@codemem/server 0.46.0-alpha.1 → 0.46.0-beta.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -284,7 +284,7 @@ var DEFAULTS = {
 	sync_host: "0.0.0.0",
 	sync_port: 7337,
 	sync_interval_s: 120,
-	sync_mdns: true,
+	sync_mdns: false,
 	sync_coordinator_timeout_s: 3,
 	sync_coordinator_presence_ttl_s: 180,
 	raw_events_sweeper_interval_s: 30
@@ -303,14 +303,18 @@ function getEffectiveConfig(configData) {
 		...configData
 	};
 	for (const key of ["claude_command", "codex_command"]) effective[key] = coerceObserverCommand(effective[key]) ?? DEFAULTS[key];
-	for (const [key, envVar] of Object.entries(CODEMEM_CONFIG_ENV_OVERRIDES)) {
-		const val = process.env[envVar];
-		if (val == null || val === "") continue;
-		if (key === "claude_command" || key === "codex_command") effective[key] = coerceObserverCommand(val) ?? effective[key];
-		else effective[key] = val;
-	}
+	Object.assign(effective, getCodememEnvOverrideValues());
 	return effective;
 }
+function observerRuntimeMetadata(configData) {
+	return {
+		resolved_observer_runtime: resolveObserverRuntime(configData),
+		observer_runtime_by_auth_source: Object.fromEntries([...AUTH_SOURCES].map((source) => [source, resolveObserverRuntime({
+			...configData,
+			observer_auth_source: source
+		})]))
+	};
+}
 function redactConfigValue(key, value) {
 	if (value == null || !SECRET_CONFIG_KEYS.has(key)) return value;
 	if (Array.isArray(value)) return value.length > 0 ? REDACTED_VALUE : [];
@@ -530,6 +534,7 @@ function viewerConfigSavePayload(saved, opts) {
 		path: savedPath,
 		config: sanitizeConfigForResponse(nextConfig),
 		effective: sanitizeConfigForResponse(afterEffective),
+		...observerRuntimeMetadata(nextConfig),
 		protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 		effects: {
 			saved_keys: savedChangedKeys,
@@ -563,6 +568,7 @@ function configRoutes(opts = {}) {
 			config: sanitizeConfigForResponse(configData),
 			defaults: DEFAULTS,
 			effective: sanitizeConfigForResponse(effective),
+			...observerRuntimeMetadata(configData),
 			env_overrides: getCodememEnvOverrides(),
 			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 			providers: loadProviderOptions()
@@ -1594,7 +1600,7 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
-		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
+		if (!forgetTargetExists(store, memoryId, forgetSafetyFilters(body))) return c.json(...forgetNotFound(forgetSafetyFilters(body)));
 		const row = drizzle(store.db, { schema }).select().from(schema.memoryItems).where(eq(schema.memoryItems.id, memoryId)).get();
 		if (!row) return c.json({ error: "memory not found" }, 404);
 		if (!store.memoryOwnedBySelf(row)) return c.json({ error: "memory not owned by this device" }, 403);
@@ -1612,6 +1618,19 @@ function memoryRoutes(getStore) {
 	});
 	return app;
 }
+function forgetNotFound(filters) {
+	return [{ error: Object.keys(filters).length > 0 ? "not_found" : "memory not found" }, 404];
+}
+function forgetSafetyFilters(body) {
+	const filters = {};
+	if (typeof body.kind === "string" && body.kind.trim()) filters.kind = body.kind.trim();
+	if (typeof body.project === "string" && body.project.trim()) filters.project = body.project.trim();
+	return filters;
+}
+function forgetTargetExists(store, memoryId, filters) {
+	if (Object.keys(filters).length > 0) return store.timeline(null, memoryId, 0, 0, filters).some((row) => row.id === memoryId);
+	return store.get(memoryId) != null;
+}
 //#endregion
 //#region src/routes/memory-tools.ts
 /**
@@ -2129,6 +2148,15 @@ function buildFailureImpact(latestFailure, queueTotals, authBackoff) {
 	if (queueTotals.pending > 0) return `${queueTotals.pending} queued raw events across ${queueTotals.sessions} session(s) are waiting on a successful flush.`;
