@codemem/core 0.36.0 → 0.37.0

package/dist/internal/cloudflare-coordinator.js

@@ -1,10 +1,10 @@
-import { r as e, t } from "../coordinator-api-CbONcz8J.js";
+import { d as e, r as t, t as n } from "../coordinator-api-hZ1RVJUN.js";
 //#region src/d1-coordinator-store.ts
-function n(e) {
+function r(e) {
 	if (e == null) throw Error("expected row");
 	return e;
 }
-function r(e) {
+function i(e) {
 	let t = e.trim();
 	if (!t) return "";
 	let n = t.includes("://") ? t : `http://${t}`;
@@ -15,7 +15,7 @@ function r(e) {
 		return "";
 	}
 }
-function i(e) {
+function a(e) {
 	if (!e) return "";
 	try {
 		let t = new URL(e), n = t.hostname.toLowerCase();
@@ -23,18 +23,18 @@ function i(e) {
 	} catch {}
 	return e;
 }
-function a(e, t) {
-	let n = [], a = /* @__PURE__ */ new Set();
+function o(e, t) {
+	let n = [], r = /* @__PURE__ */ new Set();
 	for (let o of [...e, ...t]) {
-		let e = r(o), t = i(e);
-		!e || a.has(t) || (a.add(t), n.push(e));
+		let e = i(o), t = a(e);
+		!e || r.has(t) || (r.add(t), n.push(e));
 	}
 	return n;
 }
-function o() {
+function s() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
-function s(e, t) {
+function c(e, t) {
 	return e <= t ? {
 		low: e,
 		high: t
@@ -43,17 +43,17 @@ function s(e, t) {
 		high: e
 	};
 }
-function c(e) {
+function l(e) {
 	return e instanceof Error && /unique|constraint/i.test(e.message);
 }
-function l(e) {
+function u(e) {
 	let t = new Uint8Array(e);
 	globalThis.crypto.getRandomValues(t);
 	let n = [];
 	for (let e of t) n.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"[e % 64] ?? "A");
 	return n.join("");
 }
-function u(e) {
+function d(e) {
 	let t = String(e.groupId ?? "").trim(), n = String(e.seedDeviceId ?? "").trim(), r = String(e.workerDeviceId ?? "").trim(), i = String(e.expiresAt ?? "").trim(), a = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n || !r || !i) throw Error("groupId, seedDeviceId, workerDeviceId, and expiresAt are required.");
 	return {
@@ -64,95 +64,95 @@ function u(e) {
 		createdBy: a
 	};
 }
-function d(e) {
+function f(e) {
 	return e?.trim() || null;
 }
-function f(e, t = 0) {
+function p(e, t = 0) {
 	if (e == null) return t;
 	if (!Number.isFinite(e) || e < 0) throw Error("membershipEpoch must be non-negative.");
 	return Math.trunc(e);
 }
-function p(e) {
-	let t = d(e.scopeId), n = d(e.label);
+function m(e) {
+	let t = f(e.scopeId), n = f(e.label);
 	if (!t || !n) throw Error("scopeId and label are required.");
 	return {
 		scopeId: t,
 		label: n,
-		kind: d(e.kind) ?? "user",
-		authorityType: d(e.authorityType) ?? "coordinator",
-		coordinatorId: d(e.coordinatorId),
-		groupId: d(e.groupId),
-		manifestIssuerDeviceId: d(e.manifestIssuerDeviceId),
-		membershipEpoch: f(e.membershipEpoch),
-		manifestHash: d(e.manifestHash),
-		status: d(e.status) ?? "active"
+		kind: f(e.kind) ?? "user",
+		authorityType: f(e.authorityType) ?? "coordinator",
+		coordinatorId: f(e.coordinatorId),
+		groupId: f(e.groupId),
+		manifestIssuerDeviceId: f(e.manifestIssuerDeviceId),
+		membershipEpoch: p(e.membershipEpoch),
+		manifestHash: f(e.manifestHash),
+		status: f(e.status) ?? "active"
 	};
 }
-function m(e, t, n) {
+function h(e, t, n) {
 	if (e === void 0) return t;
-	let r = d(e);
+	let r = f(e);
 	if (!r) throw Error(`${n} must not be empty.`);
 	return r;
 }
-function h(e, t) {
-	return e === void 0 ? t : d(e);
-}
 function g(e, t) {
-	let n = d(e.scopeId);
+	return e === void 0 ? t : f(e);
+}
+function _(e, t) {
+	let n = f(e.scopeId);
 	if (!n) throw Error("scopeId is required.");
-	let r = e.membershipEpoch == null ? null : f(e.membershipEpoch);
+	let r = e.membershipEpoch == null ? null : p(e.membershipEpoch);
 	if (r != null && r < t.membership_epoch) throw Error("membershipEpoch must not move backwards.");
 	return {
 		scopeId: n,
-		label: m(e.label, t.label, "label"),
-		kind: m(e.kind, t.kind, "kind"),
-		authorityType: m(e.authorityType, t.authority_type, "authorityType"),
