@codemem/core 0.44.0-alpha.1 → 0.44.0

package/dist/internal/cloudflare-coordinator.js

@@ -1,10 +1,10 @@
-import { $ as e, B as t, D as n, G as r, H as i, J as a, K as o, Q as s, R as c, U as l, V as u, W as d, X as f, Y as p, Z as m, at as h, ct as g, et as _, it as v, j as y, k as b, lt as x, n as ee, nt as S, ot as C, q as w, rt as T, t as E, tt as te, w as D } from "../coordinator-api-Dlr65yhR.js";
+import { $ as e, B as t, E as n, F as r, G as i, H as a, I as o, J as s, K as c, L as l, N as u, Q as d, R as f, S as p, U as m, V as h, W as g, X as _, Y as v, Z as y, et as b, it as x, n as ee, q as S, rt as C, t as te, tt as w, w as T, y as E, z as D } from "../coordinator-api-C2ckGC2b.js";
 //#region src/d1-coordinator-store.ts
 function O(e) {
 	if (e == null) throw Error("expected row");
 	return e;
 }
-function ne(e) {
+function k(e) {
 	let { presence_capabilities_json: t, presence_expires_at: n, ...r } = O(e);
 	if (typeof n != "string" || typeof t != "string") return r;
 	try {
@@ -23,7 +23,7 @@ function ne(e) {
 		return r;
 	}
 }
-function re(e) {
+function A(e) {
 	let t = e.trim();
 	if (!t) return "";
 	let n = t.includes("://") ? t : `http://${t}`;
@@ -34,7 +34,7 @@ function re(e) {
 		return "";
 	}
 }
-function ie(e) {
+function ne(e) {
 	if (!e) return "";
 	try {
 		let t = new URL(e), n = t.hostname.toLowerCase();
@@ -42,18 +42,18 @@ function ie(e) {
 	} catch {}
 	return e;
 }
-function k(e, t) {
+function j(e, t) {
 	let n = [], r = /* @__PURE__ */ new Set();
 	for (let i of [...e, ...t]) {
-		let e = re(i), t = ie(e);
+		let e = A(i), t = ne(e);
 		!e || r.has(t) || (r.add(t), n.push(e));
 	}
 	return n;
 }
-function A() {
+function M() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
-function ae(e, t) {
+function re(e, t) {
 	return e <= t ? {
 		low: e,
 		high: t
@@ -62,22 +62,22 @@ function ae(e, t) {
 		high: e
 	};
 }
-function j(e) {
+function ie(e) {
 	return e instanceof Error && /unique|constraint/i.test(e.message);
 }
-function M(e) {
+function N(e) {
 	let t = new Uint8Array(e);
 	globalThis.crypto.getRandomValues(t);
 	let n = [];
 	for (let e of t) n.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"[e % 64] ?? "A");
 	return n.join("");
 }
-async function N(e) {
+async function P(e) {
 	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
 	return Array.from(new Uint8Array(t), (e) => e.toString(16).padStart(2, "0")).join("");
 }
-var P = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", F = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at", oe = "enrolled_devices.group_id, enrolled_devices.device_id,\n	enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.identity_id,\n	enrolled_devices.display_name, enrolled_devices.enabled, enrolled_devices.created_at,\n	presence_records.expires_at AS presence_expires_at,\n	presence_records.capabilities_json AS presence_capabilities_json";
-function se(e) {
+var F = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", I = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at", ae = "enrolled_devices.group_id, enrolled_devices.device_id,\n	enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.identity_id,\n	enrolled_devices.display_name, enrolled_devices.enabled, enrolled_devices.created_at,\n	presence_records.expires_at AS presence_expires_at,\n	presence_records.capabilities_json AS presence_capabilities_json";
+function oe(e) {
 	let t = String(e.groupId ?? "").trim(), n = String(e.seedDeviceId ?? "").trim(), r = String(e.workerDeviceId ?? "").trim(), i = String(e.expiresAt ?? "").trim(), a = String(e.createdBy ?? "").trim() || null;
 	if (!t || !n || !r || !i) throw Error("groupId, seedDeviceId, workerDeviceId, and expiresAt are required.");
 	return {
@@ -88,11 +88,11 @@ function se(e) {
 		createdBy: a
 	};
 }
-function I(e) {
+function L(e) {
 	return e?.trim() || null;
 }
-async function ce(e) {
-	let t = e.inviteKind ?? (I(e.operationId) ? "project_share" : "legacy_enrollment"), r = I(e.policyTeamId), i = I(e.targetIdentityId), a = I(e.reviewedPreviewDigest);
+async function se(e) {
+	let t = e.inviteKind ?? (L(e.operationId) ? "project_share" : "legacy_enrollment"), r = L(e.policyTeamId), i = L(e.targetIdentityId), a = L(e.reviewedPreviewDigest);
 	if (![
 		"legacy_enrollment",
 		"project_share",
@@ -102,14 +102,14 @@ async function ce(e) {
 	if ([r, i].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) throw Error("recipient invite identifier is invalid.");
 	if (a && !/^[a-f0-9]{64}$/u.test(a)) throw Error("reviewedPreviewDigest must be a SHA-256 digest.");
 	if (t === "project_share") {
-		if (!I(e.operationId)) throw Error("project_share invite requires operationId.");
+		if (!L(e.operationId)) throw Error("project_share invite requires operationId.");
 		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
 	} else if (t === "legacy_enrollment") {
-		if (I(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
+		if (L(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
 		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
 	} else if (t === "team_member") {
-		if (!r || !a || i || I(e.operationId)) throw Error("team_member invite metadata is invalid.");
-	} else if (t === "add_device" && (!i || !a || r || I(e.operationId))) throw Error("add_device invite metadata is invalid.");
+		if (!r || !a || i || L(e.operationId)) throw Error("team_member invite metadata is invalid.");
+	} else if (t === "add_device" && (!i || !a || r || L(e.operationId))) throw Error("add_device invite metadata is invalid.");
 	if (e.reviewedIntent === void 0 || e.reviewedIntent === null) {
 		if (t === "team_member" || t === "add_device") throw Error("recipient_invite_review_unavailable");
 		return {
@@ -130,7 +130,7 @@ async function ce(e) {
 		targetIdentityId: i
 	};
 	else throw Error("recipient invite metadata requires a recipient invite kind.");
-	return await y(e.reviewedIntent, {
+	return await n(e.reviewedIntent, {
 		target: o,
 		digest: a
 	}), {
@@ -138,13 +138,13 @@ async function ce(e) {
 		policyTeamId: r,
 		targetIdentityId: i,
 		reviewedPreviewDigest: a,
-		reviewedIntentJson: n(e.reviewedIntent, o)
+		reviewedIntentJson: p(e.reviewedIntent, o)
 	};
 }
-async function L(e) {
+async function R(e) {
 	if (e.invite_kind === "team_member") {
-		if (!e.policy_team_id || !t(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
-		let n = await b(e.reviewed_intent_json, {
+		if (!e.policy_team_id || !r(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
+		let t = await T(e.reviewed_intent_json, {
 			target: {
 				kind: "team_member",
 				policyTeamId: e.policy_team_id
@@ -157,13 +157,13 @@ async function L(e) {
 			policy_team_id: e.policy_team_id,
 			assigned_identity_id: e.assigned_identity_id,
 			reviewed_preview_digest: e.reviewed_preview_digest,
-			reviewed_intent: n,
+			reviewed_intent: t,
 			bound: !!e.consumed_at
 		};
 	}
 	if (e.invite_kind === "add_device") {
 		if (!e.target_identity_id || !e.reviewed_preview_digest) throw Error("invite_invalid");
-		let t = await b(e.reviewed_intent_json, {
+		let t = await T(e.reviewed_intent_json, {
 			target: {
 				kind: "add_device",
 				targetIdentityId: e.target_identity_id
@@ -181,40 +181,40 @@ async function L(e) {
 	}
 	return null;
 }
-function R(e, t = 0) {
+function z(e, t = 0) {
 	if (e == null) return t;
 	if (!Number.isFinite(e) || e < 0) throw Error("membershipEpoch must be non-negative.");
 	return Math.trunc(e);
 }
-function z(e) {
