@serfab/cadre-core 0.9.0 → 0.10.0

package/dist/fs-atomic.js

@@ -0,0 +1,97 @@
+/**
+ * Node-only filesystem helpers: atomic file write, filename-safe encoding, and
+ * the ENOENT check, shared by `key-store-file.ts` and `file-durable-slot.ts`.
+ *
+ * This module imports `node:fs/promises`, so — like its consumers — it is kept
+ * OUT of the package's cross-platform default entry and is not itself an
+ * exported subpath; it is only reachable through the Node-only store modules.
+ */
+import debug from 'debug';
+import { mkdir, rm, rename, open } from 'node:fs/promises';
+const log = debug('sereus:cadre:fs-atomic');
+/** Best-effort POSIX permissions (ignored on Windows / unsupported FSes). */
+export const DIR_MODE = 0o700;
+export const FILE_MODE = 0o600;
+/**
+ * Percent-encode a string into a filesystem-safe filename component. Beyond
+ * `encodeURIComponent` (which already escapes `/`, spaces, and unicode), this
+ * also escapes the unreserved characters `encodeURIComponent` leaves intact but
+ * that are unsafe in filenames on some platforms (notably `*` on Windows) — and
+ * `.`, so a file suffix appended by the caller is the only literal dot, making
+ * suffix-stripping unambiguous. Reversed by `decodeURIComponent`. The result
+ * contains only `A-Za-z0-9-_` and `%XX`.
+ */
+export function encodeFileSafeComponent(component) {
+    return encodeURIComponent(component).replace(/[!'()*~.]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Whether an unknown error is a Node "file/dir not found" (ENOENT). */
+export function isNotFound(error) {
+    return typeof error === 'object' && error !== null
+        && error.code === 'ENOENT';
+}
+/**
+ * Crash-atomic file write: a concurrent reader sees either the complete
+ * previous bytes or the complete new bytes, never a torn file. `dir` is created
+ * (0700) if absent; the data is written to `tmpPath` (created exclusively,
+ * 0600), fsync'd, then atomically renamed onto `finalPath`. A failure at any
+ * point removes the temp file and leaves the previous file untouched.
+ *
+ * `tmpPath` must be a sibling of `finalPath` (same directory) so the rename
+ * stays within one filesystem and is therefore atomic, and should carry a
+ * random component so concurrent writers (and crash-orphaned leftovers) are
+ * collide-free.
+ *
+ * Durability bar: the temp file is fsync'd before the rename so a power loss
+ * cannot surface a file whose bytes never reached the platter, and `dir` is
+ * fsync'd afterwards (best-effort — see {@link syncDirBestEffort}) so the
+ * rename itself survives a crash. On POSIX `rename(2)` replaces atomically;
+ * Node maps to `MoveFileEx(MOVEFILE_REPLACE_EXISTING)` on Windows, which is
+ * also atomic — though it can fail with `EPERM`/`EBUSY` if another process
+ * holds the destination open. That cross-process case is out of scope for the
+ * single-flight in-process callers here; such a failure surfaces to the caller
+ * with the previous file left intact.
+ */
+export async function writeFileAtomically(dir, tmpPath, finalPath, data) {
+    await mkdir(dir, { recursive: true, mode: DIR_MODE });
+    // 'wx' creates the temp file exclusively; a name collision (astronomically
+    // unlikely given the caller's random component) fails here before we own anything.
+    const handle = await open(tmpPath, 'wx', FILE_MODE);
+    try {
+        try {
+            await handle.writeFile(data);
+            await handle.sync(); // land bytes on disk before the rename exposes them
+        }
+        finally {
+            await handle.close().catch(() => { });
+        }
+        await rename(tmpPath, finalPath);
+    }
+    catch (error) {
+        // Any failure after creation (write, sync, or rename): drop the temp
+        // file so a retry leaves no `.tmp` debris. The destination is only ever
+        // swapped by the atomic rename, so the previous bytes stay intact.
+        await rm(tmpPath, { force: true }).catch(() => { });
+        throw error;
+    }
+    await syncDirBestEffort(dir);
+}
+/**
+ * Best-effort fsync of a directory so a fresh file's directory entry is
+ * durable across power loss. Opening a directory for fsync is not portable
+ * (unsupported on Windows and some filesystems), and rename atomicity does not
+ * depend on it — so a failure here is logged and swallowed, never surfaced.
+ */
+async function syncDirBestEffort(dir) {
+    let dirHandle;
+    try {
+        dirHandle = await open(dir, 'r');
+        await dirHandle.sync();
+    }
+    catch (error) {
+        log('directory fsync skipped for %s: %o', dir, error);
+    }
+    finally {
+        await dirHandle?.close().catch(() => { });
+    }
+}
+//# sourceMappingURL=fs-atomic.js.map

