@codemem/server 0.46.0-alpha.2 → 0.46.0-beta.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -284,7 +284,7 @@ var DEFAULTS = {
 	sync_host: "0.0.0.0",
 	sync_port: 7337,
 	sync_interval_s: 120,
-	sync_mdns: true,
+	sync_mdns: false,
 	sync_coordinator_timeout_s: 3,
 	sync_coordinator_presence_ttl_s: 180,
 	raw_events_sweeper_interval_s: 30
@@ -303,14 +303,18 @@ function getEffectiveConfig(configData) {
 		...configData
 	};
 	for (const key of ["claude_command", "codex_command"]) effective[key] = coerceObserverCommand(effective[key]) ?? DEFAULTS[key];
-	for (const [key, envVar] of Object.entries(CODEMEM_CONFIG_ENV_OVERRIDES)) {
-		const val = process.env[envVar];
-		if (val == null || val === "") continue;
-		if (key === "claude_command" || key === "codex_command") effective[key] = coerceObserverCommand(val) ?? effective[key];
-		else effective[key] = val;
-	}
+	Object.assign(effective, getCodememEnvOverrideValues());
 	return effective;
 }
+function observerRuntimeMetadata(configData) {
+	return {
+		resolved_observer_runtime: resolveObserverRuntime(configData),
+		observer_runtime_by_auth_source: Object.fromEntries([...AUTH_SOURCES].map((source) => [source, resolveObserverRuntime({
+			...configData,
+			observer_auth_source: source
+		})]))
+	};
+}
 function redactConfigValue(key, value) {
 	if (value == null || !SECRET_CONFIG_KEYS.has(key)) return value;
 	if (Array.isArray(value)) return value.length > 0 ? REDACTED_VALUE : [];
@@ -530,6 +534,7 @@ function viewerConfigSavePayload(saved, opts) {
 		path: savedPath,
 		config: sanitizeConfigForResponse(nextConfig),
 		effective: sanitizeConfigForResponse(afterEffective),
+		...observerRuntimeMetadata(nextConfig),
 		protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 		effects: {
 			saved_keys: savedChangedKeys,
@@ -563,6 +568,7 @@ function configRoutes(opts = {}) {
 			config: sanitizeConfigForResponse(configData),
 			defaults: DEFAULTS,
 			effective: sanitizeConfigForResponse(effective),
+			...observerRuntimeMetadata(configData),
 			env_overrides: getCodememEnvOverrides(),
 			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 			providers: loadProviderOptions()
@@ -1594,7 +1600,7 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
-		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
+		if (!forgetTargetExists(store, memoryId, forgetSafetyFilters(body))) return c.json(...forgetNotFound(forgetSafetyFilters(body)));
 		const row = drizzle(store.db, { schema }).select().from(schema.memoryItems).where(eq(schema.memoryItems.id, memoryId)).get();
 		if (!row) return c.json({ error: "memory not found" }, 404);
 		if (!store.memoryOwnedBySelf(row)) return c.json({ error: "memory not owned by this device" }, 403);
@@ -1612,6 +1618,19 @@ function memoryRoutes(getStore) {
 	});
 	return app;
 }
+function forgetNotFound(filters) {
+	return [{ error: Object.keys(filters).length > 0 ? "not_found" : "memory not found" }, 404];
+}
+function forgetSafetyFilters(body) {
+	const filters = {};
+	if (typeof body.kind === "string" && body.kind.trim()) filters.kind = body.kind.trim();
+	if (typeof body.project === "string" && body.project.trim()) filters.project = body.project.trim();
+	return filters;
+}
+function forgetTargetExists(store, memoryId, filters) {
+	if (Object.keys(filters).length > 0) return store.timeline(null, memoryId, 0, 0, filters).some((row) => row.id === memoryId);
+	return store.get(memoryId) != null;
+}
 //#endregion
 //#region src/routes/memory-tools.ts
 /**
@@ -2129,6 +2148,15 @@ function buildFailureImpact(latestFailure, queueTotals, authBackoff) {
 	if (queueTotals.pending > 0) return `${queueTotals.pending} queued raw events across ${queueTotals.sessions} session(s) are waiting on a successful flush.`;
 	return "Failed flush batches are pending retry.";
 }
+function readCaptureEnabled() {
+	const value = process.env.CODEMEM_RAW_EVENTS?.trim().toLowerCase();
+	if (!value) return null;
+	return ![
+		"0",
+		"false",
+		"off"
+	].includes(value);
+}
 function observerStatusRoutes(deps) {
 	const app = new Hono();
 	app.get("/api/observer-status", (c) => {
@@ -2138,6 +2166,7 @@ function observerStatusRoutes(deps) {
 		if (!store || typeof store.rawEventBacklogTotals !== "function") return c.json({
 			active: null,
 			available_credentials: {},
+			capture_enabled: readCaptureEnabled(),
 			latest_failure: null,
 			queue: {
 				pending: 0,
@@ -2161,6 +2190,7 @@ function observerStatusRoutes(deps) {
 		return c.json({
 			active,
 			available_credentials: availableCredentials,
+			capture_enabled: readCaptureEnabled(),
 			latest_failure: failureWithImpact,
 			queue: {
 				...queueTotals,
@@ -2240,6 +2270,34 @@ function validateViewerTarget(store, payload, options = {}) {
 	if ((options.requireCurrentIdentity || payload.identity_target != null) && !store.hasCurrentIdentity()) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
 	return { ok: true };
 }
+/**
+* Middleware read of db_path / identity_target from the query string.
+* Native tools (pi extension) send targets as query params so a pre-handler
+* guard can reject a foreign viewer without consuming POST bodies. Lenient:
+* clients that omit targets (UI, MCP, curl) are unaffected.
