@codemem/server 0.46.0-rc.1 → 0.46.0-rc.3

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -671,14 +671,9 @@ function syncSelect(options) {
 		${SYNC_OCCURRED_AT_SQL} AS occurred_at,
 		CASE WHEN ok <> 0 THEN 'succeeded' ELSE 'failed' END AS status,
 		ops_in AS metric_a, ops_out AS metric_b,
-		CASE
-			WHEN lower(error) LIKE '%auth%' OR lower(error) LIKE '%unauthorized%' THEN 'authentication'
-			WHEN lower(error) LIKE '%timeout%' OR lower(error) LIKE '%timed out%' THEN 'timeout'
-			WHEN lower(error) LIKE '%version%' OR lower(error) LIKE '%capability%' THEN 'compatibility'
-			WHEN lower(error) LIKE '%connect%' OR lower(error) LIKE '%network%'
-				OR lower(error) LIKE '%dns%' THEN 'connectivity'
-			ELSE 'unspecified'
-		END AS category
+		-- Raw error text; syncEvent classifies it server-side and never returns it.
+		error AS category,
+		failure_category AS stored_category
 		FROM sync_attempts ${predicates.length ? `WHERE ${predicates.join(" AND ")}` : ""}
 		ORDER BY ${SYNC_OCCURRED_AT_SQL} DESC, id DESC
 		LIMIT @sourceLimit`;
@@ -712,7 +707,8 @@ function observerSelect(options) {
 						WHEN lower(COALESCE(observer_error_code, error_type)) LIKE '%schema%'
 							OR lower(COALESCE(observer_error_code, error_type)) LIKE '%parse%' THEN 'response format'
 						ELSE 'unspecified'
-					END AS category
+					END AS category,
+					NULL AS stored_category
 				FROM raw_event_flush_batches
 				WHERE status = '${status}' ${providerFilter} ${cursorFilter}
 				ORDER BY updated_at DESC, id DESC
@@ -729,7 +725,7 @@ function maintenanceSelect(options) {
 	return `SELECT 'maintenance' AS source_type, kind AS source_id,
 		'm:' || hex(kind) AS order_key, updated_at AS occurred_at,
 		status, progress_current AS metric_a, progress_total AS metric_b,
-		NULL AS category
+		NULL AS category, NULL AS stored_category
 		FROM maintenance_jobs WHERE status IN (${statuses.join(", ")})`;
 }
 function backlogSelect(options) {
@@ -763,7 +759,8 @@ function backlogSelect(options) {
 		'b:' || printf('%020d', 0) AS order_key, occurred_at,
 		CASE WHEN pending >= 1000 THEN 'error' ELSE 'warning' END AS status,
 		pending AS metric_a, sessions AS metric_b,
-		CASE WHEN candidate_count > 1000 THEN 'capped' ELSE NULL END AS category
+		CASE WHEN candidate_count > 1000 THEN 'capped' ELSE NULL END AS category,
+		NULL AS stored_category
 		FROM (
 			SELECT MAX(updated_at) AS occurred_at,
 				SUM(pending) AS pending,
@@ -805,11 +802,28 @@ function loadSourceRows(store, options) {
 			 ORDER BY occurred_at DESC, order_key DESC
 			 LIMIT @resultLimit`).all(params);
 }
+var SYNC_FAILURE_MESSAGES = {
+	connectivity: "Sync could not reach a paired device, or the device did not respond in time.",
+	trust: "Sync stopped because the pairing or identity check between two devices failed.",
+	scope: "Sync stopped because two devices disagree about access to a shared Space.",
+	compatibility: "Sync stopped because two devices run incompatible Codemem versions."
+};
+var SPECIFIC_STORED_SYNC_CATEGORIES = /* @__PURE__ */ new Set([
+	"trust",
+	"scope",
+	"connectivity",
+	"compatibility"
+]);
+function syncFailureCategory(row) {
+	const stored = row.stored_category;
+	if (stored && SPECIFIC_STORED_SYNC_CATEGORIES.has(stored)) return stored;
+	return classifyRecordedSyncFailure(row.category);
+}
 function syncEvent(row, includeTechnical) {
 	const succeeded = row.status === "succeeded";
 	const opsIn = Number(row.metric_a ?? 0);
 	const opsOut = Number(row.metric_b ?? 0);
-	const category = row.category ?? "unspecified";
+	const category = succeeded ? "other" : syncFailureCategory(row);
 	return {
 		id: opaqueId("sync-attempt", row.source_id),
 		orderKey: row.order_key,
@@ -817,7 +831,7 @@ function syncEvent(row, includeTechnical) {
 		severity: succeeded ? "info" : "error",
 		subsystem: "sync",
 		code: succeeded ? "sync_attempt_succeeded" : "sync_attempt_failed",
-		message: succeeded ? "A sync attempt completed." : "A sync attempt failed before all work completed.",
+		message: succeeded ? "A sync attempt completed." : SYNC_FAILURE_MESSAGES[category] ?? "A sync attempt failed before all work completed.",
 		recovery: succeeded ? void 0 : {
 			label: "Open advanced sync diagnostics",
 			href: "#advanced/sync/diagnostics"
@@ -4496,6 +4510,126 @@ function snapshotPageRequest(query, localDeviceId) {
 	};
 }
 //#endregion
+//#region src/routes/device-rename.ts
+async function enrolledGroups(config, deviceId) {
+	const remoteUrl = config.syncCoordinatorUrl || null;
