@serfab/cadre-core 0.6.0 → 0.8.1

package/dist/push-notifier.js

@@ -0,0 +1,50 @@
+/**
+ * push-notifier.ts — the platform-push **delivery** seam for strand-wake.
+ *
+ * Given a resolved mobile peer token, send one `strand-wake` data message over
+ * the right platform channel (FCM for Android, APNs for iOS). This module owns no
+ * policy — *who* to wake and *when* is the fan-out (`push-fanout.ts`). It is the
+ * reusable, credential-injected, transport-injected unit the fan-out constructs
+ * inside a participating `CadreNode` when push credentials are configured.
+ *
+ * `createPushNotifier` returns a router that dispatches by `msg.platform` to an
+ * `FcmPushNotifier` and/or `ApnsPushNotifier`, constructing only the
+ * implementations whose credentials are present. Failures are values, never
+ * thrown — mirroring `ServiceWakeResult` / `resolveDeviceToken`'s no-throw
+ * conventions so a best-effort fan-out can branch on the outcome.
+ *
+ * Server-only by construction: the FCM/APNs implementations reach for
+ * `node:crypto` / `node:http2`. They are never pulled into the RN/browser bundle
+ * because the cross-platform `index.ts` re-exports only the *types* here (a
+ * type-only re-export is erased at emit), and the only runtime constructor of a
+ * notifier is the in-package fan-out that runs inside a Node `CadreNode`. A
+ * cross-platform consumer imports the payload contract + types, never this value.
+ */
+import { createFcmPushNotifier } from './push-notifier-fcm.js';
+import { createApnsPushNotifier } from './push-notifier-apns.js';
+/**
+ * Build a {@link PushNotifier} router over the configured credentials. Only the
+ * platforms whose credentials are present get a backing implementation; a `send`
+ * for an unconfigured platform returns a best-effort `no <platform> credentials`
+ * failure rather than throwing.
+ */
+export function createPushNotifier(creds, deps = {}) {
+    const fcm = creds.fcm ? createFcmPushNotifier(creds.fcm, deps.fcm) : undefined;
+    const apns = creds.apns ? createApnsPushNotifier(creds.apns, deps.apns) : undefined;
+    async function send(msg) {
+        if (msg.platform === 'fcm')
+            return fcm ? fcm.send(msg) : noCreds('fcm');
+        if (msg.platform === 'apns')
+            return apns ? apns.send(msg) : noCreds('apns');
+        return { ok: false, unregistered: false, error: `unknown platform ${String(msg.platform)}` };
+    }
+    async function close() {
+        await Promise.all([fcm?.close(), apns?.close()]);
+    }
+    return { send, close };
+}
+/** Best-effort no-op result for a platform with no configured credentials. */
+function noCreds(platform) {
+    return { ok: false, unregistered: false, error: `no ${platform} credentials` };
+}
+//# sourceMappingURL=push-notifier.js.map

package/dist/push-notifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notifier.js","sourceRoot":"","sources":["../src/push-notifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAqB,MAAM,yBAAyB,CAAC;AAwCpF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,OAAyB,EAAE;IACpF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpF,KAAK,UAAU,IAAI,CAAC,GAAgB;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,QAAsB;IACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,cAAc,EAAE,CAAC;AACjF,CAAC"}

package/dist/schema-verification.d.ts

@@ -31,7 +31,16 @@ export declare function verifySchema(schema: string, version: string, signature:
  * Assert that an SAppConfig has a valid schema signature.
  * Throws SchemaVerificationError on failure.
  *
+ * Fail-closed by default: when `options.requireSignature` is not explicitly
+ * `false`, an absent signature is rejected with reason `'missing signature'`,
+ * distinct from the `'invalid signature'` (tampered/wrong-key) case. The
+ * relaxation (`requireSignature: false`) only excuses *absence* of a signature;
+ * a present-but-bad signature still throws.
+ *
  * @param sAppConfig - The sApp configuration to verify
- * @throws SchemaVerificationError if the signature is invalid
+ * @param options - Verification policy; `requireSignature` defaults to `true`
+ * @throws SchemaVerificationError if the signature is missing (when required) or invalid
  */
-export declare function assertSchemaSignature(sAppConfig: SAppConfig): void;
+export declare function assertSchemaSignature(sAppConfig: SAppConfig, options?: {
+    requireSignature?: boolean;
+}): void;