 	return "Failed flush batches are pending retry.";
 }
+function readCaptureEnabled() {
+	const value = process.env.CODEMEM_RAW_EVENTS?.trim().toLowerCase();
+	if (!value) return null;
+	return ![
+		"0",
+		"false",
+		"off"
+	].includes(value);
+}
 function observerStatusRoutes(deps) {
 	const app = new Hono();
 	app.get("/api/observer-status", (c) => {
@@ -2138,6 +2166,7 @@ function observerStatusRoutes(deps) {
 		if (!store || typeof store.rawEventBacklogTotals !== "function") return c.json({
 			active: null,
 			available_credentials: {},
+			capture_enabled: readCaptureEnabled(),
 			latest_failure: null,
 			queue: {
 				pending: 0,
@@ -2161,6 +2190,7 @@ function observerStatusRoutes(deps) {
 		return c.json({
 			active,
 			available_credentials: availableCredentials,
+			capture_enabled: readCaptureEnabled(),
 			latest_failure: failureWithImpact,
 			queue: {
 				...queueTotals,
@@ -2240,6 +2270,34 @@ function validateViewerTarget(store, payload, options = {}) {
 	if ((options.requireCurrentIdentity || payload.identity_target != null) && !store.hasCurrentIdentity()) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
 	return { ok: true };
 }
+/**
+* Middleware read of db_path / identity_target from the query string.
+* Native tools (pi extension) send targets as query params so a pre-handler
+* guard can reject a foreign viewer without consuming POST bodies. Lenient:
+* clients that omit targets (UI, MCP, curl) are unaffected.
+*/
+function viewerTargetQueryGuard(getStore) {
+	return async (c, next) => {
+		const dbPath = c.req.query("db_path");
+		const rawIdentity = c.req.query("identity_target");
+		if (dbPath == null && rawIdentity == null) return next();
+		let identityTarget;
+		if (rawIdentity != null) try {
+			identityTarget = JSON.parse(rawIdentity);
+		} catch {
+			return c.json({ error: {
+				code: "invalid_request",
+				message: "identity_target must be JSON"
+			} }, 400);
+		}
+		const target = validateViewerTarget(getStore(), {
+			db_path: dbPath ?? void 0,
+			identity_target: identityTarget
+		});
+		if (!target.ok) return c.json(target.body, target.status);
+		return next();
+	};
+}
 //#endregion
 //#region src/routes/pack.ts
 var MAX_LEDGER_PAYLOAD_BYTES = 16384;
@@ -2675,21 +2733,26 @@ function resolveRawEventInboxDirectory(dbPath, homeDir = homedir()) {
 	const target = createHash("sha256").update(resolve(dbPath)).digest("hex").slice(0, 24);
 	return join(homeDir, ".codemem", INBOX_DIRECTORY_NAME, target);
 }
-function entryContent(request, flushBoundary) {
+function entryContent(request, flushBoundary, boundary) {
 	return {
 		version: 1,
 		request,
-		flush_boundary: flushBoundary
+		flush_boundary: flushBoundary,
+		...boundary ? { boundary: {
+			source: boundary.source,
+			stream_id: boundary.streamId,
+			...boundary.id ? { id: boundary.id } : {}
+		} } : {}
 	};
 }
-function storedEntry(request, flushBoundary, enqueueOrder) {
+function storedEntry(request, flushBoundary, boundary, enqueueOrder) {
 	return {
-		...entryContent(request, flushBoundary),
+		...entryContent(request, flushBoundary, boundary),
 		enqueue_order: enqueueOrder.toString()
 	};
 }
 function entryContentId(entry) {
-	return contentId(JSON.stringify(entryContent(entry.request, entry.flushBoundary)));
+	return contentId(JSON.stringify(entryContent(entry.request, entry.flushBoundary, entry.boundary)));
 }
 function inboxFileName(enqueueOrder, id) {
 	return `${enqueueOrder.toString().padStart(24, "0")}-${id}.json`;
@@ -2749,10 +2812,17 @@ async function ensurePrivateDirectory(path) {
 function parseStoredEntry(serialized) {
 	const parsed = JSON.parse(serialized);