-	let t = I(e.scopeId), n = I(e.label);
+function ce(e) {
+	let t = L(e.scopeId), n = L(e.label);
 	if (!t || !n) throw Error("scopeId and label are required.");
 	return {
 		scopeId: t,
 		label: n,
-		kind: I(e.kind) ?? "user",
-		authorityType: I(e.authorityType) ?? "coordinator",
-		coordinatorId: I(e.coordinatorId),
-		groupId: I(e.groupId),
-		manifestIssuerDeviceId: I(e.manifestIssuerDeviceId),
-		membershipEpoch: R(e.membershipEpoch),
-		manifestHash: I(e.manifestHash),
-		status: I(e.status) ?? "active"
+		kind: L(e.kind) ?? "user",
+		authorityType: L(e.authorityType) ?? "coordinator",
+		coordinatorId: L(e.coordinatorId),
+		groupId: L(e.groupId),
+		manifestIssuerDeviceId: L(e.manifestIssuerDeviceId),
+		membershipEpoch: z(e.membershipEpoch),
+		manifestHash: L(e.manifestHash),
+		status: L(e.status) ?? "active"
 	};
 }
 function B(e, t, n) {
 	if (e === void 0) return t;
-	let r = I(e);
+	let r = L(e);
 	if (!r) throw Error(`${n} must not be empty.`);
 	return r;
 }
 function V(e, t) {
-	return e === void 0 ? t : I(e);
+	return e === void 0 ? t : L(e);
 }
 function H(e, t) {
-	let n = I(e.scopeId);
+	let n = L(e.scopeId);
 	if (!n) throw Error("scopeId is required.");
-	let r = e.membershipEpoch == null ? null : R(e.membershipEpoch);
+	let r = e.membershipEpoch == null ? null : z(e.membershipEpoch);
 	if (r != null && r < t.membership_epoch) throw Error("membershipEpoch must not move backwards.");
 	return {
 		scopeId: n,
@@ -230,27 +230,27 @@ function H(e, t) {
 	};
 }
 function U(e, t, n) {
-	let r = I(e.scopeId), i = I(e.deviceId);
+	let r = L(e.scopeId), i = L(e.deviceId);
 	if (!r || !i) throw Error("scopeId and deviceId are required.");
-	let a = I(e.coordinatorId), o = I(e.groupId);
+	let a = L(e.coordinatorId), o = L(e.groupId);
 	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
-	if (o && o !== t?.group_id) throw new l("scope_group_mismatch");
-	let s = e.membershipEpoch == null ? null : R(e.membershipEpoch), c = t?.membership_epoch ?? 0;
+	if (o && o !== t?.group_id) throw new f("scope_group_mismatch");
+	let s = e.membershipEpoch == null ? null : z(e.membershipEpoch), c = t?.membership_epoch ?? 0;
 	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
 	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
-	let u = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
+	let l = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
 	return {
 		scopeId: r,
 		deviceId: i,
-		role: I(e.role) ?? "member",
-		membershipEpoch: u,
+		role: L(e.role) ?? "member",
+		membershipEpoch: l,
 		coordinatorId: t?.coordinator_id ?? null,
 		groupId: t?.group_id ?? null,
-		manifestIssuerDeviceId: I(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
-		manifestHash: I(e.manifestHash) ?? t?.manifest_hash ?? null,
-		signedManifestJson: I(e.signedManifestJson),
-		actorType: I(e.actorType),
-		actorId: I(e.actorId)
+		manifestIssuerDeviceId: L(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
+		manifestHash: L(e.manifestHash) ?? t?.manifest_hash ?? null,
+		signedManifestJson: L(e.signedManifestJson),
+		actorType: L(e.actorType),
+		actorId: L(e.actorId)
 	};
 }
 function W(e) {
@@ -305,7 +305,7 @@ var $ = class {
 	}
 	async close() {}
 	async createGroup(e, t) {
-		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, A()).run();
+		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, M()).run();
 	}
 	async getGroup(e) {
 		let t = await Z(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
@@ -318,27 +318,27 @@ var $ = class {
 	async renameGroup(e, t) {
 		return await Q(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
 	}
-	async archiveGroup(e, t = A()) {
+	async archiveGroup(e, t = M()) {
 		return await Q(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
 	}
 	async unarchiveGroup(e) {
 		return await Q(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
 	}
 	async enrollDevice(e, t) {
-		if (await Q(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, A())) === 0) throw Error("invite_identity_conflict");
+		if (await Q(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, M())) === 0) throw Error("invite_identity_conflict");
 	}
 	async listEnrolledDevices(e, t) {
 		let n = t ? "" : "AND enrolled_devices.enabled = 1";
-		return (await X(this.db.prepare(`SELECT ${oe}
+		return (await X(this.db.prepare(`SELECT ${ae}
 						 FROM enrolled_devices
 						 LEFT JOIN presence_records
 						   ON presence_records.group_id = enrolled_devices.group_id
 						  AND presence_records.device_id = enrolled_devices.device_id
 						 WHERE enrolled_devices.group_id = ? ${n}
-						 ORDER BY enrolled_devices.created_at ASC, enrolled_devices.device_id ASC`).bind(e))).map(ne);
+						 ORDER BY enrolled_devices.created_at ASC, enrolled_devices.device_id ASC`).bind(e))).map(k);
 	}
 	async getEnrollment(e, t, n = !1) {
-		let r = n ? "" : "AND enabled = 1", i = await Z(this.db.prepare(`SELECT ${F}
+		let r = n ? "" : "AND enabled = 1", i = await Z(this.db.prepare(`SELECT ${I}
 					 FROM enrolled_devices
 					 WHERE group_id = ? AND device_id = ? ${r}`).bind(e, t));
 		return i ? O(i) : null;
@@ -364,111 +364,111 @@ var $ = class {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
 	async createInvite(e) {
-		let t = A(), n = M(12), r = M(24), i = await N(r), a = u(e.expiresAt), o = await this.getGroup(e.groupId), s = String(e.operationId ?? "").trim() || null, c = String(e.reviewedProjectSetDigest ?? "").trim() || null, l = await ce(e), d = l.inviteKind === "team_member" ? `identity:${M(18)}` : null;
-		if (!!s != !!c) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
+		let t = M(), n = N(12), r = N(24), i = await P(r), a = o(e.expiresAt), s = await this.getGroup(e.groupId), c = String(e.operationId ?? "").trim() || null, l = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await se(e), d = u.inviteKind === "team_member" ? `identity:${N(18)}` : null;
+		if (!!c != !!l) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
 		let f = async () => {
-			if (!s) return null;
-			let t = await Z(this.db.prepare(`SELECT ${P} FROM coordinator_invites WHERE operation_id = ?`).bind(s));
+			if (!c) return null;
+			let t = await Z(this.db.prepare(`SELECT ${F} FROM coordinator_invites WHERE operation_id = ?`).bind(c));
 			if (!t) return null;
 			if (t.consumed_at) throw Error("invite_already_bound");
-			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== l.inviteKind || t.reviewed_project_set_digest !== c || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== l.policyTeamId || t.target_identity_id !== l.targetIdentityId || t.reviewed_preview_digest !== l.reviewedPreviewDigest || t.reviewed_intent_json !== l.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
+			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== u.inviteKind || t.reviewed_project_set_digest !== l || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== u.policyTeamId || t.target_identity_id !== u.targetIdentityId || t.reviewed_preview_digest !== u.reviewedPreviewDigest || t.reviewed_intent_json !== u.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
 			return O(t);
 		}, p = async (n) => {
 			if (!n.revoked_at && n.expires_at > t) return n;
-			await Q(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, o?.display_name ?? null, s, n.token, t));
-			let c = await f();
-			if (!c) throw Error("invite_operation_reissue_failed");
-			return c;
