@serfab/cadre-core 0.10.0 → 0.11.0

package/src/ed25519-key.ts

@@ -1,134 +1,134 @@
-import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
-import type { PrivateKey } from '@libp2p/interface';
-
-/**
- * An Ed25519 keypair expressed in the base64url form that
- * `@optimystic/quereus-plugin-crypto` (`sign`/`verify`/`getPublicKey`) consumes.
- * Generic bridge type — reused for owner keys, member keys, and any other
- * seed→public keypair the control/strand databases sign with.
- */
-export interface Ed25519KeyPair {
-  /** 32-byte Ed25519 seed, base64url-encoded — the crypto-plugin private key. */
-  privateKeyB64: string;
-  /** 32-byte Ed25519 public key, base64url-encoded. */
-  publicKeyB64: string;
-}
-
-/**
- * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
- * control- and strand-database signing constraints.
- *
- * libp2p stores an Ed25519 private key as 64 raw bytes: the first 32 are the
- * seed (the actual scalar source), the last 32 are the public key — see
- * `@libp2p/crypto`'s `Ed25519PrivateKey`. `@optimystic/quereus-plugin-crypto`
- * (via `@noble/curves`) treats the 32-byte seed *as* the private key and
- * derives the public key from it with standard Ed25519. The two derivations
- * agree, so the node's peer identity and its signing key are one keypair:
- * `getPublicKey(privateKeyB64)` === `publicKeyB64`.
- *
- * @param privateKey - The node's libp2p Ed25519 private key.
- * @returns The base64url seed/public-key pair for signing operations.
- * @throws If the key is not Ed25519 or the raw bytes aren't the expected length.
- */
-export function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed25519KeyPair {
-  if (privateKey.type !== 'Ed25519') {
-    throw new Error(`ed25519KeyPairFromLibp2p requires an Ed25519 key, got ${privateKey.type}`);
-  }
-
-  const raw = privateKey.raw;
-  if (raw.length !== 64) {
-    throw new Error(`Expected a 64-byte Ed25519 raw private key (seed||public), got ${raw.length} bytes`);
-  }
-
-  const seed = raw.subarray(0, 32);
-  const publicKeyRaw = privateKey.publicKey.raw;
-  if (publicKeyRaw.length !== 32) {
-    throw new Error(`Expected a 32-byte Ed25519 public key, got ${publicKeyRaw.length} bytes`);
-  }
-
-  return {
-    privateKeyB64: uint8ArrayToString(seed, 'base64url'),
-    publicKeyB64: uint8ArrayToString(publicKeyRaw, 'base64url'),
-  };
-}
-
-/**
- * Derive the base64url Ed25519 public key from a base64url 32-byte private seed
- * — the same derivation the seed-bootstrap signer uses internally
- * (`SeedBootstrapService` constructor). Use this to enroll a standalone
- * (non-libp2p) key into the control DB before minting an invite, when the
- * key is *not* the node's peer identity (so `ed25519KeyPairFromLibp2p`,
- * which needs a libp2p key object, does not apply).
- *
- * @param privateKeyB64 - The base64url-encoded 32-byte Ed25519 seed.
- * @returns The base64url-encoded Ed25519 public key.
- */
-export function ed25519PublicKeyFromPrivate(privateKeyB64: string): string {
-  return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url') as string;
-}
-
-/** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
-const REJECTED_VALUE_ECHO_LIMIT = 64;
-
-/**
- * Render a rejected value for an error message, capped: owner keys now reach this check
- * from remote-supplied fields (a `CadreInvite`'s `ownerKeys`, a donation request's
- * `ownerKeys`), so an unbounded echo would let a peer turn one junk string into a
- * megabyte of log line.
- */
-function describeRejected(value: string): string {
-  return value.length <= REJECTED_VALUE_ECHO_LIMIT
-    ? value
-    : `${value.slice(0, REJECTED_VALUE_ECHO_LIMIT)}… (${value.length} chars)`;
-}
-
-/**
- * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
- * before it reaches the control database, where a malformed key would otherwise sit
- * indistinguishable from a real one until some later, unrelated signature check fails.
