@codemem/core 0.41.0 → 0.42.0

package/dist/internal/cloudflare-coordinator.js

@@ -1,4 +1,4 @@
-import { B as e, D as t, H as n, I as r, L as i, R as a, U as o, V as s, W as c, j as l, k as u, n as d, t as f, w as p, z as m } from "../coordinator-api-Bxw5Q3py.js";
+import { B as e, D as t, G as n, H as r, K as i, R as a, U as o, V as s, W as c, j as l, k as u, n as d, t as f, w as p, z as m } from "../coordinator-api-SeLosPIq.js";
 //#region src/d1-coordinator-store.ts
 function h(e) {
 	if (e == null) throw Error("expected row");
@@ -143,7 +143,7 @@ async function A(e) {
 }
 async function j(e) {
 	if (e.invite_kind === "team_member") {
-		if (!e.policy_team_id || !r(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		if (!e.policy_team_id || !a(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
 		let t = await u(e.reviewed_intent_json, {
 			target: {
 				kind: "team_member",
@@ -234,16 +234,16 @@ function L(e, t, n) {
 	if (!r || !i) throw Error("scopeId and deviceId are required.");
 	let a = k(e.coordinatorId), o = k(e.groupId);
 	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
-	if (o && o !== t?.group_id) throw new m("scope_group_mismatch");
-	let s = e.membershipEpoch == null ? null : M(e.membershipEpoch), c = t?.membership_epoch ?? 0;
-	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
-	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
-	let l = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
+	if (o && o !== t?.group_id) throw new s("scope_group_mismatch");
+	let c = e.membershipEpoch == null ? null : M(e.membershipEpoch), l = t?.membership_epoch ?? 0;
+	if (c != null && c < l) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
+	if (c != null && n && c < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
+	let u = c ?? (n ? Math.max(l, n.membership_epoch + +(n.status === "revoked")) : l);
 	return {
 		scopeId: r,
 		deviceId: i,
 		role: k(e.role) ?? "member",
-		membershipEpoch: l,
+		membershipEpoch: u,
 		coordinatorId: t?.coordinator_id ?? null,
 		groupId: t?.group_id ?? null,
 		manifestIssuerDeviceId: k(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
@@ -364,32 +364,32 @@ var Y = class {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
 	async createInvite(e) {
-		let t = b(), n = C(12), r = C(24), a = await w(r), o = i(e.expiresAt), s = await this.getGroup(e.groupId), c = String(e.operationId ?? "").trim() || null, l = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await A(e), d = u.inviteKind === "team_member" ? `identity:${C(18)}` : null;
-		if (!!c != !!l) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
-		let f = async () => {
-			if (!c) return null;
-			let t = await q(this.db.prepare(`SELECT ${T} FROM coordinator_invites WHERE operation_id = ?`).bind(c));
+		let t = b(), n = C(12), r = C(24), i = await w(r), a = m(e.expiresAt), o = await this.getGroup(e.groupId), s = String(e.operationId ?? "").trim() || null, c = String(e.reviewedProjectSetDigest ?? "").trim() || null, l = await A(e), u = l.inviteKind === "team_member" ? `identity:${C(18)}` : null;
+		if (!!s != !!c) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
+		let d = async () => {
+			if (!s) return null;
+			let t = await q(this.db.prepare(`SELECT ${T} FROM coordinator_invites WHERE operation_id = ?`).bind(s));
 			if (!t) return null;
 			if (t.consumed_at) throw Error("invite_already_bound");
-			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== u.inviteKind || t.reviewed_project_set_digest !== l || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== u.policyTeamId || t.target_identity_id !== u.targetIdentityId || t.reviewed_preview_digest !== u.reviewedPreviewDigest || t.reviewed_intent_json !== u.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
+			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== l.inviteKind || t.reviewed_project_set_digest !== c || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== l.policyTeamId || t.target_identity_id !== l.targetIdentityId || t.reviewed_preview_digest !== l.reviewedPreviewDigest || t.reviewed_intent_json !== l.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
 			return h(t);
-		}, p = async (n) => {
+		}, f = async (n) => {
 			if (!n.revoked_at && n.expires_at > t) return n;
