@codemem/server 0.46.3 → 0.47.0-beta.3

package/dist/index.js

@@ -1,16 +1,120 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorAccountLinkError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, FILE_CONTEXT_TRANSPORT_MAX_BYTES, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RICH_TIER_ANTHROPIC_DEFAULTS, RICH_TIER_DEFAULTS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SIMPLE_TIER_ANTHROPIC_DEFAULTS, SIMPLE_TIER_DEFAULTS, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterBranchesWithContext, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, changeCoordinatorAccount, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, classifyRecordedSyncFailure, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, dispatchFileContextTransport, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, generateWithOpenCodeV2, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getEffectiveCachedScopeAuthorization, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, linkCoordinatorAccount, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listOpenCodeV2Models, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadPublicKey, loadReplicationOpsForPeer, loadRuntimeSigningPublicKey, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeCoordinatorAccountLinkOrigin, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseBootstrapExpiry, parseFileContextTransportRequest, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readAccountLinkDevice, readCodememConfigFile, readCoordinatorAccountChangeCapabilities, readCoordinatorAccountLinkStatus, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveCodememConfigPath, resolveDbPath, resolveObserverDefaultModel, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, resolveVisibleScopeIds, runSyncPass, schema, scopeAuthorizationFailureReason, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { createMiddleware } from "hono/factory";
 import { RateLimiter } from "limiter";
-import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
 import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { homedir, hostname, networkInterfaces } from "node:os";
 import * as z from "zod";
 import { chmod, link, mkdir, open, readFile, readdir, rm, stat } from "node:fs/promises";
+//#region src/routes/account.ts
+/** Mounted only alongside the account request middleware. */
+function accountRoutes(getSession) {
+	const app = new Hono();
+	app.get("/api/account/session", (c) => c.json(getSession()));
+	return app;
+}
+//#endregion
+//#region src/account/guard.ts
+var ACCOUNT_PREFIX = "/api/account";
+var SESSION_PATH = `${ACCOUNT_PREFIX}/session`;
+var LISTENER_HOSTS = {
+	"127.0.0.1": ["127.0.0.1", "localhost"],
+	"::1": ["[::1]", "localhost"],
+	localhost: [
+		"127.0.0.1",
+		"[::1]",
+		"localhost"
+	]
+};
+function allowedAuthorities(options) {
+	try {
+		const address = options.getListenerAddress();
+		if (!address || !Number.isInteger(address.port) || address.port < 1 || address.port > 65535) return null;
+		const { host, port } = address;
+		if (!Object.hasOwn(LISTENER_HOSTS, host)) return null;
+		const aliases = LISTENER_HOSTS[host];
+		if (!aliases) return null;
+		return aliases.flatMap((alias) => {
+			const explicit = `${alias}:${port}`;
+			return [.../* @__PURE__ */ new Set([explicit, new URL(`http://${explicit}`).host])];
+		});
+	} catch {
+		return null;
+	}
+}
+function validRequestContext(c, authorities) {
+	const host = c.req.header("Host");
+	if (!host || !authorities.includes(host)) return false;
+	const expectedOrigin = new URL(`http://${host}`).origin;
+	try {
+		if (new URL(c.req.url).origin !== expectedOrigin) return false;
+	} catch {
+		return false;
+	}
+	const origin = c.req.header("Origin");
+	if (origin !== void 0 && origin !== expectedOrigin) return false;
+	if (c.req.method === "POST" && origin === void 0) return false;
+	const fetchSite = c.req.header("Sec-Fetch-Site");
+	return fetchSite === void 0 || fetchSite === "same-origin";
+}
+function validSessionRequest(c) {
+	const contentLength = c.req.header("Content-Length");
+	return c.req.method === "GET" && !c.req.url.includes("?") && c.req.raw.body === null && (contentLength === void 0 || contentLength === "0") && c.req.header("Transfer-Encoding") === void 0;
+}
+function validCsrfToken(c, token) {
+	const supplied = c.req.header("X-Codemem-Account-Csrf");
+	if (!supplied || supplied.length !== token.length) return false;
+	const candidate = Buffer.from(supplied, "utf8");
+	return candidate.length === token.length && timingSafeEqual(candidate, token);
+}
+function requestError(c, options, token) {
+	const authorities = allowedAuthorities(options);
+	if (!authorities) return "account_local_viewer_required";
+	if (c.req.method === "OPTIONS" || !validRequestContext(c, authorities)) return "account_request_rejected";
+	if (c.req.path === SESSION_PATH) return validSessionRequest(c) ? null : "account_request_rejected";
+	return validCsrfToken(c, token) ? null : "account_csrf_invalid";
+}
+function secureAccountResponse(c) {
+	for (const name of [...c.res.headers.keys()]) if (name.toLowerCase().startsWith("access-control-")) c.header(name, void 0);
+	c.header("Cache-Control", "no-store");
+	c.header("X-Content-Type-Options", "nosniff");
+	c.header("Referrer-Policy", "no-referrer");
+}
+/** One token per viewer app; only the exact GET session route can return it. */
+function createAccountGuard(options) {
+	const csrfToken = randomBytes(32).toString("base64url");
+	const token = Buffer.from(csrfToken, "utf8");
+	return {
+		middleware: createMiddleware(async (c, next) => {
+			if (c.req.path !== ACCOUNT_PREFIX && !c.req.path.startsWith(`${ACCOUNT_PREFIX}/`)) {
+				await next();
+				return;
+			}
+			try {
+				const error = requestError(c, options, token);
+				if (error) {
+					c.res = c.json({ error }, 403);
+					return;
+				}
+				await next();
+			} catch {
+				c.res = c.json({ error: "account_request_rejected" }, 500);
+			} finally {
+				secureAccountResponse(c);
+			}
+		}),
+		routes: accountRoutes(() => ({
+			version: 1,
+			csrfToken
+		}))
+	};
+}
+//#endregion
 //#region src/middleware.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"127.0.0.1",
@@ -161,6 +265,625 @@ function createInMemoryRequestRateLimiter(windowMs = 6e4) {
 	} };
 }
 //#endregion
+//#region src/account/link-registry.ts
+var DEADLINE_MS = 6e5;
+var RETENTION_MS = 9e5;
+var BUSY_SLOT = Symbol.for("codemem.account-link.busy-owner");
+var runtime = globalThis;
+runtime[BUSY_SLOT] ??= { owner: null };
+var busySlot = runtime[BUSY_SLOT];
+busySlot.lifecycle ??= Symbol();
+function releaseBusyOwner(owner) {
+	if (busySlot.owner !== owner) return;
+	busySlot.owner = null;
+	busySlot.lifecycle = Symbol();
+}
+var AUTHORITY_FIELDS = [
+	"contextId",
+	"dbPath",
+	"keysDir",
+	"configPath",
+	"coordinatorUrl",
+	"groupId",
+	"deviceId",
+	"fingerprint",
+	"identityId"
+];
+function sameAuthority(captured, fresh) {
+	return AUTHORITY_FIELDS.every((key) => captured[key] === fresh[key]) && captured.fileIdentity.dev === fresh.fileIdentity.dev && captured.fileIdentity.ino === fresh.fileIdentity.ino;
+}
+function terminal(job) {
+	return job.operation.finishedAt !== null;
+}
+function safeFailure(error) {
+	if (!(error instanceof CoordinatorAccountLinkError)) return "request_failed";
+	if (error.code === "invalid_options") return "configuration_invalid";
+	switch (error.code) {
+		case "device_unavailable":
+		case "request_failed":
+		case "schema_upgrade_required":
+		case "review_required":
+		case "link_conflict":
+		case "invalid_response":
+		case "context_changed":
+		case "identity_mismatch":
+		case "link_stopped":
+		case "cancellation_unconfirmed":
+		case "receiver_close_failed": return error.code;
+		default: return "request_failed";
+	}
+}
+function validBrowserUrl(value, origin, intent) {
+	try {
+		const url = new URL(value);
+		return url.origin === origin && url.pathname === (intent === "refresh" || intent === "disconnect" ? "/auth/account/change/start" : "/auth/link/start") && !url.username && !url.password && !url.hash;
+	} catch {
+		return false;
+	}
+}
+/** Private URLs and captured profiles stay inside this process, never in public snapshots. */
+var InProcessAccountLinkRegistry = class {
+	#options;
+	#now;
+	#jobs = /* @__PURE__ */ new Map();
+	#shuttingDown = false;
+	#closing = null;
+	#uncertainOwner = null;
+	constructor(options) {
+		this.#options = options;
+		this.#now = options.now ?? Date.now;
+	}
+	#current(context) {
+		try {
+			const fresh = this.#options.readContext(context.groupId);
+			return !("error" in fresh) && fresh.setup === "ready" && fresh.context !== null && sameAuthority(context, fresh.context);
+		} catch {
+			return false;
+		}
+	}
+	#cleanup() {
+		const finished = [...this.#jobs.values()].filter(terminal);
+		for (const [index, job] of finished.entries()) {
+			if (job.operation.state === "outcome_unknown") continue;
+			if (this.#now() - Date.parse(job.operation.finishedAt ?? "") >= RETENTION_MS || index < finished.length - 8) this.#jobs.delete(job.operation.operationId);
+		}
+	}
+	#active() {
+		this.#cleanup();
+		return [...this.#jobs.values()].find((job) => !terminal(job) || !this.#shuttingDown && job.operation.state === "outcome_unknown");
+	}
+	#inProgress() {
+		const pending = this.#active();
+		if (pending) return {
+			error: "account_link_in_progress",
+			operationId: pending.operation.operationId
+		};
+		return busySlot.owner ? { error: "account_link_in_progress" } : null;
+	}
+	#snapshot(job) {
+		return { ...job.operation };
+	}
+	#clearUrl(job) {
+		job.url = null;
+		job.operation.browserUrlAvailable = false;
+	}
+	#finish(job, state, failure) {
+		if (terminal(job)) return;
+		this.#clearUrl(job);
+		Object.assign(job.operation, {
+			state,
+			failure,
+			finishedAt: new Date(this.#now()).toISOString()
+		});
+		this.#cleanup();
+	}
+	#browserStart(job, url) {
+		if (this.#shuttingDown || terminal(job) || job.controller.signal.aborted) return;
+		if (!this.#current(job.context)) job.abortFailure = "context_changed";
+		else if (!validBrowserUrl(url, job.context.coordinatorUrl, job.operation.intent)) job.abortFailure = "invalid_response";
+		if (job.abortFailure) {
+			this.#clearUrl(job);
+			job.controller.abort();
+			return;
+		}
+		job.url = url;
+		job.operation.state = "awaiting_browser";
+		job.operation.browserUrlAvailable = job.deliveries < 5;
+	}
+	async #run(job, expectedCoordinatorId, expectedAuthority) {
+		try {
+			if (terminal(job) || job.controller.signal.aborted) {
+				this.#finish(job, "cancelled", "link_stopped");
+				return;
+			}
+			const { dbPath, keysDir, groupId, coordinatorUrl, identityId } = job.context;
+			const options = {
+				dbPath,
+				keysDir,
+				groupId,
+				coordinatorUrl,
+				expectedIdentityId: identityId,
+				expectedCoordinatorId,
+				assertCurrentContext: () => this.#current(job.context),
+				signal: job.controller.signal,
+				onBrowserStart: (url) => this.#browserStart(job, url)
+			};
+			const intent = job.operation.intent ?? "connect";
+			if (intent === "connect") await (this.#options.link ?? linkCoordinatorAccount)({
+				...options,
+				expectedAuthority
+			});
+			else {
+				const result = await (this.#options.change ?? changeCoordinatorAccount)({
+					...options,
+					intent,
+					expectedLinkId: job.expectedLinkId
+				});
+				if (result.state !== "completed" || result.intent !== intent || result.coordinatorId !== expectedCoordinatorId || result.identityId !== identityId) throw new CoordinatorAccountLinkError("invalid_response");
+			}
+			this.#finish(job, "succeeded", null);
+		} catch (error) {
+			this.#fail(job, error);
+		}
+	}
+	#fail(job, error) {
+		let failure = safeFailure(error);
+		if (job.abortFailure && (failure === "link_stopped" || failure === "request_failed")) failure = job.abortFailure;
+		let state = "failed";
+		if (failure === "cancellation_unconfirmed" || failure === "receiver_close_failed") state = "outcome_unknown";
+		else if (job.cancelled && (failure === "link_stopped" || failure === "request_failed")) state = "cancelled";
+		this.#finish(job, state, failure);
+	}
+	start({ intent = "connect", context, expectedCoordinatorId, expectedAuthority, expectedLifecycleToken, expectedLinkId }) {
+		if (this.#shuttingDown) return { error: "account_shutting_down" };
+		const pending = this.#inProgress();
+		if (pending) return pending;
+		if (expectedLifecycleToken && expectedLifecycleToken !== this.lifecycleToken()) return { error: "account_context_changed" };
+		if (!this.#current(context)) return { error: "account_context_changed" };
+		const started = this.#now();
+		const job = {
+			context: {
+				...context,
+				fileIdentity: { ...context.fileIdentity }
+			},
+			expectedLinkId,
+			controller: new AbortController(),
+			url: null,
+			deliveries: 0,
+			cancelled: false,
+			abortFailure: null,
+			done: Promise.resolve(),
+			operation: {
+				intent,
+				operationId: randomUUID(),
+				groupId: context.groupId,
+				contextId: context.contextId,
+				state: "starting",
+				failure: null,
+				browserUrlAvailable: false,
+				startedAt: new Date(started).toISOString(),
+				deadlineAt: new Date(started + DEADLINE_MS).toISOString(),
+				finishedAt: null
+			}
+		};
+		if (this.#shuttingDown) return { error: "account_shutting_down" };
+		const reentrantPending = this.#inProgress();
+		if (reentrantPending) return reentrantPending;
+		if (expectedLifecycleToken && expectedLifecycleToken !== this.lifecycleToken()) return { error: "account_context_changed" };
+		const owner = Symbol();
+		busySlot.owner = owner;
+		busySlot.lifecycle = Symbol();
+		this.#jobs.set(job.operation.operationId, job);
+		job.done = Promise.resolve().then(() => this.#run(job, expectedCoordinatorId, expectedAuthority)).finally(() => {
+			if (job.operation.state === "outcome_unknown" && !this.#shuttingDown) this.#uncertainOwner = owner;
+			else releaseBusyOwner(owner);
+		});
+		return { operation: this.#snapshot(job) };
+	}
+	lifecycleToken() {
+		busySlot.lifecycle ??= Symbol();
+		return busySlot.lifecycle;
+	}
+	get(operationId) {
+		this.#cleanup();
+		const job = this.#jobs.get(operationId);
+		return job ? this.#snapshot(job) : null;
+	}
+	browserUrl(operationId) {
+		this.#cleanup();
+		const job = this.#jobs.get(operationId);
+		if (!job || this.#shuttingDown || terminal(job) || job.controller.signal.aborted || job.operation.state !== "awaiting_browser" || job.deliveries >= 5) return null;
+		if (!this.#current(job.context)) {
+			job.abortFailure = "context_changed";
+			this.#clearUrl(job);
+			job.controller.abort();
+			return null;
+		}
+		const url = job.url;
+		if (url) job.deliveries += 1;
+		if (job.deliveries >= 5) this.#clearUrl(job);
+		return url;
+	}
+	cancel(operationId) {
+		this.#cleanup();
+		const job = this.#jobs.get(operationId);
+		if (!job) return null;
+		if (!terminal(job)) {
+			job.cancelled = true;
+			this.#clearUrl(job);
+			job.controller.abort();
+		}
+		return this.#snapshot(job);
+	}
+	async #drain() {
+		let timer;
+		try {
+			await Promise.race([Promise.all([...this.#jobs.values()].map((job) => job.done)), new Promise((resolve) => {
