@codemem/core 0.40.2 → 0.42.0

package/dist/internal/cloudflare-coordinator.js

@@ -1,4 +1,4 @@
-import { Qa as e, Xa as t, ao as n, co as r, do as i, eo as a, fo as o, lo as s, ma as c, oo as l, po as u, qa as d, so as f, t as p, uo as m } from "../coordinator-api-CvU8oTg1.js";
+import { B as e, D as t, G as n, H as r, K as i, R as a, U as o, V as s, W as c, j as l, k as u, n as d, t as f, w as p, z as m } from "../coordinator-api-SeLosPIq.js";
 //#region src/d1-coordinator-store.ts
 function h(e) {
 	if (e == null) throw Error("expected row");
@@ -92,7 +92,7 @@ function k(e) {
 	return e?.trim() || null;
 }
 async function A(e) {
-	let n = e.inviteKind ?? (k(e.operationId) ? "project_share" : "legacy_enrollment"), r = k(e.policyTeamId), i = k(e.targetIdentityId), o = k(e.reviewedPreviewDigest);
+	let n = e.inviteKind ?? (k(e.operationId) ? "project_share" : "legacy_enrollment"), r = k(e.policyTeamId), i = k(e.targetIdentityId), a = k(e.reviewedPreviewDigest);
 	if (![
 		"legacy_enrollment",
 		"project_share",
@@ -100,83 +100,83 @@ async function A(e) {
 		"add_device"
 	].includes(n)) throw Error("inviteKind is invalid.");
 	if ([r, i].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) throw Error("recipient invite identifier is invalid.");
-	if (o && !/^[a-f0-9]{64}$/u.test(o)) throw Error("reviewedPreviewDigest must be a SHA-256 digest.");
+	if (a && !/^[a-f0-9]{64}$/u.test(a)) throw Error("reviewedPreviewDigest must be a SHA-256 digest.");
 	if (n === "project_share") {
 		if (!k(e.operationId)) throw Error("project_share invite requires operationId.");
-		if (r || i || o) throw Error("recipient invite metadata requires a recipient invite kind.");
+		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
 	} else if (n === "legacy_enrollment") {
 		if (k(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
-		if (r || i || o) throw Error("recipient invite metadata requires a recipient invite kind.");
+		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
 	} else if (n === "team_member") {
-		if (!r || !o || i || k(e.operationId)) throw Error("team_member invite metadata is invalid.");
-	} else if (n === "add_device" && (!i || !o || r || k(e.operationId))) throw Error("add_device invite metadata is invalid.");
+		if (!r || !a || i || k(e.operationId)) throw Error("team_member invite metadata is invalid.");
+	} else if (n === "add_device" && (!i || !a || r || k(e.operationId))) throw Error("add_device invite metadata is invalid.");
 	if (!(e.reviewedIntent !== void 0 && e.reviewedIntent !== null)) {
 		if (n === "team_member" || n === "add_device") throw Error("recipient_invite_review_unavailable");
 		return {
 			inviteKind: n,
 			policyTeamId: r,
 			targetIdentityId: i,
-			reviewedPreviewDigest: o,
+			reviewedPreviewDigest: a,
 			reviewedIntentJson: null
 		};
 	}
-	let s;
-	if (n === "team_member" && r && o) s = {
+	let o;
+	if (n === "team_member" && r && a) o = {
 		kind: "team_member",
 		policyTeamId: r
 	};
-	else if (n === "add_device" && i && o) s = {
+	else if (n === "add_device" && i && a) o = {
 		kind: "add_device",
 		targetIdentityId: i
 	};
 	else throw Error("recipient invite metadata requires a recipient invite kind.");
-	return await a(e.reviewedIntent, {
-		target: s,
-		digest: o
+	return await l(e.reviewedIntent, {
+		target: o,
+		digest: a
 	}), {
 		inviteKind: n,
 		policyTeamId: r,
 		targetIdentityId: i,
-		reviewedPreviewDigest: o,
-		reviewedIntentJson: t(e.reviewedIntent, s)
+		reviewedPreviewDigest: a,
+		reviewedIntentJson: t(e.reviewedIntent, o)
 	};
 }
-async function j(t) {
-	if (t.invite_kind === "team_member") {
-		if (!t.policy_team_id || !n(t.assigned_identity_id) || !t.reviewed_preview_digest) throw Error("invite_invalid");
-		let r = await e(t.reviewed_intent_json, {