+			await Q(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, s?.display_name ?? null, c, n.token, t));
+			let o = await f();
+			if (!o) throw Error("invite_operation_reissue_failed");
+			return o;
 		};
-		if (s) {
+		if (c) {
 			let e = await f();
 			if (e) return await p(e);
 		}
 		try {
-			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, o?.display_name ?? null, s, c, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, s ? "pending" : null, l.inviteKind, l.policyTeamId, l.targetIdentityId, d, l.reviewedPreviewDigest, l.reviewedIntentJson).run();
+			await this.db.prepare("INSERT INTO coordinator_invites(\n				invite_id, group_id, token, policy, expires_at, created_at, created_by,\n				team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest,\n				token_digest, inviter_actor_id, inviter_display_name, inviter_device_id,\n				pending_person_id, project_summaries_json, project_intent_json, trust_state,\n				invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n				reviewed_preview_digest, reviewed_intent_json\n			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(n, e.groupId, r, e.policy, a, t, e.createdBy ?? null, s?.display_name ?? null, c, l, i, String(e.inviterActorId ?? "").trim() || null, String(e.inviterDisplayName ?? "").trim() || null, String(e.inviterDeviceId ?? "").trim() || null, String(e.pendingPersonId ?? "").trim() || null, e.projectSummaries ? JSON.stringify(e.projectSummaries) : null, e.projectIntent ? JSON.stringify(e.projectIntent) : null, c ? "pending" : null, u.inviteKind, u.policyTeamId, u.targetIdentityId, d, u.reviewedPreviewDigest, u.reviewedIntentJson).run();
 		} catch (e) {
-			if (s) {
+			if (c) {
 				let e = await f();
 				if (e) return await p(e);
 			}
 			throw e;
 		}
-		return O(await Z(this.db.prepare(`SELECT ${P} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
+		return O(await Z(this.db.prepare(`SELECT ${F} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
 	}
 	async getInviteByToken(e) {
-		let t = await N(e), n = await Z(this.db.prepare(`SELECT ${P}
+		let t = await P(e), n = await Z(this.db.prepare(`SELECT ${F}
 					 FROM coordinator_invites
 					 WHERE (token_digest = ? OR token = ?)
 					   AND revoked_at IS NULL
-					   AND expires_at > ?`).bind(t, e, A()));
+					   AND expires_at > ?`).bind(t, e, M()));
 		return n ? O(n) : null;
 	}
 	async getInviteByTokenForInspection(e) {
-		let t = await N(e), n = await Z(this.db.prepare(`SELECT ${P} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
+		let t = await P(e), n = await Z(this.db.prepare(`SELECT ${F} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
 		return n ? O(n) : null;
 	}
 	async inspectRecipientInvite(e) {
 		let t = await this.getInviteByTokenForInspection(e.token);
 		if (!t) return null;
-		let n = await L(t);
+		let n = await R(t);
 		if (!n) return null;
 		if (t.revoked_at) throw Error("invite_invalid");
-		if (!t.consumed_at && new Date(t.expires_at) <= new Date(u(e.now))) throw Error("invite_expired");
+		if (!t.consumed_at && new Date(t.expires_at) <= new Date(o(e.now))) throw Error("invite_expired");
 		let r = await this.getGroup(t.group_id);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
 		return n;
 	}
 	async consumeRecipientInvite(e) {
-		let t = u(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
+		let t = o(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
 		if (!e.identityId || !e.deviceId || !e.publicKey || !e.fingerprint || e.identityId !== e.identityId.trim() || e.deviceId !== e.deviceId.trim() || e.identityId.length > 256 || e.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e.identityId) || /[\p{Cc}\p{Cf}]/u.test(e.deviceId)) throw Error("invite_identity_conflict");
-		let a = await N(e.token), o = await this.getInviteByTokenForInspection(e.token), s = o ? await L(o) : null;
-		if (!o || !s || s.kind !== e.inviteKind || o.revoked_at) throw Error("invite_invalid");
-		let c = await this.getGroup(o.group_id);
+		let i = await P(e.token), a = await this.getInviteByTokenForInspection(e.token), s = a ? await R(a) : null;
+		if (!a || !s || s.kind !== e.inviteKind || a.revoked_at) throw Error("invite_invalid");
+		let c = await this.getGroup(a.group_id);
 		if (!c) throw Error("group_not_found");
 		if (c.archived_at) throw Error("group_archived");
-		if (!o.consumed_at && new Date(o.expires_at) <= new Date(t)) throw Error("invite_expired");
-		if (D(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
-		let l = i(s);
-		if (l !== e.identityId) throw Error("invite_identity_conflict");
-		let d = o.bound_device_id === e.deviceId && o.bound_public_key === e.publicKey && o.bound_fingerprint === e.fingerprint;
-		if (o.consumed_at && !d) throw Error("invite_already_bound");
-		if (o.consumed_at && o.recipient_actor_id !== l) throw Error("invite_identity_conflict");
-		let f = await Z(this.db.prepare(`SELECT ${F}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, e.deviceId));
-		if (f && (f.public_key !== e.publicKey || f.fingerprint !== e.fingerprint || f.identity_id !== null && f.identity_id !== l)) throw Error("invite_identity_conflict");
-		let p = 0, m = M(12);
-		if (!o.consumed_at) {
+		if (!a.consumed_at && new Date(a.expires_at) <= new Date(t)) throw Error("invite_expired");
+		if (E(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		let u = l(s);
+		if (u !== e.identityId) throw Error("invite_identity_conflict");
+		let d = a.bound_device_id === e.deviceId && a.bound_public_key === e.publicKey && a.bound_fingerprint === e.fingerprint;
+		if (a.consumed_at && !d) throw Error("invite_already_bound");
+		if (a.consumed_at && a.recipient_actor_id !== u) throw Error("invite_identity_conflict");
+		let f = await Z(this.db.prepare(`SELECT ${I}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(a.group_id, e.deviceId));
+		if (f && (f.public_key !== e.publicKey || f.fingerprint !== e.fingerprint || f.identity_id !== null && f.identity_id !== u)) throw Error("invite_identity_conflict");
+		let p = 0, m = N(12);
+		if (!a.consumed_at) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
 			p = J((await this.db.batch([
-				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${o.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, l, n, r, a, e.token, t, e.inviteKind, o.reviewed_intent_json, o.reviewed_preview_digest, l, l, e.deviceId, e.publicKey, e.fingerprint, l),
-				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, a, e.token, e.deviceId, e.publicKey, e.fingerprint, l),
-				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(m, a, e.token, t),
-				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, a, e.token, e.deviceId)
+				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${a.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, u, n, r, i, e.token, t, e.inviteKind, a.reviewed_intent_json, a.reviewed_preview_digest, u, u, e.deviceId, e.publicKey, e.fingerprint, u),
+				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, i, e.token, e.deviceId, e.publicKey, e.fingerprint, u),
+				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(m, i, e.token, t),
+				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, i, e.token, e.deviceId)
 			]))[0]);
 		}
-		let h = await this.getGroup(o.group_id);
+		let h = await this.getGroup(a.group_id);
 		if (!h) throw Error("group_not_found");
 		if (h.archived_at) throw Error("group_archived");
-		let g = await Z(this.db.prepare(`SELECT ${F}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, e.deviceId));