+*/
+function viewerTargetQueryGuard(getStore) {
+	return async (c, next) => {
+		const dbPath = c.req.query("db_path");
+		const rawIdentity = c.req.query("identity_target");
+		if (dbPath == null && rawIdentity == null) return next();
+		let identityTarget;
+		if (rawIdentity != null) try {
+			identityTarget = JSON.parse(rawIdentity);
+		} catch {
+			return c.json({ error: {
+				code: "invalid_request",
+				message: "identity_target must be JSON"
+			} }, 400);
+		}
+		const target = validateViewerTarget(getStore(), {
+			db_path: dbPath ?? void 0,
+			identity_target: identityTarget
+		});
+		if (!target.ok) return c.json(target.body, target.status);
+		return next();
+	};
+}
 //#endregion
 //#region src/routes/pack.ts
 var MAX_LEDGER_PAYLOAD_BYTES = 16384;
@@ -3789,6 +3847,8 @@ var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 3e4;
 var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 3e5;
 var TERMINAL_SHARE_MAINTENANCE_ERRORS = /* @__PURE__ */ new Set([
 	"coordinator_not_configured",
+	"conflicting_repository_mappings",
+	"project_mapping_conflict",
 	"team_sharing_not_configured",
 	"team_selection_ambiguous",
 	"initiating_device_not_reviewed",
@@ -3990,25 +4050,69 @@ async function advancePendingProjectSharesOperation(store, options) {
 var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
 var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
 var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
+function recipientPolicyMaintenanceCandidates(store, retryBefore, limit) {
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
+	const canonicalize = (projectId) => canonicalRepositoryProjectIdentity(repositoryIdentities, projectId);
+	const projectIds = store.db.prepare(`SELECT canonical_project_identity FROM project_recipients
+			 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states`).all();
+	const authorityRows = store.db.prepare(`SELECT authority_state, canonical_project_identity, last_attempt_at, safe_error_code
+			 FROM recipient_policy_authority_states`).all();
+	const authorityByProject = /* @__PURE__ */ new Map();
+	for (const row of authorityRows) {
+		const projectId = canonicalize(row.canonical_project_identity);
+		const current = authorityByProject.get(projectId);
+		if (!current) {
+			authorityByProject.set(projectId, row);
+			continue;
+		}
+		if (current.canonical_project_identity === projectId) continue;
+		if (row.canonical_project_identity === projectId) {
+			authorityByProject.set(projectId, row);
+			continue;
+		}
+		if (String(row.last_attempt_at ?? "") > String(current.last_attempt_at ?? "")) authorityByProject.set(projectId, row);
+	}
+	return [...new Set(projectIds.map((row) => canonicalize(row.canonical_project_identity)))].filter((projectId) => {
+		const authority = authorityByProject.get(projectId);
+		return authority == null || authority.last_attempt_at == null || authority.safe_error_code == null && authority.authority_state !== "active" || authority.last_attempt_at <= retryBefore;
+	}).toSorted((left, right) => {
+		const leftAttempt = authorityByProject.get(left)?.last_attempt_at;
+		const rightAttempt = authorityByProject.get(right)?.last_attempt_at;
+		if (leftAttempt == null && rightAttempt != null) return -1;
+		if (leftAttempt != null && rightAttempt == null) return 1;
+		return String(leftAttempt ?? "").localeCompare(String(rightAttempt ?? "")) || left.localeCompare(right);
+	}).slice(0, limit);
+}
+function recordRecipientPolicyMaintenanceFailure(store, projectId, attemptedAt) {
+	store.db.prepare(`INSERT INTO recipient_policy_authority_states(
+			 canonical_project_identity, state_changed_at, created_at, updated_at,
+			 attempt_count, last_attempt_at, safe_error_code, last_error_at
+			 ) VALUES (?, ?, ?, ?, 1, ?, 'recipient_policy_reconciliation_failed', ?)
+			 ON CONFLICT(canonical_project_identity) DO UPDATE SET
+			 attempt_count = attempt_count + 1, last_attempt_at = excluded.last_attempt_at,
+			 safe_error_code = excluded.safe_error_code, last_error_at = excluded.last_error_at,
+			 updated_at = excluded.updated_at`).run(projectId, attemptedAt, attemptedAt, attemptedAt, attemptedAt, attemptedAt);
+}
+function isSqliteBusy$1(error) {
+	if (!error || typeof error !== "object" || !("code" in error)) return false;
+	const code = error.code;
+	return typeof code === "string" && (code.startsWith("SQLITE_BUSY") || code.startsWith("SQLITE_LOCKED"));
+}
+function recordMaintenanceFailureIfAvailable(store, projectId, attemptedAt, error) {
+	if (isSqliteBusy$1(error)) return;
+	try {
+		recordRecipientPolicyMaintenanceFailure(store, projectId, attemptedAt);
+	} catch (bookkeepingError) {
+		if (!isSqliteBusy$1(bookkeepingError)) throw bookkeepingError;
+	}
+}
 async function reconcileRecipientPolicyProjectsOperation(store, options) {
 	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT), RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT));
 	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
 	const backoffMs = Math.max(0, Math.trunc(options.backoffMs ?? RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS));
 	const retryBefore = new Date(maintenanceNow.getTime() - backoffMs).toISOString();
-	const rows = store.db.prepare(`WITH projects AS (
-				SELECT DISTINCT canonical_project_identity FROM project_recipients
-				UNION
-				SELECT canonical_project_identity FROM recipient_policy_authority_states
-			)
-			 SELECT projects.canonical_project_identity
-			 FROM projects
-			 LEFT JOIN recipient_policy_authority_states authority
-			  ON authority.canonical_project_identity = projects.canonical_project_identity
-			 WHERE authority.safe_error_code IS NULL OR authority.last_attempt_at IS NULL
-			  OR authority.last_attempt_at <= ?
