@cydm/happy-elves 0.1.0-beta.31 → 0.1.0-beta.310

package/apps/relay/dist/http-routes.js

@@ -1,25 +1,9 @@
 import { z } from "zod";
-import { encryptedEnvelopeSchema, pairingCode, randomId, } from "../../../packages/shared/dist/index.js";
-import { controllerDeviceSchema, controllerInviteClaimSchema, controllerInviteCreateSchema, deviceRevokeSchema, pairingClaimSchema, pairingStartSchema, scopedTokenCreateSchema, scopedTokenRevokeSchema, sessionEventsQuerySchema, } from "./http-schemas.js";
+import { controllerSessionCommandDecision, encryptedEnvelopeSchema, pairingCode, randomId, } from "../../../packages/shared/dist/index.js";
+import { controllerDeviceSchema, controllerInviteClaimSchema, controllerInviteCreateSchema, deviceRenameSchema, deviceRevokeSchema, memoryDeleteSchema, memoryListQuerySchema, memorySaveSchema, memorySettingsSchema, machineMemoryDocumentSaveSchema, machineMemoryDocumentsQuerySchema, machineCreateSessionAdmissionSchema, machinePromptAdmissionSchema, pairingClaimSchema, pairingStartSchema, scopedTokenCreateSchema, scopedTokenRevokeSchema, sessionMetadataUpdateSchema, sessionHeadAdvanceSchema, sessionEventsQuerySchema, workspaceCwdPinSchema, workspaceCwdUnpinSchema, workspaceProjectPreferenceSchema, workspaceSessionRecentSchema, workspaceSessionStarSchema, } from "./http-schemas.js";
 import { HttpError } from "./errors.js";
 import { encodePairingCode, isPairingCodeMatch, tokenDigest } from "./security.js";
-const visibleSessionEventWhere = `
-  NOT EXISTS (
-    SELECT 1 FROM session_turn_aliases turn_alias
-    WHERE turn_alias.account_id = session_events.account_id
-      AND turn_alias.session_id = session_events.session_id
-      AND turn_alias.machine_id = session_events.machine_id
-      AND turn_alias.runtime_turn_id = session_events.turn_id
-      AND turn_alias.request_turn_id <> session_events.turn_id
-      AND (
-        SELECT COUNT(*) FROM session_events request_events
-        WHERE request_events.account_id = turn_alias.account_id
-          AND request_events.session_id = turn_alias.session_id
-          AND request_events.machine_id = turn_alias.machine_id
-          AND request_events.turn_id = turn_alias.request_turn_id
-      ) >= 3
-  )
-`;
+const visibleSessionEventWhere = "1 = 1";
 const sessionEventLogicalTime = `
   CASE
     WHEN occurred_at IS NOT NULL THEN occurred_at
@@ -91,6 +75,97 @@ function sessionEventLogicalSeqValue(row) {
         return row.turn_seq;
     return row.seq;
 }
+function canonicalEventRows(context, accountId, rows) {
+    const cache = new Map();
+    const seenHistorical = new Set();
+    const canonicalRows = [];
+    for (const row of rows) {
+        const key = `${row.session_id}:${row.machine_id}:${row.turn_id}`;
+        let requestTurnId = cache.get(key);
+        if (requestTurnId === undefined) {
+            const alias = context.db
+                .prepare(`SELECT request_turn_id FROM session_turn_aliases
+           WHERE account_id = ? AND session_id = ? AND machine_id = ? AND runtime_turn_id = ?`)
+                .get(accountId, row.session_id, row.machine_id, row.turn_id);
+            requestTurnId = alias?.request_turn_id ?? null;
+            cache.set(key, requestTurnId);
+        }
+        const canonicalRow = requestTurnId ? { ...row, turn_id: requestTurnId } : row;
+        const historicalKey = canonicalHistoricalEventKey(canonicalRow);
+        if (historicalKey) {
+            if (seenHistorical.has(historicalKey))
+                continue;
+            seenHistorical.add(historicalKey);
+        }
+        canonicalRows.push(canonicalRow);
+    }
+    return canonicalRows;
+}
+function canonicalHistoricalEventKey(row) {
+    if (!row.message_id || row.turn_seq === null || row.turn_seq === undefined)
+        return undefined;
+    if (!row.message_id.startsWith("hist_") && !row.message_id.startsWith("tail_"))
+        return undefined;
+    const digestStart = row.message_id.lastIndexOf("_");
+    const digest = digestStart >= 0 ? row.message_id.slice(digestStart + 1) : "";
+    if (!digest)
+        return undefined;
+    return `${row.session_id}:${row.machine_id}:${row.turn_id}:${row.turn_seq}:${digest}`;
+}
+function workspaceSyncState(context, accountId) {
+    const stars = context.db
+        .prepare(`SELECT session_id, starred_at
+       FROM session_stars
+       WHERE account_id = ?