+async function j(e) {
+	if (e.invite_kind === "team_member") {
+		if (!e.policy_team_id || !a(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let t = await u(e.reviewed_intent_json, {
 			target: {
 				kind: "team_member",
-				policyTeamId: t.policy_team_id
+				policyTeamId: e.policy_team_id
 			},
-			digest: t.reviewed_preview_digest
+			digest: e.reviewed_preview_digest
 		});
 		return {
 			kind: "team_member",
-			invite: t,
-			policy_team_id: t.policy_team_id,
-			assigned_identity_id: t.assigned_identity_id,
-			reviewed_preview_digest: t.reviewed_preview_digest,
-			reviewed_intent: r,
-			bound: !!t.consumed_at
+			invite: e,
+			policy_team_id: e.policy_team_id,
+			assigned_identity_id: e.assigned_identity_id,
+			reviewed_preview_digest: e.reviewed_preview_digest,
+			reviewed_intent: t,
+			bound: !!e.consumed_at
 		};
 	}
-	if (t.invite_kind === "add_device") {
-		if (!t.target_identity_id || !t.reviewed_preview_digest) throw Error("invite_invalid");
-		let n = await e(t.reviewed_intent_json, {
+	if (e.invite_kind === "add_device") {
+		if (!e.target_identity_id || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let t = await u(e.reviewed_intent_json, {
 			target: {
 				kind: "add_device",
-				targetIdentityId: t.target_identity_id
+				targetIdentityId: e.target_identity_id
 			},
-			digest: t.reviewed_preview_digest
+			digest: e.reviewed_preview_digest
 		});
 		return {
 			kind: "add_device",
-			invite: t,
-			target_identity_id: t.target_identity_id,
-			reviewed_preview_digest: t.reviewed_preview_digest,
-			reviewed_intent: n,
-			bound: !!t.consumed_at
+			invite: e,
+			target_identity_id: e.target_identity_id,
+			reviewed_preview_digest: e.reviewed_preview_digest,
+			reviewed_intent: t,
+			bound: !!e.consumed_at
 		};
 	}
 	return null;
@@ -230,18 +230,18 @@ function I(e, t) {
 	};
 }
 function L(e, t, n) {
-	let i = k(e.scopeId), a = k(e.deviceId);
-	if (!i || !a) throw Error("scopeId and deviceId are required.");
-	let o = k(e.coordinatorId), s = k(e.groupId);
-	if (o && o !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
-	if (s && s !== t?.group_id) throw new r("scope_group_mismatch");
+	let r = k(e.scopeId), i = k(e.deviceId);
+	if (!r || !i) throw Error("scopeId and deviceId are required.");
+	let a = k(e.coordinatorId), o = k(e.groupId);
+	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
+	if (o && o !== t?.group_id) throw new s("scope_group_mismatch");
 	let c = e.membershipEpoch == null ? null : M(e.membershipEpoch), l = t?.membership_epoch ?? 0;
 	if (c != null && c < l) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
 	if (c != null && n && c < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
 	let u = c ?? (n ? Math.max(l, n.membership_epoch + +(n.status === "revoked")) : l);
 	return {
-		scopeId: i,
-		deviceId: a,
+		scopeId: r,
+		deviceId: i,
 		role: k(e.role) ?? "member",
 		membershipEpoch: u,
 		coordinatorId: t?.coordinator_id ?? null,
@@ -364,32 +364,32 @@ var Y = class {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
 	async createInvite(e) {
-		let t = b(), n = C(12), r = C(24), i = await w(r), a = l(e.expiresAt), o = await this.getGroup(e.groupId), s = String(e.operationId ?? "").trim() || null, c = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await A(e), d = u.inviteKind === "team_member" ? `identity:${C(18)}` : null;
+		let t = b(), n = C(12), r = C(24), i = await w(r), a = m(e.expiresAt), o = await this.getGroup(e.groupId), s = String(e.operationId ?? "").trim() || null, c = String(e.reviewedProjectSetDigest ?? "").trim() || null, l = await A(e), u = l.inviteKind === "team_member" ? `identity:${C(18)}` : null;
 		if (!!s != !!c) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
-		let f = async () => {
+		let d = async () => {
