@codemem/core 0.43.2 → 0.44.0-alpha.1

package/dist/internal/cloudflare-coordinator.js

@@ -1,11 +1,11 @@
-import { B as e, D as t, G as n, H as r, J as i, K as a, R as o, U as s, V as c, W as l, j as u, k as d, n as f, q as p, t as m, w as h } from "../coordinator-api-DGTIU3Ri.js";
+import { $ as e, B as t, D as n, G as r, H as i, J as a, K as o, Q as s, R as c, U as l, V as u, W as d, X as f, Y as p, Z as m, at as h, ct as g, et as _, it as v, j as y, k as b, lt as x, n as ee, nt as S, ot as C, q as w, rt as T, t as E, tt as te, w as D } from "../coordinator-api-Dlr65yhR.js";
 //#region src/d1-coordinator-store.ts
-function g(e) {
+function O(e) {
 	if (e == null) throw Error("expected row");
 	return e;
 }
-function _(e) {
-	let { presence_capabilities_json: t, presence_expires_at: n, ...r } = g(e);
+function ne(e) {
+	let { presence_capabilities_json: t, presence_expires_at: n, ...r } = O(e);
 	if (typeof n != "string" || typeof t != "string") return r;
 	try {
 		let e = JSON.parse(t);
@@ -23,7 +23,7 @@ function _(e) {
 		return r;
 	}
 }
-function v(e) {
+function re(e) {
 	let t = e.trim();
 	if (!t) return "";
 	let n = t.includes("://") ? t : `http://${t}`;
@@ -34,7 +34,7 @@ function v(e) {
 		return "";
 	}
 }
-function y(e) {
+function ie(e) {
 	if (!e) return "";
 	try {
 		let t = new URL(e), n = t.hostname.toLowerCase();
@@ -42,18 +42,18 @@ function y(e) {
 	} catch {}
 	return e;
 }
-function b(e, t) {
+function k(e, t) {
 	let n = [], r = /* @__PURE__ */ new Set();
 	for (let i of [...e, ...t]) {
-		let e = v(i), t = y(e);
+		let e = re(i), t = ie(e);
 		!e || r.has(t) || (r.add(t), n.push(e));
 	}
 	return n;
 }
-function x() {
+function A() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
-function S(e, t) {
+function ae(e, t) {
 	return e <= t ? {
 		low: e,
 		high: t
@@ -62,22 +62,22 @@ function S(e, t) {
 		high: e
 	};
 }
-function C(e) {
+function j(e) {
 	return e instanceof Error && /unique|constraint/i.test(e.message);
 }
-function w(e) {
+function M(e) {
 	let t = new Uint8Array(e);
 	globalThis.crypto.getRandomValues(t);
 	let n = [];
 	for (let e of t) n.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"[e % 64] ?? "A");
 	return n.join("");
 }
-async function T(e) {
+async function N(e) {
 	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
 	return Array.from(new Uint8Array(t), (e) => e.toString(16).padStart(2, "0")).join("");
 }
-var E = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", D = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at", O = "enrolled_devices.group_id, enrolled_devices.device_id,\n	enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.identity_id,\n	enrolled_devices.display_name, enrolled_devices.enabled, enrolled_devices.created_at,\n	presence_records.expires_at AS presence_expires_at,\n	presence_records.capabilities_json AS presence_capabilities_json";
-function k(e) {
+var P = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", F = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at", oe = "enrolled_devices.group_id, enrolled_devices.device_id,\n	enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.identity_id,\n	enrolled_devices.display_name, enrolled_devices.enabled, enrolled_devices.created_at,\n	presence_records.expires_at AS presence_expires_at,\n	presence_records.capabilities_json AS presence_capabilities_json";
+function se(e) {
 	let t = String(e.groupId ?? "").trim(), n = String(e.seedDeviceId ?? "").trim(), r = String(e.workerDeviceId ?? "").trim(), i = String(e.expiresAt ?? "").trim(), a = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n || !r || !i) throw Error("groupId, seedDeviceId, workerDeviceId, and expiresAt are required.");
 	return {
@@ -88,32 +88,32 @@ function k(e) {
 		createdBy: a
 	};
 }
-function A(e) {
+function I(e) {
 	return e?.trim() || null;
 }
-async function j(e) {
-	let n = e.inviteKind ?? (A(e.operationId) ? "project_share" : "legacy_enrollment"), r = A(e.policyTeamId), i = A(e.targetIdentityId), a = A(e.reviewedPreviewDigest);
+async function ce(e) {
+	let t = e.inviteKind ?? (I(e.operationId) ? "project_share" : "legacy_enrollment"), r = I(e.policyTeamId), i = I(e.targetIdentityId), a = I(e.reviewedPreviewDigest);
 	if (![
 		"legacy_enrollment",
 		"project_share",
 		"team_member",
 		"add_device"
-	].includes(n)) throw Error("inviteKind is invalid.");
+	].includes(t)) throw Error("inviteKind is invalid.");
 	if ([r, i].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) throw Error("recipient invite identifier is invalid.");
 	if (a && !/^[a-f0-9]{64}$/u.test(a)) throw Error("reviewedPreviewDigest must be a SHA-256 digest.");
-	if (n === "project_share") {
-		if (!A(e.operationId)) throw Error("project_share invite requires operationId.");
+	if (t === "project_share") {
+		if (!I(e.operationId)) throw Error("project_share invite requires operationId.");
 		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
-	} else if (n === "legacy_enrollment") {
-		if (A(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
+	} else if (t === "legacy_enrollment") {
+		if (I(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
 		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
-	} else if (n === "team_member") {
-		if (!r || !a || i || A(e.operationId)) throw Error("team_member invite metadata is invalid.");
-	} else if (n === "add_device" && (!i || !a || r || A(e.operationId))) throw Error("add_device invite metadata is invalid.");
-	if (!(e.reviewedIntent !== void 0 && e.reviewedIntent !== null)) {
-		if (n === "team_member" || n === "add_device") throw Error("recipient_invite_review_unavailable");
+	} else if (t === "team_member") {
+		if (!r || !a || i || I(e.operationId)) throw Error("team_member invite metadata is invalid.");
+	} else if (t === "add_device" && (!i || !a || r || I(e.operationId))) throw Error("add_device invite metadata is invalid.");
+	if (e.reviewedIntent === void 0 || e.reviewedIntent === null) {
+		if (t === "team_member" || t === "add_device") throw Error("recipient_invite_review_unavailable");
 		return {
-			inviteKind: n,
+			inviteKind: t,
 			policyTeamId: r,
 			targetIdentityId: i,
 			reviewedPreviewDigest: a,
@@ -121,161 +121,161 @@ async function j(e) {
 		};
 	}
 	let o;
-	if (n === "team_member" && r && a) o = {
+	if (t === "team_member" && r && a) o = {
 		kind: "team_member",
 		policyTeamId: r
 	};
-	else if (n === "add_device" && i && a) o = {
+	else if (t === "add_device" && i && a) o = {
 		kind: "add_device",
 		targetIdentityId: i
 	};
 	else throw Error("recipient invite metadata requires a recipient invite kind.");
-	return await u(e.reviewedIntent, {
+	return await y(e.reviewedIntent, {
 		target: o,
 		digest: a
 	}), {
-		inviteKind: n,
+		inviteKind: t,
 		policyTeamId: r,
 		targetIdentityId: i,
 		reviewedPreviewDigest: a,
-		reviewedIntentJson: t(e.reviewedIntent, o)
+		reviewedIntentJson: n(e.reviewedIntent, o)
 	};
 }
-async function M(t) {
-	if (t.invite_kind === "team_member") {
-		if (!t.policy_team_id || !e(t.assigned_identity_id) || !t.reviewed_preview_digest) throw Error("invite_invalid");
-		let n = await d(t.reviewed_intent_json, {
+async function L(e) {
+	if (e.invite_kind === "team_member") {
+		if (!e.policy_team_id || !t(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let n = await b(e.reviewed_intent_json, {
 			target: {
 				kind: "team_member",
-				policyTeamId: t.policy_team_id
+				policyTeamId: e.policy_team_id
 			},
-			digest: t.reviewed_preview_digest
+			digest: e.reviewed_preview_digest
 		});
 		return {
 			kind: "team_member",
-			invite: t,
-			policy_team_id: t.policy_team_id,
-			assigned_identity_id: t.assigned_identity_id,
-			reviewed_preview_digest: t.reviewed_preview_digest,
+			invite: e,
+			policy_team_id: e.policy_team_id,
+			assigned_identity_id: e.assigned_identity_id,
+			reviewed_preview_digest: e.reviewed_preview_digest,
 			reviewed_intent: n,
-			bound: !!t.consumed_at
+			bound: !!e.consumed_at
 		};
 	}
-	if (t.invite_kind === "add_device") {
-		if (!t.target_identity_id || !t.reviewed_preview_digest) throw Error("invite_invalid");
-		let e = await d(t.reviewed_intent_json, {
+	if (e.invite_kind === "add_device") {
+		if (!e.target_identity_id || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let t = await b(e.reviewed_intent_json, {
 			target: {
 				kind: "add_device",
-				targetIdentityId: t.target_identity_id
+				targetIdentityId: e.target_identity_id