+       ORDER BY starred_at DESC, session_id ASC`)
+        .all(accountId);
+    const recentSessions = context.db
+        .prepare(`SELECT session_id, last_selected_at
+       FROM account_recent_sessions
+       WHERE account_id = ?
+       ORDER BY last_selected_at DESC, session_id ASC`)
+        .all(accountId);
+    const cwdPins = context.db
+        .prepare(`SELECT machine_id, cwd, label, pinned_at
+       FROM account_workspace_cwd_pins
+       WHERE account_id = ?
+       ORDER BY pinned_at DESC, machine_id ASC, cwd ASC`)
+        .all(accountId);
+    const projectPreferences = context.db
+        .prepare(`SELECT project_key, machine_id, cwd, agent, memory_mode, updated_at
+       FROM account_project_preferences
+       WHERE account_id = ?
+       ORDER BY updated_at DESC, project_key ASC`)
+        .all(accountId);
+    return {
+        stars: stars.map((row) => ({ sessionId: row.session_id, starredAt: row.starred_at })),
+        recentSessions: recentSessions.map((row) => ({ sessionId: row.session_id, lastSelectedAt: row.last_selected_at })),
+        cwdPins: cwdPins.map((row) => ({
+            machineId: row.machine_id,
+            cwd: row.cwd,
+            ...(row.label ? { label: row.label } : {}),
+            pinnedAt: row.pinned_at,
+        })),
+        projectPreferences: projectPreferences.map((row) => ({
+            projectKey: row.project_key,
+            ...(row.machine_id ? { machineId: row.machine_id } : {}),
+            ...(row.cwd ? { cwd: row.cwd } : {}),
+            ...(row.agent ? { agent: row.agent } : {}),
+            ...(isMemoryMode(row.memory_mode) ? { memoryMode: row.memory_mode } : {}),
+            updatedAt: row.updated_at,
+        })),
+    };
+}
+function isMemoryMode(value) {
+    return value === "off" || value === "readonly" || value === "readwrite";
+}
+function assertWorkspaceSession(context, accountId, sessionId) {
+    const row = context.db
+        .prepare("SELECT id FROM sessions WHERE account_id = ? AND id = ?")
+        .get(accountId, sessionId);
+    if (!row)
+        throw new HttpError(404, "SESSION_NOT_FOUND", "Session not found");
+}
 export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
     app.get("/health", async () => ({ ok: true, service: "happy-elves-relay" }));
     app.post("/api/pairing/start", async (request) => {
@@ -171,6 +246,159 @@ export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
         context.assertHttpScopedAction(token, "snapshot");
         return context.filterSnapshotForScope(context.snapshot(token.account_id), context.tokenScope(token));
     });
+    app.post("/api/machine/admissions/create-session", async (request) => {
+        const token = context.requireHttpToken(request.headers.authorization, "machine");
+        if (!token.machine_id)
+            throw new HttpError(403, "MACHINE_TOKEN_INVALID", "Machine token is missing machine id");
+        const body = machineCreateSessionAdmissionSchema.parse(request.body);
+        const previous = context.previousAdmissionAck(token.account_id, body.requestId);
+        if (previous)
+            return previous;
+        const machine = context.db
+            .prepare("SELECT * FROM machines WHERE id = ? AND account_id = ?")
+            .get(token.machine_id, token.account_id);
+        if (!machine)
+            throw new HttpError(404, "MACHINE_NOT_FOUND", "Machine not found");
+        const sessionId = body.sessionId ?? randomId("ses");
+        const existing = context.db
+            .prepare("SELECT * FROM sessions WHERE id = ? AND account_id = ?")
