@codemem/core 0.38.0 → 0.40.0-alpha.1

package/dist/internal/cloudflare-coordinator.js

@@ -1,10 +1,10 @@
-import { d as e, r as t, t as n } from "../coordinator-api-hZ1RVJUN.js";
+import { A as e, D as t, F as n, M as r, N as i, O as a, P as o, S as s, b as c, h as l, j as u, k as d, n as f, t as p, v as m } from "../coordinator-api-Btb6CEhw.js";
 //#region src/d1-coordinator-store.ts
-function r(e) {
+function h(e) {
 	if (e == null) throw Error("expected row");
 	return e;
 }
-function i(e) {
+function g(e) {
 	let t = e.trim();
 	if (!t) return "";
 	let n = t.includes("://") ? t : `http://${t}`;
@@ -15,7 +15,7 @@ function i(e) {
 		return "";
 	}
 }
-function a(e) {
+function _(e) {
 	if (!e) return "";
 	try {
 		let t = new URL(e), n = t.hostname.toLowerCase();
@@ -23,18 +23,18 @@ function a(e) {
 	} catch {}
 	return e;
 }
-function o(e, t) {
+function v(e, t) {
 	let n = [], r = /* @__PURE__ */ new Set();
-	for (let o of [...e, ...t]) {
-		let e = i(o), t = a(e);
+	for (let i of [...e, ...t]) {
+		let e = g(i), t = _(e);
 		!e || r.has(t) || (r.add(t), n.push(e));
 	}
 	return n;
 }
-function s() {
+function y() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
-function c(e, t) {
+function b(e, t) {
 	return e <= t ? {
 		low: e,
 		high: t
@@ -43,17 +43,22 @@ function c(e, t) {
 		high: e
 	};
 }
-function l(e) {
+function x(e) {
 	return e instanceof Error && /unique|constraint/i.test(e.message);
 }
-function u(e) {
+function S(e) {
 	let t = new Uint8Array(e);
 	globalThis.crypto.getRandomValues(t);
 	let n = [];
 	for (let e of t) n.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"[e % 64] ?? "A");
 	return n.join("");
 }
-function d(e) {
+async function C(e) {
+	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
+	return Array.from(new Uint8Array(t), (e) => e.toString(16).padStart(2, "0")).join("");
+}
+var w = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", T = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at";
+function E(e) {
 	let t = String(e.groupId ?? "").trim(), n = String(e.seedDeviceId ?? "").trim(), r = String(e.workerDeviceId ?? "").trim(), i = String(e.expiresAt ?? "").trim(), a = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n || !r || !i) throw Error("groupId, seedDeviceId, workerDeviceId, and expiresAt are required.");
 	return {
@@ -64,95 +69,194 @@ function d(e) {
 		createdBy: a
 	};
 }
-function f(e) {
+function D(e) {
 	return e?.trim() || null;
 }
-function p(e, t = 0) {
+async function O(e) {
+	let t = e.inviteKind ?? (D(e.operationId) ? "project_share" : "legacy_enrollment"), n = D(e.policyTeamId), r = D(e.targetIdentityId), i = D(e.reviewedPreviewDigest);
+	if (![
+		"legacy_enrollment",
+		"project_share",
+		"team_member",
+		"add_device"
+	].includes(t)) throw Error("inviteKind is invalid.");
+	if ([n, r].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) throw Error("recipient invite identifier is invalid.");
+	if (i && !/^[a-f0-9]{64}$/u.test(i)) throw Error("reviewedPreviewDigest must be a SHA-256 digest.");
+	if (t === "project_share") {
+		if (!D(e.operationId)) throw Error("project_share invite requires operationId.");
+		if (n || r || i) throw Error("recipient invite metadata requires a recipient invite kind.");
+	} else if (t === "legacy_enrollment") {
+		if (D(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
+		if (n || r || i) throw Error("recipient invite metadata requires a recipient invite kind.");
+	} else if (t === "team_member") {
+		if (!n || !i || r || D(e.operationId)) throw Error("team_member invite metadata is invalid.");
+	} else if (t === "add_device" && (!r || !i || n || D(e.operationId))) throw Error("add_device invite metadata is invalid.");
+	if (!(e.reviewedIntent !== void 0 && e.reviewedIntent !== null)) {
+		if (t === "team_member" || t === "add_device") throw Error("recipient_invite_review_unavailable");
+		return {
+			inviteKind: t,
+			policyTeamId: n,
+			targetIdentityId: r,
+			reviewedPreviewDigest: i,
+			reviewedIntentJson: null
+		};
+	}
+	let a;
+	if (t === "team_member" && n && i) a = {
+		kind: "team_member",
+		policyTeamId: n
+	};
+	else if (t === "add_device" && r && i) a = {
+		kind: "add_device",
+		targetIdentityId: r
+	};
+	else throw Error("recipient invite metadata requires a recipient invite kind.");
+	return await s(e.reviewedIntent, {
+		target: a,
+		digest: i
+	}), {
+		inviteKind: t,
+		policyTeamId: n,
+		targetIdentityId: r,
+		reviewedPreviewDigest: i,
+		reviewedIntentJson: m(e.reviewedIntent, a)
+	};
+}
+async function k(e) {
+	if (e.invite_kind === "team_member") {
+		if (!e.policy_team_id || !t(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let n = await c(e.reviewed_intent_json, {
+			target: {
+				kind: "team_member",
+				policyTeamId: e.policy_team_id
+			},
+			digest: e.reviewed_preview_digest
+		});
+		return {
+			kind: "team_member",
+			invite: e,
+			policy_team_id: e.policy_team_id,
+			assigned_identity_id: e.assigned_identity_id,
+			reviewed_preview_digest: e.reviewed_preview_digest,
+			reviewed_intent: n,
+			bound: !!e.consumed_at
+		};
+	}
+	if (e.invite_kind === "add_device") {
+		if (!e.target_identity_id || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let t = await c(e.reviewed_intent_json, {
+			target: {
+				kind: "add_device",
+				targetIdentityId: e.target_identity_id
+			},
+			digest: e.reviewed_preview_digest
+		});
+		return {
+			kind: "add_device",
+			invite: e,
+			target_identity_id: e.target_identity_id,
+			reviewed_preview_digest: e.reviewed_preview_digest,
+			reviewed_intent: t,
+			bound: !!e.consumed_at