-		if (g && (g.public_key !== e.publicKey || g.fingerprint !== e.fingerprint || g.identity_id !== null && g.identity_id !== l)) throw Error("invite_identity_conflict");
+		let g = await Z(this.db.prepare(`SELECT ${I}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(a.group_id, e.deviceId));
+		if (g && (g.public_key !== e.publicKey || g.fingerprint !== e.fingerprint || g.identity_id !== null && g.identity_id !== u)) throw Error("invite_identity_conflict");
 		let _ = await this.getInviteByTokenForInspection(e.token);
 		if (!_ || _.revoked_at || !_.consumed_at && new Date(_.expires_at) <= new Date(t)) throw Error("invite_invalid");
-		let v = await L(_);
+		let v = await R(_);
 		if (!v || v.kind !== e.inviteKind) throw Error("invite_invalid");
-		if (i(v) !== l) throw Error("invite_identity_conflict");
+		if (l(v) !== u) throw Error("invite_identity_conflict");
 		if (_.bound_device_id !== e.deviceId || _.bound_public_key !== e.publicKey || _.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (_.recipient_actor_id !== l) throw Error("invite_identity_conflict");
-		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(l, _.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		if (_.recipient_actor_id !== u) throw Error("invite_identity_conflict");
+		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(u, _.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
 		let y = await this.getEnrollment(_.group_id, e.deviceId);
 		if (!y) throw Error("invite_acceptance_incomplete");
-		if (y.public_key !== e.publicKey || y.fingerprint !== e.fingerprint || y.identity_id !== l) throw Error("invite_identity_conflict");
+		if (y.public_key !== e.publicKey || y.fingerprint !== e.fingerprint || y.identity_id !== u) throw Error("invite_identity_conflict");
 		let b = _;
 		if (v.kind === "add_device" && _.inviter_device_id && !_.bootstrap_grant_id && new Date(_.expires_at) > new Date(t)) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic bootstrap grant recovery.");
-			let n = M(12);
-			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, _.invite_id, e.deviceId, l, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, _.invite_id, e.deviceId)]);
+			let n = N(12);
+			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, _.invite_id, e.deviceId, u, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, _.invite_id, e.deviceId)]);
 			let r = await this.getInviteByTokenForInspection(e.token);
 			if (!r) throw Error("invite_invalid");
 			b = r;
@@ -483,39 +483,39 @@ var $ = class {
 	}
 	async consumeProjectInvite(e) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-		let t = u(e.now), n = await N(e.token), r = await this.getInviteByTokenForInspection(e.token);
+		let t = o(e.now), n = await P(e.token), r = await this.getInviteByTokenForInspection(e.token);
 		if (!r?.operation_id || !r.project_intent_json || r.revoked_at) throw Error("invite_invalid");
 		let i = await this.getGroup(r.group_id);
 		if (!i) throw Error("group_not_found");
 		if (i.archived_at) throw Error("group_archived");
 		if (r.operation_id !== e.operationId) throw Error("invite_invalid");
-		if (D(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		if (E(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
 		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
 		let a = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
 		if (r.consumed_at && !a) throw Error("invite_already_bound");
 		if (r.consumed_at && (r.recipient_actor_id !== e.recipientActorId || r.recipient_display_name !== e.recipientDisplayName || r.recipient_device_display_name !== e.deviceDisplayName)) throw Error("invite_identity_conflict");
-		let o = await Z(this.db.prepare(`SELECT ${F}
+		let s = await Z(this.db.prepare(`SELECT ${I}
 					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
-		if (o && (o.public_key !== e.publicKey || o.fingerprint !== e.fingerprint || o.identity_id != null && o.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
-		let s = M(12), c = J((await this.db.batch([
+		if (s && (s.public_key !== e.publicKey || s.fingerprint !== e.fingerprint || s.identity_id != null && s.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
+		let c = N(12), l = J((await this.db.batch([
 			this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n					bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n					recipient_display_name = ?, recipient_device_display_name = ?,\n					trust_state = 'pending_inviter_device'\n					WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)").bind(`consumed:${r.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, e.recipientActorId, e.recipientDisplayName, e.deviceDisplayName, n, e.token),
 			this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n					i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ? AND ? = 1\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name, enabled = 1\n				WHERE enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(t, n, e.token, e.deviceId, +!r.consumed_at),
-			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(s, n, e.token, e.deviceId, t),
+			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(c, n, e.token, e.deviceId, t),
 			this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n					grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at,\n					created_by, revoked_at\n				) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n					i.expires_at, ?, i.inviter_actor_id, NULL FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					JOIN enrolled_devices e ON e.group_id = i.group_id AND e.device_id = i.inviter_device_id\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bootstrap_grant_id IS NOT NULL\n					AND i.bound_device_id = ? AND e.enabled = 1").bind(t, n, e.token, e.deviceId)
-		]))[0]) === 1, l = await this.getGroup(r.group_id);
-		if (!l) throw Error("group_not_found");
-		if (l.archived_at) throw Error("group_archived");
+		]))[0]) === 1, u = await this.getGroup(r.group_id);
+		if (!u) throw Error("group_not_found");
+		if (u.archived_at) throw Error("group_archived");
 		let d = await this.getInviteByTokenForInspection(e.token);
 		if (!d) throw Error("invite_invalid");
 		if (d.bound_device_id !== e.deviceId || d.bound_public_key !== e.publicKey || d.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
 		if (d.recipient_actor_id !== e.recipientActorId || d.recipient_display_name !== e.recipientDisplayName || d.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
-		c || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, d.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		l || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, d.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
 		let f = await this.getEnrollment(d.group_id, e.deviceId);
 		if (!f) throw Error("invite_acceptance_incomplete");
 		if (f.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
 		let p = d.inviter_device_id ? await this.getEnrollment(d.group_id, d.inviter_device_id) : null, m = d.bootstrap_grant_id ? await this.getBootstrapGrant(d.bootstrap_grant_id) : null;
 		return {
-			status: c ? "accepted" : "existing",
+			status: l ? "accepted" : "existing",
 			invite: d,
 			enrollment: f,
 			seed_enrollment: p,
@@ -523,12 +523,12 @@ var $ = class {
 		};
 	}
 	async listInvites(e) {
-		return (await X(this.db.prepare(`SELECT ${P}
+		return (await X(this.db.prepare(`SELECT ${F}
 					 FROM coordinator_invites WHERE group_id = ?
