@serfab/cadre-core 0.8.1 → 0.9.0

package/src/device-token.ts

@@ -43,7 +43,7 @@ export function deviceTokenSignedPayload(record: Omit<DeviceTokenRecord, 'sig'>)
  * Returns a fully-populated {@link DeviceTokenRecord}.
  *
  * @param fields - the record fields to sign
- * @param privateKeyB64 - base64url ed25519 seed (see `authorityKeyFromLibp2p`)
+ * @param privateKeyB64 - base64url ed25519 seed (see `ed25519KeyPairFromLibp2p`)
  */
 export function signDeviceTokenRecord(
   fields: Omit<DeviceTokenRecord, 'sig'>,

package/src/{authority-key.ts → ed25519-key.ts}

@@ -3,10 +3,12 @@ import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
 import type { PrivateKey } from '@libp2p/interface';
 
 /**
- * A household authority keypair expressed in the base64url Ed25519 form that
+ * An Ed25519 keypair expressed in the base64url form that
  * `@optimystic/quereus-plugin-crypto` (`sign`/`verify`/`getPublicKey`) consumes.
+ * Generic bridge type — reused for owner keys, member keys, and any other
+ * seed→public keypair the control/strand databases sign with.
  */
-export interface AuthorityKeyPair {
+export interface Ed25519KeyPair {
   /** 32-byte Ed25519 seed, base64url-encoded — the crypto-plugin private key. */
   privateKeyB64: string;
   /** 32-byte Ed25519 public key, base64url-encoded. */
@@ -15,23 +17,23 @@ export interface AuthorityKeyPair {
 
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
- * control-database authority constraints.
+ * control- and strand-database signing constraints.
  *
  * libp2p stores an Ed25519 private key as 64 raw bytes: the first 32 are the
  * seed (the actual scalar source), the last 32 are the public key — see
  * `@libp2p/crypto`'s `Ed25519PrivateKey`. `@optimystic/quereus-plugin-crypto`
  * (via `@noble/curves`) treats the 32-byte seed *as* the private key and
  * derives the public key from it with standard Ed25519. The two derivations
- * agree, so the node's peer identity and its authority key are one keypair:
+ * agree, so the node's peer identity and its signing key are one keypair:
  * `getPublicKey(privateKeyB64)` === `publicKeyB64`.
  *
  * @param privateKey - The node's libp2p Ed25519 private key.
- * @returns The base64url seed/public-key pair for authority operations.
+ * @returns The base64url seed/public-key pair for signing operations.
  * @throws If the key is not Ed25519 or the raw bytes aren't the expected length.
  */
-export function authorityKeyFromLibp2p(privateKey: PrivateKey): AuthorityKeyPair {
+export function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed25519KeyPair {
   if (privateKey.type !== 'Ed25519') {
-    throw new Error(`authorityKeyFromLibp2p requires an Ed25519 key, got ${privateKey.type}`);
+    throw new Error(`ed25519KeyPairFromLibp2p requires an Ed25519 key, got ${privateKey.type}`);
   }
 
   const raw = privateKey.raw;
@@ -55,14 +57,13 @@ export function authorityKeyFromLibp2p(privateKey: PrivateKey): AuthorityKeyPair
  * Derive the base64url Ed25519 public key from a base64url 32-byte private seed
  * — the same derivation the seed-bootstrap signer uses internally
  * (`SeedBootstrapService` constructor). Use this to enroll a standalone
- * (non-libp2p) authority key into the control DB via
- * `ControlDatabase.ensureAuthorityKey` before minting an invite, when the
- * authority key is *not* the node's peer identity (so `authorityKeyFromLibp2p`,
+ * (non-libp2p) key into the control DB before minting an invite, when the
+ * key is *not* the node's peer identity (so `ed25519KeyPairFromLibp2p`,
  * which needs a libp2p key object, does not apply).
  *
  * @param privateKeyB64 - The base64url-encoded 32-byte Ed25519 seed.
  * @returns The base64url-encoded Ed25519 public key.
  */
-export function authorityPublicKeyFromPrivate(privateKeyB64: string): string {
+export function ed25519PublicKeyFromPrivate(privateKeyB64: string): string {
   return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url') as string;
 }

package/src/index.ts

@@ -10,10 +10,10 @@ export { CadreNode } from './cadre-node.js';
 // Control database
 export { ControlDatabase, buildAuthorizationMessage, type ControlDatabaseConfig, type ControlTable } from './control-database.js';
 
