@codemem/core 0.45.0-rc.2 → 0.46.0-alpha.1

package/dist/internal/cloudflare-coordinator.js

@@ -1,11 +1,11 @@
-import { $ as e, B as t, E as n, F as r, G as i, H as a, I as o, J as s, K as c, L as l, N as u, Q as d, R as f, S as p, U as m, V as h, W as g, X as _, Y as v, Z as y, et as b, it as x, n as ee, q as S, rt as C, t as te, tt as w, w as T, y as E, z as D } from "../coordinator-api-C2ckGC2b.js";
+import { $ as e, A as t, C as n, D as r, E as i, J as a, O as o, Q as s, S as c, T as l, W as u, X as d, Y as f, Z as p, at as m, b as h, ct as g, dt as _, et as v, ft as y, ht as b, it as x, k as S, lt as C, mt as w, n as T, nt as E, ot as ee, q as D, rt as te, st as O, t as k, tt as A, ut as j, w as M, x as N, y as P } from "../coordinator-api-BToPmSNg.js";
 //#region src/d1-coordinator-store.ts
-function O(e) {
+function F(e) {
 	if (e == null) throw Error("expected row");
 	return e;
 }
-function k(e) {
-	let { presence_capabilities_json: t, presence_expires_at: n, ...r } = O(e);
+function I(e) {
+	let { presence_capabilities_json: t, presence_expires_at: n, ...r } = F(e);
 	if (typeof n != "string" || typeof t != "string") return r;
 	try {
 		let e = JSON.parse(t);
@@ -23,37 +23,10 @@ function k(e) {
 		return r;
 	}
 }
-function A(e) {
-	let t = e.trim();
-	if (!t) return "";
-	let n = t.includes("://") ? t : `http://${t}`;
-	try {
-		let e = new URL(n);
-		return !e.hostname || e.port && (Number(e.port) <= 0 || Number(e.port) > 65535) ? "" : e.origin + e.pathname.replace(/\/+$/, "");
-	} catch {
-		return "";
-	}
-}
-function ne(e) {
-	if (!e) return "";
-	try {
-		let t = new URL(e), n = t.hostname.toLowerCase();
-		if ((t.protocol === "http:" || t.protocol === "") && n && t.port && t.pathname === "/") return `${n}:${t.port}`;
-	} catch {}
-	return e;
-}
-function j(e, t) {
-	let n = [], r = /* @__PURE__ */ new Set();
-	for (let i of [...e, ...t]) {
-		let e = A(i), t = ne(e);
-		!e || r.has(t) || (r.add(t), n.push(e));
-	}
-	return n;
-}
-function M() {
+function L() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
-function re(e, t) {
+function R(e, t) {
 	return e <= t ? {
 		low: e,
 		high: t
@@ -62,230 +35,39 @@ function re(e, t) {
 		high: e
 	};
 }
-function ie(e) {
+function z(e) {
 	return e instanceof Error && /unique|constraint/i.test(e.message);
 }
-function N(e) {
+function B(e) {
 	let t = new Uint8Array(e);
 	globalThis.crypto.getRandomValues(t);
 	let n = [];
 	for (let e of t) n.push("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"[e % 64] ?? "A");
 	return n.join("");
 }
-async function P(e) {
+async function V(e) {
 	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
 	return Array.from(new Uint8Array(t), (e) => e.toString(16).padStart(2, "0")).join("");
 }
-var F = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", I = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at", ae = "enrolled_devices.group_id, enrolled_devices.device_id,\n	enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.identity_id,\n	enrolled_devices.display_name, enrolled_devices.enabled, enrolled_devices.created_at,\n	presence_records.expires_at AS presence_expires_at,\n	presence_records.capabilities_json AS presence_capabilities_json";
-function oe(e) {
-	let t = String(e.groupId ?? "").trim(), n = String(e.seedDeviceId ?? "").trim(), r = String(e.workerDeviceId ?? "").trim(), i = String(e.expiresAt ?? "").trim(), a = String(e.createdBy ?? "").trim() || null;
-	if (!t || !n || !r || !i) throw Error("groupId, seedDeviceId, workerDeviceId, and expiresAt are required.");
-	return {
-		groupId: t,
-		seedDeviceId: n,
-		workerDeviceId: r,
-		expiresAt: i,
-		createdBy: a
-	};
-}
-function L(e) {
-	return e?.trim() || null;
-}
-async function se(e) {
-	let t = e.inviteKind ?? (L(e.operationId) ? "project_share" : "legacy_enrollment"), r = L(e.policyTeamId), i = L(e.targetIdentityId), a = L(e.reviewedPreviewDigest);
-	if (![
-		"legacy_enrollment",
-		"project_share",
-		"team_member",
-		"add_device"
-	].includes(t)) throw Error("inviteKind is invalid.");
-	if ([r, i].filter((e) => !!e).some((e) => e.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e))) throw Error("recipient invite identifier is invalid.");
-	if (a && !/^[a-f0-9]{64}$/u.test(a)) throw Error("reviewedPreviewDigest must be a SHA-256 digest.");
-	if (t === "project_share") {
-		if (!L(e.operationId)) throw Error("project_share invite requires operationId.");
-		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
-	} else if (t === "legacy_enrollment") {
-		if (L(e.operationId)) throw Error("legacy_enrollment invite cannot reference an operation.");
-		if (r || i || a) throw Error("recipient invite metadata requires a recipient invite kind.");
-	} else if (t === "team_member") {
-		if (!r || !a || i || L(e.operationId)) throw Error("team_member invite metadata is invalid.");
-	} else if (t === "add_device" && (!i || !a || r || L(e.operationId))) throw Error("add_device invite metadata is invalid.");
-	if (e.reviewedIntent === void 0 || e.reviewedIntent === null) {
-		if (t === "team_member" || t === "add_device") throw Error("recipient_invite_review_unavailable");
-		return {
-			inviteKind: t,
-			policyTeamId: r,
-			targetIdentityId: i,
-			reviewedPreviewDigest: a,
-			reviewedIntentJson: null
-		};
-	}
-	let o;
-	if (t === "team_member" && r && a) o = {
-		kind: "team_member",
-		policyTeamId: r
-	};
-	else if (t === "add_device" && i && a) o = {
-		kind: "add_device",
-		targetIdentityId: i
-	};
-	else throw Error("recipient invite metadata requires a recipient invite kind.");
-	return await n(e.reviewedIntent, {
-		target: o,
-		digest: a
-	}), {
-		inviteKind: t,
-		policyTeamId: r,
-		targetIdentityId: i,
-		reviewedPreviewDigest: a,
-		reviewedIntentJson: p(e.reviewedIntent, o)
-	};
-}
-async function R(e) {
-	if (e.invite_kind === "team_member") {
-		if (!e.policy_team_id || !r(e.assigned_identity_id) || !e.reviewed_preview_digest) throw Error("invite_invalid");
-		let t = await T(e.reviewed_intent_json, {
-			target: {
-				kind: "team_member",
-				policyTeamId: e.policy_team_id
-			},
-			digest: e.reviewed_preview_digest
-		});
-		return {
-			kind: "team_member",
-			invite: e,
-			policy_team_id: e.policy_team_id,
-			assigned_identity_id: e.assigned_identity_id,
-			reviewed_preview_digest: e.reviewed_preview_digest,
-			reviewed_intent: t,
-			bound: !!e.consumed_at
-		};
-	}
-	if (e.invite_kind === "add_device") {
-		if (!e.target_identity_id || !e.reviewed_preview_digest) throw Error("invite_invalid");
-		let t = await T(e.reviewed_intent_json, {
-			target: {
-				kind: "add_device",
-				targetIdentityId: e.target_identity_id
-			},
-			digest: e.reviewed_preview_digest
-		});
-		return {
-			kind: "add_device",
-			invite: e,
-			target_identity_id: e.target_identity_id,
-			reviewed_preview_digest: e.reviewed_preview_digest,
-			reviewed_intent: t,
-			bound: !!e.consumed_at
-		};
-	}
-	return null;
-}
-function z(e, t = 0) {
-	if (e == null) return t;
-	if (!Number.isFinite(e) || e < 0) throw Error("membershipEpoch must be non-negative.");
-	return Math.trunc(e);
-}
-function ce(e) {
-	let t = L(e.scopeId), n = L(e.label);
-	if (!t || !n) throw Error("scopeId and label are required.");
-	return {
-		scopeId: t,
-		label: n,
-		kind: L(e.kind) ?? "user",
-		authorityType: L(e.authorityType) ?? "coordinator",
-		coordinatorId: L(e.coordinatorId),
-		groupId: L(e.groupId),
-		manifestIssuerDeviceId: L(e.manifestIssuerDeviceId),
-		membershipEpoch: z(e.membershipEpoch),
-		manifestHash: L(e.manifestHash),
-		status: L(e.status) ?? "active"
-	};
-}
-function B(e, t, n) {
-	if (e === void 0) return t;
-	let r = L(e);
-	if (!r) throw Error(`${n} must not be empty.`);
-	return r;
-}
-function V(e, t) {
-	return e === void 0 ? t : L(e);
-}
-function H(e, t) {
-	let n = L(e.scopeId);
-	if (!n) throw Error("scopeId is required.");
-	let r = e.membershipEpoch == null ? null : z(e.membershipEpoch);
-	if (r != null && r < t.membership_epoch) throw Error("membershipEpoch must not move backwards.");
-	return {
-		scopeId: n,
-		label: B(e.label, t.label, "label"),
-		kind: B(e.kind, t.kind, "kind"),
-		authorityType: B(e.authorityType, t.authority_type, "authorityType"),
-		coordinatorId: V(e.coordinatorId, t.coordinator_id),
-		groupId: V(e.groupId, t.group_id),
-		manifestIssuerDeviceId: V(e.manifestIssuerDeviceId, t.manifest_issuer_device_id),
-		membershipEpoch: r ?? t.membership_epoch,
-		manifestHash: V(e.manifestHash, t.manifest_hash),
-		status: B(e.status, t.status, "status")
-	};
-}
-function U(e, t, n) {
-	let r = L(e.scopeId), i = L(e.deviceId);
-	if (!r || !i) throw Error("scopeId and deviceId are required.");
-	let a = L(e.coordinatorId), o = L(e.groupId);
-	if (a && a !== t?.coordinator_id) throw Error("membership coordinatorId must match the scope coordinatorId.");
-	if (o && o !== t?.group_id) throw new f("scope_group_mismatch");
-	let s = e.membershipEpoch == null ? null : z(e.membershipEpoch), c = t?.membership_epoch ?? 0;
-	if (s != null && s < c) throw Error("membershipEpoch must not be lower than the scope membershipEpoch.");
-	if (s != null && n && s < (n.status === "revoked" ? n.membership_epoch + 1 : n.membership_epoch)) throw Error("membershipEpoch must not move backwards.");
-	let l = s ?? (n ? Math.max(c, n.membership_epoch + +(n.status === "revoked")) : c);
-	return {
-		scopeId: r,
-		deviceId: i,
-		role: L(e.role) ?? "member",
-		membershipEpoch: l,