+            .get(sessionId, token.account_id);
+        if (existing)
+            throw new HttpError(409, "SESSION_ID_CONFLICT", "Session id already exists without matching admission");
+        const createdAt = context.now();
+        const machineCommand = {
+            type: "machine:createSession",
+            requestId: body.requestId,
+            sessionId,
+            agent: body.agent,
+            cwd: body.cwd,
+            name: body.name,
+            model: body.model,
+            encryptedMetadata: body.encryptedMetadata,
+        };
+        context.db.exec("BEGIN");
+        try {
+            context.db.prepare(`INSERT INTO sessions
+         (id, account_id, machine_id, agent, cwd, name, status, encrypted_metadata, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(sessionId, token.account_id, token.machine_id, body.agent, body.cwd, body.name, "new", body.encryptedMetadata ? JSON.stringify(body.encryptedMetadata) : null, createdAt, createdAt);
+            context.db.prepare(`INSERT INTO relay_admissions
+         (account_id, request_id, session_id, machine_id, kind, turn_id, admission, dispatch, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(token.account_id, body.requestId, sessionId, token.machine_id, "createSession", null, "accepted", "queued", createdAt, createdAt);
+            context.db.prepare(`INSERT INTO relay_dispatch_outbox
+         (account_id, request_id, machine_id, session_id, command_type, message, state, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(token.account_id, body.requestId, token.machine_id, sessionId, machineCommand.type, JSON.stringify(machineCommand), "queued", createdAt, createdAt);
+            context.db.exec("COMMIT");
+        }
+        catch (error) {
+            context.db.exec("ROLLBACK");
+            throw error;
+        }
+        const sessionRow = context.db.prepare("SELECT * FROM sessions WHERE id = ?").get(sessionId);
+        if (sessionRow)
+            context.broadcastControllers(token.account_id, { type: "server:session", session: context.sessionSnapshot(sessionRow) });
+        const dispatch = context.deliverOutboxCommand(token.account_id, body.requestId);
+        return {
+            type: "server:ack",
+            requestId: body.requestId,
+            ok: true,
+            sessionId,
+            admission: "accepted",
+            dispatch,
+        };
+    });
+    app.post("/api/machine/admissions/prompt", async (request) => {
+        const token = context.requireHttpToken(request.headers.authorization, "machine");
+        if (!token.machine_id)
+            throw new HttpError(403, "MACHINE_TOKEN_INVALID", "Machine token is missing machine id");
+        const body = machinePromptAdmissionSchema.parse(request.body);
+        const previous = context.previousAdmissionAck(token.account_id, body.requestId);
+        if (previous)
+            return previous;
+        const sessionRow = context.db
+            .prepare("SELECT * FROM sessions WHERE id = ? AND account_id = ? AND machine_id = ?")
+            .get(body.sessionId, token.account_id, token.machine_id);
+        if (!sessionRow)
+            throw new HttpError(404, "SESSION_NOT_FOUND", "Session not found");
+        const decision = controllerSessionCommandDecision(sessionRow.status, "prompt");
+        if (!decision.allowed &&
+            !(decision.code === "SESSION_BUSY" &&
+                !context.activeSessionClaim(token.account_id, sessionRow.id) &&
+                !sessionLooksTranscriptPending(context, sessionRow))) {
+            throw new HttpError(409, decision.code, decision.message);
+        }
+        const createdAt = context.now();
+        const machineCommand = {
+            type: "machine:prompt",
+            requestId: body.requestId,
+            sessionId: sessionRow.id,
+            turnId: body.turnId,
+            encryptedPrompt: body.encryptedPrompt,
+            encryptedMetadata: sessionRow.encrypted_metadata ? context.parseJson(sessionRow.encrypted_metadata, undefined) : undefined,
+            permissionMode: body.permissionMode,
+            model: body.model,
+            encryptedMemoryOptions: body.encryptedMemoryOptions,
+            timeoutMs: body.timeoutMs,
+        };
+        let event;
+        let busyClaim;
+        context.db.exec("BEGIN");
+        try {
+            const claim = context.claimSessionTurn({
+                accountId: token.account_id,
+                sessionId: sessionRow.id,
+                machineId: token.machine_id,
+                requestId: body.requestId,
+                turnId: body.turnId,
+                commandType: "prompt",
+                createdAt,
+            });
+            if (!claim.ok) {
+                busyClaim = claim.claim;
+                context.db.exec("ROLLBACK");
+            }
+            else {
+                event = context.insertEvent({
+                    accountId: token.account_id,
+                    sessionId: sessionRow.id,
+                    machineId: token.machine_id,
+                    source: "controller",
+                    turnId: body.turnId,
+                    payload: body.encryptedPrompt,
+                });
+                context.db.prepare(`INSERT INTO relay_admissions
+           (account_id, request_id, session_id, machine_id, kind, turn_id, admission, dispatch, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(token.account_id, body.requestId, sessionRow.id, token.machine_id, "prompt", body.turnId, "accepted", "queued", createdAt, createdAt);