-// Authority key bridge (libp2p Ed25519 -> base64url authority keypair)
-export { authorityKeyFromLibp2p, authorityPublicKeyFromPrivate, type AuthorityKeyPair } from './authority-key.js';
+// Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, type Ed25519KeyPair } from './ed25519-key.js';
 
-// Pluggable key store (backend-agnostic identity/authority key material seam).
+// Pluggable key store (backend-agnostic identity/owner key material seam).
 // Dependency-free: the interface, error, default slot id, and in-memory backend
 // are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
 // separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
@@ -81,11 +81,11 @@ export {
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 
 // Closed-strand member key generation (ed25519 protobuf, base64) + the
-// protobuf->base64url bridge that derives the founding Member/Authority key.
+// protobuf->base64url bridge that derives the founding Member/Manager key.
 export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
 
 // Strand membership writer (founder bootstrap, invite issuance/consumption,
-// authority-admit, member-peer registration, authority rotation, + shared signing
+// manager-admit, member-peer registration, manager rotation, + shared signing
 // primitives reused across the flows).
 export {
   signStrandPayload,
@@ -93,20 +93,20 @@ export {
   bootstrapFounderMembership,
   issueInvite,
   consumeInvite,
-  addMemberByAuthority,
+  addMemberByManager,
   registerMemberPeer,
-  addAuthority,
-  removeAuthority,
+  addManager,
+  removeManager,
   STRAND_ENGINE,
   STRAND_ENGINE_VERSION,
   type FounderBootstrapParams,
   type IssueInviteParams,
   type IssuedInvite,
   type ConsumeInviteParams,
-  type AddMemberByAuthorityParams,
+  type AddMemberByManagerParams,
   type RegisterMemberPeerParams,
-  type AddAuthorityParams,
-  type RemoveAuthorityParams
+  type AddManagerParams,
+  type RemoveManagerParams
 } from './strand-membership-writer.js';
 
 // Engine-canonical datetime helper (shared by control + strand signed-write flows
@@ -131,9 +131,11 @@ export {
   type SeedEventCallbacks
 } from './seed-bootstrap.js';
 
-// Peer Authorization (shared authority-signature digest + offline verifier)
+// Peer Authorization (shared owner-signature digest + offline verifier)
 export {
   peerAuthorizationDigest,
+  cadrePeerVoucherDigest,
+  cadrePeerRemoveDigest,
   verifyPeerAuthorization
 } from './peer-authorization.js';
 
@@ -181,13 +183,13 @@ export {
 // Strand-wake payload contract (canonical; shared by the server sender + RN receiver)
 export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.js';
 
-// Platform push delivery — server-only PushNotifier (FCM HTTP v1 / APNs HTTP/2).
-// TYPES ONLY here: the implementations import node:http2/node:crypto and are
-// constructed solely by `CadreNode.start` (via a guarded dynamic import) when
-// push credentials are configured. A type-only re-export is erased at emit, so the
-// cross-platform (RN/browser) entry graph never pulls these modules in.
-// `createPushNotifier` is imported directly from './push-notifier.js' only by that
-// dynamic import, never re-exported as a runtime value.
+// Platform push delivery — the cross-platform `PushNotifier` *contract* only.
+// The FCM/APNs implementations (node:http2/node:crypto) and the
+// `createPushNotifier` router that builds them live behind the Node-only subpath
+// `@serfab/cadre-core/push-node` (`push-node.ts`), never in this graph. A Node
+// host constructs a notifier from that subpath and injects the instance into
+// `CadreNodeConfig.push.notifier`. These re-exports are type-only (erased at
+// emit), so the RN/browser entry graph never pulls the Node modules in.
 export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
 