+				timer = setTimeout(resolve, 5e3);
+			})]);
+		} finally {
+			clearTimeout(timer);
+			for (const job of this.#jobs.values()) this.#finish(job, "outcome_unknown", "cancellation_unconfirmed");
+		}
+	}
+	close() {
+		if (this.#closing) return this.#closing;
+		this.#shuttingDown = true;
+		for (const job of this.#jobs.values()) {
+			this.#clearUrl(job);
+			if (!terminal(job)) {
+				job.cancelled = true;
+				job.controller.abort();
+			}
+		}
+		this.#closing = this.#drain().finally(() => {
+			if (this.#uncertainOwner) releaseBusyOwner(this.#uncertainOwner);
+		});
+		return this.#closing;
+	}
+	hasActive() {
+		return Boolean(this.#active() || busySlot.owner);
+	}
+	forContext(contextId) {
+		this.#cleanup();
+		const job = [...this.#jobs.values()].reverse().find((item) => item.operation.contextId === contextId);
+		return job ? this.#snapshot(job) : null;
+	}
+};
+function createAccountLinkRegistry(options) {
+	return new InProcessAccountLinkRegistry(options);
+}
+//#endregion
+//#region src/account/status.ts
+function attachOperation(view, registry) {
+	const operation = view.contextId ? registry?.forContext(view.contextId) ?? null : null;
+	if (registry?.hasActive()) return {
+		...view,
+		operation,
+		canLink: false,
+		blockedReason: "operation_active"
+	};
+	return {
+		...view,
+		operation
+	};
+}
+function accountLocalView(result) {
+	const context = result.context;
+	return {
+		version: 1,
+		contextId: context?.contextId ?? null,
+		setup: result.setup,
+		groups: result.groups,
+		selectedGroupId: result.selectedGroupId,
+		coordinator: result.coordinator,
+		local: context ? {
+			deviceId: context.deviceId,
+			fingerprint: context.fingerprint,
+			identityId: context.identityId,
+			identityLabel: context.identityLabel,
+			deviceLabel: context.deviceLabel
+		} : null,
+		remote: { kind: "not_checked" },
+		canLink: false,
+		blockedReason: "setup_incomplete",
+		operation: null,
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+function applyRemote(view, remote) {
+	if (remote.kind !== "status") return {
+		...view,
+		remote: remote.kind === "unsupported" ? { kind: "unsupported" } : {
+			kind: "unavailable",
+			code: remote.code
+		},
+		blockedReason: remote.kind === "unsupported" ? "unsupported" : "status_unavailable"
+	};
+	const status = remote.status;
+	const identityMatches = status.identityId !== null && status.identityId === view.local?.identityId;
+	let blockedReason = null;
+	if (status.state === "review_required" || status.state === "conflict") blockedReason = status.state;
+	else if (!identityMatches) blockedReason = "identity_mismatch";
+	else if (status.state === "linked") blockedReason = "already_linked";
+	else if (status.state === "revoked") blockedReason = "revoked";
+	return {
+		...view,
+		remote: {
+			kind: "status",
+			coordinatorId: status.coordinatorId,
+			authority: status.authority,
+			identityId: status.identityId,
+			state: status.state,
+			identityMatches,
+			account: identityMatches && status.state === "linked" ? status.account : null
+		},
+		canLink: status.state === "unlinked" && identityMatches,
+		blockedReason
+	};
+}
+async function readAccountStatus(options, groupId, signal, readOptions = {}) {
+	const initial = options.readContext(groupId);
+	if ("error" in initial) return initial;
+	const view = accountLocalView(initial);
+	if (initial.setup !== "ready" || !initial.context) return attachOperation(view, options.registry);
+	const snapshot = JSON.stringify(initial);
+	let remote;
+	try {
+		const { dbPath, keysDir, groupId, coordinatorUrl, identityId } = initial.context;
+		remote = await (options.readRemoteStatus ?? readCoordinatorAccountLinkStatus)({
+			dbPath,
+			keysDir,
+			groupId,
+			coordinatorUrl,
+			identityId,
+			signal
+		});
+	} catch {
+		remote = {
+			kind: "unavailable",
+			code: "coordinator_unreachable"
+		};
+	}
+	let fresh;
+	try {
+		fresh = options.readContext(groupId);
+	} catch {
+		fresh = { error: "account_context_unavailable" };
+	}
+	const subject = "error" in fresh ? null : fresh.context;
+	const tupleChanged = remote.kind === "status" && (remote.status.groupId !== subject?.groupId || remote.status.deviceId !== subject?.deviceId || remote.status.fingerprint !== subject?.fingerprint);
+	const expectedChanged = readOptions.expectedContext !== void 0 && (!initial.context || !sameAuthority(readOptions.expectedContext, initial.context));
+	if ("error" in fresh || snapshot !== JSON.stringify(fresh) || tupleChanged || expectedChanged) return attachOperation({
+		..."error" in fresh ? accountLocalView({
+			setup: "device_unavailable",
+			groups: [],
+			selectedGroupId: null,
+			coordinator: null,
+			context: null
+		}) : accountLocalView(fresh),
+		remote: {
+			kind: "unavailable",
+			code: "context_changed"
+		},
+		blockedReason: "status_unavailable"
+	}, options.registry);
+	const currentView = applyRemote(accountLocalView(fresh), remote);
+	await attachManagementActions(options, initial.context, currentView, signal);
+	return attachOperation(currentView, options.registry);
+}
+async function attachManagementActions(options, context, view, signal) {
+	if (view.remote.kind !== "status" || view.remote.state !== "linked" || !view.remote.identityMatches) return;
+	const read = options.readRemoteCapabilities ?? (options.readRemoteStatus ? null : readCoordinatorAccountChangeCapabilities);
+	if (!read) return;
+	let capabilities = null;
+	try {
+		const { dbPath, keysDir, groupId, coordinatorUrl, identityId } = context;
+		capabilities = await read({
+			dbPath,
+			keysDir,
+			groupId,
+			coordinatorUrl,
+			identityId,
+			signal
+		});
+	} catch {}
+	let fresh;
+	try {
+		fresh = options.readContext(context.groupId);
+	} catch {
+		fresh = { error: "account_context_unavailable" };
+	}
+	if (signal.aborted || "error" in fresh || fresh.setup !== "ready" || !fresh.context || !sameAuthority(context, fresh.context)) {
+		view.remote = {
+			kind: "unavailable",
+			code: "context_changed"
+		};
+		view.blockedReason = "status_unavailable";
+		return;
+	}
+	if (capabilities?.kind !== "capabilities" || capabilities.coordinatorId !== view.remote.coordinatorId) return;
+	view.managementActions = {
+		...capabilities.actions,
+		disconnect: capabilities.actions.disconnect && !!capabilities.unlinkTarget
+	};
+	if (view.managementActions.disconnect) view.unlinkTarget = capabilities.unlinkTarget;
+}
+//#endregion
+//#region src/routes/account-operations.ts
+var ROOT = "/api/account/link-operations";
+function validString(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+function noBody(request) {
+	const length = request.headers.get("Content-Length");
+	return request.body === null && (length === null || length === "0") && !request.headers.has("Transfer-Encoding");
+}
+/** Cap both bytes and elapsed time; cancellation must not wait on an uncooperative stream. */
+async function readBody(request, keys, optional = []) {
+	if (!/^application\/json(?:\s*;\s*charset\s*=\s*(?:utf-8|"utf-8"))?\s*$/i.test(request.headers.get("Content-Type") ?? "")) return null;
+	const reader = request.body?.getReader();
+	if (!reader) return null;
+	let timer;
+	let stop = () => {};
+	try {
+		const expired = new Promise((_, reject) => {
+			stop = () => reject(/* @__PURE__ */ new Error("invalid body"));
+			timer = setTimeout(stop, 1e4);
+			request.signal.addEventListener("abort", stop, { once: true });
+			if (request.signal.aborted) stop();
+		});
+		const bytes = /* @__PURE__ */ new Uint8Array(1024);
+		let length = 0;
+		while (true) {
+			const chunk = await Promise.race([reader.read(), expired]);
+			if (chunk.done) break;
+			if (length + chunk.value.byteLength > bytes.length) return null;
+			bytes.set(chunk.value, length);
+			length += chunk.value.byteLength;
+		}
+		const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length)));
+		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+		const actual = Object.keys(value);
+		if (keys.some((key) => !actual.includes(key)) || actual.some((key) => !keys.includes(key) && !optional.includes(key))) return null;
+		return value;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+		request.signal.removeEventListener("abort", stop);
+		reader.cancel().catch(() => {});
+		reader.releaseLock();
+	}
+}
+function isCurrent(options, operation) {
+	const fresh = options.readContext(operation.groupId);
+	return !("error" in fresh) && fresh.setup === "ready" && fresh.context?.groupId === operation.groupId && fresh.context.contextId === operation.contextId;
+}
+function validStartBody(body) {
+	return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect") && (body.authority === "controller_attestation" || body.authority === "device_claim");
+}
+function unlinkTargetChanged(body, view) {
+	return body.intent === "disconnect" && body.expectedLinkId !== view.unlinkTarget;
+}
+async function startOperation(c, options) {
+	const body = await readBody(c.req.raw, [
+		"groupId",
+		"contextId",
+		"authority",
+		"coordinatorId"
+	], ["intent", "expectedLinkId"]);
+	if (!validStartBody(body)) return c.json({ error: "account_invalid_request" }, 400);
+	const initial = options.readContext(body.groupId);
+	if ("error" in initial && initial.error === "account_group_not_configured") return c.json({ error: initial.error }, 400);
+	if ("error" in initial || initial.setup !== "ready" || !initial.context || initial.context?.contextId !== body.contextId) return c.json({ error: "account_context_changed" }, 409);
+	const checkedContext = structuredClone(initial.context);
+	const expectedLifecycleToken = options.registry.lifecycleToken();
+	const view = await readAccountStatus(options, body.groupId, c.req.raw.signal, { expectedContext: checkedContext });
+	if ("error" in view || view.setup !== "ready" || view.contextId !== body.contextId || view.remote.kind === "unavailable" && view.remote.code === "context_changed") return c.json({ error: "account_context_changed" }, 409);
+	if (view.operation && view.operation.finishedAt === null) return c.json({
+		error: "account_link_in_progress",
+		operationId: view.operation.operationId
+	}, 409);
+	if (view.blockedReason === "operation_active") return c.json({
+		error: "account_link_not_allowed",
+		blockedReason: "operation_active"
+	}, 409);
+	if (view.remote.kind === "unavailable") return c.json({ error: "account_status_unavailable" }, 503);
+	if (!actionAllowed(view, body.intent) || view.remote.kind !== "status") return c.json({
+		error: "account_link_not_allowed",
+		blockedReason: view.blockedReason
+	}, 409);
+	if (unlinkTargetChanged(body, view)) return c.json({ error: "account_context_changed" }, 409);
+	return beginCurrentOperation(c, options, body, view, view.remote.coordinatorId, checkedContext, expectedLifecycleToken);
+}
+function actionAllowed(view, intent = "connect") {
+	if (intent === "connect") return view.canLink;
+	if (intent === "refresh" || intent === "disconnect") return view.managementActions?.[intent] === true;
+	return false;
+}
+function beginCurrentOperation(c, options, body, view, expectedCoordinatorId, checkedContext, expectedLifecycleToken) {
+	if (c.req.raw.signal.aborted) return c.json({ error: "account_invalid_request" }, 400);
+	if (view.remote.kind !== "status" || (body.intent ?? "connect") === "connect" && view.remote.authority !== body.authority || view.remote.coordinatorId !== body.coordinatorId) return c.json({ error: "account_context_changed" }, 409);
+	const fresh = options.readContext(body.groupId);
+	if ("error" in fresh || fresh.setup !== "ready" || !fresh.context || fresh.context.contextId !== body.contextId || fresh.context.contextId !== view.contextId || fresh.context.groupId !== body.groupId || !sameAuthority(checkedContext, fresh.context)) return c.json({ error: "account_context_changed" }, 409);
+	const result = options.registry.start({
+		intent: body.intent ?? "connect",
+		context: checkedContext,
+		expectedCoordinatorId,
+		expectedAuthority: body.authority,
+		expectedLifecycleToken,
+		expectedLinkId: body.expectedLinkId
+	});
+	if ("error" in result) return c.json(result, result.error === "account_shutting_down" ? 503 : 409);
+	return c.json({
+		version: 1,
+		operation: result.operation
+	}, 202);
+}
+async function performOperation(c, options) {
+	const { id, action } = c.req.param();
+	if (!validString(id) || action !== "browser-url" && action !== "cancel" || !await readBody(c.req.raw, [])) return c.json({ error: "account_invalid_request" }, 400);
+	const operation = options.registry.get(id);
+	if (!operation) return c.json({ error: "account_operation_not_found" }, 404);
+	if (action === "cancel") {
+		const cancelled = options.registry.cancel(id);
+		if (!cancelled) return c.json({ error: "account_operation_not_found" }, 404);
+		return c.json({
+			version: 1,
+			operation: cancelled
+		}, cancelled.finishedAt === null ? 202 : 200);
+	}
+	if (operation.state !== "awaiting_browser") return c.json({ error: "account_browser_url_unavailable" }, 409);
+	const url = options.registry.browserUrl(id);
+	if (!url) return c.json({ error: "account_browser_url_unavailable" }, 409);
+	return c.json({
+		version: 1,
+		url
+	});
+}
+function accountOperationRoutes(options) {
+	const app = new Hono();
+	app.onError((_error, c) => c.json({ error: "account_internal_error" }, 500));
+	const rejectQuery = async (c, next) => {
+		if ([...new URL(c.req.url).searchParams].length) return c.json({ error: "account_invalid_request" }, 400);
+		await next();
+	};
+	app.use(ROOT, rejectQuery);
+	app.use(`${ROOT}/*`, rejectQuery);
+	app.post(ROOT, (c) => startOperation(c, options));
+	app.get(`${ROOT}/:id`, (c) => {
+		if (!noBody(c.req.raw) || !validString(c.req.param("id"))) return c.json({ error: "account_invalid_request" }, 400);
+		const operation = options.registry.get(c.req.param("id"));
+		if (!operation) return c.json({ error: "account_operation_not_found" }, 404);
+		return c.json({
+			version: 1,
+			operation,
+			current: isCurrent(options, operation)
+		});
+	});
+	app.post(`${ROOT}/:id/:action`, (c) => performOperation(c, options));
+	return app;
+}
+//#endregion
+//#region src/routes/account-status.ts
+function accountStatusRoutes(options) {
+	const app = new Hono();
+	app.get("/api/account/link-status", async (c) => {
+		try {
+			const query = new URL(c.req.url).searchParams;
+			const length = c.req.header("Content-Length");
+			if ([...query.keys()].some((key) => key !== "group_id") || query.getAll("group_id").length > 1 || c.req.raw.body !== null || length !== void 0 && length !== "0" || c.req.header("Transfer-Encoding") !== void 0) return c.json({ error: "account_invalid_request" }, 400);
+			const result = await readAccountStatus(options, query.get("group_id") ?? void 0, c.req.raw.signal);
+			if ("error" in result) return c.json(result, result.error === "account_group_not_configured" ? 400 : 503);
+			return c.json(result);
+		} catch {
+			return c.json({ error: "account_internal_error" }, 500);
+		}
+	});
+	return app;
+}
+//#endregion
 //#region src/routes/config.ts
 /**
 * Config routes — GET /api/config, POST /api/config.