-		coordinatorId: h(e.coordinatorId, t.coordinator_id),
-		groupId: h(e.groupId, t.group_id),
-		manifestIssuerDeviceId: h(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
+		label: h(e.label, t.label, "label"),
+		kind: h(e.kind, t.kind, "kind"),
+		authorityType: h(e.authorityType, t.authority_type, "authorityType"),
+		coordinatorId: g(e.coordinatorId, t.coordinator_id),
+		groupId: g(e.groupId, t.group_id),
+		manifestIssuerDeviceId: g(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
 		membershipEpoch: r ?? t.membership_epoch,
-		manifestHash: h(e.manifestHash, t.manifest_hash),
-		status: m(e.status, t.status, "status")
+		manifestHash: g(e.manifestHash, t.manifest_hash),
+		status: h(e.status, t.status, "status")
 	};
 }
-function _(e, t, n) {
-	let r = d(e.scopeId), i = d(e.deviceId);
+function v(e, t, n) {
+	let r = f(e.scopeId), i = f(e.deviceId);
 	if (!r || !i) throw Error("scopeId and deviceId are required.");
-	let a = d(e.coordinatorId), o = d(e.groupId);
+	let a = f(e.coordinatorId), o = f(e.groupId);
 	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
 	if (o && o !== t?.group_id) throw Error("membership groupId must match the scope groupId.");
-	let s = e.membershipEpoch == null ? null : f(e.membershipEpoch), c = t?.membership_epoch ?? 0;
+	let s = e.membershipEpoch == null ? null : p(e.membershipEpoch), c = t?.membership_epoch ?? 0;
 	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
 	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
 	let l = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
 	return {
 		scopeId: r,
 		deviceId: i,
-		role: d(e.role) ?? "member",
+		role: f(e.role) ?? "member",
 		membershipEpoch: l,
 		coordinatorId: t?.coordinator_id ?? null,
 		groupId: t?.group_id ?? null,
-		manifestIssuerDeviceId: d(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
-		manifestHash: d(e.manifestHash) ?? t?.manifest_hash ?? null,
-		signedManifestJson: d(e.signedManifestJson),
-		actorType: d(e.actorType),
-		actorId: d(e.actorId)
+		manifestIssuerDeviceId: f(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
+		manifestHash: f(e.manifestHash) ?? t?.manifest_hash ?? null,
+		signedManifestJson: f(e.signedManifestJson),
+		actorType: f(e.actorType),
+		actorId: f(e.actorId)
 	};
 }
-function v(e) {
+function y(e) {
 	return e == null || !Number.isFinite(e) ? 100 : Math.max(1, Math.min(1e3, Math.trunc(e)));
 }
-function y(e, t) {
+function b(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_audit_log(\n			action, scope_id, device_id, role, status, membership_epoch,\n			previous_role, previous_status, previous_membership_epoch,\n			coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at\n		)\n		SELECT ?, membership.scope_id, membership.device_id, membership.role, membership.status,\n			membership.membership_epoch, ?, ?, ?, membership.coordinator_id, membership.group_id,\n			?, ?, membership.manifest_hash, ?\n		FROM (SELECT 1 WHERE changes() > 0) AS required\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON membership.scope_id = ?\n			AND membership.device_id = ?\n			AND membership.status = ?\n			AND membership.membership_epoch = ?\n			AND membership.updated_at = ?").bind(t.action, t.previous?.role ?? null, t.previous?.status ?? null, t.previous?.membership_epoch ?? null, t.actorType, t.actorId, t.createdAt, t.scopeId, t.deviceId, t.status, t.membershipEpoch, t.updatedAt);
 }
-async function b(e, t) {
+async function x(e, t) {
 	if (!e.batch) throw Error("D1 batch support is required for audited scope membership changes.");
 	return await e.batch(t);
 }
-function x(e) {
+function S(e) {
 	return Number(e?.meta?.changes ?? 0);
 }
-function S(e) {
+function C(e) {
 	if (!e) return null;
 	let t = String(e.seedDeviceId ?? "").trim(), n = String(e.expiresAt ?? "").trim(), r = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n) throw Error("bootstrapGrant.seedDeviceId and expiresAt are required.");
@@ -164,299 +164,304 @@ function S(e) {
 		createdBy: r
 	};
 }
-async function C(e) {