-			 ORDER BY CASE WHEN authority.last_attempt_at IS NULL THEN 0 ELSE 1 END,
-			  authority.last_attempt_at, projects.canonical_project_identity
-			 LIMIT ?`).all(retryBefore, limit);
+	const attemptedAt = maintenanceNow.toISOString();
+	const projectIds = recipientPolicyMaintenanceCandidates(store, retryBefore, limit);
 	const reconcileProject = options.reconcileProject ?? reconcileRecipientPolicyProject;
 	const result = {
 		processed: 0,
@@ -4018,25 +4122,26 @@ async function reconcileRecipientPolicyProjectsOperation(store, options) {
 		failed: 0,
 		items: []
 	};
-	for (const row of rows) {
+	for (const projectId of projectIds) {
 		result.processed += 1;
 		try {
 			const outcome = await reconcileProject(store.db, {
-				canonicalProjectIdentity: row.canonical_project_identity,
+				canonicalProjectIdentity: projectId,
 				leaseOwner: options.leaseOwner ?? `recipient-policy-maintenance:${store.deviceId || process.pid}`
 			}, options.effects);
 			if (outcome.status === "active") result.active += 1;
 			else if (outcome.status === "needs_attention") result.attention += 1;
 			else result.waiting += 1;
 			result.items.push({
-				canonicalProjectIdentity: row.canonical_project_identity,
+				canonicalProjectIdentity: projectId,
 				status: outcome.status,
 				safeErrorCode: outcome.safeErrorCode
 			});
-		} catch {
+		} catch (error) {
+			recordMaintenanceFailureIfAvailable(store, projectId, attemptedAt, error);
 			result.failed += 1;
 			result.items.push({
-				canonicalProjectIdentity: row.canonical_project_identity,
+				canonicalProjectIdentity: projectId,
 				status: "failed",
 				safeErrorCode: "recipient_policy_reconciliation_failed"
 			});
@@ -4319,6 +4424,40 @@ var PEERS_QUERY$1 = `
 	ORDER BY name, peer_device_id
 `;
 //#endregion
+//#region src/snapshot-source.ts
+function snapshotGeneration(raw) {
+	if (!raw?.trim()) return null;
+	return Number.parseInt(raw, 10);
+}
+function snapshotSourceDevice(requested, localDeviceId) {
+	if (requested !== void 0 && requested !== localDeviceId) throw new Error("retirement_snapshot_source_required");
+	return requested;
+}
+function snapshotErrorStatus(message) {
+	if ([
+		"retirement_snapshot_source_required",
+		"missing_generation",
+		"missing_snapshot_id"
+	].includes(message)) return 400;
+	if (message === "generation_mismatch" || message === "boundary_mismatch") return 409;
+	return null;
+}
+function snapshotPageRequest(query, localDeviceId) {
+	const generation = snapshotGeneration(query("generation"));
+	const snapshotId = query("snapshot_id");
+	if (generation === null || !Number.isFinite(generation)) throw new Error("missing_generation");
+	if (!snapshotId) throw new Error("missing_snapshot_id");
+	const rawLimit = Number.parseInt(query("limit") ?? "200", 10);
+	return {
+		generation,
+		snapshotId,
+		baselineCursor: query("baseline_cursor") ?? null,
+		pageToken: query("page_token") ?? null,
+		sourceDeviceId: snapshotSourceDevice(query("source_device_id"), localDeviceId),
+		limit: Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200
+	};
+}
+//#endregion
 //#region src/routes/team-setup-view.ts
 var enabled = {
 	enabled: true,
@@ -6264,6 +6403,26 @@ function tryParsePairingPayload(value) {
 		addresses
 	};
 }
+async function inspectPairingInvite(c, next) {
+	const body = await parseViewerJsonBody(c);
+	if (typeof body?.invite !== "string") return c.json({ error: "invite_invalid" }, 400);
+	try {
+		const pairing = tryParsePairingPayload(body.invite.match(/echo\s+['"]([A-Za-z0-9+/=]+)['"]\s*\|\s*base64\s+-d\s*\|\s*codemem/)?.[1]?.trim() || body.invite.trim());
+		if (pairing?.kind === "invalid-pair") return c.json({ error: pairing.error }, 400);
+		if (pairing?.kind !== "pair") {
+			decodeInvitePayload(extractInvitePayload(body.invite));
+			return next();
+		}
+		return c.json({
+			kind: "pair",
+			device_id: pairing.device_id,
+			fingerprint: pairing.fingerprint,
+			addresses: pairing.addresses
+		});
+	} catch (error) {
+		return c.json({ error: safeRecipientInviteError(error) }, 400);
+	}
+}
 function coordinatorAdminStatusPayload(config = readCoordinatorSyncConfig()) {
 	const groups = config.syncCoordinatorGroups;
 	const activeGroup = groups[0] ?? null;
@@ -6482,6 +6641,14 @@ function missingGuardrailConfirmations(warnings, confirmedTokens) {
 	const confirmed = new Set(confirmedTokens);
 	return warnings.filter((warning) => warning.requires_confirmation && (!warning.confirmation_token || !confirmed.has(warning.confirmation_token)));
 }
+function mappingGuardrailChallenge(warnings, missing) {
+	return {
+		error: "guardrail_confirmation_required",
+		required_guardrails: [...new Set(missing.map((warning) => warning.code))],
+		required_guardrail_tokens: [...new Set(missing.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0),
+		guardrail_warnings: warnings
+	};
+}
 function parseViewerProjectMappingInput(body) {
 	const id = optionalViewerInteger(body, "id");
 	const priority = optionalViewerInteger(body, "priority");
@@ -6496,6 +6663,14 @@ function parseViewerProjectMappingInput(body) {
 		source: optionalViewerStrictString(body, "source") ?? "user"
 	};
 }
+function parseViewerProjectMappingInputs(body) {
+	const rawMappings = body.mappings;
+	if (!Array.isArray(rawMappings) || rawMappings.length === 0) throw new Error("mappings must be a non-empty array");
+	return rawMappings.map((raw) => {
+		if (raw == null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("each mapping must be an object");
+		return parseViewerProjectMappingInput(raw);
+	});
+}
 function coordinatorAdminMutationStatus(message) {
 	if (message.includes("scope_not_found") || message.includes("membership_not_found") || message.includes("group_not_found") || message.includes("Group not found") || message.includes("Scope not found") || message.includes("device_not_enrolled_for_scope_group") || message.includes("device must be enrolled")) return 404;
 	if (message.includes("not active") || message.includes("scope_not_active") || message.includes("scope_membership_effect_conflict") || message.includes("group_archived") || message.includes("Group is archived")) return 409;
@@ -7453,13 +7628,25 @@ function recipientPolicyReadCopy(state) {
 		explanation: "Legacy scope enforcement remains in control while reconciliation is pending."