@@ -1028,38 +1751,6 @@ function diagnosticsRoutes(getStore) {
 	return app;
 }
 //#endregion
-//#region src/routes/health.ts
-function databaseReachable(getStore) {
-	try {
-		getStore().db.pragma("schema_version", { simple: true });
-		return true;
-	} catch {
-		return false;
-	}
-}
-function healthRoutes(getStore) {
-	const app = new Hono();
-	app.get("/api/viewer-status", (c) => {
-		const store = getStore();
-		store.db.pragma("schema_version", { simple: true });
-		c.header("Cache-Control", "no-store");
-		return c.json({ identity: { actor_id: store.actorId } });
-	});
-	app.get("/api/health", (c) => {
-		const reachable = databaseReachable(getStore);
-		c.header("Cache-Control", "no-store");
-		return c.json({
-			service: VIEWER_SERVICE_DISCRIMINATOR,
-			version: VERSION$1,
-			pid: process.pid,
-			uptime_ms: Math.max(0, Math.floor(process.uptime() * 1e3)),
-			ready: reachable,
-			database: { reachable }
-		});
-	});
-	return app;
-}
-//#endregion
 //#region src/helpers.ts
 /**
 * Shared helpers for viewer-server routes.
@@ -1153,6 +1844,181 @@ async function parseJsonObjectBody(c, maxBytes) {
 	return parsed;
 }
 //#endregion
+//#region src/routes/target-validation.ts
+var IDENTITY_TARGET_KEYS = new Set(VIEWER_IDENTITY_TARGET_KEYS);
+var BOOLEAN_IDENTITY_TARGET_KEYS = /* @__PURE__ */ new Set([
+	"actor_id_present",
+	"embedding_disabled",
+	"embedding_offline"
+]);
+function invalidRequest$1(message) {
+	return {
+		ok: false,
+		status: 400,
+		body: { error: {
+			code: "invalid_request",
+			message
+		} }
+	};
+}
+function conflict(code, message) {
+	return {
+		ok: false,
+		status: 409,
+		body: { error: {
+			code,
+			message
+		} }
+	};
+}
+function isRecord$1(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function currentIdentityTarget() {
+	return buildViewerIdentityTarget();
+}
+function requestedDbMatches(store, value) {
+	if (value == null) return true;
+	if (typeof value !== "string" || !value.trim()) return null;
+	return resolve(resolveDbPath(value.trim())) === resolve(store.dbPath);
+}
+function implicitConfigPath() {
+	const { resolved, fallbackChain } = resolveCodememConfigPath();
+	if (resolved.source !== "env-codemem-config") return resolve(resolved.path);
+	const candidates = fallbackChain.filter((candidate) => candidate.valid);
+	const implicit = candidates.find((candidate) => candidate.exists) ?? candidates[0];
+	return implicit ? resolve(implicit.path) : null;
+}
+function identityFieldMatches(key, requested, expected) {
+	if (requested === expected) return true;
+	if (key !== "config_path" || requested !== null && expected !== null) return false;
+	return (requested ?? expected) === implicitConfigPath();
+}
+function requestedIdentityMatches(value) {
+	if (value == null) return true;
+	if (!isRecord$1(value)) return null;
+	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
+	const expected = currentIdentityTarget();
+	for (const key of VIEWER_IDENTITY_TARGET_KEYS) {
+		const requested = value[key];
+		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
+			if (typeof requested !== "boolean") return null;
+		} else if (requested !== null && typeof requested !== "string") return null;
+		if (!identityFieldMatches(key, requested, expected[key])) return false;
+	}
+	return true;
+}
+function validateViewerTarget(store, payload, options = {}) {
+	if (options.requirePairedTargets) {
+		const hasDbPath = Object.hasOwn(payload, "db_path");
+		if (hasDbPath !== Object.hasOwn(payload, "identity_target")) return invalidRequest$1("db_path and identity_target must be provided together");
+		if (hasDbPath && (payload.db_path == null || payload.identity_target == null)) return invalidRequest$1("db_path and identity_target must be valid when provided");
+	}
+	const dbMatches = requestedDbMatches(store, payload.db_path);
+	if (dbMatches == null) return invalidRequest$1("db_path must be a non-empty string");
+	if (!dbMatches) return conflict("viewer_db_mismatch", "viewer database does not match request");
+	const identityMatches = requestedIdentityMatches(payload.identity_target);
+	if (identityMatches === "unsupported") return conflict("viewer_contract_unsupported", "viewer request contract is incompatible");
+	if (identityMatches == null) return invalidRequest$1("identity_target is invalid");
+	if (!identityMatches) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
+	if ((options.requireCurrentIdentity || payload.identity_target != null) && !store.hasCurrentIdentity()) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
+	return { ok: true };
+}
+/**
+* Middleware read of db_path / identity_target from the query string.
+* Native tools (pi extension) send targets as query params so a pre-handler
+* guard can reject a foreign viewer without consuming POST bodies. Lenient:
+* clients that omit targets (UI, MCP, curl) are unaffected.
+*/
+function viewerTargetQueryGuard(getStore) {
+	return async (c, next) => {
+		const dbPath = c.req.query("db_path");
+		const rawIdentity = c.req.query("identity_target");
+		if (dbPath == null && rawIdentity == null) return next();
+		let identityTarget;
+		if (rawIdentity != null) try {
+			identityTarget = JSON.parse(rawIdentity);
+		} catch {
+			return c.json({ error: {
+				code: "invalid_request",
+				message: "identity_target must be JSON"
+			} }, 400);
+		}
+		const target = validateViewerTarget(getStore(), {
+			db_path: dbPath ?? void 0,
+			identity_target: identityTarget
+		});
+		if (!target.ok) return c.json(target.body, target.status);
+		return next();
+	};
+}
+//#endregion
+//#region src/routes/file-context.ts
+function fileContextRoutes(getStore) {
+	const app = new Hono();
+	app.post("/api/file-context", async (c) => {
+		const body = await parseJsonObjectBody(c, FILE_CONTEXT_TRANSPORT_MAX_BYTES);
+		if (body instanceof Response) return body;
+		const parsed = parseFileContextTransportRequest(body);
+		if (!parsed.success) return c.json({ error: {
+			code: "invalid_request",
+			message: "invalid file-context request"
+		} }, 400);
+		try {
+			const store = getStore();
+			const target = validateViewerTarget(store, body, {
+				requireCurrentIdentity: true,
+				requirePairedTargets: true
+			});
+			if (!target.ok) return c.json(target.body, target.status);
+			const response = dispatchFileContextTransport(store, parsed.data);
+			if (!response.ok) return c.json({ error: {
+				code: "invalid_request",
+				message: "delivery does not match attempt"
+			} }, 400);
+			return c.json(response);
+		} catch {
+			return c.json({ error: {
+				code: "file_context_failed",
+				message: "file context unavailable"
+			} }, 503);
+		}
+	});
+	return app;
+}
+//#endregion
+//#region src/routes/health.ts
+function databaseReachable(getStore) {
+	try {
+		getStore().db.pragma("schema_version", { simple: true });
+		return true;
+	} catch {
+		return false;
+	}
+}
+function healthRoutes(getStore) {
+	const app = new Hono();
+	app.get("/api/viewer-status", (c) => {
+		const store = getStore();
+		store.db.pragma("schema_version", { simple: true });
+		c.header("Cache-Control", "no-store");
+		return c.json({ identity: { actor_id: store.actorId } });
+	});
+	app.get("/api/health", (c) => {
+		const reachable = databaseReachable(getStore);
+		c.header("Cache-Control", "no-store");
+		return c.json({
+			service: VIEWER_SERVICE_DISCRIMINATOR,
+			version: VERSION$1,
+			pid: process.pid,
+			uptime_ms: Math.max(0, Math.floor(process.uptime() * 1e3)),
+			ready: reachable,
+			database: { reachable }
+		});
+	});
+	return app;
+}
+//#endregion
 //#region src/routes/memory.ts
 var MAX_FEED_QUERY_CODE_UNITS = 256;
 var searchFunctionsRegisteredStores = /* @__PURE__ */ new WeakSet();
@@ -1359,16 +2225,19 @@ function memorySearchSql(query) {
 		params: [query]
 	};
 }
-function countVisibleObservationRows(store, filters) {
-	const filterResult = buildViewerMemoryFilters(store, filters);
-	const clauses = [
-		"memory_items.active = 1",
-		`NOT ${summaryLikeSqlPredicate()}`,
-		...filterResult.clauses
-	];
-	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
-	const row = store.db.prepare(`SELECT COUNT(*) AS total FROM ${from} WHERE ${clauses.join(" AND ")}`).get(...filterResult.params);
-	return Number(row?.total ?? 0);
+function countVisibleMemoryClassifications(store, filters) {
+	const branches = buildFilterBranchesWithContext(filters, store.ownershipFilterContext());
+	const source = branches.map((branch) => {
+		const from = branch.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
+		return `SELECT ${summaryLikeSqlPredicate()} AS is_summary FROM ${from}
+			WHERE memory_items.active = 1 AND ${branch.clauses.join(" AND ") || "1 = 1"}`;
+	}).join(" UNION ALL ");
+	const row = store.db.prepare(`SELECT COUNT(*) AS memories,
+			COUNT(CASE WHEN NOT is_summary THEN 1 END) AS observations FROM (${source})`).get(...branches.flatMap((branch) => branch.params));
+	return {
+		memories: Number(row?.memories ?? 0),
+		observations: Number(row?.observations ?? 0)
+	};
 }
 function sessionAllowsArtifactAccess(store, sessionId) {
 	const visibleCount = countVisibleMemoryRows(store, { session_id: sessionId });
@@ -1544,18 +2413,13 @@ function memoryRoutes(getStore) {
 			const project = c.req.query("project") || null;
 			let prompts;
 			let artifacts;
-			let memories;
-			let observations;
+			const { memories, observations } = countVisibleMemoryClassifications(store, project ? { project } : void 0);
 			if (project) {
 				prompts = countVisiblePromptRows(store, project);
 				artifacts = countVisibleArtifactRows(store, project);
-				memories = countVisibleMemoryRows(store, { project });
-				observations = countVisibleObservationRows(store, { project });
 			} else {
 				prompts = countVisiblePromptRows(store);
 				artifacts = countVisibleArtifactRows(store);
-				memories = countVisibleMemoryRows(store);
-				observations = countVisibleObservationRows(store);
 			}
 			const total = prompts + artifacts + memories;
 			return c.json({
@@ -1647,11 +2511,11 @@ function memoryRoutes(getStore) {
 		}
 		const memoryId = parseStrictInteger(typeof body.memory_id === "string" ? body.memory_id : String(body.memory_id ?? ""));
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
-		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
+		if (!store.getForMutation(memoryId)) return c.json({ error: "memory not found" }, 404);
 		const visibility = String(body.visibility ?? "").trim();
 		if (visibility !== "private" && visibility !== "shared") return c.json({ error: "visibility must be private or shared" }, 400);
 		try {
-			const item = store.updateMemoryVisibility(memoryId, visibility);
+			const item = store.updateMemoryVisibilityForUser(memoryId, visibility);
 			return c.json({ item });
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
@@ -1672,9 +2536,9 @@ function memoryRoutes(getStore) {
 		if (memoryId == null || memoryId <= 0) return c.json({ error: "memory_id must be int" }, 400);
 		const project = String(body.project ?? "").trim();
 		if (!project) return c.json({ error: "project must be a non-empty string" }, 400);
-		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
+		if (!store.getForMutation(memoryId)) return c.json({ error: "memory not found" }, 404);
 		try {
-			const result = store.moveMemoryProject(memoryId, project);
+			const result = store.moveMemoryProjectForUser(memoryId, project);
 			return c.json(result);
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
@@ -1699,11 +2563,11 @@ function memoryRoutes(getStore) {
 		if (!store.memoryOwnedBySelf(row)) return c.json({ error: "memory not owned by this device" }, 403);
 		if (Number(row.active ?? 1) === 0 || row.deleted_at != null) return c.json({ status: "ok" });
 		try {
-			store.forget(memoryId);
+			forgetMemoryForViewer(store, memoryId);
 			return c.json({ status: "ok" });
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
-			if (msg.includes("not found")) return c.json({ error: msg }, 404);
+			if (msg.includes("not found")) return c.json(...forgetNotFound(forgetSafetyFilters(body)));
 			if (msg.includes("not owned")) return c.json({ error: msg }, 403);
 			if (msg.includes("sync_rebootstrap_in_progress")) return c.json({ error: msg }, 409);
 			return c.json({ error: msg }, 400);
@@ -1721,9 +2585,13 @@ function forgetSafetyFilters(body) {
 	return filters;
 }
 function forgetTargetExists(store, memoryId, filters) {
+	if (!store.canMutateMemory(memoryId)) return false;
 	if (Object.keys(filters).length > 0) return store.timeline(null, memoryId, 0, 0, filters).some((row) => row.id === memoryId);
 	return store.get(memoryId) != null;