 	if (parsed.version !== 1 || typeof parsed.enqueue_order !== "string" || !/^[1-9]\d*$/u.test(parsed.enqueue_order) || parsed.request == null || typeof parsed.request !== "object" || Array.isArray(parsed.request) || typeof parsed.flush_boundary !== "boolean") throw new Error("invalid raw-event inbox entry");
+	const storedBoundary = parsed.boundary;
+	if (storedBoundary !== void 0 && (typeof storedBoundary.source !== "string" || storedBoundary.source.trim() === "" || typeof storedBoundary.stream_id !== "string" || storedBoundary.stream_id.trim() === "" || storedBoundary.id !== void 0 && (typeof storedBoundary.id !== "string" || storedBoundary.id.trim() === ""))) throw new Error("invalid raw-event inbox boundary");
 	return {
 		entry: {
 			request: parsed.request,
-			flushBoundary: parsed.flush_boundary
+			flushBoundary: parsed.flush_boundary,
+			...storedBoundary ? { boundary: {
+				source: storedBoundary.source,
+				streamId: storedBoundary.stream_id,
+				...storedBoundary.id ? { id: storedBoundary.id } : {}
+			} } : {}
 		},
 		enqueueOrder: BigInt(parsed.enqueue_order)
 	};
@@ -2803,7 +2873,8 @@ var FileRawEventInbox = class {
 		const flushBoundary = options.flushBoundary === true;
 		const id = entryContentId({
 			request,
-			flushBoundary
+			flushBoundary,
+			boundary: options.boundary
 		});
 		await ensurePrivateDirectory(this.directory);
 		const entries = await readdir(this.directory, { withFileTypes: true });
@@ -2823,7 +2894,7 @@ var FileRawEventInbox = class {
 			throw error;
 		}
 		const enqueueOrder = await this.allocateEnqueueOrder(entries);
-		const serialized = JSON.stringify(storedEntry(request, flushBoundary, enqueueOrder));
+		const serialized = JSON.stringify(storedEntry(request, flushBoundary, options.boundary, enqueueOrder));
 		const destination = join(this.directory, inboxFileName(enqueueOrder, id));
 		const temporary = join(this.directory, `.${id}.${process.pid}.${randomUUID()}.tmp`);
 		try {
@@ -3024,10 +3095,11 @@ function createViewerRawEventInbox(options) {
 		onCorruptEntries: options.onCorruptEntries,
 		onBacklog: options.onBacklog,
 		onBacklogRecovered: options.onBacklogRecovered,
-		processEntry: async ({ request, flushBoundary }) => {
+		processEntry: async ({ request, flushBoundary, boundary }) => {
 			const result = ingestRawEvents(store, request);
 			nudgeRawEventSessions(options.sweeper, result.sessions);
-			if (flushBoundary && isClaudeBoundaryEnvelope(request)) await flushRawEventBoundarySessions(options.sweeper, result.sessions);
+			if (boundary) await options.sweeper?.flushBoundary(boundary.streamId, boundary.source);
+			else if (flushBoundary && isClaudeBoundaryEnvelope(request)) await flushRawEventBoundarySessions(options.sweeper, result.sessions);
 		}
 	});
 	return {
@@ -3155,15 +3227,94 @@ async function enqueueRawEventRequest(options) {
 	if (!target.ok) return options.c.json(target.body, target.status);
 	const validation = validateRawEvents(options.request);
 	try {
-		await options.inbox.enqueue(validation.request, { flushBoundary: options.flushBoundary });
+		await options.inbox.enqueue(validation.request, options.boundary ? {
+			flushBoundary: options.flushBoundary,
+			boundary: options.boundary
+		} : { flushBoundary: options.flushBoundary });
 	} catch (error) {
 		return boundedInboxErrorResponse(options.c, error);
 	}
+	const accepted = options.acceptedCount ?? validation.received;
 	return options.c.json({
-		accepted: validation.received,
-		queued: validation.received
+		accepted,
+		queued: accepted
 	}, 202);
 }
+function piEventName(payload) {
+	for (const key of [
+		"piEvent",
+		"pi_event",
+		"event",
+		"type"
+	]) {
+		const value = payload[key];
+		if (typeof value === "string" && value.trim()) return value.trim();
+	}
+	return "";
+}
+function piInboxBoundary(payload, envelope, signal) {