 	};
 }
+function recipientPolicyAuthorityForAliases(store, canonicalProjectIdentity, aliases) {
+	const canonical = getRecipientPolicyAuthorityState(store.db, canonicalProjectIdentity);
+	if (canonical) return canonical;
+	return aliases.filter((identity) => identity !== canonicalProjectIdentity).map((identity) => getRecipientPolicyAuthorityState(store.db, identity)).filter((state) => state != null).toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0] ?? null;
+}
 function listRecipientPolicyReconciliationStatus(store) {
+	const projectIds = store.db.prepare(`SELECT DISTINCT canonical_project_identity FROM project_recipients WHERE status = 'active'
+				 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states
+				 ORDER BY canonical_project_identity`).all().map((row) => row.canonical_project_identity);
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
+	const aliasesByProject = /* @__PURE__ */ new Map();
+	for (const projectId of projectIds) {
+		const canonical = canonicalRepositoryProjectIdentity(repositoryIdentities, projectId);
+		aliasesByProject.set(canonical, [...aliasesByProject.get(canonical) ?? [], projectId]);
+	}
 	return {
 		version: 1,
-		items: store.db.prepare(`SELECT DISTINCT canonical_project_identity FROM project_recipients WHERE status = 'active'
-				 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states
-				 ORDER BY canonical_project_identity`).all().map((row) => row.canonical_project_identity).map((canonicalProjectIdentity) => {
-			const state = recipientPolicyReadState(getRecipientPolicyAuthorityState(store.db, canonicalProjectIdentity));
+		items: [...aliasesByProject.keys()].toSorted().map((canonicalProjectIdentity) => {
+			const state = recipientPolicyReadState(recipientPolicyAuthorityForAliases(store, canonicalProjectIdentity, aliasesByProject.get(canonicalProjectIdentity) ?? []));
 			return {
 				canonicalProjectIdentity,
 				state,
@@ -8453,6 +8640,7 @@ function addLegacySharedReviewRow(groups, row, identity, candidate, isOwnedBySel
 }
 function collectLegacySharedReviewGroups(store) {
 	const ownedBySelf = store.buildOwnershipPredicate();
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
 	const candidatesByIdentity = new Map(listProjectScopeCandidates(store.db, { limit: null }).map((candidate) => [candidate.workspace_identity, candidate]));
 	const groups = /* @__PURE__ */ new Map();
 	let memoryCount = 0;
@@ -8464,6 +8652,11 @@ function collectLegacySharedReviewGroups(store) {
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
 			gitRemote: row.git_remote,
+			repositoryIdentity: repositoryIdentityForWorkspace(repositoryIdentities, {
+				cwd: row.cwd,
+				gitRemote: row.git_remote,
+				metadataJson: row.session_metadata_json
+			}),
 			project: row.project,
 			workspaceId: row.workspace_id
 		});
@@ -8538,7 +8731,8 @@ function legacySharedReviewSummaryRows(store) {
 			        m.workspace_id,
 			        m.actor_id,
 			        m.origin_device_id,
-			        m.metadata_json
+			        m.metadata_json,
+			        s.metadata_json AS session_metadata_json
 			 FROM memory_items m
 			 LEFT JOIN sessions s ON s.id = m.session_id
 			 WHERE m.scope_id = ?
@@ -8578,7 +8772,8 @@ function legacySharedReviewRows(store) {
 			        m.workspace_id,
 			        m.actor_id,
 			        m.origin_device_id,
-			        m.metadata_json
+			        m.metadata_json,
+			        s.metadata_json AS session_metadata_json
 			 FROM memory_items m
 			 LEFT JOIN sessions s ON s.id = m.session_id
 			 WHERE m.scope_id = ?
@@ -8595,7 +8790,7 @@ function legacySharedReviewConfirmationToken(input) {
 	return Buffer.from(`${input.workspaceIdentity}|${input.scopeId}|${payload}`, "utf8").toString("base64url");
 }
 function projectInventoryRowsForWorkspace(store, workspaceIdentity) {
-	return store.db.prepare(`SELECT m.id,
+	const rows = store.db.prepare(`SELECT m.id,
 			        m.rev,
 			        s.project,
 			        s.cwd,
@@ -8604,15 +8799,23 @@ function projectInventoryRowsForWorkspace(store, workspaceIdentity) {
 			        m.workspace_id,
 			        m.actor_id,
 			        m.origin_device_id,
-			        m.metadata_json
+			        m.metadata_json,
+			        s.metadata_json AS session_metadata_json
 			 FROM memory_items m
 			 LEFT JOIN sessions s ON s.id = m.session_id
 			 WHERE m.active = 1
-			   AND m.deleted_at IS NULL`).all().filter((row) => {
+			   AND m.deleted_at IS NULL`).all();
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
+	return rows.filter((row) => {
 		return canonicalWorkspaceIdentity({
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
 			gitRemote: row.git_remote,
+			repositoryIdentity: repositoryIdentityForWorkspace(repositoryIdentities, {
+				cwd: row.cwd,
+				gitRemote: row.git_remote,
+				metadataJson: row.session_metadata_json
+			}),
 			project: row.project,
 			workspaceId: row.workspace_id
 		}).value === workspaceIdentity;
@@ -8666,11 +8869,17 @@ function assertLocalDeviceScopeMembership(store, scopeId) {
 			 LIMIT 1`).get(scopeId, store.deviceId)) throw new Error(`local device is not a member of Sharing domain ${scopeId}`);
 }
 function legacySharedReviewRowsForWorkspace(store, workspaceIdentity) {
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
 	return legacySharedReviewRows(store).filter((row) => {
 		return canonicalWorkspaceIdentity({
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
 			gitRemote: row.git_remote,
+			repositoryIdentity: repositoryIdentityForWorkspace(repositoryIdentities, {
+				cwd: row.cwd,
+				gitRemote: row.git_remote,
+				metadataJson: row.session_metadata_json
+			}),
 			project: row.project,
 			workspaceId: row.workspace_id
 		}).value === workspaceIdentity;
@@ -8838,6 +9047,42 @@ function negotiatedSyncCapability(c) {
 * network-accessible. All requests are auth-gated via signature
 * verification so unauthenticated callers are rejected.
