@codemem/core 0.29.2 → 0.30.0-alpha.1

package/dist/internal/cloudflare-coordinator.js

@@ -1,4 +1,4 @@
-import { r as e, t } from "../coordinator-api-Dbgsu1O8.js";
+import { r as e, t } from "../coordinator-api-B9ooTSx5.js";
 //#region src/d1-coordinator-store.ts
 function n(e) {
 	if (e == null) throw Error("expected row");
@@ -65,6 +65,94 @@ function u(e) {
 	};
 }
 function d(e) {
+	return e?.trim() || null;
+}
+function f(e, t = 0) {
+	if (e == null) return t;
+	if (!Number.isFinite(e) || e < 0) throw Error("membershipEpoch must be non-negative.");
+	return Math.trunc(e);
+}
+function p(e) {
+	let t = d(e.scopeId), n = d(e.label);
+	if (!t || !n) throw Error("scopeId and label are required.");
+	return {
+		scopeId: t,
+		label: n,
+		kind: d(e.kind) ?? "user",
+		authorityType: d(e.authorityType) ?? "coordinator",
+		coordinatorId: d(e.coordinatorId),
+		groupId: d(e.groupId),
+		manifestIssuerDeviceId: d(e.manifestIssuerDeviceId),
+		membershipEpoch: f(e.membershipEpoch),
+		manifestHash: d(e.manifestHash),
+		status: d(e.status) ?? "active"
+	};
+}
+function m(e, t, n) {
+	if (e === void 0) return t;
+	let r = d(e);
+	if (!r) throw Error(`${n} must not be empty.`);
+	return r;
+}
+function h(e, t) {
+	return e === void 0 ? t : d(e);
+}
+function g(e, t) {
+	let n = d(e.scopeId);
+	if (!n) throw Error("scopeId is required.");
+	let r = e.membershipEpoch == null ? null : f(e.membershipEpoch);
+	if (r != null && r < t.membership_epoch) throw Error("membershipEpoch must not move backwards.");
+	return {
+		scopeId: n,
+		label: m(e.label, t.label, "label"),
+		kind: m(e.kind, t.kind, "kind"),
+		authorityType: m(e.authorityType, t.authority_type, "authorityType"),
+		coordinatorId: h(e.coordinatorId, t.coordinator_id),
+		groupId: h(e.groupId, t.group_id),
+		manifestIssuerDeviceId: h(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
+		membershipEpoch: r ?? t.membership_epoch,
+		manifestHash: h(e.manifestHash, t.manifest_hash),
+		status: m(e.status, t.status, "status")
+	};
+}
+function _(e, t, n) {
+	let r = d(e.scopeId), i = d(e.deviceId);
+	if (!r || !i) throw Error("scopeId and deviceId are required.");
+	let a = d(e.coordinatorId), o = d(e.groupId);
+	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
+	if (o && o !== t?.group_id) throw Error("membership groupId must match the scope groupId.");
+	let s = e.membershipEpoch == null ? null : f(e.membershipEpoch), c = t?.membership_epoch ?? 0;
+	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
+	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
+	let l = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
+	return {
+		scopeId: r,
+		deviceId: i,
+		role: d(e.role) ?? "member",
+		membershipEpoch: l,
+		coordinatorId: t?.coordinator_id ?? null,
+		groupId: t?.group_id ?? null,
+		manifestIssuerDeviceId: d(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
+		manifestHash: d(e.manifestHash) ?? t?.manifest_hash ?? null,
+		signedManifestJson: d(e.signedManifestJson),
+		actorType: d(e.actorType),
+		actorId: d(e.actorId)
+	};
+}
+function v(e) {
+	return e == null || !Number.isFinite(e) ? 100 : Math.max(1, Math.min(1e3, Math.trunc(e)));
+}
+function y(e, t) {
+	return e.prepare("INSERT INTO coordinator_scope_membership_audit_log(\n			action, scope_id, device_id, role, status, membership_epoch,\n			previous_role, previous_status, previous_membership_epoch,\n			coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at\n		)\n		SELECT ?, membership.scope_id, membership.device_id, membership.role, membership.status,\n			membership.membership_epoch, ?, ?, ?, membership.coordinator_id, membership.group_id,\n			?, ?, membership.manifest_hash, ?\n		FROM (SELECT 1 WHERE changes() > 0) AS required\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON membership.scope_id = ?\n			AND membership.device_id = ?\n			AND membership.status = ?\n			AND membership.membership_epoch = ?\n			AND membership.updated_at = ?").bind(t.action, t.previous?.role ?? null, t.previous?.status ?? null, t.previous?.membership_epoch ?? null, t.actorType, t.actorId, t.createdAt, t.scopeId, t.deviceId, t.status, t.membershipEpoch, t.updatedAt);
+}
+async function b(e, t) {
+	if (!e.batch) throw Error("D1 batch support is required for audited scope membership changes.");
+	return await e.batch(t);
+}
+function x(e) {
+	return Number(e?.meta?.changes ?? 0);
+}
+function S(e) {
 	if (!e) return null;