-			await J(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, a, o, t, e.createdBy ?? null, s?.display_name ?? null, c, n.token, t));
-			let i = await f();
-			if (!i) throw Error("invite_operation_reissue_failed");
-			return i;
+			await J(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, o?.display_name ?? null, s, n.token, t));
+			let c = await d();
+			if (!c) throw Error("invite_operation_reissue_failed");
+			return c;
 		};
-		if (c) {
-			let e = await f();
-			if (e) return await p(e);
+		if (s) {
+			let e = await d();
+			if (e) return await f(e);
 		}
 		try {
-			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, o, t, e.createdBy ?? null, s?.display_name ?? null, c, l, a, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, c ? "pending" : null, u.inviteKind, u.policyTeamId, u.targetIdentityId, d, u.reviewedPreviewDigest, u.reviewedIntentJson).run();
+			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, o?.display_name ?? null, s, c, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, s ? "pending" : null, l.inviteKind, l.policyTeamId, l.targetIdentityId, u, l.reviewedPreviewDigest, l.reviewedIntentJson).run();
 		} catch (e) {
-			if (c) {
-				let e = await f();
-				if (e) return await p(e);
+			if (s) {
+				let e = await d();
+				if (e) return await f(e);
 			}
 			throw e;
 		}
@@ -413,69 +413,69 @@ var Y = class {
 		let n = await j(t);
 		if (!n) return null;
 		if (t.revoked_at) throw Error("invite_invalid");
-		if (!t.consumed_at && new Date(t.expires_at) <= new Date(i(e.now))) throw Error("invite_expired");
+		if (!t.consumed_at && new Date(t.expires_at) <= new Date(m(e.now))) throw Error("invite_expired");
 		let r = await this.getGroup(t.group_id);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
 		return n;
 	}
-	async consumeRecipientInvite(e) {
-		let t = i(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
-		if (!e.identityId || !e.deviceId || !e.publicKey || !e.fingerprint || e.identityId !== e.identityId.trim() || e.deviceId !== e.deviceId.trim() || e.identityId.length > 256 || e.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e.identityId) || /[\p{Cc}\p{Cf}]/u.test(e.deviceId)) throw Error("invite_identity_conflict");
-		let o = await w(e.token), s = await this.getInviteByTokenForInspection(e.token), c = s ? await j(s) : null;
-		if (!s || !c || c.kind !== e.inviteKind || s.revoked_at) throw Error("invite_invalid");
-		let l = await this.getGroup(s.group_id);
-		if (!l) throw Error("group_not_found");
-		if (l.archived_at) throw Error("group_archived");
-		if (!s.consumed_at && new Date(s.expires_at) <= new Date(t)) throw Error("invite_expired");
-		if (p(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
-		let u = a(c);
-		if (u !== e.identityId) throw Error("invite_identity_conflict");
-		let d = s.bound_device_id === e.deviceId && s.bound_public_key === e.publicKey && s.bound_fingerprint === e.fingerprint;
-		if (s.consumed_at && !d) throw Error("invite_already_bound");
-		if (s.consumed_at && s.recipient_actor_id !== u) throw Error("invite_identity_conflict");
-		let f = await q(this.db.prepare(`SELECT ${E}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(s.group_id, e.deviceId));
-		if (f && (f.public_key !== e.publicKey || f.fingerprint !== e.fingerprint || f.identity_id !== null && f.identity_id !== u)) throw Error("invite_identity_conflict");
-		let m = 0, h = C(12);
-		if (!s.consumed_at) {
+	async consumeRecipientInvite(t) {
+		let n = m(t.now), r = t.recipientDisplayName ?? null, i = t.deviceDisplayName ?? null;
+		if (!t.identityId || !t.deviceId || !t.publicKey || !t.fingerprint || t.identityId !== t.identityId.trim() || t.deviceId !== t.deviceId.trim() || t.identityId.length > 256 || t.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(t.identityId) || /[\p{Cc}\p{Cf}]/u.test(t.deviceId)) throw Error("invite_identity_conflict");
+		let a = await w(t.token), o = await this.getInviteByTokenForInspection(t.token), s = o ? await j(o) : null;
+		if (!o || !s || s.kind !== t.inviteKind || o.revoked_at) throw Error("invite_invalid");
+		let c = await this.getGroup(o.group_id);
+		if (!c) throw Error("group_not_found");
+		if (c.archived_at) throw Error("group_archived");