 */
+function serveAuthorizedSnapshot(c, store, peerDeviceId) {
+	try {
+		const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
+			db: store.db,
+			localDeviceId,
+			negotiatedCapability: negotiatedSyncCapability(c),
+			peerDeviceId
+		});
+		if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
+		const pageRequest = snapshotPageRequest((name) => c.req.query(name), localDeviceId);
+		const result = loadMemorySnapshotPageForPeer(store.db, {
+			...pageRequest,
+			peerDeviceId,
+			scopeId: scopeRequest.mode === "scoped" ? scopeRequest.scope_id : void 0
+		});
+		return c.json({
+			source_device_id: pageRequest.sourceDeviceId,
+			scope_id: scopeRequest.scope_id,
+			generation: result.boundary.generation,
+			snapshot_id: result.boundary.snapshot_id,
+			baseline_cursor: result.boundary.baseline_cursor,
+			retained_floor_cursor: result.boundary.retained_floor_cursor,
+			sync_capability: LOCAL_SYNC_CAPABILITY,
+			items: result.items,
+			next_page_token: result.nextPageToken,
+			has_more: result.hasMore
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : "";
+		const status = snapshotErrorStatus(message);
+		if (status) return c.json({ error: message }, status);
+		return c.json({ error: "internal_error" }, 500);
+	}
+}
 function syncProtocolRoutes(getStore, opts = {}) {
 	const app = new Hono();
 	const routeRateLimit = opts.routeRateLimit ?? null;
@@ -9004,51 +9249,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
-			try {
-				const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
-				const negotiated = negotiatedSyncCapability(c);
-				const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-				const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
-					db: store.db,
-					localDeviceId,
-					negotiatedCapability: negotiated,
-					peerDeviceId: auth.deviceId
-				});
-				if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
-				const rawGeneration = c.req.query("generation");
-				const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
-				const snapshotId = c.req.query("snapshot_id") ?? null;
-				const baselineCursor = c.req.query("baseline_cursor") ?? null;
-				const pageToken = c.req.query("page_token") ?? null;
-				const rawLimit = Number.parseInt(c.req.query("limit") ?? "200", 10);
-				const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 5e3)) : 200;
-				if (generation == null || !Number.isFinite(generation)) return c.json({ error: "missing_generation" }, 400);
-				if (!snapshotId) return c.json({ error: "missing_snapshot_id" }, 400);
-				const result = loadMemorySnapshotPageForPeer(store.db, {
-					generation,
-					snapshotId,
-					baselineCursor,
-					pageToken,
-					limit,
-					peerDeviceId: auth.deviceId,
-					scopeId: scopeRequest.mode === "scoped" ? scopeRequest.scope_id : void 0
-				});
-				return c.json({
-					scope_id: scopeRequest.scope_id,
-					generation: result.boundary.generation,
-					snapshot_id: result.boundary.snapshot_id,
-					baseline_cursor: result.boundary.baseline_cursor,
-					retained_floor_cursor: result.boundary.retained_floor_cursor,
-					sync_capability: LOCAL_SYNC_CAPABILITY,
-					items: result.items,
-					next_page_token: result.nextPageToken,
-					has_more: result.hasMore
-				});
-			} catch (err) {
-				const message = err instanceof Error ? err.message : "";
-				if (message === "generation_mismatch" || message === "boundary_mismatch") return c.json({ error: message }, 409);
-				return c.json({ error: "internal_error" }, 500);
-			}
+			return serveAuthorizedSnapshot(c, store, auth.deviceId);
 		})();
 	});
 	app.post("/v1/ops", async (c) => {
@@ -9126,7 +9327,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 }
 async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 	const config = readCoordinatorSyncConfig();
-	const hasCoordinatorConfiguration = config.syncCoordinatorUrl.length > 0 || config.syncCoordinatorGroups.length > 0;
+	const hasCoordinatorConfiguration = config.syncCoordinatorUrl.length > 0 || config.syncCoordinatorGroups.length > 0 || config.syncCoordinatorAdminSecret.length > 0;
 	const remoteUrl = config.syncCoordinatorUrl.trim();
 	const adminSecret = config.syncCoordinatorAdminSecret.trim();
 	const groupIds = [...new Set(config.syncCoordinatorGroups.map((groupId) => groupId.trim()))].filter(Boolean);
@@ -9137,7 +9338,7 @@ async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 	};
 	if (!remoteUrl || !adminSecret || groupIds.length === 0) return {
 		availability: "unavailable",
-		safeErrorCode: "coordinator_unavailable",
+		safeErrorCode: "coordinator_configuration_required",
 		enrollments: []
 	};
 	if (groupIds.length > 25) return {
@@ -9170,6 +9371,174 @@ async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 		};
 	}
 }
+var ORIGIN_DEVICE_NAME_LOOKUP_BATCH_SIZE = 400;
+function originDeviceNameKey(value) {
+	return value.normalize("NFKC").toLowerCase().toUpperCase().toLowerCase();
+}
+function originDeviceDisplayName(value, deviceId) {
+	if (typeof value !== "string") return null;
+	try {
+		const displayName = normalizeHumanPresentationName(value, "display_name");
+		let normalizedDeviceId = deviceId;
+		try {
+			normalizedDeviceId = normalizeHumanPresentationName(deviceId, "device_id");
+		} catch {}
+		return originDeviceNameKey(displayName) === originDeviceNameKey(normalizedDeviceId) ? null : displayName;
+	} catch {
+		return null;
+	}
+}
+function resolveOriginDeviceDisplayNames(store, projects) {
+	const deviceIds = [...new Set(projects.flatMap((project) => project.origin_devices.map((device) => device.device_id)))];
+	const names = /* @__PURE__ */ new Map();
+	for (let offset = 0; offset < deviceIds.length; offset += ORIGIN_DEVICE_NAME_LOOKUP_BATCH_SIZE) {
+		const batch = deviceIds.slice(offset, offset + ORIGIN_DEVICE_NAME_LOOKUP_BATCH_SIZE);
+		const placeholders = batch.map(() => "?").join(", ");