- *
- * Trims first, reusing the blank-value message for an empty result so that case keeps its
- * existing wording instead of a confusing base64url error. Every rejection names the offending
- * value (capped, see {@link describeRejected}) — with several keys in one batch, the message is
- * the only thing that says WHICH one. Does not check the decoded bytes
- * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
- * signature verification later exactly like any other wrong key.
- *
- * **This rule is restated once outside this package**, in `validateOwnerKey`
- * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
- * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
- * directly. Change the rule here and change it there — the copies are kept in step by
- * hand, since neither package can import the other's. Each side pins its own copy to the
- * same accept/reject table (`test/ed25519-key.spec.ts` here,
- * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
- * package it was made in and lands the editor on this pointer.
- *
- * @param value - Candidate base64url-encoded Ed25519 public key.
- * @param label - Human-readable name of the field, used in error messages.
- * @returns The trimmed value, so callers write the same bytes they validated.
- */
-export function requireEd25519PublicKeyB64(value: string, label: string): string {
-  const trimmed = value.trim();
-  if (trimmed.length === 0) {
-    throw new Error(`A ${label} is required (received an empty or whitespace-only value)`);
-  }
-
-  let decoded: Uint8Array;
-  try {
-    decoded = uint8ArrayFromString(trimmed, 'base64url');
-  } catch (error) {
-    throw new Error(
-      `A ${label} must be a base64url-encoded Ed25519 public key (could not decode "${describeRejected(trimmed)}" as base64url)`,
-      { cause: error },
-    );
-  }
-
-  if (decoded.length !== 32) {
-    throw new Error(
-      `A ${label} must be a base64url-encoded 32-byte Ed25519 public key ("${describeRejected(trimmed)}" decoded to ${decoded.length} bytes)`,
-    );
-  }
-
-  return trimmed;
-}
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
+import type { PrivateKey } from '@libp2p/interface';
+
+/**
+ * An Ed25519 keypair expressed in the base64url form that
+ * `@optimystic/quereus-plugin-crypto` (`sign`/`verify`/`getPublicKey`) consumes.
+ * Generic bridge type — reused for owner keys, member keys, and any other
+ * seed→public keypair the control/strand databases sign with.
+ */
+export interface Ed25519KeyPair {
+  /** 32-byte Ed25519 seed, base64url-encoded — the crypto-plugin private key. */
+  privateKeyB64: string;
+  /** 32-byte Ed25519 public key, base64url-encoded. */
+  publicKeyB64: string;
+}
+
+/**
+ * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
+ * control- and strand-database signing constraints.
+ *
+ * libp2p stores an Ed25519 private key as 64 raw bytes: the first 32 are the
+ * seed (the actual scalar source), the last 32 are the public key — see
+ * `@libp2p/crypto`'s `Ed25519PrivateKey`. `@optimystic/quereus-plugin-crypto`
+ * (via `@noble/curves`) treats the 32-byte seed *as* the private key and
+ * derives the public key from it with standard Ed25519. The two derivations
+ * agree, so the node's peer identity and its signing key are one keypair:
+ * `getPublicKey(privateKeyB64)` === `publicKeyB64`.
+ *
+ * @param privateKey - The node's libp2p Ed25519 private key.
+ * @returns The base64url seed/public-key pair for signing operations.
+ * @throws If the key is not Ed25519 or the raw bytes aren't the expected length.
+ */
+export function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed25519KeyPair {
+  if (privateKey.type !== 'Ed25519') {
+    throw new Error(`ed25519KeyPairFromLibp2p requires an Ed25519 key, got ${privateKey.type}`);
+  }
+
+  const raw = privateKey.raw;
+  if (raw.length !== 64) {
+    throw new Error(`Expected a 64-byte Ed25519 raw private key (seed||public), got ${raw.length} bytes`);
+  }
+
+  const seed = raw.subarray(0, 32);
+  const publicKeyRaw = privateKey.publicKey.raw;
+  if (publicKeyRaw.length !== 32) {
+    throw new Error(`Expected a 32-byte Ed25519 public key, got ${publicKeyRaw.length} bytes`);
+  }
+
+  return {
+    privateKeyB64: uint8ArrayToString(seed, 'base64url'),
+    publicKeyB64: uint8ArrayToString(publicKeyRaw, 'base64url'),
+  };
+}
+
+/**
+ * Derive the base64url Ed25519 public key from a base64url 32-byte private seed
+ * — the same derivation the seed-bootstrap signer uses internally
+ * (`SeedBootstrapService` constructor). Use this to enroll a standalone
+ * (non-libp2p) key into the control DB before minting an invite, when the
+ * key is *not* the node's peer identity (so `ed25519KeyPairFromLibp2p`,
+ * which needs a libp2p key object, does not apply).
