codemem 0.46.2 → 0.47.0-beta.2

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ContextOnlyReplayError, DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, DeviceIdentityError, EXTRACTION_BENCHMARK_QUALITY_WEIGHTS, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, ObserverOutputError, ObserverOutputTransportError, PROMPT_TRANSPORT_PROTOCOL_RANGE, REF_BACKFILL_JOB, RawEventIngestValidationError, RawEventSweeper, RefBackfillRunner, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, TRUSTED_HOOK_MAPPER_OPTIONS, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, applyDistillRule, arePromptTransportProtocolRangesCompatible, atomicReplaceConfigFile, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildTieredObserverSelection, buildViewerIdentityTarget, classifyPromptTransportFailure, clonePromptPackAttempt, collectOperationalStatus, compareMemoryRoleReports, connect, connectReadOnly, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, describePiObserverStatus, detectInstallKind, draftDistillRule, ensureDeviceIdentity, ensureSchemaBootstrapped, estimateExtractionModelCost, exportMemories, extractApplyPatchPaths, extractionReplayObserverIdentity, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, formatHostPort, getAttributionDiagnostics, getCodememConfigPath, getExtractionBenchmarkProfile, getExtractionModelPricing, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryArtifactReport, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getUpdateStatus, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, ingestRawEvents, initDatabase, isAutomaticRecallMeasurement, isEmbeddingDisabled, isExplicitUpdateInstallEligible, isReleaseVersionForChannel, judgeDistillReport, listMaintenanceJobs, listPerPeerScopeSyncState, listRetentionScopeIds, loadObserverConfig, loadPublicKey, loadSqliteVec, mdnsEnabled, mutateCodememConfigFile, normalizePromptTransportProtocolRange, observerBaseUrlForProviderOverride, planReplicationOpsAgePrune, probeCodememViewerLiveness, probeCodememViewerLiveness as probeCodememViewerLiveness$1, probeRequiredNativeRuntime, projectMatchesFilter, promptPackArtifactFingerprint, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorSyncConfig, readImportPayload, recordAutomaticRecall, recordPromptPackArtifacts, recordPromptPackTerminal, recordRetrievalSurface, renderUnifiedDiff, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveComparablePath, resolveDbPath, resolveHookProject, resolvePiAgentDir, resolvePiObserverConfig, resolveProject, resolveProjectRoot, resolveRetrievalSession, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, scoreExtractionBenchmarkOutput, setPeerProjectFilter, syncPassPreflight, tryUpdateRetrievalDelivery, updatePeerAddresses, vacuumDatabase, viewerUrl, writeCodememConfigFile } from "@codemem/core";
+import { ACCOUNT_CONNECTION_MIGRATION_STATEMENTS, ACCOUNT_UNLINK_MIGRATION_STATEMENTS, AUTH_LINK_AUTHORITY_CUTOVER_SQL, ContextOnlyReplayError, CoordinatorAccountLinkError, DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, DeviceIdentityError, EXTRACTION_BENCHMARK_QUALITY_WEIGHTS, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, ObserverOutputError, ObserverOutputTransportError, OwnerProfileEnrollmentError, PROMPT_TRANSPORT_PROTOCOL_RANGE, REF_BACKFILL_JOB, RawEventIngestValidationError, RawEventSweeper, RefBackfillRunner, RemoteCoordinatorRequestError, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, TRUSTED_HOOK_MAPPER_OPTIONS, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, applyDistillRule, arePromptTransportProtocolRangesCompatible, atomicReplaceConfigFile, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildTieredObserverSelection, buildViewerIdentityTarget, classifyPromptTransportFailure, clonePromptPackAttempt, collectOperationalStatus, compareMemoryRoleReports, connect, connectReadOnly, coordinatorAuthControllerReviewAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantIdentityGroupAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorQualifyOwnerAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewInviteAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeDeviceAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, describePiObserverStatus, detectInstallKind, draftDistillRule, enrollOwnerProfile, ensureDeviceIdentity, ensureSchemaBootstrapped, estimateExtractionModelCost, expandUserPath, exportMemories, extractApplyPatchPaths, extractionReplayObserverIdentity, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, formatHostPort, getAttributionDiagnostics, getCodememConfigPath, getExtractionBenchmarkProfile, getExtractionModelPricing, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryArtifactReport, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getUpdateStatus, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, importPiSessions, ingestRawEvents, initDatabase, isAutomaticRecallMeasurement, isCoordinatorControllerAttestationReference, isEmbeddingDisabled, isExplicitUpdateInstallEligible, isReleaseVersionForChannel, judgeDistillReport, linkCoordinatorAccount, listMaintenanceJobs, listPerPeerScopeSyncState, listRetentionScopeIds, loadObserverConfig, loadPublicKey, loadRuntimeSigningPublicKey, loadSqliteVec, mdnsEnabled, mutateCodememConfigFile, normalizeCoordinatorAccountLinkOrigin, normalizePromptTransportProtocolRange, observerBaseUrlForProviderOverride, planReplicationOpsAgePrune, probeCodememViewerLiveness, probeCodememViewerLiveness as probeCodememViewerLiveness$1, probeRequiredNativeRuntime, projectMatchesFilter, promptPackArtifactFingerprint, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readAccountLinkDevice, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorAccountLinkStatus, readCoordinatorOwnerReviewLocalEvidence, readCoordinatorSyncConfig, readImportPayload, recordAutomaticRecall, recordPromptPackArtifacts, recordPromptPackTerminal, recordRetrievalSurface, renderUnifiedDiff, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveComparablePath, resolveDbPath, resolveHookProject, resolveKeyPaths, resolvePiAgentDir, resolvePiObserverConfig, resolveProject, resolveProjectRoot, resolveRetrievalSession, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, scoreExtractionBenchmarkOutput, searchPiSessions, setPeerProjectFilter, syncPassPreflight, tryUpdateRetrievalDelivery, updatePeerAddresses, upgradeCoordinatorAccountSchemaFile, upgradeCoordinatorAuthSchemaFile, vacuumDatabase, viewerUrl, writeCodememConfigFile } from "@codemem/core";
 import { Command, Option } from "commander";
 import omelette from "omelette";
 import { randomInt, randomUUID } from "node:crypto";
@@ -2583,6 +2583,937 @@ whereCmd.action((opts) => {
 });
 configCommand.addCommand(whereCmd);
 //#endregion
+//#region src/commands/coordinator-auth-schema.ts
+function failure$4(options, message, exitCode, errorCode = "auth_schema_upgrade_failed") {
+	if (options.json) {
+		emitJsonError(exitCode === 2 ? "usage_error" : errorCode, message, exitCode);
+		return;
+	}
+	p.log.error(`Coordinator auth upgrade stopped: ${message}`);
+	process.exitCode = exitCode;
+}
+function upgrade(options) {
+	const path = resolveDbOpt(options);
+	if (options.exportSql && path) {
+		failure$4(options, "Use --export-sql without --db-path; export opens no database.", 2);
+		return;
+	}
+	if (!options.exportSql && !path) {
+		failure$4(options, "Select an existing coordinator database with --db-path. Pause auth writers, drain attempts and back up the database first.", 2);
+		return;
+	}
+	try {
+		if (options.exportSql) {
+			const sql = `${AUTH_LINK_AUTHORITY_CUTOVER_SQL}\n`;
+			process.stdout.write(options.json ? `${JSON.stringify({
+				sql,
+				applied: false
+			})}\n` : sql);
+			return;
+		}
+		if (!path) return;
+		upgradeCoordinatorAuthSchemaFile(path);
+		process.stdout.write(options.json ? `${JSON.stringify({ upgraded: true })}\n` : "Coordinator authentication schema upgraded.\n");
+	} catch (error) {
+		failure$4(options, `Upgrade aborted without committing changes. Check that attempts are drained and the legacy schema and provenance match the reviewed source. ${error instanceof Error ? error.message : "Coordinator auth upgrade failed."}`, 1);
+	}
+}
+function buildCoordinatorAuthSchemaCommand() {
+	const command = new Command("upgrade-auth-schema").configureHelp(helpStyle).description("Upgrade local coordinator auth or export reviewed D1 SQL").option("-e, --export-sql", "print D1 cutover SQL without opening a database");
+	addDbOption(command);
+	addJsonOption(command);
+	command.action(upgrade);
+	return command;
+}
+var accountPrerequisites = "Pause auth writers, drain pending attempts and back up the selected coordinator database first. This command does not pause writers or create a backup.";
+function hasDatabaseSelection(options) {
+	return options.dbPath !== void 0 || options.db !== void 0;
+}
+function exportAccountSchema(options) {
+	const statements = options.deviceUnlink ? ACCOUNT_UNLINK_MIGRATION_STATEMENTS : ACCOUNT_CONNECTION_MIGRATION_STATEMENTS;
+	const text = `-- ${accountPrerequisites}\n-- Execute in ONE atomic D1 batch; do not split into autocommitted requests. Nothing has been applied.\n${statements.map((s) => `${s.trim().replace(/;$/u, "")};`).join("\n")}\n`;
+	process.stdout.write(options.json ? `${JSON.stringify({
+		statements,
+		applied: false
+	})}\n` : text);
+}
+async function upgradeAccount(options) {
+	if (options.deviceUnlink && !options.exportSql) {
+		failure$4(options, "Use --device-unlink only with --export-sql; local upgrades detect the installed schema.", 2, "account_schema_upgrade_failed");
+		return;
+	}
+	const path = resolveDbOpt(options);
+	const selected = hasDatabaseSelection(options);
+	if (options.exportSql && selected || !options.exportSql && !path) {
+		failure$4(options, options.exportSql ? "Use --export-sql without --db-path; export opens no database." : `Select an existing coordinator database with --db-path. ${accountPrerequisites}`, 2, "account_schema_upgrade_failed");
+		return;
+	}
+	try {
+		if (options.exportSql) {
+			exportAccountSchema(options);
+			return;
+		}
+		if (!path) return;
+		if (!options.json) process.stderr.write(`${accountPrerequisites}\n`);
+		await upgradeCoordinatorAccountSchemaFile(path);
+		process.stdout.write(options.json ? `${JSON.stringify({ upgraded: true })}\n` : "Coordinator account schema upgraded.\n");
+	} catch (error) {
+		failure$4(options, `Account schema upgrade stopped. Inspect the selected database before retrying. ${error instanceof Error ? error.message : "Coordinator account schema upgrade failed."}`, 1, "account_schema_upgrade_failed");
+	}
+}
+function buildCoordinatorAccountSchemaCommand() {
+	const command = new Command("upgrade-account-schema").configureHelp(helpStyle).description("Explicitly install optional coordinator account management on an existing V2 database").option("--device-unlink", "export only the delta for the prior account-management schema (requires --export-sql)").option("-e, --export-sql", "export statement boundaries for one atomic D1 batch without opening a database").addHelpText("after", `\n${accountPrerequisites}\nD1 export does not apply SQL or verify remote execution limits.\n`);
+	addDbOption(command);
+	addJsonOption(command);
+	command.action(upgradeAccount);
+	return command;
+}
+//#endregion
+//#region src/commands/coordinator-enroll-owner.ts
+var CAPTURE_WARNING = "Stop OpenCode capture, the Viewer and the sync daemon before preparing or resuming. Keep them stopped until Verified coordinator Identity is shown. Any capture/history change during the browser ceremony can stop local adoption after the server commits, leaving DB and config separate and requiring operator review.";
+function showPrivateBrowserLink$1(privateUrl) {
+	p.log.warn("Keep this browser link private. Open it to review the Google account and device, then return here to finish. No Team or Project access is added.", { output: process.stderr });
+	p.log.message(privateUrl, { output: process.stderr });
+}
+function showAccountAdmissionLink(url, request) {
+	if (!request) throw new OwnerProfileEnrollmentError("review_required");
+	p.log.warn("Open this account admission page while signed in to the intended account. Upload the private capability-request.json file below unchanged, compare the local fingerprint, and review the device. Keep this command running and capture stopped; browser confirmation alone does not finish enrollment. No Team or Project access is added.", { output: process.stderr });
+	p.log.message(`${url}\nPrivate request file: ${request.requestFile}\nDevice: ${request.deviceId}\nLocal fingerprint: ${request.fingerprint}`, { output: process.stderr });
+}
+function admissionOptions(options) {
+	if (options.accountAdmission) return {
