@serfab/cadre-core 0.8.1 → 0.9.0

package/dist/control-formation-recorder.js

@@ -10,7 +10,7 @@ const NEVER_EXPIRES = new Date(8640000000000000);
  * usage questions, and writes the consent row that records a redemption. Two
  * provisioning shapes are supported, keyed on whether the invite binds a host strand:
  *
- * - **Bound (provision-then-record):** the host strand already exists (authority-signed
+ * - **Bound (provision-then-record):** the host strand already exists (owner-signed
  *   up front and named by the invite's `StrandId`), so {@link resolveStrand} reports it
  *   and {@link recordUsage} writes the consent row against that pre-existing strand
  *   (record-only) rather than inserting a new `Strand`.
@@ -67,7 +67,7 @@ export class ControlFormationUsageRecorder {
      * Record consent against an **already-existing** host strand (record-only): the
      * single `FormationUsage` insert auto-commits and the deferred `StrandExists`
      * CHECK is satisfied by the pre-existing strand. This is the provision-then-record
-     * commitment — the strand was minted authority-signed up front, so we do NOT
+     * commitment — the strand was minted owner-signed up front, so we do NOT
      * re-insert it (which would double-insert the same PK). `initiatorKey` is carried
      * as the usage `PeerId` (advisory). Use {@link ControlDatabase.redeemInvitation}
      * for the consent-creates-strand path instead.