+ *
+ * @param privateKeyB64 - The base64url-encoded 32-byte Ed25519 seed.
+ * @returns The base64url-encoded Ed25519 public key.
+ */
+export function ed25519PublicKeyFromPrivate(privateKeyB64: string): string {
+  return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url') as string;
+}
+
+/** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
+const REJECTED_VALUE_ECHO_LIMIT = 64;
+
+/**
+ * Render a rejected value for an error message, capped: owner keys now reach this check
+ * from remote-supplied fields (a `CadreInvite`'s `ownerKeys`, a donation request's
+ * `ownerKeys`), so an unbounded echo would let a peer turn one junk string into a
+ * megabyte of log line.
+ */
+function describeRejected(value: string): string {
+  return value.length <= REJECTED_VALUE_ECHO_LIMIT
+    ? value
+    : `${value.slice(0, REJECTED_VALUE_ECHO_LIMIT)}… (${value.length} chars)`;
+}
+
+/**
+ * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
+ * before it reaches the control database, where a malformed key would otherwise sit
+ * indistinguishable from a real one until some later, unrelated signature check fails.
+ *
+ * Trims first, reusing the blank-value message for an empty result so that case keeps its
+ * existing wording instead of a confusing base64url error. Every rejection names the offending
+ * value (capped, see {@link describeRejected}) — with several keys in one batch, the message is
+ * the only thing that says WHICH one. Does not check the decoded bytes
+ * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
+ * signature verification later exactly like any other wrong key.
+ *
+ * **This rule is restated once outside this package**, in `validateOwnerKey`
+ * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
+ * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
+ * directly. Change the rule here and change it there — the copies are kept in step by
+ * hand, since neither package can import the other's. Each side pins its own copy to the
+ * same accept/reject table (`test/ed25519-key.spec.ts` here,
+ * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
+ * package it was made in and lands the editor on this pointer.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 public key.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The trimmed value, so callers write the same bytes they validated.
+ */
+export function requireEd25519PublicKeyB64(value: string, label: string): string {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    throw new Error(`A ${label} is required (received an empty or whitespace-only value)`);
+  }
+
+  let decoded: Uint8Array;
+  try {
+    decoded = uint8ArrayFromString(trimmed, 'base64url');
+  } catch (error) {
+    throw new Error(
+      `A ${label} must be a base64url-encoded Ed25519 public key (could not decode "${describeRejected(trimmed)}" as base64url)`,
+      { cause: error },
+    );
+  }
+
+  if (decoded.length !== 32) {
+    throw new Error(
+      `A ${label} must be a base64url-encoded 32-byte Ed25519 public key ("${describeRejected(trimmed)}" decoded to ${decoded.length} bytes)`,
+    );
+  }
+
+  return trimmed;
+}

package/src/enrollment.ts

@@ -1,199 +1,199 @@
-import debug from 'debug';
-import { generateKeyPair, privateKeyToProtobuf } from '@libp2p/crypto/keys';
-import { peerIdFromPrivateKey } from '@libp2p/peer-id';
-import type {
-  CreatePeerResult,
-  MemberRegistration,
-  MemberRegistrationResult
-} from './types.js';
-
-const log = debug('sereus:cadre:enrollment');
-
-/**
- * Interface for verifying member signatures for strand joining
- */
-export interface MemberVerifier {
-  /**
-   * Verify that the signature is valid for the given member registration
-   * @param registration The member registration data
-   * @param signature The signature to verify
-   * @returns true if signature is valid
-   */
-  verifyMember(registration: MemberRegistration, signature: string): Promise<boolean>;
-
-  /**
-   * Check if the member key is authorized to join the strand
-   * (e.g., was invited via FormationInvite)
-   */
-  isAuthorizedToJoin(strandId: string, memberKey: string): Promise<boolean>;
-}
-
-/**
- * Interface for registering members in a strand
- */
-export interface MemberRegistry {
-  /**
-   * Register a member in the strand's member list
-   */
-  registerMember(strandId: string, memberKey: string, peerIds: string[]): Promise<void>;
-
-  /**
-   * Check if a member is already registered in the strand
-   */
-  isMemberRegistered(strandId: string, memberKey: string): Promise<boolean>;
-}
-
-/**
- * Enrollment API for creating peer identities and managing strand membership
- *
- * Peer Creation:
- *   `createCadrePeer()` generates an Ed25519 keypair for a new node.