+		admissionMode: "account",
+		onBrowserStart: showAccountAdmissionLink
+	};
+	return {
+		admissionMode: "operator",
+		onBrowserStart: showPrivateBrowserLink$1
+	};
+}
+function reportUsageError(options, message) {
+	if (options.json) emitJsonError("usage_error", message, 2);
+	else {
+		p.log.error(message, { output: process.stderr });
+		process.exitCode = 2;
+	}
+	return false;
+}
+function usage(options) {
+	if (options.prepare === options.resume || options.prepare && (options.capability || options.reviewDigest || options.accountAdmission) || options.accountAdmission && options.capability !== void 0 || options.resume && !options.reviewDigest || options.resume && (options.json || !process.stderr.isTTY)) return reportUsageError(options, "Use --prepare first, then review its device, current Identity, capture counts and digest. Resume interactively with --resume --review-digest; use either --capability for operator admission or --account-admission for signed-in account admission, never both.");
+	if (options.capability !== void 0 && !/^[A-Za-z0-9._-]{1,512}$/.test(options.capability)) return reportUsageError(options, "Supply --capability exactly as issued, without whitespace or unsupported characters, and at most 512 characters. The prepared attempt has not been consumed.");
+	if (options.reviewDigest !== void 0 && !/^[0-9a-f]{64}$/.test(options.reviewDigest)) return reportUsageError(options, "Supply --review-digest as the exact 64-character lowercase hexadecimal digest from --prepare. Enrollment has not started.");
+	return environmentUsage(options);
+}
+function environmentUsage(options) {
+	const overrides = [
+		"CODEMEM_SYNC_COORDINATOR_URL",
+		"CODEMEM_SYNC_COORDINATOR_GROUP",
+		"CODEMEM_SYNC_COORDINATOR_GROUPS",
+		"CODEMEM_WORKSPACE_ID",
+		"CODEMEM_ACTOR_ID",
+		"CODEMEM_DEVICE_ID",
+		"CODEMEM_ACTOR_DISPLAY_NAME"
+	].filter((name) => process.env[name] !== void 0);
+	if (overrides.length) return reportUsageError(options, `Unset ${overrides.join(" and ")} before owner enrollment. Use --coordinator and the group argument, or the selected config; environment overrides cannot be adopted safely.`);
+	if (process.env.CODEMEM_SYNC_KEY_STORE?.trim().toLowerCase() === "keychain") return reportUsageError(options, "CODEMEM_SYNC_KEY_STORE=keychain is not supported for owner enrollment. Keep signing keys unchanged; select a supported existing file-key profile.");
+	return true;
+}
+function coordinatorOriginUsage(options, value) {
+	if (typeof value !== "string") return reportUsageError(options, "Set sync_coordinator_url to a valid HTTPS origin string before owner enrollment.");
+	try {
+		const url = new URL(value);
+		if (value.trim() === value && url.protocol === "https:" && !url.username && !url.password && (value === url.origin || value === `${url.origin}/`)) return true;
+	} catch {}
+	return reportUsageError(options, "Set --coordinator or sync_coordinator_url to an HTTPS origin without credentials, paths, query strings, fragments, or surrounding whitespace.");
+}
+function groupUsage(options, groupId) {
+	if (groupId.length > 0 && groupId.length <= 256 && groupId.trim() === groupId && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(groupId)) return true;
+	return reportUsageError(options, "Use a nonempty group ID of at most 256 characters, without surrounding whitespace or control characters.");
+}
+function pathEnvironmentUsage(options, selected) {
+	for (const [name, path, flag] of [
+		[
+			"CODEMEM_CONFIG",
+			selected.config,
+			"--config"
+		],
+		[
+			"CODEMEM_DB",
+			selected.db,
+			"--db-path"
+		],
+		[
+			"CODEMEM_KEYS_DIR",
+			selected.keys,
+			"--keys-dir"
+		]
+	]) {
+		const selectedPath = normalizeEnrollmentPath(name, path);
+		const override = normalizeEnrollmentPath(name, name === "CODEMEM_KEYS_DIR" ? process.env[name]?.trim() || void 0 : process.env[name]);
+		if (selectedPath !== void 0 && override !== void 0 && resolve(selectedPath) !== resolve(override)) return reportUsageError(options, `Unset ${name} or make it match ${flag} before owner enrollment. Conflicting profile paths cannot be adopted safely.`);
+	}
+	return true;
+}
+function normalizeEnrollmentPath(name, path) {
+	if (path === void 0) return void 0;
+	if (name === "CODEMEM_KEYS_DIR") return path;
+	const value = name === "CODEMEM_CONFIG" ? path.trim() : path;
+	return value ? expandUserPath(value) : void 0;
+}
+function resolveEnrollmentProfile(options) {
+	const configPath = resolveCodememConfigPath(options.config, "write").resolved.path;
+	const config = readCodememConfigFileAtPath(configPath);
+	if (config.sync_coordinator_url !== void 0 && !coordinatorOriginUsage(options, config.sync_coordinator_url)) return null;
+	const coordinatorUrl = options.coordinator ?? readCoordinatorSyncConfig(config).syncCoordinatorUrl;
+	if (!coordinatorUrl) {
+		reportUsageError(options, "Set --coordinator to your coordinator HTTPS URL, or set sync_coordinator_url in the selected config.");
+		return null;
+	}
+	if (!coordinatorOriginUsage(options, coordinatorUrl)) return null;
+	const dbPath = resolveDbPath(resolveDbOpt(options));
+	const keysDir = options.keysDir ?? (process.env.CODEMEM_KEYS_DIR?.trim() || void 0) ?? dirname(resolveKeyPaths()[0]);
+	if (!pathEnvironmentUsage(options, {
+		config: configPath,
+		db: dbPath,
+		keys: keysDir
+	})) return null;
+	return {
+		configPath,
+		coordinatorUrl,
+		dbPath,
+		keysDir
+	};
+}
+async function enroll(groupId, options) {
+	if (!usage(options)) return;
+	if (!groupUsage(options, groupId)) return;
+	if (!pathEnvironmentUsage(options, {
+		config: options.config,
+		db: resolveDbOpt(options),
+		keys: options.keysDir
+	})) return;
+	const controller = new AbortController();
+	const stop = () => controller.abort();
+	process.once("SIGINT", stop);
+	process.once("SIGTERM", stop);
+	try {
+		if (!options.json) p.log.warn(CAPTURE_WARNING, { output: process.stderr });
+		const profile = resolveEnrollmentProfile(options);
+		if (!profile) return;
+		showResult(await enrollOwnerProfile({
+			...profile,
+			groupId,
+			stateDir: options.stateDir ?? join(dirname(profile.dbPath), "owner-enrollment"),
+			mode: options.prepare ? "prepare" : "resume",
+			...admissionOptions(options),
+			capability: options.capability,
+			reviewedDigest: options.reviewDigest,
+			signal: controller.signal
+		}), options);
+	} catch (error) {
+		const safe = error instanceof OwnerProfileEnrollmentError ? new OwnerProfileEnrollmentError(error.code) : new OwnerProfileEnrollmentError("review_required");
+		const message = safe.message;
+		if (options.json) emitJsonError(safe.code, message);
+		else {
+			p.log.error(message, { output: process.stderr });
+			process.exitCode = 1;
+		}
+	} finally {
+		process.removeListener("SIGINT", stop);
+		process.removeListener("SIGTERM", stop);
+	}
+}
+function showResult(result, options) {
+	if (options.json) {
+		process.stdout.write(`${JSON.stringify({
+			...result,
+			warning: CAPTURE_WARNING
+		})}\n`);
+		return;
+	}
+	if (result.kind === "prepared") {
+		p.log.message(`Current Identity: ${result.review.actorId}\nDevice: ${result.review.deviceId}\nPublic key: ${result.review.publicKey}\nCapture: ${result.review.captureId ?? "none"} (${result.review.captureAssociation})\nOwn local memories: ${result.review.localMemoryCount}\nForeign rows retained without new access: ${result.review.retainedForeignMemoryCount}\nReview digest: ${result.reviewDigest}`, { output: process.stderr });
+		p.log.message(`Private request file for operator admission or upload during --resume --account-admission: ${result.requestFile}`, { output: process.stderr });
+		p.log.warn("Only the current Identity/device assignment will change. Signing keys, memory authorship and history stay unchanged; no membership is inferred.", { output: process.stderr });
+		return;
+	}
+	p.log.success(`Verified coordinator Identity: ${result.identityId}\nOwner binding: ${result.bindingId}`, { output: process.stderr });
+}
+function buildCoordinatorEnrollOwnerCommand() {
+	const command = new Command("enroll-owner").configureHelp(helpStyle).description("Review and enroll this existing profile's device owner").argument("<group>", "group id").option("-u, --coordinator <url>", "coordinator HTTPS origin (defaults to config)").option("--keys-dir <path>", "existing signing-key directory").option("-s, --state-dir <path>", "private retained-request directory").option("--prepare", "save a reviewed request for operator admission").option("--resume", "resume the saved request or config-only adoption").option("--capability <token>", "admin-issued capability for this exact start").option("--account-admission", "use signed-in account admission with --resume only").option("-v, --review-digest <digest>", "explicitly approve the prepared profile review");
+	addDbOption(command);
+	addConfigOption(command);
+	addJsonOption(command);
+	command.action(enroll);
+	return command;
+}
+//#endregion
+//#region src/commands/coordinator-grant-identity-group.ts
+function failure$3(options, message, exitCode = 1) {
+	if (options.json) {
+		emitJsonError("identity_group_grant_unavailable", message, exitCode);
+		return;
+	}
+	p.log.error(message, { output: process.stderr });
+	process.exitCode = exitCode;
+}
+function grantErrorMessage(error) {
+	if (error instanceof RemoteCoordinatorRequestError) {
+		if (error.status === 401 || error.status === 403) return "Coordinator refused the configured admin credential. Ask the operator to check it; do not pass credentials on the command line.";
+		if (error.code === "invalid_grant_input") return "Coordinator rejected the reference. Use the stored controller attestation reference returned by device-owner review.";
+		if (error.code === "grant_authority_unavailable") return "The stored review cannot authorize this grant. Ask the operator to check current enrollment, review revocation, and group status; do not edit the database.";
+		if (error.status === 429 || error.code === "rate_limited") return "Coordinator rate limit reached. Wait before previewing and confirming again.";
+		if (error.status === 404) return "This coordinator does not support the grant endpoint. Ask the operator to check its deployment.";
+	}
+	return "Transport grant could not be confirmed. Its outcome may be unknown; check coordinator setup and the stored review before retrying. No local profile was changed.";
+}
+function configuredTarget(options) {
+	const config = options.config ? readCodememConfigFileAtPath(options.config) : readCodememConfigFile();
+	const sync = readCoordinatorSyncConfig(config);
+	return {
+		remoteUrl: normalizeCoordinatorAccountLinkOrigin(sync.syncCoordinatorUrl),
+		adminSecret: sync.syncCoordinatorAdminSecret,
+		timeoutS: Math.max(1, sync.syncCoordinatorTimeoutS)
+	};
+}
+async function confirmGrant(request, options) {
+	const approved = await p.confirm({
+		message: "Issue the reviewed Identity's transport enrollment grant?",
+		initialValue: false,
+		output: process.stderr
+	});
+	if (p.isCancel(approved) || approved !== true) {
+		p.log.info("Nothing changed.", { output: process.stderr });
+		return;
+	}
+	const current = configuredTarget(options);
+	if (current.remoteUrl !== request.remoteUrl || current.adminSecret !== request.adminSecret) return failure$3(options, "Coordinator configuration changed. Nothing changed; preview again.");
+	const result = await coordinatorGrantIdentityGroupAction(request);
+	p.log.success(`Transport enrollment grant ${result.kind}: coordinator ${result.grant.coordinator_id}; Identity ${result.grant.identity_id}; group ${result.grant.group_id}. No Team/Project access or local profile changes.`, { output: process.stderr });
+}
+async function grantIdentityGroup(attestationId, options) {
+	try {
+		if (!isCoordinatorControllerAttestationReference(attestationId)) return failure$3(options, "Use a stored controller-v1: reference followed by exactly 64 lowercase hexadecimal characters.", 2);
+		const target = configuredTarget(options);
+		if (!target.remoteUrl) return failure$3(options, "Configure a coordinator HTTPS origin without credentials, path, query, or fragment (HTTP only on literal loopback). Nothing changed.", 2);
+		if (!target.adminSecret) return failure$3(options, "Ask the coordinator operator to configure the existing admin credential. Nothing changed.");
+		const preview = {
+			state: "preview",
+			coordinator_url: target.remoteUrl,
+			attestation_id: attestationId,
+			unchanged: true,
+			eligibility_checked: false,
+			message: "Explicit transport enrollment grant only, not Team/Project access. The server derives Identity and group from the stored review. No Google flow or local profile changes. Run in a terminal without --json to confirm."