-		coordinatorId: t?.coordinator_id ?? null,
-		groupId: t?.group_id ?? null,
-		manifestIssuerDeviceId: L(e.manifestIssuerDeviceId) ?? t?.manifest_issuer_device_id ?? null,
-		manifestHash: L(e.manifestHash) ?? t?.manifest_hash ?? null,
-		signedManifestJson: L(e.signedManifestJson),
-		actorType: L(e.actorType),
-		actorId: L(e.actorId)
-	};
-}
-function W(e) {
-	return e == null || !Number.isFinite(e) ? 100 : Math.max(1, Math.min(1e3, Math.trunc(e)));
-}
+var H = "invite_id, group_id, token, policy, expires_at, created_at, created_by,\n	team_name_snapshot, revoked_at, operation_id, reviewed_project_set_digest, token_digest,\n	inviter_actor_id, inviter_display_name, inviter_device_id, pending_person_id,\n	project_summaries_json, project_intent_json, consumed_at, bound_device_id, bound_public_key, bound_fingerprint,\n	recipient_actor_id, recipient_display_name, recipient_device_display_name, trust_state,\n	bootstrap_grant_id, invite_kind, policy_team_id, target_identity_id, assigned_identity_id,\n	reviewed_preview_digest, reviewed_intent_json", U = "group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at", W = "enrolled_devices.group_id, enrolled_devices.device_id,\n	enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.identity_id,\n	enrolled_devices.display_name, enrolled_devices.enabled, enrolled_devices.created_at,\n	presence_records.expires_at AS presence_expires_at,\n	presence_records.capabilities_json AS presence_capabilities_json";
 function G(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_audit_log(\n			effect_id, action, scope_id, device_id, role, status, membership_epoch,\n			previous_role, previous_status, previous_membership_epoch,\n			coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at\n		)\n		SELECT receipt.effect_id, ?, membership.scope_id, membership.device_id, membership.role, membership.status,\n			membership.membership_epoch, ?, ?, ?, membership.coordinator_id, membership.group_id,\n			?, ?, membership.manifest_hash, ?\n		FROM (SELECT 1 WHERE changes() > 0) AS required\n		JOIN coordinator_scope_membership_effect_receipts AS receipt\n			ON receipt.effect_id = ? AND receipt.action = ? AND receipt.request_json = ?\n			AND receipt.outcome_applied = 1\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON membership.scope_id = ?\n			AND membership.device_id = ?\n			AND membership.status = ?\n			AND membership.membership_epoch = ?\n			AND membership.updated_at = ?").bind(t.action, t.previous?.role ?? null, t.previous?.status ?? null, t.previous?.membership_epoch ?? null, t.actorType, t.actorId, t.createdAt, t.effectId, t.action, t.requestJson, t.scopeId, t.deviceId, t.status, t.membershipEpoch, t.updatedAt);
 }
 async function K(e, t) {
 	return await Z(e.prepare("SELECT effect_id, action, request_json, outcome_applied, scope_id, device_id,\n				role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n				manifest_hash, signed_manifest_json, updated_at, created_at\n			 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?").bind(t));
 }
-function le(e, t) {
+function q(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_effect_receipts(\n			effect_id, action, request_json, outcome_applied, scope_id, device_id,\n			role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n			manifest_hash, signed_manifest_json, updated_at, created_at\n		)\n		SELECT ?, 'grant', ?, 1, membership.scope_id, membership.device_id,\n			membership.role, membership.status, membership.membership_epoch,\n			membership.coordinator_id, membership.group_id, membership.manifest_issuer_device_id,\n			membership.manifest_hash, membership.signed_manifest_json, membership.updated_at, ?\n		FROM coordinator_scope_memberships AS membership\n		WHERE changes() > 0 AND membership.scope_id = ? AND membership.device_id = ?").bind(t.effectId, t.requestJson, t.createdAt, t.scopeId, t.deviceId);
 }
-function ue(e, t) {
+function ne(e, t) {
 	return e.prepare("INSERT INTO coordinator_scope_membership_effect_receipts(\n			effect_id, action, request_json, outcome_applied, scope_id, device_id,\n			role, status, membership_epoch, coordinator_id, group_id, manifest_issuer_device_id,\n			manifest_hash, signed_manifest_json, updated_at, created_at\n		)\n		SELECT ?, 'revoke', ?, changed.applied, ?, ?, membership.role, membership.status,\n			membership.membership_epoch, membership.coordinator_id, membership.group_id,\n			membership.manifest_issuer_device_id, membership.manifest_hash,\n			membership.signed_manifest_json, membership.updated_at, ?\n		FROM (SELECT CASE WHEN changes() > 0 THEN 1 ELSE 0 END AS applied) AS changed\n		LEFT JOIN coordinator_scope_memberships AS membership\n			ON changed.applied = 1 AND membership.scope_id = ? AND membership.device_id = ?\n		WHERE NOT EXISTS (\n			SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n		)").bind(t.effectId, t.requestJson, t.scopeId, t.deviceId, t.createdAt, t.scopeId, t.deviceId, t.effectId);
 }
-async function q(e, t) {
+async function J(e, t) {
 	if (!e.batch) throw Error("D1 batch support is required for audited scope membership changes.");
 	return await e.batch(t);
 }
-function J(e) {
-	return Number(e?.meta?.changes ?? 0);
-}
 function Y(e) {
-	if (!e) return null;
-	let t = String(e.seedDeviceId ?? "").trim(), n = String(e.expiresAt ?? "").trim(), r = String(e.createdBy ?? "").trim() || null;
-	if (!t || !n) throw Error("bootstrapGrant.seedDeviceId and expiresAt are required.");
-	return {
-		groupId: "",
-		seedDeviceId: t,
-		workerDeviceId: "",
-		expiresAt: n,
-		createdBy: r
-	};
+	return Number(e?.meta?.changes ?? 0);
 }
 async function X(e) {
 	let t = await e.all();
@@ -305,43 +87,43 @@ var $ = class {
 	}
 	async close() {}
 	async createGroup(e, t) {
-		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, M()).run();
+		await this.db.prepare("INSERT OR IGNORE INTO groups(group_id, display_name, archived_at, created_at) VALUES (?, ?, NULL, ?)").bind(e, t ?? null, L()).run();
 	}
 	async getGroup(e) {
 		let t = await Z(this.db.prepare("SELECT group_id, display_name, archived_at, created_at FROM groups WHERE group_id = ?").bind(e));
-		return t ? O(t) : null;
+		return t ? F(t) : null;
 	}
 	async listGroups(e = !1) {
 		let t = e ? "" : "WHERE archived_at IS NULL";
-		return (await X(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => O(e));
+		return (await X(this.db.prepare(`SELECT group_id, display_name, archived_at, created_at FROM groups ${t} ORDER BY created_at ASC`))).map((e) => F(e));
 	}
 	async renameGroup(e, t) {
 		return await Q(this.db.prepare("UPDATE groups SET display_name = ? WHERE group_id = ?").bind(t, e)) > 0;
 	}
-	async archiveGroup(e, t = M()) {
+	async archiveGroup(e, t = L()) {
 		return await Q(this.db.prepare("UPDATE groups SET archived_at = ? WHERE group_id = ? AND archived_at IS NULL").bind(t, e)) > 0;
 	}
 	async unarchiveGroup(e) {
 		return await Q(this.db.prepare("UPDATE groups SET archived_at = NULL WHERE group_id = ? AND archived_at IS NOT NULL").bind(e)) > 0;
 	}
 	async enrollDevice(e, t) {
-		if (await Q(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, M())) === 0) throw Error("invite_identity_conflict");
+		if (await Q(this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) VALUES (?, ?, ?, ?, ?, ?, 1, ?)\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					public_key = excluded.public_key,\n					fingerprint = excluded.fingerprint,\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name,\n					enabled = 1\n				WHERE excluded.identity_id IS NULL\n					OR enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(e, t.deviceId, t.publicKey, t.fingerprint, t.identityId ?? null, t.displayName ?? null, L())) === 0) throw Error("invite_identity_conflict");
 	}
 	async listEnrolledDevices(e, t) {
 		let n = t ? "" : "AND enrolled_devices.enabled = 1";
-		return (await X(this.db.prepare(`SELECT ${ae}
+		return (await X(this.db.prepare(`SELECT ${W}
 						 FROM enrolled_devices
 						 LEFT JOIN presence_records
 						   ON presence_records.group_id = enrolled_devices.group_id
 						  AND presence_records.device_id = enrolled_devices.device_id
 						 WHERE enrolled_devices.group_id = ? ${n}
-						 ORDER BY enrolled_devices.created_at ASC, enrolled_devices.device_id ASC`).bind(e))).map(k);
+						 ORDER BY enrolled_devices.created_at ASC, enrolled_devices.device_id ASC`).bind(e))).map(I);
 	}
 	async getEnrollment(e, t, n = !1) {
-		let r = n ? "" : "AND enabled = 1", i = await Z(this.db.prepare(`SELECT ${I}
+		let r = n ? "" : "AND enabled = 1", i = await Z(this.db.prepare(`SELECT ${U}
 					 FROM enrolled_devices
 					 WHERE group_id = ? AND device_id = ? ${r}`).bind(e, t));
-		return i ? O(i) : null;
+		return i ? F(i) : null;
 	}
 	async renameDevice(e, t, n) {
 		return await Q(this.db.prepare("UPDATE enrolled_devices SET display_name = ?\n					 WHERE group_id = ? AND device_id = ?").bind(n, e, t)) > 0;
@@ -351,7 +133,7 @@ var $ = class {
 	}
 	async removeDevice(e, t) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic device removal.");
-		return J((await this.db.batch([
+		return Y((await this.db.batch([
 			this.db.prepare("DELETE FROM presence_records WHERE group_id = ? AND device_id = ?").bind(e, t),
 			this.db.prepare("DELETE FROM coordinator_reciprocal_approvals WHERE group_id = ? AND (requesting_device_id = ? OR requested_device_id = ?)").bind(e, t, t),
 			this.db.prepare("DELETE FROM enrolled_devices WHERE group_id = ? AND device_id = ?").bind(e, t)