+                context.db.prepare(`INSERT INTO relay_dispatch_outbox
+           (account_id, request_id, machine_id, session_id, command_type, message, state, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(token.account_id, body.requestId, token.machine_id, sessionRow.id, machineCommand.type, JSON.stringify(machineCommand), "queued", createdAt, createdAt);
+                context.db.exec("COMMIT");
+            }
+        }
+        catch (error) {
+            context.db.exec("ROLLBACK");
+            throw error;
+        }
+        if (busyClaim) {
+            throw new HttpError(409, "SESSION_BUSY", "Session already has a running turn", {
+                sessionId: sessionRow.id,
+                activeRequestId: busyClaim.request_id,
+                activeTurnId: busyClaim.turn_id,
+            });
+        }
+        if (!event)
+            throw new HttpError(500, "ADMISSION_FAILED", "Prompt admission did not persist an event");
+        context.broadcastControllers(token.account_id, { type: "server:event", event });
+        const dispatch = context.deliverOutboxCommand(token.account_id, body.requestId);
+        return {
+            type: "server:ack",
+            requestId: body.requestId,
+            ok: true,
+            sessionId: sessionRow.id,
+            turnId: body.turnId,
+            admission: "accepted",
+            dispatch,
+        };
+    });
     app.get("/api/sessions/:sessionId/events", async (request) => {
         const token = context.requireHttpToken(request.headers.authorization, "controller");
         context.assertHttpScopedAction(token, "collect");
@@ -229,8 +457,9 @@ export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
             rows = page.slice(0, limit).reverse();
         }
         const newestRow = rows.at(-1);
+        const canonicalRows = canonicalEventRows(context, token.account_id, rows);
         return {
-            events: rows.map(context.eventSnapshot),
+            events: canonicalRows.map(context.eventSnapshot),
             hasMoreBefore,
             oldestCursor: rows[0] ? encodeSessionEventCursor(params.sessionId, rows[0]) : undefined,
             newestCursor: newestRow ? encodeSessionEventCursor(params.sessionId, newestRow) : undefined,
@@ -238,25 +467,359 @@ export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
             newestEventId: newestRow?.id,
         };
     });
+    app.post("/api/sessions/:sessionId/head", async (request) => {
+        const token = context.requireHttpToken(request.headers.authorization, "controller");
+        context.assertHttpScopedAction(token, "session.repairHead");
+        const params = z.object({ sessionId: z.string().min(1) }).parse(request.params);
+        const body = sessionHeadAdvanceSchema.parse(request.body);
+        context.assertScopedSession(context.tokenScope(token), token.account_id, params.sessionId);
+        const session = context.db
+            .prepare("SELECT * FROM sessions WHERE account_id = ? AND id = ?")
+            .get(token.account_id, params.sessionId);
+        if (!session)
+            throw new HttpError(404, "SESSION_NOT_FOUND", "Session not found");
+        if (session.status === "running" && !body.status) {
+            throw new HttpError(409, "SESSION_HEAD_REPAIR_RUNNING", "Cannot repair a running session head");
+        }
+        const basisEvent = context.db
+            .prepare(`SELECT * FROM session_events
+         WHERE account_id = ? AND session_id = ? AND machine_id = ? AND message_id = ?`)
+            .get(token.account_id, params.sessionId, session.machine_id, body.basis.eventMessageId);
+        if (!basisEvent)
+            throw new HttpError(409, "SESSION_HEAD_BASIS_MISSING", "Head advance basis event is not available");
+        if (basisEvent.turn_id !== body.basis.turnId || basisEvent.turn_seq !== body.basis.turnSeq) {
+            throw new HttpError(409, "SESSION_HEAD_BASIS_MISMATCH", "Head advance basis does not match the stored event");
+        }
+        const nextOrder = logicalEventOrderForRow(basisEvent);
+        const currentOrder = sessionHeadBasisOrderForRow(context.db, session);
+        const rewriteFenced = typeof session.head_basis_message_id === "string" &&
+            session.head_basis_message_id.startsWith("rewrite:");
+        const comparison = compareHeadOrders(nextOrder, currentOrder);
+        const currentHeadAlreadySettled = session.current_head === `event:${basisEvent.id}` ||
+            session.current_head === body.currentHead ||
+            session.last_turn_id === body.lastTurnId;
+        const advanced = !rewriteFenced && comparison > 0;
+        const statusChanged = !rewriteFenced &&
+            body.status !== undefined &&
+            session.status === "running" &&
+            comparison === 0 &&
+            currentHeadAlreadySettled;
+        if (advanced || statusChanged) {
+            const ts = context.now();
+            context.db.prepare(`UPDATE sessions
+         SET status = COALESCE(?, status),
+             current_head = COALESCE(?, current_head),
+             last_turn_id = COALESCE(?, last_turn_id),
+             head_basis_event_id = COALESCE(?, head_basis_event_id),
+             head_basis_message_id = COALESCE(?, head_basis_message_id),
+             head_basis_logical_time = COALESCE(?, head_basis_logical_time),
+             head_basis_turn_seq = COALESCE(?, head_basis_turn_seq),
+             updated_at = ?