 }
+function forgetMemoryForViewer(store, memoryId) {
+	if (!store.forgetForUser(memoryId)) throw new Error("memory not found");
+}
 //#endregion
 //#region src/routes/memory-tools.ts
 /**
@@ -1867,7 +2735,8 @@ function parseJsonBody(body) {
 	};
 }
 function rememberMemory(store, input) {
-	return store.db.transaction(() => {
+	const createdMemories = [];
+	const result = store.db.transaction(() => {
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const user = process.env.USER ?? "unknown";
 		const cwd = process.cwd();
@@ -1875,10 +2744,10 @@ function rememberMemory(store, input) {
 			project: input.project,
 			envProject: process.env.CODEMEM_PROJECT
 		});
-		const sessionInfo = store.db.prepare(`INSERT INTO sessions(started_at, ended_at, cwd, project, user, tool_version, metadata_json)
-				 VALUES (?, ?, ?, ?, ?, ?, ?)`).run(now, now, cwd, project, user, "viewer-api", toJson({ viewer: true }));
+		const sessionInfo = store.db.prepare(`INSERT INTO sessions(started_at, ended_at, cwd, project, user, tool_version, metadata_json, import_key)
+				 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(now, now, cwd, project, user, "viewer-api", toJson({ viewer: true }), randomUUID());
 		const sessionId = Number(sessionInfo.lastInsertRowid);
-		const memId = store.remember(sessionId, input.kind, input.title, input.body, input.confidence);
+		const memId = store.rememberForUser(sessionId, input.kind, input.title, input.body, input.confidence, void 0, void 0, { createdMemories });
 		if (!getMemoryForAccess(store, memId)) throw new Error("unauthorized_scope");
 		store.db.prepare("UPDATE sessions SET ended_at = ?, metadata_json = ? WHERE id = ?").run((/* @__PURE__ */ new Date()).toISOString(), toJson({ viewer: true }), sessionId);
 		return {
@@ -1887,6 +2756,8 @@ function rememberMemory(store, input) {
 			body: input.body
 		};
 	})();
+	store.enqueueCommittedVectorWrites(createdMemories);
+	return result;
 }
 function readContextFile(path, displayPath, scope) {
 	if (!existsSync(path)) return null;
@@ -2052,7 +2923,7 @@ function memoryToolRoutes(getStore) {
 				project
 			});
 			try {
-				await storeVectors(store.db, result.memId, result.title, result.body);
+				await store.flushPendingVectorWrites();
 			} catch {}
 			return c.json({ id: result.memId });
 		} catch (err) {
@@ -2268,128 +3139,31 @@ function observerStatusRoutes(deps) {
 				auth_backoff_remaining_s: 0
 			}
 		});
-		const queueTotals = store.rawEventBacklogTotals();
-		const authBackoff = sweeper?.authBackoffStatus() ?? {
-			active: false,
-			remainingS: 0
-		};
-		const latestFailure = store.latestRawEventFlushFailure();
-		const active = normalizeActiveObserver(observer?.getStatus() ?? null);
-		const availableCredentials = probeAvailableCredentials();
-		const failureWithImpact = latestFailure != null && (authBackoff.active || queueTotals.pending > 0) && latestFailure ? {
-			...latestFailure,
-			impact: buildFailureImpact(latestFailure, queueTotals, authBackoff)
-		} : null;
-		return c.json({
-			active,
-			available_credentials: availableCredentials,
-			capture_enabled: readCaptureEnabled(),
-			latest_failure: failureWithImpact,
-			queue: {
-				...queueTotals,
-				auth_backoff_active: authBackoff.active,
-				auth_backoff_remaining_s: authBackoff.remainingS
-			}
-		});
-	});
-	return app;
-}
-//#endregion
-//#region src/routes/target-validation.ts
-var IDENTITY_TARGET_KEYS = new Set(VIEWER_IDENTITY_TARGET_KEYS);
-var BOOLEAN_IDENTITY_TARGET_KEYS = /* @__PURE__ */ new Set([
-	"actor_id_present",
-	"embedding_disabled",
-	"embedding_offline"
-]);
-function invalidRequest$1(message) {
-	return {
-		ok: false,
-		status: 400,
-		body: { error: {
-			code: "invalid_request",
-			message
-		} }
-	};
-}
-function conflict(code, message) {
-	return {
-		ok: false,
-		status: 409,
-		body: { error: {
-			code,
-			message
-		} }
-	};
-}
-function isRecord$1(value) {
-	return value != null && typeof value === "object" && !Array.isArray(value);
-}
-function currentIdentityTarget() {
-	return buildViewerIdentityTarget();
-}
-function requestedDbMatches(store, value) {
-	if (value == null) return true;
-	if (typeof value !== "string" || !value.trim()) return null;
-	return resolve(resolveDbPath(value.trim())) === resolve(store.dbPath);
-}
-function requestedIdentityMatches(value) {
-	if (value == null) return true;
-	if (!isRecord$1(value)) return null;
-	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
-	const expected = currentIdentityTarget();
-	for (const key of VIEWER_IDENTITY_TARGET_KEYS) {
-		const requested = value[key];
-		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
-			if (typeof requested !== "boolean") return null;
-		} else if (requested !== null && typeof requested !== "string") return null;
-		if (requested !== expected[key]) return false;
-	}
-	return true;
-}
-function validateViewerTarget(store, payload, options = {}) {
-	if (options.requirePairedTargets) {
-		const hasDbPath = Object.hasOwn(payload, "db_path");
-		if (hasDbPath !== Object.hasOwn(payload, "identity_target")) return invalidRequest$1("db_path and identity_target must be provided together");
-		if (hasDbPath && (payload.db_path == null || payload.identity_target == null)) return invalidRequest$1("db_path and identity_target must be valid when provided");
-	}
-	const dbMatches = requestedDbMatches(store, payload.db_path);
-	if (dbMatches == null) return invalidRequest$1("db_path must be a non-empty string");
-	if (!dbMatches) return conflict("viewer_db_mismatch", "viewer database does not match request");
-	const identityMatches = requestedIdentityMatches(payload.identity_target);
-	if (identityMatches === "unsupported") return conflict("viewer_contract_unsupported", "viewer request contract is incompatible");
-	if (identityMatches == null) return invalidRequest$1("identity_target is invalid");
-	if (!identityMatches) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
-	if ((options.requireCurrentIdentity || payload.identity_target != null) && !store.hasCurrentIdentity()) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
-	return { ok: true };
-}
-/**
-* Middleware read of db_path / identity_target from the query string.
-* Native tools (pi extension) send targets as query params so a pre-handler
-* guard can reject a foreign viewer without consuming POST bodies. Lenient:
-* clients that omit targets (UI, MCP, curl) are unaffected.
-*/
-function viewerTargetQueryGuard(getStore) {
-	return async (c, next) => {
-		const dbPath = c.req.query("db_path");
-		const rawIdentity = c.req.query("identity_target");
-		if (dbPath == null && rawIdentity == null) return next();
-		let identityTarget;
-		if (rawIdentity != null) try {
-			identityTarget = JSON.parse(rawIdentity);
-		} catch {
-			return c.json({ error: {
-				code: "invalid_request",
-				message: "identity_target must be JSON"
-			} }, 400);
-		}
-		const target = validateViewerTarget(getStore(), {
-			db_path: dbPath ?? void 0,
-			identity_target: identityTarget
+		const queueTotals = store.rawEventBacklogTotals();
+		const authBackoff = sweeper?.authBackoffStatus() ?? {
+			active: false,
+			remainingS: 0
+		};
+		const latestFailure = store.latestRawEventFlushFailure();
+		const active = normalizeActiveObserver(observer?.getStatus() ?? null);
+		const availableCredentials = probeAvailableCredentials();
+		const failureWithImpact = latestFailure != null && (authBackoff.active || queueTotals.pending > 0) && latestFailure ? {
+			...latestFailure,
+			impact: buildFailureImpact(latestFailure, queueTotals, authBackoff)
+		} : null;
+		return c.json({
+			active,
+			available_credentials: availableCredentials,
+			capture_enabled: readCaptureEnabled(),
+			latest_failure: failureWithImpact,
+			queue: {
+				...queueTotals,
+				auth_backoff_active: authBackoff.active,
+				auth_backoff_remaining_s: authBackoff.remainingS
+			}
 		});
-		if (!target.ok) return c.json(target.body, target.status);
-		return next();
-	};
+	});
+	return app;
 }
 //#endregion
 //#region src/routes/pack.ts
@@ -3619,11 +4393,7 @@ function chunkNumbers(values, chunkSize = 500) {
 }
 function visibleMemoryIdSet(store, memoryIds) {
 	if (memoryIds.size === 0) return /* @__PURE__ */ new Set();
-	const filterResult = buildFilterClausesWithContext(null, {
-		actorId: store.actorId,
-		deviceId: store.deviceId,
-		enforceScopeVisibility: true
-	});
+	const filterResult = buildFilterClausesWithContext(null, store.ownershipFilterContext());
 	const visibleIds = /* @__PURE__ */ new Set();
 	for (const chunk of chunkNumbers([...memoryIds])) {
 		const clauses = [
@@ -3638,11 +4408,7 @@ function visibleMemoryIdSet(store, memoryIds) {
 }
 function visibleSessionIdSet(store, sessionIds) {
 	if (sessionIds.size === 0) return /* @__PURE__ */ new Set();
-	const filterResult = buildFilterClausesWithContext(null, {
-		actorId: store.actorId,
-		deviceId: store.deviceId,
-		enforceScopeVisibility: true
-	});
+	const filterResult = buildFilterClausesWithContext(null, store.ownershipFilterContext());
 	const visibleIds = /* @__PURE__ */ new Set();
 	for (const chunk of chunkNumbers([...sessionIds])) {
 		const clauses = [
@@ -3680,8 +4446,20 @@ function usageRowVisible(row, visibility) {
 }
 function sanitizePackUsageMetadata(metadata, visibility) {
 	if (!metadata) return null;
-	const sanitized = { ...metadata };
-	for (const key of MEMORY_ID_METADATA_KEYS) if (Array.isArray(sanitized[key])) sanitized[key] = metadataMemoryIds(sanitized[key]).filter((memoryId) => visibility.visibleMemoryIds.has(memoryId));
+	const sanitized = MEMORY_ID_METADATA_KEYS.some((key) => {
+		if (!Object.hasOwn(metadata, key)) return false;
+		const ids = metadata[key];
+		if (!Array.isArray(ids)) return true;
+		return ids.some((value) => {
+			if (typeof value !== "number" && typeof value !== "string") return true;
+			const id = Number(value);
+			return !Number.isInteger(id) || id <= 0 || !visibility.visibleMemoryIds.has(id);
+		});
+	}) ? {} : { ...metadata };
+	for (const key of MEMORY_ID_METADATA_KEYS) {
+		const ids = metadata[key];
+		if (Array.isArray(ids)) sanitized[key] = metadataMemoryIds(ids.filter((value) => typeof value === "number" || typeof value === "string")).filter((memoryId) => visibility.visibleMemoryIds.has(memoryId));
+	}
 	return sanitized;
 }
 /**
@@ -3740,15 +4518,15 @@ function usageAggregatePayload(store, project) {
 	};
 }
 /**
-* Short-lived cache for the computed /api/usage payload.
+* Short-lived cache for the unfiltered /api/usage aggregates only.
 *
 * The health dot polls /api/usage on every 5s refresh regardless of the
 * active tab. The token/event totals come from indexed SQL aggregates and the
-* recent-pack window runs scope-visibility resolution over its bounded set, so
-* each miss is cheap — but the totals are cumulative dashboard figures where a
-* few seconds of staleness is acceptable, so caching still collapses the
-* repeated recompute on the polling loop. Keyed by db path + scope identity +
-* project filter so distinct stores/projects never share an entry.
+* recent-pack window must resolve current visibility on every request, even
+* on cache hits. Only the cumulative dashboard totals tolerate staleness.
+* Keyed by db path + scope identity + project filter so distinct
+* stores/projects never share an entry. Never cache recent packs or their
+* authorization: key, proof, policy, and ownership changes must apply now.
 */
 var usagePayloadCache = /* @__PURE__ */ new Map();
 var USAGE_PAYLOAD_CACHE_MS = 1e4;
@@ -3787,12 +4565,11 @@ function sweepUsagePayloadCache(cache, nowMs) {
 /**
 * Cheap fingerprint of the state that drives scope visibility
 * (`scope_memberships` / `replication_scopes`). Folding this into the usage
-* cache key ensures a membership/scope status change — e.g. a revocation —
-* invalidates any cached payload immediately instead of letting a device keep
-* reading a scope it can no longer see for up to the TTL. These tables are
-* small, so the aggregate is negligible next to the usage_events scan the
-* cache exists to avoid. Fails safe: any error forces a unique value so the
-* request bypasses the cache and recomputes visibility from scratch.
+* cache key preserves aggregate invalidation on membership/scope changes.
+* This fingerprint is not authorization: recent packs always use the current
+* ownership/scope filter independently of the aggregate cache. These tables
+* are small, so the aggregate is negligible next to the usage_events scan the
+* cache exists to avoid. Any error forces a unique value to bypass the cache.