 			if (!s) return null;
 			let t = await q(this.db.prepare(`SELECT ${T} FROM coordinator_invites WHERE operation_id = ?`).bind(s));
 			if (!t) return null;
 			if (t.consumed_at) throw Error("invite_already_bound");
-			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== u.inviteKind || t.reviewed_project_set_digest !== c || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== u.policyTeamId || t.target_identity_id !== u.targetIdentityId || t.reviewed_preview_digest !== u.reviewedPreviewDigest || t.reviewed_intent_json !== u.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
+			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== l.inviteKind || t.reviewed_project_set_digest !== c || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== l.policyTeamId || t.target_identity_id !== l.targetIdentityId || t.reviewed_preview_digest !== l.reviewedPreviewDigest || t.reviewed_intent_json !== l.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
 			return h(t);
-		}, p = async (n) => {
+		}, f = async (n) => {
 			if (!n.revoked_at && n.expires_at > t) return n;
 			await J(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, o?.display_name ?? null, s, n.token, t));
-			let c = await f();
+			let c = await d();
 			if (!c) throw Error("invite_operation_reissue_failed");
 			return c;
 		};
 		if (s) {
-			let e = await f();
-			if (e) return await p(e);
+			let e = await d();
+			if (e) return await f(e);
 		}
 		try {
-			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, o?.display_name ?? null, s, c, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, s ? "pending" : null, u.inviteKind, u.policyTeamId, u.targetIdentityId, d, u.reviewedPreviewDigest, u.reviewedIntentJson).run();
+			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, o?.display_name ?? null, s, c, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, s ? "pending" : null, l.inviteKind, l.policyTeamId, l.targetIdentityId, u, l.reviewedPreviewDigest, l.reviewedIntentJson).run();
 		} catch (e) {
 			if (s) {
-				let e = await f();
-				if (e) return await p(e);
+				let e = await d();
+				if (e) return await f(e);
 			}
 			throw e;
 		}
@@ -413,69 +413,69 @@ var Y = class {
 		let n = await j(t);
 		if (!n) return null;
 		if (t.revoked_at) throw Error("invite_invalid");
-		if (!t.consumed_at && new Date(t.expires_at) <= new Date(l(e.now))) throw Error("invite_expired");
+		if (!t.consumed_at && new Date(t.expires_at) <= new Date(m(e.now))) throw Error("invite_expired");
 		let r = await this.getGroup(t.group_id);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
 		return n;
 	}
-	async consumeRecipientInvite(e) {
-		let t = l(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
-		if (!e.identityId || !e.deviceId || !e.publicKey || !e.fingerprint || e.identityId !== e.identityId.trim() || e.deviceId !== e.deviceId.trim() || e.identityId.length > 256 || e.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e.identityId) || /[\p{Cc}\p{Cf}]/u.test(e.deviceId)) throw Error("invite_identity_conflict");
-		let i = await w(e.token), a = await this.getInviteByTokenForInspection(e.token), o = a ? await j(a) : null;
-		if (!a || !o || o.kind !== e.inviteKind || a.revoked_at) throw Error("invite_invalid");
-		let s = await this.getGroup(a.group_id);
-		if (!s) throw Error("group_not_found");
-		if (s.archived_at) throw Error("group_archived");
-		if (!a.consumed_at && new Date(a.expires_at) <= new Date(t)) throw Error("invite_expired");
-		if (d(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
-		let c = f(o);
-		if (c !== e.identityId) throw Error("invite_identity_conflict");
-		let u = a.bound_device_id === e.deviceId && a.bound_public_key === e.publicKey && a.bound_fingerprint === e.fingerprint;
-		if (a.consumed_at && !u) throw Error("invite_already_bound");
