error: "forbidden" }, 403);
 		} else if (origin && isLoopbackOrigin(origin)) {
 			c.header("Access-Control-Allow-Origin", origin);
-			c.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+			c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 			c.header("Access-Control-Allow-Headers", "Content-Type");
 		}
 		await next();
@@ -104,7 +107,7 @@ function preflightHandler() {
 		const origin = c.req.header("Origin");
 		if (origin && isLoopbackOrigin(origin)) {
 			c.header("Access-Control-Allow-Origin", origin);
-			c.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+			c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 			c.header("Access-Control-Allow-Headers", "Content-Type");
 			c.header("Access-Control-Max-Age", "86400");
 			return c.body(null, 204);
@@ -3124,13 +3127,13 @@ var TERMINAL_RECONCILIATION_ERRORS = new Set([
 	"operation_not_found",
 	...PROJECT_INVITE_OWNER_CONFLICT_ERRORS
 ]);
-function errorStatus(error) {
+function errorStatus$1(error) {
 	const value = error && typeof error === "object" ? error.status : null;
 	return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599 ? value : null;
 }
 function projectInviteOwnerErrorResponse(error, fallback) {
 	const message = error instanceof Error ? error.message : "";
-	const status = errorStatus(error);
+	const status = errorStatus$1(error);
 	if (message === "operation_not_found" && (status == null || status === 404)) return {
 		code: message,
 		status: 404
@@ -3152,7 +3155,7 @@ function projectInviteOwnerErrorResponse(error, fallback) {
 function isRetryableReconciliationError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (TERMINAL_RECONCILIATION_ERRORS.has(message)) return false;
-	const status = errorStatus(error);
+	const status = errorStatus$1(error);
 	return status == null || status === 408 || status === 429 || status >= 500;
 }
 function safeReconciliationErrorCode(error) {
@@ -4409,7 +4412,8 @@ async function acceptDiscoveredPeer(store, input) {
 	const addressesJson = JSON.stringify(mergeAddresses(nextAddresses, existingAddresses));
 	await createCoordinatorReciprocalApproval(store, config, {
 		groupId,
-		requestedDeviceId: input.peerDeviceId
+		requestedDeviceId: input.peerDeviceId,
+		...input.expectedIncomingRequestId ? { expectedIncomingRequestId: input.expectedIncomingRequestId } : {}
 	});
 	const coordinatorUrl = config.syncCoordinatorUrl || null;
 	let scopeInclude;
@@ -5973,10 +5977,18 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return c.json({ error: "request_invalid" }, 400);
 		const body = value;
 		if (Object.keys(body).some((key) => key !== "dryRun") || Object.hasOwn(body, "dryRun") && typeof body.dryRun !== "boolean") return c.json({ error: "request_invalid" }, 400);
-		return c.json(migrateRecipientPolicyIntent(store.db, {
-			localActorId: store.actorId,
-			localDeviceId: store.deviceId
-		}, { dryRun: body.dryRun === true }));
+		try {
+			return c.json(migrateRecipientPolicyIntent(store.db, {
+				localActorId: store.actorId,
+				localDeviceId: store.deviceId
+			}, { dryRun: body.dryRun === true }));
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "migration_busy" }, 503);
+			}
+			return c.json({ error: "migration_failed" }, 500);
+		}
 	});
 	const parseReviewRequest = (value) => {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -6718,11 +6730,18 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		}
 		const peerDeviceId = String(body.peer_device_id ?? "").trim();
 		const fingerprint = String(body.fingerprint ?? "").trim();
+		const expectedGroupId = String(body.expected_group_id ?? "").trim();
+		const hasExpectedIncomingRequestId = Object.hasOwn(body, "expected_incoming_request_id");
+		const expectedIncomingRequestId = String(body.expected_incoming_request_id ?? "").trim();
 		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
+		if (hasExpectedIncomingRequestId && !expectedIncomingRequestId) return c.json({ error: "expected_incoming_request_id must not be empty" }, 400);
+		if (expectedIncomingRequestId && !expectedGroupId) return c.json({ error: "expected_group_id required" }, 400);
 		try {
 			const result = await acceptDiscoveredPeer(store, {
 				peerDeviceId,
-				fingerprint: fingerprint || void 0
+				fingerprint: fingerprint || void 0,
+				expectedGroupId: expectedGroupId || void 0,
+				expectedIncomingRequestId: expectedIncomingRequestId || void 0
 			});
 			if (!result.ok) return c.json({
 				error: result.error,
@@ -6738,6 +6757,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				needs_scope_review: true
 			});
 		} catch (error) {
+			if (error instanceof CoordinatorReciprocalApprovalRequestChangedError) return c.json({
+				error: error.code,
+				detail: "This approval request changed before it was submitted. Refresh sync status and review the current request."
