@serfab/cadre-core 0.9.0 → 0.10.0

package/dist/delegate-admission.js

@@ -0,0 +1,244 @@
+/**
+ * Delegate-peer admission grants for a party control node that also runs the
+ * circuit-relay server.
+ *
+ * A strand node runs as its own libp2p instance with its own transport peerId,
+ * derived from the cadre identity key + strandId (`strand-transport-key.ts`).
+ * That derivation uses the member's PRIVATE seed by design, so no third party —
+ * including a co-cadre relay — can recompute it. When a NAT'd member's strand
+ * node tries to reserve a circuit-relay slot on a sibling's control node, the
+ * relay's membership connection gater sees an unknown peerId and denies the
+ * connection, which kills the reservation and fails the strand's
+ * `libp2p.start()` outright.
+ *
+ * The resolution (docs/strands.md → "Relays and admission"): a party control
+ * node running a relay is party-private infrastructure — it relays for its own
+ * party's nodes, including the extra transport identities its members' strand
+ * nodes run as, and for nobody else. The mechanism is a **member-announced
+ * delegate grant**: before a member's control node starts a strand node, it
+ * tells its siblings (over the already-authenticated `/sereus/strand-addr/1.0.0`
+ * RPC) the derived peerId that strand node will use, and the receiver holds a
+ * short-lived, in-memory admission grant for exactly that peerId. The grant is
+ * consulted ONLY by the connection-level gate
+ * (`CadreNode.admitInboundControlConnection`); the fail-closed per-stream gate
+ * (`authorizeInboundControlStream`) never honors it, so a delegate gets the
+ * connection (all a circuit-relay `hop` reservation needs) and nothing more.
+ *
+ * A grant is a delegation of trust to an already-trusted member: the receiver
+ * cannot verify that the announced peerId really is the member's strand node,
+ * so an authorized member can hand CONNECTION-level access to a peerId of its
+ * choosing for up to {@link DELEGATE_GRANT_TTL_MS}. The caps below bound how
+ * far a buggy or compromised member can stretch that.
+ *
+ * The receiver side is {@link DelegateAdmissionStore}. The announcer side keeps
+ * its own throttle state (a "last announced at" map that `CadreNode` owns) and
+ * decides from it, per reconcile pass, which relays are due a re-announce —
+ * {@link dueRelayAnnounces} and {@link pruneStoppedStrandAnnounces} are that
+ * decision, pure and testable, kept here beside the TTL they are derived from.
+ */
+import debug from 'debug';
+import { multiaddr } from '@multiformats/multiaddr';
+import { peerIdFromString } from '@libp2p/peer-id';
+const log = debug('sereus:cadre:delegate-admission');
+/**
+ * How long one announced delegate grant stays valid without a re-announce.
+ * Announcers refresh at half this (`CadreNode`'s reconcile pass), so a live
+ * strand's grant never lapses while its control node can still reach the relay.
+ */
+export const DELEGATE_GRANT_TTL_MS = 30 * 60 * 1000;
+/** Cap on live grants per announcing member (soonest-expiry evicted first). */
+export const MAX_DELEGATE_GRANTS_PER_MEMBER = 32;
+/** Cap on live grants in total (soonest-expiry evicted first). */
+export const MAX_DELEGATE_GRANTS = 256;
+/**
+ * Composite map key for the per-(peer, strand) state on both sides: the
+ * receiver's replace-per-(announcer, strand) grant, and the announcer's
+ * per-(target, strand) throttle timestamp.
+ */
+export function peerStrandKey(peerId, strandId) {
+    return `${peerId}\n${strandId}`;
+}
+/** The `strandId` half of a {@link peerStrandKey}. */
+function strandIdOfKey(key) {
+    return key.slice(key.indexOf('\n') + 1);
+}
+/**
+ * In-memory store of delegate admission grants, keyed by (announcer, strandId)