package/dist/control-schema.d.ts

@@ -9,4 +9,4 @@
  * build if they drift. Any edit here must be mirrored in `schemas/control.qsql`
  * and vice versa.
  */
-export declare const CONTROL_SCHEMA = "-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)\ndeclare schema CadreControl {\n    -- A key that can authorize various control changes\n    table AuthorityKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Bootstrap: first authority key needs no existing authorization\n            (select count(1) from AuthorityKey) <= 1\n\n                -- Old authority authorizes by signing over THIS row (Key, StampId); single-use via unique StampId\n                or (old.Key is not null and old.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))\n\n                -- or other authorities authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (AuthorityKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure\n    table ValidationKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Authorities authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (AuthorityKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort\n    -- Cadre peers should participate in each of these strands\n    table Strand (\n        Id text primary key,    -- UUID\n        MemberPrivateKey text null unique,   -- Our private key as a member of this strand\n        Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Authorized by an authority signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId\n            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or authorized by a cadre peer who has received a valid formation invitation.\n                -- That path has no signed writer yet; when one is built it must still supply a\n                -- fresh, unique StampId to satisfy the not-null/unique anti-replay column.\n                or exists (select 1 from FormationUsage FU where FU.StrandId = new.Id)\n        ),\n        constraint MemberKeyClosedOnly check (\n            -- An open strand ('o') has no membership gate, so it must not carry a\n            -- member key. A non-null MemberPrivateKey requires a closed strand ('c').\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (AuthorityKey text, Signature text);\n\n    -- A peer (node) that is part of the cadre, carrying a self-published,\n    -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).\n    -- The row IS the peer-address record: a resolver reads it, re-verifies Sig against\n    -- PublicKey, checks freshness (UpdatedAt) and trust, then dials the addrs.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) whose libp2p identity == PeerId (null if non-Ed25519)\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)\n        Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published\n        constraint AuthorizedInsert check on insert, delete (\n            -- Authorized by an authority key, which vouches both membership and the\n            -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).\n            -- The single-field digest frames the base58btc PeerId as TEXT, matching\n            -- cadre-core peer-authorization.ts:peerAuthorizationDigest.\n            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key\n            -- (the key behind PeerId). PeerId/PublicKey are immutable on self-update, UpdatedAt\n            -- must strictly increase (replay guard), and Sig is verified against the stored\n            -- PublicKey over the same payload the publish path signs\n            -- (cadre-core peer-record.ts:peerRecordSignedPayload).\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest(new.PeerId || '|' || new.Multiaddr || '|' || cast(new.UpdatedAt as text)),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                -- or an authority re-authorizes (rotation / correction)\n                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (AuthorityKey text null, Signature text);\n\n    -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a\n    -- server peer can deliver a push-wake to a suspended app over the platform push\n    -- channel (a control-network dial cannot reach an OS-suspended process). The row\n    -- mirrors CadrePeer: a resolver re-verifies Sig against the CadrePeer.PublicKey for\n    -- this PeerId (see device-token.ts:deviceTokenSignedPayload), checks freshness, then\n    -- hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,        -- the CadrePeer this token belongs to\n        Platform text not null,         -- 'fcm' | 'apns'\n        Token text not null,            -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)\n        Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)\n        constraint AuthorizedInsert check on insert, delete (\n            -- Authorized by an authority key (membership vouch), exactly like CadrePeer.\n            -- The single-field digest frames the base58btc PeerId as TEXT.\n            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own token, signing with its OWN ed25519 key (the key\n            -- behind PeerId). PeerId is immutable, UpdatedAt must strictly increase (replay\n            -- guard), and Sig is verified against the stored CadrePeer.PublicKey over the\n            -- signed payload (cadre-core device-token.ts:deviceTokenSignedPayload). Platform\n            -- and Token may change on self-update (platform switch / reinstall / rotation).\n            (\n                new.PeerId = old.PeerId\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                        digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|' || cast(new.UpdatedAt as text)),\n                        new.Sig, P.PublicKey, 'ed25519'))\n            )\n                -- or an authority re-authorizes (rotation / correction)\n                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (AuthorityKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party\n    table FormationInvite (\n        Token text primary key, -- Just a random string\n        sAppId text, -- The app for the strand that will be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,   -- Web hook - send disclosure, IP address...\n        StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint AuthorizedAddOrRemove check on insert, delete (\n            -- Authorized by an authority signing over THIS row\n            -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.\n            -- coalesce(new.F, old.F) binds the NEW row on insert and the OLD row on delete (cf. CadrePeer).\n            -- StrandId is a nullable bound field: it signs as '' when absent (cf. ValidationUrl).\n            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(\n                digest(\n                    coalesce(new.Token, old.Token),\n                    coalesce(new.sAppId, old.sAppId),\n                    coalesce(cast(coalesce(new.ExpiresAt, old.ExpiresAt) as text), ''),\n                    coalesce(cast(coalesce(new.TotalUses, old.TotalUses) as text), ''),\n                    coalesce(coalesce(new.ValidationUrl, old.ValidationUrl), ''),\n                    coalesce(coalesce(new.StrandId, old.StrandId), ''),\n                    coalesce(new.StampId, old.StampId)\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Invites are insert/delete only: forbid in-place mutation so the row-bound\n        -- AuthorizedAddOrRemove signature cannot be sidestepped by updating consent\n        -- parameters (TotalUses/ExpiresAt/...) after a legitimate insert. A bare check\n        -- defaults to insert+update; the check on insert, delete above excludes update,\n        -- so this guard is required. Mirrors FormationUsage.InsertOnly.\n        constraint Immutable check on update (false)\n    ) with context (AuthorityKey text, Signature text);\n\n    table FormationUsage (\n        Token text,\n        UseNumber int,\n        Disclosure text,\n        StrandId text,\n        primary key (Token, UseNumber),\n        constraint InsertOnly check on update, delete (false),\n        constraint Monotonic check (\n            -- Read the PRE-transaction snapshot (committed.*): this CHECK auto-defers\n            -- to commit (it has a subquery), by which point the row being inserted is\n            -- live, so a plain from-FormationUsage would count this row itself and make\n            -- UseNumber = max+1 unsatisfiable. committed.* excludes the in-flight row,\n            -- giving sequential 1,2,3... per token (cross-transaction; concurrent\n            -- redemptions of the same token collide on the (Token, UseNumber) PK).\n            new.UseNumber = coalesce((select max(UseNumber) from committed.FormationUsage U where U.Token = new.Token), 0) + 1\n        ),\n        constraint Authorized check on insert (\n            -- Satisfies an invitation\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        and (FI.TotalUses is null or FI.TotalUses >= new.UseNumber)\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        and (FI.ValidationUrl is null or verify(digest(new.Token || new.Disclosure), context.ValidationSignature, context.ValidationKey, 'ed25519'))\n            )\n        ),\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId)),\n    ) with context (PeerId text, PeerSignature text, Now datetime, ValidationKey text null, ValidationSignature text null);\n}\n\napply schema CadreControl;";