@@ -364,15 +146,15 @@ var $ = class {
 		await this.db.prepare("DELETE FROM request_nonces WHERE created_at < ?").bind(e).run();
 	}
 	async createInvite(e) {
-		let t = M(), n = N(12), r = N(24), i = await P(r), a = o(e.expiresAt), s = await this.getGroup(e.groupId), c = String(e.operationId ?? "").trim() || null, l = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await se(e), d = u.inviteKind === "team_member" ? `identity:${N(18)}` : null;
+		let t = L(), n = B(12), r = B(24), i = await V(r), a = D(e.expiresAt), s = await this.getGroup(e.groupId), c = String(e.operationId ?? "").trim() || null, l = String(e.reviewedProjectSetDigest ?? "").trim() || null, u = await o(e), d = u.inviteKind === "team_member" ? `identity:${B(18)}` : null;
 		if (!!c != !!l) throw Error("operationId and reviewedProjectSetDigest must be provided together.");
 		let f = async () => {
 			if (!c) return null;
-			let t = await Z(this.db.prepare(`SELECT ${F} FROM coordinator_invites WHERE operation_id = ?`).bind(c));
+			let t = await Z(this.db.prepare(`SELECT ${H} FROM coordinator_invites WHERE operation_id = ?`).bind(c));
 			if (!t) return null;
 			if (t.consumed_at) throw Error("invite_already_bound");
 			if (t.group_id !== e.groupId || t.policy !== e.policy || t.invite_kind !== u.inviteKind || t.reviewed_project_set_digest !== l || t.inviter_actor_id !== (String(e.inviterActorId ?? "").trim() || null) || t.inviter_display_name !== (String(e.inviterDisplayName ?? "").trim() || null) || t.inviter_device_id !== (String(e.inviterDeviceId ?? "").trim() || null) || t.pending_person_id !== (String(e.pendingPersonId ?? "").trim() || null) || t.project_summaries_json !== (e.projectSummaries ? JSON.stringify(e.projectSummaries) : null) || t.project_intent_json !== (e.projectIntent ? JSON.stringify(e.projectIntent) : null) || t.policy_team_id !== u.policyTeamId || t.target_identity_id !== u.targetIdentityId || t.reviewed_preview_digest !== u.reviewedPreviewDigest || t.reviewed_intent_json !== u.reviewedIntentJson) throw Error("invite_operation_intent_conflict");
-			return O(t);
+			return F(t);
 		}, p = async (n) => {
 			if (!n.revoked_at && n.expires_at > t) return n;
 			await Q(this.db.prepare("UPDATE coordinator_invites\n						SET token = ?, token_digest = ?, expires_at = ?, created_at = ?, created_by = ?,\n							team_name_snapshot = ?, revoked_at = NULL\n						WHERE operation_id = ? AND token = ?\n						  AND (revoked_at IS NOT NULL OR expires_at <= ?)").bind(r, i, a, t, e.createdBy ?? null, s?.display_name ?? null, c, n.token, t));
@@ -393,156 +175,156 @@ var $ = class {
 			}
 			throw e;
 		}
-		return O(await Z(this.db.prepare(`SELECT ${F} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
+		return F(await Z(this.db.prepare(`SELECT ${H} FROM coordinator_invites WHERE invite_id = ?`).bind(n)));
 	}
 	async getInviteByToken(e) {
-		let t = await P(e), n = await Z(this.db.prepare(`SELECT ${F}
+		let t = await V(e), n = await Z(this.db.prepare(`SELECT ${H}
 					 FROM coordinator_invites
 					 WHERE (token_digest = ? OR token = ?)
 					   AND revoked_at IS NULL
-					   AND expires_at > ?`).bind(t, e, M()));
-		return n ? O(n) : null;
+					   AND expires_at > ?`).bind(t, e, L()));
+		return n ? F(n) : null;
 	}
 	async getInviteByTokenForInspection(e) {
-		let t = await P(e), n = await Z(this.db.prepare(`SELECT ${F} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
-		return n ? O(n) : null;
+		let t = await V(e), n = await Z(this.db.prepare(`SELECT ${H} FROM coordinator_invites WHERE token_digest = ? OR token = ?`).bind(t, e));
+		return n ? F(n) : null;
 	}
 	async inspectRecipientInvite(e) {
 		let t = await this.getInviteByTokenForInspection(e.token);
 		if (!t) return null;
-		let n = await R(t);
+		let n = await N(t);
 		if (!n) return null;
 		if (t.revoked_at) throw Error("invite_invalid");
-		if (!t.consumed_at && new Date(t.expires_at) <= new Date(o(e.now))) throw Error("invite_expired");
+		if (!t.consumed_at && new Date(t.expires_at) <= new Date(D(e.now))) throw Error("invite_expired");
 		let r = await this.getGroup(t.group_id);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
 		return n;
 	}
 	async consumeRecipientInvite(e) {
-		let t = o(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
+		let t = D(e.now), n = e.recipientDisplayName ?? null, r = e.deviceDisplayName ?? null;
 		if (!e.identityId || !e.deviceId || !e.publicKey || !e.fingerprint || e.identityId !== e.identityId.trim() || e.deviceId !== e.deviceId.trim() || e.identityId.length > 256 || e.deviceId.length > 256 || /[\p{Cc}\p{Cf}]/u.test(e.identityId) || /[\p{Cc}\p{Cf}]/u.test(e.deviceId)) throw Error("invite_identity_conflict");
-		let i = await P(e.token), a = await this.getInviteByTokenForInspection(e.token), s = a ? await R(a) : null;
-		if (!a || !s || s.kind !== e.inviteKind || a.revoked_at) throw Error("invite_invalid");
-		let c = await this.getGroup(a.group_id);
+		let i = await V(e.token), o = await this.getInviteByTokenForInspection(e.token), s = o ? await N(o) : null;
+		if (!o || !s || s.kind !== e.inviteKind || o.revoked_at) throw Error("invite_invalid");
+		let c = await this.getGroup(o.group_id);
 		if (!c) throw Error("group_not_found");
 		if (c.archived_at) throw Error("group_archived");
-		if (!a.consumed_at && new Date(a.expires_at) <= new Date(t)) throw Error("invite_expired");
-		if (E(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
-		let u = l(s);
-		if (u !== e.identityId) throw Error("invite_identity_conflict");
-		let d = a.bound_device_id === e.deviceId && a.bound_public_key === e.publicKey && a.bound_fingerprint === e.fingerprint;
-		if (a.consumed_at && !d) throw Error("invite_already_bound");
-		if (a.consumed_at && a.recipient_actor_id !== u) throw Error("invite_identity_conflict");
-		let f = await Z(this.db.prepare(`SELECT ${I}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(a.group_id, e.deviceId));
-		if (f && (f.public_key !== e.publicKey || f.fingerprint !== e.fingerprint || f.identity_id !== null && f.identity_id !== u)) throw Error("invite_identity_conflict");
-		let p = 0, m = N(12);
-		if (!a.consumed_at) {
+		if (!o.consumed_at && new Date(o.expires_at) <= new Date(t)) throw Error("invite_expired");
+		if (P(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		let l = a(s);
+		if (l !== e.identityId) throw Error("invite_identity_conflict");
+		let u = o.bound_device_id === e.deviceId && o.bound_public_key === e.publicKey && o.bound_fingerprint === e.fingerprint;
+		if (o.consumed_at && !u) throw Error("invite_already_bound");
+		if (o.consumed_at && o.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		let d = await Z(this.db.prepare(`SELECT ${U}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, e.deviceId));
+		if (d && (d.public_key !== e.publicKey || d.fingerprint !== e.fingerprint || d.identity_id !== null && d.identity_id !== l)) throw Error("invite_identity_conflict");
+		let f = 0, p = B(12);
+		if (!o.consumed_at) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-			p = J((await this.db.batch([
-				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${a.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, u, n, r, i, e.token, t, e.inviteKind, a.reviewed_intent_json, a.reviewed_preview_digest, u, u, e.deviceId, e.publicKey, e.fingerprint, u),
-				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, i, e.token, e.deviceId, e.publicKey, e.fingerprint, u),
-				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(m, i, e.token, t),
+			f = Y((await this.db.batch([
+				this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n						bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n						recipient_display_name = ?, recipient_device_display_name = ?\n						WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n						AND revoked_at IS NULL AND expires_at > ? AND invite_kind = ?\n						AND reviewed_intent_json = ? AND reviewed_preview_digest = ?\n						AND ((invite_kind = 'team_member' AND assigned_identity_id = ?)\n							OR (invite_kind = 'add_device' AND target_identity_id = ?))\n						AND NOT EXISTS (\n							SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id AND e.device_id = ?\n								AND (e.public_key <> ? OR e.fingerprint <> ?\n									OR (e.identity_id IS NOT NULL AND e.identity_id <> ?))\n						)\n						AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n							AND g.archived_at IS NULL)").bind(`consumed:${o.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, l, n, r, i, e.token, t, e.inviteKind, o.reviewed_intent_json, o.reviewed_preview_digest, l, l, e.deviceId, e.publicKey, e.fingerprint, l),
+				this.db.prepare("INSERT INTO enrolled_devices(\n						group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n					) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n						i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ?\n						AND i.bound_public_key = ? AND i.bound_fingerprint = ?\n						AND i.recipient_actor_id = ?\n					ON CONFLICT(group_id, device_id) DO UPDATE SET\n						identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n						display_name = COALESCE(enrolled_devices.display_name, excluded.display_name),\n						enabled = 1\n					WHERE enrolled_devices.identity_id IS NULL\n						OR enrolled_devices.identity_id = excluded.identity_id").bind(t, i, e.token, e.deviceId, e.publicKey, e.fingerprint, l),
+				this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE (token_digest = ? OR token = ?) AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(p, i, e.token, t),