+ * so a re-announce REPLACES the previous delegate peerId rather than
+ * accumulating — a restarted strand cannot leak grants. Expired entries are
+ * pruned lazily on every read/write. Injectable `now` keeps expiry testable
+ * without fake timers.
+ */
+export class DelegateAdmissionStore {
+    constructor(ttlMs = DELEGATE_GRANT_TTL_MS) {
+        this.grants = new Map();
+        this.ttlMs = ttlMs;
+    }
+    /** Number of live (unexpired at last prune) grants — test/diagnostic surface. */
+    get size() {
+        return this.grants.size;
+    }
+    /**
+     * Record (or refresh) a grant: `delegatePeerId` acts on behalf of
+     * `announcerPeerId` for `strandId`, valid for the store's TTL from `now`.
+     * Enforces {@link MAX_DELEGATE_GRANTS_PER_MEMBER} and
+     * {@link MAX_DELEGATE_GRANTS}, evicting the soonest-expiry grant first —
+     * biased against the stalest delegation, never against the fresh announce.
+     */
+    grant(announcerPeerId, strandId, delegatePeerId, now = Date.now()) {
+        this.prune(now);
+        const key = peerStrandKey(announcerPeerId, strandId);
+        if (!this.grants.has(key)) {
+            this.evictAtCap(MAX_DELEGATE_GRANTS_PER_MEMBER, (g) => g.announcerPeerId === announcerPeerId);
+            this.evictAtCap(MAX_DELEGATE_GRANTS, () => true);
+        }
+        this.grants.set(key, { announcerPeerId, strandId, delegatePeerId, expiresAt: now + this.ttlMs });
+        log('Delegate grant recorded: %s → %s (strand %s, %d live)', announcerPeerId, delegatePeerId, strandId, this.grants.size);
+    }
+    /**
+     * Drop every grant. Called when the owning node stops: grants are scoped to
+     * the session that recorded them, and outliving it would admit delegates
+     * announced against a node that no longer exists.
+     */
+    clear() {
+        this.grants.clear();
+    }
+    /** Is `remotePeerId` covered by a live grant? Prunes expired entries as it goes. */
+    has(remotePeerId, now = Date.now()) {
+        this.prune(now);
+        for (const grant of this.grants.values()) {
+            if (grant.delegatePeerId === remotePeerId) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Drop every grant whose expiry has passed. */
+    prune(now) {
+        for (const [key, grant] of this.grants) {
+            if (grant.expiresAt <= now) {
+                this.grants.delete(key);
+            }
+        }
+    }
+    /**
+     * If the grants matching `filter` are at `cap`, evict the soonest-expiry one
+     * among them to make room for the insert the caller is about to do.
+     */
+    evictAtCap(cap, filter) {
+        let count = 0;
+        let victimKey;
+        let victimExpiry = Number.POSITIVE_INFINITY;
+        for (const [key, grant] of this.grants) {
+            if (!filter(grant)) {
+                continue;
+            }
+            count++;
+            if (grant.expiresAt < victimExpiry) {
+                victimExpiry = grant.expiresAt;
+                victimKey = key;
+            }
+        }
+        if (count >= cap && victimKey !== undefined) {
+            const victim = this.grants.get(victimKey);
+            this.grants.delete(victimKey);
+            log('Delegate grant cap %d hit — evicted soonest-expiry grant %s → %s (strand %s)', cap, victim.announcerPeerId, victim.delegatePeerId, victim.strandId);
+        }
+    }
+}
+/**
+ * Extract the circuit relays named by a multiaddr list — for each
+ * `…/p2p/<relay>/p2p-circuit…` entry, the relay's peerId and its direct dial
+ * prefix. A bare `/p2p-circuit` (no relay named), a non-circuit addr, an
+ * unparsable addr, and an unparsable relay peerId are all skipped. A trailing
+ * `/p2p/<dst>` after the circuit component names the DESTINATION, never the