+			}, { status: 409 });
 			return c.json({
 				error: "coordinator_lookup_failed",
 				detail: error instanceof Error ? error.message : String(error)
@@ -8166,6 +8189,850 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	return app;
 }
 //#endregion
+//#region src/routes/team-setup.ts
+var TEAM_SETUP_VERSION = 1;
+var MAX_CONFIGURED_GROUPS = 25;
+var MAX_DEVICES = 500;
+var MAX_PROJECTS = 500;
+var MAX_ACCESS_DELTA_ENTRIES = 1e4;
+var MAX_IDENTITY_CHOICES = 500;
+var MAX_COMPLETED_IDENTITY_CHOICES = MAX_DEVICES * 4;
+var MAX_PROJECT_MAPPING_CHOICES = 500;
+var MAX_TOTAL_PROJECT_MAPPING_CHOICES = 1e4;
+var MAX_PROJECT_MAPPING_SCAN_ROWS = 1e4;
+var MAX_PROJECT_MAPPING_METADATA_ROWS = 1e4;
+var MAX_MUTATION_BODY_BYTES = 8192;
+var SUMMARY_SNAPSHOT_CACHE_TTL_MS = 3e4;
+var TEAM_SETUP_ROUTE_PREFIX = "/api/sync/team-setup/v1";
+var CANDIDATE_REF_PATTERN = /^legacy-team-candidate:[0-9a-f]{32}$/u;
+var DEVICE_REF_PATTERN = /^legacy-team-device-ref-v1:[0-9a-f]{64}$/u;
+var PROJECT_REF_PATTERN = /^legacy-team-project-ref-v1:[0-9a-f]{64}$/u;
+var IDENTITY_REF_PATTERN = /^legacy-team-viewer-identity-ref-v1:[0-9a-f]{64}$/u;
+var RESOLVED_PROJECT_REF_PATTERN = /^legacy-team-resolved-project-ref-v1:[0-9a-f]{64}$/u;
+var ATTEMPT_ID_PATTERN = /^legacy-team-attempt:[0-9a-f-]{36}$/u;
+var FINISH_DIGEST_PATTERN = /^legacy-team-activation-finish-v1:[0-9a-f]{64}$/u;
+var ACCESS_DELTA_DIGEST_PATTERN = /^legacy-team-access-delta:[0-9a-f]{64}$/u;
+var VIEWER_ACCESS_DELTA_DIGEST_PATTERN = /^legacy-team-viewer-access-delta-v1:[0-9a-f]{64}$/u;
+var defaultSnapshotLoaderDependencies = {
+	readConfig: readCoordinatorSyncConfig,
+	listGroups: coordinatorListGroupsAction,
+	listDevices: coordinatorListDevicesAction
+};
+function safeCoordinatorError() {
+	return /* @__PURE__ */ new Error("team_setup_roster_unavailable");
+}
+function isCoordinatorRosterTooLargeError(error) {
+	return error instanceof Error && error.message === "coordinator_response_too_large";
+}
+function configuredGroupIds(groups) {
+	const unique = [...new Set(groups.map((group) => group.trim()).filter(Boolean))];
+	if (unique.length > MAX_CONFIGURED_GROUPS) throw safeCoordinatorError();
+	return unique;
+}
+async function loadConfiguredLegacyTeamGroupSnapshotsWith(dependencies, options = {}) {
+	let config;
+	try {
+		config = dependencies.readConfig();
+	} catch {
+		throw safeCoordinatorError();
+	}
+	const groupIds = configuredGroupIds(config.syncCoordinatorGroups);
+	const hasUrl = Boolean(config.syncCoordinatorUrl);
+	const hasSecret = Boolean(config.syncCoordinatorAdminSecret);
+	if (!hasUrl && !hasSecret && groupIds.length === 0) return [];
+	if (!hasUrl || !hasSecret || groupIds.length === 0) throw safeCoordinatorError();
+	try {
+		const remoteUrl = buildBaseUrl(config.syncCoordinatorUrl);
+		const coordinatorId = remoteUrl;
+		const timeoutS = Math.max(1, config.syncCoordinatorTimeoutS);
+		const requestedGroupIds = options.candidateRef ? groupIds.filter((groupId) => legacyTeamCandidateId(coordinatorId, groupId) === options.candidateRef) : groupIds;
+		const groups = await dependencies.listGroups({
+			remoteUrl,
+			adminSecret: config.syncCoordinatorAdminSecret,
+			includeArchived: false,
+			timeoutS
+		});
+		const groupById = new Map(groups.map((group) => [group.group_id, group]));
+		return (await Promise.all(requestedGroupIds.map(async (groupId) => {
+			const group = groupById.get(groupId);
+			if (!group || group.group_id !== groupId || group.display_name !== null && typeof group.display_name !== "string" || group.archived_at != null) throw safeCoordinatorError();
+			let devices;
+			try {
+				devices = await dependencies.listDevices({
+					groupId,
+					includeDisabled: true,
+					remoteUrl,
+					adminSecret: config.syncCoordinatorAdminSecret,
+					timeoutS
+				});
+			} catch (error) {
+				if (isCoordinatorRosterTooLargeError(error)) {
+					if (options.candidateRef) throw new Error("legacy_team_setup_roster_too_large");
+					return null;
+				}
+				throw error;
+			}
+			if (devices.length > MAX_DEVICES) {
+				if (options.candidateRef) throw new Error("legacy_team_setup_roster_too_large");
+				return null;
+			}
+			if (devices.some((device) => fingerprintPublicKey(device.public_key) !== device.fingerprint || device.enabled !== 0 && device.enabled !== 1)) throw safeCoordinatorError();
+			return {
+				coordinatorId,
+				groupId,
+				displayName: group.display_name ?? "Legacy Team",
+				devices: devices.map((device) => ({
+					deviceId: device.device_id,
+					fingerprint: device.fingerprint,
+					displayName: device.display_name ?? "Device",
+					enabled: device.enabled === 1,
+					labelRedactionIds: [device.identity_id ?? "", device.public_key].filter(Boolean)
+				}))
+			};
+		}))).filter((snapshot) => snapshot !== null);
+	} catch (error) {
+		if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
+		throw safeCoordinatorError();
+	}
+}
+async function loadConfiguredLegacyTeamGroupSnapshots(options = {}) {
+	return loadConfiguredLegacyTeamGroupSnapshotsWith(defaultSnapshotLoaderDependencies, options);
+}
+function requireBoundedSnapshots(groups) {
+	if (groups.length > MAX_CONFIGURED_GROUPS) throw new Error("legacy_team_setup_roster_too_large");
+}
+function projectionOptions(store) {
+	return {
+		localActorId: store.actorId,