+		};
+	}
+	return null;
+}
+function A(e, t = 0) {
 	if (e == null) return t;
 	if (!Number.isFinite(e) || e < 0) throw Error("membershipEpoch must be non-negative.");
 	return Math.trunc(e);
 }
-function m(e) {
-	let t = f(e.scopeId), n = f(e.label);
+function j(e) {
+	let t = D(e.scopeId), n = D(e.label);
 	if (!t || !n) throw Error("scopeId and label are required.");
 	return {
 		scopeId: t,
 		label: n,
-		kind: f(e.kind) ?? "user",
-		authorityType: f(e.authorityType) ?? "coordinator",
-		coordinatorId: f(e.coordinatorId),
-		groupId: f(e.groupId),
-		manifestIssuerDeviceId: f(e.manifestIssuerDeviceId),
-		membershipEpoch: p(e.membershipEpoch),
-		manifestHash: f(e.manifestHash),
-		status: f(e.status) ?? "active"
+		kind: D(e.kind) ?? "user",
+		authorityType: D(e.authorityType) ?? "coordinator",
+		coordinatorId: D(e.coordinatorId),
+		groupId: D(e.groupId),
+		manifestIssuerDeviceId: D(e.manifestIssuerDeviceId),
+		membershipEpoch: A(e.membershipEpoch),
+		manifestHash: D(e.manifestHash),
+		status: D(e.status) ?? "active"
 	};
 }
-function h(e, t, n) {
+function M(e, t, n) {
 	if (e === void 0) return t;
-	let r = f(e);
+	let r = D(e);
 	if (!r) throw Error(`${n} must not be empty.`);
 	return r;
 }
-function g(e, t) {
-	return e === void 0 ? t : f(e);
+function N(e, t) {
+	return e === void 0 ? t : D(e);
 }
-function _(e, t) {
-	let n = f(e.scopeId);
+function P(e, t) {
+	let n = D(e.scopeId);
 	if (!n) throw Error("scopeId is required.");
-	let r = e.membershipEpoch == null ? null : p(e.membershipEpoch);
+	let r = e.membershipEpoch == null ? null : A(e.membershipEpoch);
 	if (r != null && r < t.membership_epoch) throw Error("membershipEpoch must not move backwards.");
 	return {
 		scopeId: n,
-		label: h(e.label, t.label, "label"),
-		kind: h(e.kind, t.kind, "kind"),
-		authorityType: h(e.authorityType, t.authority_type, "authorityType"),
-		coordinatorId: g(e.coordinatorId, t.coordinator_id),
-		groupId: g(e.groupId, t.group_id),
-		manifestIssuerDeviceId: g(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
+		label: M(e.label, t.label, "label"),
+		kind: M(e.kind, t.kind, "kind"),
+		authorityType: M(e.authorityType, t.authority_type, "authorityType"),
+		coordinatorId: N(e.coordinatorId, t.coordinator_id),
+		groupId: N(e.groupId, t.group_id),
+		manifestIssuerDeviceId: N(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
 		membershipEpoch: r ?? t.membership_epoch,
-		manifestHash: g(e.manifestHash, t.manifest_hash),
-		status: h(e.status, t.status, "status")
+		manifestHash: N(e.manifestHash, t.manifest_hash),
+		status: M(e.status, t.status, "status")
 	};
 }
-function v(e, t, n) {
-	let r = f(e.scopeId), i = f(e.deviceId);
-	if (!r || !i) throw Error("scopeId and deviceId are required.");
-	let a = f(e.coordinatorId), o = f(e.groupId);
-	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
-	if (o && o !== t?.group_id) throw Error("membership groupId must match the scope groupId.");
-	let s = e.membershipEpoch == null ? null : p(e.membershipEpoch), c = t?.membership_epoch ?? 0;
-	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
-	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
-	let l = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
+function F(t, n, r) {
+	let i = D(t.scopeId), a = D(t.deviceId);
+	if (!i || !a) throw Error("scopeId and deviceId are required.");
+	let o = D(t.coordinatorId), s = D(t.groupId);
+	if (o && o !== n?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
+	if (s && s !== n?.group_id) throw new e("scope_group_mismatch");
+	let c = t.membershipEpoch == null ? null : A(t.membershipEpoch), l = n?.membership_epoch ?? 0;
+	if (c != null && c < l) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
+	if (c != null && r && c < (r.status === "revoked" ? r.membership_epoch + 1 : r.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
+	let u = c ?? (r ? Math.max(l, r.membership_epoch + +(r.status === "revoked")) : l);
 	return {
-		scopeId: r,
-		deviceId: i,
-		role: f(e.role) ?? "member",
-		membershipEpoch: l,
-		coordinatorId: t?.coordinator_id ?? null,
-		groupId: t?.group_id ?? null,
-		manifestIssuerDeviceId: f(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
-		manifestHash: f(e.manifestHash) ?? t?.manifest_hash ?? null,
-		signedManifestJson: f(e.signedManifestJson),
-		actorType: f(e.actorType),
-		actorId: f(e.actorId)
+		scopeId: i,
+		deviceId: a,
+		role: D(t.role) ?? "member",
+		membershipEpoch: u,
+		coordinatorId: n?.coordinator_id ?? null,
+		groupId: n?.group_id ?? null,
+		manifestIssuerDeviceId: D(t.manifestIssuerDeviceId) ?? n?.manifest_issuer_device_id ?? null,
+		manifestHash: D(t.manifestHash) ?? n?.manifest_hash ?? null,
+		signedManifestJson: D(t.signedManifestJson),
+		actorType: D(t.actorType),
+		actorId: D(t.actorId)
 	};
 }
-function y(e) {
+function I(e) {
 	return e == null || !Number.isFinite(e) ? 100 : Math.max(1, Math.min(1e3, Math.trunc(e)));
 }
-function b(e, t) {
-	return e.prepare("INSERT INTO coordinator_scope_membership_audit_log(\n			action, scope_id, device_id, role, status, membership_epoch,\n			previous_role, previous_status, previous_membership_epoch,\n			coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at\n		)\n		SELECT ?, membership.scope_id, membership.device_id, membership.role, membership.status,\n			membership.membership_epoch, ?, ?, ?, membership.coordinator_id, membership.group_id,\n			?, ?, membership.manifest_hash, ?\n		FROM (SELECT 1 WHERE changes() > 0) AS required\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON membership.scope_id = ?\n			AND membership.device_id = ?\n			AND membership.status = ?\n			AND membership.membership_epoch = ?\n			AND membership.updated_at = ?").bind(t.action, t.previous?.role ?? null, t.previous?.status ?? null, t.previous?.membership_epoch ?? null, t.actorType, t.actorId, t.createdAt, t.scopeId, t.deviceId, t.status, t.membershipEpoch, t.updatedAt);