+		if (!o.consumed_at && new Date(o.expires_at) <= new Date(n)) throw Error("invite_expired");
+		if (p(t.publicKey) !== t.fingerprint) throw Error("fingerprint_mismatch");
+		let l = e(s);
+		if (l !== t.identityId) throw Error("invite_identity_conflict");
+		let u = o.bound_device_id === t.deviceId && o.bound_public_key === t.publicKey && o.bound_fingerprint === t.fingerprint;
+		if (o.consumed_at && !u) throw Error("invite_already_bound");
+		if (o.consumed_at && o.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		let d = await q(this.db.prepare(`SELECT ${E}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, t.deviceId));
+		if (d && (d.public_key !== t.publicKey || d.fingerprint !== t.fingerprint || d.identity_id !== null && d.identity_id !== l)) throw Error("invite_identity_conflict");
+		let f = 0, h = C(12);
+		if (!o.consumed_at) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-			m = W((await this.db.batch([
-				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${s.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, u, n, r, o, e.token, t, e.inviteKind, s.reviewed_intent_json, s.reviewed_preview_digest, u, u, e.deviceId, e.publicKey, e.fingerprint, u),
-				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, o, e.token, e.deviceId, e.publicKey, e.fingerprint, u),
-				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(h, o, e.token, t),
-				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, o, e.token, e.deviceId)
+			f = W((await this.db.batch([
+				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${o.invite_id}`, n, t.deviceId, t.publicKey, t.fingerprint, l, r, i, a, t.token, n, t.inviteKind, o.reviewed_intent_json, o.reviewed_preview_digest, l, l, t.deviceId, t.publicKey, t.fingerprint, l),
+				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(n, a, t.token, t.deviceId, t.publicKey, t.fingerprint, l),
+				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(h, a, t.token, n),
+				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(n, a, t.token, t.deviceId)
 			]))[0]);
 		}
-		let g = await this.getGroup(s.group_id);
+		let g = await this.getGroup(o.group_id);
 		if (!g) throw Error("group_not_found");
 		if (g.archived_at) throw Error("group_archived");
 		let _ = await q(this.db.prepare(`SELECT ${E}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(s.group_id, e.deviceId));
-		if (_ && (_.public_key !== e.publicKey || _.fingerprint !== e.fingerprint || _.identity_id !== null && _.identity_id !== u)) throw Error("invite_identity_conflict");
-		let v = await this.getInviteByTokenForInspection(e.token);
-		if (!v || v.revoked_at || !v.consumed_at && new Date(v.expires_at) <= new Date(t)) throw Error("invite_invalid");
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, t.deviceId));
+		if (_ && (_.public_key !== t.publicKey || _.fingerprint !== t.fingerprint || _.identity_id !== null && _.identity_id !== l)) throw Error("invite_identity_conflict");
+		let v = await this.getInviteByTokenForInspection(t.token);
+		if (!v || v.revoked_at || !v.consumed_at && new Date(v.expires_at) <= new Date(n)) throw Error("invite_invalid");
 		let y = await j(v);
-		if (!y || y.kind !== e.inviteKind) throw Error("invite_invalid");
-		if (a(y) !== u) throw Error("invite_identity_conflict");
-		if (v.bound_device_id !== e.deviceId || v.bound_public_key !== e.publicKey || v.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (v.recipient_actor_id !== u) throw Error("invite_identity_conflict");
-		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(u, v.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let b = await this.getEnrollment(v.group_id, e.deviceId);
+		if (!y || y.kind !== t.inviteKind) throw Error("invite_invalid");
+		if (e(y) !== l) throw Error("invite_identity_conflict");
+		if (v.bound_device_id !== t.deviceId || v.bound_public_key !== t.publicKey || v.bound_fingerprint !== t.fingerprint) throw Error("invite_already_bound");
+		if (v.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(l, v.group_id, t.deviceId, t.publicKey, t.fingerprint).run();
+		let b = await this.getEnrollment(v.group_id, t.deviceId);
 		if (!b) throw Error("invite_acceptance_incomplete");
-		if (b.public_key !== e.publicKey || b.fingerprint !== e.fingerprint || b.identity_id !== u) throw Error("invite_identity_conflict");