+	if (!["session_before_compact", "session_shutdown"].includes(piEventName(payload))) return;
+	const streamId = envelope?.session_stream_id ?? signal?.session_id;
+	if (!streamId) return;
+	const envelopeTimestamp = envelope?.payload.timestamp;
+	const id = typeof envelopeTimestamp === "string" ? envelopeTimestamp : signal?.ts;
+	return {
+		source: "pi",
+		streamId,
+		...id ? { id } : {}
+	};
+}
+async function postPiHookRequest(c, getStore, sweeper, inbox, inboxTarget) {
+	const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
+	if (result instanceof Response) return result;
+	const payload = result;
+	try {
+		const target = validateViewerTarget(inbox && inboxTarget ? inboxTarget : getStore(), payload, { requirePairedTargets: true });
+		if (!target.ok) return c.json(target.body, target.status);
+		const untargeted = untargetedPayload(payload);
+		const envelope = buildRawEventEnvelopeFromPiEvent(untargeted);
+		const signal = buildPiFlushSignalFromEvent(untargeted);
+		const boundary = piInboxBoundary(untargeted, envelope, signal);
+		if (envelope === null && signal === null) return c.json({
+			inserted: 0,
+			skipped: 1
+		});
+		if (inbox) return await enqueueRawEventRequest({
+			c,
+			getStore,
+			inbox,
+			inboxTarget,
+			payload,
+			request: envelope ? {
+				...envelope,
+				source: "pi"
+			} : {
+				source: "pi",
+				session_stream_id: signal?.session_id,
+				events: []
+			},
+			flushBoundary: false,
+			...boundary ? {
+				boundary,
+				acceptedCount: 1
+			} : {}
+		});
+		if (envelope === null) return c.json({
+			inserted: 0,
+			skipped: 1
+		});
+		const ingestResult = await ingestNormalizedEnvelope(getStore(), sweeper, {
+			...envelope,
+			source: "pi"
+		});
+		return c.json({
+			inserted: ingestResult.inserted,
+			skipped: ingestResult.skipped
+		});
+	} catch (error) {
+		return boundedIngestErrorResponse(c, error);
+	}
+}
 async function postRawEventRequest(c, getStore, sweeper, inbox, inboxTarget) {
 	const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 	if (result instanceof Response) return result;
@@ -3197,6 +3348,81 @@ async function ingestNormalizedEnvelope(store, sweeper, envelope, flushBoundary
 	if (flushBoundary && isClaudeBoundaryEnvelope(envelope)) await flushRawEventBoundarySessions(sweeper, result.sessions);
 	return result;
 }
+async function postClaudeHookRequest(c, getStore, sweeper, inbox, inboxTarget, transcriptDiagnostics) {
+	const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
+	if (result instanceof Response) return result;
+	const payload = result;
+	try {
+		const target = validateViewerTarget(inbox && inboxTarget ? inboxTarget : getStore(), payload, { requirePairedTargets: true });
+		if (!target.ok) return c.json(target.body, target.status);
+		let transcriptOutcome = null;
+		const envelope = buildRawEventEnvelopeFromHook(untargetedPayload(payload), {
+			transcriptPolicy: {
+				trust: "restricted",
+				approvedRoots: [claudeTranscriptRoot()]
+			},
+			onTranscriptOutcome: (outcome) => {
+				transcriptOutcome = outcome;
+				transcriptDiagnostics.record("claude", outcome);
+			}
+		});
+		if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
+		const flushBoundary = c.req.header("x-codemem-boundary-flush") === "1";
+		if (inbox) return await enqueueRawEventRequest({
+			c,
+			getStore,
+			inbox,
+			inboxTarget,
+			payload,
+			request: { ...envelope },
+			flushBoundary
+		});
+		const ingestResult = await ingestNormalizedEnvelope(getStore(), sweeper, envelope, flushBoundary);
+		return c.json({
+			inserted: ingestResult.inserted,
+			skipped: ingestResult.skipped
+		});
+	} catch (error) {
+		return boundedIngestErrorResponse(c, error);
+	}
+}
+async function postCodexHookRequest(c, getStore, sweeper, inbox, inboxTarget, transcriptDiagnostics) {