+export declare const CONTROL_SCHEMA = "-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)\ndeclare schema CadreControl {\n    -- A key that can authorize various control changes\n    table OwnerKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Bootstrap: first owner key needs no existing authorization\n            (select count(1) from OwnerKey) <= 1\n\n                -- Old owner authorizes by signing over THIS row (Key, StampId); single-use via unique StampId\n                or (old.Key is not null and old.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))\n\n                -- or other owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure\n    table ValidationKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort\n    -- Cadre peers should participate in each of these strands\n    table Strand (\n        Id text primary key,    -- UUID\n        MemberPrivateKey text null unique,   -- Our private key as a member of this strand\n        Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or authorized by a cadre peer who has received a valid formation invitation.\n                -- That path has no signed writer yet; when one is built it must still supply a\n                -- fresh, unique StampId to satisfy the not-null/unique anti-replay column.\n                or exists (select 1 from FormationUsage FU where FU.StrandId = new.Id)\n        ),\n        constraint MemberKeyClosedOnly check (\n            -- An open strand ('o') has no membership gate, so it must not carry a\n            -- member key. A non-null MemberPrivateKey requires a closed strand ('c').\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A peer (node) that is part of the cadre, carrying a self-published,\n    -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).\n    -- The row IS the peer-address record: a resolver reads it, re-verifies Sig against\n    -- PublicKey, checks freshness (UpdatedAt) and trust, then dials the addrs.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) whose libp2p identity == PeerId (null if non-Ed25519)\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)\n        Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published\n        StampId text not null unique,    -- single-use authorization nonce (anti-replay), bound into the voucher/remove digests; rotates on (re)insert\n        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)\n        VouchSig text null,              -- that owner's signature over digest(PeerId, StampId) (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership.\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner key, which vouches both membership and the\n            -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).\n            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),\n            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n            -- Persist the vouching (owner, signature) onto the row so a reader can later\n            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal\n            -- the pair the verify above validated, so a writer cannot store a voucher it did\n            -- not actually receive a signature for.\n            and new.VouchOwner = context.OwnerKey\n            and new.VouchSig = context.Signature\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over a DISTINCT 'remove'-scoped digest bound\n            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so\n            -- the stored voucher (a signature over digest(PeerId, StampId)) can NEVER be replayed\n            -- to authorize a delete. The remove signature rides in context and is never stored.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(old.PeerId, old.StampId, 'remove'), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key\n            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on\n            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified\n            -- against the stored PublicKey over the same payload the publish path signs\n            -- (cadre-core peer-record.ts:peerRecordSignedPayload).\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.StampId = old.StampId\n                and new.VouchOwner = old.VouchOwner\n                and new.VouchSig = old.VouchSig\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest(new.PeerId || '|' || new.Multiaddr || '|' || cast(new.UpdatedAt as text)),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                -- or an owner re-authorizes (rotation / correction): re-vouches the row over\n                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.\n                or (\n                    exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and new.VouchOwner = context.OwnerKey\n                    and new.VouchSig = context.Signature\n                )\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a\n    -- server peer can deliver a push-wake to a suspended app over the platform push\n    -- channel (a control-network dial cannot reach an OS-suspended process). The row\n    -- mirrors CadrePeer: a resolver re-verifies Sig against the CadrePeer.PublicKey for\n    -- this PeerId (see device-token.ts:deviceTokenSignedPayload), checks freshness, then\n    -- hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,        -- the CadrePeer this token belongs to\n        Platform text not null,         -- 'fcm' | 'apns'\n        Token text not null,            -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)\n        Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)\n        constraint AuthorizedInsert check on insert, delete (\n            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.\n            -- The single-field digest frames the base58btc PeerId as TEXT.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own token, signing with its OWN ed25519 key (the key\n            -- behind PeerId). PeerId is immutable, UpdatedAt must strictly increase (replay\n            -- guard), and Sig is verified against the stored CadrePeer.PublicKey over the\n            -- signed payload (cadre-core device-token.ts:deviceTokenSignedPayload). Platform\n            -- and Token may change on self-update (platform switch / reinstall / rotation).\n            (\n                new.PeerId = old.PeerId\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                        digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|' || cast(new.UpdatedAt as text)),\n                        new.Sig, P.PublicKey, 'ed25519'))\n            )\n                -- or an owner re-authorizes (rotation / correction)\n                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party\n    table FormationInvite (\n        Token text primary key, -- Just a random string\n        sAppId text, -- The app for the strand that will be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,   -- Web hook - send disclosure, IP address...\n        StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint AuthorizedAddOrRemove check on insert, delete (\n            -- Authorized by an owner signing over THIS row\n            -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.\n            -- coalesce(new.F, old.F) binds the NEW row on insert and the OLD row on delete (cf. CadrePeer).\n            -- StrandId is a nullable bound field: it signs as '' when absent (cf. ValidationUrl).\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    coalesce(new.Token, old.Token),\n                    coalesce(new.sAppId, old.sAppId),\n                    coalesce(cast(coalesce(new.ExpiresAt, old.ExpiresAt) as text), ''),\n                    coalesce(cast(coalesce(new.TotalUses, old.TotalUses) as text), ''),\n                    coalesce(coalesce(new.ValidationUrl, old.ValidationUrl), ''),\n                    coalesce(coalesce(new.StrandId, old.StrandId), ''),\n                    coalesce(new.StampId, old.StampId)\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Invites are insert/delete only: forbid in-place mutation so the row-bound\n        -- AuthorizedAddOrRemove signature cannot be sidestepped by updating consent\n        -- parameters (TotalUses/ExpiresAt/...) after a legitimate insert. A bare check\n        -- defaults to insert+update; the check on insert, delete above excludes update,\n        -- so this guard is required. Mirrors FormationUsage.InsertOnly.\n        constraint Immutable check on update (false)\n    ) with context (OwnerKey text, Signature text);\n\n    table FormationUsage (\n        Token text,\n        UseNumber int,\n        Disclosure text,\n        StrandId text,\n        primary key (Token, UseNumber),\n        constraint InsertOnly check on update, delete (false),\n        constraint Monotonic check (\n            -- Read the PRE-transaction snapshot (committed.*): this CHECK auto-defers\n            -- to commit (it has a subquery), by which point the row being inserted is\n            -- live, so a plain from-FormationUsage would count this row itself and make\n            -- UseNumber = max+1 unsatisfiable. committed.* excludes the in-flight row,\n            -- giving sequential 1,2,3... per token (cross-transaction; concurrent\n            -- redemptions of the same token collide on the (Token, UseNumber) PK).\n            new.UseNumber = coalesce((select max(UseNumber) from committed.FormationUsage U where U.Token = new.Token), 0) + 1\n        ),\n        constraint Authorized check on insert (\n            -- Satisfies an invitation\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        and (FI.TotalUses is null or FI.TotalUses >= new.UseNumber)\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        and (FI.ValidationUrl is null or verify(digest(new.Token || new.Disclosure), context.ValidationSignature, context.ValidationKey, 'ed25519'))\n            )\n        ),\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId)),\n    ) with context (PeerId text, PeerSignature text, Now datetime, ValidationKey text null, ValidationSignature text null);\n}\n\napply schema CadreControl;";