-		if (a.consumed_at && a.recipient_actor_id !== c) throw Error("invite_identity_conflict");
-		let p = await q(this.db.prepare(`SELECT ${E}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(a.group_id, e.deviceId));
-		if (p && (p.public_key !== e.publicKey || p.fingerprint !== e.fingerprint || p.identity_id !== null && p.identity_id !== c)) throw Error("invite_identity_conflict");
-		let m = 0, h = C(12);
-		if (!a.consumed_at) {
+	async consumeRecipientInvite(t) {
+		let n = m(t.now), r = t.recipientDisplayName ?? null, i = t.deviceDisplayName ?? null;
+		if (!t.identityId || !t.deviceId || !t.publicKey || !t.fingerprint || t.identityId !== t.identityId.trim() || t.deviceId !== t.deviceId.trim() || t.identityId.length > 256 || t.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(t.identityId) || /[\p{Cc}\p{Cf}]/u.test(t.deviceId)) throw Error("invite_identity_conflict");
+		let a = await w(t.token), o = await this.getInviteByTokenForInspection(t.token), s = o ? await j(o) : null;
+		if (!o || !s || s.kind !== t.inviteKind || o.revoked_at) throw Error("invite_invalid");
+		let c = await this.getGroup(o.group_id);
+		if (!c) throw Error("group_not_found");
+		if (c.archived_at) throw Error("group_archived");
+		if (!o.consumed_at && new Date(o.expires_at) <= new Date(n)) throw Error("invite_expired");
+		if (p(t.publicKey) !== t.fingerprint) throw Error("fingerprint_mismatch");
+		let l = e(s);
+		if (l !== t.identityId) throw Error("invite_identity_conflict");
+		let u = o.bound_device_id === t.deviceId && o.bound_public_key === t.publicKey && o.bound_fingerprint === t.fingerprint;
+		if (o.consumed_at && !u) throw Error("invite_already_bound");
+		if (o.consumed_at && o.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		let d = await q(this.db.prepare(`SELECT ${E}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, t.deviceId));
+		if (d && (d.public_key !== t.publicKey || d.fingerprint !== t.fingerprint || d.identity_id !== null && d.identity_id !== l)) throw Error("invite_identity_conflict");
+		let f = 0, h = C(12);
+		if (!o.consumed_at) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-			m = W((await this.db.batch([
-				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${a.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, c, n, r, i, e.token, t, e.inviteKind, a.reviewed_intent_json, a.reviewed_preview_digest, c, c, e.deviceId, e.publicKey, e.fingerprint, c),
-				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, i, e.token, e.deviceId, e.publicKey, e.fingerprint, c),
-				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(h, i, e.token, t),
-				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, i, e.token, e.deviceId)
+			f = W((await this.db.batch([
+				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${o.invite_id}`, n, t.deviceId, t.publicKey, t.fingerprint, l, r, i, a, t.token, n, t.inviteKind, o.reviewed_intent_json, o.reviewed_preview_digest, l, l, t.deviceId, t.publicKey, t.fingerprint, l),
+				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(n, a, t.token, t.deviceId, t.publicKey, t.fingerprint, l),
+				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(h, a, t.token, n),
+				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(n, a, t.token, t.deviceId)
 			]))[0]);
 		}
-		let g = await this.getGroup(a.group_id);
+		let g = await this.getGroup(o.group_id);
 		if (!g) throw Error("group_not_found");
 		if (g.archived_at) throw Error("group_archived");
 		let _ = await q(this.db.prepare(`SELECT ${E}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(a.group_id, e.deviceId));
-		if (_ && (_.public_key !== e.publicKey || _.fingerprint !== e.fingerprint || _.identity_id !== null && _.identity_id !== c)) throw Error("invite_identity_conflict");