 					 ORDER BY created_at DESC`).bind(e))).map((e) => O(e));
 	}
 	async createJoinRequest(e) {
-		let t = A(), n = M(12);
+		let t = M(), n = N(12);
 		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
 	}
 	async listJoinRequests(e, t) {
@@ -542,7 +542,7 @@ var $ = class {
 			...O(t),
 			_no_transition: !0
 		};
-		let n = Y(e.bootstrapGrant), r = A(), i = e.approved ? "approved" : "denied", a = null, o = null;
+		let n = Y(e.bootstrapGrant), r = M(), i = e.approved ? "approved" : "denied", a = null, o = null;
 		if (e.approved && n) {
 			if (!await Z(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
 			if (n.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
@@ -554,9 +554,9 @@ var $ = class {
 		}
 		if (this.db.batch) {
 			let t = [];
-			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(A(), e.requestId, r)), a)) {
-				o = M(12);
-				let n = A();
+			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(M(), e.requestId, r)), a)) {
+				o = N(12);
+				let n = M();
 				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(o, a.groupId, a.seedDeviceId, a.workerDeviceId, a.expiresAt, n, a.createdBy ?? null, e.requestId, r));
 			}
 			await this.db.batch(t);
@@ -593,35 +593,35 @@ var $ = class {
 		if (!t || !n || !r) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
 		if (n === r) throw Error("requesting and requested device ids must differ.");
 		if (i) {
-			let e = A();
-			if (await Q(this.db.prepare("UPDATE coordinator_reciprocal_approvals\n						 SET status = 'completed', resolved_at = ?\n						 WHERE request_id = ?\n						   AND group_id = ?\n						   AND requesting_device_id = ?\n						   AND requested_device_id = ?\n						   AND status = 'pending'").bind(e, a, t, r, n)) !== 1) throw new c();
+			let e = M();
+			if (await Q(this.db.prepare("UPDATE coordinator_reciprocal_approvals\n						 SET status = 'completed', resolved_at = ?\n						 WHERE request_id = ?\n						   AND group_id = ?\n						   AND requesting_device_id = ?\n						   AND requested_device_id = ?\n						   AND status = 'pending'").bind(e, a, t, r, n)) !== 1) throw new u();
 			return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a)));
 		}
-		let o = ae(n, r), s = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
+		let o = re(n, r), s = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
 		if (s) return O(s);
-		let l = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
-		if (l) {
-			let e = A();
-			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, l.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(l.request_id)));
+		let c = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
+		if (c) {
+			let e = M();
+			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, c.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(c.request_id)));
 		}
-		let u = M(12), d = A();
+		let l = N(12), d = M();
 		try {
-			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(u, t, n, r, o.low, o.high, d).run();
+			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(l, t, n, r, o.low, o.high, d).run();
 		} catch (e) {
-			if (!j(e)) throw e;
+			if (!ie(e)) throw e;
 			let i = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
 			if (i) return O(i);
 			let a = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
 			if (a) {
-				let e = A();
+				let e = M();
 				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, a.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a.request_id)));
 			}
 			throw e;
 		}
-		return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(u)));
+		return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(l)));
 	}
 	async createBootstrapGrant(e) {
-		let t = se(e), n = M(12), r = A();
+		let t = oe(e), n = N(12), r = M();
 		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, r, t.createdBy).run(), O(await Z(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
 	}
 	async getScope(e) {
@@ -633,22 +633,22 @@ var $ = class {
 		return n ? O(n) : null;
 	}
 	async createScope(e) {
-		let t = z(e);
+		let t = ce(e);
 		if (await this.getScope(t.scopeId)) throw Error("scopeId already exists.");
-		let n = A();
+		let n = M();
 		await this.db.prepare("INSERT INTO coordinator_scopes(\n					scope_id, label, kind, authority_type, coordinator_id, group_id,\n					manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(t.scopeId, t.label, t.kind, t.authorityType, t.coordinatorId, t.groupId, t.manifestIssuerDeviceId, t.membershipEpoch, t.manifestHash, t.status, n, n).run();
 		let r = await this.getScope(t.scopeId);
 		if (!r) throw Error("scope insert returned no row");
 		return r;
 	}
 	async updateScope(e) {
-		let t = I(e.scopeId), n = t ? await this.getScope(t) : null;
+		let t = L(e.scopeId), n = t ? await this.getScope(t) : null;
 		if (!n) return null;
 		let r = H(e, n);
-		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, A(), r.scopeId).run(), await this.getScope(r.scopeId);
+		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, M(), r.scopeId).run(), await this.getScope(r.scopeId);
 	}
 	async listScopes(e = {}) {
-		let t = [], n = [], r = I(e.coordinatorId), i = I(e.groupId), a = I(e.status);
+		let t = [], n = [], r = L(e.coordinatorId), i = L(e.groupId), a = L(e.status);
 		r && (t.push("coordinator_id = ?"), n.push(r)), i && (t.push("group_id = ?"), n.push(i)), a ? (t.push("status = ?"), n.push(a)) : e.includeInactive || t.push("status = 'active'");
 		let o = t.length ? `WHERE ${t.join(" AND ")}` : "", s = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
 				manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at
@@ -657,70 +657,70 @@ var $ = class {
 		return (await X(n.length ? s.bind(...n) : s)).map((e) => O(e));
 	}
 	async grantScopeMembership(e) {
-		let t = w(e.effectId), n = r(e), i = await K(this.db, t);
-		if (i) return d(i, "grant", n), o(i);
-		let a = I(e.scopeId), s = I(e.deviceId), c = a ? await this.getScope(a) : null;
-		if (!c) throw new l("scope_not_found");
-		if (c.status !== "active") throw new l("scope_inactive");
-		let u = a && s ? await this.getScopeMembership(a, s) : null, f = U(e, c, u);