 	let t = String(e.seedDeviceId ?? "").trim(), n = String(e.expiresAt ?? "").trim(), r = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n) throw Error("bootstrapGrant.seedDeviceId and expiresAt are required.");
@@ -76,18 +164,18 @@ function d(e) {
 		createdBy: r
 	};
 }
-async function f(e) {
+async function C(e) {
 	let t = await e.all();
 	return Array.isArray(t?.results) ? t.results : [];
 }
-async function p(e) {
+async function w(e) {
 	return await e.first();
 }
-async function m(e) {
+async function T(e) {
 	let t = await e.run();
 	return Number(t?.meta?.changes ?? 0);
 }
-var h = class {
+var E = class {
 	db;
 	constructor(e) {
 		this.db = e;
@@ -97,80 +185,80 @@ var h = class {
 		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, o()).run();
 	}
 	async getGroup(e) {
-		let t = await p(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
+		let t = await w(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
 		return t ? n(t) : null;
 	}
 	async listGroups(e = !1) {
 		let t = e ? "" : "WHERE archived_at IS NULL";
-		return (await f(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => n(e));
+		return (await C(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => n(e));
 	}
 	async renameGroup(e, t) {
-		return await m(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
+		return await T(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
 	}
 	async archiveGroup(e, t = o()) {
-		return await m(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
+		return await T(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
 	}
 	async unarchiveGroup(e) {
-		return await m(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
+		return await T(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
 	}
 	async enrollDevice(e, t) {
 		await this.db.prepare("INSERT INTO enrolled_devices(\n				group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n			) VALUES (?, ?, ?, ?, ?, 1, ?)\n			ON CONFLICT(group_id, device_id) DO UPDATE SET\n				public_key = excluded.public_key,\n				fingerprint = excluded.fingerprint,\n				display_name = excluded.display_name,\n				enabled = 1").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.displayName ?? null, o()).run();
 	}
 	async listEnrolledDevices(e, t) {
 		let r = t ? "" : "AND enabled = 1";
-		return (await f(this.db.prepare(`SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at
+		return (await C(this.db.prepare(`SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at
 						 FROM enrolled_devices
 						 WHERE group_id = ? ${r}
 						 ORDER BY created_at ASC, device_id ASC`).bind(e))).map((e) => n(e));
 	}
 	async getEnrollment(e, t) {
-		let r = await p(this.db.prepare("SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n					 FROM enrolled_devices\n					 WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(e, t));
+		let r = await w(this.db.prepare("SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n					 FROM enrolled_devices\n					 WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(e, t));
 		return r ? n(r) : null;
 	}
 	async renameDevice(e, t, n) {
-		return await m(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
+		return await T(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
 	}
 	async setDeviceEnabled(e, t, n) {
-		return await m(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
+		return await T(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
 	}
 	async removeDevice(e, t) {
-		return await this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t).run(), await this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t).run(), await m(this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)) > 0;
+		return await this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t).run(), await this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t).run(), await T(this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)) > 0;
 	}
 	async recordNonce(e, t, n) {
-		return await m(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
+		return await T(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
 	}
 	async cleanupNonces(e) {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
 	async createInvite(e) {
 		let t = o(), r = l(12), i = l(24), a = await this.getGroup(e.groupId);
-		return await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)").bind(r, e.groupId, i, e.policy, e.expiresAt, t, e.createdBy ?? null, a?.display_name ?? null).run(), n(await p(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE invite_id = ?").bind(r)));