+		};
+		if (options.json) {
+			process.stdout.write(`${JSON.stringify(preview)}\n`);
+			return;
+		}
+		p.log.info(`Coordinator: ${target.remoteUrl}\nController attestation: ${attestationId}\n${preview.message}\nThis is a local request preview, not a check of server eligibility.`, { output: process.stderr });
+		if (!process.stdin.isTTY || !process.stderr.isTTY) return;
+		await confirmGrant({
+			...target,
+			remoteUrl: target.remoteUrl,
+			attestationId
+		}, options);
+	} catch (error) {
+		failure$3(options, grantErrorMessage(error));
+	}
+}
+function buildCoordinatorGrantIdentityGroupCommand() {
+	const command = new Command("grant-identity-group").configureHelp(helpStyle).description("Preview and confirm an explicit transport enrollment grant").argument("<attestation-id>", "stored controller attestation reference");
+	addConfigOption(command);
+	addDbOption(command);
+	addJsonOption(command);
+	command.action(grantIdentityGroup);
+	return command;
+}
+//#endregion
+//#region src/commands/coordinator-link-account.ts
+function reportLinkFailure(error, coordinatorOrigin) {
+	const message = error instanceof CoordinatorAccountLinkError ? error.message : "Account linking could not finish. Check your existing device setup and coordinator configuration, then try again.";
+	p.log.error(message, { output: process.stderr });
+	if (!(error instanceof CoordinatorAccountLinkError)) return;
+	if (error.code !== "link_conflict") return;
+	let guidance = "Replacing or removing coordinator account links is not supported. ";
+	if (coordinatorOrigin) {
+		const signInUrl = new URL("/auth/sign-in", coordinatorOrigin).href;
+		guidance += `If this Google account already belongs to the intended coordinator Identity, sign in at ${signInUrl}. Otherwise, ask your coordinator operator.`;
+	} else guidance += "Ask your coordinator operator.";
+	p.log.message(guidance, { output: process.stderr });
+}
+function showPrivateBrowserLink(privateUrl) {
+	p.log.warn("Keep this browser link private. Open it to review account linking, then return to the coordinator tab to finish.", { output: process.stderr });
+	p.log.message(privateUrl, { output: process.stderr });
+}
+function requireInteractive(options) {
+	if (options.json) {
+		emitJsonError("interactive_flow_only", "Account linking is interactive. Run without --json and keep the browser link private.", 2);
+		return false;
+	}
+	if (!process.stderr.isTTY) {
+		p.log.error("Account linking requires a terminal. Run this command interactively and keep the browser link private.", { output: process.stderr });
+		process.exitCode = 2;
+		return false;
+	}
+	return true;
+}
+function readLinkConfiguration(options) {
+	const config = options.config ? readCodememConfigFileAtPath(options.config) : readCodememConfigFile();
+	const coordinatorUrl = normalizeCoordinatorAccountLinkOrigin(options.coordinator ?? readCoordinatorSyncConfig(config).syncCoordinatorUrl);
+	if (!coordinatorUrl || options.loopbackHost !== "127.0.0.1" && options.loopbackHost !== "::1") return null;
+	return {
+		config,
+		coordinatorUrl,
+		loopbackHost: options.loopbackHost
+	};
+}
+function readLinkProfile(options, selected) {
+	try {
+		const dbPath = resolveDbPath(resolveDbOpt(options));
+		const before = statSync(dbPath, { bigint: true });
+		const device = readAccountLinkDevice(dbPath);
+		const after = statSync(dbPath, { bigint: true });
+		const override = process.env.CODEMEM_DEVICE_ID?.trim() || void 0;
+		if (!before.isFile() || before.dev !== after.dev || before.ino !== after.ino || override !== void 0 && override !== device.deviceId) throw new CoordinatorAccountLinkError("device_unavailable");
+		let actor = selected.config.actor_id;
+		if (Object.hasOwn(process.env, "CODEMEM_ACTOR_ID")) actor = process.env.CODEMEM_ACTOR_ID;
+		const identityId = (typeof actor === "string" ? actor.trim() : "") || `local:${device.deviceId}`;
+		return {
+			dbPath,
+			keysDir: process.env.CODEMEM_KEYS_DIR?.trim() || void 0,
+			coordinatorUrl: selected.coordinatorUrl,
+			expectedIdentityId: identityId,
+			deviceId: device.deviceId,
+			fingerprint: device.fingerprint,
+			fileIdentity: {
+				dev: after.dev.toString(),
+				ino: after.ino.toString()
+			}
+		};
+	} catch {
+		throw new CoordinatorAccountLinkError("device_unavailable");
+	}
+}
+function profileMatches(options, snapshot) {
+	const selected = readLinkConfiguration(options);
+	return selected !== null && JSON.stringify(readLinkProfile(options, selected)) === snapshot;
+}
+function eligibleStatus(remote, identityId) {
+	if (remote.kind !== "status") {
+		if (remote.kind === "unavailable" && remote.code === "coordinator_auth_schema_upgrade_required") throw new CoordinatorAccountLinkError("schema_upgrade_required");
+		throw new CoordinatorAccountLinkError("invalid_response");
+	}
+	const status = remote.status;
+	if (status.state === "conflict" || status.state === "revoked") throw new CoordinatorAccountLinkError("link_conflict");
+	if (status.state === "review_required") throw new CoordinatorAccountLinkError("review_required");
+	if (status.identityId !== identityId) throw new CoordinatorAccountLinkError("identity_mismatch");
+	return status;
+}
+async function linkAccount(group, options) {
+	if (!requireInteractive(options)) return;
+	const controller = new AbortController();
+	const stop = () => controller.abort();
+	process.once("SIGINT", stop);
+	process.once("SIGTERM", stop);
+	let coordinatorOrigin = null;
+	try {
+		const selected = readLinkConfiguration(options);
+		if (!selected) {
+			p.log.error("Set --coordinator to your coordinator HTTPS origin and use --loopback-host 127.0.0.1 or ::1.", { output: process.stderr });
+			process.exitCode = 2;
+			return;
+		}
+		const { coordinatorUrl } = selected;
+		coordinatorOrigin = coordinatorUrl;
+		const profile = readLinkProfile(options, selected);
+		const status = eligibleStatus(await readCoordinatorAccountLinkStatus({
+			...profile,
+			coordinatorUrl,
+			identityId: profile.expectedIdentityId,
+			groupId: group,
+			signal: controller.signal
+		}), profile.expectedIdentityId);
+		if (status.state === "linked") {
+			p.log.success("This Identity is already linked. No account-link request was started.", { output: process.stderr });
+			return;
+		}
+		const snapshot = JSON.stringify(profile);
+		const result = await linkCoordinatorAccount({
+			...profile,
+			groupId: group,
+			coordinatorUrl,
+			expectedAuthority: status.authority,
+			expectedCoordinatorId: status.coordinatorId,
+			assertCurrentContext: () => profileMatches(options, snapshot),
+			loopbackHost: selected.loopbackHost,
+			signal: controller.signal,
+			onBrowserStart: showPrivateBrowserLink
+		});
+		p.log.success(`Coordinator account linked to coordinator Identity ${result.identityId}. Your local Identity has not changed.`, { output: process.stderr });
+	} catch (error) {
+		reportLinkFailure(error, coordinatorOrigin);
+		process.exitCode = 1;
+	} finally {
+		process.removeListener("SIGINT", stop);
+		process.removeListener("SIGTERM", stop);
+	}
+}
+function buildCoordinatorLinkAccountCommand() {
+	const command = new Command("link-account").configureHelp(helpStyle).description("Link a coordinator account to your existing Identity").argument("<group>", "group id").option("-u, --coordinator <url>", "coordinator HTTPS origin (defaults to saved config)").option("-l, --loopback-host <host>", "literal loopback host", "127.0.0.1");
+	addDbOption(command);
+	addConfigOption(command);
+	addJsonOption(command);
+	command.action(linkAccount);
+	return command;
+}
+//#endregion
+//#region src/commands/coordinator-qualify-owner.ts
+var isAttestation = (value) => typeof value === "string" && /^controller-v1:[a-f0-9]{64}$/u.test(value);
+var isHash$1 = (value) => typeof value === "string" && /^[a-f0-9]{64}$/u.test(value);
+function isRef(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+function setup$1(options) {
+	const config = options.config ? readCodememConfigFileAtPath(options.config) : readCodememConfigFile();
+	const sync = readCoordinatorSyncConfig(config);
+	const remoteUrl = normalizeCoordinatorAccountLinkOrigin(sync.syncCoordinatorUrl);
+	if (!remoteUrl || !sync.syncCoordinatorAdminSecret) throw new Error("configuration_unavailable");
+	return {
+		remoteUrl,
+		adminSecret: sync.syncCoordinatorAdminSecret,
+		timeoutS: Math.max(1, sync.syncCoordinatorTimeoutS)
+	};
+}
+function parsePreview$1(reply, attestationId) {
+	if (reply.state !== "ready" || reply.attestation_id !== attestationId || !isHash$1(reply.evidence_digest) || !isHash$1(reply.fingerprint) || ![
+		"coordinator_id",
+		"review_receipt_id",
+		"link_id",
+		"claim_id",
+		"identity_id",
+		"group_id",
+		"device_id"
+	].every((key) => isRef(reply[key]))) throw new Error("invalid_preview");
+	return {
+		state: "ready",
+		attestation_id: attestationId,
+		evidence_digest: reply.evidence_digest,
+		coordinator_id: reply.coordinator_id,
+		review_receipt_id: reply.review_receipt_id,
+		link_id: reply.link_id,
+		claim_id: reply.claim_id,
+		identity_id: reply.identity_id,
+		group_id: reply.group_id,
+		device_id: reply.device_id,
+		fingerprint: reply.fingerprint
+	};
+}
+var QUALIFICATION_DENIAL_CODES = [
+	"invalid_input",
+	"preview_changed",
+	"qualification_conflict",
+	"unavailable"
+];
+function failure$2(options, error, message, exitCode = 1) {
+	if (options.json) return emitJsonError(error, message, exitCode);
+	p.log.error(message, { output: process.stderr });
+	process.exitCode = exitCode;
+}
+function sameConfiguration$1(options, request) {
+	try {
+		const current = setup$1(options);
+		return current.remoteUrl === request.remoteUrl && current.adminSecret === request.adminSecret;
+	} catch {
+		return false;
+	}
+}
+async function confirmQualification(options, request, preview, stage) {
+	const approved = await p.confirm({
+		message: "Allow this linked account to enroll new devices under this Identity?",
+		initialValue: false,
+		output: process.stderr
+	});
+	if (p.isCancel(approved) || !approved) {
+		p.log.info("Nothing changed.", { output: process.stderr });
+		return;
+	}
+	if (!sameConfiguration$1(options, request)) return failure$2(options, "qualification_configuration_changed", "Operator configuration changed. Preview again before confirming.");
+	stage.onDispatch();
+	const result = await coordinatorQualifyOwnerAction({
+		...request,
+		confirmEvidenceDigest: preview.evidence_digest
+	});
+	if (result.state !== "created" && result.state !== "existing" || !isRef(result.qualification_id) || result.attestation_id !== request.attestationId || result.coordinator_id !== preview.coordinator_id || result.evidence_digest !== preview.evidence_digest) throw new Error("invalid_commit_response");
+	p.log.success("Linked account qualified for device enrollment. Team and Project access are unchanged.", { output: process.stderr });
+}
+async function qualifyOwner(attestationId, options) {
+	let writeAttempted = false;
+	try {
+		if (!isAttestation(attestationId)) return failure$2(options, "qualification_invalid_input", "Use the exact controller-v1 reference from a real device-owner review.", 2);
+		const request = {
+			...setup$1(options),
+			attestationId
+		};
+		const preview = parsePreview$1(await coordinatorQualifyOwnerAction(request), attestationId);