+		const peers = store.db.prepare(`SELECT peer_device_id AS device_id, name AS display_name
+				 FROM sync_peers
+				 WHERE peer_device_id IN (${placeholders})
+				   AND TRIM(COALESCE(pinned_fingerprint, '')) <> ''`).all(...batch);
+		for (const peer of peers) {
+			const displayName = originDeviceDisplayName(peer.display_name, peer.device_id);
+			if (displayName) names.set(peer.device_id, displayName);
+		}
+		const devices = store.db.prepare(`SELECT device_id, display_name
+				 FROM identity_devices
+				 WHERE device_id IN (${placeholders}) AND status = 'active'`).all(...batch);
+		for (const device of devices) {
+			const displayName = originDeviceDisplayName(device.display_name, device.device_id);
+			if (displayName) names.set(device.device_id, displayName);
+		}
+	}
+	return names;
+}
+function serializeProjectScopeInventory(store, inventory, sharingByProject) {
+	const originDeviceNames = resolveOriginDeviceDisplayNames(store, inventory.projects);
+	return {
+		...inventory,
+		projects: inventory.projects.map((project) => ({
+			...project,
+			origin_devices: project.origin_devices.map(({ device_id }) => ({
+				device_id,
+				display_name: originDeviceNames.get(device_id) ?? null
+			})),
+			sharing: sharingByProject.get(project.workspace_identity) ?? []
+		}))
+	};
+}
+async function deleteProjectScopeMappingRoute(c, store) {
+	const id = Number(c.req.param("id"));
+	let releasePublicationMutation;
+	try {
+		const body = c.req.header("content-type")?.includes("application/json") ? await parseViewerJsonBody(c) : {};
+		if (!body) return c.json({ error: "invalid json" }, 400);
+		const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
+		releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
+		const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const warnings = analyzeProjectScopeMappingDeletionGuardrails(store.db, id, deviceId);
+		const missing = missingGuardrailConfirmations(warnings, confirmedGuardrailTokens);
+		if (missing.length > 0) return c.json({
+			error: "guardrail_confirmation_required",
+			required_guardrails: [...new Set(missing.map((warning) => warning.code))],
+			required_guardrail_tokens: missing.map((warning) => warning.confirmation_token),
+			guardrail_warnings: warnings
+		}, 409);
+		const deleted = deleteProjectMappingAndWakePolicies(store, id, deviceId, confirmedGuardrailTokens);
+		return c.json({
+			ok: true,
+			deleted
+		});
+	} catch (error) {
+		return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+	} finally {
+		releasePublicationMutation?.();
+	}
+}
+function projectSharingByRepository(store, operations) {
+	const operationById = new Map(operations.map((operation) => [operation.operation_id, operation]));
+	const sharingByProject = /* @__PURE__ */ new Map();
+	const mappings = store.db.prepare("SELECT workspace_identity, project_pattern FROM project_scope_mappings").all();
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db, { knownRepositoryIdentities: mappings.flatMap((mapping) => [mapping.workspace_identity, mapping.project_pattern]) });
+	const seenOperationProjects = /* @__PURE__ */ new Set();
+	const reviewed = store.db.prepare(`SELECT p.operation_id, p.canonical_project_identity
+			 FROM share_operation_projects p
+			 JOIN share_operations o ON o.operation_id = p.operation_id
+			 WHERE o.inviter_actor_id = ? ORDER BY o.created_at, p.ordinal`).all(store.actorId);
+	for (const item of reviewed) {
+		const operation = operationById.get(item.operation_id);
+		if (!operation) continue;
+		const projectId = canonicalRepositoryProjectIdentity(repositoryIdentities, item.canonical_project_identity);
+		const operationProjectKey = `${item.operation_id}\u0000${projectId}`;
+		if (seenOperationProjects.has(operationProjectKey)) continue;
+		seenOperationProjects.add(operationProjectKey);
+		const current = sharingByProject.get(projectId) ?? [];
+		current.push({
+			person: operation.person,
+			lifecycle: {
+				state: operation.lifecycle.state,
+				label: operation.lifecycle.label,
+				explanation: operation.lifecycle.explanation
+			}
+		});
+		sharingByProject.set(projectId, current);
+	}
+	return sharingByProject;
+}
+function deactivateActorAndWakePolicies(store, actorId, now) {
+	store.db.transaction(() => {
+		store.db.prepare("UPDATE actors SET status = 'deactivated', updated_at = ? WHERE actor_id = ?").run(now, actorId);
+		store.db.prepare("UPDATE sync_peers SET actor_id = NULL WHERE actor_id = ?").run(actorId);
+		wakeRecipientPoliciesForIdentities(store.db, [actorId], now);
+	}).immediate();
+}
+function finishActorMerge(store, primaryActorId, secondaryActorId, now) {
+	store.db.prepare("UPDATE actors SET status = 'merged', merged_into_actor_id = ?, updated_at = ? WHERE actor_id = ?").run(primaryActorId, now, secondaryActorId);
+	wakeRecipientPoliciesForIdentities(store.db, [primaryActorId, secondaryActorId], now);
+}
+function policyWakeMappings(store) {
+	return store.db.prepare("SELECT id, scope_id, workspace_identity FROM project_scope_mappings ORDER BY id").all();
+}
+function existingRequestedMappings(mappings, inputs) {
+	const requestedIds = new Set(inputs.map((input) => input.id).filter((id) => id != null));
+	const requestedIdentities = new Set(inputs.map((input) => input.workspace_identity).filter((identity) => identity != null).map((identity) => canonicalWorkspaceIdentity({ cwd: identity }).value));
+	return mappings.filter((mapping) => {
+		if (requestedIds.has(mapping.id)) return true;
+		if (!mapping.workspace_identity) return false;
+		return requestedIdentities.has(canonicalWorkspaceIdentity({ cwd: mapping.workspace_identity }).value);
+	});
+}
+function mappedProjectsInScopes(mappings, scopeIds) {
+	return mappings.filter((mapping) => scopeIds.has(mapping.scope_id)).map((mapping) => mapping.workspace_identity).filter((identity) => identity != null);