+		if (b.public_key !== t.publicKey || b.fingerprint !== t.fingerprint || b.identity_id !== l) throw Error("invite_identity_conflict");
 		let x = v;
-		if (y.kind === "add_device" && v.inviter_device_id && !v.bootstrap_grant_id && new Date(v.expires_at) > new Date(t)) {
+		if (y.kind === "add_device" && v.inviter_device_id && !v.bootstrap_grant_id && new Date(v.expires_at) > new Date(n)) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic bootstrap grant recovery.");
-			let n = C(12);
-			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, v.invite_id, e.deviceId, u, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, v.invite_id, e.deviceId)]);
-			let r = await this.getInviteByTokenForInspection(e.token);
+			let e = C(12);
+			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(e, v.invite_id, t.deviceId, l, n), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(n, v.invite_id, t.deviceId)]);
+			let r = await this.getInviteByTokenForInspection(t.token);
 			if (!r) throw Error("invite_invalid");
 			x = r;
 		}
 		let S = x.bootstrap_grant_id ? await this.getBootstrapGrant(x.bootstrap_grant_id) : null;
 		return {
-			status: m === 1 ? "accepted" : "existing",
+			status: f === 1 ? "accepted" : "existing",
 			invite: x,
 			reviewed_intent: y.reviewed_intent,
 			bootstrap_grant: S
@@ -483,42 +483,42 @@ var Y = class {
 	}
 	async consumeProjectInvite(e) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-		let t = i(e.now), n = await w(e.token), r = await this.getInviteByTokenForInspection(e.token);
+		let t = m(e.now), n = await w(e.token), r = await this.getInviteByTokenForInspection(e.token);
 		if (!r?.operation_id || !r.project_intent_json || r.revoked_at) throw Error("invite_invalid");
-		let a = await this.getGroup(r.group_id);
-		if (!a) throw Error("group_not_found");
-		if (a.archived_at) throw Error("group_archived");
+		let i = await this.getGroup(r.group_id);
+		if (!i) throw Error("group_not_found");
+		if (i.archived_at) throw Error("group_archived");
 		if (r.operation_id !== e.operationId) throw Error("invite_invalid");
 		if (p(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
 		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
-		let o = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
-		if (r.consumed_at && !o) throw Error("invite_already_bound");
+		let a = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
+		if (r.consumed_at && !a) throw Error("invite_already_bound");
 		if (r.consumed_at && (r.recipient_actor_id !== e.recipientActorId || r.recipient_display_name !== e.recipientDisplayName || r.recipient_device_display_name !== e.deviceDisplayName)) throw Error("invite_identity_conflict");
-		let s = await q(this.db.prepare(`SELECT ${E}
+		let o = await q(this.db.prepare(`SELECT ${E}
 					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
-		if (s && (s.public_key !== e.publicKey || s.fingerprint !== e.fingerprint || s.identity_id != null && s.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
-		let c = C(12), l = W((await this.db.batch([
+		if (o && (o.public_key !== e.publicKey || o.fingerprint !== e.fingerprint || o.identity_id != null && o.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
+		let s = C(12), c = W((await this.db.batch([
 			this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n					bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n					recipient_display_name = ?, recipient_device_display_name = ?,\n					trust_state = 'pending_inviter_device'\n					WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)").bind(`consumed:${r.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, e.recipientActorId, e.recipientDisplayName, e.deviceDisplayName, n, e.token),
 			this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n					i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ? AND ? = 1\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name, enabled = 1\n				WHERE enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(t, n, e.token, e.deviceId, +!r.consumed_at),
-			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(c, n, e.token, e.deviceId, t),
+			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(s, n, e.token, e.deviceId, t),