- *   For cadre peer authorization, use the Seed Bootstrap API instead.
- *
- * Member Registration:
- *   Accept invitations to join strands as a member.
- */
-export class EnrollmentService {
-  private readonly memberVerifier?: MemberVerifier;
-  private readonly memberRegistry?: MemberRegistry;
-
-  constructor(options?: {
-    memberVerifier?: MemberVerifier;
-    memberRegistry?: MemberRegistry;
-  }) {
-    this.memberVerifier = options?.memberVerifier;
-    this.memberRegistry = options?.memberRegistry;
-    log('EnrollmentService created');
-  }
-
-  /**
-   * Create a new cadre peer identity
-   *
-   * Generates a new Ed25519 keypair for a cadre node.
-   * The private key should be stored securely by the node.
-   * The PeerId can be used with the Seed Bootstrap API for authorization.
-   */
-  async createCadrePeer(): Promise<CreatePeerResult> {
-    log('Creating new cadre peer identity');
-
-    // Generate Ed25519 keypair (same as libp2p uses)
-    const privateKey = await generateKeyPair('Ed25519');
-    const peerId = peerIdFromPrivateKey(privateKey);
-
-    // Export private key as protobuf bytes for storage
-    const privateKeyBytes = privateKeyToProtobuf(privateKey);
-
-    log('Created peer with ID: %s', peerId.toString());
-
-    return {
-      peerId,
-      privateKey: privateKeyBytes
-    };
-  }
-
-  // ============================================================================
-  // Member Registration API
-  // ============================================================================
-
-  /**
-   * Register a member into a strand.
-   *
-   * Called by an invited party to accept an invitation and join as a member.
-   * The signature proves ownership of the member key.
-   *
-   * @param registration The member registration data (strandId, key, peerIds)
-   * @param signature Signature over the registration proving key ownership
-   * @returns Success/failure with optional reason
-   */
-  async registerMember(
-    registration: MemberRegistration,
-    signature: string
-  ): Promise<MemberRegistrationResult> {
-    const { strandId, key, peerIds } = registration;
-
-    log('Registering member %s for strand %s with %d peers', key, strandId, peerIds.length);
-
-    // Check required dependencies
-    if (!this.memberVerifier) {
-      log('MemberVerifier not configured');
-      return { success: false, reason: 'MemberVerifier not configured' };
-    }
-
-    if (!this.memberRegistry) {
-      log('MemberRegistry not configured');
-      return { success: false, reason: 'MemberRegistry not configured' };
-    }
-
-    // Verify the signature
-    const isValidSignature = await this.memberVerifier.verifyMember(registration, signature);
-    if (!isValidSignature) {
-      log('Invalid signature for member registration: %s', key);
-      return { success: false, reason: 'Invalid signature' };
-    }
-
-    // Check if member is authorized to join (e.g., has a valid invitation)
-    const isAuthorized = await this.memberVerifier.isAuthorizedToJoin(strandId, key);
-    if (!isAuthorized) {
-      log('Member %s not authorized to join strand %s', key, strandId);
-      return { success: false, reason: 'Not authorized to join strand' };
-    }
-
-    // Check if already registered
-    const alreadyRegistered = await this.memberRegistry.isMemberRegistered(strandId, key);
-    if (alreadyRegistered) {
-      log('Member %s already registered in strand %s', key, strandId);
-      return { success: false, reason: 'Member already registered' };
-    }
-
-    // Register the member
-    try {
-      await this.memberRegistry.registerMember(strandId, key, peerIds);
-      log('Member %s successfully registered in strand %s', key, strandId);