+async function w(e) {
 	let t = await e.all();
 	return Array.isArray(t?.results) ? t.results : [];
 }
-async function w(e) {
+async function T(e) {
 	return await e.first();
 }
-async function T(e) {
+async function E(e) {
 	let t = await e.run();
 	return Number(t?.meta?.changes ?? 0);
 }
-var E = class {
+var D = class {
 	db;
 	constructor(e) {
 		this.db = e;
 	}
 	async close() {}
 	async createGroup(e, t) {
-		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, o()).run();
+		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, s()).run();
 	}
 	async getGroup(e) {
-		let t = await w(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
-		return t ? n(t) : null;
+		let t = await T(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
+		return t ? r(t) : null;
 	}
 	async listGroups(e = !1) {
 		let t = e ? "" : "WHERE archived_at IS NULL";
-		return (await C(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => n(e));
+		return (await w(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => r(e));
 	}
 	async renameGroup(e, t) {
-		return await T(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
+		return await E(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
 	}
-	async archiveGroup(e, t = o()) {
-		return await T(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
+	async archiveGroup(e, t = s()) {
+		return await E(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
 	}
 	async unarchiveGroup(e) {
-		return await T(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
+		return await E(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
 	}
 	async enrollDevice(e, t) {
-		await this.db.prepare("INSERT INTO enrolled_devices(\n				group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n			) VALUES (?, ?, ?, ?, ?, 1, ?)\n			ON CONFLICT(group_id, device_id) DO UPDATE SET\n				public_key = excluded.public_key,\n				fingerprint = excluded.fingerprint,\n				display_name = excluded.display_name,\n				enabled = 1").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.displayName ?? null, o()).run();
+		await this.db.prepare("INSERT INTO enrolled_devices(\n				group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n			) VALUES (?, ?, ?, ?, ?, 1, ?)\n			ON CONFLICT(group_id, device_id) DO UPDATE SET\n				public_key = excluded.public_key,\n				fingerprint = excluded.fingerprint,\n				display_name = excluded.display_name,\n				enabled = 1").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.displayName ?? null, s()).run();
 	}
 	async listEnrolledDevices(e, t) {
-		let r = t ? "" : "AND enabled = 1";
-		return (await C(this.db.prepare(`SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at
+		let n = t ? "" : "AND enabled = 1";
+		return (await w(this.db.prepare(`SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at
 						 FROM enrolled_devices
-						 WHERE group_id = ? ${r}
-						 ORDER BY created_at ASC, device_id ASC`).bind(e))).map((e) => n(e));
+						 WHERE group_id = ? ${n}
+						 ORDER BY created_at ASC, device_id ASC`).bind(e))).map((e) => r(e));
 	}
 	async getEnrollment(e, t) {
-		let r = await w(this.db.prepare("SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n					 FROM enrolled_devices\n					 WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(e, t));
-		return r ? n(r) : null;
+		let n = await T(this.db.prepare("SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n					 FROM enrolled_devices\n					 WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(e, t));
+		return n ? r(n) : null;
 	}
 	async renameDevice(e, t, n) {
-		return await T(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
+		return await E(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
 	}
 	async setDeviceEnabled(e, t, n) {
-		return await T(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
+		return await E(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
 	}
 	async removeDevice(e, t) {