+	const adminSecret = config.syncCoordinatorAdminSecret || null;
+	if (!remoteUrl || !adminSecret) throw new Error("coordinator_unavailable");
+	const groups = await coordinatorListGroupsAction({
+		remoteUrl,
+		adminSecret
+	});
+	if (groups.length > 25) throw new Error("coordinator_evidence_too_large");
+	const devices = (await Promise.all(groups.map((group) => coordinatorListDevicesAction({
+		groupId: group.group_id,
+		includeDisabled: true,
+		remoteUrl,
+		adminSecret
+	})))).flat();
+	if (devices.length > 500) throw new Error("coordinator_evidence_too_large");
+	const matches = devices.filter((device) => device.device_id === deviceId);
+	if (new Set(matches.map((device) => `${device.public_key}:${device.fingerprint}`)).size > 1) throw new Error("device_enrollment_conflict");
+	return [...new Set(matches.map((device) => device.group_id))].sort();
+}
+async function renameEnrolledGroups(config, groups, deviceId, name) {
+	let renamed = 0;
+	for (const groupId of groups) try {
+		if (!await coordinatorRenameDeviceAction({
+			groupId,
+			deviceId,
+			displayName: name,
+			remoteUrl: config.syncCoordinatorUrl || null,
+			adminSecret: config.syncCoordinatorAdminSecret || null
+		})) break;
+		renamed += 1;
+	} catch {
+		break;
+	}
+	return renamed;
+}
+async function renameDevice(store, deviceId, name, provenance) {
+	const config = readCoordinatorSyncConfig();
+	if (provenance === "coordinator_enrollment" && !config.syncCoordinatorUrl) return {
+		ok: false,
+		error: "coordinator_device_names_unavailable",
+		status: 503
+	};
+	let groups = [];
+	if (config.syncCoordinatorUrl) {
+		try {
+			groups = await enrolledGroups(config, deviceId);
+		} catch (error) {
+			if (error instanceof Error && error.message === "device_enrollment_conflict") return {
+				ok: false,
+				error: "device_enrollment_conflict",
+				status: 409
+			};
+			return {
+				ok: false,
+				error: "coordinator_device_names_unavailable",
+				status: 503
+			};
+		}
+		if (provenance === "coordinator_enrollment" && groups.length === 0) return {
+			ok: false,
+			error: "device_enrollment_unavailable",
+			status: 409
+		};
+	}
+	const renamedGroupCount = await renameEnrolledGroups(config, groups, deviceId, name);
+	if (renamedGroupCount !== groups.length) return {
+		ok: false,
+		error: "coordinator_device_rename_incomplete",
+		status: 503,
+		renamedGroupCount
+	};
+	if (!store.db.transaction(() => {
+		const result = store.db.prepare("UPDATE identity_devices SET display_name = ?, updated_at = ? WHERE device_id = ? AND status = 'active'").run(name, (/* @__PURE__ */ new Date()).toISOString(), deviceId);
+		if (result.changes) store.db.prepare("UPDATE sync_peers SET name = ? WHERE peer_device_id = ?").run(name, deviceId);
+		return result.changes;
+	})()) return {
+		ok: false,
+		error: "device_not_found",
+		status: 409
+	};
+	return {
+		ok: true,
+		display_name: name
+	};
+}
+function deviceRenameRoutes(getStore) {
+	const pendingDevices = /* @__PURE__ */ new Set();
+	return new Hono().post("/api/sync/recipient-policy/v1/devices/:device_id/rename", async (c) => {
+		const store = getStore();
+		const deviceId = String(c.req.param("device_id") ?? "").trim();
+		const binding = store.db.prepare("SELECT provenance FROM identity_devices WHERE device_id = ? AND status = 'active'").get(deviceId);
+		if (!binding) return c.json({ error: "device_not_found" }, 404);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "invalid_json" }, 400);
+		}
+		let name;
+		try {
+			name = normalizeHumanPresentationName(String(body.display_name ?? ""), "display_name");
+		} catch {
+			return c.json({ error: "display_name_invalid" }, 400);
+		}
+		if (pendingDevices.has(deviceId)) return c.json({ error: "device_rename_busy" }, 409);
+		pendingDevices.add(deviceId);
+		try {
+			const result = await renameDevice(store, deviceId, name, binding.provenance);
+			if (!result.ok) return c.json(result, result.status);
+			return c.json(result);
+		} catch {
+			return c.json({ error: "device_rename_failed" }, 503);
+		} finally {
+			pendingDevices.delete(deviceId);
+		}
+	});
+}
+//#endregion
 //#region src/routes/team-setup-view.ts
 var enabled = {
 	enabled: true,
@@ -10008,7 +10142,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			localDeviceId: store.deviceId
 		}));
 	});
-	app.get("/api/sync/recipient-policy/v1/intent", (c) => {
+	app.route("/", deviceRenameRoutes(getStore)).get("/api/sync/recipient-policy/v1/intent", (c) => {
 		const store = getStore();
 		return c.json(listRecipientPolicyIntent(store.db));
 	});