-		let v = await this.getInviteByTokenForInspection(e.token);
-		if (!v || v.revoked_at || !v.consumed_at && new Date(v.expires_at) <= new Date(t)) throw Error("invite_invalid");
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, t.deviceId));
+		if (_ && (_.public_key !== t.publicKey || _.fingerprint !== t.fingerprint || _.identity_id !== null && _.identity_id !== l)) throw Error("invite_identity_conflict");
+		let v = await this.getInviteByTokenForInspection(t.token);
+		if (!v || v.revoked_at || !v.consumed_at && new Date(v.expires_at) <= new Date(n)) throw Error("invite_invalid");
 		let y = await j(v);
-		if (!y || y.kind !== e.inviteKind) throw Error("invite_invalid");
-		if (f(y) !== c) throw Error("invite_identity_conflict");
-		if (v.bound_device_id !== e.deviceId || v.bound_public_key !== e.publicKey || v.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (v.recipient_actor_id !== c) throw Error("invite_identity_conflict");
-		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(c, v.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let b = await this.getEnrollment(v.group_id, e.deviceId);
+		if (!y || y.kind !== t.inviteKind) throw Error("invite_invalid");
+		if (e(y) !== l) throw Error("invite_identity_conflict");
+		if (v.bound_device_id !== t.deviceId || v.bound_public_key !== t.publicKey || v.bound_fingerprint !== t.fingerprint) throw Error("invite_already_bound");
+		if (v.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(l, v.group_id, t.deviceId, t.publicKey, t.fingerprint).run();
+		let b = await this.getEnrollment(v.group_id, t.deviceId);
 		if (!b) throw Error("invite_acceptance_incomplete");
-		if (b.public_key !== e.publicKey || b.fingerprint !== e.fingerprint || b.identity_id !== c) throw Error("invite_identity_conflict");
+		if (b.public_key !== t.publicKey || b.fingerprint !== t.fingerprint || b.identity_id !== l) throw Error("invite_identity_conflict");
 		let x = v;
-		if (y.kind === "add_device" && v.inviter_device_id && !v.bootstrap_grant_id && new Date(v.expires_at) > new Date(t)) {
+		if (y.kind === "add_device" && v.inviter_device_id && !v.bootstrap_grant_id && new Date(v.expires_at) > new Date(n)) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic bootstrap grant recovery.");
-			let n = C(12);
-			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, v.invite_id, e.deviceId, c, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, v.invite_id, e.deviceId)]);
-			let r = await this.getInviteByTokenForInspection(e.token);
+			let e = C(12);
+			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(e, v.invite_id, t.deviceId, l, n), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(n, v.invite_id, t.deviceId)]);
+			let r = await this.getInviteByTokenForInspection(t.token);
 			if (!r) throw Error("invite_invalid");
 			x = r;
 		}
 		let S = x.bootstrap_grant_id ? await this.getBootstrapGrant(x.bootstrap_grant_id) : null;
 		return {
-			status: m === 1 ? "accepted" : "existing",
+			status: f === 1 ? "accepted" : "existing",
 			invite: x,
 			reviewed_intent: y.reviewed_intent,
 			bootstrap_grant: S
@@ -483,13 +483,13 @@ var Y = class {
 	}
 	async consumeProjectInvite(e) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-		let t = l(e.now), n = await w(e.token), r = await this.getInviteByTokenForInspection(e.token);
+		let t = m(e.now), n = await w(e.token), r = await this.getInviteByTokenForInspection(e.token);
 		if (!r?.operation_id || !r.project_intent_json || r.revoked_at) throw Error("invite_invalid");
 		let i = await this.getGroup(r.group_id);
 		if (!i) throw Error("group_not_found");
 		if (i.archived_at) throw Error("group_archived");
 		if (r.operation_id !== e.operationId) throw Error("invite_invalid");
-		if (d(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		if (p(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