 			},
-			digest: t.reviewed_preview_digest
+			digest: e.reviewed_preview_digest
 		});
 		return {
 			kind: "add_device",
-			invite: t,
-			target_identity_id: t.target_identity_id,
-			reviewed_preview_digest: t.reviewed_preview_digest,
-			reviewed_intent: e,
-			bound: !!t.consumed_at
+			invite: e,
+			target_identity_id: e.target_identity_id,
+			reviewed_preview_digest: e.reviewed_preview_digest,
+			reviewed_intent: t,
+			bound: !!e.consumed_at
 		};
 	}
 	return null;
 }
-function N(e, t = 0) {
+function R(e, t = 0) {
 	if (e == null) return t;
 	if (!Number.isFinite(e) || e < 0) throw Error("membershipEpoch must be non-negative.");
 	return Math.trunc(e);
 }
-function P(e) {
-	let t = A(e.scopeId), n = A(e.label);
+function z(e) {
+	let t = I(e.scopeId), n = I(e.label);
 	if (!t || !n) throw Error("scopeId and label are required.");
 	return {
 		scopeId: t,
 		label: n,
-		kind: A(e.kind) ?? "user",
-		authorityType: A(e.authorityType) ?? "coordinator",
-		coordinatorId: A(e.coordinatorId),
-		groupId: A(e.groupId),
-		manifestIssuerDeviceId: A(e.manifestIssuerDeviceId),
-		membershipEpoch: N(e.membershipEpoch),
-		manifestHash: A(e.manifestHash),
-		status: A(e.status) ?? "active"
+		kind: I(e.kind) ?? "user",
+		authorityType: I(e.authorityType) ?? "coordinator",
+		coordinatorId: I(e.coordinatorId),
+		groupId: I(e.groupId),
+		manifestIssuerDeviceId: I(e.manifestIssuerDeviceId),
+		membershipEpoch: R(e.membershipEpoch),
+		manifestHash: I(e.manifestHash),
+		status: I(e.status) ?? "active"
 	};
 }
-function F(e, t, n) {
+function B(e, t, n) {
 	if (e === void 0) return t;
-	let r = A(e);
+	let r = I(e);
 	if (!r) throw Error(`${n} must not be empty.`);
 	return r;
 }
-function I(e, t) {
-	return e === void 0 ? t : A(e);
+function V(e, t) {
+	return e === void 0 ? t : I(e);
 }
-function L(e, t) {
-	let n = A(e.scopeId);
+function H(e, t) {
+	let n = I(e.scopeId);
 	if (!n) throw Error("scopeId is required.");
-	let r = e.membershipEpoch == null ? null : N(e.membershipEpoch);
+	let r = e.membershipEpoch == null ? null : R(e.membershipEpoch);
 	if (r != null && r < t.membership_epoch) throw Error("membershipEpoch must not move backwards.");
 	return {
 		scopeId: n,
-		label: F(e.label, t.label, "label"),
-		kind: F(e.kind, t.kind, "kind"),
-		authorityType: F(e.authorityType, t.authority_type, "authorityType"),
-		coordinatorId: I(e.coordinatorId, t.coordinator_id),
-		groupId: I(e.groupId, t.group_id),
-		manifestIssuerDeviceId: I(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
+		label: B(e.label, t.label, "label"),
+		kind: B(e.kind, t.kind, "kind"),
+		authorityType: B(e.authorityType, t.authority_type, "authorityType"),
+		coordinatorId: V(e.coordinatorId, t.coordinator_id),
+		groupId: V(e.groupId, t.group_id),
+		manifestIssuerDeviceId: V(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
 		membershipEpoch: r ?? t.membership_epoch,
-		manifestHash: I(e.manifestHash, t.manifest_hash),
-		status: F(e.status, t.status, "status")
+		manifestHash: V(e.manifestHash, t.manifest_hash),
+		status: B(e.status, t.status, "status")
 	};
 }
-function R(e, t, n) {
-	let r = A(e.scopeId), i = A(e.deviceId);
+function U(e, t, n) {
+	let r = I(e.scopeId), i = I(e.deviceId);
 	if (!r || !i) throw Error("scopeId and deviceId are required.");
-	let a = A(e.coordinatorId), o = A(e.groupId);
+	let a = I(e.coordinatorId), o = I(e.groupId);
 	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
-	if (o && o !== t?.group_id) throw new s("scope_group_mismatch");
-	let c = e.membershipEpoch == null ? null : N(e.membershipEpoch), l = t?.membership_epoch ?? 0;
-	if (c != null && c < l) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
-	if (c != null && n && c < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
-	let u = c ?? (n ? Math.max(l, n.membership_epoch + +(n.status === "revoked")) : l);
+	if (o && o !== t?.group_id) throw new l("scope_group_mismatch");
+	let s = e.membershipEpoch == null ? null : R(e.membershipEpoch), c = t?.membership_epoch ?? 0;
+	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
+	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
+	let u = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
 	return {
 		scopeId: r,
 		deviceId: i,
-		role: A(e.role) ?? "member",
+		role: I(e.role) ?? "member",
 		membershipEpoch: u,
 		coordinatorId: t?.coordinator_id ?? null,
 		groupId: t?.group_id ?? null,
-		manifestIssuerDeviceId: A(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
-		manifestHash: A(e.manifestHash) ?? t?.manifest_hash ?? null,
-		signedManifestJson: A(e.signedManifestJson),
-		actorType: A(e.actorType),
-		actorId: A(e.actorId)
+		manifestIssuerDeviceId: I(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
+		manifestHash: I(e.manifestHash) ?? t?.manifest_hash ?? null,
+		signedManifestJson: I(e.signedManifestJson),
+		actorType: I(e.actorType),
+		actorId: I(e.actorId)
 	};
 }
-function z(e) {
+function W(e) {
 	return e == null || !Number.isFinite(e) ? 100 : Math.max(1, Math.min(1e3, Math.trunc(e)));
 }
-function B(e, t) {
+function G(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_audit_log(\n			effect_id, action, scope_id, device_id, role, status, membership_epoch,\n			previous_role, previous_status, previous_membership_epoch,\n			coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at\n		)\n		SELECT receipt.effect_id, ?, membership.scope_id, membership.device_id, membership.role, membership.status,\n			membership.membership_epoch, ?, ?, ?, membership.coordinator_id, membership.group_id,\n			?, ?, membership.manifest_hash, ?\n		FROM (SELECT 1 WHERE changes() > 0) AS required\n		JOIN coordinator_scope_membership_effect_receipts AS receipt\n			ON receipt.effect_id = ? AND receipt.action = ? AND receipt.request_json = ?\n			AND receipt.outcome_applied = 1\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON membership.scope_id = ?\n			AND membership.device_id = ?\n			AND membership.status = ?\n			AND membership.membership_epoch = ?\n			AND membership.updated_at = ?").bind(t.action, t.previous?.role ?? null, t.previous?.status ?? null, t.previous?.membership_epoch ?? null, t.actorType, t.actorId, t.createdAt, t.effectId, t.action, t.requestJson, t.scopeId, t.deviceId, t.status, t.membershipEpoch, t.updatedAt);
 }
-async function V(e, t) {
-	return await J(e.prepare("SELECT effect_id, action, request_json, outcome_applied, scope_id, device_id,\n				role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n				manifest_hash, signed_manifest_json, updated_at, created_at\n			 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?").bind(t));
+async function K(e, t) {
+	return await Z(e.prepare("SELECT effect_id, action, request_json, outcome_applied, scope_id, device_id,\n				role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n				manifest_hash, signed_manifest_json, updated_at, created_at\n			 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?").bind(t));
 }
-function H(e, t) {
+function le(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_effect_receipts(\n			effect_id, action, request_json, outcome_applied, scope_id, device_id,\n			role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n			manifest_hash, signed_manifest_json, updated_at, created_at\n		)\n		SELECT ?, 'grant', ?, 1, membership.scope_id, membership.device_id,\n			membership.role, membership.status, membership.membership_epoch,\n			membership.coordinator_id, membership.group_id, membership.manifest_issuer_device_id,\n			membership.manifest_hash, membership.signed_manifest_json, membership.updated_at, ?\n		FROM coordinator_scope_memberships AS membership\n		WHERE changes() > 0 AND membership.scope_id = ? AND membership.device_id = ?").bind(t.effectId, t.requestJson, t.createdAt, t.scopeId, t.deviceId);
 }
-function U(e, t) {
+function ue(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_effect_receipts(\n			effect_id, action, request_json, outcome_applied, scope_id, device_id,\n			role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n			manifest_hash, signed_manifest_json, updated_at, created_at\n		)\n		SELECT ?, 'revoke', ?, changed.applied, ?, ?, membership.role, membership.status,\n			membership.membership_epoch, membership.coordinator_id, membership.group_id,\n			membership.manifest_issuer_device_id, membership.manifest_hash,\n			membership.signed_manifest_json, membership.updated_at, ?\n		FROM (SELECT CASE WHEN changes() > 0 THEN 1 ELSE 0 END AS applied) AS changed\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON changed.applied = 1 AND membership.scope_id = ? AND membership.device_id = ?\n		WHERE NOT EXISTS (\n			SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n		)").bind(t.effectId, t.requestJson, t.scopeId, t.deviceId, t.createdAt, t.scopeId, t.deviceId, t.effectId);