+ * relay, and is ignored. Deduplicated by relay peerId (first addr wins).
+ */
+export function extractCircuitRelayTargets(addrs) {
+    const byRelay = new Map();
+    for (const addr of addrs) {
+        const target = circuitRelayTarget(addr);
+        if (target && !byRelay.has(target.relayPeerId)) {
+            byRelay.set(target.relayPeerId, target);
+        }
+    }
+    return [...byRelay.values()];
+}
+/**
+ * Of `relays`, the ones whose grant for `strandId` is due a re-announce: never
+ * announced to, or last announced at least half the TTL ago. Half, so a failed
+ * refresh has one more attempt before the grant lapses — a lapsed grant means
+ * the relay denies the strand node's reservation re-dial.
+ *
+ * `announceAt` is the announcer-side "last announced at" map, keyed by
+ * {@link peerStrandKey} on the peer announced TO.
+ */
+export function dueRelayAnnounces(announceAt, relays, strandId, now, ttlMs = DELEGATE_GRANT_TTL_MS) {
+    return relays.filter((relay) => now - (announceAt.get(peerStrandKey(relay.relayPeerId, strandId)) ?? 0) >= ttlMs / 2);
+}
+/**
+ * Drop `announceAt` entries whose strand is no longer running — a stopped
+ * strand needs no refresh, and without this the map grows for the node's
+ * lifetime. Mutates in place.
+ */
+export function pruneStoppedStrandAnnounces(announceAt, runningStrandIds) {
+    for (const key of announceAt.keys()) {
+        if (!runningStrandIds.has(strandIdOfKey(key))) {
+            announceAt.delete(key);
+        }
+    }
+}
+/**
+ * The circuit relay named by `addr`, throwing when `addr` is unparsable or names
+ * no relay. The throwing form exists for CONFIG-facing callers (`relay-addrs.ts`),
+ * where a typo must fail loudly rather than cost the node its reachability;
+ * {@link extractCircuitRelayTargets} reads runtime-discovered addrs instead and
+ * logs-and-skips.
+ */
+export function circuitRelayTargetOrThrow(addr) {
+    const target = parseCircuitRelayTarget(addr);
+    if (!target) {
+        throw new Error(`Multiaddr names no circuit relay (expected …/p2p/<relayPeerId>/p2p-circuit): ${addr}`);
+    }
+    return target;
+}
+/**
+ * The circuit relay named by `addr`; null when `addr` is well-formed but simply
+ * names no relay (a direct listen addr, a bare `/p2p-circuit`), and THROWS when
+ * `addr` is malformed (unparsable multiaddr, garbage relay peerId). The two
+ * callers want opposite things from the first case and the same thing from the
+ * second, so the distinction lives here rather than in either of them.
+ */
+function parseCircuitRelayTarget(addr) {
+    const ma = multiaddr(addr);
+    const components = ma.getComponents();
+    const circuitIdx = components.findIndex((c) => c.name === 'p2p-circuit');
+    if (circuitIdx < 1) {
+        return null;
+    }
+    const relay = components[circuitIdx - 1];
+    if (relay.name !== 'p2p' || !relay.value) {
+        return null;
+    }
+    peerIdFromString(relay.value); // validate; throws on garbage
+    return {
+        relayPeerId: relay.value,
+        relayAddr: ma.decapsulate('/p2p-circuit').toString()
+    };
+}
+/**
+ * One-addr body of {@link extractCircuitRelayTargets}; null when `addr` names no
+ * relay. Only a MALFORMED addr logs — the addr lists this reads (a node's live
+ * multiaddrs, its configured listen addrs) are mostly direct addrs, and calling
+ * each of those "unparsable" is both wrong and per-announce noise.
+ */
+function circuitRelayTarget(addr) {
+    try {
+        return parseCircuitRelayTarget(addr);
+    }
+    catch (err) {
+        log('Skipping unparsable relay addr %s: %o', addr, err);
+        return null;
+    }
+}
+//# sourceMappingURL=delegate-admission.js.map