+		if (options.json) {
+			process.stdout.write(`${JSON.stringify({
+				preview,
+				network_request: true,
+				unchanged: true
+			})}\n`);
+			return;
+		}
+		p.log.info(`Network preview from ${preview.coordinator_id}\nIdentity: ${preview.identity_id}\nLinked account reference: ${preview.link_id}\nDevice: ${preview.device_id}; fingerprint: ${preview.fingerprint}\nReview: ${preview.attestation_id}\nReceipt: ${preview.review_receipt_id}\nClaim: ${preview.claim_id}; group: ${preview.group_id}`, { output: process.stderr });
+		p.log.warn("Independently verify the real operator review. Qualification permits new devices under this Identity; an independently trusted transport-group grant is still separate. This does not create a Team, issue a grant, or rewrite a device claim.", { output: process.stderr });
+		if (!process.stdin.isTTY || !process.stderr.isTTY) {
+			p.log.info("Preview only; no qualification issued. Use a terminal without --json to confirm.", { output: process.stderr });
+			return;
+		}
+		await confirmQualification(options, request, preview, { onDispatch: () => {
+			writeAttempted = true;
+		} });
+	} catch (error) {
+		if (error instanceof RemoteCoordinatorRequestError && error.status === 409 && QUALIFICATION_DENIAL_CODES.includes(error.code)) return failure$2(options, "qualification_rejected", "Qualification denied: evidence is invalid, changed, was revoked, conflicts, or is unavailable. Preview again; no automatic retry.");
+		let message = "Qualification server unavailable or preview invalid. Ask the coordinator operator to check the configured Worker's browser authentication and owner-enrollment settings, required migrations 0035 and 0036, and the saved trusted HTTPS coordinator origin and admin credential.";
+		if (writeAttempted) message = "Qualification outcome is unknown. It may have committed; do not assume rollback or retry automatically. Ask the coordinator operator to inspect the outcome.";
+		failure$2(options, writeAttempted ? "qualification_outcome_unknown" : "qualification_unavailable", message);
+	}
+}
+function buildCoordinatorQualifyOwnerCommand() {
+	const command = new Command("qualify-owner").configureHelp(helpStyle).description("Preview and confirm linked-account device enrollment permission").argument("<attestation-id>", "controller-v1 reference from a real operator review");
+	addConfigOption(command);
+	addJsonOption(command);
+	command.action(qualifyOwner);
+	return command;
+}
+//#endregion
+//#region src/commands/coordinator-review-device-owner.ts
+var REVIEW_REASONS = [
+	"group_unavailable",
+	"enrollment_unavailable",
+	"key_mismatch",
+	"enrollment_identity_mismatch",
+	"invite_identity_mismatch",
+	"invite_evidence_invalid"
+];
+function validId$1(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+function isHash(value) {
+	return typeof value === "string" && value.length === 64 && /^[a-f0-9]{64}$/.test(value);
+}
+function reviewErrorMessage(error) {
+	if (error instanceof RemoteCoordinatorRequestError) {
+		if (error.code === "review_stale") return "Evidence changed since the preview. Nothing changed; run the review again.";
+		if (error.code === "already_reviewed_or_needs_review") return "This device already has a reviewed owner, or needs a separate review. Nothing changed.";
+		if (error.code === "needs_review") return "Coordinator ownership evidence needs review. Nothing changed; ask the coordinator operator.";
+	}
+	return "Device owner review could not finish. Check the existing device, admin credential, and coordinator setup; preview again before retrying.";
+}
+function failure$1(options, message, exitCode = 1) {
+	if (options.json) {
+		emitJsonError("owner_review_unavailable", message, exitCode);
+		return;
+	}
+	p.log.error(message, { output: process.stderr });
+	process.exitCode = exitCode;
+}
+function localOptions(options) {
+	const config = options.config ? readCodememConfigFileAtPath(options.config) : readCodememConfigFile();
+	const sync = readCoordinatorSyncConfig(config);
+	let actorId;
+	let identitySource = "config";
+	if (Object.hasOwn(process.env, "CODEMEM_ACTOR_ID")) {
+		actorId = process.env.CODEMEM_ACTOR_ID?.trim();
+		identitySource = "env";
+	} else if (typeof config.actor_id === "string") actorId = config.actor_id.trim();
+	return {
+		local: {
+			dbPath: resolveDbPath(resolveDbOpt(options)),
+			actorId,
+			identitySource,
+			deviceIdOverride: process.env.CODEMEM_DEVICE_ID?.trim()
+		},
+		remoteUrl: normalizeCoordinatorAccountLinkOrigin(options.coordinator ?? sync.syncCoordinatorUrl),
+		adminSecret: sync.syncCoordinatorAdminSecret,
+		timeoutS: Math.max(1, sync.syncCoordinatorTimeoutS)
+	};
+}
+function displayLocal(evidence) {
+	const device = evidence.device;
+	return {
+		...evidence,
+		device: device ? {
+			deviceId: device.deviceId,
+			fingerprint: device.fingerprint,
+			label: device.label
+		} : null
+	};
+}
+function showLocal(evidence) {
+	const count = (value) => value === null ? "unknown" : String(value);
+	const device = evidence.device;
+	const identity = evidence.identity;
+	p.log.message([
+		`Device: ${device?.label ?? device?.deviceId ?? "unavailable"}`,
+		`Device ID: ${device?.deviceId ?? "unknown"}; fingerprint: ${device?.fingerprint ?? "unknown"}`,
+		`Identity: ${identity?.label ?? identity?.identityId ?? "unavailable"} (${identity?.source ?? "unknown"})`,
+		`Identity ID: ${identity?.identityId ?? "unknown"}`,
+		`Memory authors: current ${count(evidence.memoryCounts.current)}, other ${count(evidence.memoryCounts.others)}, unknown ${count(evidence.memoryCounts.unknown)} — unchanged`,
+		`Active Teams: ${count(evidence.teamCount)}; direct Projects: ${count(evidence.projectCount)} — unchanged`,
+		"This review does not move memories or change access. Google account linking is a separate step."
+	].join("\n"), { output: process.stderr });
+}
+function validInviteCount(reply, invites) {
+	return invites.length <= 10 && Number.isSafeInteger(reply.reviewed_invite_count) && reply.reviewed_invite_count >= invites.length;
+}
+function validInviteRef(invite) {
+	return !!invite && validId$1(invite.invite_id) && (invite.kind === "team_member" || invite.kind === "add_device");
+}
+function parsePreview(payload, request) {
+	if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("invalid_preview");
+	const reply = payload;
+	const enrollment = reply.enrollment;
+	const invites = reply.reviewed_invites;
+	if (reply.state !== "ready" && reply.state !== "needs_review" || !validId$1(reply.coordinator_id) || !Array.isArray(reply.reasons) || !reply.reasons.every((reason) => typeof reason === "string" && REVIEW_REASONS.includes(reason)) || !Array.isArray(invites) || !validInviteCount(reply, invites) || !invites.every(validInviteRef)) throw new Error("invalid_preview");
+	if (enrollment !== null && (!enrollment || enrollment.device_id !== request.deviceId || !isHash(enrollment.fingerprint) || !["none", "matches"].includes(enrollment.identity_label))) throw new Error("invalid_preview");
+	if (reply.state === "ready" && (!enrollment || enrollment.device_id !== request.deviceId || enrollment.fingerprint !== request.fingerprint || !["none", "matches"].includes(enrollment.identity_label) || !isHash(reply.evidence_digest) || reply.reasons.length)) throw new Error("invalid_preview");
+	return {
+		state: reply.state,
+		coordinator_id: reply.coordinator_id,
+		reasons: reply.reasons,
+		evidence_digest: reply.state === "ready" ? reply.evidence_digest : void 0,
+		enrollment: enrollment ? {
+			device_id: enrollment.device_id,
+			fingerprint: enrollment.fingerprint,
+			display_name: null,
+			identity_label: enrollment.identity_label
+		} : null,
+		reviewed_invites: invites.map((invite) => ({
+			invite_id: invite.invite_id,
+			kind: invite.kind
+		})),
+		reviewed_invite_count: reply.reviewed_invite_count
+	};
+}
+function sameLocalOwner(before, after) {
+	return after.state === "ready" && before.ownershipRecords.actorPresent === after.ownershipRecords.actorPresent && before.ownershipRecords.deviceAssignmentPresent === after.ownershipRecords.deviceAssignmentPresent && before.device?.deviceId === after.device?.deviceId && before.device?.publicKey === after.device?.publicKey && before.device?.fingerprint === after.device?.fingerprint && before.identity?.identityId === after.identity?.identityId && before.identity?.source === after.identity?.source;
+}
+async function confirmReview(group, options, evidence, request, preview) {
+	if (!process.stdin.isTTY || !process.stderr.isTTY) return failure$1(options, "Preview only. Run in a terminal without --json to confirm this review.", 2);
+	const approved = await p.confirm({
+		message: "Review this device owner?",
+		initialValue: false,
+		output: process.stderr
+	});
+	if (p.isCancel(approved) || !approved) {
+		p.log.info("Nothing changed.", { output: process.stderr });
+		return;
+	}
+	const current = localOptions(options);
+	if (current.remoteUrl !== request.remoteUrl || !sameLocalOwner(evidence, readCoordinatorOwnerReviewLocalEvidence(current.local))) return failure$1(options, "Your device or Identity changed. Nothing changed on the coordinator; preview again.");
+	const result = await coordinatorAuthControllerReviewAction({
+		...request,
+		confirmEvidenceDigest: preview.evidence_digest
+	});
+	if (result.state !== "created" && result.state !== "existing" || typeof result.attestation_id !== "string" || result.attestation_id.length !== 78 || !/^controller-v1:[a-f0-9]{64}$/.test(result.attestation_id) || result.coordinator_id !== preview.coordinator_id || result.group_id !== group || result.device_id !== request.deviceId || result.identity_id !== request.identityId || result.fingerprint !== request.fingerprint || typeof result.created_at !== "string") throw new Error("invalid_commit_response");
+	p.log.success("Device owner reviewed. Memories and access are unchanged.", { output: process.stderr });
+	p.log.info(`Controller attestation reference: ${result.attestation_id}\nKeep this noncredential reference for a separate, explicit operator-issued transport group grant. This review does not issue that grant or grant Team/Project access.`, { output: process.stderr });
+	if (showTargetedLinkFollowUp(options)) return;
+	showLinkFollowUp(group);
+}
+function showLinkFollowUp(group) {
+	if (group.includes("\\")) {
+		p.log.info(`Next, run codemem coordinator link-account with group ID ${JSON.stringify(group)}. Quote the ID for your shell.`, { output: process.stderr });
+		return;
+	}
+	const quotedGroup = `'${group.replaceAll("'", "'\\''")}'`;
+	p.log.info(`Next, link your Google account separately: codemem coordinator link-account ${quotedGroup}`, { output: process.stderr });
+}
+function showTargetedLinkFollowUp(options) {
+	if (!options.coordinator && !options.config && !resolveDbOpt(options)) return false;
+	p.log.info("Next, link your Google account separately with codemem coordinator link-account for this group. Reuse the same --coordinator, --config, and --db-path options from this review.", { output: process.stderr });
+	return true;
+}
+function showLocalStop(evidence, options) {
+	if (options.json) {
+		process.stdout.write(`${JSON.stringify({
+			...displayLocal(evidence),
+			unchanged: true,
+			error: "needs_review",
+			message: "Local device ownership needs review. Nothing changed."