 }
-async function W(e, t) {
+async function q(e, t) {
 	if (!e.batch) throw Error("D1 batch support is required for audited scope membership changes.");
 	return await e.batch(t);
 }
-function G(e) {
+function J(e) {
 	return Number(e?.meta?.changes ?? 0);
 }
-function K(e) {
+function Y(e) {
 	if (!e) return null;
 	let t = String(e.seedDeviceId ?? "").trim(), n = String(e.expiresAt ?? "").trim(), r = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n) throw Error("bootstrapGrant.seedDeviceId and expiresAt are required.");
@@ -287,95 +287,95 @@ function K(e) {
 		createdBy: r
 	};
 }
-async function q(e) {
+async function X(e) {
 	let t = await e.all();
 	return Array.isArray(t?.results) ? t.results : [];
 }
-async function J(e) {
+async function Z(e) {
 	return await e.first();
 }
-async function Y(e) {
+async function Q(e) {
 	let t = await e.run();
 	return Number(t?.meta?.changes ?? 0);
 }
-var X = class {
+var $ = class {
 	db;
 	constructor(e) {
 		this.db = e;
 	}
 	async close() {}
 	async createGroup(e, t) {
-		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, x()).run();
+		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, A()).run();
 	}
 	async getGroup(e) {
-		let t = await J(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
-		return t ? g(t) : null;
+		let t = await Z(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
+		return t ? O(t) : null;
 	}
 	async listGroups(e = !1) {
 		let t = e ? "" : "WHERE archived_at IS NULL";
-		return (await q(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => g(e));
+		return (await X(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => O(e));
 	}
 	async renameGroup(e, t) {
-		return await Y(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
+		return await Q(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
 	}
-	async archiveGroup(e, t = x()) {
-		return await Y(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
+	async archiveGroup(e, t = A()) {
+		return await Q(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
 	}
 	async unarchiveGroup(e) {
-		return await Y(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
+		return await Q(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
 	}
 	async enrollDevice(e, t) {
-		if (await Y(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, x())) === 0) throw Error("invite_identity_conflict");
+		if (await Q(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, A())) === 0) throw Error("invite_identity_conflict");
 	}
 	async listEnrolledDevices(e, t) {
 		let n = t ? "" : "AND enrolled_devices.enabled = 1";
-		return (await q(this.db.prepare(`SELECT ${O}
+		return (await X(this.db.prepare(`SELECT ${oe}
 						 FROM enrolled_devices
 						 LEFT JOIN presence_records
 						   ON presence_records.group_id = enrolled_devices.group_id
 						  AND presence_records.device_id = enrolled_devices.device_id
 						 WHERE enrolled_devices.group_id = ? ${n}
-						 ORDER BY enrolled_devices.created_at ASC, enrolled_devices.device_id ASC`).bind(e))).map(_);
+						 ORDER BY enrolled_devices.created_at ASC, enrolled_devices.device_id ASC`).bind(e))).map(ne);
 	}
 	async getEnrollment(e, t, n = !1) {
-		let r = n ? "" : "AND enabled = 1", i = await J(this.db.prepare(`SELECT ${D}
+		let r = n ? "" : "AND enabled = 1", i = await Z(this.db.prepare(`SELECT ${F}
 					 FROM enrolled_devices
 					 WHERE group_id = ? AND device_id = ? ${r}`).bind(e, t));
-		return i ? g(i) : null;
+		return i ? O(i) : null;
 	}
 	async renameDevice(e, t, n) {
-		return await Y(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
+		return await Q(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
 	}
 	async setDeviceEnabled(e, t, n) {
-		return await Y(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
+		return await Q(this.db.prepare("UPDATE enrolled_devices SET enabled = ?\n					 WHERE group_id = ? AND device_id = ?").bind(+!!n, e, t)) > 0;
 	}
 	async removeDevice(e, t) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic device removal.");
-		return G((await this.db.batch([
+		return J((await this.db.batch([
 			this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t),
 			this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t),
 			this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)
 		]))[2]) > 0;
 	}
 	async recordNonce(e, t, n) {
-		return await Y(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
+		return await Q(this.db.prepare("INSERT OR IGNORE INTO request_nonces(device_id, nonce, created_at) VALUES (?, ?, ?)").bind(e, t, n)) > 0;
 	}
 	async cleanupNonces(e) {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
 	async createInvite(e) {
-		let t = x(), n = w(12), r = w(24), i = await T(r), a = c(e.expiresAt), o = await this.getGroup(e.groupId), s = String(e.operationId ?? "").trim() || null, l = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await j(e), d = u.inviteKind === "team_member" ? `identity:${w(18)}` : null;
-		if (!!s != !!l) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
+		let t = A(), n = M(12), r = M(24), i = await N(r), a = u(e.expiresAt), o = await this.getGroup(e.groupId), s = String(e.operationId ?? "").trim() || null, c = String(e.reviewedProjectSetDigest ?? "").trim() || null, l = await ce(e), d = l.inviteKind === "team_member" ? `identity:${M(18)}` : null;
+		if (!!s != !!c) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
 		let f = async () => {
 			if (!s) return null;
-			let t = await J(this.db.prepare(`SELECT ${E} FROM coordinator_invites WHERE operation_id = ?`).bind(s));
+			let t = await Z(this.db.prepare(`SELECT ${P} FROM coordinator_invites WHERE operation_id = ?`).bind(s));
 			if (!t) return null;
 			if (t.consumed_at) throw Error("invite_already_bound");
-			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== u.inviteKind || t.reviewed_project_set_digest !== l || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== u.policyTeamId || t.target_identity_id !== u.targetIdentityId || t.reviewed_preview_digest !== u.reviewedPreviewDigest || t.reviewed_intent_json !== u.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
-			return g(t);
+			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== l.inviteKind || t.reviewed_project_set_digest !== c || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== l.policyTeamId || t.target_identity_id !== l.targetIdentityId || t.reviewed_preview_digest !== l.reviewedPreviewDigest || t.reviewed_intent_json !== l.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
+			return O(t);
 		}, p = async (n) => {
 			if (!n.revoked_at && n.expires_at > t) return n;
-			await Y(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, o?.display_name ?? null, s, n.token, t));
+			await Q(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, o?.display_name ?? null, s, n.token, t));
 			let c = await f();
 			if (!c) throw Error("invite_operation_reissue_failed");
 			return c;
@@ -385,7 +385,7 @@ var X = class {
 			if (e) return await p(e);
 		}
 		try {
-			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, o?.display_name ?? null, s, l, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, s ? "pending" : null, u.inviteKind, u.policyTeamId, u.targetIdentityId, d, u.reviewedPreviewDigest, u.reviewedIntentJson).run();
+			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, o?.display_name ?? null, s, c, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, s ? "pending" : null, l.inviteKind, l.policyTeamId, l.targetIdentityId, d, l.reviewedPreviewDigest, l.reviewedIntentJson).run();
 		} catch (e) {
 			if (s) {
 				let e = await f();
@@ -393,129 +393,129 @@ var X = class {
 			}
 			throw e;
 		}
-		return g(await J(this.db.prepare(`SELECT ${E} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
+		return O(await Z(this.db.prepare(`SELECT ${P} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
 	}
 	async getInviteByToken(e) {
-		let t = await T(e), n = await J(this.db.prepare(`SELECT ${E}
+		let t = await N(e), n = await Z(this.db.prepare(`SELECT ${P}
 					 FROM coordinator_invites
 					 WHERE (token_digest = ? OR token = ?)