package/dist/schema-verification.js

@@ -18,7 +18,7 @@ export class SchemaVerificationError extends Error {
  */
 function schemaDigest(schema, version) {
     const payload = JSON.stringify({ schema, version });
-    return digest(payload, 'sha256', 'utf8', 'base64url');
+    return digest([payload], 'sha256', 'base64url');
 }
 /**
  * Sign an sApp schema with the author's ed25519 private key.
@@ -56,13 +56,24 @@ export function verifySchema(schema, version, signature, authorPublicKey) {
  * Assert that an SAppConfig has a valid schema signature.
  * Throws SchemaVerificationError on failure.
  *
+ * Fail-closed by default: when `options.requireSignature` is not explicitly
+ * `false`, an absent signature is rejected with reason `'missing signature'`,
+ * distinct from the `'invalid signature'` (tampered/wrong-key) case. The
+ * relaxation (`requireSignature: false`) only excuses *absence* of a signature;
+ * a present-but-bad signature still throws.
+ *
  * @param sAppConfig - The sApp configuration to verify
- * @throws SchemaVerificationError if the signature is invalid
+ * @param options - Verification policy; `requireSignature` defaults to `true`
+ * @throws SchemaVerificationError if the signature is missing (when required) or invalid
  */
-export function assertSchemaSignature(sAppConfig) {
+export function assertSchemaSignature(sAppConfig, options) {
     const { id, version, schema, signature } = sAppConfig;
+    const requireSignature = options?.requireSignature ?? true;
     if (!signature) {
-        log('No signature provided for %s v%s — skipping verification', id, version);
+        if (requireSignature) {
+            throw new SchemaVerificationError(id ?? '', version, 'missing signature');
+        }
+        log('No signature provided for %s v%s — skipping verification (policy relaxed)', id, version);
         return;
     }
     if (!id) {

package/dist/schema-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-verification.js","sourceRoot":"","sources":["../src/schema-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGzE,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YACkB,MAAc,EACd,OAAe,EAC/B,MAAc;QAEd,KAAK,CAAC,uCAAuC,MAAM,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ9D,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QAI/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAW,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,gBAAwB;IAClF,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,SAAiB,EAAE,eAAuB;IACtG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IAEtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,0DAA0D,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"schema-verification.js","sourceRoot":"","sources":["../src/schema-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGzE,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YACkB,MAAc,EACd,OAAe,EAC/B,MAAc;QAEd,KAAK,CAAC,uCAAuC,MAAM,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ9D,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QAI/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,gBAAwB;IAClF,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,SAAiB,EAAE,eAAuB;IACtG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAsB,EACtB,OAAwC;IAExC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IACtD,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;IAE3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,2EAA2E,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/seed-bootstrap.d.ts