 				this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, i, e.token, e.deviceId)
 			]))[0]);
 		}
-		let h = await this.getGroup(a.group_id);
-		if (!h) throw Error("group_not_found");
-		if (h.archived_at) throw Error("group_archived");
-		let g = await Z(this.db.prepare(`SELECT ${I}
-					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(a.group_id, e.deviceId));
-		if (g && (g.public_key !== e.publicKey || g.fingerprint !== e.fingerprint || g.identity_id !== null && g.identity_id !== u)) throw Error("invite_identity_conflict");
-		let _ = await this.getInviteByTokenForInspection(e.token);
-		if (!_ || _.revoked_at || !_.consumed_at && new Date(_.expires_at) <= new Date(t)) throw Error("invite_invalid");
-		let v = await R(_);
-		if (!v || v.kind !== e.inviteKind) throw Error("invite_invalid");
-		if (l(v) !== u) throw Error("invite_identity_conflict");
-		if (_.bound_device_id !== e.deviceId || _.bound_public_key !== e.publicKey || _.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (_.recipient_actor_id !== u) throw Error("invite_identity_conflict");
-		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(u, _.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let y = await this.getEnrollment(_.group_id, e.deviceId);
-		if (!y) throw Error("invite_acceptance_incomplete");
-		if (y.public_key !== e.publicKey || y.fingerprint !== e.fingerprint || y.identity_id !== u) throw Error("invite_identity_conflict");
-		let b = _;
-		if (v.kind === "add_device" && _.inviter_device_id && !_.bootstrap_grant_id && new Date(_.expires_at) > new Date(t)) {
+		let m = await this.getGroup(o.group_id);
+		if (!m) throw Error("group_not_found");
+		if (m.archived_at) throw Error("group_archived");
+		let h = await Z(this.db.prepare(`SELECT ${U}
+					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(o.group_id, e.deviceId));
+		if (h && (h.public_key !== e.publicKey || h.fingerprint !== e.fingerprint || h.identity_id !== null && h.identity_id !== l)) throw Error("invite_identity_conflict");
+		let g = await this.getInviteByTokenForInspection(e.token);
+		if (!g || g.revoked_at || !g.consumed_at && new Date(g.expires_at) <= new Date(t)) throw Error("invite_invalid");
+		let _ = await N(g);
+		if (!_ || _.kind !== e.inviteKind) throw Error("invite_invalid");
+		if (a(_) !== l) throw Error("invite_identity_conflict");
+		if (g.bound_device_id !== e.deviceId || g.bound_public_key !== e.publicKey || g.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (g.recipient_actor_id !== l) throw Error("invite_identity_conflict");
+		await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n				WHERE group_id = ? AND device_id = ? AND identity_id IS NULL\n					AND public_key = ? AND fingerprint = ?").bind(l, g.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		let v = await this.getEnrollment(g.group_id, e.deviceId);
+		if (!v) throw Error("invite_acceptance_incomplete");
+		if (v.public_key !== e.publicKey || v.fingerprint !== e.fingerprint || v.identity_id !== l) throw Error("invite_identity_conflict");
+		let y = g;
+		if (_.kind === "add_device" && g.inviter_device_id && !g.bootstrap_grant_id && new Date(g.expires_at) > new Date(t)) {
 			if (!this.db.batch) throw Error("D1 batch support is required for atomic bootstrap grant recovery.");
-			let n = N(12);
-			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, _.invite_id, e.deviceId, u, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, _.invite_id, e.deviceId)]);
+			let n = B(12);
+			await this.db.batch([this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n						trust_state = 'bootstrap_grant_created'\n						WHERE invite_id = ? AND invite_kind = 'add_device'\n						AND bootstrap_grant_id IS NULL AND inviter_device_id IS NOT NULL\n						AND bound_device_id = ? AND recipient_actor_id = ? AND expires_at > ?\n						AND EXISTS (SELECT 1 FROM enrolled_devices e\n							WHERE e.group_id = coordinator_invites.group_id\n							AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(n, g.invite_id, e.deviceId, l, t), this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n						grant_id, group_id, seed_device_id, worker_device_id, expires_at,\n						created_at, created_by, revoked_at\n					) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n						i.expires_at, ?, i.recipient_actor_id, NULL FROM coordinator_invites i\n					JOIN enrolled_devices e ON e.group_id = i.group_id\n						AND e.device_id = i.inviter_device_id AND e.enabled = 1\n					WHERE i.invite_id = ? AND i.invite_kind = 'add_device'\n						AND i.bootstrap_grant_id IS NOT NULL AND i.bound_device_id = ?").bind(t, g.invite_id, e.deviceId)]);
 			let r = await this.getInviteByTokenForInspection(e.token);
 			if (!r) throw Error("invite_invalid");
-			b = r;
+			y = r;
 		}
-		let x = b.bootstrap_grant_id ? await this.getBootstrapGrant(b.bootstrap_grant_id) : null;
+		let b = y.bootstrap_grant_id ? await this.getBootstrapGrant(y.bootstrap_grant_id) : null;
 		return {
-			status: p === 1 ? "accepted" : "existing",
-			invite: b,
-			reviewed_intent: v.reviewed_intent,
-			bootstrap_grant: x
+			status: f === 1 ? "accepted" : "existing",
+			invite: y,
+			reviewed_intent: _.reviewed_intent,
+			bootstrap_grant: b
 		};
 	}
 	async consumeProjectInvite(e) {
 		if (!this.db.batch) throw Error("D1 batch support is required for atomic invite consume.");
-		let t = o(e.now), n = await P(e.token), r = await this.getInviteByTokenForInspection(e.token);
+		let t = D(e.now), n = await V(e.token), r = await this.getInviteByTokenForInspection(e.token);
 		if (!r?.operation_id || !r.project_intent_json || r.revoked_at) throw Error("invite_invalid");
 		let i = await this.getGroup(r.group_id);
 		if (!i) throw Error("group_not_found");
 		if (i.archived_at) throw Error("group_archived");
 		if (r.operation_id !== e.operationId) throw Error("invite_invalid");
-		if (E(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
+		if (P(e.publicKey) !== e.fingerprint) throw Error("fingerprint_mismatch");
 		if (!r.consumed_at && new Date(r.expires_at) <= new Date(t)) throw Error("invite_expired");
 		let a = r.bound_device_id === e.deviceId && r.bound_public_key === e.publicKey && r.bound_fingerprint === e.fingerprint;
 		if (r.consumed_at && !a) throw Error("invite_already_bound");
 		if (r.consumed_at && (r.recipient_actor_id !== e.recipientActorId || r.recipient_display_name !== e.recipientDisplayName || r.recipient_device_display_name !== e.deviceDisplayName)) throw Error("invite_identity_conflict");
-		let s = await Z(this.db.prepare(`SELECT ${I}
+		let o = await Z(this.db.prepare(`SELECT ${U}
 					FROM enrolled_devices WHERE group_id = ? AND device_id = ?`).bind(r.group_id, e.deviceId));
-		if (s && (s.public_key !== e.publicKey || s.fingerprint !== e.fingerprint || s.identity_id != null && s.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
-		let c = N(12), l = J((await this.db.batch([
+		if (o && (o.public_key !== e.publicKey || o.fingerprint !== e.fingerprint || o.identity_id != null && o.identity_id !== e.recipientActorId)) throw Error("invite_identity_conflict");
+		let s = B(12), c = Y((await this.db.batch([
 			this.db.prepare("UPDATE coordinator_invites SET token = ?, consumed_at = ?, bound_device_id = ?,\n					bound_public_key = ?, bound_fingerprint = ?, recipient_actor_id = ?,\n					recipient_display_name = ?, recipient_device_display_name = ?,\n					trust_state = 'pending_inviter_device'\n					WHERE (token_digest = ? OR token = ?) AND consumed_at IS NULL\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)").bind(`consumed:${r.invite_id}`, t, e.deviceId, e.publicKey, e.fingerprint, e.recipientActorId, e.recipientDisplayName, e.deviceDisplayName, n, e.token),
 			this.db.prepare("INSERT INTO enrolled_devices(\n					group_id, device_id, public_key, fingerprint, identity_id, display_name, enabled, created_at\n				) SELECT i.group_id, i.bound_device_id, i.bound_public_key, i.bound_fingerprint,\n					i.recipient_actor_id, i.recipient_device_display_name, 1, ? FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bound_device_id = ? AND ? = 1\n				ON CONFLICT(group_id, device_id) DO UPDATE SET\n					identity_id = COALESCE(enrolled_devices.identity_id, excluded.identity_id),\n					display_name = excluded.display_name, enabled = 1\n				WHERE enrolled_devices.identity_id IS NULL\n					OR enrolled_devices.identity_id = excluded.identity_id").bind(t, n, e.token, e.deviceId, +!r.consumed_at),
-			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(c, n, e.token, e.deviceId, t),
+			this.db.prepare("UPDATE coordinator_invites SET bootstrap_grant_id = ?,\n					trust_state = 'bootstrap_grant_created'\n					WHERE (token_digest = ? OR token = ?) AND bootstrap_grant_id IS NULL\n					AND bound_device_id = ?\n					AND EXISTS (SELECT 1 FROM groups g WHERE g.group_id = coordinator_invites.group_id\n						AND g.archived_at IS NULL)\n					AND expires_at > ?\n					AND EXISTS (SELECT 1 FROM enrolled_devices e WHERE e.group_id = coordinator_invites.group_id\n						AND e.device_id = coordinator_invites.inviter_device_id AND e.enabled = 1)").bind(s, n, e.token, e.deviceId, t),