 					   AND revoked_at IS NULL
-					   AND expires_at > ?`).bind(t, e, x()));
-		return n ? g(n) : null;
+					   AND expires_at > ?`).bind(t, e, A()));
+		return n ? O(n) : null;
 	}
 	async getInviteByTokenForInspection(e) {
-		let t = await T(e), n = await J(this.db.prepare(`SELECT ${E} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
-		return n ? g(n) : null;
+		let t = await N(e), n = await Z(this.db.prepare(`SELECT ${P} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
+		return n ? O(n) : null;
 	}
 	async inspectRecipientInvite(e) {
 		let t = await this.getInviteByTokenForInspection(e.token);
 		if (!t) return null;
-		let n = await M(t);
+		let n = await L(t);
 		if (!n) return null;
 		if (t.revoked_at) throw Error("invite_invalid");
-		if (!t.consumed_at && new Date(t.expires_at) <= new Date(c(e.now))) throw Error("invite_expired");
+		if (!t.consumed_at && new Date(t.expires_at) <= new Date(u(e.now))) throw Error("invite_expired");
 		let r = await this.getGroup(t.group_id);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
 		return n;
 	}
 	async consumeRecipientInvite(e) {
-		let t = c(e.now), n = e.recipientDisplayName ?? null, i = e.deviceDisplayName ?? null;
+		let t = u(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
 		if (!e.identityId || !e.deviceId || !e.publicKey || !e.fingerprint || e.identityId !== e.identityId.trim() || e.deviceId !== e.deviceId.trim() || e.identityId.length > 256 || e.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e.identityId) || /[\p{Cc}\p{Cf}]/u.test(e.deviceId)) throw Error("invite_identity_conflict");
-		let a = await T(e.token), o = await this.getInviteByTokenForInspection(e.token), s = o ? await M(o) : null;
+		let a = await N(e.token), o = await this.getInviteByTokenForInspection(e.token), s = o ? await L(o) : null;
 		if (!o || !s || s.kind !== e.inviteKind || o.revoked_at) throw Error("invite_invalid");
-		let l = await this.getGroup(o.group_id);
-		if (!l) throw Error("group_not_found");
-		if (l.archived_at) throw Error("group_archived");
+		let c = await this.getGroup(o.group_id);
+		if (!c) throw Error("group_not_found");
+		if (c.archived_at) throw Error("group_archived");
 		if (!o.consumed_at && new Date(o.expires_at) <= new Date(t)) throw Error("invite_expired");
-		if (h(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
-		let u = r(s);
-		if (u !== e.identityId) throw Error("invite_identity_conflict");
+		if (D(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		let l = i(s);
+		if (l !== e.identityId) throw Error("invite_identity_conflict");
 		let d = o.bound_device_id === e.deviceId && o.bound_public_key === e.publicKey && o.bound_fingerprint === e.fingerprint;
 		if (o.consumed_at && !d) throw Error("invite_already_bound");
-		if (o.consumed_at && o.recipient_actor_id !== u) throw Error("invite_identity_conflict");
-		let f = await J(this.db.prepare(`SELECT ${D}
+		if (o.consumed_at && o.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		let f = await Z(this.db.prepare(`SELECT ${F}
 					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, e.deviceId));
-		if (f && (f.public_key !== e.publicKey || f.fingerprint !== e.fingerprint || f.identity_id !== null && f.identity_id !== u)) throw Error("invite_identity_conflict");
-		let p = 0, m = w(12);
+		if (f && (f.public_key !== e.publicKey || f.fingerprint !== e.fingerprint || f.identity_id !== null && f.identity_id !== l)) throw Error("invite_identity_conflict");
+		let p = 0, m = M(12);
 		if (!o.consumed_at) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-			p = G((await this.db.batch([
-				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${o.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, u, n, i, a, e.token, t, e.inviteKind, o.reviewed_intent_json, o.reviewed_preview_digest, u, u, e.deviceId, e.publicKey, e.fingerprint, u),
-				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, a, e.token, e.deviceId, e.publicKey, e.fingerprint, u),
+			p = J((await this.db.batch([
+				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${o.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, l, n, r, a, e.token, t, e.inviteKind, o.reviewed_intent_json, o.reviewed_preview_digest, l, l, e.deviceId, e.publicKey, e.fingerprint, l),
+				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, a, e.token, e.deviceId, e.publicKey, e.fingerprint, l),
 				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(m, a, e.token, t),
 				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, a, e.token, e.deviceId)
 			]))[0]);
 		}
-		let g = await this.getGroup(o.group_id);
-		if (!g) throw Error("group_not_found");
-		if (g.archived_at) throw Error("group_archived");
-		let _ = await J(this.db.prepare(`SELECT ${D}
+		let h = await this.getGroup(o.group_id);
+		if (!h) throw Error("group_not_found");
+		if (h.archived_at) throw Error("group_archived");
+		let g = await Z(this.db.prepare(`SELECT ${F}
 					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, e.deviceId));
-		if (_ && (_.public_key !== e.publicKey || _.fingerprint !== e.fingerprint || _.identity_id !== null && _.identity_id !== u)) throw Error("invite_identity_conflict");
-		let v = await this.getInviteByTokenForInspection(e.token);
-		if (!v || v.revoked_at || !v.consumed_at && new Date(v.expires_at) <= new Date(t)) throw Error("invite_invalid");
-		let y = await M(v);
-		if (!y || y.kind !== e.inviteKind) throw Error("invite_invalid");
-		if (r(y) !== u) throw Error("invite_identity_conflict");
-		if (v.bound_device_id !== e.deviceId || v.bound_public_key !== e.publicKey || v.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (v.recipient_actor_id !== u) throw Error("invite_identity_conflict");
-		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(u, v.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let b = await this.getEnrollment(v.group_id, e.deviceId);
-		if (!b) throw Error("invite_acceptance_incomplete");
-		if (b.public_key !== e.publicKey || b.fingerprint !== e.fingerprint || b.identity_id !== u) throw Error("invite_identity_conflict");
-		let x = v;
-		if (y.kind === "add_device" && v.inviter_device_id && !v.bootstrap_grant_id && new Date(v.expires_at) > new Date(t)) {
+		if (g && (g.public_key !== e.publicKey || g.fingerprint !== e.fingerprint || g.identity_id !== null && g.identity_id !== l)) throw Error("invite_identity_conflict");
+		let _ = await this.getInviteByTokenForInspection(e.token);