+		localDeviceId: store.deviceId
+	};
+}
+function discoverCandidates(store, groups) {
+	requireBoundedSnapshots(groups);
+	return discoverLegacyTeamCandidates(store.db, {
+		projection: projectionOptions(store),
+		groups
+	});
+}
+function candidateSummary(candidate) {
+	return {
+		candidateRef: candidate.candidateRef,
+		displayName: candidate.displayName,
+		status: candidate.status,
+		deviceCount: candidate.deviceCount,
+		projectCount: candidate.projectCount,
+		unresolvedDeviceCount: candidate.unresolvedDeviceCount,
+		unresolvedProjectCount: candidate.unresolvedProjectCount
+	};
+}
+function candidateSummaryForDraft(candidate, draft) {
+	return {
+		...candidateSummary(candidate),
+		status: draft.state === "completed" ? "ready" : draft.state,
+		unresolvedDeviceCount: draft.unresolvedDeviceCount,
+		unresolvedProjectCount: draft.unresolvedProjectCount
+	};
+}
+function completedCandidateFromDraft(draft) {
+	return {
+		candidateRef: draft.candidateRef,
+		displayName: draft.displayName,
+		status: "ready",
+		deviceCount: draft.devices.length,
+		projectCount: draft.projects.length,
+		unresolvedDeviceCount: draft.unresolvedDeviceCount,
+		unresolvedProjectCount: draft.unresolvedProjectCount
+	};
+}
+function identityRef(candidateRef, identityId) {
+	return identityId ? recipientPolicyDigest("legacy-team-viewer-identity-ref-v1", [candidateRef, identityId]) : null;
+}
+function requiredIdentityRef(candidateRef, identityId) {
+	return recipientPolicyDigest("legacy-team-viewer-identity-ref-v1", [candidateRef, identityId]);
+}
+function teamRef(candidateRef, teamId) {
+	return recipientPolicyDigest("legacy-team-viewer-team-ref-v1", [candidateRef, teamId]);
+}
+function resolvedProjectRef(projectRef, projectIdentity) {
+	return projectIdentity ? legacyTeamResolvedProjectRef(projectRef, projectIdentity) : null;
+}
+function viewerSafeAccessDelta(candidateRef, delta, labels) {
+	const fallbackLabels = /* @__PURE__ */ new Map();
+	const fallbackLabelCounts = /* @__PURE__ */ new Map();
+	const reservedLabels = new Set([
+		labels?.teamDisplayName,
+		...labels?.devices.map((device) => device.displayName) ?? [],
+		...labels?.projects.flatMap((project) => [project.displayName, ...project.mappingChoices.map((choice) => choice.displayName)]) ?? [],
+		...labels?.identityChoices.map((identity) => identity.displayName) ?? []
+	].filter((label) => Boolean(label)).map((label) => normalizeChoiceLabelText(label).toLowerCase()));
+	const fallbackLabel = (kind, ref) => {
+		const key = `${kind}:${ref}`;
+		const existing = fallbackLabels.get(key);
+		if (existing) return existing;
+		let index = (fallbackLabelCounts.get(kind) ?? 0) + 1;
+		let label = `${kind} outside this setup (${index})`;
+		while (reservedLabels.has(normalizeChoiceLabelText(label).toLowerCase())) {
+			index += 1;
+			label = `${kind} outside this setup (${index})`;
+		}
+		fallbackLabelCounts.set(kind, index);
+		reservedLabels.add(normalizeChoiceLabelText(label).toLowerCase());
+		fallbackLabels.set(key, label);
+		return label;
+	};
+	const projectsByRef = new Map(labels?.projects.map((project) => [project.projectRef, project]));
+	const projectsByCanonicalRef = new Map(labels?.projects.flatMap((project) => project.canonicalProjectRef ? [[project.canonicalProjectRef, project]] : []));
+	const identitiesByRef = new Map(labels?.identityChoices.map((identity) => [identity.identityRef, identity]));
+	const devicesByRef = new Map(labels?.devices.map((device) => [device.deviceRef, device]));
+	const resolvedDisplayName = (projectRef, ref) => {
+		if (!ref) return null;
+		const project = projectsByRef.get(projectRef);
+		const choice = project?.mappingChoices.find((item) => item.resolvedProjectRef === ref);
+		if (choice) return choice.displayName;
+		if (project?.resolvedProjectRef === ref && project.resolution === "deterministic") return `${project.displayName} (automatic match)`;
+		return fallbackLabel("Project", ref);
+	};
+	return {
+		teamChanges: delta.teamChanges.map((change) => ({
+			teamRef: teamRef(candidateRef, change.teamId),
+			teamDisplayName: labels?.teamDisplayName ?? fallbackLabel("Team", teamRef(candidateRef, change.teamId)),
+			change: change.change,
+			fromDeviceEligibilityMode: change.fromDeviceEligibilityMode,
+			toDeviceEligibilityMode: change.toDeviceEligibilityMode
+		})),
+		membershipChanges: delta.membershipChanges.map((change) => {
+			const identityRef = requiredIdentityRef(candidateRef, change.identityId);
+			const membershipTeamRef = teamRef(candidateRef, change.teamId);
+			return {
+				teamRef: membershipTeamRef,
+				teamDisplayName: labels?.teamDisplayName ?? fallbackLabel("Team", membershipTeamRef),
+				identityRef,
+				identityDisplayName: identitiesByRef.get(identityRef)?.displayName ?? fallbackLabel("Person", identityRef),
+				change: change.change
+			};
+		}),
+		projectChanges: delta.projectChanges.map((change) => {
+			const fromRef = resolvedProjectRef(change.projectRef, change.fromProjectIdentity);
+			const toRef = resolvedProjectRef(change.projectRef, change.toProjectIdentity);
+			return {
+				projectRef: change.projectRef,
+				projectDisplayName: projectsByRef.get(change.projectRef)?.displayName ?? fallbackLabel("Project", change.projectRef),
+				fromResolvedProjectRef: fromRef,