 		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
 		let a = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
 		if (r.consumed_at && !a) throw Error("invite_already_bound");
@@ -502,23 +502,23 @@ var Y = class {
 			this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n					i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ? AND ? = 1\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name, enabled = 1\n				WHERE enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(t, n, e.token, e.deviceId, +!r.consumed_at),
 			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(s, n, e.token, e.deviceId, t),
 			this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n					grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at,\n					created_by, revoked_at\n				) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n					i.expires_at, ?, i.inviter_actor_id, NULL FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					JOIN enrolled_devices e ON e.group_id = i.group_id AND e.device_id = i.inviter_device_id\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bootstrap_grant_id IS NOT NULL\n					AND i.bound_device_id = ? AND e.enabled = 1").bind(t, n, e.token, e.deviceId)
-		]))[0]) === 1, u = await this.getGroup(r.group_id);
-		if (!u) throw Error("group_not_found");
-		if (u.archived_at) throw Error("group_archived");
-		let f = await this.getInviteByTokenForInspection(e.token);
-		if (!f) throw Error("invite_invalid");
-		if (f.bound_device_id !== e.deviceId || f.bound_public_key !== e.publicKey || f.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (f.recipient_actor_id !== e.recipientActorId || f.recipient_display_name !== e.recipientDisplayName || f.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
-		c || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, f.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let p = await this.getEnrollment(f.group_id, e.deviceId);
-		if (!p) throw Error("invite_acceptance_incomplete");
-		if (p.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
-		let m = f.inviter_device_id ? await this.getEnrollment(f.group_id, f.inviter_device_id) : null, h = f.bootstrap_grant_id ? await this.getBootstrapGrant(f.bootstrap_grant_id) : null;
+		]))[0]) === 1, l = await this.getGroup(r.group_id);
+		if (!l) throw Error("group_not_found");
+		if (l.archived_at) throw Error("group_archived");
+		let u = await this.getInviteByTokenForInspection(e.token);
+		if (!u) throw Error("invite_invalid");
+		if (u.bound_device_id !== e.deviceId || u.bound_public_key !== e.publicKey || u.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (u.recipient_actor_id !== e.recipientActorId || u.recipient_display_name !== e.recipientDisplayName || u.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
+		c || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, u.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		let d = await this.getEnrollment(u.group_id, e.deviceId);
+		if (!d) throw Error("invite_acceptance_incomplete");
+		if (d.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
+		let f = u.inviter_device_id ? await this.getEnrollment(u.group_id, u.inviter_device_id) : null, h = u.bootstrap_grant_id ? await this.getBootstrapGrant(u.bootstrap_grant_id) : null;
 		return {
 			status: c ? "accepted" : "existing",
-			invite: f,
-			enrollment: p,
-			seed_enrollment: m,
+			invite: u,
+			enrollment: d,
+			seed_enrollment: f,
 			bootstrap_grant: h
 		};
 	}
@@ -652,64 +652,64 @@ var Y = class {
 		return (await K(n.length ? s.bind(...n) : s)).map((e) => h(e));
 	}
 	async grantScopeMembership(e) {
-		let t = o(e.effectId), n = m(e), a = await B(this.db, t);
-		if (a) return s(a, "grant", n), i(a);