package/dist/delegate-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate-admission.js","sourceRoot":"","sources":["../src/delegate-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAcvC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,OAAO,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAIjC,YAAY,QAAgB,qBAAqB;QAHhC,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAIzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAuB,EAAE,QAAgB,EAAE,cAAsB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CACb,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAC7C,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,uDAAuD,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5H,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,oFAAoF;IACpF,GAAG,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,GAAW,EAAE,MAAyC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAA6B,CAAC;QAClC,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;gBACnC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,GAAG,CAAC,8EAA8E,EAChF,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAe;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAuC,EACvC,MAAqC,EACrC,QAAgB,EAChB,GAAW,EACX,QAAgB,qBAAqB;IAErC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAChG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAA+B,EAC/B,gBAAqC;IAErC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B;IAC7D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/device-token.d.ts

@@ -4,20 +4,20 @@
  * another peer's row.
  *
  * Modeled directly on {@link peerRecordSignedPayload} (peer-record.ts): the signed
- * payload is a single SHA-256 digest of a delimited string of the authenticated
- * fields. It is intentionally NOT JSON-canonicalized — a delimited digest is
- * trivially deterministic across node/browser/RN (plain string concat + sha256, no
- * key ordering) and is reconstructable inside the `DeviceToken.AuthorizedUpdate` SQL
- * constraint from the row's own columns:
+ * payload is a single SHA-256 digest over the shared domain-tagged field vector
+ * (see control-authorization.ts) — the crypto plugin's injective multi-field
+ * encoding, so no field split is ambiguous even with an opaque platform token. It
+ * is intentionally NOT JSON-canonicalized (deterministic across node/browser/RN,
+ * no key ordering) and is reconstructable inside the `DeviceToken.AuthorizedUpdate`
+ * SQL constraint from the row's own columns:
  *
- *   digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|'
- *          || cast(new.UpdatedAt as text))
+ *   digest('CadreControl.DeviceToken', 'publish',
+ *          new.PeerId, new.Platform, new.Token, cast(new.UpdatedAt as text))
  *
  * Keep {@link deviceTokenSignedPayload} and that constraint byte-for-byte in sync.
- * The `'|'` delimiter is safe: a base58btc PeerId, a fixed `'fcm'`/`'apns'` platform
- * string, and a base-10 integer never contain it. The opaque platform token is the
- * last variable-length field before the integer stamp, so even a token containing a
- * `'|'` cannot create a collision with a different field split.
+ * The `'publish'` action tag marks this as a peer's SELF-signed record (signed with
+ * the peer's own key, not an owner key) and keeps it disjoint from every
+ * owner-signed digest.
  *
  * Unlike a peer-address record, a device-token record carries NO public key: the
  * signature is verified against the `CadrePeer.PublicKey` bound to the same PeerId

package/dist/device-token.js

@@ -4,20 +4,20 @@
  * another peer's row.
  *
  * Modeled directly on {@link peerRecordSignedPayload} (peer-record.ts): the signed
- * payload is a single SHA-256 digest of a delimited string of the authenticated
- * fields. It is intentionally NOT JSON-canonicalized — a delimited digest is
- * trivially deterministic across node/browser/RN (plain string concat + sha256, no
- * key ordering) and is reconstructable inside the `DeviceToken.AuthorizedUpdate` SQL
- * constraint from the row's own columns:
+ * payload is a single SHA-256 digest over the shared domain-tagged field vector
+ * (see control-authorization.ts) — the crypto plugin's injective multi-field
+ * encoding, so no field split is ambiguous even with an opaque platform token. It
+ * is intentionally NOT JSON-canonicalized (deterministic across node/browser/RN,
+ * no key ordering) and is reconstructable inside the `DeviceToken.AuthorizedUpdate`
+ * SQL constraint from the row's own columns:
  *
- *   digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|'
- *          || cast(new.UpdatedAt as text))
+ *   digest('CadreControl.DeviceToken', 'publish',
+ *          new.PeerId, new.Platform, new.Token, cast(new.UpdatedAt as text))
  *
  * Keep {@link deviceTokenSignedPayload} and that constraint byte-for-byte in sync.
- * The `'|'` delimiter is safe: a base58btc PeerId, a fixed `'fcm'`/`'apns'` platform
- * string, and a base-10 integer never contain it. The opaque platform token is the
- * last variable-length field before the integer stamp, so even a token containing a
- * `'|'` cannot create a collision with a different field split.
+ * The `'publish'` action tag marks this as a peer's SELF-signed record (signed with
+ * the peer's own key, not an owner key) and keeps it disjoint from every
+ * owner-signed digest.
  *
  * Unlike a peer-address record, a device-token record carries NO public key: the
  * signature is verified against the `CadrePeer.PublicKey` bound to the same PeerId
@@ -25,14 +25,15 @@
  * membership row already lives.
  */
 import { digest, sign, verify } from '@optimystic/quereus-plugin-crypto';
+import { controlAuthorizationFields } from './control-authorization.js';
 /**
  * Build the base64url SHA-256 digest that the self-signature covers. Mirrors the
  * `DeviceToken.AuthorizedUpdate` constraint exactly; both sides take the default
  * base64url output of a single `digest(...)`, which round-trips cleanly.
  */
 export function deviceTokenSignedPayload(record) {
-    const joined = `${record.peerId}|${record.platform}|${record.token}|${record.updatedAt}`;
-    return digest([joined], 'sha256', 'base64url');
+    const fields = controlAuthorizationFields('CadreControl.DeviceToken', 'publish', [record.peerId, record.platform, record.token, String(record.updatedAt)]);
+    return digest(fields, 'sha256', 'base64url');
 }
 /**
  * Sign a device-token record with the ed25519 private key behind its `peerId`.