+				fromResolvedProjectDisplayName: resolvedDisplayName(change.projectRef, fromRef),
+				toResolvedProjectRef: toRef,
+				toResolvedProjectDisplayName: resolvedDisplayName(change.projectRef, toRef),
+				change: change.change
+			};
+		}),
+		recipientChanges: delta.recipientChanges.map((change) => {
+			const canonicalProjectRef = legacyTeamCanonicalProjectRef(candidateRef, change.canonicalProjectIdentity);
+			const recipientRef = teamRef(candidateRef, change.recipientId);
+			return {
+				canonicalProjectRef,
+				canonicalProjectDisplayName: projectsByCanonicalRef.get(canonicalProjectRef)?.displayName ?? fallbackLabel("Project", canonicalProjectRef),
+				recipientKind: change.recipientKind,
+				recipientRef,
+				recipientDisplayName: labels?.teamDisplayName ?? fallbackLabel("Team", recipientRef),
+				change: change.change
+			};
+		}),
+		deviceAccessChanges: delta.deviceAccessChanges.map((change) => {
+			const canonicalProjectRef = legacyTeamCanonicalProjectRef(candidateRef, change.canonicalProjectIdentity);
+			const deviceRef = legacyTeamDeviceRef(candidateRef, change.deviceId);
+			return {
+				canonicalProjectRef,
+				canonicalProjectDisplayName: projectsByCanonicalRef.get(canonicalProjectRef)?.displayName ?? fallbackLabel("Project", canonicalProjectRef),
+				deviceRef,
+				deviceDisplayName: devicesByRef.get(deviceRef)?.displayName ?? fallbackLabel("Device", deviceRef),
+				change: change.change
+			};
+		})
+	};
+}
+function viewerAccessDeltaDigest(delta) {
+	return recipientPolicyDigest("legacy-team-viewer-access-delta-v1", delta);
+}
+function requireBoundedAccessDelta(delta) {
+	const total = delta.teamChanges.length + delta.membershipChanges.length + delta.projectChanges.length + delta.recipientChanges.length + delta.deviceAccessChanges.length;
+	if (delta.teamChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.membershipChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.projectChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.recipientChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.deviceAccessChanges.length > MAX_ACCESS_DELTA_ENTRIES || total > MAX_ACCESS_DELTA_ENTRIES) throw new Error("legacy_team_setup_roster_too_large");
+}
+var SAFE_CHOICE_LABEL_PATTERN = /^[\p{L}\p{N} '&,.()_-]*$/u;
+function normalizeChoiceLabelText(value) {
+	return value.normalize("NFKC").replace(/\p{Cf}/gu, "").replace(/\p{Cc}/gu, " ").replace(/\s+/gu, " ").trim();
+}
+function safeChoiceLabel(value, fallback, forbiddenIds, opaqueRef) {
+	const normalized = normalizeChoiceLabelText(value.slice(0, 512));
+	const label = normalized.slice(0, 120).trim();
+	const forbiddenComparisons = forbiddenIds.map((forbiddenId) => normalizeChoiceLabelText(forbiddenId).toLowerCase()).filter(Boolean);
+	const comparable = normalized.toLowerCase();
+	if (!label || !SAFE_CHOICE_LABEL_PATTERN.test(label) || /[\p{L}\p{N}]\.[\p{L}\p{N}]/u.test(label) || /-----|\b(?:ssh|ecdsa|sk)-[\p{L}\p{N}-]+ /iu.test(label) || forbiddenComparisons.some((forbiddenComparison) => comparable.includes(forbiddenComparison))) {
+		const suffix = opaqueRef?.slice(-6);
+		return suffix ? `${fallback} ${suffix}` : fallback;
+	}
+	return label;
+}
+function disambiguateChoiceLabels(choices, choiceRef) {
+	const counts = /* @__PURE__ */ new Map();
+	const originalLabels = /* @__PURE__ */ new Set();
+	for (const choice of choices) {
+		const comparable = normalizeChoiceLabelText(choice.displayName).toLowerCase();
+		counts.set(comparable, (counts.get(comparable) ?? 0) + 1);
+		originalLabels.add(comparable);
+	}
+	const usedLabels = /* @__PURE__ */ new Set();
+	return choices.map((choice, index) => {
+		const comparable = normalizeChoiceLabelText(choice.displayName).toLowerCase();
+		if ((counts.get(comparable) ?? 0) < 2 && !usedLabels.has(comparable)) {
+			usedLabels.add(comparable);
+			return choice;
+		}
+		const ref = choiceRef(choice);
+		let suffixLength = Math.min(6, ref.length);
+		let suffix = ref.slice(-suffixLength);
+		const maxAttempts = ref.length + originalLabels.size + usedLabels.size + 2;
+		for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+			const baseLength = Math.max(0, 119 - suffix.length);
+			const base = choice.displayName.slice(0, baseLength).trimEnd();
+			const displayName = base ? `${base} ${suffix}` : suffix.slice(-120);
+			const finalComparable = normalizeChoiceLabelText(displayName).toLowerCase();
+			if (!usedLabels.has(finalComparable) && !originalLabels.has(finalComparable)) {
+				usedLabels.add(finalComparable);
+				return {
+					...choice,
+					displayName
+				};
+			}
+			if (suffixLength < ref.length) {
+				suffixLength = Math.min(ref.length, suffixLength + 2);
+				suffix = ref.slice(-suffixLength);
+				continue;
+			}
+			suffix = `${ref.slice(-Math.min(96, ref.length))}-${index + 1}-${attempt + 1}`;
+		}
+		throw new Error("legacy_team_setup_roster_too_large");
+	});
+}
+function requireCompleteMappingChoices(projectCount, choiceCount) {
+	if (projectCount * choiceCount > MAX_TOTAL_PROJECT_MAPPING_CHOICES) throw new Error("legacy_team_setup_roster_too_large");
+}
+function createCachedSnapshotLoader(load, ttlMs, now = Date.now) {
+	let cached = null;
+	let inFlight = null;
+	let generation = 0;
+	const cachedLoad = () => {
+		if (cached && now() < cached.expiresAt) return Promise.resolve(cached.snapshots);
+		if (inFlight) return inFlight;
