@serfab/cadre-core 0.7.1 → 0.9.0

package/dist/push-notifier.d.ts

@@ -0,0 +1,52 @@
+/**
+ * push-notifier.ts — the platform-push **delivery** contract for strand-wake.
+ *
+ * This module is the cross-platform-safe *interface* half: the message shape
+ * ({@link PushMessage}), the outcome value ({@link PushSendResult}), and the
+ * {@link PushNotifier} port a `CadreNode` sends over. It carries ZERO runtime
+ * dependencies and imports no implementation — so the RN/browser entry graph can
+ * reference the type without ever resolving `node:crypto` / `node:http2`.
+ *
+ * The concrete FCM/APNs implementations (`push-notifier-fcm.ts` /
+ * `push-notifier-apns.ts`) and the `createPushNotifier` router that builds them
+ * live behind the Node-only subpath `@serfab/cadre-core/push-node`
+ * (`push-node.ts`). A Node host constructs a notifier from that subpath and
+ * injects the instance into `CadreNodeConfig.push.notifier`; the cross-platform
+ * core never constructs one, so the Node-only builtins stay out of its graph.
+ *
+ * Keep this file zero-import (beyond erased type-only imports): the whole point
+ * of the seam is that referencing the interface can never drag an implementation
+ * module into a bundler's graph.
+ */
+import type { PushPlatform } from './types.js';
+import type { StrandWakePayload } from './strand-wake-payload.js';
+/** One strand-wake data message addressed to one device. */
+export interface PushMessage {
+    /** The resolved `DeviceToken.token` for the target peer. */
+    token: string;
+    /** Which channel — selects FCM vs APNs. */
+    platform: PushPlatform;
+    /** The strand-wake payload `{ type:'strand-wake', strandId, reason }`. */
+    payload: StrandWakePayload;
+}
+/**
+ * Outcome of a single {@link PushNotifier.send}. A delivery failure is a value,
+ * never a thrown error. `unregistered: true` means the platform reported the
+ * token is permanently invalid (FCM 404 `UNREGISTERED` / 400 naming the token;
+ * APNs 410 `Unregistered` / 400 `BadDeviceToken`) — the caller should expire the
+ * stale `DeviceToken`. Any other failure is `unregistered: false` and is treated
+ * as best-effort/transient (no retry storm).
+ */
+export type PushSendResult = {
+    ok: true;
+} | {
+    ok: false;
+    unregistered: boolean;
+    error: string;
+};
+export interface PushNotifier {
+    /** Send one strand-wake data message to one device. Never throws. */
+    send(msg: PushMessage): Promise<PushSendResult>;
+    /** Release transport resources (e.g. the APNs HTTP/2 session). */
+    close(): Promise<void>;
+}

package/dist/push-notifier.js

@@ -0,0 +1,22 @@
+/**
+ * push-notifier.ts — the platform-push **delivery** contract for strand-wake.
+ *
+ * This module is the cross-platform-safe *interface* half: the message shape
+ * ({@link PushMessage}), the outcome value ({@link PushSendResult}), and the
+ * {@link PushNotifier} port a `CadreNode` sends over. It carries ZERO runtime
+ * dependencies and imports no implementation — so the RN/browser entry graph can
+ * reference the type without ever resolving `node:crypto` / `node:http2`.
+ *
+ * The concrete FCM/APNs implementations (`push-notifier-fcm.ts` /
+ * `push-notifier-apns.ts`) and the `createPushNotifier` router that builds them
+ * live behind the Node-only subpath `@serfab/cadre-core/push-node`
+ * (`push-node.ts`). A Node host constructs a notifier from that subpath and
+ * injects the instance into `CadreNodeConfig.push.notifier`; the cross-platform
+ * core never constructs one, so the Node-only builtins stay out of its graph.
+ *
+ * Keep this file zero-import (beyond erased type-only imports): the whole point
+ * of the seam is that referencing the interface can never drag an implementation
+ * module into a bundler's graph.
+ */
+export {};
+//# sourceMappingURL=push-notifier.js.map

package/dist/push-notifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notifier.js","sourceRoot":"","sources":["../src/push-notifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/schema-verification.d.ts

@@ -31,7 +31,16 @@ export declare function verifySchema(schema: string, version: string, signature:
  * Assert that an SAppConfig has a valid schema signature.