package/dist/device-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-token.js","sourceRoot":"","sources":["../src/device-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGzE;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsC;IAC7E,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;IACzF,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAsC,EACtC,aAAqB;IAErB,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACF,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;AACrH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB,EAAE,YAAoB;IACxF,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,MAAM,CACX,aAAa,EACb,MAAM,CAAC,GAAG,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"device-token.js","sourceRoot":"","sources":["../src/device-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsC;IAC7E,MAAM,MAAM,GAAG,0BAA0B,CACvC,0BAA0B,EAC1B,SAAS,EACT,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACzE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAsC,EACtC,aAAqB;IAErB,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACF,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;AACrH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB,EAAE,YAAoB;IACxF,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,MAAM,CACX,aAAa,EACb,MAAM,CAAC,GAAG,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC;AAC7C,CAAC"}

package/dist/ed25519-key.d.ts

@@ -40,3 +40,29 @@ export declare function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed2551
  * @returns The base64url-encoded Ed25519 public key.
  */
 export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): string;
+/**
+ * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
+ * before it reaches the control database, where a malformed key would otherwise sit
+ * indistinguishable from a real one until some later, unrelated signature check fails.
+ *
+ * Trims first, reusing the blank-value message for an empty result so that case keeps its
+ * existing wording instead of a confusing base64url error. Every rejection names the offending
+ * value (capped, see {@link describeRejected}) — with several keys in one batch, the message is
+ * the only thing that says WHICH one. Does not check the decoded bytes
+ * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
+ * signature verification later exactly like any other wrong key.
+ *
+ * **This rule is restated once outside this package**, in `validateOwnerKey`
+ * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
+ * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
+ * directly. Change the rule here and change it there — the copies are kept in step by
+ * hand, since neither package can import the other's. Each side pins its own copy to the
+ * same accept/reject table (`test/ed25519-key.spec.ts` here,
+ * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
+ * package it was made in and lands the editor on this pointer.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 public key.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The trimmed value, so callers write the same bytes they validated.
+ */
+export declare function requireEd25519PublicKeyB64(value: string, label: string): string;

package/dist/ed25519-key.js

@@ -1,4 +1,4 @@
-import { toString as uint8ArrayToString } from 'uint8arrays';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
@@ -48,4 +48,59 @@ export function ed25519KeyPairFromLibp2p(privateKey) {
 export function ed25519PublicKeyFromPrivate(privateKeyB64) {
     return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url');
 }
+/** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
+const REJECTED_VALUE_ECHO_LIMIT = 64;
+/**
+ * Render a rejected value for an error message, capped: owner keys now reach this check
+ * from remote-supplied fields (a `CadreInvite`'s `ownerKeys`, a donation request's
+ * `ownerKeys`), so an unbounded echo would let a peer turn one junk string into a
+ * megabyte of log line.
+ */
+function describeRejected(value) {
+    return value.length <= REJECTED_VALUE_ECHO_LIMIT
+        ? value
+        : `${value.slice(0, REJECTED_VALUE_ECHO_LIMIT)}… (${value.length} chars)`;
+}
+/**
+ * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
+ * before it reaches the control database, where a malformed key would otherwise sit
+ * indistinguishable from a real one until some later, unrelated signature check fails.
+ *
+ * Trims first, reusing the blank-value message for an empty result so that case keeps its
+ * existing wording instead of a confusing base64url error. Every rejection names the offending
+ * value (capped, see {@link describeRejected}) — with several keys in one batch, the message is
+ * the only thing that says WHICH one. Does not check the decoded bytes
+ * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
+ * signature verification later exactly like any other wrong key.
+ *
+ * **This rule is restated once outside this package**, in `validateOwnerKey`
+ * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
+ * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
+ * directly. Change the rule here and change it there — the copies are kept in step by
+ * hand, since neither package can import the other's. Each side pins its own copy to the
+ * same accept/reject table (`test/ed25519-key.spec.ts` here,
+ * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
+ * package it was made in and lands the editor on this pointer.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 public key.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The trimmed value, so callers write the same bytes they validated.
+ */
+export function requireEd25519PublicKeyB64(value, label) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        throw new Error(`A ${label} is required (received an empty or whitespace-only value)`);
+    }
+    let decoded;
+    try {
+        decoded = uint8ArrayFromString(trimmed, 'base64url');
+    }
+    catch (error) {
+        throw new Error(`A ${label} must be a base64url-encoded Ed25519 public key (could not decode "${describeRejected(trimmed)}" as base64url)`, { cause: error });
+    }
+    if (decoded.length !== 32) {
+        throw new Error(`A ${label} must be a base64url-encoded 32-byte Ed25519 public key ("${describeRejected(trimmed)}" decoded to ${decoded.length} bytes)`);
+    }
+    return trimmed;
+}
 //# sourceMappingURL=ed25519-key.js.map