+         WHERE id = ? AND account_id = ?`).run(body.status && session.status === "running" ? body.status : null, advanced ? body.currentHead : null, advanced ? body.lastTurnId : null, advanced ? basisEvent.id : null, advanced ? basisEvent.message_id : null, advanced ? nextOrder.time : null, advanced ? nextOrder.seq : null, ts, params.sessionId, token.account_id);
+        }
+        const row = context.db
+            .prepare("SELECT * FROM sessions WHERE account_id = ? AND id = ?")
+            .get(token.account_id, params.sessionId);
+        if (!row)
+            throw new HttpError(404, "SESSION_NOT_FOUND", "Session not found");
+        const snapshot = context.sessionSnapshot(row);
+        context.broadcastControllers(token.account_id, { type: "server:session", session: snapshot });
+        return {
+            advanced,
+            session: snapshot,
+            basis: {
+                eventId: basisEvent.id,
+                messageId: basisEvent.message_id ?? undefined,
+                logicalTime: nextOrder.time,
+                turnSeq: nextOrder.seq,
+            },
+            ...(statusChanged ? { settled: true } : {}),
+            ...(rewriteFenced ? { reason: "rewrite-fenced" } : {}),
+        };
+    });
+    app.get("/api/workspace-sync", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        return workspaceSyncState(context, token.account_id);
+    });
+    app.post("/api/workspace-sync/session-star", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = workspaceSessionStarSchema.parse(request.body);
+        assertWorkspaceSession(context, token.account_id, body.sessionId);
+        const ts = context.now();
+        if (body.starred) {
+            context.db
+                .prepare(`INSERT INTO session_stars (account_id, session_id, starred_at)
+           VALUES (?, ?, ?)
+           ON CONFLICT(account_id, session_id) DO UPDATE SET starred_at = excluded.starred_at`)
+                .run(token.account_id, body.sessionId, ts);
+            return { sessionId: body.sessionId, starred: true, starredAt: ts };
+        }
+        context.db
+            .prepare("DELETE FROM session_stars WHERE account_id = ? AND session_id = ?")
+            .run(token.account_id, body.sessionId);
+        return { sessionId: body.sessionId, starred: false, unstarredAt: ts };
+    });
+    app.post("/api/workspace-sync/session-recent", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = workspaceSessionRecentSchema.parse(request.body);
+        assertWorkspaceSession(context, token.account_id, body.sessionId);
+        const ts = context.now();
+        context.db
+            .prepare(`INSERT INTO account_recent_sessions (account_id, session_id, last_selected_at)
+         VALUES (?, ?, ?)
+         ON CONFLICT(account_id, session_id) DO UPDATE SET last_selected_at = excluded.last_selected_at`)
+            .run(token.account_id, body.sessionId, ts);
+        return { sessionId: body.sessionId, lastSelectedAt: ts };
+    });
+    app.post("/api/workspace-sync/cwd-pin", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = workspaceCwdPinSchema.parse(request.body);
+        const ts = context.now();
+        context.db
+            .prepare(`INSERT INTO account_workspace_cwd_pins (account_id, machine_id, cwd, label, pinned_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(account_id, machine_id, cwd) DO UPDATE SET
+           label = excluded.label,
+           pinned_at = excluded.pinned_at`)
+            .run(token.account_id, body.machineId, body.cwd, body.label ?? null, ts);
+        return {
+            machineId: body.machineId,
+            cwd: body.cwd,
+            ...(body.label ? { label: body.label } : {}),
+            pinnedAt: ts,
+        };
+    });
+    app.post("/api/workspace-sync/cwd-unpin", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = workspaceCwdUnpinSchema.parse(request.body);
+        const ts = context.now();
+        context.db
+            .prepare("DELETE FROM account_workspace_cwd_pins WHERE account_id = ? AND machine_id = ? AND cwd = ?")