  * Throws SchemaVerificationError on failure.
  *
+ * Fail-closed by default: when `options.requireSignature` is not explicitly
+ * `false`, an absent signature is rejected with reason `'missing signature'`,
+ * distinct from the `'invalid signature'` (tampered/wrong-key) case. The
+ * relaxation (`requireSignature: false`) only excuses *absence* of a signature;
+ * a present-but-bad signature still throws.
+ *
  * @param sAppConfig - The sApp configuration to verify
- * @throws SchemaVerificationError if the signature is invalid
+ * @param options - Verification policy; `requireSignature` defaults to `true`
+ * @throws SchemaVerificationError if the signature is missing (when required) or invalid
  */
-export declare function assertSchemaSignature(sAppConfig: SAppConfig): void;
+export declare function assertSchemaSignature(sAppConfig: SAppConfig, options?: {
+    requireSignature?: boolean;
+}): void;

package/dist/schema-verification.js

@@ -18,7 +18,7 @@ export class SchemaVerificationError extends Error {
  */
 function schemaDigest(schema, version) {
     const payload = JSON.stringify({ schema, version });
-    return digest(payload, 'sha256', 'utf8', 'base64url');
+    return digest([payload], 'sha256', 'base64url');
 }
 /**
  * Sign an sApp schema with the author's ed25519 private key.
@@ -56,13 +56,24 @@ export function verifySchema(schema, version, signature, authorPublicKey) {
  * Assert that an SAppConfig has a valid schema signature.
  * Throws SchemaVerificationError on failure.
  *
+ * Fail-closed by default: when `options.requireSignature` is not explicitly
+ * `false`, an absent signature is rejected with reason `'missing signature'`,
+ * distinct from the `'invalid signature'` (tampered/wrong-key) case. The
+ * relaxation (`requireSignature: false`) only excuses *absence* of a signature;
+ * a present-but-bad signature still throws.
+ *
  * @param sAppConfig - The sApp configuration to verify
- * @throws SchemaVerificationError if the signature is invalid
+ * @param options - Verification policy; `requireSignature` defaults to `true`
+ * @throws SchemaVerificationError if the signature is missing (when required) or invalid
  */
-export function assertSchemaSignature(sAppConfig) {
+export function assertSchemaSignature(sAppConfig, options) {
     const { id, version, schema, signature } = sAppConfig;
+    const requireSignature = options?.requireSignature ?? true;
     if (!signature) {
-        log('No signature provided for %s v%s — skipping verification', id, version);
+        if (requireSignature) {
+            throw new SchemaVerificationError(id ?? '', version, 'missing signature');
+        }
+        log('No signature provided for %s v%s — skipping verification (policy relaxed)', id, version);
         return;
     }
     if (!id) {

package/dist/schema-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-verification.js","sourceRoot":"","sources":["../src/schema-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGzE,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YACkB,MAAc,EACd,OAAe,EAC/B,MAAc;QAEd,KAAK,CAAC,uCAAuC,MAAM,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ9D,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QAI/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAW,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,gBAAwB;IAClF,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,SAAiB,EAAE,eAAuB;IACtG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IAEtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,0DAA0D,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"schema-verification.js","sourceRoot":"","sources":["../src/schema-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGzE,MAAM,GAAG,GAAG,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEhD;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YACkB,MAAc,EACd,OAAe,EAC/B,MAAc;QAEd,KAAK,CAAC,uCAAuC,MAAM,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ9D,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QAI/B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,gBAAwB;IAClF,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,SAAiB,EAAE,eAAuB;IACtG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAsB,EACtB,OAAwC;IAExC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IACtD,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;IAE3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,2EAA2E,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/seed-bootstrap.d.ts

@@ -1,18 +1,49 @@
 import type { Libp2p } from '@libp2p/interface';
-import type { ControlNetworkSeed, SeedAckMessage, AuthorizePeerOptions, ApplySeedResult, AddDroneOptions, AddPhoneOptions, DroneInitResult, InviteResult, CadreInvite } from './types.js';
+import type { ControlNetworkSeed, SeedAckMessage, AuthorizePeerOptions, ApplySeedResult, AddDroneOptions, AddPhoneOptions, DroneInitResult, InviteResult, CadreInvite, PeerAddressRecord, DeviceTokenRecord } from './types.js';
 import type { ControlDatabase } from './control-database.js';
+import { type SeedTrustPolicy } from './seed-trust-policy.js';
 /** Protocol ID for seed delivery */
 export declare const SEED_PROTOCOL = "/sereus/seed/1.0.0";
+/**
+ * Decode a 4-byte big-endian length-prefixed frame; returns the body bytes.