+	const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
+	if (result instanceof Response) return result;
+	const payload = result;
+	try {
+		const target = validateViewerTarget(inbox && inboxTarget ? inboxTarget : getStore(), payload, { requirePairedTargets: true });
+		if (!target.ok) return c.json(target.body, target.status);
+		let transcriptOutcome = null;
+		const envelope = buildRawEventEnvelopeFromCodexHook(untargetedPayload(payload), {
+			transcriptPolicy: {
+				trust: "restricted",
+				approvedRoots: [codexTranscriptRoot()]
+			},
+			onTranscriptOutcome: (outcome) => {
+				transcriptOutcome = outcome;
+				transcriptDiagnostics.record("codex", outcome);
+			}
+		});
+		if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
+		if (inbox) return await enqueueRawEventRequest({
+			c,
+			getStore,
+			inbox,
+			inboxTarget,
+			payload,
+			request: { ...envelope },
+			flushBoundary: false
+		});
+		const ingestResult = await ingestNormalizedEnvelope(getStore(), sweeper, envelope);
+		return c.json({
+			inserted: ingestResult.inserted,
+			skipped: ingestResult.skipped
+		});
+	} catch (error) {
+		return boundedIngestErrorResponse(c, error);
+	}
+}
 function rawEventsRoutes(getStore, sweeper, inbox, inboxTarget) {
 	const app = new Hono();
 	const transcriptDiagnostics = createTranscriptDiagnostics();
@@ -3248,89 +3474,9 @@ function rawEventsRoutes(getStore, sweeper, inbox, inboxTarget) {
 		});
 	});
 	app.post("/api/raw-events", (c) => postRawEventRequest(c, getStore, sweeper, inbox, inboxTarget));
-	app.post("/api/claude-hooks", async (c) => {
-		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
-		if (result instanceof Response) return result;
-		const payload = result;
-		try {
-			const store = getStore();
-			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
-			if (!target.ok) return c.json(target.body, target.status);
-			let transcriptOutcome = null;
-			const envelope = buildRawEventEnvelopeFromHook(untargetedPayload(payload), {
-				transcriptPolicy: {
-					trust: "restricted",
-					approvedRoots: [claudeTranscriptRoot()]
-				},
-				onTranscriptOutcome: (outcome) => {
-					transcriptOutcome = outcome;
-					transcriptDiagnostics.record("claude", outcome);
-				}
-			});
-			if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
-			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, envelope, c.req.header("x-codemem-boundary-flush") === "1");
-			return c.json({
-				inserted: ingestResult.inserted,
-				skipped: ingestResult.skipped
-			});
-		} catch (err) {
-			return boundedIngestErrorResponse(c, err);
-		}
-	});
-	app.post("/api/codex-hooks", async (c) => {
-		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
-		if (result instanceof Response) return result;
-		const payload = result;
-		try {
-			const store = getStore();
-			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
-			if (!target.ok) return c.json(target.body, target.status);
-			let transcriptOutcome = null;
-			const envelope = buildRawEventEnvelopeFromCodexHook(untargetedPayload(payload), {
-				transcriptPolicy: {
-					trust: "restricted",
-					approvedRoots: [codexTranscriptRoot()]
-				},
-				onTranscriptOutcome: (outcome) => {
-					transcriptOutcome = outcome;
-					transcriptDiagnostics.record("codex", outcome);
-				}
-			});
-			if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
-			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, envelope);
-			return c.json({
-				inserted: ingestResult.inserted,
-				skipped: ingestResult.skipped
-			});
-		} catch (err) {
-			return boundedIngestErrorResponse(c, err);
-		}
-	});
-	app.post("/api/pi-hooks", async (c) => {
-		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