-      return { success: true };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      log('Failed to register member %s: %s', key, message);
-      return { success: false, reason: `Registration failed: ${message}` };
-    }
-  }
-
-  /**
-   * Validate a member registration without actually registering
-   * Useful for pre-flight checks
-   */
-  async validateMemberRegistration(
-    registration: MemberRegistration,
-    signature: string
-  ): Promise<{ valid: boolean; reason?: string }> {
-    const { strandId, key } = registration;
-
-    if (!this.memberVerifier) {
-      return { valid: false, reason: 'MemberVerifier not configured' };
-    }
-
-    if (!this.memberRegistry) {
-      return { valid: false, reason: 'MemberRegistry not configured' };
-    }
-
-    // Verify signature
-    const isValidSignature = await this.memberVerifier.verifyMember(registration, signature);
-    if (!isValidSignature) {
-      return { valid: false, reason: 'Invalid signature' };
-    }
-
-    // Check authorization
-    const isAuthorized = await this.memberVerifier.isAuthorizedToJoin(strandId, key);
-    if (!isAuthorized) {
-      return { valid: false, reason: 'Not authorized to join strand' };
-    }
-
-    // Check if already registered
-    const alreadyRegistered = await this.memberRegistry.isMemberRegistered(strandId, key);
-    if (alreadyRegistered) {
-      return { valid: false, reason: 'Member already registered' };
-    }
-
-    return { valid: true };
-  }
-}
-
+import debug from 'debug';
+import { generateKeyPair, privateKeyToProtobuf } from '@libp2p/crypto/keys';
+import { peerIdFromPrivateKey } from '@libp2p/peer-id';
+import type {
+  CreatePeerResult,
+  MemberRegistration,
+  MemberRegistrationResult
+} from './types.js';
+
+const log = debug('sereus:cadre:enrollment');
+
+/**
+ * Interface for verifying member signatures for strand joining
+ */
+export interface MemberVerifier {
+  /**
+   * Verify that the signature is valid for the given member registration
+   * @param registration The member registration data
+   * @param signature The signature to verify
+   * @returns true if signature is valid
+   */
+  verifyMember(registration: MemberRegistration, signature: string): Promise<boolean>;
+
+  /**
+   * Check if the member key is authorized to join the strand
+   * (e.g., was invited via FormationInvite)
+   */
+  isAuthorizedToJoin(strandId: string, memberKey: string): Promise<boolean>;
+}
+
+/**
+ * Interface for registering members in a strand
+ */
+export interface MemberRegistry {
+  /**
+   * Register a member in the strand's member list
+   */
+  registerMember(strandId: string, memberKey: string, peerIds: string[]): Promise<void>;
+
+  /**
+   * Check if a member is already registered in the strand
+   */
+  isMemberRegistered(strandId: string, memberKey: string): Promise<boolean>;
+}
+
+/**
+ * Enrollment API for creating peer identities and managing strand membership
+ *
+ * Peer Creation:
+ *   `createCadrePeer()` generates an Ed25519 keypair for a new node.
+ *   For cadre peer authorization, use the Seed Bootstrap API instead.
+ *
+ * Member Registration:
+ *   Accept invitations to join strands as a member.
+ */
+export class EnrollmentService {
+  private readonly memberVerifier?: MemberVerifier;
+  private readonly memberRegistry?: MemberRegistry;
+
+  constructor(options?: {
+    memberVerifier?: MemberVerifier;
+    memberRegistry?: MemberRegistry;
+  }) {
+    this.memberVerifier = options?.memberVerifier;
+    this.memberRegistry = options?.memberRegistry;
+    log('EnrollmentService created');
+  }
+
+  /**
+   * Create a new cadre peer identity
+   *
+   * Generates a new Ed25519 keypair for a cadre node.
+   * The private key should be stored securely by the node.
+   * The PeerId can be used with the Seed Bootstrap API for authorization.