+ *
+ * Guards every parse site against malformed input: a buffer too short to hold
+ * the prefix, a declared length exceeding `maxLength`, and a declared length
+ * exceeding the bytes actually present. Returns a view (`subarray`, no copy) —
+ * the body is handed straight to `TextDecoder`.
+ */
+export declare function decodeLengthPrefixedFrame(data: Uint8Array, maxLength?: number): Uint8Array;
+/**
+ * Derive the base64url ed25519 public key embedded in an Ed25519 libp2p PeerId.
+ *
+ * An Ed25519 PeerId is an identity multihash of the public key, so
+ * `peerIdFromString(id).publicKey.raw` is the 32-byte ed25519 key whose
+ * base64url form matches the `OwnerKey.Key` representation (and
+ * `ed25519KeyPairFromLibp2p().publicKeyB64`). Returns null for a non-Ed25519
+ * id, a missing embedded key, or any parse failure — callers treat null as
+ * "not an owner" rather than throwing.
+ */
+export declare function ed25519PublicKeyB64FromPeerId(peerId: string): string | null;
+/**
+ * Canonical byte representation of the authenticated seed fields.
+ *
+ * Routes both the creator (`createSeed`) and the verifier
+ * (`validateSeedSignature`) through one builder so the signed bytes are
+ * identical regardless of key insertion order. `canonicalJson` sorts keys and
+ * drops `undefined`, so the signed payload is exactly `{ partyId, peers }` —
+ * the fields the producer actually emits.
+ */
+export declare function canonicalSeedPayload(seed: Pick<ControlNetworkSeed, 'partyId' | 'peers'>): string;
 /**
  * Configuration for the SeedBootstrapService
  */
 export interface SeedBootstrapConfig {
     /** Party ID for this cadre */
     partyId: string;
-    /** Authority private key for signing seeds and peer authorizations (base64url) */
-    authorityPrivateKey?: string;
-    /** Authority public key (base64url) - derived from private key if not provided */
-    authorityPublicKey?: string;
+    /** Owner private key for signing seeds and peer authorizations (base64url) */
+    ownerPrivateKey?: string;
+    /** Owner public key (base64url) - derived from private key if not provided */
+    ownerPublicKey?: string;
     /**
      * Optional async resolver returning the multiaddrs to embed in invites.
      * When unset, `libp2pNode.getMultiaddrs()` is used. Hosts behind NAT supply
@@ -20,6 +51,30 @@ export interface SeedBootstrapConfig {
      * DDNS hostname and externally-mapped port.
      */
     inviteAddressResolver?: () => Promise<string[]>;
+    /**
+     * Trust anchor for incoming seeds. Decides whether a signature-verified
+     * `signerKey` should be trusted, against the receiver's known owner
+     * keys (NOT the seed body). Defaults to `dbAnchoredTrustPolicy()`, which
+     * rejects any signer not already in the `OwnerKey` table. An enrollment
+     * caller can pass a per-seed override to `applySeed` instead.
+     *
+     * A `CadreNode` forwards its node-wide `CadreNodeConfig.seedTrustPolicy` here
+     * — that is the only seam the inbound libp2p seed-protocol handler can use,
+     * since a network-delivered seed has no per-call override.
+     */
+    trustPolicy?: SeedTrustPolicy;
+    /**
+     * Time the inbound seed handler waits for the seed frame before aborting the
+     * read (ms). Defaults to {@link DEFAULT_SEED_READ_TIMEOUT_MS}. Bounds a
+     * buggy/compromised own-cadre node that opens a stream and never half-closes.
+     */
+    seedReadTimeoutMs?: number;
+    /**
+     * Cap on concurrent inbound seed streams (defaults to
+     * {@link DEFAULT_MAX_CONCURRENT_SEEDS}). Over the cap, a non-accepting ack is
+     * returned without applying any seed.