+		if (!_ || _.revoked_at || !_.consumed_at && new Date(_.expires_at) <= new Date(t)) throw Error("invite_invalid");
+		let v = await L(_);
+		if (!v || v.kind !== e.inviteKind) throw Error("invite_invalid");
+		if (i(v) !== l) throw Error("invite_identity_conflict");
+		if (_.bound_device_id !== e.deviceId || _.bound_public_key !== e.publicKey || _.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (_.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(l, _.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		let y = await this.getEnrollment(_.group_id, e.deviceId);
+		if (!y) throw Error("invite_acceptance_incomplete");
+		if (y.public_key !== e.publicKey || y.fingerprint !== e.fingerprint || y.identity_id !== l) throw Error("invite_identity_conflict");
+		let b = _;
+		if (v.kind === "add_device" && _.inviter_device_id && !_.bootstrap_grant_id && new Date(_.expires_at) > new Date(t)) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic bootstrap grant recovery.");
-			let n = w(12);
-			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, v.invite_id, e.deviceId, u, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, v.invite_id, e.deviceId)]);
+			let n = M(12);
+			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, _.invite_id, e.deviceId, l, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, _.invite_id, e.deviceId)]);
 			let r = await this.getInviteByTokenForInspection(e.token);
 			if (!r) throw Error("invite_invalid");
-			x = r;
+			b = r;
 		}
-		let S = x.bootstrap_grant_id ? await this.getBootstrapGrant(x.bootstrap_grant_id) : null;
+		let x = b.bootstrap_grant_id ? await this.getBootstrapGrant(b.bootstrap_grant_id) : null;
 		return {
 			status: p === 1 ? "accepted" : "existing",
-			invite: x,
-			reviewed_intent: y.reviewed_intent,
-			bootstrap_grant: S
+			invite: b,
+			reviewed_intent: v.reviewed_intent,
+			bootstrap_grant: x
 		};
 	}
 	async consumeProjectInvite(e) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-		let t = c(e.now), n = await T(e.token), r = await this.getInviteByTokenForInspection(e.token);
+		let t = u(e.now), n = await N(e.token), r = await this.getInviteByTokenForInspection(e.token);
 		if (!r?.operation_id || !r.project_intent_json || r.revoked_at) throw Error("invite_invalid");
 		let i = await this.getGroup(r.group_id);
 		if (!i) throw Error("group_not_found");
 		if (i.archived_at) throw Error("group_archived");
 		if (r.operation_id !== e.operationId) throw Error("invite_invalid");
-		if (h(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		if (D(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
 		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
 		let a = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
 		if (r.consumed_at && !a) throw Error("invite_already_bound");
 		if (r.consumed_at && (r.recipient_actor_id !== e.recipientActorId || r.recipient_display_name !== e.recipientDisplayName || r.recipient_device_display_name !== e.deviceDisplayName)) throw Error("invite_identity_conflict");
-		let o = await J(this.db.prepare(`SELECT ${D}
+		let o = await Z(this.db.prepare(`SELECT ${F}
 					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
 		if (o && (o.public_key !== e.publicKey || o.fingerprint !== e.fingerprint || o.identity_id != null && o.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
-		let s = w(12), l = G((await this.db.batch([
+		let s = M(12), c = J((await this.db.batch([
 			this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n					bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n					recipient_display_name = ?, recipient_device_display_name = ?,\n					trust_state = 'pending_inviter_device'\n					WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)").bind(`consumed:${r.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, e.recipientActorId, e.recipientDisplayName, e.deviceDisplayName, n, e.token),
 			this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n					i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ? AND ? = 1\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name, enabled = 1\n				WHERE enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(t, n, e.token, e.deviceId, +!r.consumed_at),
 			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(s, n, e.token, e.deviceId, t),
 			this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n					grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at,\n					created_by, revoked_at\n				) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n					i.expires_at, ?, i.inviter_actor_id, NULL FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					JOIN enrolled_devices e ON e.group_id = i.group_id AND e.device_id = i.inviter_device_id\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bootstrap_grant_id IS NOT NULL\n					AND i.bound_device_id = ? AND e.enabled = 1").bind(t, n, e.token, e.deviceId)
-		]))[0]) === 1, u = await this.getGroup(r.group_id);
-		if (!u) throw Error("group_not_found");
-		if (u.archived_at) throw Error("group_archived");
+		]))[0]) === 1, l = await this.getGroup(r.group_id);
+		if (!l) throw Error("group_not_found");
+		if (l.archived_at) throw Error("group_archived");
 		let d = await this.getInviteByTokenForInspection(e.token);
 		if (!d) throw Error("invite_invalid");
 		if (d.bound_device_id !== e.deviceId || d.bound_public_key !== e.publicKey || d.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
 		if (d.recipient_actor_id !== e.recipientActorId || d.recipient_display_name !== e.recipientDisplayName || d.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
-		l || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, d.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		c || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, d.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
 		let f = await this.getEnrollment(d.group_id, e.deviceId);
 		if (!f) throw Error("invite_acceptance_incomplete");
 		if (f.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
 		let p = d.inviter_device_id ? await this.getEnrollment(d.group_id, d.inviter_device_id) : null, m = d.bootstrap_grant_id ? await this.getBootstrapGrant(d.bootstrap_grant_id) : null;
 		return {
-			status: l ? "accepted" : "existing",
+			status: c ? "accepted" : "existing",
 			invite: d,
 			enrollment: f,
 			seed_enrollment: p,
@@ -523,28 +523,28 @@ var X = class {
 		};
 	}
 	async listInvites(e) {
-		return (await q(this.db.prepare(`SELECT ${E}
+		return (await X(this.db.prepare(`SELECT ${P}
 					 FROM coordinator_invites WHERE group_id = ?