+}
+function wakeRecipientPolicyProjects(store, projectIdentities, now) {
+	wakeRecipientPoliciesForProjectIdentities(store.db, [...new Set(projectIdentities)], now);
+}
+function saveProjectMappingsAndWakePolicies(store, deviceId, mappingInputs) {
+	return store.db.transaction(() => {
+		const before = policyWakeMappings(store);
+		const previousMappings = existingRequestedMappings(before, mappingInputs);
+		const mappings = upsertProjectScopeSettingsMappings(store.db, mappingInputs, { deviceId });
+		const after = policyWakeMappings(store);
+		const changedScopeIds = /* @__PURE__ */ new Set([...previousMappings.map((mapping) => mapping.scope_id), ...mappings.map((mapping) => mapping.scope_id)]);
+		wakeRecipientPolicyProjects(store, [...mappedProjectsInScopes(before, changedScopeIds), ...mappedProjectsInScopes(after, changedScopeIds)], (/* @__PURE__ */ new Date()).toISOString());
+		return mappings;
+	}).immediate();
+}
+function deleteProjectMappingAndWakePolicies(store, mappingId, deviceId, confirmedGuardrailTokens) {
+	return store.db.transaction(() => {
+		const before = policyWakeMappings(store);
+		const removed = before.find((mapping) => mapping.id === mappingId);
+		const deleted = deleteProjectScopeSettingsMapping(store.db, mappingId, {
+			deviceId,
+			confirmedGuardrailTokens
+		});
+		if (deleted && removed) {
+			const changedScopeIds = /* @__PURE__ */ new Set([removed.scope_id]);
+			wakeRecipientPolicyProjects(store, [...mappedProjectsInScopes(before, changedScopeIds), ...mappedProjectsInScopes(policyWakeMappings(store), changedScopeIds)], (/* @__PURE__ */ new Date()).toISOString());
+		}
+		return deleted;
+	}).immediate();
+}
 /**
 * Viewer-facing sync management routes (/api/sync/*).
 *
@@ -9178,7 +9547,7 @@ async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
 * local viewer.
 */
 function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
-	const app = new Hono();
+	const app = new Hono().post("/api/sync/invites/inspect", inspectPairingInvite);
 	const readCoordinatorConfig = options.readCoordinatorConfig ?? readCoordinatorSyncConfig;
 	const renameCoordinatorGroup = options.renameCoordinatorGroup ?? coordinatorRenameGroupAction;
 	const loadCoordinatorEvidence = options.loadDeviceIdentityCoordinatorEvidence ?? loadConfiguredDeviceIdentityCoordinatorEvidence;
@@ -9802,34 +10171,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			scopeId: c.req.query("scope_id"),
 			status: c.req.query("status")
 		});
-		const operations = await shareOperationReadModels(store, void 0, false);
-		const operationById = new Map(operations.map((operation) => [operation.operation_id, operation]));
-		const sharingByProject = /* @__PURE__ */ new Map();
-		const reviewed = store.db.prepare(`SELECT p.operation_id, p.canonical_project_identity
-			 FROM share_operation_projects p
-			 JOIN share_operations o ON o.operation_id = p.operation_id
-			 WHERE o.inviter_actor_id = ? ORDER BY o.created_at, p.ordinal`).all(store.actorId);
-		for (const item of reviewed) {
-			const operation = operationById.get(item.operation_id);
-			if (!operation) continue;
-			const current = sharingByProject.get(item.canonical_project_identity) ?? [];
-			current.push({
-				person: operation.person,
-				lifecycle: {
-					state: operation.lifecycle.state,
-					label: operation.lifecycle.label,
-					explanation: operation.lifecycle.explanation
-				}
-			});
-			sharingByProject.set(item.canonical_project_identity, current);
-		}
-		return c.json({
-			...inventory,
-			projects: inventory.projects.map((project) => ({
-				...project,
-				sharing: sharingByProject.get(project.workspace_identity) ?? []
-			}))
-		});
+		const sharingByProject = projectSharingByRepository(store, await shareOperationReadModels(store, void 0, false));
+		return c.json(serializeProjectScopeInventory(store, inventory, sharingByProject));
 	});
 	app.post("/api/sync/projects/reassign-project", async (c) => {
 		const store = getStore();
@@ -10085,28 +10428,19 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
 			const mappingInput = parseViewerProjectMappingInput(body);
 			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput);
+			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, {
+				...mappingInput,
+				deviceId
+			});
 			if (analysis.requested_workspace_identity?.startsWith("unmapped:")) return c.json({
 				error: "unmapped_project_local_only",
 				message: "Unmapped projects need a stable path, git remote, or workspace id before assigning a Sharing domain.",
 				guardrail_warnings: analysis.warnings
 			}, 400);
 			const missingConfirmations = missingGuardrailConfirmations(analysis.warnings, confirmedGuardrailTokens);
-			if (missingConfirmations.length > 0) {
-				const missingCodes = [...new Set(missingConfirmations.map((warning) => warning.code))];
-				const missingTokens = [...new Set(missingConfirmations.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0);
-				return c.json({
-					error: "guardrail_confirmation_required",
-					required_guardrails: missingCodes,
-					required_guardrail_tokens: missingTokens,
-					guardrail_warnings: analysis.warnings
-				}, 409);
-			}
-			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-			const mapping = upsertProjectScopeSettingsMapping(store.db, {
-				deviceId,
-				...mappingInput
-			});
+			if (missingConfirmations.length > 0) return c.json(mappingGuardrailChallenge(analysis.warnings, missingConfirmations), 409);
+			const [mapping] = saveProjectMappingsAndWakePolicies(store, deviceId, [mappingInput]);
 			return c.json({
 				ok: true,
 				mapping,
@@ -10124,14 +10458,13 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (!body) return c.json({ error: "invalid json" }, 400);
 		let releasePublicationMutation;
 		try {
-			const rawMappings = body.mappings;