-		if (f.groupId && !await this.getEnrollment(f.groupId, f.deviceId)) throw new l("device_not_enrolled");
-		let p = A();
+		let n = a(e.effectId), r = t(e), i = await K(this.db, n);
+		if (i) return D(i, "grant", r), h(i);
+		let o = L(e.scopeId), s = L(e.deviceId), c = o ? await this.getScope(o) : null;
+		if (!c) throw new f("scope_not_found");
+		if (c.status !== "active") throw new f("scope_inactive");
+		let l = o && s ? await this.getScopeMembership(o, s) : null, u = U(e, c, l);
+		if (u.groupId && !await this.getEnrollment(u.groupId, u.deviceId)) throw new f("device_not_enrolled");
+		let d = M();
 		await q(this.db, [
-			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(f.scopeId, f.deviceId, f.role, f.membershipEpoch, f.coordinatorId, f.groupId, f.manifestIssuerDeviceId, f.manifestHash, f.signedManifestJson, p, t),
+			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(u.scopeId, u.deviceId, u.role, u.membershipEpoch, u.coordinatorId, u.groupId, u.manifestIssuerDeviceId, u.manifestHash, u.signedManifestJson, d, n),
 			le(this.db, {
-				effectId: t,
-				requestJson: n,
-				scopeId: f.scopeId,
-				deviceId: f.deviceId,
-				createdAt: p
+				effectId: n,
+				requestJson: r,
+				scopeId: u.scopeId,
+				deviceId: u.deviceId,
+				createdAt: d
 			}),
 			G(this.db, {
-				effectId: t,
-				requestJson: n,
+				effectId: n,
+				requestJson: r,
 				action: "grant",
-				previous: u,
-				scopeId: f.scopeId,
-				deviceId: f.deviceId,
+				previous: l,
+				scopeId: u.scopeId,
+				deviceId: u.deviceId,
 				status: "active",
-				membershipEpoch: f.membershipEpoch,
-				updatedAt: p,
-				actorType: f.actorType,
-				actorId: f.actorId,
-				createdAt: p
+				membershipEpoch: u.membershipEpoch,
+				updatedAt: d,
+				actorType: u.actorType,
+				actorId: u.actorId,
+				createdAt: d
 			})
 		]);
-		let m = await K(this.db, t);
-		if (!m) throw Error("scope membership grant was not applied.");
-		return d(m, "grant", n), o(m);
+		let p = await K(this.db, n);
+		if (!p) throw Error("scope membership grant was not applied.");
+		return D(p, "grant", r), h(p);
 	}
 	async revokeScopeMembership(e) {
-		let t = I(e.scopeId), n = I(e.deviceId);
+		let t = L(e.scopeId), n = L(e.deviceId);
 		if (!t || !n) throw Error("scopeId and deviceId are required.");
-		let r = w(e.effectId), i = a(e), o = await K(this.db, r);
-		if (o) return d(o, "revoke", i), o.outcome_applied === 1;
-		let s = e.membershipEpoch == null ? null : R(e.membershipEpoch), c = I(e.groupId), u = c ? await this.getScope(t) : null;
-		if (c && c !== u?.group_id) throw new l("scope_group_mismatch");
-		let f = await this.getScopeMembership(t, n);
-		if (s != null && f && s <= f.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let p = A(), m = s ?? (f?.membership_epoch ?? -1) + 1, h = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(s, s, I(e.manifestHash), I(e.signedManifestJson), p, t, n, f?.membership_epoch ?? -1, f?.status ?? "", r), g = ue(this.db, {
+		let r = a(e.effectId), i = m(e), o = await K(this.db, r);
+		if (o) return D(o, "revoke", i), o.outcome_applied === 1;
+		let s = e.membershipEpoch == null ? null : z(e.membershipEpoch), c = L(e.groupId), l = c ? await this.getScope(t) : null;
+		if (c && c !== l?.group_id) throw new f("scope_group_mismatch");
+		let u = await this.getScopeMembership(t, n);
+		if (s != null && u && s <= u.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let d = M(), p = s ?? (u?.membership_epoch ?? -1) + 1, h = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(s, s, L(e.manifestHash), L(e.signedManifestJson), d, t, n, u?.membership_epoch ?? -1, u?.status ?? "", r), g = ue(this.db, {
 			effectId: r,
 			requestJson: i,
 			scopeId: t,
 			deviceId: n,
-			createdAt: p
+			createdAt: d
 		}), _ = G(this.db, {
 			effectId: r,
 			requestJson: i,
 			action: "revoke",
-			previous: f,
+			previous: u,
 			scopeId: t,
 			deviceId: n,
 			status: "revoked",
-			membershipEpoch: m,
-			updatedAt: p,
-			actorType: I(e.actorType),
-			actorId: I(e.actorId),
-			createdAt: p
+			membershipEpoch: p,
+			updatedAt: d,
+			actorType: L(e.actorType),
+			actorId: L(e.actorId),
+			createdAt: d
 		});
 		try {
 			await q(this.db, [
@@ -730,15 +730,15 @@ var $ = class {
 			]);
 		} catch (e) {
 			let r = await this.getScopeMembership(t, n);
-			if (f && (!r || r.membership_epoch !== f.membership_epoch || r.status !== f.status)) return !1;
+			if (u && (!r || r.membership_epoch !== u.membership_epoch || r.status !== u.status)) return !1;
 			throw e;
 		}
 		let v = await K(this.db, r);
 		if (!v) throw Error("scope membership revoke receipt was not persisted.");
-		return d(v, "revoke", i), v.outcome_applied === 1;
+		return D(v, "revoke", i), v.outcome_applied === 1;
 	}
 	async listScopeMemberships(e, t = !1) {
-		let n = I(e);
+		let n = L(e);
 		if (!n) throw Error("scopeId is required.");
 		let r = t ? "" : "AND status = 'active'";
 		return (await X(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
@@ -748,7 +748,7 @@ var $ = class {
 						 ORDER BY device_id ASC`).bind(n))).map((e) => O(e));
 	}
 	async listDeviceScopeMemberships(e, t = !1) {
-		let n = I(e);
+		let n = L(e);
 		if (!n) throw Error("deviceId is required.");
 		let r = t ? "" : "AND status = 'active'";
 		return (await X(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
@@ -758,9 +758,9 @@ var $ = class {
 						 ORDER BY scope_id ASC`).bind(n))).map((e) => O(e));
 	}
 	async listScopeMembershipAuditEvents(e) {
-		let t = I(e.scopeId);
+		let t = L(e.scopeId);
 		if (!t) throw Error("scopeId is required.");
-		let n = I(e.deviceId), r = W(e.limit), i = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", a = n ? [
+		let n = L(e.deviceId), r = W(e.limit), i = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", a = n ? [
 			t,
 			n,
 			r
@@ -780,7 +780,7 @@ var $ = class {
 	async listBootstrapGrants(e) {
 		return (await X(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => O(e));
 	}
-	async revokeBootstrapGrant(e, t = A()) {
+	async revokeBootstrapGrant(e, t = M()) {
 		return await Q(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