+		})}\n`);
+		return;
+	}
+	p.log.warn(`Review stopped: ${evidence.reasons.join(", ")}. Nothing changed.`, { output: process.stderr });
+}
+function emitReviewPreview(evidence, preview) {
+	let stopped = {};
+	if (preview.state !== "ready") {
+		stopped = {
+			error: "needs_review",
+			message: "Coordinator device ownership needs review. Nothing changed."
+		};
+		process.exitCode = 1;
+	}
+	process.stdout.write(`${JSON.stringify({
+		local: displayLocal(evidence),
+		review: preview,
+		unchanged: true,
+		...stopped
+	})}\n`);
+}
+async function reviewDeviceOwner(group, options) {
+	try {
+		if (!validId$1(group)) return failure$1(options, "Use a valid coordinator group ID.", 2);
+		const setup = localOptions(options);
+		const evidence = readCoordinatorOwnerReviewLocalEvidence(setup.local);
+		if (!options.json) showLocal(evidence);
+		if (evidence.state !== "ready" || !evidence.device || !evidence.identity) {
+			showLocalStop(evidence, options);
+			process.exitCode = 1;
+			return;
+		}
+		if (!setup.adminSecret) return failure$1(options, "Ask the coordinator operator to configure the existing admin credential. Nothing changed.");
+		if (!setup.remoteUrl) return failure$1(options, "Set --coordinator to a coordinator HTTPS origin (HTTP is allowed only on literal loopback).", 2);
+		const request = {
+			remoteUrl: setup.remoteUrl,
+			adminSecret: setup.adminSecret,
+			timeoutS: setup.timeoutS,
+			groupId: group,
+			deviceId: evidence.device.deviceId,
+			identityId: evidence.identity.identityId,
+			fingerprint: evidence.device.fingerprint
+		};
+		const preview = parsePreview(await coordinatorAuthControllerReviewAction(request), request);
+		if (options.json) {
+			emitReviewPreview(evidence, preview);
+			return;
+		}
+		if (preview.state !== "ready") return failure$1(options, `Coordinator review stopped: ${preview.reasons.join(", ")}. Nothing changed.`);
+		p.log.info(`Coordinator: ${preview.coordinator_id}; reviewed invitations: ${preview.reviewed_invite_count}`, { output: process.stderr });
+		await confirmReview(group, options, evidence, request, preview);
+	} catch (error) {
+		failure$1(options, reviewErrorMessage(error));
+	}
+}
+function buildCoordinatorReviewDeviceOwnerCommand() {
+	const command = new Command("review-device-owner").configureHelp(helpStyle).description("Preview and confirm the owner of your existing device").argument("<group>", "group id").option("-u, --coordinator <url>", "coordinator HTTPS origin (defaults to saved config)");
+	addDbOption(command);
+	addConfigOption(command);
+	addJsonOption(command);
+	command.action(reviewDeviceOwner);
+	return command;
+}
+//#endregion
+//#region src/commands/coordinator-revoke-device.ts
+function validId(value) {
+	return value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
+}
+function setup(options) {
+	const config = options.config ? readCodememConfigFileAtPath(options.config) : readCodememConfigFile();
+	const remoteUrl = normalizeCoordinatorAccountLinkOrigin(config.sync_coordinator_url);
+	const adminSecret = config.sync_coordinator_admin_secret;
+	const timeoutS = config.sync_coordinator_timeout_s ?? 3;
+	if (!remoteUrl || typeof adminSecret !== "string" || !adminSecret.trim() || /[\r\n\0]/u.test(adminSecret) || typeof timeoutS !== "number" || !Number.isFinite(timeoutS) || timeoutS < 1 || timeoutS > 3600) throw new Error("revocation_configuration_unavailable");
+	return {
+		remoteUrl,
+		adminSecret,
+		timeoutS
+	};
+}
+function sameConfiguration(options, request) {
+	try {
+		const current = setup(options);
+		return current.remoteUrl === request.remoteUrl && current.adminSecret === request.adminSecret && current.timeoutS === request.timeoutS;
+	} catch {
+		return false;
+	}
+}
+function failure(options, code, message, exitCode = 1) {
+	if (options.json) {
+		emitJsonError(code, message, exitCode);
+		return;
+	}
+	p.log.error(message, { output: process.stderr });
+	process.exitCode = exitCode;
+}
+var IMPACT = "Across the whole coordinator database: revoke this device ID with ANY key and this canonical key under ANY device ID, in ALL groups. The selected group supplies evidence only. Another device continues only when BOTH its device ID and key differ. No immediate offline enforcement, manual/direct-peer trust revocation, or erasure of remote copies. Account links, sessions, grants, memberships and stored memories are not rewritten.";
+function receiptLabel(value) {
+	return JSON.stringify(value).replace(/[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/gu, (character) => `\\u{${(character.codePointAt(0) ?? 0).toString(16)}}`);
+}
+function receiptJson(result) {
+	return JSON.stringify(result).replace(/[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/gu, (character) => character.split("").map((unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`).join(""));
+}
+async function confirmRevocation(options, request, preview, onDispatch) {
+	const approved = await p.confirm({
+		message: "Revoke BOTH subjects across the whole coordinator database?",
+		initialValue: false,
+		output: process.stderr
+	});
+	if (p.isCancel(approved) || approved !== true) {
+		p.log.info("No revocation requested.", { output: process.stderr });
+		return;
+	}
+	if (!sameConfiguration(options, request)) return failure(options, "revocation_configuration_changed", "Operator configuration changed or is unavailable. No revocation requested; preview again.");
+	const result = await coordinatorRevokeDeviceAction({
+		...request,
+		expectedDigest: preview.expected_digest,
+		expectedContext: {
+			coordinatorId: preview.coordinator_id,
+			keyId: preview.key_id
+		},
+		onDispatch
+	});
+	if (result.state !== "revoked") throw new Error("revocation_response_invalid");
+	process.stdout.write(`${receiptJson(result)}\n`);
+	p.log.success(`Coordinator ${result.coordinator_id}: both whole-database subjects revoked.`, { output: process.stderr });
+	for (const row of result.revocations) p.log.info(`${row.subject_kind}: ${row.subject_value}; retained reference: ${receiptLabel(row.revocation_id)}; created: ${receiptLabel(row.created_at)}`, { output: process.stderr });
+}
+async function revokeDevice(groupId, deviceId, options) {
+	let writeDispatched = false;
+	try {
+		if (!validId(groupId) || !validId(deviceId)) return failure(options, "revocation_invalid_input", "Use exact group and device IDs without whitespace or control characters (maximum 256 characters).", 2);
+		const request = {
+			...setup(options),
+			groupId,
+			deviceId
+		};
+		const preview = await coordinatorRevokeDeviceAction(request);
+		if (preview.state !== "ready") throw new Error("revocation_response_invalid");
+		if (options.json) {
+			process.stdout.write(`${JSON.stringify({
+				preview,
+				network_request: true,
+				unchanged: true,
+				message: IMPACT
+			})}\n`);
+			return;
+		}
+		p.log.info(`Coordinator: ${preview.coordinator_id}\nEvidence group: ${preview.group_id}\nGlobal device ID: ${preview.device_id}\nCanonical key ID: ${preview.key_id}\nScope: ${preview.scope}`, { output: process.stderr });
+		p.log.warn(IMPACT, { output: process.stderr });
+		if (!process.stdin.isTTY || !process.stderr.isTTY) {
+			p.log.info("Network preview only; no revocation requested. Use a terminal without --json to confirm.", { output: process.stderr });
+			return;
+		}
+		await confirmRevocation(options, request, preview, () => {
+			writeDispatched = true;
+		});
+	} catch (error) {
+		if (error instanceof RemoteCoordinatorRequestError && error.status === 409 && (error.code === "revocation_preview_stale" || error.code === "revocation_target_unavailable")) return failure(options, error.code, "Revocation rejected: the target is unavailable or preview evidence changed. Preview again; do not retry automatically.");
+		if (writeDispatched) return failure(options, "revocation_outcome_unknown", "Revocation outcome is unknown. It may have committed; do not assume rollback or retry automatically. Ask the coordinator operator to inspect both retained subjects.");
+		failure(options, "revocation_unavailable", "Revocation preview unavailable or invalid. Check the saved HTTPS origin (HTTP only on literal loopback), operator credential and operator-enabled server context. The CLI does not activate the server. No revocation requested.");
+	}
+}
+function buildCoordinatorRevokeDeviceCommand() {
+	const command = new Command("revoke-device").configureHelp(helpStyle).description("Preview and confirm whole-database device ID and key revocation").argument("<group>", "group supplying current enrollment evidence only").argument("<device>", "device ID to revoke across all groups");
+	addConfigOption(command);
+	addJsonOption(command);
+	command.action(revokeDevice);
+	return command;
+}
+//#endregion
 //#region src/commands/coordinator.ts
 /**
 * Coordinator CLI commands — manage coordinator invites, join requests, and relay server.
@@ -2616,7 +3547,7 @@ function parseOptionalInteger(value, name) {
 }
 function formatImportInviteError(error) {
 	const message = error instanceof Error ? error.message : String(error);
-	const recipientInviteViewerGuidance = "Accept Team/add-device recipient invitations through the Viewer: run `codemem serve`, review the access details, and confirm the invitation there.";
+	const recipientInviteReviewGuidance = "Review this invitation with `codemem coordinator import-invite <invite> --review`, then accept with --reviewed-onboarding-digest <digest> using the same profile and device name. You can also review and accept through the Viewer with `codemem serve`.";
 	switch (message) {
 		case "invite_already_bound": return "This invite was already used. Ask the sender for a new one.";
 		case "invite_expired": return "This invite has expired. Ask the sender for a new one.";
@@ -2631,16 +3562,66 @@ function formatImportInviteError(error) {
 		case "invite_identity_conflict":
 		case "recipient_invite_intent_mismatch":
 		case "recipient_invite_review_unavailable":
-		case "reviewed_onboarding_digest_required": return recipientInviteViewerGuidance;
+		case "reviewed_onboarding_digest_required":
+		case "reviewed_onboarding_stale": return recipientInviteReviewGuidance;
+		case "invite_review_profile_required": return "Invite review needs an initialized device and matching keys. Run `codemem sync pair --payload-only` with the intended --db-path, --config, and CODEMEM_KEYS_DIR first, then review that profile with --keys-dir.";
+		case "recipient_invite_review_required": return "Only Team/add-device recipient invitations need --review. Import this legacy invitation without --review.";
+		case "invite_inspection_transport_failed": return "Could not inspect the invitation at its coordinator. Check network access and use the original coordinator URL; redirects are not accepted.";
+		case "invite_coordinator_conflict": return "This profile already uses another coordinator. Use the intended device profile and review again.";
 		default: return message;
 	}
 }
+function inviteImportProfile(invite, opts) {
+	return {
+		inviteValue: invite,
+		dbPath: resolveDbOpt(opts) ?? null,
+		keysDir: opts.keysDir ?? null,
+		configPath: opts.config ?? null,
+		recipientDisplayName: opts.recipientName?.trim() || null,
+		deviceDisplayName: opts.deviceName?.trim() || null
+	};
+}
+async function acceptInviteWithProfileCheck(profile, reviewedOnboardingDigest) {
+	const digest = reviewedOnboardingDigest?.trim() || null;
+	if (digest) {
+		if ((await coordinatorReviewInviteAction(profile)).reviewed_onboarding_digest !== digest) throw new Error("reviewed_onboarding_stale");
+	}
+	return coordinatorImportInviteAction({
+		...profile,
+		reviewedOnboardingDigest: digest
+	});
+}
+function rejectConflictingInviteReviewOptions(opts) {
+	if (!opts.review || opts.reviewedOnboardingDigest === void 0) return false;
+	const message = "Use --review or --reviewed-onboarding-digest, not both.";
+	if (opts.json) emitJsonError("usage_error", message);
+	else p.log.error(message);
+	process.exitCode = 2;
+	return true;
+}
+function printInviteReview(review, opts) {
+	console.log(JSON.stringify(review, null, 2));
+	if (opts.json) return;
+	p.outro("Review only: no invitation accepted or local profile changed. To accept, rerun with --reviewed-onboarding-digest <digest> and the same profile and device name. A Team recipient display name is cosmetic and may be changed before acceptance.");
+}
 /**
 * Build a fresh coordinator command tree. Each call returns independent
 * Commander instances so the tree can be mounted under multiple parents.