+     */
+    maxConcurrentSeeds?: number;
 }
 /**
  * Event callbacks for seed-related events
@@ -37,13 +92,18 @@ export interface SeedEventCallbacks {
  *
  * Seeds solve the cold-start problem: new nodes need control data to validate
  * connections, but can't get data without connecting first. Seeds pre-populate
- * the new node's cache with peer information and optionally transactions.
+ * the new node's cache with peer information.
  */
 export declare class SeedBootstrapService {
     private readonly config;
     private libp2pNode;
     private controlDatabase;
-    private readonly authorityPublicKey;
+    private readonly ownerPublicKey;
+    private readonly trustPolicy;
+    private readonly seedReadTimeoutMs;
+    private readonly maxConcurrentSeeds;
+    /** In-flight inbound seed streams, used to enforce {@link maxConcurrentSeeds}. */
+    private activeStreams;
     private eventCallbacks;
     constructor(config: SeedBootstrapConfig);
     /**
@@ -52,32 +112,160 @@ export declare class SeedBootstrapService {
      */
     setEventCallbacks(callbacks: SeedEventCallbacks): void;
     /**
-     * Initialize the service with libp2p node and control database
+     * Whether this service holds an owner private key, i.e. can produce the
+     * owner signatures that gate `CadrePeer` / `DeviceToken` inserts, deletes,
+     * and re-authorizations. A seed-listener-only service (`enableSeedListener`,
+     * no owner key) returns false: it can receive/apply seeds but cannot author
+     * or re-issue owner writes. Used by the write-while-alone re-replication
+     * drain to skip owner work on a non-owner node.
      */
-    initialize(libp2pNode: Libp2p, controlDatabase: ControlDatabase): void;
+    canAuthorize(): boolean;
+    /**
+     * Initialize the service with libp2p node and control database.
+     *
+     * `registerHandler` (default true) gates registration of the shared inbound
+     * `/sereus/seed/1.0.0` handler on `libp2pNode`. Persistent services
+     * (`initializeSeedBootstrap`, `enableSeedListener`) own that handler and leave
+     * it on. The throwaway temp services CadreNode builds in `applySeed` /
+     * `dialInvite` pass `false`: they only need the stored `libp2pNode` /
+     * `controlDatabase` for dialing and known-key lookup, and must NOT bind a
+     * discarded closure to the shared node (a handler leak, and a second
+     * `handle()` of the same protocol throws `DuplicateProtocolHandlerError`).
+     */
+    initialize(libp2pNode: Libp2p, controlDatabase: ControlDatabase, options?: {
+        registerHandler?: boolean;
+    }): void;
     /**
      * Authorize a new peer to join the cadre.
-     * Signs the peer ID with the authority key and inserts into CadrePeer table.
+     * Signs the peer ID with the owner key and inserts into CadrePeer table.
+     *
+     * The owner vouches the `PublicKey <-> PeerId` binding: rather than trust a
+     * caller-supplied key, the binding is enforced by construction — `PublicKey` is
+     * DERIVED from the (Ed25519) `peerId`. A non-Ed25519 peer id yields a null
+     * `PublicKey`, and such a row can never be self-updated (it has no key to
+     * verify against), which is correct. The row is inserted with a fresh
+     * `UpdatedAt` but no self-signature (`Sig` null) — the owner cannot produce
+     * the peer's self-signature, so the peer must self-publish (see
+     * {@link CadreNode.registerSelf}) before the row resolves.
      */
     authorizePeer(options: AuthorizePeerOptions): Promise<void>;
     /**
-     * Remove a peer from the cadre by authority signature.
+     * Owner-signed INSERT of this node's OWN self-signed address record.
+     *
+     * Used by {@link CadreNode.registerSelf} when the node is not yet a member and
+     * is its own owner (it holds the owner key): the row is owner-signed
+     * (satisfying `AuthorizedInsert`) AND carries a valid self-`Sig`, so it resolves
+     * immediately without a follow-up self-update.
+     */
+    insertSelfPeerRecord(record: PeerAddressRecord): Promise<void>;
+    /**
+     * Shared owner-signed `CadrePeer` INSERT. Mints a fresh single-use `StampId`
+     * and signs the voucher digest `digest(peerId, stampId)` ({@link cadrePeerVoucherDigest})
+     * with the owner key (satisfying `AuthorizedInsert`), then writes the full record
+     * row with the vouching (owner, signature) persisted into VouchOwner/VouchSig.