@@ -1,8 +1,39 @@
 import type { Libp2p } from '@libp2p/interface';
-import type { ControlNetworkSeed, SeedAckMessage, AuthorizePeerOptions, ApplySeedResult, AddDroneOptions, AddPhoneOptions, DroneInitResult, InviteResult, CadreInvite } from './types.js';
+import type { ControlNetworkSeed, SeedAckMessage, AuthorizePeerOptions, ApplySeedResult, AddDroneOptions, AddPhoneOptions, DroneInitResult, InviteResult, CadreInvite, PeerAddressRecord, DeviceTokenRecord } from './types.js';
 import type { ControlDatabase } from './control-database.js';
+import { type SeedTrustPolicy } from './seed-trust-policy.js';
 /** Protocol ID for seed delivery */
 export declare const SEED_PROTOCOL = "/sereus/seed/1.0.0";
+/**
+ * Decode a 4-byte big-endian length-prefixed frame; returns the body bytes.
+ *
+ * Guards every parse site against malformed input: a buffer too short to hold
+ * the prefix, a declared length exceeding `maxLength`, and a declared length
+ * exceeding the bytes actually present. Returns a view (`subarray`, no copy) —
+ * the body is handed straight to `TextDecoder`.
+ */
+export declare function decodeLengthPrefixedFrame(data: Uint8Array, maxLength?: number): Uint8Array;
+/**
+ * Derive the base64url ed25519 public key embedded in an Ed25519 libp2p PeerId.
+ *
+ * An Ed25519 PeerId is an identity multihash of the public key, so
+ * `peerIdFromString(id).publicKey.raw` is the 32-byte ed25519 key whose
+ * base64url form matches the `AuthorityKey.Key` representation (and
+ * `authorityKeyFromLibp2p().publicKeyB64`). Returns null for a non-Ed25519
+ * id, a missing embedded key, or any parse failure — callers treat null as
+ * "not an authority" rather than throwing.
+ */
+export declare function ed25519PublicKeyB64FromPeerId(peerId: string): string | null;
+/**
+ * Canonical byte representation of the authenticated seed fields.
+ *
+ * Routes both the creator (`createSeed`) and the verifier
+ * (`validateSeedSignature`) through one builder so the signed bytes are
+ * identical regardless of key insertion order. `canonicalJson` sorts keys and
+ * drops `undefined`, so the signed payload is exactly `{ partyId, peers }` —
+ * the fields the producer actually emits.
+ */
+export declare function canonicalSeedPayload(seed: Pick<ControlNetworkSeed, 'partyId' | 'peers'>): string;
 /**
  * Configuration for the SeedBootstrapService
  */
@@ -13,6 +44,37 @@ export interface SeedBootstrapConfig {
     authorityPrivateKey?: string;
     /** Authority public key (base64url) - derived from private key if not provided */
     authorityPublicKey?: string;
+    /**
+     * Optional async resolver returning the multiaddrs to embed in invites.
+     * When unset, `libp2pNode.getMultiaddrs()` is used. Hosts behind NAT supply
+     * this (via `@serfab/cadre-host`'s NatService) to substitute the host's
+     * DDNS hostname and externally-mapped port.
+     */
+    inviteAddressResolver?: () => Promise<string[]>;
+    /**
+     * Trust anchor for incoming seeds. Decides whether a signature-verified
+     * `signerKey` should be trusted, against the receiver's known authority
+     * keys (NOT the seed body). Defaults to `dbAnchoredTrustPolicy()`, which
+     * rejects any signer not already in the `AuthorityKey` table. An enrollment
+     * caller can pass a per-seed override to `applySeed` instead.
+     *
+     * A `CadreNode` forwards its node-wide `CadreNodeConfig.seedTrustPolicy` here
+     * — that is the only seam the inbound libp2p seed-protocol handler can use,
+     * since a network-delivered seed has no per-call override.
+     */
+    trustPolicy?: SeedTrustPolicy;
+    /**
+     * Time the inbound seed handler waits for the seed frame before aborting the
+     * read (ms). Defaults to {@link DEFAULT_SEED_READ_TIMEOUT_MS}. Bounds a
+     * buggy/compromised own-cadre node that opens a stream and never half-closes.
+     */
+    seedReadTimeoutMs?: number;
+    /**
+     * Cap on concurrent inbound seed streams (defaults to
+     * {@link DEFAULT_MAX_CONCURRENT_SEEDS}). Over the cap, a non-accepting ack is
+     * returned without applying any seed.
+     */
+    maxConcurrentSeeds?: number;
 }
 /**
  * Event callbacks for seed-related events
@@ -30,13 +92,18 @@ export interface SeedEventCallbacks {
  *
  * Seeds solve the cold-start problem: new nodes need control data to validate
  * connections, but can't get data without connecting first. Seeds pre-populate
- * the new node's cache with peer information and optionally transactions.
+ * the new node's cache with peer information.
  */
 export declare class SeedBootstrapService {
     private readonly config;
     private libp2pNode;
     private controlDatabase;
     private readonly authorityPublicKey;
+    private readonly trustPolicy;
+    private readonly seedReadTimeoutMs;
+    private readonly maxConcurrentSeeds;
+    /** In-flight inbound seed streams, used to enforce {@link maxConcurrentSeeds}. */
+    private activeStreams;