+		return await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)").bind(r, e.groupId, i, e.policy, e.expiresAt, t, e.createdBy ?? null, a?.display_name ?? null).run(), n(await w(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE invite_id = ?").bind(r)));
 	}
 	async getInviteByToken(e) {
-		let t = await p(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites\n					 WHERE token = ?\n					   AND revoked_at IS NULL\n					   AND expires_at > ?").bind(e, o()));
+		let t = await w(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites\n					 WHERE token = ?\n					   AND revoked_at IS NULL\n					   AND expires_at > ?").bind(e, o()));
 		return t ? n(t) : null;
 	}
 	async listInvites(e) {
-		return (await f(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE group_id = ?\n					 ORDER BY created_at DESC").bind(e))).map((e) => n(e));
+		return (await C(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE group_id = ?\n					 ORDER BY created_at DESC").bind(e))).map((e) => n(e));
 	}
 	async createJoinRequest(e) {
 		let t = o(), r = l(12);
-		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(r, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), n(await p(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(r)));
+		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(r, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), n(await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(r)));
 	}
 	async listJoinRequests(e, t) {
 		let r = t ?? "pending";
-		return (await f(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, r))).map((e) => n(e));
+		return (await C(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, r))).map((e) => n(e));
 	}
 	async reviewJoinRequest(e) {
-		let t = await p(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		let t = await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!t) return null;
 		if (t.status !== "pending") return {
 			...n(t),
 			_no_transition: !0
 		};
-		let r = d(e.bootstrapGrant), i = o(), a = e.approved ? "approved" : "denied", s = null, c = null;
+		let r = S(e.bootstrapGrant), i = o(), a = e.approved ? "approved" : "denied", s = null, c = null;
 		if (e.approved && r) {
-			if (!await p(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, r.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
+			if (!await w(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, r.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
 			if (r.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
 			s = {
 				...r,
@@ -197,67 +285,172 @@ var h = class {
 				let e = await this.createBootstrapGrant(s);
 				r = e.grant_id, c = e.grant_id;
 			}
-			if (await m(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)) === 0) {
+			if (await T(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)) === 0) {
 				r && await this.revokeBootstrapGrant(r);
-				let t = await p(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+				let t = await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 				return t ? {
 					...n(t),
 					_no_transition: !0
 				} : null;
 			}
 		}
-		let u = await p(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		let u = await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!u) return null;
-		let f = s ? c ? await this.getBootstrapGrant(c) : await this.createBootstrapGrant(s) : null;
+		let d = s ? c ? await this.getBootstrapGrant(c) : await this.createBootstrapGrant(s) : null;
 		return {
 			...n(u),
-			bootstrap_grant: f
+			bootstrap_grant: d
 		};
 	}
 	async createReciprocalApproval(e) {
 		let t = e.groupId.trim(), r = e.requestingDeviceId.trim(), i = e.requestedDeviceId.trim();
 		if (!t || !r || !i) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
 		if (r === i) throw Error("requesting and requested device ids must differ.");
-		let a = s(r, i), u = await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, i));
+		let a = s(r, i), u = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, i));
 		if (u) return n(u);
-		let d = await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, i, r));
+		let d = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, i, r));
 		if (d) {
 			let e = o();
-			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, d.request_id).run(), n(await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(d.request_id)));