package/dist/ed25519-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAgBjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC"}
+{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAgBjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/file-durable-slot.d.ts

@@ -0,0 +1,20 @@
+import type { DurableSlot } from './node-local-snapshot.js';
+export declare class FileDurableSlot implements DurableSlot {
+    private readonly dir;
+    private readonly name;
+    /** Filename-safe form of the party id, shared by the record and temp paths. */
+    private readonly encodedParty;
+    constructor(dir: string, name: string, partyId: string);
+    /**
+     * The record's bytes as text. An absent file (ENOENT — including an absent
+     * directory) is `undefined`, a cold start. Every other read failure
+     * (EACCES, EISDIR, EIO, …) THROWS, per {@link DurableSlot.load}: the caller
+     * must not mistake an unreadable file for an empty one and snapshot-write
+     * over it.
+     */
+    load(): Promise<string | undefined>;
+    save(text: string): Promise<void>;
+    private filePath;
+    /** Sibling temp path for the atomic replace (random component: collide-free). */
+    private tempPath;
+}

package/dist/file-durable-slot.js

@@ -0,0 +1,53 @@
+/**
+ * Node-only {@link DurableSlot} backend: one JSON file per party under `dir`,
+ * at `<dir>/<name>.<encoded partyId>.json` (0600, atomically replaced on every
+ * save), so one directory can hold the same node-local record for several
+ * parties without cross-party leakage.
+ *
+ * This is the whole platform-specific part of the file-backed node-local
+ * stores (`trusted-owner-store-file.ts`, `bootstrap-peer-store-file.ts`); the
+ * load policy, envelope and write chain are cross-platform in
+ * `node-local-snapshot.ts`. Like its two importers, this module imports
+ * `node:fs/promises`, so it is kept OUT of the package's cross-platform
+ * default entry and is not itself an exported subpath.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { encodeFileSafeComponent, isNotFound, writeFileAtomically } from './fs-atomic.js';
+export class FileDurableSlot {
+    constructor(dir, name, partyId) {
+        this.dir = dir;
+        this.name = name;
+        this.encodedParty = encodeFileSafeComponent(partyId);
+    }
+    /**
+     * The record's bytes as text. An absent file (ENOENT — including an absent
+     * directory) is `undefined`, a cold start. Every other read failure
+     * (EACCES, EISDIR, EIO, …) THROWS, per {@link DurableSlot.load}: the caller
+     * must not mistake an unreadable file for an empty one and snapshot-write
+     * over it.
+     */
+    async load() {
+        try {
+            return (await readFile(this.filePath())).toString('utf8');
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return undefined;
+            throw new Error(`FileDurableSlot: ${this.filePath()} is present but unreadable`, { cause: error });
+        }
+    }
+    async save(text) {
+        await writeFileAtomically(this.dir, this.tempPath(), this.filePath(), new TextEncoder().encode(text));
+    }
+    filePath() {
+        return join(this.dir, `${this.name}.${this.encodedParty}.json`);
+    }
+    /** Sibling temp path for the atomic replace (random component: collide-free). */
+    tempPath() {
+        const unique = randomBytes(6).toString('hex');
+        return join(this.dir, `${this.name}.${this.encodedParty}.${unique}.tmp`);
+    }
+}
+//# sourceMappingURL=file-durable-slot.js.map

package/dist/file-durable-slot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-durable-slot.js","sourceRoot":"","sources":["../src/file-durable-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1F,MAAM,OAAO,eAAe;IAI3B,YACkB,GAAW,EACX,IAAY,EAC7B,OAAe;QAFE,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAG7B,IAAI,CAAC,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI;QACT,IAAI,CAAC;YACJ,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvG,CAAC;IAEO,QAAQ;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,iFAAiF;IACzE,QAAQ;QACf,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC;IAC1E,CAAC;CACD"}