+     * The owner signature does NOT cover the address columns — those are vouched only
+     * as far as the owner asserts them, and a peer's own `Sig` (when present) is what
+     * makes the row resolvable.
+     */
+    private insertCadrePeerRow;
+    /**
+     * Owner-signed INSERT of a peer's OWN self-signed `DeviceToken` row.
      *
-     * The constraint over CadrePeer's `check on insert, delete` validates a
-     * signature over `digest(old.PeerId, 'sha256', 'utf8')` by an authority
-     * key. We use the same digest pattern as authorizePeer.
+     * Counterpart to {@link insertSelfPeerRecord} for the device-token registry: the
+     * row is owner-signed (satisfying `DeviceToken.AuthorizedInsert`, which vouches
+     * membership exactly as `CadrePeer.AuthorizedInsert` does) AND carries the peer's
+     * own self-`Sig` over the token payload. The owner signature covers only the
+     * PeerId — it does NOT vouch the token contents; the peer's `Sig` (verified at
+     * resolve time against the bound `CadrePeer.PublicKey`) is what makes the row
+     * resolvable. Used by {@link CadreNode.registerDeviceToken} for the first publish
+     * when the node is its own owner.
+     */
+    insertSelfDeviceToken(record: DeviceTokenRecord): Promise<void>;
+    /**
+     * Owner-signed DELETE of a peer's `DeviceToken` row (logout / token
+     * invalidation). The `DeviceToken.AuthorizedInsert` constraint gates both insert
+     * AND delete on an owner signature over `digest(old.PeerId)`, so — like
+     * {@link removePeer} for `CadrePeer` — clearing a token requires the owner key.
+     */
+    deleteDeviceToken(peerId: string): Promise<void>;
+    /**
+     * Sign a peer ID with the owner key for a `CadrePeer` / `DeviceToken`
+     * insert-or-delete. The signed bytes come from the shared
+     * {@link peerAuthorizationDigest} helper so the offline `cadre enroll register`
+     * verifier checks the exact same construction. Throws if no owner key is set.
+     */
+    private signPeerAuthorization;
+    /**
+     * Return the configured owner private key, or throw if none is set. The single
+     * precondition gate for every owner-signed write. {@link removePeer} /
+     * {@link reauthorizePeer} read the row's `StampId` from the DB BEFORE they sign, so
+     * they call this up front — otherwise a keyless service would either surface the
+     * wrong "Control database not initialized" error or, worse, silently no-op when the
+     * target row is absent (the early `stampId === null` return) instead of rejecting.
+     */
+    private requireOwnerPrivateKey;
+    /**
+     * Sign a base64url digest with the owner key (ed25519). The single place the
+     * owner private key is applied; callers pass the canonical digest for the specific
+     * action ({@link cadrePeerVoucherDigest} / {@link cadrePeerRemoveDigest} /
+     * {@link peerAuthorizationDigest}). Throws if no owner key is set.
+     */
+    private signDigest;
+    /**
+     * Remove a peer from the cadre by owner signature.
+     *
+     * The `CadrePeer.AuthorizedDelete` (`check on delete`) constraint validates a
+     * signature over the DISTINCT 'remove'-scoped digest `digest(old.PeerId, old.StampId,
+     * 'remove')` ({@link cadrePeerRemoveDigest}) by an owner key — deliberately NOT the
+     * insert voucher digest, so the row's stored `VouchSig` can never be replayed to delete.
      */
     removePeer(peerId: string): Promise<void>;
+    /**
+     * Owner "re-touch" of an existing `CadrePeer` membership row: bump
+     * `UpdatedAt` under the owner branch of `CadrePeer.AuthorizedUpdate` (a
+     * signature over `digest(peerId)` — the same construction {@link authorizePeer}
+     * uses) so the row is re-emitted as a fresh, broadcasting transaction.