+function L(e, t) {
+	return e.prepare("INSERT INTO coordinator_scope_membership_audit_log(\n			effect_id, action, scope_id, device_id, role, status, membership_epoch,\n			previous_role, previous_status, previous_membership_epoch,\n			coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at\n		)\n		SELECT receipt.effect_id, ?, membership.scope_id, membership.device_id, membership.role, membership.status,\n			membership.membership_epoch, ?, ?, ?, membership.coordinator_id, membership.group_id,\n			?, ?, membership.manifest_hash, ?\n		FROM (SELECT 1 WHERE changes() > 0) AS required\n		JOIN coordinator_scope_membership_effect_receipts AS receipt\n			ON receipt.effect_id = ? AND receipt.action = ? AND receipt.request_json = ?\n			AND receipt.outcome_applied = 1\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON membership.scope_id = ?\n			AND membership.device_id = ?\n			AND membership.status = ?\n			AND membership.membership_epoch = ?\n			AND membership.updated_at = ?").bind(t.action, t.previous?.role ?? null, t.previous?.status ?? null, t.previous?.membership_epoch ?? null, t.actorType, t.actorId, t.createdAt, t.effectId, t.action, t.requestJson, t.scopeId, t.deviceId, t.status, t.membershipEpoch, t.updatedAt);
 }
-async function x(e, t) {
+async function R(e, t) {
+	return await G(e.prepare("SELECT effect_id, action, request_json, outcome_applied, scope_id, device_id,\n				role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n				manifest_hash, signed_manifest_json, updated_at, created_at\n			 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?").bind(t));
+}
+function z(e, t) {
+	return e.prepare("INSERT INTO coordinator_scope_membership_effect_receipts(\n			effect_id, action, request_json, outcome_applied, scope_id, device_id,\n			role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n			manifest_hash, signed_manifest_json, updated_at, created_at\n		)\n		SELECT ?, 'grant', ?, 1, membership.scope_id, membership.device_id,\n			membership.role, membership.status, membership.membership_epoch,\n			membership.coordinator_id, membership.group_id, membership.manifest_issuer_device_id,\n			membership.manifest_hash, membership.signed_manifest_json, membership.updated_at, ?\n		FROM coordinator_scope_memberships AS membership\n		WHERE changes() > 0 AND membership.scope_id = ? AND membership.device_id = ?").bind(t.effectId, t.requestJson, t.createdAt, t.scopeId, t.deviceId);
+}
+function B(e, t) {
+	return e.prepare("INSERT INTO coordinator_scope_membership_effect_receipts(\n			effect_id, action, request_json, outcome_applied, scope_id, device_id,\n			role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n			manifest_hash, signed_manifest_json, updated_at, created_at\n		)\n		SELECT ?, 'revoke', ?, changed.applied, ?, ?, membership.role, membership.status,\n			membership.membership_epoch, membership.coordinator_id, membership.group_id,\n			membership.manifest_issuer_device_id, membership.manifest_hash,\n			membership.signed_manifest_json, membership.updated_at, ?\n		FROM (SELECT CASE WHEN changes() > 0 THEN 1 ELSE 0 END AS applied) AS changed\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON changed.applied = 1 AND membership.scope_id = ? AND membership.device_id = ?\n		WHERE NOT EXISTS (\n			SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n		)").bind(t.effectId, t.requestJson, t.scopeId, t.deviceId, t.createdAt, t.scopeId, t.deviceId, t.effectId);
+}
+async function V(e, t) {
 	if (!e.batch) throw Error("D1 batch support is required for audited scope membership changes.");
 	return await e.batch(t);
 }
-function S(e) {
+function H(e) {
 	return Number(e?.meta?.changes ?? 0);
 }
-function C(e) {
+function U(e) {
 	if (!e) return null;
 	let t = String(e.seedDeviceId ?? "").trim(), n = String(e.expiresAt ?? "").trim(), r = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n) throw Error("bootstrapGrant.seedDeviceId and expiresAt are required.");
@@ -164,108 +268,245 @@ function C(e) {
 		createdBy: r
 	};
 }
-async function w(e) {
+async function W(e) {
 	let t = await e.all();
 	return Array.isArray(t?.results) ? t.results : [];
 }
-async function T(e) {
+async function G(e) {
 	return await e.first();
 }
-async function E(e) {
+async function K(e) {
 	let t = await e.run();
 	return Number(t?.meta?.changes ?? 0);
 }
-var D = class {
+var q = class {
 	db;
 	constructor(e) {
 		this.db = e;
 	}
 	async close() {}
 	async createGroup(e, t) {
-		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, s()).run();
+		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, y()).run();
 	}
 	async getGroup(e) {
-		let t = await T(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
-		return t ? r(t) : null;
+		let t = await G(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
+		return t ? h(t) : null;
 	}
 	async listGroups(e = !1) {
 		let t = e ? "" : "WHERE archived_at IS NULL";
-		return (await w(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => r(e));
+		return (await W(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => h(e));
 	}
 	async renameGroup(e, t) {
-		return await E(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
+		return await K(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
 	}