     private eventCallbacks;
     constructor(config: SeedBootstrapConfig);
     /**
@@ -45,14 +112,118 @@ export declare class SeedBootstrapService {
      */
     setEventCallbacks(callbacks: SeedEventCallbacks): void;
     /**
-     * Initialize the service with libp2p node and control database
+     * Whether this service holds an authority private key, i.e. can produce the
+     * authority signatures that gate `CadrePeer` / `DeviceToken` inserts, deletes,
+     * and re-authorizations. A seed-listener-only service (`enableSeedListener`,
+     * no authority key) returns false: it can receive/apply seeds but cannot author
+     * or re-issue authority writes. Used by the write-while-alone re-replication
+     * drain to skip authority work on a non-authority node.
      */
-    initialize(libp2pNode: Libp2p, controlDatabase: ControlDatabase): void;
+    canAuthorize(): boolean;
+    /**
+     * Initialize the service with libp2p node and control database.
+     *
+     * `registerHandler` (default true) gates registration of the shared inbound
+     * `/sereus/seed/1.0.0` handler on `libp2pNode`. Persistent services
+     * (`initializeSeedBootstrap`, `enableSeedListener`) own that handler and leave
+     * it on. The throwaway temp services CadreNode builds in `applySeed` /
+     * `dialInvite` pass `false`: they only need the stored `libp2pNode` /
+     * `controlDatabase` for dialing and known-key lookup, and must NOT bind a
+     * discarded closure to the shared node (a handler leak, and a second
+     * `handle()` of the same protocol throws `DuplicateProtocolHandlerError`).
+     */
+    initialize(libp2pNode: Libp2p, controlDatabase: ControlDatabase, options?: {
+        registerHandler?: boolean;
+    }): void;
     /**
      * Authorize a new peer to join the cadre.
      * Signs the peer ID with the authority key and inserts into CadrePeer table.
+     *
+     * The authority vouches the `PublicKey <-> PeerId` binding: rather than trust a
+     * caller-supplied key, the binding is enforced by construction — `PublicKey` is
+     * DERIVED from the (Ed25519) `peerId`. A non-Ed25519 peer id yields a null
+     * `PublicKey`, and such a row can never be self-updated (it has no key to
+     * verify against), which is correct. The row is inserted with a fresh
+     * `UpdatedAt` but no self-signature (`Sig` null) — the authority cannot produce
+     * the peer's self-signature, so the peer must self-publish (see
+     * {@link CadreNode.registerSelf}) before the row resolves.
      */
     authorizePeer(options: AuthorizePeerOptions): Promise<void>;
+    /**
+     * Authority-signed INSERT of this node's OWN self-signed address record.
+     *
+     * Used by {@link CadreNode.registerSelf} when the node is not yet a member and
+     * is its own authority (it holds the authority key): the row is authority-signed
+     * (satisfying `AuthorizedInsert`) AND carries a valid self-`Sig`, so it resolves
+     * immediately without a follow-up self-update.
+     */
+    insertSelfPeerRecord(record: PeerAddressRecord): Promise<void>;
+    /**
+     * Shared authority-signed `CadrePeer` INSERT. Signs `digest(peerId)` with the
+     * authority key (satisfying `AuthorizedInsert`) and writes the full record
+     * row. The authority signature does NOT cover the address columns — those are
+     * vouched only as far as the authority asserts them, and a peer's own `Sig`
+     * (when present) is what makes the row resolvable.
+     */
+    private insertCadrePeerRow;
+    /**
+     * Authority-signed INSERT of a peer's OWN self-signed `DeviceToken` row.
+     *
+     * Counterpart to {@link insertSelfPeerRecord} for the device-token registry: the
+     * row is authority-signed (satisfying `DeviceToken.AuthorizedInsert`, which vouches
+     * membership exactly as `CadrePeer.AuthorizedInsert` does) AND carries the peer's
+     * own self-`Sig` over the token payload. The authority signature covers only the
+     * PeerId — it does NOT vouch the token contents; the peer's `Sig` (verified at
+     * resolve time against the bound `CadrePeer.PublicKey`) is what makes the row
+     * resolvable. Used by {@link CadreNode.registerDeviceToken} for the first publish
+     * when the node is its own authority.
+     */
+    insertSelfDeviceToken(record: DeviceTokenRecord): Promise<void>;
+    /**
+     * Authority-signed DELETE of a peer's `DeviceToken` row (logout / token
+     * invalidation). The `DeviceToken.AuthorizedInsert` constraint gates both insert
+     * AND delete on an authority signature over `digest(old.PeerId)`, so — like
+     * {@link removePeer} for `CadrePeer` — clearing a token requires the authority key.
+     */
+    deleteDeviceToken(peerId: string): Promise<void>;
+    /**
+     * Sign a peer ID with the authority key for a `CadrePeer` / `DeviceToken`
+     * insert-or-delete. The signed bytes come from the shared
+     * {@link peerAuthorizationDigest} helper so the offline `cadre enroll register`