package/dist/control-schema.js

@@ -12,30 +12,30 @@
 export const CONTROL_SCHEMA = `-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)
 declare schema CadreControl {
     -- A key that can authorize various control changes
-    table AuthorityKey (
+    table OwnerKey (
         Key text primary key,
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint Authorized check (
-            -- Bootstrap: first authority key needs no existing authorization
-            (select count(1) from AuthorityKey) <= 1
+            -- Bootstrap: first owner key needs no existing authorization
+            (select count(1) from OwnerKey) <= 1
 
-                -- Old authority authorizes by signing over THIS row (Key, StampId); single-use via unique StampId
-                or (old.Key is not null and old.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))
+                -- Old owner authorizes by signing over THIS row (Key, StampId); single-use via unique StampId
+                or (old.Key is not null and old.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))
 
-                -- or other authorities authorize by signing over THIS row (Key, StampId); single-use via unique StampId
-                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
+                -- or other owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId
+                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
         )
-    ) with context (AuthorityKey text null, Signature text null);
+    ) with context (OwnerKey text null, Signature text null);
 
     -- A key that can validate a strand formation disclosure
     table ValidationKey (
         Key text primary key,
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint Authorized check (
-            -- Authorities authorize by signing over THIS row (Key, StampId); single-use via unique StampId
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
         )
-    ) with context (AuthorityKey text, Signature text);
+    ) with context (OwnerKey text, Signature text);
 
     -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort
     -- Cadre peers should participate in each of these strands
@@ -45,8 +45,8 @@ declare schema CadreControl {
         Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint Authorized check (
-            -- Authorized by an authority signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))
 
                 -- or authorized by a cadre peer who has received a valid formation invitation.
                 -- That path has no signed writer yet; when one is built it must still supply a
@@ -58,7 +58,7 @@ declare schema CadreControl {
             -- member key. A non-null MemberPrivateKey requires a closed strand ('c').
             new.MemberPrivateKey is null or new.Type = 'c'
         )
-    ) with context (AuthorityKey text, Signature text);
+    ) with context (OwnerKey text, Signature text);
 
     -- A peer (node) that is part of the cadre, carrying a self-published,
     -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).
@@ -70,31 +70,55 @@ declare schema CadreControl {
         Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)
         UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)
         Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published
-        constraint AuthorizedInsert check on insert, delete (
-            -- Authorized by an authority key, which vouches both membership and the
+        StampId text not null unique,    -- single-use authorization nonce (anti-replay), bound into the voucher/remove digests; rotates on (re)insert
+        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)
+        VouchSig text null,              -- that owner's signature over digest(PeerId, StampId) (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership.
+        constraint AuthorizedInsert check on insert (
+            -- Authorized by an owner key, which vouches both membership and the
             -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).
-            -- The single-field digest frames the base58btc PeerId as TEXT, matching
-            -- cadre-core peer-authorization.ts:peerAuthorizationDigest.
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
+            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),
+            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Persist the vouching (owner, signature) onto the row so a reader can later
+            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal
+            -- the pair the verify above validated, so a writer cannot store a voucher it did
+            -- not actually receive a signature for.
+            and new.VouchOwner = context.OwnerKey
+            and new.VouchSig = context.Signature
+        ),
+        constraint AuthorizedDelete check on delete (
+            -- Delete is authorized by a signature over a DISTINCT 'remove'-scoped digest bound
+            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so
+            -- the stored voucher (a signature over digest(PeerId, StampId)) can NEVER be replayed
+            -- to authorize a delete. The remove signature rides in context and is never stored.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(old.PeerId, old.StampId, 'remove'), context.Signature, A.Key, 'ed25519'))
         ),
         constraint AuthorizedUpdate check on update (
             -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key
-            -- (the key behind PeerId). PeerId/PublicKey are immutable on self-update, UpdatedAt
-            -- must strictly increase (replay guard), and Sig is verified against the stored
-            -- PublicKey over the same payload the publish path signs
+            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on
+            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified
+            -- against the stored PublicKey over the same payload the publish path signs
             -- (cadre-core peer-record.ts:peerRecordSignedPayload).
             (
                 new.PeerId = old.PeerId
                 and new.PublicKey = old.PublicKey
+                and new.StampId = old.StampId
+                and new.VouchOwner = old.VouchOwner
+                and new.VouchSig = old.VouchSig
                 and new.UpdatedAt > coalesce(old.UpdatedAt, 0)
                 and verify(
                         digest(new.PeerId || '|' || new.Multiaddr || '|' || cast(new.UpdatedAt as text)),
                         new.Sig, new.PublicKey, 'ed25519')
             )
-                -- or an authority re-authorizes (rotation / correction)
-                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
+                -- or an owner re-authorizes (rotation / correction): re-vouches the row over
+                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.
+                or (
+                    exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))
+                    and new.VouchOwner = context.OwnerKey
+                    and new.VouchSig = context.Signature
+                )
         )
-    ) with context (AuthorityKey text null, Signature text);
+    ) with context (OwnerKey text null, Signature text);
 