-		return await this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t).run(), await this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t).run(), await T(this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)) > 0;
+		if (!this.db.batch) throw Error("D1 batch support is required for atomic device removal.");
+		return S((await this.db.batch([
+			this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t),
+			this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t),
+			this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)
+		]))[2]) > 0;
 	}
 	async recordNonce(e, t, n) {
-		return await T(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
+		return await E(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
 	}
 	async cleanupNonces(e) {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
-	async createInvite(e) {
-		let t = o(), r = l(12), i = l(24), a = await this.getGroup(e.groupId);
-		return await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)").bind(r, e.groupId, i, e.policy, e.expiresAt, t, e.createdBy ?? null, a?.display_name ?? null).run(), n(await w(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE invite_id = ?").bind(r)));
+	async createInvite(t) {
+		let n = s(), i = u(12), a = u(24), o = e(t.expiresAt), c = await this.getGroup(t.groupId);
+		return await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)").bind(i, t.groupId, a, t.policy, o, n, t.createdBy ?? null, c?.display_name ?? null).run(), r(await T(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE invite_id = ?").bind(i)));
 	}
 	async getInviteByToken(e) {
-		let t = await w(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites\n					 WHERE token = ?\n					   AND revoked_at IS NULL\n					   AND expires_at > ?").bind(e, o()));
-		return t ? n(t) : null;
+		let t = await T(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites\n					 WHERE token = ?\n					   AND revoked_at IS NULL\n					   AND expires_at > ?").bind(e, s()));
+		return t ? r(t) : null;
 	}
 	async listInvites(e) {
-		return (await C(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE group_id = ?\n					 ORDER BY created_at DESC").bind(e))).map((e) => n(e));
+		return (await w(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE group_id = ?\n					 ORDER BY created_at DESC").bind(e))).map((e) => r(e));
 	}
 	async createJoinRequest(e) {
-		let t = o(), r = l(12);
-		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(r, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), n(await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(r)));
+		let t = s(), n = u(12);
+		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), r(await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
 	}
 	async listJoinRequests(e, t) {
-		let r = t ?? "pending";
-		return (await C(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, r))).map((e) => n(e));
+		let n = t ?? "pending";
+		return (await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => r(e));
 	}
 	async reviewJoinRequest(e) {
-		let t = await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		let t = await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!t) return null;
 		if (t.status !== "pending") return {
-			...n(t),
+			...r(t),
 			_no_transition: !0
 		};
-		let r = S(e.bootstrapGrant), i = o(), a = e.approved ? "approved" : "denied", s = null, c = null;
-		if (e.approved && r) {
-			if (!await w(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, r.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
-			if (r.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
-			s = {
-				...r,
+		let n = C(e.bootstrapGrant), i = s(), a = e.approved ? "approved" : "denied", o = null, c = null;
+		if (e.approved && n) {
+			if (!await T(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
+			if (n.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
+			o = {
+				...n,
 				groupId: t.group_id,
 				workerDeviceId: t.device_id
 			};
 		}
 		if (this.db.batch) {
 			let t = [];