+		const operationGeneration = generation;
+		let operation;
+		operation = load().then((snapshots) => {
+			if (generation !== operationGeneration) return cachedLoad();
+			cached = {
+				expiresAt: now() + ttlMs,
+				snapshots
+			};
+			return snapshots;
+		}).finally(() => {
+			if (inFlight === operation) inFlight = null;
+		});
+		inFlight = operation;
+		return operation;
+	};
+	cachedLoad.invalidate = () => {
+		generation += 1;
+		cached = null;
+		inFlight = null;
+	};
+	return cachedLoad;
+}
+function identityChoicesFromRows(rows, candidateRef, maxChoices = MAX_IDENTITY_CHOICES) {
+	if (rows.length > maxChoices) throw new Error("legacy_team_setup_roster_too_large");
+	const actorIds = rows.map((row) => row.actor_id);
+	return disambiguateChoiceLabels(rows.map((row) => {
+		const opaqueIdentityRef = requiredIdentityRef(candidateRef, row.actor_id);
+		return {
+			identityId: row.actor_id,
+			identityRef: opaqueIdentityRef,
+			displayName: safeChoiceLabel(row.display_name, "Person", actorIds, opaqueIdentityRef)
+		};
+	}), (choice) => choice.identityRef);
+}
+function identityChoices(store, candidateRef) {
+	return identityChoicesFromRows(store.db.prepare(`SELECT actor_id, display_name FROM actors
+			 WHERE status = 'active' AND merged_into_actor_id IS NULL
+			 ORDER BY display_name, actor_id LIMIT ?`).all(501), candidateRef);
+}
+function completedDraftIdentityChoices(store, draft) {
+	const actorIds = [...new Set(draft.devices.flatMap((device) => [
+		device.existingIdentityId,
+		device.suggestedIdentityId,
+		device.targetIdentityId,
+		device.expectation.kind === "existing" ? device.expectation.identityId : null
+	]))].filter((actorId) => actorId !== null);
+	if (actorIds.length === 0) return [];
+	const placeholders = actorIds.map(() => "?").join(", ");
+	return identityChoicesFromRows(store.db.prepare(`SELECT actor_id, display_name FROM actors
+			 WHERE status = 'active' AND merged_into_actor_id IS NULL
+			   AND actor_id IN (${placeholders})
+			 ORDER BY display_name, actor_id`).all(...actorIds), draft.candidateRef, MAX_COMPLETED_IDENTITY_CHOICES);
+}
+function projectMappingChoices(store) {
+	let candidates;
+	try {
+		candidates = listProjectScopeCandidates(store.db, {
+			limit: null,
+			maxScannedRows: MAX_PROJECT_MAPPING_SCAN_ROWS,
+			maxMetadataRows: MAX_PROJECT_MAPPING_METADATA_ROWS,
+			excludePeerReceived: true
+		}).filter((candidate) => !candidate.read_only && isLegacyTeamSetupProjectMappingIdentity(candidate.workspace_identity));
+	} catch (error) {
+		if (error instanceof Error && (error.message === "project_scope_candidate_scan_too_large" || error.message === "project_scope_candidate_metadata_too_large")) throw new Error("legacy_team_setup_roster_too_large");
+		throw error;
+	}
+	if (candidates.length > MAX_PROJECT_MAPPING_CHOICES) throw new Error("legacy_team_setup_roster_too_large");
+	return candidates.map((candidate) => ({
+		projectIdentity: candidate.workspace_identity,
+		sourceDisplayName: candidate.display_project
+	}));
+}
+function viewerSafeDraft(store, draft) {
+	if (draft.devices.length > MAX_DEVICES || draft.projects.length > MAX_PROJECTS) throw new Error("legacy_team_setup_roster_too_large");
+	const completed = draft.state === "completed";
+	const identities = completed ? completedDraftIdentityChoices(store, draft) : identityChoices(store, draft.candidateRef);
+	const mappableProjectCount = completed ? 0 : draft.projects.filter((project) => project.resolution !== "deterministic").length;
+	const mappingChoices = mappableProjectCount === 0 ? [] : projectMappingChoices(store);
+	requireCompleteMappingChoices(mappableProjectCount, mappingChoices.length);
+	const mappingChoiceIdentities = mappingChoices.map((choice) => choice.projectIdentity);
+	return {
+		devices: draft.devices.map((device) => ({
+			deviceRef: device.deviceRef,
+			displayName: device.displayName,
+			enabled: device.enabled,
+			existingIdentityRef: identityRef(draft.candidateRef, device.existingIdentityId),
+			suggestedIdentityRef: identityRef(draft.candidateRef, device.suggestedIdentityId),
+			verifiedEvidenceKind: device.verifiedEvidenceKind,
+			decision: device.decision,
+			targetIdentityRef: identityRef(draft.candidateRef, device.targetIdentityId),
+			expectation: device.expectation.kind === "existing" ? {
+				kind: "existing",
+				assignmentVersion: device.expectation.assignmentVersion,
+				identityRef: requiredIdentityRef(draft.candidateRef, device.expectation.identityId)
+			} : { kind: "absent" }
+		})),
+		projects: draft.projects.map((project) => ({
+			projectRef: project.projectRef,
+			displayName: project.displayName,
+			resolution: project.resolution,
+			canonicalProjectRef: project.canonicalProjectRef,
+			resolvedProjectRef: project.resolvedProjectRef,
+			mappingChoices: project.resolution === "deterministic" ? [] : disambiguateChoiceLabels(mappingChoices.map((choice) => {
+				const opaqueResolvedProjectRef = legacyTeamResolvedProjectRef(project.projectRef, choice.projectIdentity);
+				return {
+					resolvedProjectRef: opaqueResolvedProjectRef,
+					displayName: safeChoiceLabel(choice.sourceDisplayName, "Project", mappingChoiceIdentities, opaqueResolvedProjectRef)
+				};
+			}), (choice) => choice.resolvedProjectRef)
+		})),
+		identityChoices: identities.map(({ identityRef, displayName }) => ({