     -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a
     -- server peer can deliver a push-wake to a suspended app over the platform push
@@ -109,9 +133,9 @@ declare schema CadreControl {
         UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)
         Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)
         constraint AuthorizedInsert check on insert, delete (
-            -- Authorized by an authority key (membership vouch), exactly like CadrePeer.
+            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.
             -- The single-field digest frames the base58btc PeerId as TEXT.
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
         ),
         constraint AuthorizedUpdate check on update (
             -- Peer self-updates its own token, signing with its OWN ed25519 key (the key
@@ -126,10 +150,10 @@ declare schema CadreControl {
                         digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|' || cast(new.UpdatedAt as text)),
                         new.Sig, P.PublicKey, 'ed25519'))
             )
-                -- or an authority re-authorizes (rotation / correction)
-                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
+                -- or an owner re-authorizes (rotation / correction)
+                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
         )
-    ) with context (AuthorityKey text null, Signature text);
+    ) with context (OwnerKey text null, Signature text);
 
     -- An open invitation to form a strand with this party
     table FormationInvite (
@@ -141,11 +165,11 @@ declare schema CadreControl {
         StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint AuthorizedAddOrRemove check on insert, delete (
-            -- Authorized by an authority signing over THIS row
+            -- Authorized by an owner signing over THIS row
             -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.
             -- coalesce(new.F, old.F) binds the NEW row on insert and the OLD row on delete (cf. CadrePeer).
             -- StrandId is a nullable bound field: it signs as '' when absent (cf. ValidationUrl).
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(
                 digest(
                     coalesce(new.Token, old.Token),
                     coalesce(new.sAppId, old.sAppId),
@@ -163,7 +187,7 @@ declare schema CadreControl {
         -- defaults to insert+update; the check on insert, delete above excludes update,
         -- so this guard is required. Mirrors FormationUsage.InsertOnly.
         constraint Immutable check on update (false)
-    ) with context (AuthorityKey text, Signature text);
+    ) with context (OwnerKey text, Signature text);
 
     table FormationUsage (
         Token text,

package/dist/control-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BA0LH,CAAC"}
+{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAkNH,CAAC"}

package/dist/device-token.d.ts

@@ -36,7 +36,7 @@ export declare function deviceTokenSignedPayload(record: Omit<DeviceTokenRecord,
  * Returns a fully-populated {@link DeviceTokenRecord}.
  *
  * @param fields - the record fields to sign
- * @param privateKeyB64 - base64url ed25519 seed (see `authorityKeyFromLibp2p`)
+ * @param privateKeyB64 - base64url ed25519 seed (see `ed25519KeyPairFromLibp2p`)
  */
 export declare function signDeviceTokenRecord(fields: Omit<DeviceTokenRecord, 'sig'>, privateKeyB64: string): DeviceTokenRecord;
 /**

package/dist/device-token.js

@@ -39,7 +39,7 @@ export function deviceTokenSignedPayload(record) {
  * Returns a fully-populated {@link DeviceTokenRecord}.
  *
  * @param fields - the record fields to sign
- * @param privateKeyB64 - base64url ed25519 seed (see `authorityKeyFromLibp2p`)
+ * @param privateKeyB64 - base64url ed25519 seed (see `ed25519KeyPairFromLibp2p`)
  */
 export function signDeviceTokenRecord(fields, privateKeyB64) {
     const payloadDigest = deviceTokenSignedPayload(fields);

package/dist/{authority-key.d.ts → ed25519-key.d.ts}

@@ -1,9 +1,11 @@
 import type { PrivateKey } from '@libp2p/interface';
 /**
- * A household authority keypair expressed in the base64url Ed25519 form that
+ * An Ed25519 keypair expressed in the base64url form that
  * `@optimystic/quereus-plugin-crypto` (`sign`/`verify`/`getPublicKey`) consumes.
+ * Generic bridge type — reused for owner keys, member keys, and any other
+ * seed→public keypair the control/strand databases sign with.
  */
-export interface AuthorityKeyPair {
+export interface Ed25519KeyPair {
     /** 32-byte Ed25519 seed, base64url-encoded — the crypto-plugin private key. */
     privateKeyB64: string;
     /** 32-byte Ed25519 public key, base64url-encoded. */
@@ -11,31 +13,30 @@ export interface AuthorityKeyPair {
 }
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
- * control-database authority constraints.
+ * control- and strand-database signing constraints.
  *
  * libp2p stores an Ed25519 private key as 64 raw bytes: the first 32 are the
  * seed (the actual scalar source), the last 32 are the public key — see
  * `@libp2p/crypto`'s `Ed25519PrivateKey`. `@optimystic/quereus-plugin-crypto`
  * (via `@noble/curves`) treats the 32-byte seed *as* the private key and
  * derives the public key from it with standard Ed25519. The two derivations
- * agree, so the node's peer identity and its authority key are one keypair:
+ * agree, so the node's peer identity and its signing key are one keypair:
  * `getPublicKey(privateKeyB64)` === `publicKeyB64`.
  *
  * @param privateKey - The node's libp2p Ed25519 private key.
- * @returns The base64url seed/public-key pair for authority operations.
+ * @returns The base64url seed/public-key pair for signing operations.
  * @throws If the key is not Ed25519 or the raw bytes aren't the expected length.
  */
-export declare function authorityKeyFromLibp2p(privateKey: PrivateKey): AuthorityKeyPair;
+export declare function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed25519KeyPair;
 /**
  * Derive the base64url Ed25519 public key from a base64url 32-byte private seed
  * — the same derivation the seed-bootstrap signer uses internally
  * (`SeedBootstrapService` constructor). Use this to enroll a standalone
- * (non-libp2p) authority key into the control DB via
- * `ControlDatabase.ensureAuthorityKey` before minting an invite, when the
- * authority key is *not* the node's peer identity (so `authorityKeyFromLibp2p`,
+ * (non-libp2p) key into the control DB before minting an invite, when the
+ * key is *not* the node's peer identity (so `ed25519KeyPairFromLibp2p`,
  * which needs a libp2p key object, does not apply).
  *
  * @param privateKeyB64 - The base64url-encoded 32-byte Ed25519 seed.
  * @returns The base64url-encoded Ed25519 public key.
  */
-export declare function authorityPublicKeyFromPrivate(privateKeyB64: string): string;
+export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): string;