-					 ORDER BY created_at DESC`).bind(e))).map((e) => g(e));
+					 ORDER BY created_at DESC`).bind(e))).map((e) => O(e));
 	}
 	async createJoinRequest(e) {
-		let t = x(), n = w(12);
-		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), g(await J(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
+		let t = A(), n = M(12);
+		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
 	}
 	async listJoinRequests(e, t) {
 		let n = t ?? "pending";
-		return (await q(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => g(e));
+		return (await X(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => O(e));
 	}
 	async reviewJoinRequest(e) {
-		let t = await J(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		let t = await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!t) return null;
 		if (t.status !== "pending") return {
-			...g(t),
+			...O(t),
 			_no_transition: !0
 		};
-		let n = K(e.bootstrapGrant), r = x(), i = e.approved ? "approved" : "denied", a = null, o = null;
+		let n = Y(e.bootstrapGrant), r = A(), i = e.approved ? "approved" : "denied", a = null, o = null;
 		if (e.approved && n) {
-			if (!await J(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
+			if (!await Z(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
 			if (n.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
 			a = {
 				...n,
@@ -554,9 +554,9 @@ var X = class {
 		}
 		if (this.db.batch) {
 			let t = [];
-			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(x(), e.requestId, r)), a)) {
-				o = w(12);
-				let n = x();
+			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(A(), e.requestId, r)), a)) {
+				o = M(12);
+				let n = A();
 				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(o, a.groupId, a.seedDeviceId, a.workerDeviceId, a.expiresAt, n, a.createdBy ?? null, e.requestId, r));
 			}
 			await this.db.batch(t);
@@ -571,20 +571,20 @@ var X = class {
 				let e = await this.createBootstrapGrant(a);
 				n = e.grant_id, o = e.grant_id;
 			}
-			if (await Y(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)) === 0) {
+			if (await Q(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)) === 0) {
 				n && await this.revokeBootstrapGrant(n);
-				let t = await J(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+				let t = await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 				return t ? {
-					...g(t),
+					...O(t),
 					_no_transition: !0
 				} : null;
 			}
 		}
-		let s = await J(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
+		let s = await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!s) return null;
 		let c = a ? o ? await this.getBootstrapGrant(o) : await this.createBootstrapGrant(a) : null;
 		return {
-			...g(s),
+			...O(s),
 			bootstrap_grant: c
 		};
 	}
@@ -593,195 +593,280 @@ var X = class {
 		if (!t || !n || !r) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
 		if (n === r) throw Error("requesting and requested device ids must differ.");
 		if (i) {
-			let e = x();
-			if (await Y(this.db.prepare("UPDATE coordinator_reciprocal_approvals\n						 SET status = 'completed', resolved_at = ?\n						 WHERE request_id = ?\n						   AND group_id = ?\n						   AND requesting_device_id = ?\n						   AND requested_device_id = ?\n						   AND status = 'pending'").bind(e, a, t, r, n)) !== 1) throw new o();
-			return g(await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a)));
+			let e = A();
+			if (await Q(this.db.prepare("UPDATE coordinator_reciprocal_approvals\n						 SET status = 'completed', resolved_at = ?\n						 WHERE request_id = ?\n						   AND group_id = ?\n						   AND requesting_device_id = ?\n						   AND requested_device_id = ?\n						   AND status = 'pending'").bind(e, a, t, r, n)) !== 1) throw new c();
+			return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a)));
 		}
-		let s = S(n, r), c = await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
-		if (c) return g(c);
-		let l = await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
+		let o = ae(n, r), s = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
+		if (s) return O(s);
+		let l = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
 		if (l) {
-			let e = x();
-			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, l.request_id).run(), g(await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(l.request_id)));
+			let e = A();
+			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, l.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(l.request_id)));
 		}
-		let u = w(12), d = x();
+		let u = M(12), d = A();
 		try {
-			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(u, t, n, r, s.low, s.high, d).run();
+			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(u, t, n, r, o.low, o.high, d).run();
 		} catch (e) {
-			if (!C(e)) throw e;
-			let i = await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
-			if (i) return g(i);
-			let a = await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
+			if (!j(e)) throw e;
+			let i = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
+			if (i) return O(i);
+			let a = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
 			if (a) {
-				let e = x();
-				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, a.request_id).run(), g(await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a.request_id)));
+				let e = A();
+				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, a.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a.request_id)));
 			}
 			throw e;
 		}
-		return g(await J(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(u)));
+		return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(u)));
 	}
 	async createBootstrapGrant(e) {
-		let t = k(e), n = w(12), r = x();
-		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, r, t.createdBy).run(), g(await J(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
+		let t = se(e), n = M(12), r = A();
+		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, r, t.createdBy).run(), O(await Z(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
 	}
 	async getScope(e) {
-		let t = await J(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
-		return t ? g(t) : null;
+		let t = await Z(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
+		return t ? O(t) : null;
 	}
 	async getScopeMembership(e, t) {
-		let n = await J(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
-		return n ? g(n) : null;
+		let n = await Z(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
+		return n ? O(n) : null;
 	}
 	async createScope(e) {
-		let t = P(e);
+		let t = z(e);
 		if (await this.getScope(t.scopeId)) throw Error("scopeId already exists.");
-		let n = x();
+		let n = A();
 		await this.db.prepare("INSERT INTO coordinator_scopes(\n					scope_id, label, kind, authority_type, coordinator_id, group_id,\n					manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(t.scopeId, t.label, t.kind, t.authorityType, t.coordinatorId, t.groupId, t.manifestIssuerDeviceId, t.membershipEpoch, t.manifestHash, t.status, n, n).run();
 		let r = await this.getScope(t.scopeId);
 		if (!r) throw Error("scope insert returned no row");
 		return r;
 	}
 	async updateScope(e) {
-		let t = A(e.scopeId), n = t ? await this.getScope(t) : null;
+		let t = I(e.scopeId), n = t ? await this.getScope(t) : null;
 		if (!n) return null;
-		let r = L(e, n);
-		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, x(), r.scopeId).run(), await this.getScope(r.scopeId);
+		let r = H(e, n);
+		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, A(), r.scopeId).run(), await this.getScope(r.scopeId);
 	}
 	async listScopes(e = {}) {
-		let t = [], n = [], r = A(e.coordinatorId), i = A(e.groupId), a = A(e.status);
+		let t = [], n = [], r = I(e.coordinatorId), i = I(e.groupId), a = I(e.status);
 		r && (t.push("coordinator_id = ?"), n.push(r)), i && (t.push("group_id = ?"), n.push(i)), a ? (t.push("status = ?"), n.push(a)) : e.includeInactive || t.push("status = 'active'");
 		let o = t.length ? `WHERE ${t.join(" AND ")}` : "", s = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
 				manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at
 			 FROM coordinator_scopes ${o}
 			 ORDER BY coordinator_id ASC, group_id ASC, scope_id ASC`);