-	async archiveGroup(e, t = s()) {
-		return await E(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
+	async archiveGroup(e, t = y()) {
+		return await K(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
 	}
 	async unarchiveGroup(e) {
-		return await E(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
+		return await K(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
 	}
 	async enrollDevice(e, t) {
-		await this.db.prepare("INSERT INTO enrolled_devices(\n				group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n			) VALUES (?, ?, ?, ?, ?, 1, ?)\n			ON CONFLICT(group_id, device_id) DO UPDATE SET\n				public_key = excluded.public_key,\n				fingerprint = excluded.fingerprint,\n				display_name = excluded.display_name,\n				enabled = 1").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.displayName ?? null, s()).run();
+		if (await K(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, y())) === 0) throw Error("invite_identity_conflict");
 	}
 	async listEnrolledDevices(e, t) {
 		let n = t ? "" : "AND enabled = 1";
-		return (await w(this.db.prepare(`SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at
+		return (await W(this.db.prepare(`SELECT ${T}
 						 FROM enrolled_devices
 						 WHERE group_id = ? ${n}
-						 ORDER BY created_at ASC, device_id ASC`).bind(e))).map((e) => r(e));
+						 ORDER BY created_at ASC, device_id ASC`).bind(e))).map((e) => h(e));
 	}
-	async getEnrollment(e, t) {
-		let n = await T(this.db.prepare("SELECT group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n					 FROM enrolled_devices\n					 WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(e, t));
-		return n ? r(n) : null;
+	async getEnrollment(e, t, n = !1) {
+		let r = n ? "" : "AND enabled = 1", i = await G(this.db.prepare(`SELECT ${T}
+					 FROM enrolled_devices
+					 WHERE group_id = ? AND device_id = ? ${r}`).bind(e, t));
+		return i ? h(i) : null;
 	}
 	async renameDevice(e, t, n) {
-		return await E(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
+		return await K(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
 	}
 	async setDeviceEnabled(e, t, n) {
-		return await E(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
+		return await K(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
 	}
 	async removeDevice(e, t) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic device removal.");
-		return S((await this.db.batch([
+		return H((await this.db.batch([
 			this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t),
 			this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t),
 			this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)
 		]))[2]) > 0;
 	}
 	async recordNonce(e, t, n) {
-		return await E(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
+		return await K(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
 	}
 	async cleanupNonces(e) {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
-	async createInvite(t) {
-		let n = s(), i = u(12), a = u(24), o = e(t.expiresAt), c = await this.getGroup(t.groupId);
-		return await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)").bind(i, t.groupId, a, t.policy, o, n, t.createdBy ?? null, c?.display_name ?? null).run(), r(await T(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE invite_id = ?").bind(i)));
+	async createInvite(e) {
+		let t = y(), n = S(12), r = S(24), i = await C(r), o = a(e.expiresAt), s = await this.getGroup(e.groupId), c = String(e.operationId ?? "").trim() || null, l = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await O(e), d = u.inviteKind === "team_member" ? `identity:${S(18)}` : null;
+		if (!!c != !!l) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
+		let f = async () => {
+			if (!c) return null;
+			let t = await G(this.db.prepare(`SELECT ${w} FROM coordinator_invites WHERE operation_id = ?`).bind(c));
+			if (!t) return null;
+			if (t.consumed_at) throw Error("invite_already_bound");
+			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== u.inviteKind || t.reviewed_project_set_digest !== l || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== u.policyTeamId || t.target_identity_id !== u.targetIdentityId || t.reviewed_preview_digest !== u.reviewedPreviewDigest || t.reviewed_intent_json !== u.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
+			return h(t);
+		}, p = async (n) => {
+			if (!n.revoked_at && n.expires_at > t) return n;
+			await K(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, o, t, e.createdBy ?? null, s?.display_name ?? null, c, n.token, t));
+			let a = await f();
+			if (!a) throw Error("invite_operation_reissue_failed");
+			return a;
+		};
+		if (c) {
+			let e = await f();
+			if (e) return await p(e);
+		}
+		try {
+			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, o, t, e.createdBy ?? null, s?.display_name ?? null, c, l, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, c ? "pending" : null, u.inviteKind, u.policyTeamId, u.targetIdentityId, d, u.reviewedPreviewDigest, u.reviewedIntentJson).run();
+		} catch (e) {
+			if (c) {
+				let e = await f();
+				if (e) return await p(e);
+			}
+			throw e;
+		}
+		return h(await G(this.db.prepare(`SELECT ${w} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
 	}
 	async getInviteByToken(e) {
-		let t = await T(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites\n					 WHERE token = ?\n					   AND revoked_at IS NULL\n					   AND expires_at > ?").bind(e, s()));
-		return t ? r(t) : null;
+		let t = await C(e), n = await G(this.db.prepare(`SELECT ${w}
+					 FROM coordinator_invites
+					 WHERE (token_digest = ? OR token = ?)