-			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(o(), e.requestId, i)), s)) {
-				c = l(12);
-				let n = o();
-				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(c, s.groupId, s.seedDeviceId, s.workerDeviceId, s.expiresAt, n, s.createdBy ?? null, e.requestId, i));
+			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(s(), e.requestId, i)), o)) {
+				c = u(12);
+				let n = s();
+				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(c, o.groupId, o.seedDeviceId, o.workerDeviceId, o.expiresAt, n, o.createdBy ?? null, e.requestId, i));
 			}
 			await this.db.batch(t);
 		} else {
-			let r = null;
+			let n = null;
 			if (e.approved && (await this.enrollDevice(t.group_id, {
 				deviceId: t.device_id,
 				fingerprint: t.fingerprint,
 				publicKey: t.public_key,
 				displayName: (t.display_name ?? "").trim() || null
-			}), s)) {
-				let e = await this.createBootstrapGrant(s);
-				r = e.grant_id, c = e.grant_id;
+			}), o)) {
+				let e = await this.createBootstrapGrant(o);
+				n = e.grant_id, c = e.grant_id;
 			}
-			if (await T(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)) === 0) {
-				r && await this.revokeBootstrapGrant(r);
-				let t = await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+			if (await E(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)) === 0) {
+				n && await this.revokeBootstrapGrant(n);
+				let t = await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 				return t ? {
-					...n(t),
+					...r(t),
 					_no_transition: !0
 				} : null;
 			}
 		}
-		let u = await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
-		if (!u) return null;
-		let d = s ? c ? await this.getBootstrapGrant(c) : await this.createBootstrapGrant(s) : null;
+		let l = await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		if (!l) return null;
+		let d = o ? c ? await this.getBootstrapGrant(c) : await this.createBootstrapGrant(o) : null;
 		return {
-			...n(u),
+			...r(l),
 			bootstrap_grant: d
 		};
 	}
 	async createReciprocalApproval(e) {
-		let t = e.groupId.trim(), r = e.requestingDeviceId.trim(), i = e.requestedDeviceId.trim();
-		if (!t || !r || !i) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
-		if (r === i) throw Error("requesting and requested device ids must differ.");
-		let a = s(r, i), u = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, i));
-		if (u) return n(u);
-		let d = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, i, r));
+		let t = e.groupId.trim(), n = e.requestingDeviceId.trim(), i = e.requestedDeviceId.trim();
+		if (!t || !n || !i) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
+		if (n === i) throw Error("requesting and requested device ids must differ.");
+		let a = c(n, i), o = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, i));
+		if (o) return r(o);
+		let d = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, i, n));
 		if (d) {
-			let e = o();
-			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, d.request_id).run(), n(await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(d.request_id)));
+			let e = s();
+			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, d.request_id).run(), r(await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(d.request_id)));
 		}
-		let f = l(12), p = o();
+		let f = u(12), p = s();
 		try {
-			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(f, t, r, i, a.low, a.high, p).run();
+			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(f, t, n, i, a.low, a.high, p).run();
 		} catch (e) {
-			if (!c(e)) throw e;
-			let a = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, i));
-			if (a) return n(a);
-			let s = await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, i, r));
-			if (s) {
-				let e = o();
-				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, s.request_id).run(), n(await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(s.request_id)));
+			if (!l(e)) throw e;
+			let a = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, i));