-		return (await q(n.length ? s.bind(...n) : s)).map((e) => g(e));
+		return (await X(n.length ? s.bind(...n) : s)).map((e) => O(e));
 	}
 	async grantScopeMembership(e) {
-		let t = p(e.effectId), r = n(e), i = await V(this.db, t);
-		if (i) return l(i, "grant", r), a(i);
-		let o = A(e.scopeId), c = A(e.deviceId), u = o ? await this.getScope(o) : null;
-		if (!u) throw new s("scope_not_found");
-		if (u.status !== "active") throw new s("scope_inactive");
-		let d = o && c ? await this.getScopeMembership(o, c) : null, f = R(e, u, d);
-		if (f.groupId && !await this.getEnrollment(f.groupId, f.deviceId)) throw new s("device_not_enrolled");
-		let m = x();
-		await W(this.db, [
-			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(f.scopeId, f.deviceId, f.role, f.membershipEpoch, f.coordinatorId, f.groupId, f.manifestIssuerDeviceId, f.manifestHash, f.signedManifestJson, m, t),
-			H(this.db, {
+		let t = w(e.effectId), n = r(e), i = await K(this.db, t);
+		if (i) return d(i, "grant", n), o(i);
+		let a = I(e.scopeId), s = I(e.deviceId), c = a ? await this.getScope(a) : null;
+		if (!c) throw new l("scope_not_found");
+		if (c.status !== "active") throw new l("scope_inactive");
+		let u = a && s ? await this.getScopeMembership(a, s) : null, f = U(e, c, u);
+		if (f.groupId && !await this.getEnrollment(f.groupId, f.deviceId)) throw new l("device_not_enrolled");
+		let p = A();
+		await q(this.db, [
+			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(f.scopeId, f.deviceId, f.role, f.membershipEpoch, f.coordinatorId, f.groupId, f.manifestIssuerDeviceId, f.manifestHash, f.signedManifestJson, p, t),
+			le(this.db, {
 				effectId: t,
-				requestJson: r,
+				requestJson: n,
 				scopeId: f.scopeId,
 				deviceId: f.deviceId,
-				createdAt: m
+				createdAt: p
 			}),
-			B(this.db, {
+			G(this.db, {
 				effectId: t,
-				requestJson: r,
+				requestJson: n,
 				action: "grant",
-				previous: d,
+				previous: u,
 				scopeId: f.scopeId,
 				deviceId: f.deviceId,
 				status: "active",
 				membershipEpoch: f.membershipEpoch,
-				updatedAt: m,
+				updatedAt: p,
 				actorType: f.actorType,
 				actorId: f.actorId,
-				createdAt: m
+				createdAt: p
 			})
 		]);
-		let h = await V(this.db, t);
-		if (!h) throw Error("scope membership grant was not applied.");
-		return l(h, "grant", r), a(h);
+		let m = await K(this.db, t);
+		if (!m) throw Error("scope membership grant was not applied.");
+		return d(m, "grant", n), o(m);
 	}
 	async revokeScopeMembership(e) {
-		let t = A(e.scopeId), n = A(e.deviceId);
+		let t = I(e.scopeId), n = I(e.deviceId);
 		if (!t || !n) throw Error("scopeId and deviceId are required.");
-		let r = p(e.effectId), a = i(e), o = await V(this.db, r);
-		if (o) return l(o, "revoke", a), o.outcome_applied === 1;
-		let c = e.membershipEpoch == null ? null : N(e.membershipEpoch), u = A(e.groupId), d = u ? await this.getScope(t) : null;
-		if (u && u !== d?.group_id) throw new s("scope_group_mismatch");
+		let r = w(e.effectId), i = a(e), o = await K(this.db, r);
+		if (o) return d(o, "revoke", i), o.outcome_applied === 1;
+		let s = e.membershipEpoch == null ? null : R(e.membershipEpoch), c = I(e.groupId), u = c ? await this.getScope(t) : null;
+		if (c && c !== u?.group_id) throw new l("scope_group_mismatch");
 		let f = await this.getScopeMembership(t, n);
-		if (c != null && f && c <= f.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let m = x(), h = c ?? (f?.membership_epoch ?? -1) + 1, g = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(c, c, A(e.manifestHash), A(e.signedManifestJson), m, t, n, f?.membership_epoch ?? -1, f?.status ?? "", r), _ = U(this.db, {
+		if (s != null && f && s <= f.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let p = A(), m = s ?? (f?.membership_epoch ?? -1) + 1, h = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(s, s, I(e.manifestHash), I(e.signedManifestJson), p, t, n, f?.membership_epoch ?? -1, f?.status ?? "", r), g = ue(this.db, {
 			effectId: r,
-			requestJson: a,
+			requestJson: i,
 			scopeId: t,
 			deviceId: n,
-			createdAt: m
-		}), v = B(this.db, {
+			createdAt: p
+		}), _ = G(this.db, {
 			effectId: r,
-			requestJson: a,
+			requestJson: i,
 			action: "revoke",
 			previous: f,
 			scopeId: t,
 			deviceId: n,
 			status: "revoked",
-			membershipEpoch: h,
-			updatedAt: m,
-			actorType: A(e.actorType),
-			actorId: A(e.actorId),
-			createdAt: m
+			membershipEpoch: m,
+			updatedAt: p,
+			actorType: I(e.actorType),
+			actorId: I(e.actorId),
+			createdAt: p
 		});
 		try {
-			await W(this.db, [
+			await q(this.db, [
+				h,
 				g,
-				_,
-				v
+				_
 			]);
 		} catch (e) {
 			let r = await this.getScopeMembership(t, n);
 			if (f && (!r || r.membership_epoch !== f.membership_epoch || r.status !== f.status)) return !1;
 			throw e;
 		}
-		let y = await V(this.db, r);
-		if (!y) throw Error("scope membership revoke receipt was not persisted.");
-		return l(y, "revoke", a), y.outcome_applied === 1;
+		let v = await K(this.db, r);
+		if (!v) throw Error("scope membership revoke receipt was not persisted.");
+		return d(v, "revoke", i), v.outcome_applied === 1;
 	}
 	async listScopeMemberships(e, t = !1) {
-		let n = A(e);
+		let n = I(e);
 		if (!n) throw Error("scopeId is required.");
 		let r = t ? "" : "AND status = 'active'";
-		return (await q(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
+		return (await X(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
 							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
 						 FROM coordinator_scope_memberships
 						 WHERE scope_id = ? ${r}
-						 ORDER BY device_id ASC`).bind(n))).map((e) => g(e));
+						 ORDER BY device_id ASC`).bind(n))).map((e) => O(e));
+	}
+	async listDeviceScopeMemberships(e, t = !1) {
+		let n = I(e);
+		if (!n) throw Error("deviceId is required.");
+		let r = t ? "" : "AND status = 'active'";
+		return (await X(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
+							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
+						 FROM coordinator_scope_memberships
+						 WHERE device_id = ? ${r}
+						 ORDER BY scope_id ASC`).bind(n))).map((e) => O(e));
 	}
 	async listScopeMembershipAuditEvents(e) {
-		let t = A(e.scopeId);
+		let t = I(e.scopeId);
 		if (!t) throw Error("scopeId is required.");
-		let n = A(e.deviceId), r = z(e.limit), i = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", a = n ? [
+		let n = I(e.deviceId), r = W(e.limit), i = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", a = n ? [
 			t,
 			n,
 			r
 		] : [t, r];
-		return (await q(this.db.prepare(`SELECT event_id, effect_id, action, scope_id, device_id, role, status, membership_epoch,
+		return (await X(this.db.prepare(`SELECT event_id, effect_id, action, scope_id, device_id, role, status, membership_epoch,
 							previous_role, previous_status, previous_membership_epoch,
 							coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at
 						 FROM coordinator_scope_membership_audit_log
 						 WHERE ${i}
 						 ORDER BY event_id ASC
-						 LIMIT ?`).bind(...a))).map((e) => g(e));
+						 LIMIT ?`).bind(...a))).map((e) => O(e));
 	}
 	async getBootstrapGrant(e) {
-		let t = await J(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
-		return t ? g(t) : null;
+		let t = await Z(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
+		return t ? O(t) : null;
 	}
 	async listBootstrapGrants(e) {
-		return (await q(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => g(e));
+		return (await X(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => O(e));
 	}
-	async revokeBootstrapGrant(e, t = x()) {
-		return await Y(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
+	async revokeBootstrapGrant(e, t = A()) {
+		return await Q(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
 	}
 	async listReciprocalApprovals(e) {
 		let t = e.direction === "incoming" ? "requested_device_id" : "requesting_device_id", n = e.status?.trim() || "pending";
-		return (await q(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
+		return (await X(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
 						 FROM coordinator_reciprocal_approvals
 						 WHERE group_id = ? AND ${t} = ? AND status = ?