 */
-function buildCoordinatorCommand() {
+function createCoordinatorCommandRoot() {
 	const cmd = new Command("coordinator").configureHelp(helpStyle).description("Manage coordinator invites, join requests, and relay server");
+	cmd.addCommand(buildCoordinatorLinkAccountCommand());
+	cmd.addCommand(buildCoordinatorEnrollOwnerCommand());
+	cmd.addCommand(buildCoordinatorReviewDeviceOwnerCommand());
+	cmd.addCommand(buildCoordinatorQualifyOwnerCommand());
+	cmd.addCommand(buildCoordinatorGrantIdentityGroupCommand());
+	cmd.addCommand(buildCoordinatorRevokeDeviceCommand());
+	cmd.addCommand(buildCoordinatorAuthSchemaCommand());
+	cmd.addCommand(buildCoordinatorAccountSchemaCommand());
+	return cmd;
+}
+function buildCoordinatorCommand() {
+	const cmd = createCoordinatorCommandRoot();
 	const groupCreateCmd = new Command("group-create").configureHelp(helpStyle).description("Create a coordinator group in the local store").argument("<group>", "group id").option("--name <name>", "display name override");
 	addDbOption(groupCreateCmd);
 	addJsonOption(groupCreateCmd);
@@ -3265,20 +4246,19 @@ function buildCoordinatorCommand() {
 		}
 	});
 	cmd.addCommand(createInviteCmd);
-	const importInviteCmd = new Command("import-invite").configureHelp(helpStyle).description("Import a coordinator invite").argument("<invite>", "invite value or link").option("-R, --recipient-name <name>", "recipient Identity display name").option("-N, --device-name <name>", "device display name").option("--keys-dir <path>", "keys directory");
+	const importInviteCmd = new Command("import-invite").configureHelp(helpStyle).description("Import a coordinator invite").argument("<invite>", "invite value or link").option("-R, --recipient-name <name>", "recipient Identity display name").option("-N, --device-name <name>", "device display name").option("--review", "Review recipient access without accepting").option("--reviewed-onboarding-digest <digest>", "Accept the reviewed recipient access").option("--keys-dir <path>", "keys directory");
 	addDbOption(importInviteCmd);
 	addConfigOption(importInviteCmd);
 	addJsonOption(importInviteCmd);
 	importInviteCmd.action(async (invite, opts) => {
 		try {
-			const result = await coordinatorImportInviteAction({
-				inviteValue: invite,
-				dbPath: resolveDbOpt(opts) ?? null,
-				keysDir: opts.keysDir ?? null,
-				configPath: opts.config ?? null,
-				recipientDisplayName: opts.recipientName?.trim() || null,
-				deviceDisplayName: opts.deviceName?.trim() || null
-			});
+			if (rejectConflictingInviteReviewOptions(opts)) return;
+			const profile = inviteImportProfile(invite, opts);
+			if (opts.review) {
+				printInviteReview(await coordinatorReviewInviteAction(profile), opts);
+				return;
+			}
+			const result = await acceptInviteWithProfileCheck(profile, opts.reviewedOnboardingDigest);
 			if (opts.json) {
 				console.log(JSON.stringify(result, null, 2));
 				return;
@@ -4250,11 +5230,11 @@ async function distillAction(opts) {
 		store?.close();
 	}
 }
-var cmd$3 = new Command("distill").configureHelp(helpStyle).description("Mine recurring memories into reviewable context candidates").option("-p, --project <project>", "project identifier (defaults to git repo root)").option("-A, --all-projects", "mine memories across all projects").option("-k, --kind <kind>", "memory kind to mine (repeat or comma-separate)", collectKind, []).option("-m, --min-recurrence <n>", "minimum member count per candidate", "2").option("-l, --limit <n>", "max candidates", "10").option("-e, --explain", "include evidence snippets in human output").option("--include-documented", "include candidates already represented in context files").option("--no-judge", "skip the observer-model worthiness judgment that drops routine-activity clusters").option("-D, --draft", "draft an AGENTS.md rule for the top candidate and show the diff").option("--apply", "write the drafted rule to the target file (implies --draft; prompts to confirm; with --json applies immediately without prompting)");
-addDbOption(cmd$3);
-addJsonOption(cmd$3);
-cmd$3.action(distillAction);
-var distillCommand = cmd$3;
+var cmd$5 = new Command("distill").configureHelp(helpStyle).description("Mine recurring memories into reviewable context candidates").option("-p, --project <project>", "project identifier (defaults to git repo root)").option("-A, --all-projects", "mine memories across all projects").option("-k, --kind <kind>", "memory kind to mine (repeat or comma-separate)", collectKind, []).option("-m, --min-recurrence <n>", "minimum member count per candidate", "2").option("-l, --limit <n>", "max candidates", "10").option("-e, --explain", "include evidence snippets in human output").option("--include-documented", "include candidates already represented in context files").option("--no-judge", "skip the observer-model worthiness judgment that drops routine-activity clusters").option("-D, --draft", "draft an AGENTS.md rule for the top candidate and show the diff").option("--apply", "write the drafted rule to the target file (implies --draft; prompts to confirm; with --json applies immediately without prompting)");
+addDbOption(cmd$5);
+addJsonOption(cmd$5);
+cmd$5.action(distillAction);
+var distillCommand = cmd$5;
 //#endregion
 //#region src/commands/embed.ts
 function parseOptionalPositiveInt(value) {
@@ -4353,12 +5333,12 @@ function invokedAsTopLevelAlias(name, argv = process.argv.slice(2)) {
 }
 //#endregion
 //#region src/commands/export-memories.ts
-function expandUserPath(value) {
+function expandUserPath$1(value) {
 	return value.startsWith("~/") ? join(homedir(), value.slice(2)) : value;
 }
-var cmd$2 = new Command("export-memories").configureHelp(helpStyle).description("Export memories to a JSON file for sharing or backup").argument("<output>", "output file path (use '-' for stdout)").option("--project <project>", "filter by project (defaults to git repo root)").option("--all-projects", "export all projects").option("--include-inactive", "include deactivated memories").option("--since <iso>", "only export memories created after this ISO timestamp");
-addDbOption(cmd$2);
-cmd$2.action((output, opts) => {
+var cmd$4 = new Command("export-memories").configureHelp(helpStyle).description("Export memories to a JSON file for sharing or backup").argument("<output>", "output file path (use '-' for stdout)").option("--project <project>", "filter by project (defaults to git repo root)").option("--all-projects", "export all projects").option("--include-inactive", "include deactivated memories").option("--since <iso>", "only export memories created after this ISO timestamp");
+addDbOption(cmd$4);
+cmd$4.action((output, opts) => {
 	if (output !== "-" && invokedAsTopLevelAlias("export-memories")) emitDeprecationWarning("codemem export-memories", "codemem memory export");
 	const payload = exportMemories({
 		dbPath: resolveDbPath(resolveDbOpt(opts)),
@@ -4372,7 +5352,7 @@ cmd$2.action((output, opts) => {
 		process.stdout.write(text);
 		return;
 	}
-	const outputPath = expandUserPath(output);
+	const outputPath = expandUserPath$1(output);
 	writeFileSync(outputPath, text, "utf8");
 	p.intro("codemem export-memories");
 	p.log.success([
@@ -4384,13 +5364,13 @@ cmd$2.action((output, opts) => {
 	].join("\n"));
 	p.outro("done");
 });
-var exportMemoriesCommand = cmd$2;
+var exportMemoriesCommand = cmd$4;
 //#endregion
 //#region src/commands/import-memories.ts
-var cmd$1 = new Command("import-memories").configureHelp(helpStyle).description("Import memories from an exported JSON file").argument("<inputFile>", "input JSON file (use '-' for stdin)").option("--remap-project <path>", "remap all projects to this path on import").option("--dry-run", "preview import without writing");
-addDbOption(cmd$1);
-addJsonOption(cmd$1);
-cmd$1.action((inputFile, opts) => {
+var cmd$3 = new Command("import-memories").configureHelp(helpStyle).description("Import memories from an exported JSON file").argument("<inputFile>", "input JSON file (use '-' for stdin)").option("--remap-project <path>", "remap all projects to this path on import").option("--dry-run", "preview import without writing");
+addDbOption(cmd$3);
+addJsonOption(cmd$3);
+cmd$3.action((inputFile, opts) => {
 	if (!opts.json && invokedAsTopLevelAlias("import-memories")) emitDeprecationWarning("codemem import-memories", "codemem memory import");
 	let payload;
 	try {
@@ -4451,7 +5431,7 @@ cmd$1.action((inputFile, opts) => {
 	].join("\n"));
 	p.outro("done");
 });
-var importMemoriesCommand = cmd$1;
+var importMemoriesCommand = cmd$3;
 //#endregion
 //#region src/maintenance-worker-runtime.ts
 var defaultLogger = {
@@ -4957,7 +5937,7 @@ function forgetMemoryAction(idStr, opts) {
 	}
 	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
 	try {
-		if (!store.get(memoryId)) {
+		if (!store.forgetForUser(memoryId)) {
 			if (opts.json) emitJsonError("not_found", `Memory ${memoryId} not found`);
 			else {
 				p.log.error(`Memory ${memoryId} not found`);
@@ -4965,7 +5945,6 @@ function forgetMemoryAction(idStr, opts) {
 			}
 			return;
 		}
-		store.forget(memoryId);
 		if (opts.json) console.log(JSON.stringify({
 			id: memoryId,
 			status: "forgotten"
@@ -4980,39 +5959,35 @@ function parseConfidence(value) {
 	if (!Number.isFinite(n)) return .5;
 	return Math.min(1, Math.max(0, n));
 }
-function rollbackManualMemory(store, sessionId, memoryId) {
-	store.db.transaction(() => {
-		const row = store.db.prepare("SELECT import_key FROM memory_items WHERE id = ?").get(memoryId);
-		store.db.prepare("DELETE FROM memory_vectors WHERE memory_id = ?").run(memoryId);
-		store.db.prepare("DELETE FROM memory_file_refs WHERE memory_id = ?").run(memoryId);
-		store.db.prepare("DELETE FROM memory_concept_refs WHERE memory_id = ?").run(memoryId);
-		store.db.prepare("DELETE FROM replication_ops WHERE entity_type = 'memory_item' AND (entity_id = ? OR entity_id = ?)").run(row?.import_key ?? "", String(memoryId));
-		store.db.prepare("DELETE FROM memory_items WHERE id = ?").run(memoryId);
-		store.db.prepare(`DELETE FROM sessions
-				 WHERE id = ?
-				   AND NOT EXISTS (SELECT 1 FROM memory_items WHERE session_id = ?)`).run(sessionId, sessionId);
-	})();
-}
-async function rememberMemoryAction(opts) {
-	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
-	let sessionId = null;
-	try {
-		const project = resolveProject(process.cwd(), opts.project ?? null);
-		sessionId = store.startSession({
+function createManualMemory(store, opts) {
+	const project = resolveProject(process.cwd(), opts.project ?? null);
+	const createdMemories = [];
+	return store.db.transaction(() => {
+		const newSessionId = store.startSession({
 			cwd: process.cwd(),
 			project,
 			user: process.env.USER ?? "unknown",
 			toolVersion: "manual",
 			metadata: { manual: true }
 		});
-		const memId = store.remember(sessionId, opts.kind, opts.title, opts.body, parseConfidence(opts.confidence), opts.tags);
-		if (!store.get(memId)) {
-			await store.flushPendingVectorWrites();
-			rollbackManualMemory(store, sessionId, memId);
-			sessionId = null;
-			throw new Error("unauthorized_scope");
-		}
-		store.endSession(sessionId, { manual: true });
+		const memId = store.rememberForUser(newSessionId, opts.kind, opts.title, opts.body, parseConfidence(opts.confidence), opts.tags, void 0, { createdMemories });
+		if (!store.get(memId)) throw new Error("unauthorized_scope");
+		store.endSession(newSessionId, { manual: true });
+		return {
+			memId,
+			sessionId: newSessionId,
+			createdMemories
+		};
+	}).immediate();
+}
+async function rememberMemoryAction(opts) {
+	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
+	let sessionId = null;
+	try {
+		const result = createManualMemory(store, opts);
+		sessionId = result.sessionId;
+		const memId = result.memId;
+		store.enqueueCommittedVectorWrites(result.createdMemories);
 		await store.flushPendingVectorWrites();
 		if (opts.json) console.log(JSON.stringify({ id: memId }));
 		else p.log.success(`Stored memory ${memId}`);
@@ -7172,6 +8147,218 @@ var piHookInjectCommand = piHookInjectCmd.action(async (opts) => {
 	}
 });
 //#endregion
+//#region src/commands/pi-import-sessions.ts
+/**
+* codemem pi-import-sessions — backfill pi agent session history (design D3/D4).