 			this.db.prepare("INSERT OR IGNORE INTO coordinator_bootstrap_grants(\n					grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at,\n					created_by, revoked_at\n				) SELECT i.bootstrap_grant_id, i.group_id, i.inviter_device_id, i.bound_device_id,\n					i.expires_at, ?, i.inviter_actor_id, NULL FROM coordinator_invites i\n					JOIN groups g ON g.group_id = i.group_id AND g.archived_at IS NULL\n					JOIN enrolled_devices e ON e.group_id = i.group_id AND e.device_id = i.inviter_device_id\n					WHERE (i.token_digest = ? OR i.token = ?) AND i.bootstrap_grant_id IS NOT NULL\n					AND i.bound_device_id = ? AND e.enabled = 1").bind(t, n, e.token, e.deviceId)
-		]))[0]) === 1, u = await this.getGroup(r.group_id);
-		if (!u) throw Error("group_not_found");
-		if (u.archived_at) throw Error("group_archived");
-		let d = await this.getInviteByTokenForInspection(e.token);
-		if (!d) throw Error("invite_invalid");
-		if (d.bound_device_id !== e.deviceId || d.bound_public_key !== e.publicKey || d.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
-		if (d.recipient_actor_id !== e.recipientActorId || d.recipient_display_name !== e.recipientDisplayName || d.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
-		l || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, d.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
-		let f = await this.getEnrollment(d.group_id, e.deviceId);
-		if (!f) throw Error("invite_acceptance_incomplete");
-		if (f.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
-		let p = d.inviter_device_id ? await this.getEnrollment(d.group_id, d.inviter_device_id) : null, m = d.bootstrap_grant_id ? await this.getBootstrapGrant(d.bootstrap_grant_id) : null;
+		]))[0]) === 1, l = await this.getGroup(r.group_id);
+		if (!l) throw Error("group_not_found");
+		if (l.archived_at) throw Error("group_archived");
+		let u = await this.getInviteByTokenForInspection(e.token);
+		if (!u) throw Error("invite_invalid");
+		if (u.bound_device_id !== e.deviceId || u.bound_public_key !== e.publicKey || u.bound_fingerprint !== e.fingerprint) throw Error("invite_already_bound");
+		if (u.recipient_actor_id !== e.recipientActorId || u.recipient_display_name !== e.recipientDisplayName || u.recipient_device_display_name !== e.deviceDisplayName) throw Error("invite_identity_conflict");
+		c || await this.db.prepare("UPDATE enrolled_devices SET identity_id = ?\n					WHERE group_id = ? AND device_id = ? AND identity_id IS NULL AND enabled = 1\n						AND public_key = ? AND fingerprint = ?").bind(e.recipientActorId, u.group_id, e.deviceId, e.publicKey, e.fingerprint).run();
+		let d = await this.getEnrollment(u.group_id, e.deviceId);
+		if (!d) throw Error("invite_acceptance_incomplete");
+		if (d.identity_id !== e.recipientActorId) throw Error("invite_identity_conflict");
+		let f = u.inviter_device_id ? await this.getEnrollment(u.group_id, u.inviter_device_id) : null, p = u.bootstrap_grant_id ? await this.getBootstrapGrant(u.bootstrap_grant_id) : null;
 		return {
-			status: l ? "accepted" : "existing",
-			invite: d,
-			enrollment: f,
-			seed_enrollment: p,
-			bootstrap_grant: m
+			status: c ? "accepted" : "existing",
+			invite: u,
+			enrollment: d,
+			seed_enrollment: f,
+			bootstrap_grant: p
 		};
 	}
 	async listInvites(e) {
-		return (await X(this.db.prepare(`SELECT ${F}
+		return (await X(this.db.prepare(`SELECT ${H}
 					 FROM coordinator_invites WHERE group_id = ?
-					 ORDER BY created_at DESC`).bind(e))).map((e) => O(e));
+					 ORDER BY created_at DESC`).bind(e))).map((e) => F(e));
 	}
 	async createJoinRequest(e) {
-		let t = M(), n = N(12);
-		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
+		let t = L(), n = B(12);
+		return await this.db.prepare("INSERT INTO coordinator_join_requests(\n				request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n			) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, NULL)").bind(n, e.groupId, e.deviceId, e.publicKey, e.fingerprint, e.displayName ?? null, e.token, t).run(), F(await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(n)));
 	}
 	async listJoinRequests(e, t) {
 		let n = t ?? "pending";
-		return (await X(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => O(e));
+		return (await X(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n						 FROM coordinator_join_requests\n						 WHERE group_id = ? AND status = ?\n						 ORDER BY created_at ASC, device_id ASC").bind(e, n))).map((e) => F(e));
 	}
 	async reviewJoinRequest(e) {
 		let t = await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status,\n					        created_at, reviewed_at, reviewed_by\n					 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 		if (!t) return null;
 		if (t.status !== "pending") return {
-			...O(t),
+			...F(t),
 			_no_transition: !0
 		};
-		let n = Y(e.bootstrapGrant), r = M(), i = e.approved ? "approved" : "denied", a = null, o = null;
+		let n = l(e.bootstrapGrant), r = L(), i = e.approved ? "approved" : "denied", a = null, o = null;
 		if (e.approved && n) {
 			if (!await Z(this.db.prepare("SELECT device_id FROM enrolled_devices WHERE group_id = ? AND device_id = ? AND enabled = 1").bind(t.group_id, n.seedDeviceId))) throw Error("bootstrap grant seed device is not enrolled in the group.");
 			if (n.seedDeviceId === t.device_id) throw Error("bootstrap grant seed and worker device ids must differ.");
@@ -554,9 +336,9 @@ var $ = class {
 		}
 		if (this.db.batch) {
 			let t = [];
-			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(M(), e.requestId, r)), a)) {
-				o = N(12);
-				let n = M();
+			if (t.push(this.db.prepare("UPDATE coordinator_join_requests\n						 SET status = ?, reviewed_at = ?, reviewed_by = ?\n						 WHERE request_id = ? AND status = 'pending'").bind(i, r, e.reviewedBy ?? null, e.requestId)), e.approved && (t.push(this.db.prepare("INSERT INTO enrolled_devices(\n							group_id, device_id, public_key, fingerprint, display_name, enabled, created_at\n						)\n						SELECT group_id, device_id, public_key, fingerprint, display_name, 1, ?\n						FROM coordinator_join_requests\n						WHERE request_id = ?\n						  AND status = 'approved'\n						  AND reviewed_at = ?\n						ON CONFLICT(group_id, device_id) DO UPDATE SET\n							public_key = excluded.public_key,\n							fingerprint = excluded.fingerprint,\n							display_name = excluded.display_name,\n							enabled = 1").bind(L(), e.requestId, r)), a)) {
+				o = B(12);
+				let n = L();
 				t.push(this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n							grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						) SELECT ?, ?, ?, ?, ?, ?, ?, NULL\n						WHERE EXISTS (\n							SELECT 1 FROM coordinator_join_requests\n							WHERE request_id = ? AND status = 'approved' AND reviewed_at = ?\n						)").bind(o, a.groupId, a.seedDeviceId, a.workerDeviceId, a.expiresAt, n, a.createdBy ?? null, e.requestId, r));
 			}
 			await this.db.batch(t);
@@ -575,7 +357,7 @@ var $ = class {
 				n && await this.revokeBootstrapGrant(n);
 				let t = await Z(this.db.prepare("SELECT request_id, group_id, device_id, public_key, fingerprint, display_name, token, status, created_at, reviewed_at, reviewed_by\n							 FROM coordinator_join_requests WHERE request_id = ?").bind(e.requestId));
 				return t ? {
-					...O(t),
+					...F(t),
 					_no_transition: !0
 				} : null;
 			}
@@ -584,7 +366,7 @@ var $ = class {
 		if (!s) return null;
 		let c = a ? o ? await this.getBootstrapGrant(o) : await this.createBootstrapGrant(a) : null;
 		return {
-			...O(s),
+			...F(s),
 			bootstrap_grant: c
 		};
 	}
@@ -593,194 +375,194 @@ var $ = class {
 		if (!t || !n || !r) throw Error("groupId, requestingDeviceId, and requestedDeviceId are required.");
 		if (n === r) throw Error("requesting and requested device ids must differ.");
 		if (i) {
-			let e = M();
+			let e = L();
 			if (await Q(this.db.prepare("UPDATE coordinator_reciprocal_approvals\n						 SET status = 'completed', resolved_at = ?\n						 WHERE request_id = ?\n						   AND group_id = ?\n						   AND requesting_device_id = ?\n						   AND requested_device_id = ?\n						   AND status = 'pending'").bind(e, a, t, r, n)) !== 1) throw new u();
-			return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a)));
+			return F(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a)));
 		}
-		let o = re(n, r), s = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
-		if (s) return O(s);
+		let o = R(n, r), s = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
+		if (s) return F(s);
 		let c = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals\n					 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n					 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
 		if (c) {
-			let e = M();
-			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, c.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(c.request_id)));
+			let e = L();
+			return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, c.request_id).run(), F(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(c.request_id)));
 		}
-		let l = N(12), d = M();
+		let l = B(12), d = L();
 		try {
 			await this.db.prepare("INSERT INTO coordinator_reciprocal_approvals(\n						request_id,\n						group_id,\n						requesting_device_id,\n						requested_device_id,\n						pending_pair_low_device_id,\n						pending_pair_high_device_id,\n						status,\n						created_at,\n						resolved_at\n					) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, NULL)").bind(l, t, n, r, o.low, o.high, d).run();
 		} catch (e) {
-			if (!ie(e)) throw e;
+			if (!z(e)) throw e;
 			let i = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, n, r));
-			if (i) return O(i);
+			if (i) return F(i);