+            .run(token.account_id, body.machineId, body.cwd);
+        return { machineId: body.machineId, cwd: body.cwd, removed: true, removedAt: ts };
+    });
+    app.post("/api/workspace-sync/project-preference", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = workspaceProjectPreferenceSchema.parse(request.body);
+        const ts = context.now();
+        context.db
+            .prepare(`INSERT INTO account_project_preferences (account_id, project_key, machine_id, cwd, agent, memory_mode, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(account_id, project_key) DO UPDATE SET
+           machine_id = excluded.machine_id,
+           cwd = excluded.cwd,
+           agent = excluded.agent,
+           memory_mode = excluded.memory_mode,
+           updated_at = excluded.updated_at`)
+            .run(token.account_id, body.projectKey, body.machineId ?? null, body.cwd ?? null, body.agent ?? null, body.memoryMode ?? null, ts);
+        return {
+            projectKey: body.projectKey,
+            ...(body.machineId ? { machineId: body.machineId } : {}),
+            ...(body.cwd ? { cwd: body.cwd } : {}),
+            ...(body.agent ? { agent: body.agent } : {}),
+            ...(body.memoryMode ? { memoryMode: body.memoryMode } : {}),
+            updatedAt: ts,
+        };
+    });
+    app.post("/api/sessions/:sessionId/metadata", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const params = z.object({ sessionId: z.string().min(1) }).parse(request.params);
+        const body = sessionMetadataUpdateSchema.parse(request.body);
+        const session = context.db
+            .prepare("SELECT * FROM sessions WHERE id = ? AND account_id = ?")
+            .get(params.sessionId, token.account_id);
+        if (!session)
+            throw new HttpError(404, "SESSION_NOT_FOUND", "Session not found");
+        const ts = context.now();
+        context.db
+            .prepare("UPDATE sessions SET encrypted_metadata = ?, updated_at = ? WHERE id = ? AND account_id = ?")
+            .run(JSON.stringify(body.encryptedMetadata), ts, params.sessionId, token.account_id);
+        const updated = context.db
+            .prepare("SELECT * FROM sessions WHERE id = ? AND account_id = ?")
+            .get(params.sessionId, token.account_id);
+        const snapshot = context.sessionSnapshot(updated);
+        context.broadcastControllers(token.account_id, { type: "server:session", session: snapshot });
+        return { session: snapshot, updatedAt: ts };
+    });
+    app.get("/api/memory", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const query = memoryListQuerySchema.parse(request.query);
+        const rows = query.projectKey
+            ? context.db
+                .prepare(`SELECT id, project_key, encrypted_memory, created_at, updated_at
+             FROM account_memories
+             WHERE account_id = ? AND project_key = ?
+             ORDER BY updated_at DESC, id ASC`)
+                .all(token.account_id, query.projectKey)
+            : context.db
+                .prepare(`SELECT id, project_key, encrypted_memory, created_at, updated_at
+             FROM account_memories
+             WHERE account_id = ?
+             ORDER BY updated_at DESC, id ASC`)
+                .all(token.account_id);
+        return {
+            memories: rows.map((row) => ({
+                id: row.id,
+                projectKey: row.project_key,
+                encryptedMemory: context.parseJson(row.encrypted_memory, undefined),
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+            })),
+        };
+    });
+    app.post("/api/memory", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = memorySaveSchema.parse(request.body);
+        const encryptedMemory = encryptedEnvelopeSchema.parse(body.encryptedMemory);
+        const ts = context.now();
+        context.db
+            .prepare(`INSERT INTO account_memories (id, account_id, project_key, encrypted_memory, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET
+           project_key = excluded.project_key,
+           encrypted_memory = excluded.encrypted_memory,
+           updated_at = excluded.updated_at`)
+            .run(body.id, token.account_id, body.projectKey, JSON.stringify(encryptedMemory), ts, ts);
+        return {
+            id: body.id,
+            projectKey: body.projectKey,
+            encryptedMemory,
+            createdAt: ts,
+            updatedAt: ts,
+        };
+    });
+    app.post("/api/memory/delete", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = memoryDeleteSchema.parse(request.body);
+        const ts = context.now();
+        context.db.prepare("DELETE FROM account_memories WHERE account_id = ? AND id = ?").run(token.account_id, body.id);
+        return { id: body.id, deleted: true, deletedAt: ts };
+    });
+    app.get("/api/memory/settings", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const query = memoryListQuerySchema.parse(request.query);
+        const rows = query.projectKey
+            ? context.db
+                .prepare(`SELECT project_key, disabled, injection_enabled, updated_at
+             FROM account_memory_settings
+             WHERE account_id = ? AND project_key = ?
+             ORDER BY updated_at DESC`)
+                .all(token.account_id, query.projectKey)
+            : context.db
+                .prepare(`SELECT project_key, disabled, injection_enabled, updated_at
+             FROM account_memory_settings
+             WHERE account_id = ?
+             ORDER BY updated_at DESC, project_key ASC`)
+                .all(token.account_id);
+        return {
+            settings: rows.map((row) => ({
+                projectKey: row.project_key,
+                disabled: row.disabled === 1,
+                injectionEnabled: row.injection_enabled === 1,
+                updatedAt: row.updated_at,
+            })),
+        };
+    });
+    app.post("/api/memory/settings", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = memorySettingsSchema.parse(request.body);
+        const current = context.db
+            .prepare("SELECT disabled, injection_enabled FROM account_memory_settings WHERE account_id = ? AND project_key = ?")