 // Push-credential validation + log redaction. Dependency-free (type-only imports),

package/src/key-store.ts

@@ -2,7 +2,7 @@
  * Backend-agnostic store for raw private key material.
  *
  * Mobile cadre nodes hold sensitive key material at rest: the libp2p
- * peer/node identity key and (in the single-key reference model) the authority
+ * peer/node identity key and (in the single-key reference model) the owner
  * signing key derived from it. This module defines the seam those keys flow
  * through so a platform-secure backend (iOS Keychain / Android Keystore) can be
  * plugged in without `@serfab/cadre-core` taking any platform dependency.

package/src/peer-authorization.ts

@@ -4,12 +4,12 @@ import { digest, verify } from '@optimystic/quereus-plugin-crypto';
 const log = debug('sereus:cadre:peer-authorization');
 
 /**
- * Canonical digest an authority signs to authorize a peer.
+ * Canonical digest an owner signs to authorize a peer.
  *
  * This is the exact byte construction {@link SeedBootstrapService.authorizePeer}
  * signs over when it inserts an authorized `CadrePeer` row:
  * `digest([peerId], 'sha256', 'base64url')`. Factored into one place so the
- * producer (authority signing) and the verifier (the offline `cadre enroll
+ * producer (owner signing) and the verifier (the offline `cadre enroll
  * register` check) can never drift apart — change the digest here and both move
  * together. The SQL mirror is the bare single-field `digest(coalesce(new.PeerId, old.PeerId))`.
  */
@@ -18,13 +18,41 @@ export function peerAuthorizationDigest(peerId: string): string {
 }
 
 /**
- * Verify that `signature` is a valid authority ed25519 signature over `peerId`'s
- * authorization digest, using `authorityPublicKey` (base64url).
+ * Canonical digest an owner signs to VOUCH a `CadrePeer` membership row (insert
+ * and the owner re-touch update). Binds the peer id to the row's single-use
+ * `StampId` nonce, so a captured signed insert cannot be replayed (the `StampId` is
+ * unique) and — because {@link cadrePeerRemoveDigest} scopes a DIFFERENT payload — the
+ * stored voucher (`VouchSig`) cannot be replayed to authorize a delete.
+ *
+ * The SQL mirror is `digest(new.PeerId, new.StampId)` (two TEXT fields), matching the
+ * canonical multi-field framing in control-database.ts:buildAuthorizationMessage.
+ */
+export function cadrePeerVoucherDigest(peerId: string, stampId: string): string {
+  return digest([peerId, stampId], 'sha256', 'base64url') as string;
+}
+
+/**
+ * Canonical digest an owner signs to REMOVE a `CadrePeer` row. Deliberately a
+ * distinct payload from {@link cadrePeerVoucherDigest} (adds the `'remove'` action
+ * tag) so the row's stored voucher — a signature over the voucher digest — can never
+ * satisfy this delete check. The signature is supplied in write context and never
+ * stored, so no reader can replay it; binding the live row's `StampId` also invalidates
+ * any captured remove after a delete+reinsert (the nonce rotates).
+ *
+ * SQL mirror: `digest(old.PeerId, old.StampId, 'remove')`.
+ */
+export function cadrePeerRemoveDigest(peerId: string, stampId: string): string {
+  return digest([peerId, stampId, 'remove'], 'sha256', 'base64url') as string;
+}
+
+/**
+ * Verify that `signature` is a valid owner ed25519 signature over `peerId`'s
+ * authorization digest, using `ownerPublicKey` (base64url).
  *
  * This is the mirror of the signing done in
  * {@link SeedBootstrapService.authorizePeer}: it checks the signature against
  * {@link peerAuthorizationDigest}. A `true` result means the holder of the
- * authority private key vouched for this peer ID — it does NOT mean the peer is
+ * owner private key vouched for this peer ID — it does NOT mean the peer is
  * registered anywhere.
  *
  * Returns a boolean and never throws: malformed base64url, a bad/garbage key, or
@@ -33,14 +61,14 @@ export function peerAuthorizationDigest(peerId: string): string {
  */
 export function verifyPeerAuthorization(
   peerId: string,
-  authorityPublicKey: string,
+  ownerPublicKey: string,
   signature: string
 ): boolean {
   try {
     return verify(
       peerAuthorizationDigest(peerId),
       signature,
-      authorityPublicKey,
+      ownerPublicKey,
       'ed25519',
       'base64url',
       'base64url',