 			let a = await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n						 FROM coordinator_reciprocal_approvals\n						 WHERE group_id = ? AND requesting_device_id = ? AND requested_device_id = ? AND status = 'pending'\n						 ORDER BY created_at DESC LIMIT 1").bind(t, r, n));
 			if (a) {
-				let e = M();
-				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, a.request_id).run(), O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a.request_id)));
+				let e = L();
+				return await this.db.prepare("UPDATE coordinator_reciprocal_approvals SET status = 'completed', resolved_at = ? WHERE request_id = ?").bind(e, a.request_id).run(), F(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n							 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(a.request_id)));
 			}
 			throw e;
 		}
-		return O(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(l)));
+		return F(await Z(this.db.prepare("SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at\n					 FROM coordinator_reciprocal_approvals WHERE request_id = ?").bind(l)));
 	}
 	async createBootstrapGrant(e) {
-		let t = oe(e), n = N(12), r = M();
-		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, r, t.createdBy).run(), O(await Z(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
+		let t = M(e), n = B(12), r = L();
+		return await this.db.prepare("INSERT INTO coordinator_bootstrap_grants(\n				grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n			) VALUES (?, ?, ?, ?, ?, ?, ?, NULL)").bind(n, t.groupId, t.seedDeviceId, t.workerDeviceId, t.expiresAt, r, t.createdBy).run(), F(await Z(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(n)));
 	}
 	async getScope(e) {
 		let t = await Z(this.db.prepare("SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,\n						manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n					 FROM coordinator_scopes WHERE scope_id = ?").bind(e));
-		return t ? O(t) : null;
+		return t ? F(t) : null;
 	}
 	async getScopeMembership(e, t) {
 		let n = await Z(this.db.prepare("SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n						manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n					 FROM coordinator_scope_memberships\n					 WHERE scope_id = ? AND device_id = ?").bind(e, t));
-		return n ? O(n) : null;
+		return n ? F(n) : null;
 	}
 	async createScope(e) {
-		let t = ce(e);
+		let t = i(e);
 		if (await this.getScope(t.scopeId)) throw Error("scopeId already exists.");
-		let n = M();
+		let n = L();
 		await this.db.prepare("INSERT INTO coordinator_scopes(\n					scope_id, label, kind, authority_type, coordinator_id, group_id,\n					manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at\n				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(t.scopeId, t.label, t.kind, t.authorityType, t.coordinatorId, t.groupId, t.manifestIssuerDeviceId, t.membershipEpoch, t.manifestHash, t.status, n, n).run();
 		let r = await this.getScope(t.scopeId);
 		if (!r) throw Error("scope insert returned no row");
 		return r;
 	}
 	async updateScope(e) {
-		let t = L(e.scopeId), n = t ? await this.getScope(t) : null;
+		let t = h(e.scopeId), n = t ? await this.getScope(t) : null;
 		if (!n) return null;
-		let r = H(e, n);
-		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, M(), r.scopeId).run(), await this.getScope(r.scopeId);
+		let r = S(e, n);
+		return await this.db.prepare("UPDATE coordinator_scopes\n				 SET label = ?,\n					 kind = ?,\n					 authority_type = ?,\n					 coordinator_id = ?,\n					 group_id = ?,\n					 manifest_issuer_device_id = ?,\n					 membership_epoch = ?,\n					 manifest_hash = ?,\n					 status = ?,\n					 updated_at = ?\n				 WHERE scope_id = ?").bind(r.label, r.kind, r.authorityType, r.coordinatorId, r.groupId, r.manifestIssuerDeviceId, r.membershipEpoch, r.manifestHash, r.status, L(), r.scopeId).run(), await this.getScope(r.scopeId);
 	}
 	async listScopes(e = {}) {
-		let t = [], n = [], r = L(e.coordinatorId), i = L(e.groupId), a = L(e.status);
+		let t = [], n = [], r = h(e.coordinatorId), i = h(e.groupId), a = h(e.status);
 		r && (t.push("coordinator_id = ?"), n.push(r)), i && (t.push("group_id = ?"), n.push(i)), a ? (t.push("status = ?"), n.push(a)) : e.includeInactive || t.push("status = 'active'");
 		let o = t.length ? `WHERE ${t.join(" AND ")}` : "", s = this.db.prepare(`SELECT scope_id, label, kind, authority_type, coordinator_id, group_id,
 				manifest_issuer_device_id, membership_epoch, manifest_hash, status, created_at, updated_at
 			 FROM coordinator_scopes ${o}
 			 ORDER BY coordinator_id ASC, group_id ASC, scope_id ASC`);
-		return (await X(n.length ? s.bind(...n) : s)).map((e) => O(e));
-	}
-	async grantScopeMembership(e) {
-		let n = a(e.effectId), r = t(e), i = await K(this.db, n);
-		if (i) return D(i, "grant", r), h(i);
-		let o = L(e.scopeId), s = L(e.deviceId), c = o ? await this.getScope(o) : null;
-		if (!c) throw new f("scope_not_found");
-		if (c.status !== "active") throw new f("scope_inactive");
-		let l = o && s ? await this.getScopeMembership(o, s) : null, u = U(e, c, l);
-		if (u.groupId && !await this.getEnrollment(u.groupId, u.deviceId)) throw new f("device_not_enrolled");
-		let d = M();
-		await q(this.db, [
-			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(u.scopeId, u.deviceId, u.role, u.membershipEpoch, u.coordinatorId, u.groupId, u.manifestIssuerDeviceId, u.manifestHash, u.signedManifestJson, d, n),
-			le(this.db, {
+		return (await X(n.length ? s.bind(...n) : s)).map((e) => F(e));
+	}
+	async grantScopeMembership(t) {
+		let n = e(t.effectId), i = p(t), a = await K(this.db, n);
+		if (a) return d(a, "grant", i), s(a);
+		let o = h(t.scopeId), c = h(t.deviceId), l = o ? await this.getScope(o) : null;
+		if (!l) throw new f("scope_not_found");
+		if (l.status !== "active") throw new f("scope_inactive");
+		let u = o && c ? await this.getScopeMembership(o, c) : null, m = r(t, l, u);
+		if (m.groupId && !await this.getEnrollment(m.groupId, m.deviceId)) throw new f("device_not_enrolled");
+		let g = L();
+		await J(this.db, [
+			this.db.prepare("INSERT INTO coordinator_scope_memberships(\n					scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,\n					manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at\n				) SELECT ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?\n				WHERE NOT EXISTS (\n					SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n				)\n				ON CONFLICT(scope_id, device_id) DO UPDATE SET\n					role = excluded.role,\n					status = 'active',\n					membership_epoch = excluded.membership_epoch,\n					coordinator_id = excluded.coordinator_id,\n					group_id = excluded.group_id,\n					manifest_issuer_device_id = excluded.manifest_issuer_device_id,\n					manifest_hash = excluded.manifest_hash,\n					signed_manifest_json = excluded.signed_manifest_json,\n					updated_at = excluded.updated_at\n				WHERE excluded.membership_epoch > coordinator_scope_memberships.membership_epoch\n				   OR (\n					excluded.membership_epoch = coordinator_scope_memberships.membership_epoch\n					AND coordinator_scope_memberships.status != 'revoked'\n				   )").bind(m.scopeId, m.deviceId, m.role, m.membershipEpoch, m.coordinatorId, m.groupId, m.manifestIssuerDeviceId, m.manifestHash, m.signedManifestJson, g, n),
+			q(this.db, {
 				effectId: n,
-				requestJson: r,
-				scopeId: u.scopeId,
-				deviceId: u.deviceId,
-				createdAt: d
+				requestJson: i,
+				scopeId: m.scopeId,
+				deviceId: m.deviceId,
+				createdAt: g
 			}),
 			G(this.db, {
 				effectId: n,
-				requestJson: r,
+				requestJson: i,
 				action: "grant",
-				previous: l,
-				scopeId: u.scopeId,
-				deviceId: u.deviceId,
+				previous: u,
+				scopeId: m.scopeId,
+				deviceId: m.deviceId,
 				status: "active",
-				membershipEpoch: u.membershipEpoch,
-				updatedAt: d,
-				actorType: u.actorType,
-				actorId: u.actorId,
-				createdAt: d
+				membershipEpoch: m.membershipEpoch,
+				updatedAt: g,
+				actorType: m.actorType,
+				actorId: m.actorId,
+				createdAt: g
 			})
 		]);
-		let p = await K(this.db, n);
-		if (!p) throw Error("scope membership grant was not applied.");
-		return D(p, "grant", r), h(p);
-	}
-	async revokeScopeMembership(e) {
-		let t = L(e.scopeId), n = L(e.deviceId);
-		if (!t || !n) throw Error("scopeId and deviceId are required.");
-		let r = a(e.effectId), i = m(e), o = await K(this.db, r);
-		if (o) return D(o, "revoke", i), o.outcome_applied === 1;
-		let s = e.membershipEpoch == null ? null : z(e.membershipEpoch), c = L(e.groupId), l = c ? await this.getScope(t) : null;
-		if (c && c !== l?.group_id) throw new f("scope_group_mismatch");
-		let u = await this.getScopeMembership(t, n);
-		if (s != null && u && s <= u.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
-		let d = M(), p = s ?? (u?.membership_epoch ?? -1) + 1, h = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(s, s, L(e.manifestHash), L(e.signedManifestJson), d, t, n, u?.membership_epoch ?? -1, u?.status ?? "", r), g = ue(this.db, {
-			effectId: r,
-			requestJson: i,
-			scopeId: t,
-			deviceId: n,
-			createdAt: d
-		}), _ = G(this.db, {
-			effectId: r,
-			requestJson: i,
+		let _ = await K(this.db, n);
+		if (!_) throw Error("scope membership grant was not applied.");
+		return d(_, "grant", i), s(_);
+	}
+	async revokeScopeMembership(n) {
+		let r = h(n.scopeId), i = h(n.deviceId);
+		if (!r || !i) throw Error("scopeId and deviceId are required.");
+		let a = e(n.effectId), o = v(n), s = await K(this.db, a);