-						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => g(e));
+						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => O(e));
+	}
+	async createLegacyTeamCompletion(e, t) {
+		let [n] = h([e]);
+		if (!n) throw Error("completion_manifest_invalid");
+		let r = await this.getGroup(n);
+		if (!r) throw Error("group_not_found");
+		if (r.archived_at) throw Error("group_archived");
+		let i = T(t), a = JSON.parse(i);
+		x(a);
+		let o = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
+		if (o) {
+			if (o.manifest_json !== i) throw new S();
+			return {
+				status: "existing",
+				manifest: C(JSON.parse(o.manifest_json))
+			};
+		}
+		let s = await X(this.db.prepare("SELECT DISTINCT\n					requested.scope_id,\n					scope.authority_type,\n					scope.coordinator_id,\n					scope.group_id,\n					scope.status\n				 FROM (\n					SELECT json_extract(value, '$.scope_id') AS scope_id\n					FROM json_each(?, '$.project_mappings')\n				 ) AS requested\n				 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i)), c = g(a, n, s), l = await Q(this.db.prepare("INSERT OR IGNORE INTO coordinator_legacy_team_completions(\n					group_id, candidate_ref, manifest_version, manifest_json, completed_at, created_at\n					) SELECT ?, ?, ?, ?, ?, ?\n					  FROM groups\n					  WHERE group_id = ? AND archived_at IS NULL\n					    AND NOT EXISTS (\n					      SELECT 1\n					      FROM json_each(?, '$.project_mappings') AS requested\n					      LEFT JOIN coordinator_scopes AS scope\n					        ON scope.scope_id = json_extract(requested.value, '$.scope_id')\n					       AND scope.authority_type = 'coordinator'\n					       AND scope.coordinator_id = ?\n					       AND scope.group_id = ?\n					       AND scope.status = 'active'\n					      WHERE scope.scope_id IS NULL\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM enrolled_devices AS enrolled\n					      WHERE enrolled.group_id = ?\n					        AND NOT EXISTS (\n					          SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					          WHERE json_extract(requested.value, '$.device_id') = enrolled.device_id\n					            AND json_extract(requested.value, '$.key_fingerprint') = enrolled.fingerprint\n					            AND json_extract(requested.value, '$.enabled') = enrolled.enabled\n					        )\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					      WHERE json_extract(requested.value, '$.decision') = 'included'\n					        AND NOT EXISTS (\n					          SELECT 1 FROM enrolled_devices AS enrolled\n					          WHERE enrolled.group_id = ?\n					            AND enrolled.device_id = json_extract(requested.value, '$.device_id')\n					            AND enrolled.fingerprint = json_extract(requested.value, '$.key_fingerprint')\n					            AND enrolled.enabled = 1\n					        )\n					    )").bind(n, a.candidate_ref, a.version, i, a.completed_at, A(), n, i, c, n, n, i, i, n)), u = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
+		if (!u) {
+			let e = await this.getGroup(n);
+			if (!e) throw Error("group_not_found");
+			if (e.archived_at) throw Error("group_archived");
+			let t = await X(this.db.prepare("SELECT DISTINCT\n						requested.scope_id,\n						scope.authority_type,\n						scope.coordinator_id,\n						scope.group_id,\n						scope.status\n					 FROM (\n						SELECT json_extract(value, '$.scope_id') AS scope_id\n						FROM json_each(?, '$.project_mappings')\n					 ) AS requested\n					 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i));
+			throw g(a, n, t), Error("completion_manifest_unavailable");
+		}
+		if (u.manifest_json !== i) throw new S();
+		return {
+			status: l === 1 ? "created" : "existing",
+			manifest: C(JSON.parse(u.manifest_json))
+		};
+	}
+	async getLegacyTeamCompletion(e, t) {
+		let [n] = h([e]), r = v(t);
+		if (!n) throw Error("completion_manifest_invalid");
+		let i = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, r));
+		return i ? C(JSON.parse(i.manifest_json)) : null;
+	}
+	async listLegacyTeamCompletions(e) {
+		let t = h(e);
+		if (t.length === 0) return [];
+		let n = t.map(() => "?").join(", "), r = await Z(this.db.prepare(`SELECT
+					COUNT(*) AS record_count,
+					COALESCE(SUM(
+						LENGTH(CAST(group_id AS BLOB)) + LENGTH(CAST(manifest_json AS BLOB))
+					), 0) AS batch_bytes,
+					COALESCE(MAX(LENGTH(CAST(manifest_json AS BLOB))), 0) AS max_manifest_bytes
+				FROM coordinator_legacy_team_completions
+				WHERE group_id IN (${n})`).bind(...t));
+		if (!r || r.record_count > 500 || r.batch_bytes > 375e5 || r.max_manifest_bytes > 15e5) throw Error("completion_results_too_large");
+		let i = await X(this.db.prepare(`WITH completion_stats AS (
+					SELECT
+						COUNT(*) AS record_count,
+						COALESCE(SUM(
+							LENGTH(CAST(group_id AS BLOB)) + LENGTH(CAST(manifest_json AS BLOB))
+						), 0) AS batch_bytes,
+						COALESCE(MAX(LENGTH(CAST(manifest_json AS BLOB))), 0) AS max_manifest_bytes
+					FROM coordinator_legacy_team_completions
+					WHERE group_id IN (${n})
+				)
+				SELECT completions.group_id, completions.manifest_json
+				FROM coordinator_legacy_team_completions AS completions
+				CROSS JOIN completion_stats
+				WHERE completions.group_id IN (${n})
+					  AND completion_stats.record_count <= 500
+					  AND completion_stats.batch_bytes <= ${f}
+					  AND completion_stats.max_manifest_bytes <= ${s}
+					  AND LENGTH(completions.manifest_json) <= ${s}
+					  AND LENGTH(CAST(completions.manifest_json AS BLOB)) <= ${s}
+					ORDER BY completions.group_id, completions.completed_at, completions.candidate_ref
+					LIMIT 501`).bind(...t, ...t));
+		if (i.length === 0 && r.record_count > 0 || i.length > 500 || i.reduce((e, t) => e + new TextEncoder().encode(t.group_id).byteLength + new TextEncoder().encode(t.manifest_json).byteLength, 0) > 375e5) throw Error("completion_results_too_large");
+		return i.map((e) => ({
+			group_id: e.group_id,
+			manifest: C(JSON.parse(e.manifest_json))
+		}));
 	}
 	async upsertPresence(e) {
-		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = b([], e.addresses);
+		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = k([], e.addresses);
 		return await this.db.prepare("INSERT INTO presence_records(group_id, device_id, addresses_json, last_seen_at, expires_at, capabilities_json)\n				 VALUES (?, ?, ?, ?, ?, ?)\n				 ON CONFLICT(group_id, device_id) DO UPDATE SET\n					addresses_json = excluded.addresses_json,\n					last_seen_at = excluded.last_seen_at,\n					expires_at = excluded.expires_at,\n					capabilities_json = excluded.capabilities_json").bind(e.groupId, e.deviceId, JSON.stringify(r), t.toISOString(), n, JSON.stringify(e.capabilities ?? {})).run(), {
 			group_id: e.groupId,
 			device_id: e.deviceId,
@@ -790,14 +875,14 @@ var X = class {
 		};
 	}
 	async listGroupPeers(e, t) {
-		let n = x();
-		return (await q(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
+		let n = A();
+		return (await X(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
 			let t = String(e.expires_at ?? "").trim(), r = !0;
 			if (t) {
 				let e = new Date(t);
 				r = Number.isNaN(e.getTime()) || e.toISOString() <= n;
 			}
-			let i = r ? [] : b([], JSON.parse(String(e.addresses_json ?? "[]")));
+			let i = r ? [] : k([], JSON.parse(String(e.addresses_json ?? "[]")));
 			return {
 				device_id: String(e.device_id ?? ""),
 				public_key: String(e.public_key ?? ""),
@@ -814,17 +899,18 @@ var X = class {
 };
 //#endregion
 //#region src/d1-coordinator-runtime.ts
-function Z(e) {
-	return m({
-		storeFactory: () => new X(e.db),
-		runtime: {
-			adminSecret: () => String(e.adminSecret ?? "").trim() || null,
-			now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
-		},
+function de(e) {
+	let t = {
+		adminSecret: () => String(e.adminSecret ?? "").trim() || null,
+		now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
+	};
+	return E({
+		storeFactory: () => new $(e.db),
+		runtime: t,
 		requestVerifier: e.requestVerifier
 	});
 }
 //#endregion
-export { X as D1CoordinatorStore, f as DEFAULT_TIME_WINDOW_S, Z as createD1CoordinatorApp };
+export { p as COORDINATOR_LEGACY_TEAM_COMPLETION_CONFLICT, f as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_BYTES, m as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_RESPONSE_BYTES, s as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BYTES, e as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_GROUPS, _ as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_RECORDS, te as COORDINATOR_LEGACY_TEAM_COMPLETION_VERSION, S as CoordinatorLegacyTeamCompletionConflictError, $ as D1CoordinatorStore, ee as DEFAULT_TIME_WINDOW_S, T as canonicalCoordinatorLegacyTeamCompletionManifestJson, de as createD1CoordinatorApp, v as normalizeCoordinatorLegacyTeamCompletionCandidateRef, h as normalizeCoordinatorLegacyTeamCompletionGroupIds, C as normalizeCoordinatorLegacyTeamCompletionManifest };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map