 	}
 	async listReciprocalApprovals(e) {
@@ -791,43 +791,43 @@ var $ = class {
 						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => O(e));
 	}
 	async createLegacyTeamCompletion(e, t) {
-		let [n] = h([e]);
+		let [n] = b([e]);
 		if (!n) throw Error("completion_manifest_invalid");
 		let r = await this.getGroup(n);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
-		let i = T(t), a = JSON.parse(i);
+		let i = d(t), a = JSON.parse(i);
 		x(a);
 		let o = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
 		if (o) {
-			if (o.manifest_json !== i) throw new S();
+			if (o.manifest_json !== i) throw new y();
 			return {
 				status: "existing",
-				manifest: C(JSON.parse(o.manifest_json))
+				manifest: w(JSON.parse(o.manifest_json))
 			};
 		}
-		let s = await X(this.db.prepare("SELECT DISTINCT\n					requested.scope_id,\n					scope.authority_type,\n					scope.coordinator_id,\n					scope.group_id,\n					scope.status\n				 FROM (\n					SELECT json_extract(value, '$.scope_id') AS scope_id\n					FROM json_each(?, '$.project_mappings')\n				 ) AS requested\n				 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i)), c = g(a, n, s), l = await Q(this.db.prepare("INSERT OR IGNORE INTO coordinator_legacy_team_completions(\n					group_id, candidate_ref, manifest_version, manifest_json, completed_at, created_at\n					) SELECT ?, ?, ?, ?, ?, ?\n					  FROM groups\n					  WHERE group_id = ? AND archived_at IS NULL\n					    AND NOT EXISTS (\n					      SELECT 1\n					      FROM json_each(?, '$.project_mappings') AS requested\n					      LEFT JOIN coordinator_scopes AS scope\n					        ON scope.scope_id = json_extract(requested.value, '$.scope_id')\n					       AND scope.authority_type = 'coordinator'\n					       AND scope.coordinator_id = ?\n					       AND scope.group_id = ?\n					       AND scope.status = 'active'\n					      WHERE scope.scope_id IS NULL\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM enrolled_devices AS enrolled\n					      WHERE enrolled.group_id = ?\n					        AND NOT EXISTS (\n					          SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					          WHERE json_extract(requested.value, '$.device_id') = enrolled.device_id\n					            AND json_extract(requested.value, '$.key_fingerprint') = enrolled.fingerprint\n					            AND json_extract(requested.value, '$.enabled') = enrolled.enabled\n					        )\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					      WHERE json_extract(requested.value, '$.decision') = 'included'\n					        AND NOT EXISTS (\n					          SELECT 1 FROM enrolled_devices AS enrolled\n					          WHERE enrolled.group_id = ?\n					            AND enrolled.device_id = json_extract(requested.value, '$.device_id')\n					            AND enrolled.fingerprint = json_extract(requested.value, '$.key_fingerprint')\n					            AND enrolled.enabled = 1\n					        )\n					    )").bind(n, a.candidate_ref, a.version, i, a.completed_at, A(), n, i, c, n, n, i, i, n)), u = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
+		let s = await X(this.db.prepare("SELECT DISTINCT\n					requested.scope_id,\n					scope.authority_type,\n					scope.coordinator_id,\n					scope.group_id,\n					scope.status\n				 FROM (\n					SELECT json_extract(value, '$.scope_id') AS scope_id\n					FROM json_each(?, '$.project_mappings')\n				 ) AS requested\n				 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i)), c = C(a, n, s), l = await Q(this.db.prepare("INSERT OR IGNORE INTO coordinator_legacy_team_completions(\n					group_id, candidate_ref, manifest_version, manifest_json, completed_at, created_at\n					) SELECT ?, ?, ?, ?, ?, ?\n					  FROM groups\n					  WHERE group_id = ? AND archived_at IS NULL\n					    AND NOT EXISTS (\n					      SELECT 1\n					      FROM json_each(?, '$.project_mappings') AS requested\n					      LEFT JOIN coordinator_scopes AS scope\n					        ON scope.scope_id = json_extract(requested.value, '$.scope_id')\n					       AND scope.authority_type = 'coordinator'\n					       AND scope.coordinator_id = ?\n					       AND scope.group_id = ?\n					       AND scope.status = 'active'\n					      WHERE scope.scope_id IS NULL\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM enrolled_devices AS enrolled\n					      WHERE enrolled.group_id = ?\n					        AND NOT EXISTS (\n					          SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					          WHERE json_extract(requested.value, '$.device_id') = enrolled.device_id\n					            AND json_extract(requested.value, '$.key_fingerprint') = enrolled.fingerprint\n					            AND json_extract(requested.value, '$.enabled') = enrolled.enabled\n					        )\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					      WHERE json_extract(requested.value, '$.decision') = 'included'\n					        AND NOT EXISTS (\n					          SELECT 1 FROM enrolled_devices AS enrolled\n					          WHERE enrolled.group_id = ?\n					            AND enrolled.device_id = json_extract(requested.value, '$.device_id')\n					            AND enrolled.fingerprint = json_extract(requested.value, '$.key_fingerprint')\n					            AND enrolled.enabled = 1\n					        )\n					    )").bind(n, a.candidate_ref, a.version, i, a.completed_at, M(), n, i, c, n, n, i, i, n)), u = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
 		if (!u) {
 			let e = await this.getGroup(n);
 			if (!e) throw Error("group_not_found");
 			if (e.archived_at) throw Error("group_archived");
 			let t = await X(this.db.prepare("SELECT DISTINCT\n						requested.scope_id,\n						scope.authority_type,\n						scope.coordinator_id,\n						scope.group_id,\n						scope.status\n					 FROM (\n						SELECT json_extract(value, '$.scope_id') AS scope_id\n						FROM json_each(?, '$.project_mappings')\n					 ) AS requested\n					 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i));
-			throw g(a, n, t), Error("completion_manifest_unavailable");
+			throw C(a, n, t), Error("completion_manifest_unavailable");
 		}
-		if (u.manifest_json !== i) throw new S();