+     *
+     * This is the write-while-alone re-replication primitive
+     * (`control-write-ensure-replicated`): a membership row that committed
+     * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
+     * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original
+     * INSERT) because the row already exists locally; a re-INSERT would hit the
+     * `PeerId` PK. Only the freshness stamp changes — `PublicKey` / `Multiaddr` /
+     * `Sig` are left intact — so it is safe over a row whose peer has not
+     * self-published (`Sig` null); the caller must skip a row that already carries a
+     * self-`Sig` (that row is the owning peer's to refresh, and bumping `UpdatedAt`
+     * without re-signing would invalidate its self-signature).
+     *
+     * @param peerId - the membership row to re-touch.
+     * @param updatedAt - the strictly-increasing freshness stamp to write.
+     * @throws if no owner private key is configured (a non-owner cannot
+     *   re-sign another peer's row) or the control database is not initialized.
+     */
+    reauthorizePeer(peerId: string, updatedAt: number): Promise<void>;
     /**
      * Create a seed from the current control network state.
-     * The seed contains peer information and is signed by an authority.
+     * The seed contains peer information and is signed by an owner.
      */
     createSeed(): Promise<ControlNetworkSeed>;
     /**
      * Apply a seed to populate the peer cache and enable connections.
-     * Validates the seed signature before applying.
+     *
+     * Validates the seed signature, then evaluates a trust anchor for the
+     * `signerKey` that does NOT come from the seed body: the receiver's
+     * `OwnerKey` table (DB-anchored), optionally augmented by pinned keys or
+     * TOFU via the configured/overriding `SeedTrustPolicy`. A forged
+     * self-asserting seed — one that merely lists its own signer as an owner
+     * peer — no longer passes.
+     *
+     * @param seed - The seed to apply (already transport-decoded).
+     * @param options.trustPolicy - Per-call policy override (e.g. a
+     *   `pinnedKeyTrustPolicy` derived from a `CadreInvite`) used instead of the
+     *   service-configured default for this seed only.
      */
-    applySeed(seed: ControlNetworkSeed): Promise<ApplySeedResult>;
+    applySeed(seed: ControlNetworkSeed, options?: {
+        trustPolicy?: SeedTrustPolicy;
+    }): Promise<ApplySeedResult>;
     /**
      * Encode a seed for out-of-band delivery (e.g., QR code, copy/paste).
      */
@@ -101,12 +289,31 @@ export declare class SeedBootstrapService {
     validateSeedSignature(seed: ControlNetworkSeed): boolean;
     /**
      * Query peers from the control database.
+     *
+     * Owner identity is sourced from the `OwnerKey` table, not from the
+     * transport peer ID. An Ed25519 libp2p PeerId embeds its public key (identity
+     * multihash), so each peer's ed25519 key is derivable from its `PeerId`; a
+     * peer is an owner iff that derived key is in the `OwnerKey` set.
+     * This makes any owner node markable — not just the local one — and ties
+     * `isOwner` to the control table rather than to `peerId === self`.
      */
     private queryPeers;
     /**
-     * Register the seed protocol handler.
+     * Register the seed protocol handler. The inbound closure just delegates to
+     * {@link handleSeedStream} — extracted as a method so it has a unit-test seam
+     * (mirroring wake's `handleStream`) the inline closure never had.
      */
     private registerProtocolHandler;
+    /**
+     * Read one inbound seed frame, apply it, and write the ack.
+     *
+     * Hardened against a buggy/compromised own-cadre node: a concurrency cap (over
+     * {@link maxConcurrentSeeds}, reply without applying), a read timeout (a peer
+     * that never half-closes is aborted inside `readStreamToEnd`), and the existing
+     * malformed/oversized-frame guard — all reported as a non-accepting
+     * {@link SeedAckMessage} rather than a dropped/hung stream.
+     */
+    private handleSeedStream;
     /**
      * Shutdown the service.
      */
@@ -169,11 +376,11 @@ export declare class SeedBootstrapService {
      */
     decodeInvite(encoded: string): CadreInvite;
     /**
-     * Dial an authority from an invite.
-     * Use this on a phone after receiving an invite to connect to the authority.
+     * Dial an owner from an invite.
+     * Use this on a phone after receiving an invite to connect to the owner.
      *
      * @param invite - The invite received out-of-band
-     * @returns Connection to the authority
+     * @returns Connection to the owner
      */
     dialInvite(invite: CadreInvite): Promise<void>;
 }