+   */
+  async createCadrePeer(): Promise<CreatePeerResult> {
+    log('Creating new cadre peer identity');
+
+    // Generate Ed25519 keypair (same as libp2p uses)
+    const privateKey = await generateKeyPair('Ed25519');
+    const peerId = peerIdFromPrivateKey(privateKey);
+
+    // Export private key as protobuf bytes for storage
+    const privateKeyBytes = privateKeyToProtobuf(privateKey);
+
+    log('Created peer with ID: %s', peerId.toString());
+
+    return {
+      peerId,
+      privateKey: privateKeyBytes
+    };
+  }
+
+  // ============================================================================
+  // Member Registration API
+  // ============================================================================
+
+  /**
+   * Register a member into a strand.
+   *
+   * Called by an invited party to accept an invitation and join as a member.
+   * The signature proves ownership of the member key.
+   *
+   * @param registration The member registration data (strandId, key, peerIds)
+   * @param signature Signature over the registration proving key ownership
+   * @returns Success/failure with optional reason
+   */
+  async registerMember(
+    registration: MemberRegistration,
+    signature: string
+  ): Promise<MemberRegistrationResult> {
+    const { strandId, key, peerIds } = registration;
+
+    log('Registering member %s for strand %s with %d peers', key, strandId, peerIds.length);
+
+    // Check required dependencies
+    if (!this.memberVerifier) {
+      log('MemberVerifier not configured');
+      return { success: false, reason: 'MemberVerifier not configured' };
+    }
+
+    if (!this.memberRegistry) {
+      log('MemberRegistry not configured');
+      return { success: false, reason: 'MemberRegistry not configured' };
+    }
+
+    // Verify the signature
+    const isValidSignature = await this.memberVerifier.verifyMember(registration, signature);
+    if (!isValidSignature) {
+      log('Invalid signature for member registration: %s', key);
+      return { success: false, reason: 'Invalid signature' };
+    }
+
+    // Check if member is authorized to join (e.g., has a valid invitation)
+    const isAuthorized = await this.memberVerifier.isAuthorizedToJoin(strandId, key);
+    if (!isAuthorized) {
+      log('Member %s not authorized to join strand %s', key, strandId);
+      return { success: false, reason: 'Not authorized to join strand' };
+    }
+
+    // Check if already registered
+    const alreadyRegistered = await this.memberRegistry.isMemberRegistered(strandId, key);
+    if (alreadyRegistered) {
+      log('Member %s already registered in strand %s', key, strandId);
+      return { success: false, reason: 'Member already registered' };
+    }
+
+    // Register the member
+    try {
+      await this.memberRegistry.registerMember(strandId, key, peerIds);
+      log('Member %s successfully registered in strand %s', key, strandId);
+      return { success: true };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      log('Failed to register member %s: %s', key, message);
+      return { success: false, reason: `Registration failed: ${message}` };
+    }
+  }
+
+  /**
+   * Validate a member registration without actually registering
+   * Useful for pre-flight checks
+   */
+  async validateMemberRegistration(
+    registration: MemberRegistration,
+    signature: string
+  ): Promise<{ valid: boolean; reason?: string }> {
+    const { strandId, key } = registration;
+
+    if (!this.memberVerifier) {
+      return { valid: false, reason: 'MemberVerifier not configured' };
+    }
+
+    if (!this.memberRegistry) {
+      return { valid: false, reason: 'MemberRegistry not configured' };
+    }
+
+    // Verify signature
+    const isValidSignature = await this.memberVerifier.verifyMember(registration, signature);
+    if (!isValidSignature) {
+      return { valid: false, reason: 'Invalid signature' };
+    }
+
+    // Check authorization
+    const isAuthorized = await this.memberVerifier.isAuthorizedToJoin(strandId, key);
+    if (!isAuthorized) {
+      return { valid: false, reason: 'Not authorized to join strand' };
+    }
+
+    // Check if already registered
+    const alreadyRegistered = await this.memberRegistry.isMemberRegistered(strandId, key);
+    if (alreadyRegistered) {
+      return { valid: false, reason: 'Member already registered' };
+    }
+
+    return { valid: true };
+  }
+}
+