-		if (result instanceof Response) return result;
-		const payload = result;
-		try {
-			const store = getStore();
-			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
-			if (!target.ok) return c.json(target.body, target.status);
-			const envelope = buildRawEventEnvelopeFromPiEvent(untargetedPayload(payload));
-			if (envelope === null) return c.json({
-				inserted: 0,
-				skipped: 1
-			});
-			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, {
-				...envelope,
-				source: "pi"
-			});
-			return c.json({
-				inserted: ingestResult.inserted,
-				skipped: ingestResult.skipped
-			});
-		} catch (err) {
-			return boundedIngestErrorResponse(c, err);
-		}
-	});
+	app.post("/api/claude-hooks", (c) => postClaudeHookRequest(c, getStore, sweeper, inbox, inboxTarget, transcriptDiagnostics));
+	app.post("/api/codex-hooks", (c) => postCodexHookRequest(c, getStore, sweeper, inbox, inboxTarget, transcriptDiagnostics));
+	app.post("/api/pi-hooks", (c) => postPiHookRequest(c, getStore, sweeper, inbox, inboxTarget));
 	return app;
 }
 //#endregion
@@ -4231,6 +4377,40 @@ var PEERS_QUERY$1 = `
 	ORDER BY name, peer_device_id
 `;
 //#endregion
+//#region src/snapshot-source.ts
+function snapshotGeneration(raw) {
+	if (!raw?.trim()) return null;
+	return Number.parseInt(raw, 10);
+}
+function snapshotSourceDevice(requested, localDeviceId) {
+	if (requested !== void 0 && requested !== localDeviceId) throw new Error("retirement_snapshot_source_required");
+	return requested;
+}
+function snapshotErrorStatus(message) {
+	if ([
+		"retirement_snapshot_source_required",
+		"missing_generation",
+		"missing_snapshot_id"
+	].includes(message)) return 400;
+	if (message === "generation_mismatch" || message === "boundary_mismatch") return 409;
+	return null;
+}
+function snapshotPageRequest(query, localDeviceId) {
+	const generation = snapshotGeneration(query("generation"));
+	const snapshotId = query("snapshot_id");
+	if (generation === null || !Number.isFinite(generation)) throw new Error("missing_generation");
+	if (!snapshotId) throw new Error("missing_snapshot_id");
+	const rawLimit = Number.parseInt(query("limit") ?? "200", 10);
+	return {
+		generation,
+		snapshotId,
+		baselineCursor: query("baseline_cursor") ?? null,
+		pageToken: query("page_token") ?? null,
+		sourceDeviceId: snapshotSourceDevice(query("source_device_id"), localDeviceId),
+		limit: Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200
+	};
+}
+//#endregion
 //#region src/routes/team-setup-view.ts
 var enabled = {
 	enabled: true,
@@ -6176,6 +6356,26 @@ function tryParsePairingPayload(value) {
 		addresses
 	};
 }
+async function inspectPairingInvite(c, next) {
+	const body = await parseViewerJsonBody(c);
+	if (typeof body?.invite !== "string") return c.json({ error: "invite_invalid" }, 400);
+	try {
+		const pairing = tryParsePairingPayload(body.invite.match(/echo\s+['"]([A-Za-z0-9+/=]+)['"]\s*\|\s*base64\s+-d\s*\|\s*codemem/)?.[1]?.trim() || body.invite.trim());
+		if (pairing?.kind === "invalid-pair") return c.json({ error: pairing.error }, 400);
+		if (pairing?.kind !== "pair") {
+			decodeInvitePayload(extractInvitePayload(body.invite));
+			return next();
+		}
+		return c.json({
+			kind: "pair",
+			device_id: pairing.device_id,
+			fingerprint: pairing.fingerprint,
+			addresses: pairing.addresses
+		});
+	} catch (error) {
+		return c.json({ error: safeRecipientInviteError(error) }, 400);
+	}
+}
 function coordinatorAdminStatusPayload(config = readCoordinatorSyncConfig()) {
 	const groups = config.syncCoordinatorGroups;
 	const activeGroup = groups[0] ?? null;
@@ -8750,6 +8950,42 @@ function negotiatedSyncCapability(c) {
 * network-accessible. All requests are auth-gated via signature
 * verification so unauthenticated callers are rejected.