package/dist/{authority-key.js → ed25519-key.js}

@@ -2,23 +2,23 @@ import { toString as uint8ArrayToString } from 'uint8arrays';
 import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
- * control-database authority constraints.
+ * control- and strand-database signing constraints.
  *
  * libp2p stores an Ed25519 private key as 64 raw bytes: the first 32 are the
  * seed (the actual scalar source), the last 32 are the public key — see
  * `@libp2p/crypto`'s `Ed25519PrivateKey`. `@optimystic/quereus-plugin-crypto`
  * (via `@noble/curves`) treats the 32-byte seed *as* the private key and
  * derives the public key from it with standard Ed25519. The two derivations
- * agree, so the node's peer identity and its authority key are one keypair:
+ * agree, so the node's peer identity and its signing key are one keypair:
  * `getPublicKey(privateKeyB64)` === `publicKeyB64`.
  *
  * @param privateKey - The node's libp2p Ed25519 private key.
- * @returns The base64url seed/public-key pair for authority operations.
+ * @returns The base64url seed/public-key pair for signing operations.
  * @throws If the key is not Ed25519 or the raw bytes aren't the expected length.
  */
-export function authorityKeyFromLibp2p(privateKey) {
+export function ed25519KeyPairFromLibp2p(privateKey) {
     if (privateKey.type !== 'Ed25519') {
-        throw new Error(`authorityKeyFromLibp2p requires an Ed25519 key, got ${privateKey.type}`);
+        throw new Error(`ed25519KeyPairFromLibp2p requires an Ed25519 key, got ${privateKey.type}`);
     }
     const raw = privateKey.raw;
     if (raw.length !== 64) {
@@ -38,15 +38,14 @@ export function authorityKeyFromLibp2p(privateKey) {
  * Derive the base64url Ed25519 public key from a base64url 32-byte private seed
  * — the same derivation the seed-bootstrap signer uses internally
  * (`SeedBootstrapService` constructor). Use this to enroll a standalone
- * (non-libp2p) authority key into the control DB via
- * `ControlDatabase.ensureAuthorityKey` before minting an invite, when the
- * authority key is *not* the node's peer identity (so `authorityKeyFromLibp2p`,
+ * (non-libp2p) key into the control DB before minting an invite, when the
+ * key is *not* the node's peer identity (so `ed25519KeyPairFromLibp2p`,
  * which needs a libp2p key object, does not apply).
  *
  * @param privateKeyB64 - The base64url-encoded 32-byte Ed25519 seed.
  * @returns The base64url-encoded Ed25519 public key.
  */
-export function authorityPublicKeyFromPrivate(privateKeyB64) {
+export function ed25519PublicKeyFromPrivate(privateKeyB64) {
     return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url');
 }
-//# sourceMappingURL=authority-key.js.map
+//# sourceMappingURL=ed25519-key.js.map