+			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, d.request_id).run(), n(await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(d.request_id)));
 		}
-		let f = l(12), m = o();
+		let f = l(12), p = o();
 		try {
-			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(f, t, r, i, a.low, a.high, m).run();
+			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(f, t, r, i, a.low, a.high, p).run();
 		} catch (e) {
 			if (!c(e)) throw e;
-			let a = await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, i));
+			let a = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, i));
 			if (a) return n(a);
-			let s = await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, i, r));
+			let s = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, i, r));
 			if (s) {
 				let e = o();
-				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, s.request_id).run(), n(await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(s.request_id)));
+				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, s.request_id).run(), n(await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(s.request_id)));
 			}
 			throw e;
 		}
-		return n(await p(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(f)));
+		return n(await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(f)));
 	}
 	async createBootstrapGrant(e) {
 		let t = u(e), r = l(12), i = o();
-		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(r, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, i, t.createdBy).run(), n(await p(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(r)));
+		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(r, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, i, t.createdBy).run(), n(await w(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(r)));
+	}
+	async getScope(e) {
+		let t = await w(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
+		return t ? n(t) : null;
+	}
+	async getScopeMembership(e, t) {
+		let r = await w(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
+		return r ? n(r) : null;
+	}
+	async createScope(e) {
+		let t = p(e);
+		if (await this.getScope(t.scopeId)) throw Error("scopeId already exists.");
+		let n = o();
+		await this.db.prepare("INSERT INTO coordinator_scopes(\n					scope_id, label, kind, authority_type, coordinator_id, group_id,\n					manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(t.scopeId, t.label, t.kind, t.authorityType, t.coordinatorId, t.groupId, t.manifestIssuerDeviceId, t.membershipEpoch, t.manifestHash, t.status, n, n).run();
+		let r = await this.getScope(t.scopeId);
+		if (!r) throw Error("scope insert returned no row");
+		return r;
+	}
+	async updateScope(e) {
+		let t = d(e.scopeId), n = t ? await this.getScope(t) : null;
+		if (!n) return null;
+		let r = g(e, n);
+		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, o(), r.scopeId).run(), await this.getScope(r.scopeId);
+	}
+	async listScopes(e = {}) {
+		let t = [], r = [], i = d(e.coordinatorId), a = d(e.groupId), o = d(e.status);
+		i && (t.push("coordinator_id = ?"), r.push(i)), a && (t.push("group_id = ?"), r.push(a)), o ? (t.push("status = ?"), r.push(o)) : e.includeInactive || t.push("status = 'active'");
+		let s = t.length ? `WHERE ${t.join(" AND ")}` : "", c = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
+				manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at
+			 FROM coordinator_scopes ${s}
+			 ORDER BY coordinator_id ASC, group_id ASC, scope_id ASC`);
+		return (await C(r.length ? c.bind(...r) : c)).map((e) => n(e));
+	}
+	async grantScopeMembership(e) {
+		let t = d(e.scopeId), r = d(e.deviceId), i = t ? await this.getScope(t) : null;
+		if (!i) throw Error("scopeId must reference an existing scope.");
+		let a = t && r ? await this.getScopeMembership(t, r) : null, s = _(e, i, a);
+		if (s.groupId && !await this.getEnrollment(s.groupId, s.deviceId)) throw Error("device must be enrolled and enabled in the scope group.");
+		let c = o();
+		if (x((await b(this.db, [this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(s.scopeId, s.deviceId, s.role, s.membershipEpoch, s.coordinatorId, s.groupId, s.manifestIssuerDeviceId, s.manifestHash, s.signedManifestJson, c), y(this.db, {
+			action: "grant",
+			previous: a,
+			scopeId: s.scopeId,
+			deviceId: s.deviceId,
+			status: "active",
+			membershipEpoch: s.membershipEpoch,
+			updatedAt: c,
+			actorType: s.actorType,