package/src/peer-record.ts

@@ -61,7 +61,7 @@ export function peerRecordSignedPayload(peerId: string, multiaddr: string, updat
  * preserved and is the order signed over).
  *
  * @param fields - the record fields to sign (signaling addr first by convention)
- * @param privateKeyB64 - base64url ed25519 seed (see `authorityKeyFromLibp2p`)
+ * @param privateKeyB64 - base64url ed25519 seed (see `ed25519KeyPairFromLibp2p`)
  */
 export function signPeerRecord(
   fields: { peerId: string; publicKey: string; addrs: string[]; updatedAt: number },
@@ -132,8 +132,8 @@ export function orderSignalingFirst(addrs: string[]): string[] {
 /**
  * Default resolve trust gate: trust any peer that has a `CadrePeer` row.
  *
- * A row only exists because an authority signed its `AuthorizedInsert`, so row
- * presence already means "authority-vouched member". This is the seam where a
+ * A row only exists because an owner signed its `AuthorizedInsert`, so row
+ * presence already means "owner-vouched member". This is the seam where a
  * stricter policy (trust circle, pinned keys) plugs in — see
  * {@link PeerResolveTrustPolicy}.
  */

package/src/push-node.ts

@@ -0,0 +1,64 @@
+/**
+ * push-node.ts — Node-only subpath entry for platform push **construction**.
+ *
+ * Import from the dedicated subpath, never the package root:
+ *
+ * ```ts
+ * import { createPushNotifier } from '@serfab/cadre-core/push-node';
+ * ```
+ *
+ * The FCM/APNs implementations reach for `node:crypto` / `node:http2`, so they
+ * are quarantined here — unreachable from the cross-platform `./index.js` graph
+ * (same isolation pattern as `./key-store-file`). A React Native / browser entry
+ * never resolves this path, so the Node builtins never reach a bundler that
+ * cannot satisfy them. The core references only the {@link PushNotifier}
+ * *interface* (`push-notifier.ts`) and a Node host injects the instance built
+ * here into `CadreNodeConfig.push.notifier`.
+ */
+
+import type { PushCredentials, PushPlatform } from './types.js';
+import type { PushMessage, PushNotifier, PushSendResult } from './push-notifier.js';
+import { createFcmPushNotifier, type FcmPushDeps } from './push-notifier-fcm.js';
+import { createApnsPushNotifier, type ApnsPushDeps } from './push-notifier-apns.js';
+
+/**
+ * Per-platform transport/clock/log seams, injected by tests. Defaults are the
+ * real implementations (global `fetch` for FCM, a `node:http2` session for APNs).
+ */
+export interface PushNotifierDeps {
+  fcm?: FcmPushDeps;
+  apns?: ApnsPushDeps;
+}
+
+/**
+ * Build a {@link PushNotifier} router over the configured credentials. Only the
+ * platforms whose credentials are present get a backing implementation; a `send`
+ * for an unconfigured platform returns a best-effort `no <platform> credentials`
+ * failure rather than throwing.
+ */
+export function createPushNotifier(creds: PushCredentials, deps: PushNotifierDeps = {}): PushNotifier {
+  const fcm = creds.fcm ? createFcmPushNotifier(creds.fcm, deps.fcm) : undefined;
+  const apns = creds.apns ? createApnsPushNotifier(creds.apns, deps.apns) : undefined;
+
+  async function send(msg: PushMessage): Promise<PushSendResult> {
+    if (msg.platform === 'fcm') return fcm ? fcm.send(msg) : noCreds('fcm');
+    if (msg.platform === 'apns') return apns ? apns.send(msg) : noCreds('apns');
+    return { ok: false, unregistered: false, error: `unknown platform ${String(msg.platform)}` };
+  }
+
+  async function close(): Promise<void> {
+    await Promise.all([fcm?.close(), apns?.close()]);
+  }
+
+  return { send, close };
+}
+
+/** Best-effort no-op result for a platform with no configured credentials. */
+function noCreds(platform: PushPlatform): PushSendResult {
+  return { ok: false, unregistered: false, error: `no ${platform} credentials` };
+}
+
+// Per-platform builders + their injected-dep types, for a host that wants a
+// single-platform notifier or to inject a fake transport directly.
+export { createFcmPushNotifier, createApnsPushNotifier };
+export type { FcmPushDeps, ApnsPushDeps };