-		let c = k(e.scopeId), l = k(e.deviceId), u = c ? await this.getScope(c) : null;
-		if (!u) throw new r("scope_not_found");
-		if (u.status !== "active") throw new r("scope_inactive");
-		let d = c && l ? await this.getScopeMembership(c, l) : null, f = L(e, u, d);
-		if (f.groupId && !await this.getEnrollment(f.groupId, f.deviceId)) throw new r("device_not_enrolled");
-		let p = b();
+		let t = n(e.effectId), i = o(e), a = await B(this.db, t);
+		if (a) return r(a, "grant", i), c(a);
+		let l = k(e.scopeId), u = k(e.deviceId), d = l ? await this.getScope(l) : null;
+		if (!d) throw new s("scope_not_found");
+		if (d.status !== "active") throw new s("scope_inactive");
+		let f = l && u ? await this.getScopeMembership(l, u) : null, p = L(e, d, f);
+		if (p.groupId && !await this.getEnrollment(p.groupId, p.deviceId)) throw new s("device_not_enrolled");
+		let m = b();
 		await U(this.db, [
-			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(f.scopeId, f.deviceId, f.role, f.membershipEpoch, f.coordinatorId, f.groupId, f.manifestIssuerDeviceId, f.manifestHash, f.signedManifestJson, p, t),
+			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(p.scopeId, p.deviceId, p.role, p.membershipEpoch, p.coordinatorId, p.groupId, p.manifestIssuerDeviceId, p.manifestHash, p.signedManifestJson, m, t),
 			V(this.db, {
 				effectId: t,
-				requestJson: n,
-				scopeId: f.scopeId,
-				deviceId: f.deviceId,
-				createdAt: p
+				requestJson: i,
+				scopeId: p.scopeId,
+				deviceId: p.deviceId,
+				createdAt: m
 			}),
 			z(this.db, {
 				effectId: t,
-				requestJson: n,
+				requestJson: i,
 				action: "grant",
-				previous: d,
-				scopeId: f.scopeId,
-				deviceId: f.deviceId,
+				previous: f,
+				scopeId: p.scopeId,
+				deviceId: p.deviceId,
 				status: "active",
-				membershipEpoch: f.membershipEpoch,
-				updatedAt: p,
-				actorType: f.actorType,
-				actorId: f.actorId,
-				createdAt: p
+				membershipEpoch: p.membershipEpoch,
+				updatedAt: m,
+				actorType: p.actorType,
+				actorId: p.actorId,
+				createdAt: m
 			})
 		]);
 		let h = await B(this.db, t);
 		if (!h) throw Error("scope membership grant was not applied.");
-		return s(h, "grant", n), i(h);
+		return r(h, "grant", i), c(h);
 	}
 	async revokeScopeMembership(e) {
-		let t = k(e.scopeId), n = k(e.deviceId);
-		if (!t || !n) throw Error("scopeId and deviceId are required.");
-		let i = o(e.effectId), a = u(e), c = await B(this.db, i);
-		if (c) return s(c, "revoke", a), c.outcome_applied === 1;
-		let l = e.membershipEpoch == null ? null : M(e.membershipEpoch), d = k(e.groupId), f = d ? await this.getScope(t) : null;
-		if (d && d !== f?.group_id) throw new r("scope_group_mismatch");
-		let p = await this.getScopeMembership(t, n);
-		if (l != null && p && l <= p.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let m = b(), h = l ?? (p?.membership_epoch ?? -1) + 1, g = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(l, l, k(e.manifestHash), k(e.signedManifestJson), m, t, n, p?.membership_epoch ?? -1, p?.status ?? "", i), _ = H(this.db, {
-			effectId: i,
-			requestJson: a,
+		let t = k(e.scopeId), a = k(e.deviceId);
+		if (!t || !a) throw Error("scopeId and deviceId are required.");
+		let o = n(e.effectId), c = i(e), l = await B(this.db, o);
+		if (l) return r(l, "revoke", c), l.outcome_applied === 1;
+		let u = e.membershipEpoch == null ? null : M(e.membershipEpoch), d = k(e.groupId), f = d ? await this.getScope(t) : null;
+		if (d && d !== f?.group_id) throw new s("scope_group_mismatch");
+		let p = await this.getScopeMembership(t, a);
+		if (u != null && p && u <= p.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let m = b(), h = u ?? (p?.membership_epoch ?? -1) + 1, g = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(u, u, k(e.manifestHash), k(e.signedManifestJson), m, t, a, p?.membership_epoch ?? -1, p?.status ?? "", o), _ = H(this.db, {