package/dist/ed25519-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAgBjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from './types.js';
 export { canonicalJson } from './canonical-json.js';
 export { CadreNode } from './cadre-node.js';
 export { ControlDatabase, buildAuthorizationMessage, type ControlDatabaseConfig, type ControlTable } from './control-database.js';
-export { authorityKeyFromLibp2p, authorityPublicKeyFromPrivate, type AuthorityKeyPair } from './authority-key.js';
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, type Ed25519KeyPair } from './ed25519-key.js';
 export { InMemoryKeyStore, KeyStoreAccessError, DEFAULT_IDENTITY_KEY_ID, type KeyStore, type KeyId } from './key-store.js';
 export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
 export { StrandWatcher, type StrandWatcherCallbacks, type StrandQueryable, type SAppIdLookup, type StrandRowWithApp } from './strand-watcher.js';
@@ -13,11 +13,11 @@ export { EnrollmentService, type MemberVerifier, type MemberRegistry } from './e
 export { StrandSolicitationService, createDefaultFormationResponseValidator, type DisclosureValidator, type FormationUsageRecorder, type ResolvedHostStrand, type StrandProvisioner, type FormationSigner, type FormationResponseValidator, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-export { signStrandPayload, verifyStrandPayload, bootstrapFounderMembership, issueInvite, consumeInvite, addMemberByAuthority, registerMemberPeer, addAuthority, removeAuthority, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type AddMemberByAuthorityParams, type RegisterMemberPeerParams, type AddAuthorityParams, type RemoveAuthorityParams } from './strand-membership-writer.js';
+export { signStrandPayload, verifyStrandPayload, bootstrapFounderMembership, issueInvite, consumeInvite, addMemberByManager, registerMemberPeer, addManager, removeManager, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type AddMemberByManagerParams, type RegisterMemberPeerParams, type AddManagerParams, type RemoveManagerParams } from './strand-membership-writer.js';
 export { canonicalDatetime } from './canonical-datetime.js';
 export { StrandMemberRegistry, StrandMemberVerifier, memberRegistrationPayload, type StrandAdmission } from './strand-member-registry.js';
 export { SeedBootstrapService, SEED_PROTOCOL, ed25519PublicKeyB64FromPeerId, type SeedBootstrapConfig, type SeedEventCallbacks } from './seed-bootstrap.js';
-export { peerAuthorizationDigest, verifyPeerAuthorization } from './peer-authorization.js';
+export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, verifyPeerAuthorization } from './peer-authorization.js';
 export { StrandWakeService, dialWake, WAKE_PROTOCOL, type StrandWakeServiceOptions, type DialWakeOptions } from './strand-wake-protocol.js';
 export { StrandAddrService, collectStrandAddrs, STRAND_ADDR_PROTOCOL, type StrandAddrServiceOptions, type StrandAddrPeer, type CollectStrandAddrsOptions } from './strand-addr-protocol.js';
 export { peerRecordSignedPayload, signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, isSignalingAddr, orderSignalingFirst, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';

package/dist/index.js

@@ -6,9 +6,9 @@ export { canonicalJson } from './canonical-json.js';
 export { CadreNode } from './cadre-node.js';
 // Control database
 export { ControlDatabase, buildAuthorizationMessage } from './control-database.js';
-// Authority key bridge (libp2p Ed25519 -> base64url authority keypair)
-export { authorityKeyFromLibp2p, authorityPublicKeyFromPrivate } from './authority-key.js';
-// Pluggable key store (backend-agnostic identity/authority key material seam).
+// Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate } from './ed25519-key.js';
+// Pluggable key store (backend-agnostic identity/owner key material seam).
 // Dependency-free: the interface, error, default slot id, and in-memory backend
 // are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
 // separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
@@ -30,12 +30,12 @@ export { StrandSolicitationService, createDefaultFormationResponseValidator } fr
 // DB-backed FormationUsageRecorder (reads/writes the real CadreControl tables)
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 // Closed-strand member key generation (ed25519 protobuf, base64) + the
-// protobuf->base64url bridge that derives the founding Member/Authority key.
+// protobuf->base64url bridge that derives the founding Member/Manager key.
 export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
 // Strand membership writer (founder bootstrap, invite issuance/consumption,
-// authority-admit, member-peer registration, authority rotation, + shared signing
+// manager-admit, member-peer registration, manager rotation, + shared signing
 // primitives reused across the flows).
-export { signStrandPayload, verifyStrandPayload, bootstrapFounderMembership, issueInvite, consumeInvite, addMemberByAuthority, registerMemberPeer, addAuthority, removeAuthority, STRAND_ENGINE, STRAND_ENGINE_VERSION } from './strand-membership-writer.js';
+export { signStrandPayload, verifyStrandPayload, bootstrapFounderMembership, issueInvite, consumeInvite, addMemberByManager, registerMemberPeer, addManager, removeManager, STRAND_ENGINE, STRAND_ENGINE_VERSION } from './strand-membership-writer.js';
 // Engine-canonical datetime helper (shared by control + strand signed-write flows
 // so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
 export { canonicalDatetime } from './canonical-datetime.js';
@@ -44,8 +44,8 @@ export { canonicalDatetime } from './canonical-datetime.js';
 export { StrandMemberRegistry, StrandMemberVerifier, memberRegistrationPayload } from './strand-member-registry.js';
 // Seed Bootstrap
 export { SeedBootstrapService, SEED_PROTOCOL, ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
-// Peer Authorization (shared authority-signature digest + offline verifier)
-export { peerAuthorizationDigest, verifyPeerAuthorization } from './peer-authorization.js';
+// Peer Authorization (shared owner-signature digest + offline verifier)
+export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, verifyPeerAuthorization } from './peer-authorization.js';
 // Strand Wake (control-network push-wake protocol)
 export { StrandWakeService, dialWake, WAKE_PROTOCOL } from './strand-wake-protocol.js';
 // Strand Address (control-network strand-address RPC) — wire types come via