+					   AND revoked_at IS NULL
+					   AND expires_at > ?`).bind(t, e, y()));
+		return n ? h(n) : null;
+	}
+	async getInviteByTokenForInspection(e) {
+		let t = await C(e), n = await G(this.db.prepare(`SELECT ${w} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
+		return n ? h(n) : null;
+	}
+	async inspectRecipientInvite(e) {
+		let t = await this.getInviteByTokenForInspection(e.token);
+		if (!t) return null;
+		let n = await k(t);
+		if (!n) return null;
+		if (t.revoked_at) throw Error("invite_invalid");
+		if (!t.consumed_at && new Date(t.expires_at) <= new Date(a(e.now))) throw Error("invite_expired");
+		let r = await this.getGroup(t.group_id);
+		if (!r) throw Error("group_not_found");
+		if (r.archived_at) throw Error("group_archived");
+		return n;
+	}
+	async consumeRecipientInvite(e) {
+		let t = a(e.now);
+		if (!e.identityId || !e.deviceId || !e.publicKey || !e.fingerprint || e.identityId !== e.identityId.trim() || e.deviceId !== e.deviceId.trim() || e.identityId.length > 256 || e.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e.identityId) || /[\p{Cc}\p{Cf}]/u.test(e.deviceId)) throw Error("invite_identity_conflict");
+		let n = await C(e.token), r = await this.getInviteByTokenForInspection(e.token), i = r ? await k(r) : null;
+		if (!r || !i || i.kind !== e.inviteKind || r.revoked_at) throw Error("invite_invalid");
+		let o = await this.getGroup(r.group_id);
+		if (!o) throw Error("group_not_found");
+		if (o.archived_at) throw Error("group_archived");
+		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
+		if (l(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		let s = d(i);
+		if (s !== e.identityId) throw Error("invite_identity_conflict");
+		let c = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
+		if (r.consumed_at && !c) throw Error("invite_already_bound");
+		if (r.consumed_at && r.recipient_actor_id !== s) throw Error("invite_identity_conflict");
+		let u = await G(this.db.prepare(`SELECT ${T}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
+		if (u && (u.public_key !== e.publicKey || u.fingerprint !== e.fingerprint || u.identity_id !== null && u.identity_id !== s)) throw Error("invite_identity_conflict");
+		let f = 0;
+		if (!r.consumed_at) {
+			if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
+			f = H((await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${r.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, s, n, e.token, t, e.inviteKind, r.reviewed_intent_json, r.reviewed_preview_digest, s, s, e.deviceId, e.publicKey, e.fingerprint, s), this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, NULL, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, n, e.token, e.deviceId, e.publicKey, e.fingerprint, s)]))[0]);
+		}
+		let p = await this.getGroup(r.group_id);
+		if (!p) throw Error("group_not_found");
+		if (p.archived_at) throw Error("group_archived");
+		let m = await G(this.db.prepare(`SELECT ${T}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
+		if (m && (m.public_key !== e.publicKey || m.fingerprint !== e.fingerprint || m.identity_id !== null && m.identity_id !== s)) throw Error("invite_identity_conflict");
+		let h = await this.getInviteByTokenForInspection(e.token);
+		if (!h || h.revoked_at || !h.consumed_at && new Date(h.expires_at) <= new Date(t)) throw Error("invite_invalid");
+		let g = await k(h);
+		if (!g || g.kind !== e.inviteKind) throw Error("invite_invalid");
+		if (d(g) !== s) throw Error("invite_identity_conflict");
+		if (h.bound_device_id !== e.deviceId || h.bound_public_key !== e.publicKey || h.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (h.recipient_actor_id !== s) throw Error("invite_identity_conflict");
+		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(s, h.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		let _ = await this.getEnrollment(h.group_id, e.deviceId);
+		if (!_) throw Error("invite_acceptance_incomplete");
+		if (_.public_key !== e.publicKey || _.fingerprint !== e.fingerprint || _.identity_id !== s) throw Error("invite_identity_conflict");
+		return {
+			status: f === 1 ? "accepted" : "existing",
+			invite: h,
+			reviewed_intent: g.reviewed_intent
+		};
+	}
+	async consumeProjectInvite(e) {
+		if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
+		let t = a(e.now), n = await C(e.token), r = await this.getInviteByTokenForInspection(e.token);
+		if (!r?.operation_id || !r.project_intent_json || r.revoked_at) throw Error("invite_invalid");
+		let i = await this.getGroup(r.group_id);
+		if (!i) throw Error("group_not_found");
+		if (i.archived_at) throw Error("group_archived");
+		if (r.operation_id !== e.operationId) throw Error("invite_invalid");
+		if (l(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
+		let o = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
+		if (r.consumed_at && !o) throw Error("invite_already_bound");
+		if (r.consumed_at && (r.recipient_actor_id !== e.recipientActorId || r.recipient_display_name !== e.recipientDisplayName || r.recipient_device_display_name !== e.deviceDisplayName)) throw Error("invite_identity_conflict");
+		let s = await G(this.db.prepare(`SELECT ${T}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
+		if (s && (s.public_key !== e.publicKey || s.fingerprint !== e.fingerprint)) throw Error("invite_identity_conflict");
+		let c = S(12), u = H((await this.db.batch([
+			this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n					bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n					recipient_display_name = ?, recipient_device_display_name = ?,\n					trust_state = 'pending_inviter_device'\n					WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)").bind(`consumed:${r.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, e.recipientActorId, e.recipientDisplayName, e.deviceDisplayName, n, e.token),
+			this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n				) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n					i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ? AND ? = 1\n				ON CONFLICT(group_id, device_id) DO UPDATE SET display_name = excluded.display_name, enabled = 1").bind(t, n, e.token, e.deviceId, +!r.consumed_at),
+			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(c, n, e.token, e.deviceId, t),
+			this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n					grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at,\n					created_by, revoked_at\n				) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n					i.expires_at, ?, i.inviter_actor_id, NULL FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					JOIN enrolled_devices e ON e.group_id = i.group_id AND e.device_id = i.inviter_device_id\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bootstrap_grant_id IS NOT NULL\n					AND i.bound_device_id = ? AND e.enabled = 1").bind(t, n, e.token, e.deviceId)
+		]))[0]) === 1, d = await this.getGroup(r.group_id);
+		if (!d) throw Error("group_not_found");
+		if (d.archived_at) throw Error("group_archived");
+		let f = await this.getInviteByTokenForInspection(e.token);
+		if (!f) throw Error("invite_invalid");
+		if (f.bound_device_id !== e.deviceId || f.bound_public_key !== e.publicKey || f.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (f.recipient_actor_id !== e.recipientActorId || f.recipient_display_name !== e.recipientDisplayName || f.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
+		let p = await this.getEnrollment(f.group_id, e.deviceId);
+		if (!p) throw Error("invite_acceptance_incomplete");
+		let m = f.inviter_device_id ? await this.getEnrollment(f.group_id, f.inviter_device_id) : null, h = f.bootstrap_grant_id ? await this.getBootstrapGrant(f.bootstrap_grant_id) : null;
+		return {
+			status: u ? "accepted" : "existing",
+			invite: f,
+			enrollment: p,
+			seed_enrollment: m,
+			bootstrap_grant: h
+		};
 	}
 	async listInvites(e) {
-		return (await w(this.db.prepare("SELECT invite_id, group_id, token, policy, expires_at, created_at, created_by, team_name_snapshot, revoked_at\n					 FROM coordinator_invites WHERE group_id = ?\n					 ORDER BY created_at DESC").bind(e))).map((e) => r(e));
+		return (await W(this.db.prepare(`SELECT ${w}
+					 FROM coordinator_invites WHERE group_id = ?