+		if (s) return d(s, "revoke", o), s.outcome_applied === 1;
+		let c = n.membershipEpoch == null ? null : t(n.membershipEpoch), l = h(n.groupId), u = l ? await this.getScope(r) : null;
+		if (l && l !== u?.group_id) throw new f("scope_group_mismatch");
+		let p = await this.getScopeMembership(r, i);
+		if (c != null && p && c <= p.membership_epoch) throw Error("membershipEpoch must increase on revoke.");
+		let m = L(), g = c ?? (p?.membership_epoch ?? -1) + 1, _ = this.db.prepare("UPDATE coordinator_scope_memberships\n						 SET status = 'revoked',\n							 membership_epoch = CASE WHEN ? IS NULL THEN membership_epoch + 1 ELSE ? END,\n							 manifest_hash = COALESCE(?, manifest_hash),\n							 signed_manifest_json = COALESCE(?, signed_manifest_json),\n							 updated_at = ?\n						 WHERE scope_id = ? AND device_id = ? AND membership_epoch = ? AND status = ?\n						   AND NOT EXISTS (\n							SELECT 1 FROM coordinator_scope_membership_effect_receipts WHERE effect_id = ?\n						   )").bind(c, c, h(n.manifestHash), h(n.signedManifestJson), m, r, i, p?.membership_epoch ?? -1, p?.status ?? "", a), y = ne(this.db, {
+			effectId: a,
+			requestJson: o,
+			scopeId: r,
+			deviceId: i,
+			createdAt: m
+		}), b = G(this.db, {
+			effectId: a,
+			requestJson: o,
 			action: "revoke",
-			previous: u,
-			scopeId: t,
-			deviceId: n,
+			previous: p,
+			scopeId: r,
+			deviceId: i,
 			status: "revoked",
-			membershipEpoch: p,
-			updatedAt: d,
-			actorType: L(e.actorType),
-			actorId: L(e.actorId),
-			createdAt: d
+			membershipEpoch: g,
+			updatedAt: m,
+			actorType: h(n.actorType),
+			actorId: h(n.actorId),
+			createdAt: m
 		});
 		try {
-			await q(this.db, [
-				h,
-				g,
-				_
+			await J(this.db, [
+				_,
+				y,
+				b
 			]);
 		} catch (e) {
-			let r = await this.getScopeMembership(t, n);
-			if (u && (!r || r.membership_epoch !== u.membership_epoch || r.status !== u.status)) return !1;
+			let t = await this.getScopeMembership(r, i);
+			if (p && (!t || t.membership_epoch !== p.membership_epoch || t.status !== p.status)) return !1;
 			throw e;
 		}
-		let v = await K(this.db, r);
-		if (!v) throw Error("scope membership revoke receipt was not persisted.");
-		return D(v, "revoke", i), v.outcome_applied === 1;
+		let x = await K(this.db, a);
+		if (!x) throw Error("scope membership revoke receipt was not persisted.");
+		return d(x, "revoke", o), x.outcome_applied === 1;
 	}
 	async listScopeMemberships(e, t = !1) {
-		let n = L(e);
+		let n = h(e);
 		if (!n) throw Error("scopeId is required.");
 		let r = t ? "" : "AND status = 'active'";
 		return (await X(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
 							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
 						 FROM coordinator_scope_memberships
 						 WHERE scope_id = ? ${r}
-						 ORDER BY device_id ASC`).bind(n))).map((e) => O(e));
+						 ORDER BY device_id ASC`).bind(n))).map((e) => F(e));
 	}
 	async listDeviceScopeMemberships(e, t = !1) {
-		let n = L(e);
+		let n = h(e);
 		if (!n) throw Error("deviceId is required.");
 		let r = t ? "" : "AND status = 'active'";
 		return (await X(this.db.prepare(`SELECT scope_id, device_id, role, status, membership_epoch, coordinator_id, group_id,
 							manifest_issuer_device_id, manifest_hash, signed_manifest_json, updated_at
 						 FROM coordinator_scope_memberships
 						 WHERE device_id = ? ${r}
-						 ORDER BY scope_id ASC`).bind(n))).map((e) => O(e));
+						 ORDER BY scope_id ASC`).bind(n))).map((e) => F(e));
 	}
 	async listScopeMembershipAuditEvents(e) {
-		let t = L(e.scopeId);
+		let t = h(e.scopeId);
 		if (!t) throw Error("scopeId is required.");
-		let n = L(e.deviceId), r = W(e.limit), i = n ? "scope_id = ? AND device_id = ?" : "scope_id = ?", a = n ? [
+		let r = h(e.deviceId), i = n(e.limit), a = r ? "scope_id = ? AND device_id = ?" : "scope_id = ?", o = r ? [
 			t,
-			n,
-			r
-		] : [t, r];
+			r,
+			i
+		] : [t, i];
 		return (await X(this.db.prepare(`SELECT event_id, effect_id, action, scope_id, device_id, role, status, membership_epoch,
 							previous_role, previous_status, previous_membership_epoch,
 							coordinator_id, group_id, actor_type, actor_id, manifest_hash, created_at
 						 FROM coordinator_scope_membership_audit_log
-						 WHERE ${i}
+						 WHERE ${a}
 						 ORDER BY event_id ASC
-						 LIMIT ?`).bind(...a))).map((e) => O(e));
+						 LIMIT ?`).bind(...o))).map((e) => F(e));
 	}
 	async getBootstrapGrant(e) {
 		let t = await Z(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n					 FROM coordinator_bootstrap_grants WHERE grant_id = ?").bind(e));
-		return t ? O(t) : null;
+		return t ? F(t) : null;
 	}
 	async listBootstrapGrants(e) {
-		return (await X(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => O(e));
+		return (await X(this.db.prepare("SELECT grant_id, group_id, seed_device_id, worker_device_id, expires_at, created_at, created_by, revoked_at\n						 FROM coordinator_bootstrap_grants WHERE group_id = ?\n						 ORDER BY created_at DESC, grant_id DESC").bind(e))).map((e) => F(e));
 	}
-	async revokeBootstrapGrant(e, t = M()) {
+	async revokeBootstrapGrant(e, t = L()) {
 		return await Q(this.db.prepare("UPDATE coordinator_bootstrap_grants\n						 SET revoked_at = COALESCE(revoked_at, ?)\n						 WHERE grant_id = ?").bind(t, e)) > 0;
 	}
 	async listReciprocalApprovals(e) {
@@ -788,46 +570,46 @@ var $ = class {
 		return (await X(this.db.prepare(`SELECT request_id, group_id, requesting_device_id, requested_device_id, status, created_at, resolved_at
 						 FROM coordinator_reciprocal_approvals
 						 WHERE group_id = ? AND ${t} = ? AND status = ?
-						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => O(e));
+						 ORDER BY created_at ASC, request_id ASC`).bind(e.groupId, e.deviceId, n))).map((e) => F(e));
 	}
 	async createLegacyTeamCompletion(e, t) {
-		let [n] = b([e]);
+		let [n] = _([e]);
 		if (!n) throw Error("completion_manifest_invalid");
 		let r = await this.getGroup(n);
 		if (!r) throw Error("group_not_found");
 		if (r.archived_at) throw Error("group_archived");
-		let i = d(t), a = JSON.parse(i);
-		x(a);
+		let i = C(t), a = JSON.parse(i);
+		b(a);
 		let o = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
 		if (o) {
-			if (o.manifest_json !== i) throw new y();
+			if (o.manifest_json !== i) throw new g();
 			return {
 				status: "existing",
-				manifest: w(JSON.parse(o.manifest_json))
+				manifest: y(JSON.parse(o.manifest_json))
 			};
 		}
-		let s = await X(this.db.prepare("SELECT DISTINCT\n					requested.scope_id,\n					scope.authority_type,\n					scope.coordinator_id,\n					scope.group_id,\n					scope.status\n				 FROM (\n					SELECT json_extract(value, '$.scope_id') AS scope_id\n					FROM json_each(?, '$.project_mappings')\n				 ) AS requested\n				 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i)), c = C(a, n, s), l = await Q(this.db.prepare("INSERT OR IGNORE INTO coordinator_legacy_team_completions(\n					group_id, candidate_ref, manifest_version, manifest_json, completed_at, created_at\n					) SELECT ?, ?, ?, ?, ?, ?\n					  FROM groups\n					  WHERE group_id = ? AND archived_at IS NULL\n					    AND NOT EXISTS (\n					      SELECT 1\n					      FROM json_each(?, '$.project_mappings') AS requested\n					      LEFT JOIN coordinator_scopes AS scope\n					        ON scope.scope_id = json_extract(requested.value, '$.scope_id')\n					       AND scope.authority_type = 'coordinator'\n					       AND scope.coordinator_id = ?\n					       AND scope.group_id = ?\n					       AND scope.status = 'active'\n					      WHERE scope.scope_id IS NULL\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM enrolled_devices AS enrolled\n					      WHERE enrolled.group_id = ?\n					        AND NOT EXISTS (\n					          SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					          WHERE json_extract(requested.value, '$.device_id') = enrolled.device_id\n					            AND json_extract(requested.value, '$.key_fingerprint') = enrolled.fingerprint\n					            AND json_extract(requested.value, '$.enabled') = enrolled.enabled\n					        )\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					      WHERE json_extract(requested.value, '$.decision') = 'included'\n					        AND NOT EXISTS (\n					          SELECT 1 FROM enrolled_devices AS enrolled\n					          WHERE enrolled.group_id = ?\n					            AND enrolled.device_id = json_extract(requested.value, '$.device_id')\n					            AND enrolled.fingerprint = json_extract(requested.value, '$.key_fingerprint')\n					            AND enrolled.enabled = 1\n					        )\n					    )").bind(n, a.candidate_ref, a.version, i, a.completed_at, M(), n, i, c, n, n, i, i, n)), u = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