+*
+* Thin wrapper over core importPiSessions: walks every session JSONL file under
+* <pi-agent-dir>/sessions (project subdirs included, PI_CODING_AGENT_DIR honored).
+*
+* Extraction is opt-in (--extract, off by default): it runs the observer model over
+* the imported history, which costs tokens proportional to backlog size. With
+* --extract the STANDARD flush path (flushRawEvents — the same function the
+* raw-event sweeper calls each tick) runs over the imported pi sessions; there is
+* no bespoke extraction pipeline. Without it, imported events are stored searchable
+* and the running viewer's sweeper picks them up like any other backlog.
+*/
+var EXTRACT_COST_NOTE = "also extract memories (runs the observer model over imported history — LLM cost scales with backlog; default: off, imported events stay searchable)";
+/**
+* Import sessions, then — when --extract is set — drain the imported pi
+* sessions through the standard flush path. Returns the import summary plus
+* extraction counts and failures.
+*/
+async function runPiImportSessions(opts, deps = {}) {
+	const dbPath = resolveDbPath(resolveDbOpt(opts));
+	return {
+		summary: importPiSessions({
+			dbPath,
+			onProgress: deps.onProgress
+		}),
+		extraction: opts.extract ? await flushImportedPiSessions(dbPath, deps.observer) : {
+			requested: false,
+			flushedEvents: 0,
+			failedSessions: 0,
+			pendingSessions: null,
+			error: null
+		}
+	};
+}
+/**
+* Run the existing raw-event flush (the sweeper's own flushRawEvents) over
+* every pending source-"pi" session — never a bespoke extraction path. Fails
+* open per session: a failed flush batch stays retryable by the sweeper's
+* pending-queue phase, exactly like live-session flush failures.
+*/
+async function flushImportedPiSessions(dbPath, observer) {
+	const store = new MemoryStore(dbPath);
+	const extraction = {
+		requested: true,
+		flushedEvents: 0,
+		failedSessions: 0,
+		pendingSessions: 0,
+		error: null
+	};
+	try {
+		let resolved;
+		try {
+			resolved = observer ?? new ObserverClient();
+		} catch (err) {
+			extraction.error = `observer init failed: ${err instanceof Error ? err.message : String(err)}`;
+			extraction.pendingSessions = piPendingSessions(store).length;
+			return extraction;
+		}
+		for (const streamId of piPendingSessions(store)) try {
+			const result = await flushRawEvents(store, { observer: resolved }, {
+				opencodeSessionId: streamId,
+				source: "pi",
+				cwd: null,
+				project: null,
+				startedAt: null,
+				maxEvents: null
+			});
+			extraction.flushedEvents += result.flushed;
+		} catch (err) {
+			extraction.failedSessions++;
+			extraction.error ??= `session ${streamId}: ${err instanceof Error ? err.message : String(err)}`;
+		}
+		extraction.pendingSessions = piPendingSessions(store).length;
+		return extraction;
+	} finally {
+		store.close();
+	}
+}
+/** Pending-flush sessions attributed to source "pi", without a page cap. */
+function piPendingSessions(store) {
+	return store.rawEventSessionsPendingFlush(null, "pi").map((session) => session.streamId);
+}
+/** Human-readable summary line; per-file progress is streamed by the caller. */
+function formatPiImportHuman(result) {
+	const { summary, extraction } = result;
+	const lines = [`Scanned ${summary.filesScanned} files: ${summary.filesImported} imported, ${summary.filesUnchanged} unchanged, ${summary.filesEmpty} empty, ${summary.filesErrored} errored — ${summary.inserted} events inserted, ${summary.skipped} skipped.`];
+	if (extraction.requested) {
+		lines.push(`Extraction: observer flushed ${extraction.flushedEvents} events into memories.`);
+		if (extraction.failedSessions > 0 || (extraction.pendingSessions ?? 0) > 0) lines.push(`${extraction.failedSessions} sessions failed; ${extraction.pendingSessions} remain pending.`);
+		if (extraction.error) lines.push(`Extraction error: ${extraction.error}`);
+	}
+	return lines.join("\n");
+}
+function logProgress(progress) {
+	const name = progress.file;
+	if (progress.status === "imported") p.log.info(`imported ${name} (+${progress.inserted} events)`);
+	else if (progress.status === "unchanged") p.log.info(`unchanged ${name}`);
+	else if (progress.status === "empty") p.log.info(`empty ${name}`);
+	else p.log.warn(`error ${name}: ${progress.error ?? "unknown error"}`);
+}
+var cmd$2 = new Command("pi-import-sessions").configureHelp(helpStyle).description("Import pi agent session history into the searchable store").option("--extract", EXTRACT_COST_NOTE);
+addDbOption(cmd$2);
+addJsonOption(cmd$2);
+var piImportSessionsCommand = cmd$2.action(async (opts) => {
+	try {
+		const result = await runPiImportSessions(opts, opts.json ? {} : { onProgress: logProgress });
+		const { extraction } = result;
+		let extractionFailure;
+		if (extraction.error || extraction.failedSessions > 0 || (extraction.pendingSessions ?? 0) > 0) {
+			extractionFailure = extraction.error ?? `${extraction.failedSessions} sessions failed; ${extraction.pendingSessions} remain pending.`;
+			process.exitCode = 1;
+		}
+		if (opts.json) {
+			console.log(JSON.stringify({
+				...result.summary,
+				extraction,
+				error: extractionFailure ? "pi_extraction_incomplete" : void 0,
+				message: extractionFailure
+			}, null, 2));
+			return;
+		}
+		p.log.message(formatPiImportHuman(result));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "pi-import-sessions failed";
+		if (opts.json) emitJsonError("pi_import_sessions_failed", message);
+		else {
+			p.log.error(message);
+			process.exitCode = 1;
+		}
+	}
+});
+//#endregion
+//#region src/commands/pi-session-search.ts
+/**
+* codemem pi-session-search — search stored pi session conversations.
+*
+* Queries the raw-event store (source "pi") via core searchPiSessions — the
+* same contract as GET /api/pi/sessions/search and the pi-extension
+* memory_session_search tool (design D5). --json prints the exact response
+* object those surfaces return, which is what the extension's CLI fallback
+* parses.
+*
+* Empty results usually mean the index only covers sessions captured since
+* codemem was installed; `codemem pi-import-sessions` backfills history.
+*/
+var EMPTY_INDEX_HINT = "The index may only cover sessions captured since codemem was installed; backfill history with: codemem pi-import-sessions";
+function intOption(value) {
+	const parsed = Number.parseInt(String(value ?? ""), 10);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Run the session search and return the shared response object.
+* Throws on invalid input or store failure; printing stays with the caller.
+*/
+function runPiSessionSearch(query, opts) {
+	if (!query.trim()) throw new Error("query required");
+	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
+	try {
+		return searchPiSessions(store.db, query, {
+			project: opts.project,
+			session_id: opts.sessionId,
+			limit: intOption(opts.limit),
+			snippet_chars: intOption(opts.snippetChars)
+		});
+	} finally {
+		store.close();
+	}
+}
+/** Human-readable output: "Found N results" header + attributed snippet lines. */
+function formatPiSessionSearchHuman(response) {
+	const warning = response.query_truncated ? "Warning: matching used only part of the query. Shorten it to at most 8,192 characters and 64 search terms, then retry." : null;
+	if (response.results.length === 0) return `No results found for "${response.query}". ${warning ?? EMPTY_INDEX_HINT}`;
+	const lines = [`Found ${response.returned} results for "${response.query}"`];
+	if (warning) lines.push(warning);
+	for (const [index, match] of response.results.entries()) {
+		const attribution = [
+			match.role,
+			match.project ?? "no project",
+			`session ${match.session_id}`,
+			match.timestamp ?? "unknown time"
+		].join(" · ");
+		const snippet = match.snippet_truncated ? `${match.snippet}…` : match.snippet;
+		lines.push(`${index + 1}. ${attribution}`, snippet);
+	}
+	if (response.truncated) lines.push(`Showing ${response.returned} of ${response.total_matches} matches.`);
+	return lines.join("\n");
+}
+var cmd$1 = new Command("pi-session-search").configureHelp(helpStyle).description("Search stored pi session conversations by text query").argument("<query>", "search query").option("--project <project>", "filter by project label").option("--session-id <id>", "filter by pi session id").option("--limit <n>", "max results (1-20)", "10").option("--snippet-chars <n>", "per-result snippet cap in chars (100-4000)", "1200");
+addDbOption(cmd$1);
+addJsonOption(cmd$1);
+var piSessionSearchCommand = cmd$1.action((query, opts) => {
+	try {
+		const response = runPiSessionSearch(query, opts);
+		if (opts.json) {
+			console.log(JSON.stringify(response, null, 2));
+			return;
+		}
+		const text = formatPiSessionSearchHuman(response);
+		if (response.results.length === 0) p.log.warn(text);
+		else p.log.message(text);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "pi-session-search failed";
+		if (opts.json) emitJsonError("pi_session_search_failed", message);
+		else {
+			p.log.error(message);
+			process.exitCode = 1;
+		}
+	}
+});
+//#endregion
 //#region src/commands/recent.ts
 var cmd = new Command("recent").configureHelp(helpStyle).description("Show recent memories").option("--limit <n>", "max results", "5").option("--project <project>", "project identifier (defaults to git repo root)").option("--all-projects", "search across all projects").option("--kind <kind>", "filter by memory kind");
 addDbOption(cmd);
@@ -8020,6 +9207,49 @@ function createRawEventTargetState(store) {
 		stop
 	};
 }
+function createViewerAccountLink(store, invocation, serverModule) {
+	const configPath = resolveCodememConfigPath(invocation.configPath ?? void 0).resolved.path;
+	const keysDir = dirname(resolveKeyPaths(process.env.CODEMEM_KEYS_DIR?.trim() || void 0)[0]);
+	const readContext = serverModule.createAccountContextReader({
+		getProfile: () => ({
+			dbPath: store.dbPath,
+			deviceId: store.deviceId,
+			identityId: store.actorId,
+			identityLabel: store.actorDisplayName
+		}),
+		readConfig: () => readCodememConfigFileAtPath(configPath),
+		configPath,
+		keysDir
+	});
+	const registry = serverModule.createAccountLinkRegistry({ readContext });
+	let actualBoundPort = null;
+	return {
+		registry,
+		setBoundPort: (port) => {
+			actualBoundPort = port;
+		},
+		options: {
+			readContext,
+			registry,
+			getListenerAddress: () => actualBoundPort === null ? null : {
+				host: invocation.host,
+				port: actualBoundPort
+			}
+		}
+	};
+}
+function announceViewerStartup(options) {
+	const { pidPath, invocation, preparedDb, info } = options;