+		if (u.manifest_json !== i) throw new y();
 		return {
 			status: l === 1 ? "created" : "existing",
-			manifest: C(JSON.parse(u.manifest_json))
+			manifest: w(JSON.parse(u.manifest_json))
 		};
 	}
-	async getLegacyTeamCompletion(e, t) {
-		let [n] = h([e]), r = v(t);
-		if (!n) throw Error("completion_manifest_invalid");
-		let i = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, r));
-		return i ? C(JSON.parse(i.manifest_json)) : null;
+	async getLegacyTeamCompletion(t, n) {
+		let [r] = b([t]), i = e(n);
+		if (!r) throw Error("completion_manifest_invalid");
+		let a = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(r, i));
+		return a ? w(JSON.parse(a.manifest_json)) : null;
 	}
 	async listLegacyTeamCompletions(e) {
-		let t = h(e);
+		let t = b(e);
 		if (t.length === 0) return [];
 		let n = t.map(() => "?").join(", "), r = await Z(this.db.prepare(`SELECT
 					COUNT(*) AS record_count,
@@ -838,7 +838,7 @@ var $ = class {
 				FROM coordinator_legacy_team_completions
 				WHERE group_id IN (${n})`).bind(...t));
 		if (!r || r.record_count > 500 || r.batch_bytes > 375e5 || r.max_manifest_bytes > 15e5) throw Error("completion_results_too_large");
-		let i = await X(this.db.prepare(`WITH completion_stats AS (
+		let a = await X(this.db.prepare(`WITH completion_stats AS (
 					SELECT
 						COUNT(*) AS record_count,
 						COALESCE(SUM(
@@ -853,20 +853,20 @@ var $ = class {
 				CROSS JOIN completion_stats
 				WHERE completions.group_id IN (${n})
 					  AND completion_stats.record_count <= 500
-					  AND completion_stats.batch_bytes <= ${f}
-					  AND completion_stats.max_manifest_bytes <= ${s}
-					  AND LENGTH(completions.manifest_json) <= ${s}
-					  AND LENGTH(CAST(completions.manifest_json AS BLOB)) <= ${s}
+					  AND completion_stats.batch_bytes <= ${i}
+					  AND completion_stats.max_manifest_bytes <= ${S}
+					  AND LENGTH(completions.manifest_json) <= ${S}
+					  AND LENGTH(CAST(completions.manifest_json AS BLOB)) <= ${S}
 					ORDER BY completions.group_id, completions.completed_at, completions.candidate_ref
 					LIMIT 501`).bind(...t, ...t));
-		if (i.length === 0 && r.record_count > 0 || i.length > 500 || i.reduce((e, t) => e + new TextEncoder().encode(t.group_id).byteLength + new TextEncoder().encode(t.manifest_json).byteLength, 0) > 375e5) throw Error("completion_results_too_large");
-		return i.map((e) => ({
+		if (a.length === 0 && r.record_count > 0 || a.length > 500 || a.reduce((e, t) => e + new TextEncoder().encode(t.group_id).byteLength + new TextEncoder().encode(t.manifest_json).byteLength, 0) > 375e5) throw Error("completion_results_too_large");
+		return a.map((e) => ({
 			group_id: e.group_id,
-			manifest: C(JSON.parse(e.manifest_json))
+			manifest: w(JSON.parse(e.manifest_json))
 		}));
 	}
 	async upsertPresence(e) {
-		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = k([], e.addresses);
+		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = j([], e.addresses);
 		return await this.db.prepare("INSERT INTO presence_records(group_id, device_id, addresses_json, last_seen_at, expires_at, capabilities_json)\n				 VALUES (?, ?, ?, ?, ?, ?)\n				 ON CONFLICT(group_id, device_id) DO UPDATE SET\n					addresses_json = excluded.addresses_json,\n					last_seen_at = excluded.last_seen_at,\n					expires_at = excluded.expires_at,\n					capabilities_json = excluded.capabilities_json").bind(e.groupId, e.deviceId, JSON.stringify(r), t.toISOString(), n, JSON.stringify(e.capabilities ?? {})).run(), {
 			group_id: e.groupId,
 			device_id: e.deviceId,
@@ -875,14 +875,14 @@ var $ = class {
 		};
 	}
 	async listGroupPeers(e, t) {
-		let n = A();
+		let n = M();
 		return (await X(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
 			let t = String(e.expires_at ?? "").trim(), r = !0;
 			if (t) {
 				let e = new Date(t);
 				r = Number.isNaN(e.getTime()) || e.toISOString() <= n;
 			}
-			let i = r ? [] : k([], JSON.parse(String(e.addresses_json ?? "[]")));
+			let i = r ? [] : j([], JSON.parse(String(e.addresses_json ?? "[]")));
 			return {
 				device_id: String(e.device_id ?? ""),
 				public_key: String(e.public_key ?? ""),
@@ -904,13 +904,13 @@ function de(e) {
 		adminSecret: () => String(e.adminSecret ?? "").trim() || null,
 		now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
 	};
-	return E({
+	return te({
 		storeFactory: () => new $(e.db),
 		runtime: t,
 		requestVerifier: e.requestVerifier
 	});
 }
 //#endregion
-export { p as COORDINATOR_LEGACY_TEAM_COMPLETION_CONFLICT, f as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_BYTES, m as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_RESPONSE_BYTES, s as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BYTES, e as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_GROUPS, _ as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_RECORDS, te as COORDINATOR_LEGACY_TEAM_COMPLETION_VERSION, S as CoordinatorLegacyTeamCompletionConflictError, $ as D1CoordinatorStore, ee as DEFAULT_TIME_WINDOW_S, T as canonicalCoordinatorLegacyTeamCompletionManifestJson, de as createD1CoordinatorApp, v as normalizeCoordinatorLegacyTeamCompletionCandidateRef, h as normalizeCoordinatorLegacyTeamCompletionGroupIds, C as normalizeCoordinatorLegacyTeamCompletionManifest };
+export { g as COORDINATOR_LEGACY_TEAM_COMPLETION_CONFLICT, i as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_BYTES, c as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_RESPONSE_BYTES, S as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BYTES, s as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_GROUPS, v as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_RECORDS, _ as COORDINATOR_LEGACY_TEAM_COMPLETION_VERSION, y as CoordinatorLegacyTeamCompletionConflictError, $ as D1CoordinatorStore, ee as DEFAULT_TIME_WINDOW_S, d as canonicalCoordinatorLegacyTeamCompletionManifestJson, de as createD1CoordinatorApp, e as normalizeCoordinatorLegacyTeamCompletionCandidateRef, b as normalizeCoordinatorLegacyTeamCompletionGroupIds, w as normalizeCoordinatorLegacyTeamCompletionManifest };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map