 			this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n					grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at,\n					created_by, revoked_at\n				) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n					i.expires_at, ?, i.inviter_actor_id, NULL FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					JOIN enrolled_devices e ON e.group_id = i.group_id AND e.device_id = i.inviter_device_id\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bootstrap_grant_id IS NOT NULL\n					AND i.bound_device_id = ? AND e.enabled = 1").bind(t, n, e.token, e.deviceId)
-		]))[0]) === 1, u = await this.getGroup(r.group_id);
-		if (!u) throw Error("group_not_found");
-		if (u.archived_at) throw Error("group_archived");
-		let d = await this.getInviteByTokenForInspection(e.token);
-		if (!d) throw Error("invite_invalid");
-		if (d.bound_device_id !== e.deviceId || d.bound_public_key !== e.publicKey || d.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (d.recipient_actor_id !== e.recipientActorId || d.recipient_display_name !== e.recipientDisplayName || d.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
-		l || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, d.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let f = await this.getEnrollment(d.group_id, e.deviceId);
-		if (!f) throw Error("invite_acceptance_incomplete");
-		if (f.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
-		let m = d.inviter_device_id ? await this.getEnrollment(d.group_id, d.inviter_device_id) : null, h = d.bootstrap_grant_id ? await this.getBootstrapGrant(d.bootstrap_grant_id) : null;
+		]))[0]) === 1, l = await this.getGroup(r.group_id);
+		if (!l) throw Error("group_not_found");
+		if (l.archived_at) throw Error("group_archived");
+		let u = await this.getInviteByTokenForInspection(e.token);
+		if (!u) throw Error("invite_invalid");
+		if (u.bound_device_id !== e.deviceId || u.bound_public_key !== e.publicKey || u.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (u.recipient_actor_id !== e.recipientActorId || u.recipient_display_name !== e.recipientDisplayName || u.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
+		c || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, u.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		let d = await this.getEnrollment(u.group_id, e.deviceId);
+		if (!d) throw Error("invite_acceptance_incomplete");
+		if (d.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
+		let f = u.inviter_device_id ? await this.getEnrollment(u.group_id, u.inviter_device_id) : null, h = u.bootstrap_grant_id ? await this.getBootstrapGrant(u.bootstrap_grant_id) : null;
 		return {
-			status: l ? "accepted" : "existing",
-			invite: d,
-			enrollment: f,
-			seed_enrollment: m,
+			status: c ? "accepted" : "existing",
+			invite: u,
+			enrollment: d,
+			seed_enrollment: f,
 			bootstrap_grant: h
 		};
 	}
@@ -651,71 +651,71 @@ var Y = class {
 			 ORDER BY coordinator_id ASC, group_id ASC, scope_id ASC`);
 		return (await K(n.length ? s.bind(...n) : s)).map((e) => h(e));
 	}
-	async grantScopeMembership(t) {
-		let r = o(t.effectId), i = s(t), a = await B(this.db, r);
-		if (a) return e(a, "grant", i), n(a);
-		let c = k(t.scopeId), l = k(t.deviceId), u = c ? await this.getScope(c) : null;
-		if (!u) throw new m("scope_not_found");
-		if (u.status !== "active") throw new m("scope_inactive");
-		let d = c && l ? await this.getScopeMembership(c, l) : null, f = L(t, u, d);
-		if (f.groupId && !await this.getEnrollment(f.groupId, f.deviceId)) throw new m("device_not_enrolled");
-		let p = b();
+	async grantScopeMembership(e) {
+		let t = n(e.effectId), i = o(e), a = await B(this.db, t);
+		if (a) return r(a, "grant", i), c(a);
+		let l = k(e.scopeId), u = k(e.deviceId), d = l ? await this.getScope(l) : null;
+		if (!d) throw new s("scope_not_found");
+		if (d.status !== "active") throw new s("scope_inactive");
+		let f = l && u ? await this.getScopeMembership(l, u) : null, p = L(e, d, f);
+		if (p.groupId && !await this.getEnrollment(p.groupId, p.deviceId)) throw new s("device_not_enrolled");
+		let m = b();
 		await U(this.db, [
-			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(f.scopeId, f.deviceId, f.role, f.membershipEpoch, f.coordinatorId, f.groupId, f.manifestIssuerDeviceId, f.manifestHash, f.signedManifestJson, p, r),