+     * verifier checks the exact same construction. Throws if no authority key is set.
+     */
+    private signPeerAuthorization;
+    /**
+     * Remove a peer from the cadre by authority signature.
+     *
+     * The constraint over CadrePeer's `check on insert, delete` validates a
+     * signature over `digest(old.PeerId)` by an authority key. We use the same
+     * digest pattern as authorizePeer.
+     */
+    removePeer(peerId: string): Promise<void>;
+    /**
+     * Authority "re-touch" of an existing `CadrePeer` membership row: bump
+     * `UpdatedAt` under the authority branch of `CadrePeer.AuthorizedUpdate` (a
+     * signature over `digest(peerId)` — the same construction {@link authorizePeer}
+     * uses) so the row is re-emitted as a fresh, broadcasting transaction.
+     *
+     * This is the write-while-alone re-replication primitive
+     * (`control-write-ensure-replicated`): a membership row that committed
+     * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
+     * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original
+     * INSERT) because the row already exists locally; a re-INSERT would hit the
+     * `PeerId` PK. Only the freshness stamp changes — `PublicKey` / `Multiaddr` /
+     * `Sig` are left intact — so it is safe over a row whose peer has not
+     * self-published (`Sig` null); the caller must skip a row that already carries a
+     * self-`Sig` (that row is the owning peer's to refresh, and bumping `UpdatedAt`
+     * without re-signing would invalidate its self-signature).
+     *
+     * @param peerId - the membership row to re-touch.
+     * @param updatedAt - the strictly-increasing freshness stamp to write.
+     * @throws if no authority private key is configured (a non-authority cannot
+     *   re-sign another peer's row) or the control database is not initialized.
+     */
+    reauthorizePeer(peerId: string, updatedAt: number): Promise<void>;
     /**
      * Create a seed from the current control network state.
      * The seed contains peer information and is signed by an authority.
@@ -60,9 +231,22 @@ export declare class SeedBootstrapService {
     createSeed(): Promise<ControlNetworkSeed>;
     /**
      * Apply a seed to populate the peer cache and enable connections.
-     * Validates the seed signature before applying.
+     *
+     * Validates the seed signature, then evaluates a trust anchor for the
+     * `signerKey` that does NOT come from the seed body: the receiver's
+     * `AuthorityKey` table (DB-anchored), optionally augmented by pinned keys or
+     * TOFU via the configured/overriding `SeedTrustPolicy`. A forged
+     * self-asserting seed — one that merely lists its own signer as an authority
+     * peer — no longer passes.
+     *
+     * @param seed - The seed to apply (already transport-decoded).
+     * @param options.trustPolicy - Per-call policy override (e.g. a
+     *   `pinnedKeyTrustPolicy` derived from a `CadreInvite`) used instead of the
+     *   service-configured default for this seed only.
      */
-    applySeed(seed: ControlNetworkSeed): Promise<ApplySeedResult>;
+    applySeed(seed: ControlNetworkSeed, options?: {
+        trustPolicy?: SeedTrustPolicy;
+    }): Promise<ApplySeedResult>;
     /**
      * Encode a seed for out-of-band delivery (e.g., QR code, copy/paste).
      */
@@ -86,12 +270,31 @@ export declare class SeedBootstrapService {
     validateSeedSignature(seed: ControlNetworkSeed): boolean;
     /**
      * Query peers from the control database.
+     *
+     * Authority identity is sourced from the `AuthorityKey` table, not from the
+     * transport peer ID. An Ed25519 libp2p PeerId embeds its public key (identity
+     * multihash), so each peer's ed25519 key is derivable from its `PeerId`; a
+     * peer is an authority iff that derived key is in the `AuthorityKey` set.
+     * This makes any authority node markable — not just the local one — and ties
+     * `isAuthority` to the control table rather than to `peerId === self`.
      */
     private queryPeers;
     /**
-     * Register the seed protocol handler.
+     * Register the seed protocol handler. The inbound closure just delegates to
+     * {@link handleSeedStream} — extracted as a method so it has a unit-test seam
+     * (mirroring wake's `handleStream`) the inline closure never had.
      */
     private registerProtocolHandler;
+    /**
+     * Read one inbound seed frame, apply it, and write the ack.
+     *
+     * Hardened against a buggy/compromised own-cadre node: a concurrency cap (over
+     * {@link maxConcurrentSeeds}, reply without applying), a read timeout (a peer
+     * that never half-closes is aborted inside `readStreamToEnd`), and the existing
+     * malformed/oversized-frame guard — all reported as a non-accepting
+     * {@link SeedAckMessage} rather than a dropped/hung stream.
+     */
+    private handleSeedStream;
     /**
      * Shutdown the service.
      */