+			if (a) return r(a);
+			let o = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, i, n));
+			if (o) {
+				let e = s();
+				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, o.request_id).run(), r(await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(o.request_id)));
 			}
 			throw e;
 		}
-		return n(await w(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(f)));
+		return r(await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(f)));
 	}
 	async createBootstrapGrant(e) {
-		let t = u(e), r = l(12), i = o();
-		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(r, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, i, t.createdBy).run(), n(await w(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(r)));
+		let t = d(e), n = u(12), i = s();
+		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, i, t.createdBy).run(), r(await T(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
 	}
 	async getScope(e) {
-		let t = await w(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
-		return t ? n(t) : null;
+		let t = await T(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
+		return t ? r(t) : null;
 	}
 	async getScopeMembership(e, t) {
-		let r = await w(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
-		return r ? n(r) : null;
+		let n = await T(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
+		return n ? r(n) : null;
 	}
 	async createScope(e) {
-		let t = p(e);
+		let t = m(e);
 		if (await this.getScope(t.scopeId)) throw Error("scopeId already exists.");
-		let n = o();
+		let n = s();
 		await this.db.prepare("INSERT INTO coordinator_scopes(\n					scope_id, label, kind, authority_type, coordinator_id, group_id,\n					manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(t.scopeId, t.label, t.kind, t.authorityType, t.coordinatorId, t.groupId, t.manifestIssuerDeviceId, t.membershipEpoch, t.manifestHash, t.status, n, n).run();
 		let r = await this.getScope(t.scopeId);
 		if (!r) throw Error("scope insert returned no row");
 		return r;
 	}
 	async updateScope(e) {
-		let t = d(e.scopeId), n = t ? await this.getScope(t) : null;
+		let t = f(e.scopeId), n = t ? await this.getScope(t) : null;
 		if (!n) return null;
-		let r = g(e, n);
-		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, o(), r.scopeId).run(), await this.getScope(r.scopeId);
+		let r = _(e, n);
+		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, s(), r.scopeId).run(), await this.getScope(r.scopeId);
 	}
 	async listScopes(e = {}) {
-		let t = [], r = [], i = d(e.coordinatorId), a = d(e.groupId), o = d(e.status);
-		i && (t.push("coordinator_id = ?"), r.push(i)), a && (t.push("group_id = ?"), r.push(a)), o ? (t.push("status = ?"), r.push(o)) : e.includeInactive || t.push("status = 'active'");
+		let t = [], n = [], i = f(e.coordinatorId), a = f(e.groupId), o = f(e.status);
+		i && (t.push("coordinator_id = ?"), n.push(i)), a && (t.push("group_id = ?"), n.push(a)), o ? (t.push("status = ?"), n.push(o)) : e.includeInactive || t.push("status = 'active'");
 		let s = t.length ? `WHERE ${t.join(" AND ")}` : "", c = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
 				manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at
 			 FROM coordinator_scopes ${s}
 			 ORDER BY coordinator_id ASC, group_id ASC, scope_id ASC`);
-		return (await C(r.length ? c.bind(...r) : c)).map((e) => n(e));
+		return (await w(n.length ? c.bind(...n) : c)).map((e) => r(e));
 	}
 	async grantScopeMembership(e) {
-		let t = d(e.scopeId), r = d(e.deviceId), i = t ? await this.getScope(t) : null;
+		let t = f(e.scopeId), n = f(e.deviceId), i = t ? await this.getScope(t) : null;
 		if (!i) throw Error("scopeId must reference an existing scope.");
-		let a = t && r ? await this.getScopeMembership(t, r) : null, s = _(e, i, a);
-		if (s.groupId && !await this.getEnrollment(s.groupId, s.deviceId)) throw Error("device must be enrolled and enabled in the scope group.");
-		let c = o();