+			effectId: o,
+			requestJson: c,
 			scopeId: t,
-			deviceId: n,
+			deviceId: a,
 			createdAt: m
 		}), v = z(this.db, {
-			effectId: i,
-			requestJson: a,
+			effectId: o,
+			requestJson: c,
 			action: "revoke",
 			previous: p,
 			scopeId: t,
-			deviceId: n,
+			deviceId: a,
 			status: "revoked",
 			membershipEpoch: h,
 			updatedAt: m,
@@ -724,13 +724,13 @@ var Y = class {
 				v
 			]);
 		} catch (e) {
-			let r = await this.getScopeMembership(t, n);
-			if (p && (!r || r.membership_epoch !== p.membership_epoch || r.status !== p.status)) return !1;
+			let n = await this.getScopeMembership(t, a);
+			if (p && (!n || n.membership_epoch !== p.membership_epoch || n.status !== p.status)) return !1;
 			throw e;
 		}
-		let y = await B(this.db, i);
+		let y = await B(this.db, o);
 		if (!y) throw Error("scope membership revoke receipt was not persisted.");
-		return s(y, "revoke", a), y.outcome_applied === 1;
+		return r(y, "revoke", c), y.outcome_applied === 1;
 	}
 	async listScopeMemberships(e, t = !1) {
 		let n = k(e);
@@ -810,7 +810,7 @@ var Y = class {
 //#endregion
 //#region src/d1-coordinator-runtime.ts
 function X(e) {
-	return p({
+	return f({
 		storeFactory: () => new Y(e.db),
 		runtime: {
 			adminSecret: () => String(e.adminSecret ?? "").trim() || null,
@@ -820,6 +820,6 @@ function X(e) {
 	});
 }
 //#endregion
-export { Y as D1CoordinatorStore, c as DEFAULT_TIME_WINDOW_S, X as createD1CoordinatorApp };
+export { Y as D1CoordinatorStore, d as DEFAULT_TIME_WINDOW_S, X as createD1CoordinatorApp };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map

package/dist/operational-status.d.ts

@@ -0,0 +1,36 @@
+import { type Database } from "./db.js";
+export type OperationalMaintenanceState = "idle" | "running" | "failed" | "unknown";
+export type OperationalSemanticState = "healthy" | "pending" | "degraded" | "failed" | "unknown";
+export interface OperationalStatusSnapshot {
+    sync: {
+        available: boolean;
+        daemon_error: boolean;
+        needs_attention: boolean;
+        peer_errors: number;
+    };
+    maintenance: {
+        state: OperationalMaintenanceState;
+        running: number;
+        failed: number;
+    };
+    semantic_index: {
+        state: OperationalSemanticState;
+        vector_table_present: boolean;
+    };
+    raw_events: {
+        available: boolean;
+        pending: number;
+        failed_batches: number;
+    };
+    observer: {
+        available: boolean;
+        failed_batches: number;
+        backoff_batches: number;
+    };
+}
+/** Collect bounded operational aggregates from an already-open database without writing schema. */
+export declare function collectOperationalStatus(db: Database, options?: {
+    embeddingDisabled?: boolean;
+    recentFailureCutoff?: string;
+}): OperationalStatusSnapshot;
+//# sourceMappingURL=operational-status.d.ts.map

package/dist/operational-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational-status.d.ts","sourceRoot":"","sources":["../src/operational-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,QAAQ,EAAe,MAAM,SAAS,CAAC;AAGnE,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEjG,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE;QACL,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,EAAE;QACZ,KAAK,EAAE,2BAA2B,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KACf,CAAC;IACF,cAAc,EAAE;QACf,KAAK,EAAE,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF,UAAU,EAAE;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,EAAE;QACT,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,MAAM,CAAC;KACxB,CAAC;CACF;AAoMD,mGAAmG;AACnG,wBAAgB,wBAAwB,CACvC,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,yBAAyB,CAQ3B"}