 */
+function serveAuthorizedSnapshot(c, store, peerDeviceId) {
+	try {
+		const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
+			db: store.db,
+			localDeviceId,
+			negotiatedCapability: negotiatedSyncCapability(c),
+			peerDeviceId
+		});
+		if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
+		const pageRequest = snapshotPageRequest((name) => c.req.query(name), localDeviceId);
+		const result = loadMemorySnapshotPageForPeer(store.db, {
+			...pageRequest,
+			peerDeviceId,
+			scopeId: scopeRequest.mode === "scoped" ? scopeRequest.scope_id : void 0
+		});
+		return c.json({
+			source_device_id: pageRequest.sourceDeviceId,
+			scope_id: scopeRequest.scope_id,
+			generation: result.boundary.generation,
+			snapshot_id: result.boundary.snapshot_id,
+			baseline_cursor: result.boundary.baseline_cursor,
+			retained_floor_cursor: result.boundary.retained_floor_cursor,
+			sync_capability: LOCAL_SYNC_CAPABILITY,
+			items: result.items,
+			next_page_token: result.nextPageToken,
+			has_more: result.hasMore
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : "";
+		const status = snapshotErrorStatus(message);
+		if (status) return c.json({ error: message }, status);
+		return c.json({ error: "internal_error" }, 500);
+	}
+}
 function syncProtocolRoutes(getStore, opts = {}) {
 	const app = new Hono();
 	const routeRateLimit = opts.routeRateLimit ?? null;
@@ -8916,51 +9152,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
-			try {
-				const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
-				const negotiated = negotiatedSyncCapability(c);
-				const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-				const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
-					db: store.db,
-					localDeviceId,
-					negotiatedCapability: negotiated,
-					peerDeviceId: auth.deviceId
-				});
-				if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
-				const rawGeneration = c.req.query("generation");
-				const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
-				const snapshotId = c.req.query("snapshot_id") ?? null;
-				const baselineCursor = c.req.query("baseline_cursor") ?? null;
-				const pageToken = c.req.query("page_token") ?? null;
-				const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
-				const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200;
-				if (generation == null || !Number.isFinite(generation)) return c.json({ error: "missing_generation" }, 400);
-				if (!snapshotId) return c.json({ error: "missing_snapshot_id" }, 400);
-				const result = loadMemorySnapshotPageForPeer(store.db, {
-					generation,
-					snapshotId,
-					baselineCursor,
-					pageToken,
-					limit,
-					peerDeviceId: auth.deviceId,
-					scopeId: scopeRequest.mode === "scoped" ? scopeRequest.scope_id : void 0
-				});
-				return c.json({
-					scope_id: scopeRequest.scope_id,
-					generation: result.boundary.generation,
-					snapshot_id: result.boundary.snapshot_id,
-					baseline_cursor: result.boundary.baseline_cursor,
-					retained_floor_cursor: result.boundary.retained_floor_cursor,
-					sync_capability: LOCAL_SYNC_CAPABILITY,
-					items: result.items,
-					next_page_token: result.nextPageToken,
-					has_more: result.hasMore
-				});
-			} catch (err) {
-				const message = err instanceof Error ? err.message : "";
-				if (message === "generation_mismatch" || message === "boundary_mismatch") return c.json({ error: message }, 409);
-				return c.json({ error: "internal_error" }, 500);
-			}
+			return serveAuthorizedSnapshot(c, store, auth.deviceId);
 		})();
 	});
 	app.post("/v1/ops", async (c) => {
@@ -9038,7 +9230,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 }
 async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 	const config = readCoordinatorSyncConfig();
-	const hasCoordinatorConfiguration = config.syncCoordinatorUrl.length > 0 || config.syncCoordinatorGroups.length > 0;
+	const hasCoordinatorConfiguration = config.syncCoordinatorUrl.length > 0 || config.syncCoordinatorGroups.length > 0 || config.syncCoordinatorAdminSecret.length > 0;
 	const remoteUrl = config.syncCoordinatorUrl.trim();
 	const adminSecret = config.syncCoordinatorAdminSecret.trim();
 	const groupIds = [...new Set(config.syncCoordinatorGroups.map((groupId) => groupId.trim()))].filter(Boolean);
@@ -9049,7 +9241,7 @@ async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 	};