-		if (x((await b(this.db, [this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(s.scopeId, s.deviceId, s.role, s.membershipEpoch, s.coordinatorId, s.groupId, s.manifestIssuerDeviceId, s.manifestHash, s.signedManifestJson, c), y(this.db, {
+		let a = t && n ? await this.getScopeMembership(t, n) : null, o = v(e, i, a);
+		if (o.groupId && !await this.getEnrollment(o.groupId, o.deviceId)) throw Error("device must be enrolled and enabled in the scope group.");
+		let c = s();
+		if (S((await x(this.db, [this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(o.scopeId, o.deviceId, o.role, o.membershipEpoch, o.coordinatorId, o.groupId, o.manifestIssuerDeviceId, o.manifestHash, o.signedManifestJson, c), b(this.db, {
 			action: "grant",
 			previous: a,
-			scopeId: s.scopeId,
-			deviceId: s.deviceId,
+			scopeId: o.scopeId,
+			deviceId: o.deviceId,
 			status: "active",
-			membershipEpoch: s.membershipEpoch,
+			membershipEpoch: o.membershipEpoch,
 			updatedAt: c,
-			actorType: s.actorType,
-			actorId: s.actorId,
+			actorType: o.actorType,
+			actorId: o.actorId,
 			createdAt: c
 		})]))[0]) <= 0) throw Error("scope membership grant was not applied.");
-		return n(await w(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(s.scopeId, s.deviceId)));
+		return r(await T(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(o.scopeId, o.deviceId)));
 	}
 	async revokeScopeMembership(e) {
-		let t = d(e.scopeId), n = d(e.deviceId);
+		let t = f(e.scopeId), n = f(e.deviceId);
 		if (!t || !n) throw Error("scopeId and deviceId are required.");
-		let r = e.membershipEpoch == null ? null : f(e.membershipEpoch), i = await this.getScopeMembership(t, n);
+		let r = e.membershipEpoch == null ? null : p(e.membershipEpoch), i = await this.getScopeMembership(t, n);
 		if (!i) return !1;
 		if (r != null && i && r <= i.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let a = o(), s = r ?? i.membership_epoch + 1, c = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?").bind(r, r, d(e.manifestHash), d(e.signedManifestJson), a, t, n, i.membership_epoch, i.status), l = y(this.db, {
+		let a = s(), o = r ?? i.membership_epoch + 1, c = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?").bind(r, r, f(e.manifestHash), f(e.signedManifestJson), a, t, n, i.membership_epoch, i.status), l = b(this.db, {
 			action: "revoke",
 			previous: i,
 			scopeId: t,
 			deviceId: n,
 			status: "revoked",
-			membershipEpoch: s,
+			membershipEpoch: o,
 			updatedAt: a,
-			actorType: d(e.actorType),
-			actorId: d(e.actorId),
+			actorType: f(e.actorType),
+			actorId: f(e.actorId),
 			createdAt: a
 		}), u;
 		try {
-			u = await b(this.db, [c, l]);
+			u = await x(this.db, [c, l]);
 		} catch (e) {
 			let r = await this.getScopeMembership(t, n);
 			if (!r || r.membership_epoch !== i.membership_epoch || r.status !== i.status) return !1;
 			throw e;
 		}
-		return !(x(u[0]) <= 0);
+		return !(S(u[0]) <= 0);
 	}
 	async listScopeMemberships(e, t = !1) {
-		let r = d(e);
-		if (!r) throw Error("scopeId is required.");
+		let n = f(e);
+		if (!n) throw Error("scopeId is required.");
 		let i = t ? "" : "AND status = 'active'";
-		return (await C(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
+		return (await w(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
 							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
 						 FROM coordinator_scope_memberships
 						 WHERE scope_id = ? ${i}
-						 ORDER BY device_id ASC`).bind(r))).map((e) => n(e));
+						 ORDER BY device_id ASC`).bind(n))).map((e) => r(e));
 	}
 	async listScopeMembershipAuditEvents(e) {
-		let t = d(e.scopeId);
+		let t = f(e.scopeId);
 		if (!t) throw Error("scopeId is required.");
-		let r = d(e.deviceId), i = v(e.limit), a = r ? "scope_id = ? AND device_id = ?" : "scope_id = ?", o = r ? [
+		let n = f(e.deviceId), i = y(e.limit), a = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", o = n ? [
 			t,
-			r,
+			n,
 			i
 		] : [t, i];