package/src/push-notifier-apns.ts

@@ -1,8 +1,16 @@
 /**
  * push-notifier-apns.ts — APNs HTTP/2 strand-wake delivery.
  *
- * Server-only: signs a provider JWT (ES256, JOSE raw r‖s via `node:crypto`) and
- * sends a background data push over an HTTP/2 session to Apple's gateway.
+ * Node-only: signs a provider JWT (ES256, JOSE raw r‖s via `node:crypto`) and
+ * sends a background data push over an HTTP/2 session to Apple's gateway. APNs
+ * mandates HTTP/2, so `node:http2` is unavoidable here — one reason the push
+ * path is injected rather than rebuilt on WebCrypto/`fetch`.
+ *
+ * Reachable only through the `@serfab/cadre-core/push-node` subpath — never from
+ * the cross-platform `./index.js` graph — so the `node:crypto` / `node:http2`
+ * imports below are safe: no RN/browser bundler ever resolves this module. (Plain
+ * named imports; the old namespace-import-to-only-warn dance is obsolete now that
+ * the module is unreachable from a browser build by construction.)
  *
  * The HTTP/2 call is behind an injected `Http2Requester` seam (bundled with a
  * `close` into an {@link ApnsTransport}) so unit tests assert the request shape
@@ -19,12 +27,8 @@
  * token prefix.
  */
 
-// Namespace import (not `import { sign }`): a *named* import of the
-// browser-externalized `node:crypto` hard-fails the web build, whereas a
-// namespace import only warns — same reasoning as the `node:http2` import below
-// and the matching note in push-notifier-fcm.ts. Server-only; never run in browser.
-import * as nodeCrypto from 'node:crypto';
-import * as http2 from 'node:http2';
+import { sign } from 'node:crypto';
+import { connect, type ClientHttp2Session } from 'node:http2';
 import debug from 'debug';
 import type { ApnsCredentials } from './types.js';
 import type { PushMessage, PushNotifier, PushSendResult } from './push-notifier.js';
@@ -171,7 +175,7 @@ export function createApnsPushNotifier(creds: ApnsCredentials, deps: ApnsPushDep
     const header = { alg: 'ES256', kid: creds.keyId };
     const claims = { iss: creds.teamId, iat };
     const signingInput = `${b64urlJson(header)}.${b64urlJson(claims)}`;
-    const sig = nodeCrypto.sign('SHA256', Buffer.from(signingInput), {
+    const sig = sign('SHA256', Buffer.from(signingInput), {
       key: creds.privateKey,
       dsaEncoding: 'ieee-p1363',
     }).toString('base64url');
@@ -195,11 +199,11 @@ export function createApnsPushNotifier(creds: ApnsCredentials, deps: ApnsPushDep
  * network) — tests inject a fake transport; the real path is validated out-of-band.
  */
 function createHttp2Transport(host: string): ApnsTransport {
-  let session: http2.ClientHttp2Session | null = null;
+  let session: ClientHttp2Session | null = null;
 