+			identityRef,
+			displayName
+		}))
+	};
+}
+function errorStatus(code) {
+	if (code === "team_setup_roster_unavailable") return 503;
+	if (code === "team_setup_failed") return 503;
+	if (code === "team_setup_incomplete") return 400;
+	return 409;
+}
+function apiErrorCode(error) {
+	const code = legacyTeamSetupApiErrorCode(error);
+	return code === "team_setup_projection_changed" ? "team_setup_conflict" : code;
+}
+async function parseBoundedJsonObject(c) {
+	if (c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return { ok: false };
+	const lengthHeader = c.req.header("content-length");
+	if (lengthHeader != null && !/^\d+$/u.test(lengthHeader.trim())) return { ok: false };
+	const contentLength = lengthHeader == null ? null : Number(lengthHeader);
+	if (contentLength != null && contentLength > MAX_MUTATION_BODY_BYTES) return { ok: false };
+	const body = c.req.raw.body;
+	if (!body) return { ok: false };
+	const reader = body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > MAX_MUTATION_BODY_BYTES) {
+				await reader.cancel().catch(() => void 0);
+				return { ok: false };
+			}
+			chunks.push(value);
+		}
+	} catch {
+		return { ok: false };
+	} finally {
+		reader.releaseLock();
+	}
+	try {
+		const bytes = new Uint8Array(total);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? {
+			ok: true,
+			value: parsed
+		} : { ok: false };
+	} catch {
+		return { ok: false };
+	}
+}
+function hasExactKeys(value, keys) {
+	const actual = Object.keys(value).toSorted();
+	const expected = keys.toSorted();
+	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function mutationResponse(draft) {
+	return {
+		version: TEAM_SETUP_VERSION,
+		candidateRef: draft.candidateRef,
+		attemptId: draft.attemptId,
+		draftState: draft.state,
+		canFinish: draft.canFinish,
+		unresolvedDeviceCount: draft.unresolvedDeviceCount,
+		unresolvedProjectCount: draft.unresolvedProjectCount
+	};
+}
+function finishResponse(candidateRef, result) {
+	return {
+		version: TEAM_SETUP_VERSION,
+		status: result.status,
+		teamRef: teamRef(candidateRef, result.teamId),
+		attemptId: result.attemptId,
+		accessDeltaDigest: result.accessDeltaDigest,
+		completedAt: result.completedAt
+	};
+}
+function teamSetupRoutes(options) {
+	const app = new Hono();
+	const loadSnapshots = options.loadLegacyTeamConfiguredGroupSnapshots ?? loadConfiguredLegacyTeamGroupSnapshots;
+	async function loadedSnapshots(candidateRef) {
+		try {
+			return await loadSnapshots(candidateRef ? { candidateRef } : void 0);
+		} catch (error) {
+			if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
+			throw safeCoordinatorError();
+		}
+	}
+	const loadedSummarySnapshots = createCachedSnapshotLoader(() => loadedSnapshots(), SUMMARY_SNAPSHOT_CACHE_TTL_MS);
+	async function loadedCandidateSnapshots(candidateRef) {
+		loadedSummarySnapshots.invalidate();
+		try {
+			return await loadedSnapshots(candidateRef);
+		} finally {
+			loadedSummarySnapshots.invalidate();
+		}
+	}
+	app.get("/api/sync/team-setup/v1", async (c) => {
+		let groups;
+		try {
+			groups = await loadedSummarySnapshots();
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+		try {
+			const response = {
+				version: TEAM_SETUP_VERSION,
+				candidates: discoverCandidates(options.getStore(), groups).map(candidateSummary)
+			};
+			return c.json(response);
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.get("/api/sync/team-setup/v1/:candidateRef", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			let draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			let candidate;
+			if (draft?.state === "completed" && isLegacyTeamCandidateSelectable(store.db, candidateRef, { projects: legacyTeamCandidateProjectInventory(store.db, projectionOptions(store), candidateRef) })) candidate = completedCandidateFromDraft(draft);
+			else {
+				const discoveredCandidate = discoverCandidates(store, (await loadedCandidateSnapshots(candidateRef)).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef)).find((item) => item.candidateRef === candidateRef);
+				if (!discoveredCandidate) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+				candidate = discoveredCandidate;
+				draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			}
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			let conflictState = null;
+			let preview = null;
+			if (draft.state !== "completed") try {
+				preview = previewLegacyTeamSetupActivation(store.db, {
+					candidateRef,
+					attemptId: draft.attemptId
+				});
+			} catch (error) {
+				const code = apiErrorCode(error);
+				if (code === "team_setup_failed") return c.json({ error: code }, 503);
+				preview = null;
+				conflictState = code;
+			}
+			if (preview) requireBoundedAccessDelta(preview.accessDelta);
+			const viewDraft = conflictState ? getLegacyTeamSetupDraft(store.db, candidateRef) ?? draft : draft;
+			const safeDraft = viewerSafeDraft(store, viewDraft);
+			const responseBase = {
+				version: TEAM_SETUP_VERSION,
+				candidate: candidateSummaryForDraft(candidate, viewDraft),
+				attemptId: viewDraft.attemptId,
+				draftState: viewDraft.state,
+				unresolvedDeviceCount: viewDraft.unresolvedDeviceCount,
+				unresolvedProjectCount: viewDraft.unresolvedProjectCount,
+				...safeDraft
+			};
+			if (!preview) {