-			if (!Array.isArray(rawMappings) || rawMappings.length === 0) return c.json({ error: "mappings must be a non-empty array" }, 400);
-			const mappingInputs = rawMappings.map((raw) => {
-				if (raw == null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("each mapping must be an object");
-				return parseViewerProjectMappingInput(raw);
-			});
+			const mappingInputs = parseViewerProjectMappingInputs(body);
 			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			const analyses = mappingInputs.map((mappingInput) => analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput));
+			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+			const analyses = analyzeProjectScopeMappingChangesGuardrails(store.db, mappingInputs.map((input) => ({
+				...input,
+				deviceId
+			})));
 			const unmapped = analyses.find((analysis) => analysis.requested_workspace_identity?.startsWith("unmapped:"));
 			if (unmapped) return c.json({
 				error: "unmapped_project_local_only",
@@ -10139,24 +10472,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				guardrail_warnings: unmapped.warnings
 			}, 400);
 			const missingConfirmations = analyses.flatMap((analysis) => missingGuardrailConfirmations(analysis.warnings, []));
-			if (missingConfirmations.length > 0) {
-				const missingCodes = [...new Set(missingConfirmations.map((warning) => warning.code))];
-				const missingTokens = [...new Set(missingConfirmations.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0);
-				return c.json({
-					error: "guardrail_confirmation_required",
-					required_guardrails: missingCodes,
-					required_guardrail_tokens: missingTokens,
-					guardrail_warnings: analyses.flatMap((analysis) => analysis.warnings)
-				}, 409);
-			}
-			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-			const saveMappings = store.db.transaction(() => mappingInputs.map((mappingInput) => upsertProjectScopeSettingsMapping(store.db, {
-				deviceId,
-				...mappingInput
-			})));
+			if (missingConfirmations.length > 0) return c.json(mappingGuardrailChallenge(analyses.flatMap((analysis) => analysis.warnings), missingConfirmations), 409);
 			return c.json({
 				ok: true,
-				mappings: saveMappings(),
+				mappings: saveProjectMappingsAndWakePolicies(store, deviceId, mappingInputs),
 				guardrail_warnings: analyses.flatMap((analysis) => analysis.warnings)
 			});
 		} catch (error) {
@@ -10165,23 +10484,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			releasePublicationMutation?.();
 		}
 	});
-	app.delete("/api/sync/sharing-domains/project-mappings/:id", async (c) => {
-		const store = getStore();
-		const id = Number(c.req.param("id"));
-		let releasePublicationMutation;
-		try {
-			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			const deleted = deleteProjectScopeSettingsMapping(store.db, id);
-			return c.json({
-				ok: true,
-				deleted
-			});
-		} catch (error) {
-			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
-		} finally {
-			releasePublicationMutation?.();
-		}
-	});
+	app.delete("/api/sync/sharing-domains/project-mappings/:id", (c) => deleteProjectScopeMappingRoute(c, getStore()));
 	app.post("/api/sync/peers/identity", async (c) => {
 		const store = getStore();
 		ensureLocalActorRecord(store);
@@ -10439,11 +10742,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 					 WHERE inviter_actor_id = ? OR recipient_actor_id = ? OR person_id = ?`).run(secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, now, secondaryActorId, secondaryActorId, secondaryActorId);
 			const peerUpdate = d.update(schema.syncPeers).set({ actor_id: primaryActorId }).where(eq(schema.syncPeers.actor_id, secondaryActorId)).run();
 			if (primary.is_local) d.update(schema.syncPeers).set({ claimed_local_actor: 1 }).where(eq(schema.syncPeers.actor_id, primaryActorId)).run();
-			d.update(schema.actors).set({
-				status: "merged",
-				merged_into_actor_id: primaryActorId,
-				updated_at: now
-			}).where(eq(schema.actors.actor_id, secondaryActorId)).run();
+			finishActorMerge(store, primaryActorId, secondaryActorId, now);
 			return { mergedCount: Number(peerUpdate.changes ?? 0) };
 		}).immediate();
 		if ("error" in result) return c.json({ error: result.error }, result.status);
@@ -10462,16 +10761,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (actorId === store.actorId) return c.json({ error: "cannot deactivate this device's own local actor" }, 409);
 		const releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, [actorId]);
 		queueMicrotask(releaseActorMutations);
-		const d = drizzle(store.db, { schema });
-		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
+		const actor = drizzle(store.db, { schema }).select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
 		if (!actor) return c.json({ error: "actor not found" }, 404);
 		if (actor.status !== "active") return c.json({ error: "actor not active" }, 409);
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		d.update(schema.actors).set({
-			status: "deactivated",
-			updated_at: now
-		}).where(eq(schema.actors.actor_id, actorId)).run();
-		d.update(schema.syncPeers).set({ actor_id: null }).where(eq(schema.syncPeers.actor_id, actorId)).run();
+		deactivateActorAndWakePolicies(store, actorId, (/* @__PURE__ */ new Date()).toISOString());
 		return c.json({ ok: true });
 	});
 	app.post("/api/sync/legacy-devices/claim", async (c) => {
@@ -12028,6 +12321,9 @@ function createApp(opts) {
 	const app = new Hono();
 	app.use("*", preflightHandler());
 	app.use("*", originGuard({ unsafeGetPathPrefixes: [TEAM_SETUP_ROUTE_PREFIX] }));
+	const viewerTargetGuard = viewerTargetQueryGuard(storeFactory);
+	app.use("/api/memories/*", viewerTargetGuard);
+	app.use("/api/memory", viewerTargetGuard);
 	app.route("/", healthRoutes(storeFactory));
 	app.route("/", diagnosticsRoutes(storeFactory));
 	app.route("/", statsRoutes(storeFactory));