+					 ORDER BY created_at DESC`).bind(e))).map((e) => h(e));
 	}
 	async createJoinRequest(e) {
-		let t = s(), n = u(12);
-		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), r(await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
+		let t = y(), n = S(12);
+		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), h(await G(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
 	}
 	async listJoinRequests(e, t) {
 		let n = t ?? "pending";
-		return (await w(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => r(e));
+		return (await W(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => h(e));
 	}
 	async reviewJoinRequest(e) {
-		let t = await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		let t = await G(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!t) return null;
 		if (t.status !== "pending") return {
-			...r(t),
+			...h(t),
 			_no_transition: !0
 		};
-		let n = C(e.bootstrapGrant), i = s(), a = e.approved ? "approved" : "denied", o = null, c = null;
+		let n = U(e.bootstrapGrant), r = y(), i = e.approved ? "approved" : "denied", a = null, o = null;
 		if (e.approved && n) {
-			if (!await T(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
+			if (!await G(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
 			if (n.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
-			o = {
+			a = {
 				...n,
 				groupId: t.group_id,
 				workerDeviceId: t.device_id
@@ -273,10 +514,10 @@ var D = class {
 		}
 		if (this.db.batch) {
 			let t = [];
-			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(s(), e.requestId, i)), o)) {
-				c = u(12);
-				let n = s();
-				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(c, o.groupId, o.seedDeviceId, o.workerDeviceId, o.expiresAt, n, o.createdBy ?? null, e.requestId, i));
+			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(y(), e.requestId, r)), a)) {
+				o = S(12);
+				let n = y();
+				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(o, a.groupId, a.seedDeviceId, a.workerDeviceId, a.expiresAt, n, a.createdBy ?? null, e.requestId, r));
 			}
 			await this.db.batch(t);
 		} else {
@@ -286,182 +527,216 @@ var D = class {
 				fingerprint: t.fingerprint,
 				publicKey: t.public_key,
 				displayName: (t.display_name ?? "").trim() || null
-			}), o)) {
-				let e = await this.createBootstrapGrant(o);
-				n = e.grant_id, c = e.grant_id;
+			}), a)) {
+				let e = await this.createBootstrapGrant(a);
+				n = e.grant_id, o = e.grant_id;
 			}
-			if (await E(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(a, i, e.reviewedBy ?? null, e.requestId)) === 0) {
+			if (await K(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)) === 0) {
 				n && await this.revokeBootstrapGrant(n);
-				let t = await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+				let t = await G(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 				return t ? {
-					...r(t),
+					...h(t),
 					_no_transition: !0
 				} : null;
 			}
 		}
-		let l = await T(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
-		if (!l) return null;
-		let d = o ? c ? await this.getBootstrapGrant(c) : await this.createBootstrapGrant(o) : null;
+		let s = await G(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		if (!s) return null;
+		let c = a ? o ? await this.getBootstrapGrant(o) : await this.createBootstrapGrant(a) : null;
 		return {
-			...r(l),
-			bootstrap_grant: d
+			...h(s),
+			bootstrap_grant: c
 		};
 	}
 	async createReciprocalApproval(e) {
-		let t = e.groupId.trim(), n = e.requestingDeviceId.trim(), i = e.requestedDeviceId.trim();
-		if (!t || !n || !i) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
-		if (n === i) throw Error("requesting and requested device ids must differ.");
-		let a = c(n, i), o = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, i));
-		if (o) return r(o);
-		let d = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, i, n));
-		if (d) {
-			let e = s();
-			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, d.request_id).run(), r(await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(d.request_id)));
+		let t = e.groupId.trim(), n = e.requestingDeviceId.trim(), r = e.requestedDeviceId.trim();
+		if (!t || !n || !r) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
+		if (n === r) throw Error("requesting and requested device ids must differ.");
+		let i = b(n, r), a = await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
+		if (a) return h(a);
+		let o = await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
+		if (o) {
+			let e = y();
+			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, o.request_id).run(), h(await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(o.request_id)));
 		}
-		let f = u(12), p = s();
+		let s = S(12), c = y();
 		try {
-			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(f, t, n, i, a.low, a.high, p).run();
+			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(s, t, n, r, i.low, i.high, c).run();
 		} catch (e) {
-			if (!l(e)) throw e;
-			let a = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, i));
-			if (a) return r(a);
-			let o = await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, i, n));
-			if (o) {
-				let e = s();
-				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, o.request_id).run(), r(await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(o.request_id)));
+			if (!x(e)) throw e;
+			let i = await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
+			if (i) return h(i);
+			let a = await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
+			if (a) {
+				let e = y();
+				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, a.request_id).run(), h(await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a.request_id)));
 			}
 			throw e;
 		}
-		return r(await T(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(f)));
+		return h(await G(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(s)));
 	}
 	async createBootstrapGrant(e) {
-		let t = d(e), n = u(12), i = s();
-		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, i, t.createdBy).run(), r(await T(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
+		let t = E(e), n = S(12), r = y();
+		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, r, t.createdBy).run(), h(await G(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