+				const response = {
+					...responseBase,
+					canFinish: false,
+					conflictState
+				};
+				return c.json(response);
+			}
+			const accessDelta = viewerSafeAccessDelta(candidateRef, preview.accessDelta, {
+				teamDisplayName: viewDraft.displayName,
+				...safeDraft
+			});
+			const response = {
+				...responseBase,
+				canFinish: true,
+				conflictState: null,
+				finishDigest: preview.finishDigest,
+				accessDeltaDigest: preview.accessDeltaDigest,
+				viewerAccessDeltaDigest: viewerAccessDeltaDigest(accessDelta),
+				accessDelta
+			};
+			return c.json(response);
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.put("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/assignment", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const deviceRef = c.req.param("deviceRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !DEVICE_REF_PATTERN.test(deviceRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, [
+			"attemptId",
+			"expectation",
+			"targetIdentityRef"
+		])) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, expectation, targetIdentityRef } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof targetIdentityRef !== "string" || !IDENTITY_REF_PATTERN.test(targetIdentityRef) || !expectation || typeof expectation !== "object" || Array.isArray(expectation)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const device = draft.devices.find((item) => item.deviceRef === deviceRef);
+			if (!device) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			const submittedExpectation = expectation;
+			if (!(device.expectation.kind === "absent" ? hasExactKeys(submittedExpectation, ["kind"]) && submittedExpectation.kind === "absent" : hasExactKeys(submittedExpectation, [
+				"assignmentVersion",
+				"identityRef",
+				"kind"
+			]) && submittedExpectation.kind === "existing" && submittedExpectation.assignmentVersion === device.expectation.assignmentVersion && submittedExpectation.identityRef === requiredIdentityRef(candidateRef, device.expectation.identityId))) return c.json({ error: "team_setup_assignment_changed" }, 409);
+			const target = identityChoices(store, candidateRef).find((choice) => choice.identityRef === targetIdentityRef);
+			if (!target) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			return c.json(mutationResponse(setLegacyTeamSetupDeviceAssignment(store.db, {
+				attemptId,
+				deviceRef,
+				targetIdentityId: target.identityId,
+				expectation: device.expectation
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.put("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/decision", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const deviceRef = c.req.param("deviceRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !DEVICE_REF_PATTERN.test(deviceRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, decision, expectedTargetIdentityRef } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || ![
+			"included",
+			"excluded",
+			"removed"
+		].includes(decision) || (decision === "included" ? !hasExactKeys(parsed.value, [
+			"attemptId",
+			"decision",
+			"expectedTargetIdentityRef"
+		]) || typeof expectedTargetIdentityRef !== "string" || !IDENTITY_REF_PATTERN.test(expectedTargetIdentityRef) : !hasExactKeys(parsed.value, ["attemptId", "decision"]))) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const device = draft.devices.find((item) => item.deviceRef === deviceRef);
+			if (!device) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (decision === "included" && (device.targetIdentityId === null || requiredIdentityRef(candidateRef, device.targetIdentityId) !== expectedTargetIdentityRef)) return c.json({ error: "team_setup_assignment_changed" }, 409);
+			return c.json(mutationResponse(setLegacyTeamSetupDeviceDecision(store.db, {
+				attemptId,
+				deviceRef,
+				decision
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.delete("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/decision", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const deviceRef = c.req.param("deviceRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !DEVICE_REF_PATTERN.test(deviceRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, ["attemptId"])) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			if (!draft.devices.some((item) => item.deviceRef === deviceRef)) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			return c.json(mutationResponse(clearLegacyTeamSetupDeviceDecision(store.db, {
+				attemptId,
+				deviceRef
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.put("/api/sync/team-setup/v1/:candidateRef/projects/:projectRef/mapping", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const projectRef = c.req.param("projectRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !PROJECT_REF_PATTERN.test(projectRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, ["attemptId", "resolvedProjectRef"])) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, resolvedProjectRef } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof resolvedProjectRef !== "string" || !RESOLVED_PROJECT_REF_PATTERN.test(resolvedProjectRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const project = draft.projects.find((item) => item.projectRef === projectRef);
+			if (!project) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (project.resolution === "deterministic") return c.json({ error: "team_setup_incomplete" }, 400);