+	writeFileSync(pidPath, JSON.stringify({
+		pid: process.pid,
+		host: invocation.host,
+		port: invocation.port
+	}), "utf-8");
+	p.intro("codemem viewer");
+	p.log.success(`Listening on http://${info.address}:${info.port}`);
+	p.log.info(`Database: ${preparedDb}`);
+	p.log.step("Raw event sweeper started");
+}
 async function startForegroundViewer(invocation) {
 	const serverModule = await import("@codemem/server");
 	const { createApp, createSyncApp, closeStore, createViewerRawEventInbox, getStore } = serverModule;
@@ -8053,11 +9283,13 @@ async function startForegroundViewer(invocation) {
 	const config = invocation.configPath ? readCodememConfigFileAtPath(invocation.configPath) : readCodememConfigFile();
 	const syncConfig = readCoordinatorSyncConfig(config);
 	const syncEnabled = syncConfig.syncEnabled;
+	const accountLink = createViewerAccountLink(store, invocation, serverModule);
 	const syncRuntimeStatus = {
 		phase: syncEnabled ? "starting" : "disabled",
 		detail: syncEnabled ? "Waiting for viewer startup to finish" : "Sync is disabled"
 	};
 	const appOpts = {
+		accountLink: accountLink.options,
 		storeFactory: () => store,
 		...rawEventProcessing.appOptions,
 		getSyncRuntimeStatus: () => syncRuntimeStatus
@@ -8086,15 +9318,13 @@ async function startForegroundViewer(invocation) {
 		hostname: invocation.host,
 		port: invocation.port
 	}, (info) => {
-		writeFileSync(pidPath, JSON.stringify({
-			pid: process.pid,
-			host: invocation.host,
-			port: invocation.port
-		}), "utf-8");
-		p.intro("codemem viewer");
-		p.log.success(`Listening on http://${info.address}:${info.port}`);
-		p.log.info(`Database: ${preparedDb}`);
-		p.log.step("Raw event sweeper started");
+		accountLink.setBoundPort(info.port);
+		announceViewerStartup({
+			pidPath,
+			invocation,
+			preparedDb,
+			info
+		});
 		maintenanceWorker = startMaintenanceWorkerProcess(invocation);
 		if (syncEnabled) {
 			const syncStartDelayMs = 3e3;
@@ -8143,6 +9373,7 @@ async function startForegroundViewer(invocation) {
 	const shutdown = async () => {
 		p.outro("shutting down");
 		syncAbort.abort();
+		await accountLink.registry.close();
 		await stopMaintenanceWorkerProcess(maintenanceWorker, dbPath);
 		await new Promise((resolve) => {
 			let remaining = syncServer ? 2 : 1;
@@ -9422,6 +10653,7 @@ function installPi(options = {}) {
 		p.log.info("  - Start (or restart) pi to load the extension package");
 		if (!options.piMcp) p.log.info("  - Optional MCP surface: install pi-mcp-adapter, then re-run with --pi-mcp");
 		p.log.info("  - To disable: remove the @codemem/pi-extension entry from pi settings.json packages");
+		p.log.info("  - Pre-install pi session history is not imported automatically; backfill it with: codemem pi-import-sessions");
 	}
 	return ok;
 }
@@ -10470,37 +11702,99 @@ doctorCmd.action(async (opts) => {
 	}
 });
 syncCommand.addCommand(doctorCmd);
-var statusCmd = new Command("status").configureHelp(helpStyle).description("Show sync configuration and peer summary");
-addDbOption(statusCmd);
-addConfigOption(statusCmd);
-addJsonOption(statusCmd);
-statusCmd.action((opts) => {
-	const config = readCliConfig(opts.config);
-	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
-	try {
-		const d = drizzle(store.db, { schema });
-		const deviceRow = d.select({
-			device_id: schema.syncDevice.device_id,
-			fingerprint: schema.syncDevice.fingerprint
-		}).from(schema.syncDevice).limit(1).get();
-		const peers = d.select({
-			peer_device_id: schema.syncPeers.peer_device_id,
-			name: schema.syncPeers.name,
-			last_sync_at: schema.syncPeers.last_sync_at,
-			last_error: schema.syncPeers.last_error
-		}).from(schema.syncPeers).all();
-		const semanticIndex = getSemanticIndexDiagnostics(store.db);
-		const localDeviceId = deviceRow?.device_id ?? null;
-		const peersWithScopes = peers.map((peer) => {
+function syncStatusIdentityAndPeers(store) {
+	const d = drizzle(store.db, { schema });
+	const deviceRow = d.select({
+		device_id: schema.syncDevice.device_id,
+		fingerprint: schema.syncDevice.fingerprint
+	}).from(schema.syncDevice).limit(1).get();
+	const peers = d.select({
+		peer_device_id: schema.syncPeers.peer_device_id,
+		name: schema.syncPeers.name,
+		last_sync_at: schema.syncPeers.last_sync_at,
+		last_error: schema.syncPeers.last_error,
+		public_key: schema.syncPeers.public_key
+	}).from(schema.syncPeers).all();
+	const localDeviceId = deviceRow?.device_id ?? null;
+	const localSigningPublicKey = localDeviceId && peers.length > 0 && store.db.prepare(`SELECT 1 FROM scope_memberships m
+		 JOIN replication_scopes s ON s.scope_id = m.scope_id
+		 WHERE m.device_id = ? AND m.status = 'active'
+		 AND s.authority_type = 'coordinator' LIMIT 1`).get(localDeviceId) ? loadRuntimeSigningPublicKey(store.db, {
+		deviceId: localDeviceId,
+		keysDir: process.env.CODEMEM_KEYS_DIR?.trim() || void 0
+	}) : null;
+	return {
+		deviceRow,
+		peers,
+		peersWithScopes: peers.map((peer) => {
 			const peerDeviceId = String(peer.peer_device_id ?? "").trim();
 			return {
 				peer,
 				scopes: listPerPeerScopeSyncState(store.db, {
 					localDeviceId,
-					peerDeviceId
+					peerDeviceId,
+					localSigningPublicKey,
+					authenticatedPeerSigningKey: peer.public_key
 				})
 			};
+		})
+	};
+}
+function printSyncStatusPeers(peersWithScopes) {
+	if (peersWithScopes.length === 0) {
+		p.log.info("Peers: none");
+		return;
+	}
+	for (const { peer, scopes } of peersWithScopes) {
+		const peerHeader = `  ${peer.name || peer.peer_device_id}: last_sync=${peer.last_sync_at ?? "never"}, status=${peer.last_error ?? "ok"}`;
+		if (scopes.length === 0) {
+			p.log.message(peerHeader);
+			continue;
+		}
+		const scopeLines = scopes.map((scope) => {
+			const state = scope.bootstrapped ? "received" : "pending";
+			return `      - ${scope.label} (${scope.scope_id}): ${state}`;
 		});
+		p.log.message([
+			peerHeader,
+			"    Spaces:",
+			...scopeLines
+		].join("\n"));
+	}
+}
+function printSyncStatus(config, identityAndPeers, semanticIndex) {
+	const { deviceRow, peers, peersWithScopes } = identityAndPeers;
+	p.intro("codemem sync status");
+	p.log.info([
+		`Enabled:    ${config.sync_enabled === true ? "yes" : "no"}`,
+		`Host:       ${config.sync_host ?? "0.0.0.0"}`,
+		`Port:       ${config.sync_port ?? 7337}`,
+		`Interval:   ${config.sync_interval_s ?? 120}s`,
+		`Coordinator: ${config.sync_coordinator_url ?? "(not configured)"}`
+	].join("\n"));
+	if (deviceRow) p.log.info(`Device ID:   ${deviceRow.device_id}\nFingerprint: ${deviceRow.fingerprint}`);
+	else p.log.warn("Device identity not initialized (run `codemem sync enable`)");
+	printSyncStatusPeers(peersWithScopes);
+	p.log.info([
+		"Semantic index:",
+		`  State: ${semanticIndex.state}`,
+		`  Summary: ${semanticIndex.summary}`,
+		`  Coverage: ${semanticIndex.indexed_memory_count}/${semanticIndex.embeddable_memory_count}`,
+		`  Mode: ${semanticIndex.mode === "semantic" ? `semantic (${semanticIndex.semantic_search_model ?? semanticIndex.current_model})` : "keyword-only"}`
+	].join("\n"));
+	p.outro(`${peers.length} peer(s)`);
+}
+var statusCmd = new Command("status").configureHelp(helpStyle).description("Show sync configuration and peer summary");
+addDbOption(statusCmd);
+addConfigOption(statusCmd);
+addJsonOption(statusCmd);
+statusCmd.action(function showSyncStatus(opts) {
+	const config = readCliConfig(opts.config);
+	const store = new MemoryStore(resolveDbPath(resolveDbOpt(opts)));
+	try {
+		const identityAndPeers = syncStatusIdentityAndPeers(store);
+		const { deviceRow, peersWithScopes } = identityAndPeers;
+		const semanticIndex = getSemanticIndexDiagnostics(store.db);
 		if (opts.json) {
 			console.log(JSON.stringify({
 				enabled: config.sync_enabled === true,
@@ -10521,40 +11815,7 @@ statusCmd.action((opts) => {
 			}, null, 2));
 			return;
 		}
-		p.intro("codemem sync status");
-		p.log.info([
-			`Enabled:    ${config.sync_enabled === true ? "yes" : "no"}`,
-			`Host:       ${config.sync_host ?? "0.0.0.0"}`,
-			`Port:       ${config.sync_port ?? 7337}`,
-			`Interval:   ${config.sync_interval_s ?? 120}s`,
-			`Coordinator: ${config.sync_coordinator_url ?? "(not configured)"}`
-		].join("\n"));
-		if (deviceRow) p.log.info(`Device ID:   ${deviceRow.device_id}\nFingerprint: ${deviceRow.fingerprint}`);
-		else p.log.warn("Device identity not initialized (run `codemem sync enable`)");
-		if (peers.length === 0) p.log.info("Peers: none");
-		else for (const { peer, scopes } of peersWithScopes) {
-			const peerHeader = `  ${peer.name || peer.peer_device_id}: last_sync=${peer.last_sync_at ?? "never"}, status=${peer.last_error ?? "ok"}`;
-			if (scopes.length === 0) p.log.message(peerHeader);
-			else {
-				const scopeLines = scopes.map((scope) => {
-					const state = scope.bootstrapped ? "received" : "pending";
-					return `      - ${scope.label} (${scope.scope_id}): ${state}`;
-				});
-				p.log.message([
-					peerHeader,
-					"    Spaces:",
-					...scopeLines
-				].join("\n"));
-			}
-		}
-		p.log.info([
-			"Semantic index:",
-			`  State: ${semanticIndex.state}`,
-			`  Summary: ${semanticIndex.summary}`,
-			`  Coverage: ${semanticIndex.indexed_memory_count}/${semanticIndex.embeddable_memory_count}`,
-			`  Mode: ${semanticIndex.mode === "semantic" ? `semantic (${semanticIndex.semantic_search_model ?? semanticIndex.current_model})` : "keyword-only"}`
-		].join("\n"));
-		p.outro(`${peers.length} peer(s)`);
+		printSyncStatus(config, identityAndPeers, semanticIndex);
 	} finally {
 		store.close();
 	}
@@ -10902,6 +12163,7 @@ connectCmd.action((url, opts) => {
 syncCommand.addCommand(connectCmd);
 var syncCoordinatorAlias = buildCoordinatorCommand();
 syncCoordinatorAlias.hook("preAction", (_thisCmd, actionCmd) => {
+	if (actionCmd.optsWithGlobals().json) return;
 	const subName = actionCmd.name();
 	emitDeprecationWarning(`codemem sync coordinator ${subName}`, `codemem coordinator ${subName}`);
 });
@@ -11726,6 +12988,8 @@ var ROOT_COMPLETION_COMMANDS = [
 	"mcp",
 	"memory",
 	"pack",
+	"pi-import-sessions",
+	"pi-session-search",
 	"recent",
 	"search",
 	"serve",
@@ -11790,6 +13054,8 @@ function registerRootCommands(program) {
 	program.addCommand(recentCommand);
 	program.addCommand(searchCommand);
 	program.addCommand(packCommand);
+	program.addCommand(piSessionSearchCommand);
+	program.addCommand(piImportSessionsCommand);
 	program.addCommand(promptPackLedgerCommand, { hidden: true });
 	program.addCommand(showMemoryCommand, { hidden: true });
 	program.addCommand(forgetMemoryCommand, { hidden: true });