 	}
 	async getScope(e) {
-		let t = await T(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
-		return t ? r(t) : null;
+		let t = await G(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
+		return t ? h(t) : null;
 	}
 	async getScopeMembership(e, t) {
-		let n = await T(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
-		return n ? r(n) : null;
+		let n = await G(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
+		return n ? h(n) : null;
 	}
 	async createScope(e) {
-		let t = m(e);
+		let t = j(e);
 		if (await this.getScope(t.scopeId)) throw Error("scopeId already exists.");
-		let n = s();
+		let n = y();
 		await this.db.prepare("INSERT INTO coordinator_scopes(\n					scope_id, label, kind, authority_type, coordinator_id, group_id,\n					manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(t.scopeId, t.label, t.kind, t.authorityType, t.coordinatorId, t.groupId, t.manifestIssuerDeviceId, t.membershipEpoch, t.manifestHash, t.status, n, n).run();
 		let r = await this.getScope(t.scopeId);
 		if (!r) throw Error("scope insert returned no row");
 		return r;
 	}
 	async updateScope(e) {
-		let t = f(e.scopeId), n = t ? await this.getScope(t) : null;
+		let t = D(e.scopeId), n = t ? await this.getScope(t) : null;
 		if (!n) return null;
-		let r = _(e, n);
-		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, s(), r.scopeId).run(), await this.getScope(r.scopeId);
+		let r = P(e, n);
+		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, y(), r.scopeId).run(), await this.getScope(r.scopeId);
 	}
 	async listScopes(e = {}) {
-		let t = [], n = [], i = f(e.coordinatorId), a = f(e.groupId), o = f(e.status);
-		i && (t.push("coordinator_id = ?"), n.push(i)), a && (t.push("group_id = ?"), n.push(a)), o ? (t.push("status = ?"), n.push(o)) : e.includeInactive || t.push("status = 'active'");
-		let s = t.length ? `WHERE ${t.join(" AND ")}` : "", c = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
+		let t = [], n = [], r = D(e.coordinatorId), i = D(e.groupId), a = D(e.status);
+		r && (t.push("coordinator_id = ?"), n.push(r)), i && (t.push("group_id = ?"), n.push(i)), a ? (t.push("status = ?"), n.push(a)) : e.includeInactive || t.push("status = 'active'");
+		let o = t.length ? `WHERE ${t.join(" AND ")}` : "", s = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
 				manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at
-			 FROM coordinator_scopes ${s}
+			 FROM coordinator_scopes ${o}
 			 ORDER BY coordinator_id ASC, group_id ASC, scope_id ASC`);
-		return (await w(n.length ? c.bind(...n) : c)).map((e) => r(e));
-	}
-	async grantScopeMembership(e) {
-		let t = f(e.scopeId), n = f(e.deviceId), i = t ? await this.getScope(t) : null;
-		if (!i) throw Error("scopeId must reference an existing scope.");
-		let a = t && n ? await this.getScopeMembership(t, n) : null, o = v(e, i, a);
-		if (o.groupId && !await this.getEnrollment(o.groupId, o.deviceId)) throw Error("device must be enrolled and enabled in the scope group.");
-		let c = s();
-		if (S((await x(this.db, [this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(o.scopeId, o.deviceId, o.role, o.membershipEpoch, o.coordinatorId, o.groupId, o.manifestIssuerDeviceId, o.manifestHash, o.signedManifestJson, c), b(this.db, {
-			action: "grant",
-			previous: a,
-			scopeId: o.scopeId,
-			deviceId: o.deviceId,
-			status: "active",
-			membershipEpoch: o.membershipEpoch,
-			updatedAt: c,
-			actorType: o.actorType,
-			actorId: o.actorId,
-			createdAt: c
-		})]))[0]) <= 0) throw Error("scope membership grant was not applied.");
-		return r(await T(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(o.scopeId, o.deviceId)));
-	}
-	async revokeScopeMembership(e) {
-		let t = f(e.scopeId), n = f(e.deviceId);
-		if (!t || !n) throw Error("scopeId and deviceId are required.");
-		let r = e.membershipEpoch == null ? null : p(e.membershipEpoch), i = await this.getScopeMembership(t, n);
-		if (!i) return !1;
-		if (r != null && i && r <= i.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let a = s(), o = r ?? i.membership_epoch + 1, c = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?").bind(r, r, f(e.manifestHash), f(e.signedManifestJson), a, t, n, i.membership_epoch, i.status), l = b(this.db, {
+		return (await W(n.length ? s.bind(...n) : s)).map((e) => h(e));
+	}
+	async grantScopeMembership(t) {
+		let n = o(t.effectId), a = r(t), s = await R(this.db, n);
+		if (s) return u(s, "grant", a), i(s);
+		let c = D(t.scopeId), l = D(t.deviceId), d = c ? await this.getScope(c) : null;
+		if (!d) throw new e("scope_not_found");
+		if (d.status !== "active") throw new e("scope_inactive");
+		let f = c && l ? await this.getScopeMembership(c, l) : null, p = F(t, d, f);
+		if (p.groupId && !await this.getEnrollment(p.groupId, p.deviceId)) throw new e("device_not_enrolled");
+		let m = y();
+		await V(this.db, [
+			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(p.scopeId, p.deviceId, p.role, p.membershipEpoch, p.coordinatorId, p.groupId, p.manifestIssuerDeviceId, p.manifestHash, p.signedManifestJson, m, n),
+			z(this.db, {
+				effectId: n,
+				requestJson: a,
+				scopeId: p.scopeId,
+				deviceId: p.deviceId,
+				createdAt: m
+			}),
+			L(this.db, {
+				effectId: n,
+				requestJson: a,
+				action: "grant",
+				previous: f,
+				scopeId: p.scopeId,
+				deviceId: p.deviceId,
+				status: "active",
+				membershipEpoch: p.membershipEpoch,
+				updatedAt: m,
+				actorType: p.actorType,
+				actorId: p.actorId,
+				createdAt: m
+			})
+		]);
+		let h = await R(this.db, n);
+		if (!h) throw Error("scope membership grant was not applied.");
+		return u(h, "grant", a), i(h);
+	}
+	async revokeScopeMembership(t) {
+		let r = D(t.scopeId), i = D(t.deviceId);
+		if (!r || !i) throw Error("scopeId and deviceId are required.");
+		let a = o(t.effectId), s = n(t), c = await R(this.db, a);
+		if (c) return u(c, "revoke", s), c.outcome_applied === 1;
+		let l = t.membershipEpoch == null ? null : A(t.membershipEpoch), d = D(t.groupId), f = d ? await this.getScope(r) : null;
+		if (d && d !== f?.group_id) throw new e("scope_group_mismatch");
+		let p = await this.getScopeMembership(r, i);