+            .get(token.account_id, body.projectKey);
+        const disabled = body.disabled === undefined ? current?.disabled ?? 0 : body.disabled ? 1 : 0;
+        const injectionEnabled = body.injectionEnabled === undefined ? current?.injection_enabled ?? 0 : body.injectionEnabled ? 1 : 0;
+        const ts = context.now();
+        context.db
+            .prepare(`INSERT INTO account_memory_settings (account_id, project_key, disabled, injection_enabled, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(account_id, project_key) DO UPDATE SET
+           disabled = excluded.disabled,
+           injection_enabled = excluded.injection_enabled,
+           updated_at = excluded.updated_at`)
+            .run(token.account_id, body.projectKey, disabled, injectionEnabled, ts);
+        return { projectKey: body.projectKey, disabled: disabled === 1, injectionEnabled: injectionEnabled === 1, updatedAt: ts };
+    });
+    app.get("/api/machine/memory-documents", async (request) => {
+        const token = context.requireHttpToken(request.headers.authorization, "machine");
+        const query = machineMemoryDocumentsQuerySchema.parse(request.query);
+        const projectKey = `memory-doc:${query.projectKey}`;
+        const rows = context.db
+            .prepare(`SELECT id, project_key, encrypted_memory, created_at, updated_at
+         FROM account_memories
+         WHERE account_id = ? AND project_key = ?
+         ORDER BY updated_at DESC, id ASC`)
+            .all(token.account_id, projectKey);
+        return {
+            documents: rows.map((row) => ({
+                id: row.id,
+                projectKey: query.projectKey,
+                encryptedDocument: context.parseJson(row.encrypted_memory, undefined),
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+            })),
+        };
+    });
+    app.post("/api/machine/memory-documents", async (request) => {
+        const token = context.requireHttpToken(request.headers.authorization, "machine");
+        const body = machineMemoryDocumentSaveSchema.parse(request.body);
+        const projectKey = `memory-doc:${body.projectKey}`;
+        const ts = context.now();
+        context.db
+            .prepare(`INSERT INTO account_memories (id, account_id, project_key, encrypted_memory, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET
+           project_key = excluded.project_key,
+           encrypted_memory = excluded.encrypted_memory,
+           updated_at = excluded.updated_at`)
+            .run(body.id, token.account_id, projectKey, JSON.stringify(body.encryptedDocument), ts, ts);
+        return { id: body.id, projectKey: body.projectKey, encryptedDocument: body.encryptedDocument, createdAt: ts, updatedAt: ts };
+    });
     app.get("/api/devices", async (request) => {
         const token = context.requireFullControllerToken(request.headers.authorization);
         const rows = context.db
-            .prepare(`SELECT kind, machine_id, device_id, device_name, created_at, revoked_at
+            .prepare(`SELECT tokens.kind, tokens.machine_id, tokens.device_id, tokens.device_name,
+                tokens.created_at, tokens.revoked_at, tokens.last_seen,
+                machines.last_seen AS machine_last_seen
          FROM tokens
-         WHERE account_id = ? AND device_id IS NOT NULL
-         ORDER BY created_at DESC`)
+         LEFT JOIN machines ON machines.account_id = tokens.account_id AND machines.id = tokens.machine_id
+         WHERE tokens.account_id = ? AND tokens.device_id IS NOT NULL
+         ORDER BY tokens.created_at DESC`)
             .all(token.account_id);
+        const byDeviceId = new Map();
+        for (const row of rows) {
+            const existing = byDeviceId.get(row.device_id);
+            if (!existing) {
+                byDeviceId.set(row.device_id, row);
+                continue;
+            }
+            if (existing.revoked_at !== null && row.revoked_at === null) {
+                byDeviceId.set(row.device_id, row);
+            }
+        }
         return {
-            devices: rows.map((row) => ({
-                deviceId: row.device_id,
-                name: row.device_name ?? row.device_id,
-                kind: row.kind,
-                current: row.kind === "controller" && row.device_id === token.device_id,
-                revoked: row.revoked_at !== null,
-                createdAt: row.created_at,
-                machineId: row.machine_id ?? undefined,
-                revokedAt: row.revoked_at ?? undefined,
-            })),
+            devices: [...byDeviceId.values()].map((row) => {
+                const revoked = row.revoked_at !== null;
+                const online = revoked