+		let s = await X(this.db.prepare("SELECT DISTINCT\n					requested.scope_id,\n					scope.authority_type,\n					scope.coordinator_id,\n					scope.group_id,\n					scope.status\n				 FROM (\n					SELECT json_extract(value, '$.scope_id') AS scope_id\n					FROM json_each(?, '$.project_mappings')\n				 ) AS requested\n				 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i)), c = w(a, n, s), l = await Q(this.db.prepare("INSERT OR IGNORE INTO coordinator_legacy_team_completions(\n					group_id, candidate_ref, manifest_version, manifest_json, completed_at, created_at\n					) SELECT ?, ?, ?, ?, ?, ?\n					  FROM groups\n					  WHERE group_id = ? AND archived_at IS NULL\n					    AND NOT EXISTS (\n					      SELECT 1\n					      FROM json_each(?, '$.project_mappings') AS requested\n					      LEFT JOIN coordinator_scopes AS scope\n					        ON scope.scope_id = json_extract(requested.value, '$.scope_id')\n					       AND scope.authority_type = 'coordinator'\n					       AND scope.coordinator_id = ?\n					       AND scope.group_id = ?\n					       AND scope.status = 'active'\n					      WHERE scope.scope_id IS NULL\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM enrolled_devices AS enrolled\n					      WHERE enrolled.group_id = ?\n					        AND NOT EXISTS (\n					          SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					          WHERE json_extract(requested.value, '$.device_id') = enrolled.device_id\n					            AND json_extract(requested.value, '$.key_fingerprint') = enrolled.fingerprint\n					            AND json_extract(requested.value, '$.enabled') = enrolled.enabled\n					        )\n					    )\n					    AND NOT EXISTS (\n					      SELECT 1 FROM json_each(?, '$.device_decisions') AS requested\n					      WHERE json_extract(requested.value, '$.decision') = 'included'\n					        AND NOT EXISTS (\n					          SELECT 1 FROM enrolled_devices AS enrolled\n					          WHERE enrolled.group_id = ?\n					            AND enrolled.device_id = json_extract(requested.value, '$.device_id')\n					            AND enrolled.fingerprint = json_extract(requested.value, '$.key_fingerprint')\n					            AND enrolled.enabled = 1\n					        )\n					    )").bind(n, a.candidate_ref, a.version, i, a.completed_at, L(), n, i, c, n, n, i, i, n)), u = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, a.candidate_ref));
 		if (!u) {
 			let e = await this.getGroup(n);
 			if (!e) throw Error("group_not_found");
 			if (e.archived_at) throw Error("group_archived");
 			let t = await X(this.db.prepare("SELECT DISTINCT\n						requested.scope_id,\n						scope.authority_type,\n						scope.coordinator_id,\n						scope.group_id,\n						scope.status\n					 FROM (\n						SELECT json_extract(value, '$.scope_id') AS scope_id\n						FROM json_each(?, '$.project_mappings')\n					 ) AS requested\n					 LEFT JOIN coordinator_scopes AS scope ON scope.scope_id = requested.scope_id").bind(i));
-			throw C(a, n, t), Error("completion_manifest_unavailable");
+			throw w(a, n, t), Error("completion_manifest_unavailable");
 		}
-		if (u.manifest_json !== i) throw new y();
+		if (u.manifest_json !== i) throw new g();
 		return {
 			status: l === 1 ? "created" : "existing",
-			manifest: w(JSON.parse(u.manifest_json))
+			manifest: y(JSON.parse(u.manifest_json))
 		};
 	}
-	async getLegacyTeamCompletion(t, n) {
-		let [r] = b([t]), i = e(n);
-		if (!r) throw Error("completion_manifest_invalid");
-		let a = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(r, i));
-		return a ? w(JSON.parse(a.manifest_json)) : null;
+	async getLegacyTeamCompletion(e, t) {
+		let [n] = _([e]), r = j(t);
+		if (!n) throw Error("completion_manifest_invalid");
+		let i = await Z(this.db.prepare("SELECT manifest_json FROM coordinator_legacy_team_completions\n					WHERE group_id = ? AND candidate_ref = ?").bind(n, r));
+		return i ? y(JSON.parse(i.manifest_json)) : null;
 	}
 	async listLegacyTeamCompletions(e) {
-		let t = b(e);
+		let t = _(e);
 		if (t.length === 0) return [];
 		let n = t.map(() => "?").join(", "), r = await Z(this.db.prepare(`SELECT
 					COUNT(*) AS record_count,
@@ -838,7 +620,7 @@ var $ = class {
 				FROM coordinator_legacy_team_completions
 				WHERE group_id IN (${n})`).bind(...t));
 		if (!r || r.record_count > 500 || r.batch_bytes > 375e5 || r.max_manifest_bytes > 15e5) throw Error("completion_results_too_large");
-		let a = await X(this.db.prepare(`WITH completion_stats AS (
+		let i = await X(this.db.prepare(`WITH completion_stats AS (
 					SELECT
 						COUNT(*) AS record_count,
 						COALESCE(SUM(
@@ -853,20 +635,20 @@ var $ = class {
 				CROSS JOIN completion_stats
 				WHERE completions.group_id IN (${n})
 					  AND completion_stats.record_count <= 500
-					  AND completion_stats.batch_bytes <= ${i}
-					  AND completion_stats.max_manifest_bytes <= ${S}
-					  AND LENGTH(completions.manifest_json) <= ${S}
-					  AND LENGTH(CAST(completions.manifest_json AS BLOB)) <= ${S}
+					  AND completion_stats.batch_bytes <= ${E}
+					  AND completion_stats.max_manifest_bytes <= ${x}
+					  AND LENGTH(completions.manifest_json) <= ${x}
+					  AND LENGTH(CAST(completions.manifest_json AS BLOB)) <= ${x}
 					ORDER BY completions.group_id, completions.completed_at, completions.candidate_ref
 					LIMIT 501`).bind(...t, ...t));
-		if (a.length === 0 && r.record_count > 0 || a.length > 500 || a.reduce((e, t) => e + new TextEncoder().encode(t.group_id).byteLength + new TextEncoder().encode(t.manifest_json).byteLength, 0) > 375e5) throw Error("completion_results_too_large");
-		return a.map((e) => ({
+		if (i.length === 0 && r.record_count > 0 || i.length > 500 || i.reduce((e, t) => e + new TextEncoder().encode(t.group_id).byteLength + new TextEncoder().encode(t.manifest_json).byteLength, 0) > 375e5) throw Error("completion_results_too_large");
+		return i.map((e) => ({
 			group_id: e.group_id,
-			manifest: w(JSON.parse(e.manifest_json))
+			manifest: y(JSON.parse(e.manifest_json))
 		}));
 	}
 	async upsertPresence(e) {
-		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = j([], e.addresses);
+		let t = /* @__PURE__ */ new Date(), n = new Date(t.getTime() + e.ttlS * 1e3).toISOString(), r = c([], e.addresses);
 		return await this.db.prepare("INSERT INTO presence_records(group_id, device_id, addresses_json, last_seen_at, expires_at, capabilities_json)\n				 VALUES (?, ?, ?, ?, ?, ?)\n				 ON CONFLICT(group_id, device_id) DO UPDATE SET\n					addresses_json = excluded.addresses_json,\n					last_seen_at = excluded.last_seen_at,\n					expires_at = excluded.expires_at,\n					capabilities_json = excluded.capabilities_json").bind(e.groupId, e.deviceId, JSON.stringify(r), t.toISOString(), n, JSON.stringify(e.capabilities ?? {})).run(), {
 			group_id: e.groupId,
 			device_id: e.deviceId,
@@ -875,14 +657,14 @@ var $ = class {
 		};
 	}
 	async listGroupPeers(e, t) {
-		let n = M();
+		let n = L();
 		return (await X(this.db.prepare("SELECT enrolled_devices.device_id, enrolled_devices.public_key, enrolled_devices.fingerprint, enrolled_devices.display_name,\n						presence_records.addresses_json, presence_records.last_seen_at, presence_records.expires_at,\n						presence_records.capabilities_json\n					 FROM enrolled_devices\n					 LEFT JOIN presence_records\n					   ON presence_records.group_id = enrolled_devices.group_id\n					  AND presence_records.device_id = enrolled_devices.device_id\n					 WHERE enrolled_devices.group_id = ?\n					   AND enrolled_devices.enabled = 1\n					   AND enrolled_devices.device_id != ?\n					 ORDER BY enrolled_devices.device_id ASC").bind(e, t))).map((e) => {
 			let t = String(e.expires_at ?? "").trim(), r = !0;
 			if (t) {
 				let e = new Date(t);
 				r = Number.isNaN(e.getTime()) || e.toISOString() <= n;
 			}
-			let i = r ? [] : j([], JSON.parse(String(e.addresses_json ?? "[]")));
+			let i = r ? [] : c([], JSON.parse(String(e.addresses_json ?? "[]")));
 			return {
 				device_id: String(e.device_id ?? ""),
 				public_key: String(e.public_key ?? ""),
@@ -899,18 +681,18 @@ var $ = class {
 };
 //#endregion
 //#region src/d1-coordinator-runtime.ts
-function de(e) {
+function re(e) {
 	let t = {
 		adminSecret: () => String(e.adminSecret ?? "").trim() || null,
 		now: e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
 	};
-	return te({
+	return k({
 		storeFactory: () => new $(e.db),
 		runtime: t,
 		requestVerifier: e.requestVerifier
 	});
 }
 //#endregion
-export { g as COORDINATOR_LEGACY_TEAM_COMPLETION_CONFLICT, i as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_BYTES, c as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_RESPONSE_BYTES, S as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BYTES, s as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_GROUPS, v as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_RECORDS, _ as COORDINATOR_LEGACY_TEAM_COMPLETION_VERSION, y as CoordinatorLegacyTeamCompletionConflictError, $ as D1CoordinatorStore, ee as DEFAULT_TIME_WINDOW_S, d as canonicalCoordinatorLegacyTeamCompletionManifestJson, de as createD1CoordinatorApp, e as normalizeCoordinatorLegacyTeamCompletionCandidateRef, b as normalizeCoordinatorLegacyTeamCompletionGroupIds, w as normalizeCoordinatorLegacyTeamCompletionManifest };
+export { A as COORDINATOR_LEGACY_TEAM_COMPLETION_CONFLICT, E as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_BYTES, te as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BATCH_RESPONSE_BYTES, x as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_BYTES, m as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_GROUPS, ee as COORDINATOR_LEGACY_TEAM_COMPLETION_MAX_RECORDS, O as COORDINATOR_LEGACY_TEAM_COMPLETION_VERSION, g as CoordinatorLegacyTeamCompletionConflictError, $ as D1CoordinatorStore, T as DEFAULT_TIME_WINDOW_S, C as canonicalCoordinatorLegacyTeamCompletionManifestJson, re as createD1CoordinatorApp, j as normalizeCoordinatorLegacyTeamCompletionCandidateRef, _ as normalizeCoordinatorLegacyTeamCompletionGroupIds, y as normalizeCoordinatorLegacyTeamCompletionManifest };
 
 //# sourceMappingURL=cloudflare-coordinator.js.map