+			const target = projectMappingChoices(store).find((choice) => legacyTeamResolvedProjectRef(projectRef, choice.projectIdentity) === resolvedProjectRef);
+			if (!target) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			return c.json(mutationResponse(setLegacyTeamSetupProjectMapping(store.db, {
+				attemptId,
+				projectRef,
+				resolvedProjectIdentity: target.projectIdentity
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.post("/api/sync/team-setup/v1/:candidateRef/refresh", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, [])) return c.json({ error: "team_setup_incomplete" }, 400);
+		let groups;
+		try {
+			groups = await loadedCandidateSnapshots(candidateRef);
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+		if (groups.filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef).length === 0) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+		try {
+			const store = options.getStore();
+			return c.json(mutationResponse(refreshLegacyTeamCandidate(store.db, {
+				projection: projectionOptions(store),
+				groups
+			}, candidateRef)));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.post("/api/sync/team-setup/v1/:candidateRef/finish", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok) return c.json({ error: "team_setup_incomplete" }, 400);
+		const finishKeys = [
+			"attemptId",
+			"confirmedAccessDeltaDigest",
+			"confirmedViewerAccessDeltaDigest",
+			"finishDigest"
+		];
+		if (!hasExactKeys(parsed.value, finishKeys)) return Object.keys(parsed.value).every((key) => finishKeys.includes(key)) ? c.json({ error: "team_setup_confirmation_stale" }, 409) : c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, confirmedAccessDeltaDigest, confirmedViewerAccessDeltaDigest, finishDigest } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof finishDigest !== "string" || !FINISH_DIGEST_PATTERN.test(finishDigest) || typeof confirmedAccessDeltaDigest !== "string" || !ACCESS_DELTA_DIGEST_PATTERN.test(confirmedAccessDeltaDigest) || typeof confirmedViewerAccessDeltaDigest !== "string" || !VIEWER_ACCESS_DELTA_DIGEST_PATTERN.test(confirmedViewerAccessDeltaDigest)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			if (draft.state !== "completed") {
+				const preview = previewLegacyTeamSetupActivation(store.db, {
+					candidateRef,
+					attemptId: draft.attemptId
+				});
+				requireBoundedAccessDelta(preview.accessDelta);
+				const safeDraft = viewerSafeDraft(store, draft);
+				if (viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, preview.accessDelta, {
+					teamDisplayName: draft.displayName,
+					...safeDraft
+				})) !== confirmedViewerAccessDeltaDigest) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			}
+			const result = await finishLegacyTeamSetupActivation(store.db, {
+				candidateRef,
+				attemptId,
+				finishDigest,
+				confirmedAccessDeltaDigest,
+				loadFreshRoster: async () => {
+					const matching = (await loadedCandidateSnapshots(candidateRef)).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef);
+					if (matching.length !== 1) throw safeCoordinatorError();
+					return matching[0]?.devices ?? [];
+				},
+				loadProjectInventory: () => legacyTeamCandidateProjectInventory(store.db, projectionOptions(store), candidateRef),
+				validateLockedPreview: (lockedPreview) => {
+					requireBoundedAccessDelta(lockedPreview.accessDelta);
+					const lockedDraft = getLegacyTeamSetupDraft(store.db, candidateRef);
+					if (!lockedDraft || lockedDraft.attemptId !== attemptId) return false;
+					const safeDraft = viewerSafeDraft(store, lockedDraft);
+					return viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, lockedPreview.accessDelta, {
+						teamDisplayName: lockedDraft.displayName,
+						...safeDraft
+					})) === confirmedViewerAccessDeltaDigest;
+				}
+			});
+			return c.json(finishResponse(candidateRef, result));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	return app;
+}
+//#endregion
 //#region src/routes/update-status.ts
 function updateStatusRoutes(options = {}) {
 	const getUpdateStatus$1 = options.getUpdateStatus ?? getUpdateStatus;
@@ -8216,7 +9083,7 @@ function createApp(opts) {
 	const getSyncRuntimeStatus = opts?.getSyncRuntimeStatus ?? (() => null);
 	const app = new Hono();
 	app.use("*", preflightHandler());
-	app.use("*", originGuard());
+	app.use("*", originGuard({ unsafeGetPathPrefixes: [TEAM_SETUP_ROUTE_PREFIX] }));
 	app.route("/", healthRoutes(storeFactory));
 	app.route("/", statsRoutes(storeFactory));
 	app.route("/", memoryRoutes(storeFactory));
@@ -8229,6 +9096,10 @@ function createApp(opts) {
 	app.route("/", configRoutes({ getSweeper: () => sweeper }));
 	app.route("/", rawEventsRoutes(storeFactory, sweeper));
 	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus, { loadDeviceIdentityCoordinatorEvidence: opts?.loadDeviceIdentityCoordinatorEvidence }));
+	app.route("/", teamSetupRoutes({
+		getStore: storeFactory,
+		loadLegacyTeamConfiguredGroupSnapshots: opts?.loadLegacyTeamConfiguredGroupSnapshots
+	}));
 	app.route("/", updateStatusRoutes({ getUpdateStatus: opts?.getUpdateStatus }));
 	const staticRoot = process.env.CODEMEM_VIEWER_STATIC_DIR ?? join(import.meta.dirname ?? ".", "../static");
 	app.use("/assets/*", async (c, next) => {