+		if (l != null && p && l <= p.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let m = y(), h = l ?? (p?.membership_epoch ?? -1) + 1, g = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(l, l, D(t.manifestHash), D(t.signedManifestJson), m, r, i, p?.membership_epoch ?? -1, p?.status ?? "", a), _ = B(this.db, {
+			effectId: a,
+			requestJson: s,
+			scopeId: r,
+			deviceId: i,
+			createdAt: m
+		}), v = L(this.db, {
+			effectId: a,
+			requestJson: s,
 			action: "revoke",
-			previous: i,
-			scopeId: t,
-			deviceId: n,
+			previous: p,
+			scopeId: r,
+			deviceId: i,
 			status: "revoked",
-			membershipEpoch: o,
-			updatedAt: a,
-			actorType: f(e.actorType),
-			actorId: f(e.actorId),
-			createdAt: a
-		}), u;
+			membershipEpoch: h,
+			updatedAt: m,
+			actorType: D(t.actorType),
+			actorId: D(t.actorId),
+			createdAt: m
+		});
 		try {
-			u = await x(this.db, [c, l]);
+			await V(this.db, [
+				g,
+				_,
+				v
+			]);
 		} catch (e) {
-			let r = await this.getScopeMembership(t, n);
-			if (!r || r.membership_epoch !== i.membership_epoch || r.status !== i.status) return !1;
+			let t = await this.getScopeMembership(r, i);
+			if (p && (!t || t.membership_epoch !== p.membership_epoch || t.status !== p.status)) return !1;
 			throw e;
 		}
-		return !(S(u[0]) <= 0);
+		let b = await R(this.db, a);
+		if (!b) throw Error("scope membership revoke receipt was not persisted.");
+		return u(b, "revoke", s), b.outcome_applied === 1;
 	}
 	async listScopeMemberships(e, t = !1) {
-		let n = f(e);
+		let n = D(e);
 		if (!n) throw Error("scopeId is required.");
-		let i = t ? "" : "AND status = 'active'";
-		return (await w(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
+		let r = t ? "" : "AND status = 'active'";
+		return (await W(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
 							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
 						 FROM coordinator_scope_memberships
-						 WHERE scope_id = ? ${i}
-						 ORDER BY device_id ASC`).bind(n))).map((e) => r(e));
+						 WHERE scope_id = ? ${r}
+						 ORDER BY device_id ASC`).bind(n))).map((e) => h(e));
 	}
 	async listScopeMembershipAuditEvents(e) {
-		let t = f(e.scopeId);
+		let t = D(e.scopeId);
 		if (!t) throw Error("scopeId is required.");
-		let n = f(e.deviceId), i = y(e.limit), a = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", o = n ? [
+		let n = D(e.deviceId), r = I(e.limit), i = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", a = n ? [
 			t,
 			n,
-			i
-		] : [t, i];
-		return (await w(this.db.prepare(`SELECT event_id, action, scope_id, device_id, role, status, membership_epoch,
+			r
+		] : [t, r];
+		return (await W(this.db.prepare(`SELECT event_id, effect_id, action, scope_id, device_id, role, status, membership_epoch,
 							previous_role, previous_status, previous_membership_epoch,
 							coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at
 						 FROM coordinator_scope_membership_audit_log
-						 WHERE ${a}
+						 WHERE ${i}
 						 ORDER BY event_id ASC
-						 LIMIT ?`).bind(...o))).map((e) => r(e));
+						 LIMIT ?`).bind(...a))).map((e) => h(e));
 	}
 	async getBootstrapGrant(e) {
-		let t = await T(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
-		return t ? r(t) : null;
+		let t = await G(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
+		return t ? h(t) : null;
 	}
 	async listBootstrapGrants(e) {
-		return (await w(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => r(e));
+		return (await W(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => h(e));
 	}
-	async revokeBootstrapGrant(e, t = s()) {
-		return await E(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
+	async revokeBootstrapGrant(e, t = y()) {
+		return await K(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
 	}
 	async listReciprocalApprovals(e) {
 		let t = e.direction === "incoming" ? "requested_device_id" : "requesting_device_id", n = e.status?.trim() || "pending";
-		return (await w(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
+		return (await W(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
 						 FROM coordinator_reciprocal_approvals
 						 WHERE group_id = ? AND ${t} = ? AND status = ?
-						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => r(e));
+						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => h(e));
 	}
 	async upsertPresence(e) {
-		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = o([], e.addresses);
+		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = v([], e.addresses);
 		return await this.db.prepare("INSERT INTO presence_records(group_id, device_id, addresses_json, last_seen_at, expires_at, capabilities_json)\n				 VALUES (?, ?, ?, ?, ?, ?)\n				 ON CONFLICT(group_id, device_id) DO UPDATE SET\n					addresses_json = excluded.addresses_json,\n					last_seen_at = excluded.last_seen_at,\n					expires_at = excluded.expires_at,\n					capabilities_json = excluded.capabilities_json").bind(e.groupId, e.deviceId, JSON.stringify(r), t.toISOString(), n, JSON.stringify(e.capabilities ?? {})).run(), {
 			group_id: e.groupId,
 			device_id: e.deviceId,
@@ -470,14 +745,14 @@ var D = class {
 		};
 	}
 	async listGroupPeers(e, t) {
-		let n = s();
-		return (await w(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
+		let n = y();
+		return (await W(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
 			let t = String(e.expires_at ?? "").trim(), r = !0;
 			if (t) {
 				let e = new Date(t);
 				r = Number.isNaN(e.getTime()) || e.toISOString() <= n;
 			}
-			let i = r ? [] : o([], JSON.parse(String(e.addresses_json ?? "[]")));
+			let i = r ? [] : v([], JSON.parse(String(e.addresses_json ?? "[]")));
 			return {
 				device_id: String(e.device_id ?? ""),
 				public_key: String(e.public_key ?? ""),
@@ -494,9 +769,9 @@ var D = class {
 };
 //#endregion
 //#region src/d1-coordinator-runtime.ts
-function O(e) {
-	return n({
-		storeFactory: () => new D(e.db),
+function J(e) {
+	return p({
+		storeFactory: () => new q(e.db),
 		runtime: {
 			adminSecret: () => String(e.adminSecret ?? "").trim() || null,
 			now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
@@ -505,6 +780,6 @@ function O(e) {
 	});
 }
 //#endregion
-export { D as D1CoordinatorStore, t as DEFAULT_TIME_WINDOW_S, O as createD1CoordinatorApp };
+export { q as D1CoordinatorStore, f as DEFAULT_TIME_WINDOW_S, J as createD1CoordinatorApp };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map