 	if (!remoteUrl || !adminSecret || groupIds.length === 0) return {
 		availability: "unavailable",
-		safeErrorCode: "coordinator_unavailable",
+		safeErrorCode: "coordinator_configuration_required",
 		enrollments: []
 	};
 	if (groupIds.length > 25) return {
@@ -9082,6 +9274,61 @@ async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 		};
 	}
 }
+var ORIGIN_DEVICE_NAME_LOOKUP_BATCH_SIZE = 400;
+function originDeviceNameKey(value) {
+	return value.normalize("NFKC").toLowerCase().toUpperCase().toLowerCase();
+}
+function originDeviceDisplayName(value, deviceId) {
+	if (typeof value !== "string") return null;
+	try {
+		const displayName = normalizeHumanPresentationName(value, "display_name");
+		let normalizedDeviceId = deviceId;
+		try {
+			normalizedDeviceId = normalizeHumanPresentationName(deviceId, "device_id");
+		} catch {}
+		return originDeviceNameKey(displayName) === originDeviceNameKey(normalizedDeviceId) ? null : displayName;
+	} catch {
+		return null;
+	}
+}
+function resolveOriginDeviceDisplayNames(store, projects) {
+	const deviceIds = [...new Set(projects.flatMap((project) => project.origin_devices.map((device) => device.device_id)))];
+	const names = /* @__PURE__ */ new Map();
+	for (let offset = 0; offset < deviceIds.length; offset += ORIGIN_DEVICE_NAME_LOOKUP_BATCH_SIZE) {
+		const batch = deviceIds.slice(offset, offset + ORIGIN_DEVICE_NAME_LOOKUP_BATCH_SIZE);
+		const placeholders = batch.map(() => "?").join(", ");
+		const peers = store.db.prepare(`SELECT peer_device_id AS device_id, name AS display_name
+				 FROM sync_peers
+				 WHERE peer_device_id IN (${placeholders})
+				   AND TRIM(COALESCE(pinned_fingerprint, '')) <> ''`).all(...batch);
+		for (const peer of peers) {
+			const displayName = originDeviceDisplayName(peer.display_name, peer.device_id);
+			if (displayName) names.set(peer.device_id, displayName);
+		}
+		const devices = store.db.prepare(`SELECT device_id, display_name
+				 FROM identity_devices
+				 WHERE device_id IN (${placeholders}) AND status = 'active'`).all(...batch);
+		for (const device of devices) {
+			const displayName = originDeviceDisplayName(device.display_name, device.device_id);
+			if (displayName) names.set(device.device_id, displayName);
+		}
+	}
+	return names;
+}
+function serializeProjectScopeInventory(store, inventory, sharingByProject) {
+	const originDeviceNames = resolveOriginDeviceDisplayNames(store, inventory.projects);
+	return {
+		...inventory,
+		projects: inventory.projects.map((project) => ({
+			...project,
+			origin_devices: project.origin_devices.map(({ device_id }) => ({
+				device_id,
+				display_name: originDeviceNames.get(device_id) ?? null
+			})),
+			sharing: sharingByProject.get(project.workspace_identity) ?? []
+		}))
+	};
+}
 /**
 * Viewer-facing sync management routes (/api/sync/*).
 *
@@ -9090,7 +9337,7 @@ async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 * local viewer.
 */
 function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
-	const app = new Hono();
+	const app = new Hono().post("/api/sync/invites/inspect", inspectPairingInvite);
 	const readCoordinatorConfig = options.readCoordinatorConfig ?? readCoordinatorSyncConfig;
 	const renameCoordinatorGroup = options.renameCoordinatorGroup ?? coordinatorRenameGroupAction;
 	const loadCoordinatorEvidence = options.loadDeviceIdentityCoordinatorEvidence ?? loadConfiguredDeviceIdentityCoordinatorEvidence;
@@ -9735,13 +9982,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			});
 			sharingByProject.set(item.canonical_project_identity, current);
 		}
-		return c.json({
-			...inventory,
-			projects: inventory.projects.map((project) => ({
-				...project,
-				sharing: sharingByProject.get(project.workspace_identity) ?? []
-			}))
-		});
+		return c.json(serializeProjectScopeInventory(store, inventory, sharingByProject));
 	});
 	app.post("/api/sync/projects/reassign-project", async (c) => {
 		const store = getStore();
@@ -11940,6 +12181,9 @@ function createApp(opts) {
 	const app = new Hono();
 	app.use("*", preflightHandler());
 	app.use("*", originGuard({ unsafeGetPathPrefixes: [TEAM_SETUP_ROUTE_PREFIX] }));
+	const viewerTargetGuard = viewerTargetQueryGuard(storeFactory);
+	app.use("/api/memories/*", viewerTargetGuard);
+	app.use("/api/memory", viewerTargetGuard);
 	app.route("/", healthRoutes(storeFactory));
 	app.route("/", diagnosticsRoutes(storeFactory));
 	app.route("/", statsRoutes(storeFactory));