 */
 function scopeVisibilityGeneration(store) {
 	try {
@@ -3873,8 +4650,16 @@ function statsRoutes(getStore) {
 			const cacheKey = usageCacheKey(store, projectFilter);
 			const nowMs = Date.now();
 			const cached = usagePayloadCache.get(cacheKey);
-			if (cached && nowMs < cached.expiresAtMs) return c.json(cached.payload);
-			const aggregates = usageAggregatePayload(store, projectFilter);
+			const cacheHit = cached && nowMs < cached.expiresAtMs;
+			const aggregates = cacheHit ? cached.payload : usageAggregatePayload(store, projectFilter);
+			if (!cacheHit) {
+				const setAtMs = Date.now();
+				sweepUsagePayloadCache(usagePayloadCache, setAtMs);
+				usagePayloadCache.set(cacheKey, {
+					payload: aggregates,
+					expiresAtMs: setAtMs + USAGE_PAYLOAD_CACHE_MS
+				});
+			}
 			const RECENT_PACK_SCAN_LIMIT = 200;
 			const loadRecentPackWindow = (project) => {
 				return (project ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
@@ -3907,12 +4692,6 @@ function statsRoutes(getStore) {
 				totals_filtered: aggregates.totalsFiltered,
 				recent_packs: recentPacks
 			};
-			const setAtMs = Date.now();
-			sweepUsagePayloadCache(usagePayloadCache, setAtMs);
-			usagePayloadCache.set(cacheKey, {
-				payload,
-				expiresAtMs: setAtMs + USAGE_PAYLOAD_CACHE_MS
-			});
 			return c.json(payload);
 		}
 	});
@@ -3921,10 +4700,7 @@ function statsRoutes(getStore) {
 function healthStats(store) {
 	return {
 		...store.stats(),
-		automatic_recall: automaticRecallHealth(store.db, {
-			actorId: store.actorId,
-			deviceId: store.deviceId
-		})
+		automatic_recall: automaticRecallHealth(store.db, store.ownershipFilterContext())
 	};
 }
 //#endregion
@@ -4542,7 +5318,7 @@ async function buildSyncStatusResponse(input) {
 	return response;
 }
 var PEERS_QUERY$1 = `
-	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.addresses_json,
+	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.public_key, p.addresses_json,
 	       p.last_seen_at, p.last_sync_at, p.last_error,
 	       p.runtime_version, p.runtime_version_observed_at,
 	       p.projects_include_json, p.projects_exclude_json, p.claimed_local_actor,
@@ -4879,6 +5655,52 @@ var defaultSnapshotLoaderDependencies = {
 function safeCoordinatorError() {
 	return /* @__PURE__ */ new Error("team_setup_roster_unavailable");
 }
+var CoordinatorAdminConfigurationMissingError = class extends Error {
+	constructor() {
+		super("team_setup_roster_unavailable");
+		this.name = "CoordinatorAdminConfigurationMissingError";
+	}
+};
+function isPassthroughSnapshotLoadError(error) {
+	return error instanceof CoordinatorAdminConfigurationMissingError || error instanceof Error && error.message === "legacy_team_setup_roster_too_large";
+}
+/**
+* Without coordinator admin access this Viewer cannot discover groups to
+* migrate, so the summary suppresses discovery. Members still see their Teams
+* from local records, and Devices reports incomplete coordinator setup. Saved,
+* unfinished migrations stay visible so they can be resumed once access
+* returns. Only the summary uses this; Team detail and finish stay fail-closed.
+*/
+function summaryWithoutAdminAccess(error, getStore, readConfig) {
+	if (!(error instanceof CoordinatorAdminConfigurationMissingError)) throw error;
+	const store = getStore();
+	const config = readConfig();
+	const eligibleCandidateRefs = new Set(legacyTeamCandidateGroupDescriptors(store, config.syncCoordinatorUrl, config.syncCoordinatorGroups).map(({ coordinatorId, groupId }) => legacyTeamCandidateId(coordinatorId, groupId)));
+	if (eligibleCandidateRefs.size === 0) return [];
+	const eligibleRefs = [...eligibleCandidateRefs];
+	const placeholders = eligibleRefs.map(() => "?").join(", ");
+	return store.db.prepare(`SELECT DISTINCT coordinator_id, group_id FROM legacy_team_setup_drafts
+			 WHERE candidate_id IN (${placeholders})
+			 ORDER BY coordinator_id, group_id`).all(...eligibleRefs).flatMap((row) => {
+		const candidateRef = legacyTeamCandidateId(row.coordinator_id, row.group_id);
+		if (!eligibleCandidateRefs.has(candidateRef)) return [];
+		const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+		if (!draft || draft.state === "completed" || hasCompletedLegacyTeamSetup(store, candidateRef)) return [];
+		return [{
+			coordinatorId: row.coordinator_id,
+			groupId: row.group_id,
+			displayName: draft.displayName,
+			devices: []
+		}];
+	}).slice(0, MAX_CONFIGURED_GROUPS);
+}
+function loadSummarySnapshots(load, getStore, readConfig) {
+	return () => load().catch((error) => summaryWithoutAdminAccess(error, getStore, readConfig));
+}
+function createLoadedSummarySnapshotCache(load, options) {
+	const readConfig = options.readCoordinatorConfig ?? options.snapshotLoaderDependencies?.readConfig ?? readCoordinatorSyncConfig;
+	return createCachedSnapshotLoader(loadSummarySnapshots(load, options.getStore, readConfig), SUMMARY_SNAPSHOT_CACHE_TTL_MS);
+}
 function isCoordinatorRosterTooLargeError(error) {
 	return error instanceof Error && error.message === "coordinator_response_too_large";
 }
@@ -5028,7 +5850,8 @@ async function loadConfiguredLegacyTeamGroupSnapshotsWith(dependencies, options
 	const hasUrl = Boolean(config.syncCoordinatorUrl);
 	const hasSecret = Boolean(config.syncCoordinatorAdminSecret);
 	if (!hasUrl && !hasSecret && config.syncCoordinatorGroups.length === 0) return [];
-	if (!hasUrl || !hasSecret) throw safeCoordinatorError();
+	if (hasUrl && !hasSecret) throw new CoordinatorAdminConfigurationMissingError();
+	if (!hasUrl) throw safeCoordinatorError();
 	try {
 		const configuredCoordinatorId = buildBaseUrl(config.syncCoordinatorUrl);
 		if (!configuredCoordinatorId) throw safeCoordinatorError();
@@ -5100,7 +5923,7 @@ async function loadConfiguredLegacyTeamGroupSnapshotsWith(dependencies, options
 		if (validSnapshots.length === 0 && outcomes.some((outcome) => outcome.kind === "unavailable")) throw safeCoordinatorError();
 		return validSnapshots;
 	} catch (error) {
-		if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
+		if (isPassthroughSnapshotLoadError(error)) throw error;
 		throw safeCoordinatorError();
 	}
 }
@@ -5762,11 +6585,11 @@ function teamSetupRoutes(options) {
 				deadlineMs
 			} : void 0);
 		} catch (error) {
-			if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
+			if (isPassthroughSnapshotLoadError(error)) throw error;
 			throw safeCoordinatorError();
 		}
 	}
-	const loadedSummarySnapshots = createCachedSnapshotLoader(() => loadedSnapshots(), SUMMARY_SNAPSHOT_CACHE_TTL_MS);
+	const loadedSummarySnapshots = createLoadedSummarySnapshotCache(loadedSnapshots, options);
 	options.registerSummaryInvalidator?.(() => loadedSummarySnapshots.invalidate());
 	const completionDependencies = options.completionDependencies === void 0 ? defaultCompletionDependencies : options.completionDependencies;
 	/**
@@ -6760,7 +7583,7 @@ async function maybeGrantDefaultSpaceOnJoin(opts) {
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
 	});
 }
-function configuredGroups(config) {
+function configuredGroups$1(config) {
 	const rawGroups = config.sync_coordinator_groups;
 	if (Array.isArray(rawGroups)) return rawGroups.map((group) => String(group).trim()).filter(Boolean);
 	if (typeof rawGroups === "string") return rawGroups.split(",").map((group) => group.trim()).filter(Boolean);
@@ -6772,7 +7595,7 @@ function removeConfiguredCoordinatorGroup(groupId) {
 	if (!targetGroup) return [];
 	let nextGroups = [];
 	mutateCodememConfigFile((config) => {
-		const groups = configuredGroups(config);
+		const groups = configuredGroups$1(config);
 		nextGroups = groups.filter((group) => group !== targetGroup);
 		const configuredGroup = String(config.sync_coordinator_group ?? "").trim();
 		const removesPluralGroup = nextGroups.length !== groups.length;
@@ -7295,7 +8118,7 @@ async function reconcileProjectInviteAcceptance(store, operationId) {
 	const owner = store.db.prepare("SELECT inviter_actor_id FROM share_operations WHERE operation_id = ?").pluck().get(operationId);
 	if (!owner) throw new Error("operation_not_found");
 	if (owner !== store.actorId) throw new Error("operation_scope_mismatch");
-	ensureLocalActorRecord(store);
+	requireLocalActorRecord(store);
 	const { groupId, payload } = await coordinatorProjectInvitePayload(operationId);
 	if (payload.state === "waiting_for_acceptance") return {
 		accepted: false,
@@ -7329,7 +8152,7 @@ async function reconcileProjectInviteAcceptance(store, operationId) {
 		throw error;
 	}
 	const projects = parseAcceptedProjectIntent(payload.projects);
-	reconcileShareOperationAcceptance(store.db, {
+	commitProjectInviteAcceptance(store, {
 		operationId,
 		localInviterActorId: store.actorId,
 		coordinatorGroupId: groupId,
@@ -7350,6 +8173,12 @@ async function reconcileProjectInviteAcceptance(store, operationId) {
 		payload
 	};
 }
+function commitProjectInviteAcceptance(store, input) {
+	store.db.transaction(() => {
+		store.assertPendingLocalCaptureAdoptionActors();
+		reconcileShareOperationAcceptance(store.db, input);
+	}).immediate();
+}
 async function shareOperationReadModels(store, operationId, includeInviteLinks = true) {
 	const rows = store.db.prepare(`SELECT o.operation_id, o.state, o.person_id, o.teammate_name,
 			o.recipient_actor_id, o.recipient_display_name, o.recipient_device_id,
@@ -7529,6 +8358,10 @@ function errorStatus(error) {
 function projectInviteOwnerErrorResponse(error, fallback) {
 	const message = error instanceof Error ? error.message : "";
 	const status = errorStatus(error);
+	if (isPendingCaptureActorConflict(error) && (status == null || status === 409)) return {
+		code: message,
+		status: 409
+	};
 	if (message === "operation_not_found" && (status == null || status === 404)) return {
 		code: message,
 		status: 404
@@ -8003,6 +8836,14 @@ function unauthorizedPayload() {
 	return { error: "unauthorized" };
 }
 var SYNC_AUTH_STORE_BUSY_REASON = "sync_auth_store_busy";
+function authenticatedSyncPeer(deviceId, publicKey) {
+	return {
+		ok: true,
+		reason: "ok",
+		deviceId,
+		authenticatedPeerSigningKey: publicKey
+	};
+}
 var DIRECT_PEER_SIGNATURE_VERSION_NUMBER = 3;
 function logDirectPeerAuthDiagnostic(...reasons) {
 	const reason = reasons.find((candidate) => candidate === "recipient_mismatch" || candidate === "signature_downgrade");
@@ -8173,11 +9014,39 @@ function authorizeSyncRequest(store, request, body) {
 		const versionResult = recordDirectPeerSignatureVersion(store, deviceId, verification.version);
 		if (versionResult) return versionResult;
 	}
-	return {
-		ok: true,
-		reason: "ok",
-		deviceId
-	};
+	return authenticatedSyncPeer(deviceId, publicKey);
+}
+function bootstrapPayloadRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function bootstrapPayloadText(value) {
+	return typeof value === "string" && value.length > 0 && !value.includes("\0");
+}
+function bootstrapNullableText(value) {
+	return value === null || typeof value === "string";
+}
+function validBootstrapEnrollment(value) {
+	if (!bootstrapPayloadRecord(value)) return false;
+	return bootstrapPayloadText(value.group_id) && bootstrapPayloadText(value.device_id) && bootstrapPayloadText(value.public_key) && bootstrapPayloadText(value.fingerprint) && bootstrapNullableText(value.identity_id) && bootstrapNullableText(value.display_name) && value.enabled === 1 && bootstrapPayloadText(value.created_at) && fingerprintPublicKey(value.public_key) === value.fingerprint;
+}
+function validBootstrapVerification(value, grantId) {
+	if (!bootstrapPayloadRecord(value) || value.authorization_version !== 1) return false;
+	const grant = value.grant;
+	if (!bootstrapPayloadRecord(grant)) return false;
+	if (grant.grant_id !== grantId || !bootstrapPayloadText(grant.group_id) || !bootstrapPayloadText(grant.seed_device_id) || !bootstrapPayloadText(grant.worker_device_id) || !bootstrapPayloadText(grant.created_at) || !bootstrapNullableText(grant.created_by) || grant.revoked_at !== null || !Number.isFinite(parseBootstrapExpiry(grant.expires_at))) return false;