+			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(p.scopeId, p.deviceId, p.role, p.membershipEpoch, p.coordinatorId, p.groupId, p.manifestIssuerDeviceId, p.manifestHash, p.signedManifestJson, m, t),
 			V(this.db, {
-				effectId: r,
+				effectId: t,
 				requestJson: i,
-				scopeId: f.scopeId,
-				deviceId: f.deviceId,
-				createdAt: p
+				scopeId: p.scopeId,
+				deviceId: p.deviceId,
+				createdAt: m
 			}),
 			z(this.db, {
-				effectId: r,
+				effectId: t,
 				requestJson: i,
 				action: "grant",
-				previous: d,
-				scopeId: f.scopeId,
-				deviceId: f.deviceId,
+				previous: f,
+				scopeId: p.scopeId,
+				deviceId: p.deviceId,
 				status: "active",
-				membershipEpoch: f.membershipEpoch,
-				updatedAt: p,
-				actorType: f.actorType,
-				actorId: f.actorId,
-				createdAt: p
+				membershipEpoch: p.membershipEpoch,
+				updatedAt: m,
+				actorType: p.actorType,
+				actorId: p.actorId,
+				createdAt: m
 			})
 		]);
-		let h = await B(this.db, r);
+		let h = await B(this.db, t);
 		if (!h) throw Error("scope membership grant was not applied.");
-		return e(h, "grant", i), n(h);
-	}
-	async revokeScopeMembership(t) {
-		let n = k(t.scopeId), r = k(t.deviceId);
-		if (!n || !r) throw Error("scopeId and deviceId are required.");
-		let i = o(t.effectId), a = c(t), s = await B(this.db, i);
-		if (s) return e(s, "revoke", a), s.outcome_applied === 1;
-		let l = t.membershipEpoch == null ? null : M(t.membershipEpoch), u = k(t.groupId), d = u ? await this.getScope(n) : null;
-		if (u && u !== d?.group_id) throw new m("scope_group_mismatch");
-		let f = await this.getScopeMembership(n, r);
-		if (l != null && f && l <= f.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let p = b(), h = l ?? (f?.membership_epoch ?? -1) + 1, g = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(l, l, k(t.manifestHash), k(t.signedManifestJson), p, n, r, f?.membership_epoch ?? -1, f?.status ?? "", i), _ = H(this.db, {
-			effectId: i,
-			requestJson: a,
-			scopeId: n,
-			deviceId: r,
-			createdAt: p
+		return r(h, "grant", i), c(h);
+	}
+	async revokeScopeMembership(e) {
+		let t = k(e.scopeId), a = k(e.deviceId);
+		if (!t || !a) throw Error("scopeId and deviceId are required.");
+		let o = n(e.effectId), c = i(e), l = await B(this.db, o);
+		if (l) return r(l, "revoke", c), l.outcome_applied === 1;
+		let u = e.membershipEpoch == null ? null : M(e.membershipEpoch), d = k(e.groupId), f = d ? await this.getScope(t) : null;
+		if (d && d !== f?.group_id) throw new s("scope_group_mismatch");
+		let p = await this.getScopeMembership(t, a);
+		if (u != null && p && u <= p.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let m = b(), h = u ?? (p?.membership_epoch ?? -1) + 1, g = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(u, u, k(e.manifestHash), k(e.signedManifestJson), m, t, a, p?.membership_epoch ?? -1, p?.status ?? "", o), _ = H(this.db, {
+			effectId: o,
+			requestJson: c,
+			scopeId: t,
+			deviceId: a,
+			createdAt: m
 		}), v = z(this.db, {
-			effectId: i,
-			requestJson: a,
+			effectId: o,
+			requestJson: c,
 			action: "revoke",
-			previous: f,
-			scopeId: n,
-			deviceId: r,
+			previous: p,
+			scopeId: t,
+			deviceId: a,
 			status: "revoked",
 			membershipEpoch: h,
-			updatedAt: p,
-			actorType: k(t.actorType),
-			actorId: k(t.actorId),
-			createdAt: p
+			updatedAt: m,
+			actorType: k(e.actorType),
+			actorId: k(e.actorId),
+			createdAt: m
 		});
 		try {
 			await U(this.db, [
@@ -724,13 +724,13 @@ var Y = class {
 				v
 			]);
 		} catch (e) {
-			let t = await this.getScopeMembership(n, r);
-			if (f && (!t || t.membership_epoch !== f.membership_epoch || t.status !== f.status)) return !1;
+			let n = await this.getScopeMembership(t, a);
+			if (p && (!n || n.membership_epoch !== p.membership_epoch || n.status !== p.status)) return !1;
 			throw e;
 		}
-		let y = await B(this.db, i);
+		let y = await B(this.db, o);
 		if (!y) throw Error("scope membership revoke receipt was not persisted.");
-		return e(y, "revoke", a), y.outcome_applied === 1;
+		return r(y, "revoke", c), y.outcome_applied === 1;
 	}
 	async listScopeMemberships(e, t = !1) {
 		let n = k(e);