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAiD,MAAM,uBAAuB,CAAC;AAElI,uEAAuE;AACvE,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAyB,MAAM,oBAAoB,CAAC;AAElH,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAQxC,MAAM,0BAA0B,CAAC;AAElC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,kFAAkF;AAClF,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,qBAAqB,EAStB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,4EAA4E;AAC5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EAGd,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAErC,MAAM,qBAAqB,CAAC;AAE7B,sDAAsD;AACtD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,kBAAkB,EAUnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAG7B,MAAM,+BAA+B,CAAC;AAEvC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAiD,MAAM,uBAAuB,CAAC;AAElI,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAuB,MAAM,kBAAkB,CAAC;AAE9G,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAQxC,MAAM,0BAA0B,CAAC;AAElC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,8EAA8E;AAC9E,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,aAAa,EACb,qBAAqB,EAStB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EAGd,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAErC,MAAM,qBAAqB,CAAC;AAE7B,sDAAsD;AACtD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,kBAAkB,EAUnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAG7B,MAAM,+BAA+B,CAAC;AAEvC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}

package/dist/key-store.d.ts

@@ -2,7 +2,7 @@
  * Backend-agnostic store for raw private key material.
  *
  * Mobile cadre nodes hold sensitive key material at rest: the libp2p
- * peer/node identity key and (in the single-key reference model) the authority
+ * peer/node identity key and (in the single-key reference model) the owner
  * signing key derived from it. This module defines the seam those keys flow
  * through so a platform-secure backend (iOS Keychain / Android Keystore) can be
  * plugged in without `@serfab/cadre-core` taking any platform dependency.

package/dist/key-store.js

@@ -2,7 +2,7 @@
  * Backend-agnostic store for raw private key material.
  *
  * Mobile cadre nodes hold sensitive key material at rest: the libp2p
- * peer/node identity key and (in the single-key reference model) the authority
+ * peer/node identity key and (in the single-key reference model) the owner
  * signing key derived from it. This module defines the seam those keys flow
  * through so a platform-secure backend (iOS Keychain / Android Keystore) can be
  * plugged in without `@serfab/cadre-core` taking any platform dependency.

package/dist/peer-authorization.d.ts

@@ -1,26 +1,48 @@
 /**
- * Canonical digest an authority signs to authorize a peer.
+ * Canonical digest an owner signs to authorize a peer.
  *
  * This is the exact byte construction {@link SeedBootstrapService.authorizePeer}
  * signs over when it inserts an authorized `CadrePeer` row:
  * `digest([peerId], 'sha256', 'base64url')`. Factored into one place so the
- * producer (authority signing) and the verifier (the offline `cadre enroll
+ * producer (owner signing) and the verifier (the offline `cadre enroll
  * register` check) can never drift apart — change the digest here and both move
  * together. The SQL mirror is the bare single-field `digest(coalesce(new.PeerId, old.PeerId))`.
  */
 export declare function peerAuthorizationDigest(peerId: string): string;
 /**
- * Verify that `signature` is a valid authority ed25519 signature over `peerId`'s
- * authorization digest, using `authorityPublicKey` (base64url).
+ * Canonical digest an owner signs to VOUCH a `CadrePeer` membership row (insert
+ * and the owner re-touch update). Binds the peer id to the row's single-use
+ * `StampId` nonce, so a captured signed insert cannot be replayed (the `StampId` is
+ * unique) and — because {@link cadrePeerRemoveDigest} scopes a DIFFERENT payload — the
+ * stored voucher (`VouchSig`) cannot be replayed to authorize a delete.
+ *
+ * The SQL mirror is `digest(new.PeerId, new.StampId)` (two TEXT fields), matching the
+ * canonical multi-field framing in control-database.ts:buildAuthorizationMessage.
+ */
+export declare function cadrePeerVoucherDigest(peerId: string, stampId: string): string;
+/**
+ * Canonical digest an owner signs to REMOVE a `CadrePeer` row. Deliberately a
+ * distinct payload from {@link cadrePeerVoucherDigest} (adds the `'remove'` action
+ * tag) so the row's stored voucher — a signature over the voucher digest — can never
+ * satisfy this delete check. The signature is supplied in write context and never
+ * stored, so no reader can replay it; binding the live row's `StampId` also invalidates
+ * any captured remove after a delete+reinsert (the nonce rotates).
+ *
+ * SQL mirror: `digest(old.PeerId, old.StampId, 'remove')`.
+ */
+export declare function cadrePeerRemoveDigest(peerId: string, stampId: string): string;
+/**
+ * Verify that `signature` is a valid owner ed25519 signature over `peerId`'s
+ * authorization digest, using `ownerPublicKey` (base64url).
  *
  * This is the mirror of the signing done in
  * {@link SeedBootstrapService.authorizePeer}: it checks the signature against
  * {@link peerAuthorizationDigest}. A `true` result means the holder of the
- * authority private key vouched for this peer ID — it does NOT mean the peer is
+ * owner private key vouched for this peer ID — it does NOT mean the peer is
  * registered anywhere.
  *
  * Returns a boolean and never throws: malformed base64url, a bad/garbage key, or
  * any crypto failure resolves to `false` (callers want a verdict, not an
  * exception). The catch is logged at debug.
  */
-export declare function verifyPeerAuthorization(peerId: string, authorityPublicKey: string, signature: string): boolean;
+export declare function verifyPeerAuthorization(peerId: string, ownerPublicKey: string, signature: string): boolean;