+	const seed = value.seed_enrollment;
+	const worker = value.worker_enrollment;
+	if (!validBootstrapEnrollment(seed) || !validBootstrapEnrollment(worker)) return false;
+	return seed.device_id === grant.seed_device_id && worker.device_id === grant.worker_device_id && seed.group_id === grant.group_id && worker.group_id === grant.group_id;
+}
+function bootstrapSeedMatchesLocalIdentity(store, seed) {
+	try {
+		const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const publicKey = loadPublicKey(syncKeysDir());
+		return deviceId === seed.device_id && publicKey === seed.public_key && fingerprint === seed.fingerprint && publicKey !== null && fingerprintPublicKey(publicKey) === seed.fingerprint;
+	} catch {
+		return false;
+	}
 }
 async function authorizeBootstrapGrantRequest(store, request, body) {
 	const grantId = (request.header("X-Codemem-Bootstrap-Grant") ?? "").trim();
@@ -8196,9 +9065,10 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_coordinator_not_configured",
 		deviceId
 	};
-	const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	let localDeviceId;
 	let verification;
 	try {
+		[localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 		let payload = null;
 		if (config.syncCoordinatorAdminSecret) {
 			const [status, adminPayload] = await requestJson("GET", `${buildBaseUrl(config.syncCoordinatorUrl)}/v1/admin/bootstrap-grants/${encodeURIComponent(grantId)}`, {
@@ -8229,6 +9099,11 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 			reason: "bootstrap_grant_lookup_failed",
 			deviceId
 		};
+		if (!validBootstrapVerification(payload, grantId)) return {
+			ok: false,
+			reason: "bootstrap_grant_invalid_payload",
+			deviceId
+		};
 		verification = payload;
 	} catch {
 		return {
@@ -8238,44 +9113,15 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		};
 	}
 	const grant = verification.grant;
+	const seedEnrollment = verification.seed_enrollment;
 	const workerEnrollment = verification.worker_enrollment;
-	if (!grant || !workerEnrollment) return {
-		ok: false,
-		reason: "bootstrap_grant_invalid_payload",
-		deviceId
-	};
-	if (config.syncCoordinatorGroups.length > 0 && !config.syncCoordinatorGroups.includes(String(grant.group_id))) return {
+	if (config.syncCoordinatorGroups.length > 0 && !config.syncCoordinatorGroups.includes(grant.group_id)) return {
 		ok: false,
 		reason: "bootstrap_grant_group_mismatch",
 		deviceId
 	};
-	if (grant.revoked_at) return {
-		ok: false,
-		reason: "bootstrap_grant_revoked",
-		deviceId
-	};
-	if (String(workerEnrollment.device_id) !== String(grant.worker_device_id)) return {
-		ok: false,
-		reason: "bootstrap_grant_worker_enrollment_mismatch",
-		deviceId
-	};
-	if (String(workerEnrollment.group_id) !== String(grant.group_id)) return {
-		ok: false,
-		reason: "bootstrap_grant_group_mismatch",
-		deviceId
-	};
-	if (Number(workerEnrollment.enabled) !== 1) return {
-		ok: false,
-		reason: "bootstrap_grant_worker_disabled",
-		deviceId
-	};
-	const workerPublicKey = String(workerEnrollment.public_key ?? "").trim();
-	const workerFingerprint = String(workerEnrollment.fingerprint ?? "").trim();
-	if (!workerPublicKey || fingerprintPublicKey(workerPublicKey) !== workerFingerprint) return {
-		ok: false,
-		reason: "bootstrap_grant_worker_identity_invalid",
-		deviceId
-	};
+	const workerPublicKey = workerEnrollment.public_key;
+	const workerFingerprint = workerEnrollment.fingerprint;
 	if (grant.worker_device_id !== deviceId) return {
 		ok: false,
 		reason: "bootstrap_grant_worker_mismatch",
@@ -8286,11 +9132,16 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_seed_mismatch",
 		deviceId
 	};
-	if (new Date(grant.expires_at) <= /* @__PURE__ */ new Date()) return {
+	if (parseBootstrapExpiry(grant.expires_at) <= Date.now()) return {
 		ok: false,
 		reason: "bootstrap_grant_expired",
 		deviceId
 	};
+	if (!bootstrapSeedMatchesLocalIdentity(store, seedEnrollment)) return {
+		ok: false,
+		reason: "bootstrap_grant_seed_identity_invalid",
+		deviceId
+	};
 	const existingPeer = store.db.prepare(`SELECT highest_observed_direct_signature_version
 			 FROM sync_peer_signature_state WHERE peer_device_id = ? LIMIT 1`).get(deviceId);
 	let signatureVerification;
@@ -8321,7 +9172,7 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
 	if (nonceResult) return nonceResult;
 	updatePeerAddresses(store.db, deviceId, [], {
-		name: String(workerEnrollment.display_name ?? "").trim() || void 0,
+		name: workerEnrollment.display_name?.trim() || void 0,
 		pinnedFingerprint: workerFingerprint,
 		publicKey: workerPublicKey,
 		replaceTrust: true
@@ -8330,11 +9181,7 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		const versionResult = recordDirectPeerSignatureVersion(store, deviceId, signatureVerification.version);
 		if (versionResult) return versionResult;
 	}
-	return {
-		ok: true,
-		reason: "ok",
-		deviceId
-	};
+	return authenticatedSyncPeer(deviceId, workerPublicKey);
 }
 function parseJsonList(value) {
 	if (value == null) return [];
@@ -8409,7 +9256,23 @@ function peerAuthorizedScopes(store, peerDeviceId) {
 		updated_at: cleanPeerScopeText(row.updated_at)
 	}));
 }
+function isPendingCaptureActorConflict(error) {
+	return error instanceof Error && error.constructor === Error && error.message === "device_adoption_actor_conflict";
+}
+/** False leaves the conflict untouched; callers must check before claiming or merging identity. */
 function ensureLocalActorRecord(store) {
+	return store.db.transaction(() => {
+		try {
+			store.assertPendingLocalCaptureAdoptionActors();
+		} catch (error) {
+			if (isPendingCaptureActorConflict(error)) return false;
+			throw error;
+		}
+		persistLocalActorRecord(store);
+		return true;
+	}).immediate();
+}
+function persistLocalActorRecord(store) {
 	const d = drizzle(store.db, { schema });
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	d.update(schema.actors).set({
@@ -8437,7 +9300,16 @@ function ensureLocalActorRecord(store) {
 		updated_at: now
 	}).run();
 }
+function requireLocalActorRecord(store) {
+	if (!ensureLocalActorRecord(store)) throw new Error("device_adoption_actor_conflict");
+}
 function ensureStableStoreIdentity(store) {
+	const deviceId = ensureStableStoreDeviceIdentity(store);
+	requireLocalActorRecord(store);
+	return deviceId;
+}
+/** Preserve normal actor setup for reads, without repairing a pending conflict. */
+function ensureStableStoreIdentityForRead(store) {
 	const deviceId = ensureStableStoreDeviceIdentity(store);
 	ensureLocalActorRecord(store);
 	return deviceId;
@@ -8749,7 +9621,7 @@ function missingArchivedCoordinatorGroupResponse(groupId, status, groups) {
 * When showDiag is false, sensitive fields (fingerprint, last_error, addresses)
 * are redacted.
 */
-function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, localDeviceId) {
+function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, localDeviceId, loadDiagnosticKey) {
 	const peerId = String(row.peer_device_id ?? "");
 	const recentOps = recentOpsByPeer?.get(peerId) ?? {
 		in: 0,
@@ -8759,7 +9631,8 @@ function mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer
 	const addresses = safeJsonList(row.addresses_json);
 	const perScopeSync = listPerPeerScopeSyncState(store.db, {
 		localDeviceId: localDeviceId ?? null,
-		peerDeviceId: peerId
+		peerDeviceId: peerId,
+		...peerScopeDiagnosticKeys(store, row, localDeviceId, loadDiagnosticKey)
 	});
 	return {
 		peer_device_id: row.peer_device_id,
@@ -8821,6 +9694,16 @@ function recentScopeRejectionsByPeer(store) {
 	}
 	return map;
 }
+function staleRowsForCleanupDiagnostics(store, localDeviceId) {
+	return diagnoseStalePeerReceivedRows(store.db, {
+		localDeviceId,
+		keysDir: syncKeysDir(),
+		maxRows: CLEANUP_DIAGNOSTICS_MAX_ROWS
+	});
+}
+function applyInboundSyncOps(store, ops, localDeviceId) {
+	return applyReplicationOps(store.db, ops, localDeviceId, store.scanner, { keysDir: syncKeysDir() });
+}
 function cleanupDiagnostics(store, localDeviceId, showDiag) {
 	const opRows = store.db.prepare(`SELECT
 				SUM(CASE WHEN device_id = ? THEN 1 ELSE 0 END) AS source_authored,
@@ -8828,10 +9711,7 @@ function cleanupDiagnostics(store, localDeviceId, showDiag) {
 				MAX(created_at) AS latest_at
 			 FROM replication_ops
 			 WHERE op_type = ?`).get(localDeviceId ?? "", localDeviceId ?? "", ACCESS_CLEANUP_OP_TYPE);
-	const stale = localDeviceId && showDiag ? diagnoseStalePeerReceivedRows(store.db, {
-		localDeviceId,
-		maxRows: CLEANUP_DIAGNOSTICS_MAX_ROWS
-	}) : {
+	const stale = localDeviceId && showDiag ? staleRowsForCleanupDiagnostics(store, localDeviceId) : {
 		ambiguous: [],
 		checked: 0,
 		retained: 0,
@@ -9114,8 +9994,8 @@ function forgetProjectInventoryLocalMemories(store, input) {
 	};
 	if (input.confirmationToken !== confirmationToken) throw new Error("project memories changed before cleanup; refresh and try again");
 	store.db.transaction(() => {
-		for (const row of localRows) store.forget(row.id);
-	})();
+		for (const row of localRows) if (!store.forgetForUser(row.id)) throw new Error("unauthorized_scope");
+	}).immediate();
 	return {
 		confirmed: true,
 		forgotten_memory_count: localRows.length,
@@ -9132,7 +10012,7 @@ function assertLocalDeviceScopeMembership(store, scopeId) {
 			   AND sm.status = 'active'
 			   AND rs.status = 'active'
 			   AND sm.membership_epoch >= rs.membership_epoch
-			 LIMIT 1`).get(scopeId, store.deviceId)) throw new Error(`local device is not a member of Sharing domain ${scopeId}`);
+			 LIMIT 1`).get(scopeId, store.deviceId) || !store.isScopeWritable(scopeId)) throw new Error(`local device is not a member of Sharing domain ${scopeId}`);
 }
 function legacySharedReviewRowsForWorkspace(store, workspaceIdentity) {
 	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
@@ -9195,18 +10075,19 @@ function legacySharedReviewReassignmentPreview(store, input) {
 	};
 }
 function reassignLegacySharedReviewGroup(store, input) {
-	const preview = legacySharedReviewReassignmentPreview(store, input);
-	if (input.confirmationToken !== preview.confirmation_token) throw new Error("legacy shared review group changed before reassignment; refresh and try again");
-	const rows = reassignableLegacySharedReviewRows(store, legacySharedReviewRowsForWorkspace(store, input.workspaceIdentity));
-	store.db.transaction(() => {
+	return store.db.transaction(() => {
+		const preview = legacySharedReviewReassignmentPreview(store, input);
+		if (input.confirmationToken !== preview.confirmation_token) throw new Error("legacy shared review group changed before reassignment; refresh and try again");
+		const rows = reassignableLegacySharedReviewRows(store, legacySharedReviewRowsForWorkspace(store, input.workspaceIdentity));
+		assertLocalDeviceScopeMembership(store, input.scopeId);
 		for (const row of rows) store.reassignMemoryScope(row.id, input.scopeId);
-	})();
-	return {
-		ok: true,
-		...preview,
-		reassigned_memory_count: rows.length,
-		legacy_shared_review: legacySharedReviewSummary(store)
-	};
+		return {
+			ok: true,
+			...preview,
+			reassigned_memory_count: rows.length,
+			legacy_shared_review: legacySharedReviewSummary(store)
+		};
+	}).immediate();
 }
 var SYNC_DIRECTION_WINDOW_SECONDS = 86400;
 function recentPeerOps(store) {
@@ -9281,7 +10162,7 @@ function readViewerBinding(dbPath) {
 	return null;
 }
 var PEERS_QUERY = `
-	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.addresses_json,
+	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.public_key, p.addresses_json,
 	       p.last_seen_at, p.last_sync_at, p.last_error,
 	       p.runtime_version, p.runtime_version_observed_at,
 	       p.projects_include_json, p.projects_exclude_json, p.claimed_local_actor,
@@ -9318,15 +10199,116 @@ function negotiatedSyncCapability(c) {
 * network-accessible. All requests are auth-gated via signature
 * verification so unauthenticated callers are rejected.