+			actorId: s.actorId,
+			createdAt: c
+		})]))[0]) <= 0) throw Error("scope membership grant was not applied.");
+		return n(await w(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(s.scopeId, s.deviceId)));
+	}
+	async revokeScopeMembership(e) {
+		let t = d(e.scopeId), n = d(e.deviceId);
+		if (!t || !n) throw Error("scopeId and deviceId are required.");
+		let r = e.membershipEpoch == null ? null : f(e.membershipEpoch), i = await this.getScopeMembership(t, n);
+		if (!i) return !1;
+		if (r != null && i && r <= i.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let a = o(), s = r ?? i.membership_epoch + 1, c = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?").bind(r, r, d(e.manifestHash), d(e.signedManifestJson), a, t, n, i.membership_epoch, i.status), l = y(this.db, {
+			action: "revoke",
+			previous: i,
+			scopeId: t,
+			deviceId: n,
+			status: "revoked",
+			membershipEpoch: s,
+			updatedAt: a,
+			actorType: d(e.actorType),
+			actorId: d(e.actorId),
+			createdAt: a
+		}), u;
+		try {
+			u = await b(this.db, [c, l]);
+		} catch (e) {
+			let r = await this.getScopeMembership(t, n);
+			if (!r || r.membership_epoch !== i.membership_epoch || r.status !== i.status) return !1;
+			throw e;
+		}
+		return !(x(u[0]) <= 0);
+	}
+	async listScopeMemberships(e, t = !1) {
+		let r = d(e);
+		if (!r) throw Error("scopeId is required.");
+		let i = t ? "" : "AND status = 'active'";
+		return (await C(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
+							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
+						 FROM coordinator_scope_memberships
+						 WHERE scope_id = ? ${i}
+						 ORDER BY device_id ASC`).bind(r))).map((e) => n(e));
+	}
+	async listScopeMembershipAuditEvents(e) {
+		let t = d(e.scopeId);
+		if (!t) throw Error("scopeId is required.");
+		let r = d(e.deviceId), i = v(e.limit), a = r ? "scope_id = ? AND device_id = ?" : "scope_id = ?", o = r ? [
+			t,
+			r,
+			i
+		] : [t, i];
+		return (await C(this.db.prepare(`SELECT event_id, action, scope_id, device_id, role, status, membership_epoch,
+							previous_role, previous_status, previous_membership_epoch,
+							coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at
+						 FROM coordinator_scope_membership_audit_log
+						 WHERE ${a}
+						 ORDER BY event_id ASC
+						 LIMIT ?`).bind(...o))).map((e) => n(e));
 	}
 	async getBootstrapGrant(e) {
-		let t = await p(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
+		let t = await w(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
 		return t ? n(t) : null;
 	}
 	async listBootstrapGrants(e) {
-		return (await f(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => n(e));
+		return (await C(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => n(e));
 	}
 	async revokeBootstrapGrant(e, t = o()) {
-		return await m(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
+		return await T(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
 	}
 	async listReciprocalApprovals(e) {
 		let t = e.direction === "incoming" ? "requested_device_id" : "requesting_device_id", r = e.status?.trim() || "pending";
-		return (await f(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
+		return (await C(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
 						 FROM coordinator_reciprocal_approvals
 						 WHERE group_id = ? AND ${t} = ? AND status = ?
 						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, r))).map((e) => n(e));
@@ -273,7 +466,7 @@ var h = class {
 	}
 	async listGroupPeers(e, t) {
 		let n = o();
-		return (await f(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
+		return (await C(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
 			let t = String(e.expires_at ?? "").trim(), r = !0;
 			if (t) {
 				let e = new Date(t);
@@ -296,9 +489,9 @@ var h = class {
 };
 //#endregion
 //#region src/d1-coordinator-runtime.ts
-function g(e) {
+function D(e) {
 	return t({
-		storeFactory: () => new h(e.db),
+		storeFactory: () => new E(e.db),
 		runtime: {
 			adminSecret: () => String(e.adminSecret ?? "").trim() || null,
 			now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
@@ -307,6 +500,6 @@ function g(e) {
 	});
 }
 //#endregion
-export { h as D1CoordinatorStore, e as DEFAULT_TIME_WINDOW_S, g as createD1CoordinatorApp };
+export { E as D1CoordinatorStore, e as DEFAULT_TIME_WINDOW_S, D as createD1CoordinatorApp };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map