-  function ensureSession(): http2.ClientHttp2Session {
+  function ensureSession(): ClientHttp2Session {
     if (session && !session.closed && !session.destroyed) return session;
-    const s = http2.connect(host);
+    const s = connect(host);
     // Drop a dead session so ensureSession recreates it on the next request.
     s.on('error', () => { if (session === s) session = null; });
     s.on('goaway', () => { s.destroy(); });

package/src/push-notifier-fcm.ts

@@ -1,10 +1,16 @@
 /**
  * push-notifier-fcm.ts — FCM HTTP v1 strand-wake delivery.
  *
- * Server-only: mints a Google OAuth2 access token (RS256 JWT bearer grant signed
+ * Node-only: mints a Google OAuth2 access token (RS256 JWT bearer grant signed
  * with `node:crypto`) and POSTs a data message to the FCM v1 endpoint. The legacy
  * server-key `fcm.googleapis.com/fcm/send` API is deprecated, so we use HTTP v1.
  *
+ * Reachable only through the `@serfab/cadre-core/push-node` subpath — never from
+ * the cross-platform `./index.js` graph — so the `node:crypto` import below is
+ * safe: no RN/browser bundler ever resolves this module. (Plain named import;
+ * the old namespace-import-to-only-warn dance is obsolete now that the module is
+ * unreachable from a browser build by construction.)
+ *
  * The network call is behind an injected `fetch`-like seam so unit tests assert
  * the request shape and map every documented response code with no real network
  * and no credentials. Failures are returned as {@link PushSendResult} values.
@@ -14,14 +20,7 @@
  * code and a redacted token prefix.
  */
 
-// Namespace import (not `import { sign }`): this module is server-only and is
-// reached only via the guarded dynamic import in CadreNode, but bundlers still
-// analyse that lazy chunk. A *named* import of `node:crypto` hard-fails the
-// browser build ("sign is not exported by __vite-browser-external"), whereas a
-// namespace import of the deliberately-unaliased external only warns (matching
-// the `node:http2` namespace import in push-notifier-apns.ts). The browser
-// never executes this code (config.push is node-only), so the warning is benign.
-import * as nodeCrypto from 'node:crypto';
+import { sign } from 'node:crypto';
 import debug from 'debug';
 import type { FcmCredentials } from './types.js';
 import type { PushMessage, PushNotifier, PushSendResult } from './push-notifier.js';
@@ -166,7 +165,7 @@ export function createFcmPushNotifier(creds: FcmCredentials, deps: FcmPushDeps =
       exp: iat + 3600,
     };
     const signingInput = `${b64urlJson(header)}.${b64urlJson(claims)}`;
-    const sig = nodeCrypto.sign('RSA-SHA256', Buffer.from(signingInput), creds.privateKey).toString('base64url');
+    const sig = sign('RSA-SHA256', Buffer.from(signingInput), creds.privateKey).toString('base64url');
     return `${signingInput}.${sig}`;
   }
 