-		return (await C(this.db.prepare(`SELECT event_id, action, scope_id, device_id, role, status, membership_epoch,
+		return (await w(this.db.prepare(`SELECT event_id, action, scope_id, device_id, role, status, membership_epoch,
 							previous_role, previous_status, previous_membership_epoch,
 							coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at
 						 FROM coordinator_scope_membership_audit_log
 						 WHERE ${a}
 						 ORDER BY event_id ASC
-						 LIMIT ?`).bind(...o))).map((e) => n(e));
+						 LIMIT ?`).bind(...o))).map((e) => r(e));
 	}
 	async getBootstrapGrant(e) {
-		let t = await w(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
-		return t ? n(t) : null;
+		let t = await T(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
+		return t ? r(t) : null;
 	}
 	async listBootstrapGrants(e) {
-		return (await C(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => n(e));
+		return (await w(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => r(e));
 	}
-	async revokeBootstrapGrant(e, t = o()) {
-		return await T(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
+	async revokeBootstrapGrant(e, t = s()) {
+		return await E(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
 	}
 	async listReciprocalApprovals(e) {
-		let t = e.direction === "incoming" ? "requested_device_id" : "requesting_device_id", r = e.status?.trim() || "pending";
-		return (await C(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
+		let t = e.direction === "incoming" ? "requested_device_id" : "requesting_device_id", n = e.status?.trim() || "pending";
+		return (await w(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
 						 FROM coordinator_reciprocal_approvals
 						 WHERE group_id = ? AND ${t} = ? AND status = ?
-						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, r))).map((e) => n(e));
+						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => r(e));
 	}
 	async upsertPresence(e) {
-		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = a([], e.addresses);
+		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = o([], e.addresses);
 		return await this.db.prepare("INSERT INTO presence_records(group_id, device_id, addresses_json, last_seen_at, expires_at, capabilities_json)\n				 VALUES (?, ?, ?, ?, ?, ?)\n				 ON CONFLICT(group_id, device_id) DO UPDATE SET\n					addresses_json = excluded.addresses_json,\n					last_seen_at = excluded.last_seen_at,\n					expires_at = excluded.expires_at,\n					capabilities_json = excluded.capabilities_json").bind(e.groupId, e.deviceId, JSON.stringify(r), t.toISOString(), n, JSON.stringify(e.capabilities ?? {})).run(), {
 			group_id: e.groupId,
 			device_id: e.deviceId,
@@ -465,14 +470,14 @@ var E = class {
 		};
 	}
 	async listGroupPeers(e, t) {
-		let n = o();
-		return (await C(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
+		let n = s();
+		return (await w(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
 			let t = String(e.expires_at ?? "").trim(), r = !0;
 			if (t) {
 				let e = new Date(t);
 				r = Number.isNaN(e.getTime()) || e.toISOString() <= n;
 			}
-			let i = r ? [] : a([], JSON.parse(String(e.addresses_json ?? "[]")));
+			let i = r ? [] : o([], JSON.parse(String(e.addresses_json ?? "[]")));
 			return {
 				device_id: String(e.device_id ?? ""),
 				public_key: String(e.public_key ?? ""),
@@ -489,9 +494,9 @@ var E = class {
 };
 //#endregion
 //#region src/d1-coordinator-runtime.ts
-function D(e) {
-	return t({
-		storeFactory: () => new E(e.db),
+function O(e) {
+	return n({
+		storeFactory: () => new D(e.db),
 		runtime: {
 			adminSecret: () => String(e.adminSecret ?? "").trim() || null,
 			now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
@@ -500,6 +505,6 @@ function D(e) {
 	});
 }
 //#endregion
-export { E as D1CoordinatorStore, e as DEFAULT_TIME_WINDOW_S, D as createD1CoordinatorApp };
+export { D as D1CoordinatorStore, t as DEFAULT_TIME_WINDOW_S, O as createD1CoordinatorApp };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map