+                    ? false
+                    : row.kind === "machine" && row.machine_id
+                        ? context.connectedMachine(token.account_id, row.machine_id) !== undefined
+                        : context.controllerDeviceOnline(token.account_id, row.device_id);
+                const lastSeen = row.kind === "machine"
+                    ? row.machine_last_seen ?? row.last_seen ?? row.created_at
+                    : row.last_seen ?? row.created_at;
+                return {
+                    deviceId: row.device_id,
+                    name: row.device_name ?? row.device_id,
+                    kind: row.kind,
+                    current: row.kind === "controller" && row.device_id === token.device_id,
+                    revoked,
+                    online,
+                    createdAt: row.created_at,
+                    lastSeen,
+                    machineId: row.machine_id ?? undefined,
+                    revokedAt: row.revoked_at ?? undefined,
+                };
+            }),
         };
     });
     app.post("/api/devices/controller", async (request) => {
@@ -280,6 +843,20 @@ export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
             createdAt,
         };
     });
+    app.post("/api/devices/rename", async (request) => {
+        const token = context.requireFullControllerToken(request.headers.authorization);
+        const body = deviceRenameSchema.parse(request.body);
+        const target = context.db
+            .prepare("SELECT * FROM tokens WHERE account_id = ? AND device_id = ? AND revoked_at IS NULL ORDER BY created_at DESC")
+            .get(token.account_id, body.deviceId);
+        if (!target)
+            throw new HttpError(404, "DEVICE_NOT_FOUND", "Device not found");
+        context.db.prepare("UPDATE tokens SET device_name = ? WHERE token = ?").run(body.name, target.token);
+        if (target.kind === "machine" && target.machine_id) {
+            context.db.prepare("UPDATE machines SET name = ?, updated_at = ? WHERE account_id = ? AND id = ?").run(body.name, context.now(), token.account_id, target.machine_id);
+        }
+        return { deviceId: body.deviceId, name: body.name, renamedAt: context.now() };
+    });
     app.post("/api/controller-invites", async (request) => {
         const token = context.requireFullControllerToken(request.headers.authorization);
         const body = controllerInviteCreateSchema.parse(request.body);
@@ -392,4 +969,53 @@ export function registerHttpRoutes(app, context, controllerInviteTtlMs) {
         return { tokenId: body.tokenId, revokedAt: target.revoked_at ?? ts };
     });
 }
+function compareHeadOrders(next, current) {
+    if (!current)
+        return 1;
+    if (next.time !== current.time)
+        return next.time > current.time ? 1 : -1;
+    if (next.seq !== current.seq)
+        return next.seq > current.seq ? 1 : -1;
+    if (next.id !== current.id)
+        return next.id > current.id ? 1 : -1;
+    return 0;
+}
+function logicalEventOrderForRow(row) {
+    if (row.occurred_at !== null && row.occurred_at !== undefined) {
+        return { time: row.occurred_at, seq: row.turn_seq ?? row.seq, id: row.id };
+    }
+    if (row.message_id?.startsWith("hist_") && row.turn_seq !== null && row.turn_seq !== undefined) {
+        return { time: 0, seq: row.turn_seq, id: row.id };
+    }
+    return { time: row.created_at, seq: row.turn_seq ?? row.seq, id: row.id };
+}
+function sessionHeadBasisOrderForRow(db, row) {
+    if (row.head_basis_logical_time !== null && row.head_basis_turn_seq !== null) {
+        return {
+            time: row.head_basis_logical_time,
+            seq: row.head_basis_turn_seq,
+            id: row.head_basis_event_id ?? 0,
+        };
+    }
+    const eventId = row.current_head ? /^event:(\d+)$/.exec(row.current_head)?.[1] : undefined;
+    if (!eventId)
+        return undefined;
+    const event = db
+        .prepare("SELECT * FROM session_events WHERE account_id = ? AND session_id = ? AND machine_id = ? AND id = ?")
+        .get(row.account_id, row.id, row.machine_id, Number(eventId));
+    return event ? logicalEventOrderForRow(event) : undefined;
+}
+function sessionLooksTranscriptPending(context, sessionRow) {
+    if (sessionRow.status !== "running")
+        return false;
+    if (!sessionRow.source_session_id || !sessionRow.source_checkpoint_id)
+        return false;
+    const row = context.db
+        .prepare(`SELECT 1
+       FROM session_events
+       WHERE account_id = ? AND session_id = ? AND machine_id = ?
+       LIMIT 1`)
+        .get(sessionRow.account_id, sessionRow.id, sessionRow.machine_id);
+    return !row;
+}
 //# sourceMappingURL=http-routes.js.map