package/src/push-notifier.ts

@@ -1,30 +1,26 @@
 /**
- * push-notifier.ts — the platform-push **delivery** seam for strand-wake.
+ * push-notifier.ts — the platform-push **delivery** contract for strand-wake.
  *
- * Given a resolved mobile peer token, send one `strand-wake` data message over
- * the right platform channel (FCM for Android, APNs for iOS). This module owns no
- * policy — *who* to wake and *when* is the fan-out (`push-fanout.ts`). It is the
- * reusable, credential-injected, transport-injected unit the fan-out constructs
- * inside a participating `CadreNode` when push credentials are configured.
+ * This module is the cross-platform-safe *interface* half: the message shape
+ * ({@link PushMessage}), the outcome value ({@link PushSendResult}), and the
+ * {@link PushNotifier} port a `CadreNode` sends over. It carries ZERO runtime
+ * dependencies and imports no implementation — so the RN/browser entry graph can
+ * reference the type without ever resolving `node:crypto` / `node:http2`.
  *
- * `createPushNotifier` returns a router that dispatches by `msg.platform` to an
- * `FcmPushNotifier` and/or `ApnsPushNotifier`, constructing only the
- * implementations whose credentials are present. Failures are values, never
- * thrown — mirroring `ServiceWakeResult` / `resolveDeviceToken`'s no-throw
- * conventions so a best-effort fan-out can branch on the outcome.
+ * The concrete FCM/APNs implementations (`push-notifier-fcm.ts` /
+ * `push-notifier-apns.ts`) and the `createPushNotifier` router that builds them
+ * live behind the Node-only subpath `@serfab/cadre-core/push-node`
+ * (`push-node.ts`). A Node host constructs a notifier from that subpath and
+ * injects the instance into `CadreNodeConfig.push.notifier`; the cross-platform
+ * core never constructs one, so the Node-only builtins stay out of its graph.
  *
- * Server-only by construction: the FCM/APNs implementations reach for
- * `node:crypto` / `node:http2`. They are never pulled into the RN/browser bundle
- * because the cross-platform `index.ts` re-exports only the *types* here (a
- * type-only re-export is erased at emit), and the only runtime constructor of a
- * notifier is the in-package fan-out that runs inside a Node `CadreNode`. A
- * cross-platform consumer imports the payload contract + types, never this value.
+ * Keep this file zero-import (beyond erased type-only imports): the whole point
+ * of the seam is that referencing the interface can never drag an implementation
+ * module into a bundler's graph.
  */
 
-import type { PushPlatform, PushCredentials } from './types.js';
+import type { PushPlatform } from './types.js';
 import type { StrandWakePayload } from './strand-wake-payload.js';
-import { createFcmPushNotifier, type FcmPushDeps } from './push-notifier-fcm.js';
-import { createApnsPushNotifier, type ApnsPushDeps } from './push-notifier-apns.js';
 
 /** One strand-wake data message addressed to one device. */
 export interface PushMessage {
@@ -54,40 +50,3 @@ export interface PushNotifier {
   /** Release transport resources (e.g. the APNs HTTP/2 session). */
   close(): Promise<void>;
 }
-
-/**
- * Per-platform transport/clock/log seams, injected by tests. Defaults are the
- * real implementations (global `fetch` for FCM, a `node:http2` session for APNs).
- */
-export interface PushNotifierDeps {
-  fcm?: FcmPushDeps;
-  apns?: ApnsPushDeps;
-}
-
-/**
- * Build a {@link PushNotifier} router over the configured credentials. Only the
- * platforms whose credentials are present get a backing implementation; a `send`
- * for an unconfigured platform returns a best-effort `no <platform> credentials`
- * failure rather than throwing.
- */
-export function createPushNotifier(creds: PushCredentials, deps: PushNotifierDeps = {}): PushNotifier {
-  const fcm = creds.fcm ? createFcmPushNotifier(creds.fcm, deps.fcm) : undefined;
-  const apns = creds.apns ? createApnsPushNotifier(creds.apns, deps.apns) : undefined;
-
-  async function send(msg: PushMessage): Promise<PushSendResult> {
-    if (msg.platform === 'fcm') return fcm ? fcm.send(msg) : noCreds('fcm');
-    if (msg.platform === 'apns') return apns ? apns.send(msg) : noCreds('apns');
-    return { ok: false, unregistered: false, error: `unknown platform ${String(msg.platform)}` };
-  }
-
-  async function close(): Promise<void> {
-    await Promise.all([fcm?.close(), apns?.close()]);
-  }
-
-  return { send, close };
-}
-
-/** Best-effort no-op result for a platform with no configured credentials. */
-function noCreds(platform: PushPlatform): PushSendResult {
-  return { ok: false, unregistered: false, error: `no ${platform} credentials` };
-}