package/dist/project-invite-identity.d.ts

@@ -3,6 +3,8 @@ export interface ProjectInviteSummary {
     existing_memory_count: number;
 }
 export declare function normalizeIdentityDisplayName(value: string, field: string): string;
+export declare function isHumanPresentationName(value: unknown): boolean;
+export declare function normalizeHumanPresentationName(value: string, field: string): string;
 export declare function normalizeDeviceNameHint(value: string | null | undefined): string | null;
 export declare function friendlyDeviceName(input: {
     explicitName?: string | null;

package/dist/project-invite-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-invite-identity.d.ts","sourceRoot":"","sources":["../src/project-invite-identity.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAUjF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIvF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,MAAM,CAST;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAoBtF"}
+{"version":3,"file":"project-invite-identity.d.ts","sourceRoot":"","sources":["../src/project-invite-identity.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAUjF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAe/D;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAInF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIvF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,MAAM,CAmBT;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAoBtF"}

package/dist/prompt-transport.d.ts

@@ -0,0 +1,36 @@
+export interface PromptTransportProtocolRange {
+    minSupportedProtocolVersion: number;
+    protocolVersion: number;
+}
+/** Current prompt-transport protocol range implemented by this release. */
+export declare const PROMPT_TRANSPORT_PROTOCOL_RANGE: {
+    readonly minSupportedProtocolVersion: 1;
+    readonly protocolVersion: 1;
+};
+export type PromptTransportDisposition = "fallback" | "local_fallback" | "terminal";
+export type PromptTransportFailure = {
+    kind: "profile_absent" | "profile_malformed" | "protocol_range_mismatch" | "network_unavailable" | "network_timeout" | "network_reset" | "viewer_restart" | "malformed_response";
+} | {
+    kind: "database_mismatch" | "runtime_identity_mismatch";
+} | {
+    kind: "invalid_request";
+    compatibleProfile: boolean;
+} | {
+    kind: "policy_failure" | "authorization_failure";
+} | {
+    kind: "viewer_contract_unsupported";
+    compatibleProfile: boolean;
+};
+/**
+ * Normalize a current/minimum pair into a closed supported range.
+ *
+ * A missing minimum is interpreted as an older single-version profile. Any
+ * explicitly malformed minimum remains invalid instead of being silently
+ * widened.
+ */
+export declare function normalizePromptTransportProtocolRange(protocolVersion: unknown, minSupportedProtocolVersion?: unknown): PromptTransportProtocolRange | null;
+/** Return true when two closed protocol-version ranges overlap. */
+export declare function arePromptTransportProtocolRangesCompatible(left: PromptTransportProtocolRange, right: PromptTransportProtocolRange): boolean;
+/** Classify whether a prompt transport failure may use local compatibility fallback. */
+export declare function classifyPromptTransportFailure(failure: PromptTransportFailure): PromptTransportDisposition;
+//# sourceMappingURL=prompt-transport.d.ts.map

package/dist/prompt-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-transport.d.ts","sourceRoot":"","sources":["../src/prompt-transport.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC5C,2BAA2B,EAAE,MAAM,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B;;;CAGK,CAAC;AAElD,MAAM,MAAM,0BAA0B,GAAG,UAAU,GAAG,gBAAgB,GAAG,UAAU,CAAC;AAEpF,MAAM,MAAM,sBAAsB,GAC/B;IACA,IAAI,EACD,gBAAgB,GAChB,mBAAmB,GACnB,yBAAyB,GACzB,qBAAqB,GACrB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,oBAAoB,CAAC;CACvB,GACD;IAAE,IAAI,EAAE,mBAAmB,GAAG,2BAA2B,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,gBAAgB,GAAG,uBAAuB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,6BAA6B,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAAC;AAMvE;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CACpD,eAAe,EAAE,OAAO,EACxB,2BAA2B,CAAC,EAAE,OAAO,GACnC,4BAA4B,GAAG,IAAI,CASrC;AAED,mEAAmE;AACnE,wBAAgB,0CAA0C,CACzD,IAAI,EAAE,4BAA4B,EAClC,KAAK,EAAE,4BAA4B,GACjC,OAAO,CAKT;AAED,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,sBAAsB,GAC7B,0BAA0B,CAe5B"}

package/dist/raw-event-flush.d.ts

@@ -24,6 +24,7 @@ export interface FlushRawEventsOptions {
     project?: string | null;
     startedAt?: string | null;
     maxEvents?: number | null;
+    throughEventSeq?: number | null;
 }
 /**
  * Flush raw events for a single session through the ingest pipeline.

package/dist/raw-event-flush.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw-event-flush.d.ts","sourceRoot":"","sources":["../src/raw-event-flush.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,KAAK,aAAa,EAAU,MAAM,sBAAsB,CAAC;AAElE,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyD9C;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,cAAc,CA2FrF;AA0CD,MAAM,WAAW,qBAAqB;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CACnC,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,qBAAqB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAyIpD"}
+{"version":3,"file":"raw-event-flush.d.ts","sourceRoot":"","sources":["../src/raw-event-flush.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,KAAK,aAAa,EAAU,MAAM,sBAAsB,CAAC;AAElE,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyD9C;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,cAAc,CA2FrF;AA0CD,MAAM,WAAW,qBAAqB;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CACnC,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,qBAAqB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CA+IpD"}

package/dist/raw-event-ingest.d.ts

@@ -0,0 +1,19 @@
+import type { Database } from "./db.js";
+export interface RawEventIngestStore {
+    db: Database;
+}
+export interface RawEventIngestSession {
+    source: string;
+    streamId: string;
+}
+export interface RawEventIngestResult {
+    inserted: number;
+    skipped: number;
+    received: number;
+    sessions: RawEventIngestSession[];
+}
+export declare class RawEventIngestValidationError extends Error {
+    constructor(message: string);
+}
+export declare function ingestRawEvents(store: RawEventIngestStore, request: object): RawEventIngestResult;
+//# sourceMappingURL=raw-event-ingest.d.ts.map