 */
-function serveAuthorizedSnapshot(c, store, peerDeviceId) {
+function syncScopeAuthorizationContext(store, auth, localDeviceId) {
+	return {
+		db: store.db,
+		localDeviceId,
+		peerDeviceId: auth.deviceId,
+		localSigningPublicKey: loadPublicKey(syncKeysDir()),
+		authenticatedPeerSigningKey: auth.authenticatedPeerSigningKey
+	};
+}
+function peerScopeDiagnosticKeys(store, row, localDeviceId, loadDiagnosticKey) {
+	return {
+		localSigningPublicKey: loadDiagnosticKey?.(store, localDeviceId) ?? null,
+		authenticatedPeerSigningKey: typeof row.public_key === "string" ? row.public_key : null
+	};
+}
+function createPeerScopeDiagnosticKeyLoader() {
+	let publicKey;
+	return (store, localDeviceId) => {
+		if (publicKey !== void 0) return publicKey;
+		publicKey = null;
+		if (!localDeviceId) return null;
+		if (!store.db.prepare(`SELECT 1 FROM scope_memberships m
+			 JOIN replication_scopes s ON s.scope_id = m.scope_id
+			 WHERE m.device_id = ? AND m.status = 'active'
+			 AND s.authority_type = 'coordinator' LIMIT 1`).get(localDeviceId)) return null;
+		publicKey = loadRuntimeSigningPublicKey(store.db, {
+			deviceId: localDeviceId,
+			keysDir: syncKeysDir()
+		});
+		return publicKey;
+	};
+}
+function readPeerScopeDiagnostics(store, showDiag) {
+	const rows = store.db.prepare(PEERS_QUERY).all();
+	const recentOpsByPeer = recentPeerOps(store);
+	const scopeRejectionsByPeer = recentScopeRejectionsByPeer(store);
+	const localDeviceId = drizzle(store.db, { schema }).select({ device_id: schema.syncDevice.device_id }).from(schema.syncDevice).limit(1).get()?.device_id ?? null;
+	const loadDiagnosticKey = createPeerScopeDiagnosticKeyLoader();
+	return rows.map((row) => mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, localDeviceId, loadDiagnosticKey));
+}
+function validateManagedScopes(scopeIds, context) {
+	for (const scopeId of scopeIds) {
+		if (!scopeId || scopeId === LOCAL_DEFAULT_SCOPE_ID) continue;
+		const localAuthorization = getEffectiveCachedScopeAuthorization(context.db, {
+			deviceId: context.localDeviceId,
+			scopeId,
+			expectedPublicKey: context.localSigningPublicKey?.trim() ?? ""
+		});
+		const authority = localAuthorization.scope?.authority_type;
+		if (authority === "manual" || authority === "invite" || authority === "local") continue;
+		if (authority !== "coordinator") return {
+			scopeId,
+			reason: "missing_scope"
+		};
+		const localReason = scopeAuthorizationFailureReason(localAuthorization);
+		if (localReason) return {
+			scopeId,
+			reason: localReason
+		};
+		const peerAuthorization = getEffectiveCachedScopeAuthorization(context.db, {
+			deviceId: context.peerDeviceId,
+			scopeId,
+			expectedPublicKey: context.authenticatedPeerSigningKey.trim()
+		});
+		const peerReason = scopeAuthorizationFailureReason(peerAuthorization);
+		if (peerReason) return {
+			scopeId,
+			reason: peerReason
+		};
+	}
+	return null;
+}
+function addExistingMutationScopes(db, ops, scopeIds) {
+	const existingScopes = db.prepare("SELECT DISTINCT scope_id FROM memory_items WHERE import_key = ?");
+	for (const op of ops) {
+		if (![
+			"upsert",
+			"delete",
+			"reassign_scope"
+		].includes(op.op_type)) continue;
+		const rows = existingScopes.all(op.entity_id);
+		for (const { scope_id: scope } of rows) if (typeof scope === "string" && scope.trim()) scopeIds.add(scope.trim());
+	}
+}
+function rejectUnauthorizedInboundBatch(c, ops, context, options) {
+	const rejected = rejectInboundScopeFailures(context.db, ops, context.localDeviceId, {
+		enabled: options.enabled,
+		peerDeviceId: context.peerDeviceId
+	});
+	if (rejected) return c.json({
+		error: "scope_rejected",
+		reason: rejected.rejections[0]?.reason ?? "scope_mismatch",
+		rejections: rejected.rejections,
+		sync_capability: LOCAL_SYNC_CAPABILITY,
+		scope_id: options.scopeId
+	}, 403);
+	const scopeIds = new Set(options.managedScopeIds);
+	addExistingMutationScopes(context.db, ops, scopeIds);
+	const failure = validateManagedScopes(scopeIds, context);
+	if (!failure) return null;
+	return c.json(syncScopeResetRequiredPayload(getSyncResetState(context.db), failure.reason, LOCAL_SYNC_CAPABILITY, failure.scopeId), 409);
+}
+function serveAuthorizedSnapshot(c, store, auth) {
+	const peerDeviceId = auth.deviceId;
 	try {
 		const rawScopeId = c.req.query(SYNC_SCOPE_QUERY_PARAM);
 		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 		const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
-			db: store.db,
-			localDeviceId,
-			negotiatedCapability: negotiatedSyncCapability(c),
-			peerDeviceId
+			...syncScopeAuthorizationContext(store, auth, localDeviceId),
+			negotiatedCapability: negotiatedSyncCapability(c)
 		});
 		if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
 		const pageRequest = snapshotPageRequest((name) => c.req.query(name), localDeviceId);
@@ -9407,10 +10389,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 				const [deviceId, fingerprint] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 				const syncReset = getSyncResetState(store.db);
 				const negotiated = negotiatedSyncCapability(c);
-				const authorizedScopes = isScopedSyncCapability(negotiated) ? listAuthorizedScopesForPeer(store.db, {
-					localDeviceId: deviceId,
-					peerDeviceId: auth.deviceId
-				}) : null;
+				const authorizedScopes = isScopedSyncCapability(negotiated) ? listAuthorizedScopesForPeer(store.db, { ...syncScopeAuthorizationContext(store, auth, deviceId) }) : null;
 				const response = {
 					device_id: deviceId,
 					protocol_version: SYNC_PROTOCOL_VERSION,
@@ -9443,10 +10422,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			const negotiated = negotiatedSyncCapability(c);
 			const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
 			const scopeRequest = parseSyncScopeRequest(rawScopeId, rawScopeId !== void 0, {
-				db: store.db,
-				localDeviceId,
-				negotiatedCapability: negotiated,
-				peerDeviceId
+				...syncScopeAuthorizationContext(store, auth, localDeviceId),
+				negotiatedCapability: negotiated
 			});
 			if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
 			const since = c.req.query("since") ?? null;
@@ -9520,7 +10497,7 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
-			return serveAuthorizedSnapshot(c, store, auth.deviceId);
+			return serveAuthorizedSnapshot(c, store, auth);
 		})();
 	});
 	app.post("/v1/ops", async (c) => {
@@ -9546,21 +10523,25 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		}
 		const negotiated = negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(body.sync_capability));
 		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const scopeContext = syncScopeAuthorizationContext(store, auth, localDeviceId);
 		const scopeRequest = parseSyncScopeRequest(body.scope_id, Object.hasOwn(body, "scope_id"), {
-			db: store.db,
-			localDeviceId,
-			negotiatedCapability: negotiated,
-			peerDeviceId
+			...scopeContext,
+			negotiatedCapability: negotiated
 		});
 		if (!scopeRequest.ok) return c.json(syncScopeResetRequiredPayload(getSyncResetState(store.db), scopeRequest.reason, LOCAL_SYNC_CAPABILITY, null), 409);
 		if (!Array.isArray(body.ops)) return c.json({ error: "invalid_ops" }, 400);
 		if (body.ops.length > MAX_SYNC_OPS) return c.json({ error: "too_many_ops" }, 413);
 		const normalizedOps = extractReplicationOps(body);
+		const scopeIds = new Set(normalizedOps.map((op) => typeof op.scope_id === "string" ? op.scope_id.trim() : ""));
 		const peerFeatures = normalizeSyncFeatures(body.sync_features);
 		const reassignOps = normalizedOps.filter((op) => op.op_type === "reassign_scope");
 		if (reassignOps.length > 0 && !peerFeatures.includes("reassign_scope")) return c.json({ error: "reassign_capability_required" }, 409);
 		try {
-			for (const op of reassignOps) parseReassignScopePayload(op);
+			for (const op of reassignOps) {
+				const reassignment = parseReassignScopePayload(op);
+				scopeIds.add(reassignment.old_scope_id);
+				scopeIds.add(reassignment.new_scope_id);
+			}
 		} catch {
 			return c.json({ error: "reassign_payload_invalid" }, 400);
 		}
@@ -9573,18 +10554,13 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			applyScopeFilter: false,
 			supportsReassignScope: peerFeatures.includes("reassign_scope")
 		});
-		const rejected = rejectInboundScopeFailures(store.db, normalizedOps, localDeviceId, {
+		const rejected = rejectUnauthorizedInboundBatch(c, normalizedOps, scopeContext, {
 			enabled: negotiated !== "unsupported",
-			peerDeviceId
+			scopeId: scopeRequest.scope_id,
+			managedScopeIds: scopeIds
 		});
-		if (rejected) return c.json({
-			error: "scope_rejected",
-			reason: rejected.rejections[0]?.reason ?? "scope_mismatch",
-			rejections: rejected.rejections,
-			sync_capability: LOCAL_SYNC_CAPABILITY,
-			scope_id: scopeRequest.scope_id
-		}, 403);
-		const result = applyReplicationOps(store.db, filtered.allowed, localDeviceId, store.scanner);
+		if (rejected) return rejected;
+		const result = applyInboundSyncOps(store, filtered.allowed, localDeviceId);
 		const skipped = result.skipped + filtered.skipped;
 		return c.json({
 			...result,
@@ -9785,10 +10761,15 @@ function wakeRecipientPolicyProjects(store, projectIdentities, now) {
 	wakeRecipientPoliciesForProjectIdentities(store.db, [...new Set(projectIdentities)], now);
 }
 function saveProjectMappingsAndWakePolicies(store, deviceId, mappingInputs) {
+	store.adoptEnsuredDeviceIdentity(deviceId);
 	return store.db.transaction(() => {
 		const before = policyWakeMappings(store);
 		const previousMappings = existingRequestedMappings(before, mappingInputs);
-		const mappings = upsertProjectScopeSettingsMappings(store.db, mappingInputs, { deviceId });
+		const writableScopeIds = new Set(resolveVisibleScopeIds(store.db, store.deviceId, store.scopeResolutionDeviceContext()));
+		const mappings = upsertProjectScopeSettingsMappings(store.db, mappingInputs, {
+			deviceId,
+			canWriteScope: (scopeId) => writableScopeIds.has(scopeId ?? "")
+		});
 		const after = policyWakeMappings(store);
 		const changedScopeIds = /* @__PURE__ */ new Set([...previousMappings.map((mapping) => mapping.scope_id), ...mappings.map((mapping) => mapping.scope_id)]);
 		wakeRecipientPolicyProjects(store, [...mappedProjectsInScopes(before, changedScopeIds), ...mappedProjectsInScopes(after, changedScopeIds)], (/* @__PURE__ */ new Date()).toISOString());
@@ -9796,12 +10777,14 @@ function saveProjectMappingsAndWakePolicies(store, deviceId, mappingInputs) {
 	}).immediate();
 }
 function deleteProjectMappingAndWakePolicies(store, mappingId, deviceId, confirmedGuardrailTokens) {
+	store.adoptEnsuredDeviceIdentity(deviceId);
 	return store.db.transaction(() => {
 		const before = policyWakeMappings(store);
 		const removed = before.find((mapping) => mapping.id === mappingId);
 		const deleted = deleteProjectScopeSettingsMapping(store.db, mappingId, {
 			deviceId,
-			confirmedGuardrailTokens
+			confirmedGuardrailTokens,
+			canWriteScope: (scopeId) => store.isScopeWritable(scopeId)
 		});
 		if (deleted && removed) {
 			const changedScopeIds = /* @__PURE__ */ new Set([removed.scope_id]);
@@ -9817,8 +10800,125 @@ function deleteProjectMappingAndWakePolicies(store, mappingId, deviceId, confirm
 * provide sync status, peer management, and coordinator UI for the
 * local viewer.
 */
+function reassignProjectInventoryForUser(store, input) {
+	store.adoptEnsuredDeviceIdentity(input.deviceId);
+	return reassignProjectScopeInventoryProject(store.db, {
+		...input,
+		canWriteScope: (scopeId) => store.isScopeWritable(scopeId)
+	});
+}
+function pendingCaptureActorMutationFailure(store) {
+	try {
+		store.assertPendingLocalCaptureAdoptionActors();
+		return null;
+	} catch (error) {
+		if (isPendingCaptureActorConflict(error)) return {
+			error: error.message,
+			status: 409
+		};
+		throw error;
+	}
+}
+function runViewerActorMutation(store, mutate) {
+	return store.db.transaction(() => pendingCaptureActorMutationFailure(store) ?? mutate()).immediate();
+}
+function actorMergeDigest(primaryActorId, secondaryActorId) {
+	return createHash("sha256").update(JSON.stringify({
+		kind: "identity-merge-v1",
+		primaryActorId,
+		secondaryActorId,
+		nonce: randomUUID()
+	})).digest("hex");
+}
+function actorMergePrincipalFailure(store, primary, secondary) {
+	if (primary.status !== "active") return {
+		error: "primary actor not active",
+		status: 409
+	};
+	if (secondary.status !== "active") return {
+		error: "secondary actor not active",
+		status: 409
+	};
+	if (secondary.is_local && secondary.actor_id === store.actorId) return {
+		error: "cannot merge this device's own local actor",
+		status: 409
+	};
+	return null;
+}
+function resolvePeerIdentityAssignment(store, opts) {
+	const requestedActorId = opts.body.actor_id == null ? void 0 : String(opts.body.actor_id ?? "").trim() || null;
+	const claimedLocalActor = typeof opts.body.claimed_local_actor === "boolean" ? opts.body.claimed_local_actor : void 0;
+	let nextActorId = opts.actorId;
+	let nextClaimedLocalActor = opts.claimedLocalActor;
+	if (requestedActorId !== void 0) {
+		nextActorId = requestedActorId;
+		if (requestedActorId) {
+			const actor = drizzle(store.db, { schema }).select({
+				actor_id: schema.actors.actor_id,
+				is_local: schema.actors.is_local,
+				status: schema.actors.status
+			}).from(schema.actors).where(eq(schema.actors.actor_id, requestedActorId)).get();
+			if (!actor) return {
+				error: "actor not found",
+				status: 404
+			};
+			if (actor.status !== "active") return {
+				error: "actor not active",
+				status: 409
+			};
+			nextClaimedLocalActor = claimedLocalActor ?? Boolean(actor.is_local);
+		} else nextClaimedLocalActor = claimedLocalActor ?? false;
+	} else if (claimedLocalActor !== void 0) {
+		nextClaimedLocalActor = claimedLocalActor;
+		if (claimedLocalActor) nextActorId = store.actorId;
+		else if (nextActorId === store.actorId) nextActorId = null;
+	}
+	return {
+		actor_id: nextActorId,
+		claimed_local_actor: nextClaimedLocalActor
+	};
+}
+function persistPeerIdentityMutation(store, body) {
+	const peerDeviceId = String(body.peer_device_id ?? "").trim();
+	if (!peerDeviceId) return {
+		error: "peer_device_id required",
+		status: 400
+	};
+	const d = drizzle(store.db, { schema });
+	const peer = d.select({
+		peer_device_id: schema.syncPeers.peer_device_id,
+		actor_id: schema.syncPeers.actor_id,
+		claimed_local_actor: schema.syncPeers.claimed_local_actor
+	}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get();
+	if (!peer) return {
+		error: "peer not found",
+		status: 404
+	};
+	const assignment = resolvePeerIdentityAssignment(store, {
+		body,
+		actorId: peer.actor_id ?? null,
+		claimedLocalActor: Boolean(peer.claimed_local_actor)
+	});
+	if ("error" in assignment) return assignment;
+	d.update(schema.syncPeers).set({
+		actor_id: assignment.actor_id,
+		claimed_local_actor: assignment.claimed_local_actor ? 1 : 0
+	}).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).run();
+	return assignment;
+}
+function createActorMutationPreflightRoutes(getStore) {
+	const app = new Hono();
+	const preflight = async (c, next) => {
+		if (!ensureLocalActorRecord(getStore())) return c.json({ error: "device_adoption_actor_conflict" }, 409);
+		await next();
+	};
+	app.post("/api/sync/peers/identity", preflight);
+	app.post("/api/sync/actors/merge", preflight);
+	return app;
+}
 function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
-	const app = new Hono().post("/api/sync/invites/inspect", inspectPairingInvite);
+	const app = createActorMutationPreflightRoutes(getStore);