package/dist/raw-event-ingest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-event-ingest.d.ts","sourceRoot":"","sources":["../src/raw-event-ingest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAcxC,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,QAAQ,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAuBD,qBAAa,6BAA8B,SAAQ,KAAK;gBAC3C,OAAO,EAAE,MAAM;CAI3B;AA0VD,wBAAgB,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,oBAAoB,CAoCjG"}

package/dist/raw-event-sweeper.d.ts

@@ -21,12 +21,14 @@ export declare class RawEventSweeper {
     private store;
     private ingestOpts;
     private active;
+    private stopping;
     private running;
     private currentTick;
     private wakeHandle;
     private loopHandle;
     private autoFlushTimers;
-    private sessionFlushing;
+    private sessionFlushPromises;
+    private sessionBoundaryWaiters;
     private autoFlushPending;
     private autoFlushPromises;
     private authBackoffUntil;
@@ -77,6 +79,9 @@ export declare class RawEventSweeper {
      * Mirrors Python's RawEventAutoFlusher.note_activity() behavior.
      */
     nudge(opencodeSessionId: string, source?: string): void;
+    /** Flush one session immediately through the event visible at this boundary. */
+    flushBoundary(opencodeSessionId: string, source?: string): Promise<void>;
+    private acquireSessionFlush;
     private trackAutoFlush;
     private scheduleAutoFlush;
     private flushNow;

package/dist/raw-event-sweeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw-event-sweeper.d.ts","sourceRoot":"","sources":["../src/raw-event-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4B9C,qBAAa,eAAe;IAC3B,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,eAAe,CAAoD;IAC3E,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,eAAe,CAAS;gBAEpB,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa;IASzD,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,eAAe;IAYvB;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAMxB;;OAEG;IACH,iBAAiB,IAAI;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAU5D;;;;;;OAMG;IACH,KAAK,IAAI,IAAI;IAOb;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B;;;OAGG;IACH,mBAAmB,IAAI,IAAI;IAI3B;;;OAGG;IACH,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,SAAa,GAAG,IAAI;IA0B3D,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,iBAAiB;YAqBX,QAAQ;IAwCtB,4DAA4D;IAC5D,OAAO,CAAC,YAAY;IAYpB,iDAAiD;YACnC,OAAO;IAgBrB,OAAO,CAAC,IAAI;IAmBZ;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAkG3B"}
+{"version":3,"file":"raw-event-sweeper.d.ts","sourceRoot":"","sources":["../src/raw-event-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4B9C,qBAAa,eAAe;IAC3B,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,eAAe,CAAoD;IAC3E,OAAO,CAAC,oBAAoB,CAAoC;IAChE,OAAO,CAAC,sBAAsB,CAA6B;IAC3D,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,eAAe,CAAS;gBAEpB,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa;IASzD,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,eAAe;IAYvB;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAMxB;;OAEG;IACH,iBAAiB,IAAI;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAU5D;;;;;;OAMG;IACH,KAAK,IAAI,IAAI;IAQb;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB3B;;;OAGG;IACH,mBAAmB,IAAI,IAAI;IAI3B;;;OAGG;IACH,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,SAAa,GAAG,IAAI;IA2B3D,gFAAgF;IAC1E,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAqBpE,mBAAmB;IAwCjC,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,iBAAiB;YAsBX,QAAQ;IA6DtB,4DAA4D;IAC5D,OAAO,CAAC,YAAY;IAYpB,iDAAiD;YACnC,OAAO;IAgBrB,OAAO,CAAC,IAAI;IAmBZ;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAkG3B"}

package/dist/schema-bootstrap.d.ts

@@ -11,6 +11,15 @@ import type { Database } from "./db.js";
  */
 export declare function ensureVectorSchema(db: Database): void;
 export declare function bootstrapSchema(db: Database): void;
+/** Add sticky direct-peer signature state without requiring a schema-version bump. */
+export declare function ensureSyncPeerDirectSignatureVersionColumn(db: Database): void;
+/**
+ * Keep signature downgrade protection outside deletable peer trust rows.
+ *
+ * The copy is advancing-only so this repair can run on every open, including
+ * databases whose compatibility marker was written before this table existed.
+ */
+export declare function ensureSyncPeerSignatureStateSchema(db: Database): void;
 /** Add the local-only retrieval ledger to an already initialized database. */
 export declare function ensureRetrievalLedgerSchema(db: Database): void;
 /**