+	app.post("/api/sync/invites/inspect", inspectPairingInvite);
 	const readCoordinatorConfig = options.readCoordinatorConfig ?? readCoordinatorSyncConfig;
 	const renameCoordinatorGroup = options.renameCoordinatorGroup ?? coordinatorRenameGroupAction;
 	const loadCoordinatorEvidence = options.loadDeviceIdentityCoordinatorEvidence ?? loadConfiguredDeviceIdentityCoordinatorEvidence;
@@ -9852,7 +10952,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	};
 	app.get("/api/sync/recipient-policy/v1/device-inventory", async (c) => {
 		const store = getStore();
-		ensureStableStoreIdentity(store);
+		ensureStableStoreIdentityForRead(store);
 		return c.json(listDeviceIdentityInventory(store.db, await localInventoryInput(store)));
 	});
 	app.patch("/api/sync/recipient-policy/v1/teams/:teamId", async (c) => {
@@ -9944,7 +11044,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (!body) return c.json({ error: "binding_request_invalid" }, 400);
 		const store = getStore();
 		try {
-			ensureStableStoreIdentity(store);
+			ensureStableStoreIdentityForRead(store);
 			const result = previewDeviceIdentityBindings(store.db, await localInventoryInput(store), body);
 			if (result.status === "invalid") return c.json(result, 400);
 			if (result.status === "not_found") return c.json(result, 404);
@@ -9985,6 +11085,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		}
 	});
 	app.get("/api/sync/status", async (c) => {
+		const loadDiagnosticKey = createPeerScopeDiagnosticKeyLoader();
 		const response = await buildSyncStatusResponse({
 			store: getStore(),
 			showDiagnostics: queryBool(c.req.query("includeDiagnostics")),
@@ -9996,7 +11097,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				isRecentIso,
 				legacySharedReviewSummary,
 				listRecipientPolicyReconciliationStatus,
-				mapPeerRow,
+				mapPeerRow: (...args) => mapPeerRow(...args, loadDiagnosticKey),
 				mapSyncAttemptRow,
 				peerStatus,
 				readViewerBinding,
@@ -10013,11 +11114,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const store = getStore();
 		{
 			const showDiag = queryBool(c.req.query("includeDiagnostics"));
-			const rows = store.db.prepare(PEERS_QUERY).all();
-			const recentOpsByPeer = recentPeerOps(store);
-			const scopeRejectionsByPeer = recentScopeRejectionsByPeer(store);
-			const localDeviceId = drizzle(store.db, { schema }).select({ device_id: schema.syncDevice.device_id }).from(schema.syncDevice).limit(1).get()?.device_id ?? null;
-			const peers = rows.map((row) => mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, localDeviceId));
+			const peers = readPeerScopeDiagnostics(store, showDiag);
 			return c.json({
 				items: peers,
 				redacted: !showDiag
@@ -10407,7 +11504,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		const body = await parseViewerJsonBody(c);
 		const request = parseReviewRequest(body);
 		if (!request) return c.json({ error: "request_invalid" }, 400);
-		ensureLocalActorRecord(store);
+		requireLocalActorRecord(store);
 		const result = resolveRecipientPolicyReview(store.db, {
 			localActorId: store.actorId,
 			localDeviceId: store.deviceId
@@ -10423,7 +11520,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (!body || !Array.isArray(body.requests) || body.requests.length === 0 || body.requests.length > 100) return c.json({ error: "request_invalid" }, 400);
 		const requests = body.requests.map(parseReviewRequest);
 		if (requests.some((request) => request == null)) return c.json({ error: "request_invalid" }, 400);
-		ensureLocalActorRecord(store);
+		requireLocalActorRecord(store);
 		const result = resolveRecipientPolicyReviewBulk(store.db, {
 			localActorId: store.actorId,
 			localDeviceId: store.deviceId
@@ -10453,7 +11550,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			const workspaceIdentity = optionalViewerStrictString(body, "workspace_identity") ?? "";
 			const project = optionalViewerStrictString(body, "project") ?? "";
 			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-			const result = reassignProjectScopeInventoryProject(store.db, {
+			const result = reassignProjectInventoryForUser(store, {
 				deviceId,
 				project,
 				workspaceIdentity
@@ -10758,51 +11855,17 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	app.delete("/api/sync/sharing-domains/project-mappings/:id", (c) => deleteProjectScopeMappingRoute(c, getStore()));
 	app.post("/api/sync/peers/identity", async (c) => {
 		const store = getStore();
-		ensureLocalActorRecord(store);
 		let body;
 		try {
 			body = await c.req.json();
 		} catch {
 			return c.json({ error: "invalid json" }, 400);
 		}
-		const peerDeviceId = String(body.peer_device_id ?? "").trim();
-		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
-		const requestedActorId = body.actor_id == null ? void 0 : String(body.actor_id ?? "").trim() || null;
-		const claimedLocalActor = typeof body.claimed_local_actor === "boolean" ? body.claimed_local_actor : void 0;
-		const d = drizzle(store.db, { schema });
-		const peer = d.select({
-			peer_device_id: schema.syncPeers.peer_device_id,
-			actor_id: schema.syncPeers.actor_id,
-			claimed_local_actor: schema.syncPeers.claimed_local_actor
-		}).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get();
-		if (!peer) return c.json({ error: "peer not found" }, 404);
-		let nextActorId = peer.actor_id ?? null;
-		let nextClaimedLocalActor = Boolean(peer.claimed_local_actor);
-		if (requestedActorId !== void 0) {
-			nextActorId = requestedActorId;
-			if (requestedActorId) {
-				const actor = d.select({
-					actor_id: schema.actors.actor_id,
-					is_local: schema.actors.is_local,
-					status: schema.actors.status
-				}).from(schema.actors).where(eq(schema.actors.actor_id, requestedActorId)).get();
-				if (!actor) return c.json({ error: "actor not found" }, 404);
-				if (actor.status !== "active") return c.json({ error: "actor not active" }, 409);
-				nextClaimedLocalActor = claimedLocalActor ?? Boolean(actor.is_local);
-			} else nextClaimedLocalActor = claimedLocalActor ?? false;
-		} else if (claimedLocalActor !== void 0) {
-			nextClaimedLocalActor = claimedLocalActor;
-			if (claimedLocalActor) nextActorId = store.actorId;
-			else if (nextActorId === store.actorId) nextActorId = null;
-		}
-		d.update(schema.syncPeers).set({
-			actor_id: nextActorId,
-			claimed_local_actor: nextClaimedLocalActor ? 1 : 0
-		}).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).run();
+		const result = runViewerActorMutation(store, () => persistPeerIdentityMutation(store, body));
+		if ("error" in result) return c.json({ error: result.error }, result.status);
 		return c.json({
 			ok: true,
-			actor_id: nextActorId,
-			claimed_local_actor: nextClaimedLocalActor
+			...result
 		});
 	});
 	app.post("/api/sync/actors", async (c) => {
@@ -10869,7 +11932,6 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	});
 	app.post("/api/sync/actors/merge", async (c) => {
 		const store = getStore();
-		ensureLocalActorRecord(store);
 		let body;
 		try {
 			body = await c.req.json();
@@ -10886,24 +11948,16 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		queueMicrotask(releaseActorMutations);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const result = store.db.transaction(() => {
+			const conflict = pendingCaptureActorMutationFailure(store);
+			if (conflict) return conflict;
 			const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
 			const secondary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, secondaryActorId)).get();
 			if (!primary || !secondary) return {
 				error: "actor not found",
 				status: 404
 			};
-			if (primary.status !== "active") return {
-				error: "primary actor not active",
-				status: 409
-			};
-			if (secondary.status !== "active") return {
-				error: "secondary actor not active",
-				status: 409
-			};
-			if (secondary.is_local && secondary.actor_id === store.actorId) return {
-				error: "cannot merge this device's own local actor",
-				status: 409
-			};
+			const principalFailure = actorMergePrincipalFailure(store, primary, secondary);
+			if (principalFailure) return principalFailure;
 			const memberships = d.select().from(schema.policyTeamMemberships).where(eq(schema.policyTeamMemberships.identity_id, secondaryActorId)).all();
 			const primaryMemberships = /* @__PURE__ */ new Map();
 			for (const membership of memberships) {
@@ -10924,12 +11978,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				};
 				primaryRecipients.set(recipient.canonical_project_identity, primaryRecipient);
 			}
-			const mergeDigest = createHash("sha256").update(JSON.stringify({
-				kind: "identity-merge-v1",
-				primaryActorId,
-				secondaryActorId,
-				nonce: randomUUID()
-			})).digest("hex");
+			const mergeDigest = actorMergeDigest(primaryActorId, secondaryActorId);
 			const bindings = d.select({
 				deviceId: schema.identityDevices.device_id,
 				assignmentVersion: schema.identityDevices.assignment_version
@@ -11146,7 +12195,8 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			if (!payload.operation_id && !recipientInvite) return c.json({ kind: "legacy_team_invite" });
 			const [status, inspected] = await requestJson("POST", `${buildBaseUrl(payload.coordinator_url)}/v1/invites/inspect`, {
 				body: { token: payload.token },
-				timeoutS: 10
+				timeoutS: 10,
+				redirect: "error"
 			});
 			if (status < 200 || status >= 300) return c.json({ error: recipientInvite ? safeRecipientInviteError(inspected?.error) : String(inspected?.error ?? "invite_invalid") }, status === 410 ? 410 : 400);
 			const config = readCodememConfigFile();
@@ -12541,6 +13591,122 @@ function updateStatusRoutes(options = {}) {
 	return app;
 }
 //#endregion
+//#region src/account/context.ts
+function validId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+function label(value) {
+	return validId(value) ? value : void 0;
+}
+function clean(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function configuredGroups(raw) {
+	const value = process.env.CODEMEM_SYNC_COORDINATOR_GROUPS ?? raw.sync_coordinator_groups;
+	if (value === void 0 || value === null || value === "") return [];
+	const values = typeof value === "string" ? value.split(",") : value;
+	if (!Array.isArray(values) || values.some((item) => !validId(clean(item)))) return null;
+	return values.map(clean);
+}
+function readyContext(options, groupId, coordinatorUrl, raw, groups) {
+	const profile = options.getProfile();
+	if (!profile) return "device_unavailable";
+	const before = statSync(profile.dbPath, { bigint: true });
+	const device = readAccountLinkDevice(profile.dbPath);
+	const after = statSync(profile.dbPath, { bigint: true });
+	const override = process.env.CODEMEM_DEVICE_ID?.trim() || void 0;
+	if (!before.isFile() || before.dev !== after.dev || before.ino !== after.ino || device.deviceId !== profile.deviceId || override !== void 0 && override !== device.deviceId) return "device_unavailable";
+	let actor = clean(raw.actor_id);
+	if (Object.hasOwn(process.env, "CODEMEM_ACTOR_ID")) actor = clean(process.env.CODEMEM_ACTOR_ID);
+	actor ||= `local:${device.deviceId}`;
+	if (!validId(actor) || actor !== profile.identityId) return "identity_unavailable";
+	const context = {
+		dbPath: profile.dbPath,
+		keysDir: options.keysDir,
+		configPath: options.configPath,
+		coordinatorUrl,
+		groupId,
+		deviceId: device.deviceId,
+		fingerprint: device.fingerprint,
+		identityId: actor,
+		identityLabel: label(profile.identityLabel),
+		deviceLabel: label(profile.deviceLabel),
+		fileIdentity: {
+			dev: after.dev.toString(),
+			ino: after.ino.toString()
+		}
+	};
+	const contextId = createHash("sha256").update(JSON.stringify({
+		context,
+		groups,
+		actorConfig: clean(raw.actor_id),
+		actorEnv: process.env.CODEMEM_ACTOR_ID,
+		deviceEnv: override,
+		keyStore: process.env.CODEMEM_SYNC_KEY_STORE,
+		home: process.env.HOME
+	})).digest("hex").slice(0, 32);
+	return {
+		...context,
+		contextId
+	};
+}
+function readContext(options, groupId) {
+	const raw = options.readConfig();
+	const config = readCoordinatorSyncConfig(raw);
+	if (!configuredGroups(raw)) return { error: "account_context_unavailable" };
+	const groups = [...new Set(config.syncCoordinatorGroups)];
+	if (groups.length > 25 || groups.some((id) => !validId(id))) return { error: "account_context_unavailable" };
+	if (groupId !== void 0 && !groups.includes(groupId)) return { error: "account_group_not_configured" };
+	const selectedGroupId = groupId ?? (groups.length === 1 ? groups[0] : null) ?? null;
+	const origin = normalizeCoordinatorAccountLinkOrigin(config.syncCoordinatorUrl);
+	const base = {
+		groups,
+		selectedGroupId,
+		coordinator: origin ? { origin } : null,
+		context: null
+	};
+	if (!config.syncCoordinatorUrl || groups.length === 0) return {
+		...base,
+		setup: "coordinator_not_configured"
+	};
+	if (!origin) return {
+		...base,
+		setup: "coordinator_url_invalid"
+	};
+	if (!selectedGroupId) return {
+		...base,
+		setup: "group_selection_required"
+	};
+	let context;
+	try {
+		context = readyContext(options, selectedGroupId, origin, raw, groups);
+	} catch {
+		return {
+			...base,
+			setup: "device_unavailable"
+		};
+	}
+	if (typeof context === "string") return {
+		...base,
+		setup: context
+	};
+	return {
+		...base,
+		setup: "ready",
+		context
+	};
+}
+/** Trusted callbacks describe the running profile, never a browser-selected path. */
+function createAccountContextReader(options) {
+	return (groupId) => {
+		try {
+			return readContext(options, groupId);
+		} catch {
+			return { error: "account_context_unavailable" };
+		}
+	};
+}
+//#endregion
 //#region src/index.ts
 /**
 * @codemem/server — HTTP server (viewer, sync, API).
@@ -12590,6 +13756,21 @@ function registerConfigRoutes(app, opts, sweeper) {
 		getObserverApplyStatus: opts?.getObserverApplyStatus
 	}));
 }
+function registerAccountRoutes(app, options) {
+	if (!options) return;
+	const account = createAccountGuard(options);
+	app.use("*", account.middleware);
+	app.route("/", account.routes);
+	if (options.readContext) app.route("/", accountStatusRoutes({
+		...options,
+		readContext: options.readContext
+	}));
+	if (options.readContext && options.registry) app.route("/", accountOperationRoutes({
+		...options,
+		readContext: options.readContext,
+		registry: options.registry
+	}));
+}
 function createApp(opts) {
 	const storeFactory = opts?.storeFactory ?? getStore;
 	const sweeper = opts?.sweeper ?? null;
@@ -12597,6 +13778,7 @@ function createApp(opts) {
 	const getSyncRuntimeStatus = opts?.getSyncRuntimeStatus ?? (() => null);
 	let invalidateTeamSetupSummary = () => {};
 	const app = new Hono();
+	registerAccountRoutes(app, opts?.accountLink);
 	app.use("*", preflightHandler());
 	app.use("*", originGuard({ unsafeGetPathPrefixes: [TEAM_SETUP_ROUTE_PREFIX] }));
 	const viewerTargetGuard = viewerTargetQueryGuard(storeFactory);
@@ -12608,6 +13790,7 @@ function createApp(opts) {
 	app.route("/", memoryRoutes(storeFactory));
 	app.route("/", memoryToolRoutes(storeFactory));
 	app.route("/", packTransportRoutes(storeFactory));
+	app.route("/", fileContextRoutes(storeFactory));
 	app.route("/", observerStatusRoutes({
 		getStore: storeFactory,
 		getSweeper: () => sweeper,
@@ -12662,6 +13845,6 @@ function createSyncApp(opts) {
 	return app;
 }
 //#endregion
-export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory };
+export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, createAccountContextReader, createAccountLinkRegistry, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory };
 
 //# sourceMappingURL=index.js.map