package/dist/fs-atomic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-atomic.js","sourceRoot":"","sources":["../src/fs-atomic.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG3D,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACxD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,OAAO,CAC3C,YAAY,EACZ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACvD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;WAC7C,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,GAAW,EACX,OAAe,EACf,SAAiB,EACjB,IAAgB;IAEhB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC;QACJ,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,oDAAoD;QAC1E,CAAC;gBAAS,CAAC;YACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,SAAiC,CAAC;IACtC,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,oCAAoC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QACV,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;AACF,CAAC"}

package/dist/identity-key.d.ts

@@ -0,0 +1,49 @@
+import type { PrivateKey } from '@libp2p/interface';
+import { type KeyId, type KeyStore } from './key-store.js';
+/**
+ * Load the node identity key from `keyStore`, generating and persisting a fresh
+ * Ed25519 key when the slot is empty.
+ *
+ * A rejected `get` (e.g. {@link KeyStoreAccessError} from a cancelled biometric
+ * prompt) **propagates** — we never fall through to generation on a read error,
+ * because that would silently orphan an existing but momentarily unreadable
+ * identity. Corrupt bytes in the slot likewise throw rather than regenerate.
+ *
+ * Idempotent in effect: a second call on a populated store loads the stored key
+ * and writes nothing.
+ *
+ * @param keyStore - Backend the identity is read from / persisted to.
+ * @param keyId - Slot id; defaults to {@link DEFAULT_IDENTITY_KEY_ID}.
+ * @returns The resolved libp2p private key.
+ */
+export declare function loadOrCreateIdentityKey(keyStore: KeyStore, keyId?: KeyId): Promise<PrivateKey>;
+/**
+ * Proof-of-possession signer for a node key, for out-of-band HTTP services that
+ * want to attribute a request to a peer id.
+ *
+ * Deliberately generic — it carries no ICE/TURN vocabulary, and the message it
+ * signs is the caller's business. The one consumer today is the reference apps'
+ * `loadIceConfig`, which signs the TURN credential issuer's peer assertion; those
+ * files mirror this interface structurally rather than importing it, so they stay
+ * dependency-free.
+ */
+export interface PeerKeySigner {
+    /** base58btc peer id — the same string libp2p reports for this node. */
+    readonly peerId: string;
+    /** base64url of the libp2p protobuf-encoded public key. */
+    readonly publicKeyB64: string;
+    /** Sign the UTF-8 bytes of `message`; resolves to a base64url signature. */
+    sign(message: string): Promise<string>;
+}
+/**
+ * Wrap a libp2p private key as a {@link PeerKeySigner}.
+ *
+ * Ed25519 only: the peer id is derived as an identity multihash (so
+ * `publicKey.toString()` already *is* the base58btc peer id — no `@libp2p/peer-id`
+ * round trip needed), and verifiers of this proof accept nothing else.
+ *
+ * @param privateKey - The node's libp2p Ed25519 private key.
+ * @returns A signer exposing the peer id, the encoded public key, and `sign`.
+ * @throws If the key is not Ed25519.
+ */
+export declare function peerKeySigner(privateKey: PrivateKey): PeerKeySigner;

package/dist/identity-key.js

@@ -0,0 +1,81 @@
+/**
+ * identity-key — the load-or-create rule for a {@link KeyStore}-backed node
+ * identity, plus the "prove you hold this node key" signer built on top of it.
+ *
+ * Both live here because both are needed *outside* `CadreNode`: an embedding app
+ * (the React Native reference app) has to resolve its identity key before the node
+ * is constructed, so it can sign an out-of-band HTTP request with the same key the
+ * node will then load. Keeping one copy of the load-or-create rule is load-bearing
+ * — a second copy that drifted could generate a fresh key and orphan the real
+ * identity.
+ *
+ * Dependency-free beyond `@libp2p/crypto` + `uint8arrays` (both already core
+ * dependencies), so this module is safe in every (RN / browser / Node) entry graph.
+ */
+import debug from 'debug';
+import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf, publicKeyToProtobuf } from '@libp2p/crypto/keys';
+import { toString as uint8ArrayToString } from 'uint8arrays';
+import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
+const log = debug('sereus:cadre:identity-key');
+/**
+ * Load the node identity key from `keyStore`, generating and persisting a fresh
+ * Ed25519 key when the slot is empty.
+ *
+ * A rejected `get` (e.g. {@link KeyStoreAccessError} from a cancelled biometric
+ * prompt) **propagates** — we never fall through to generation on a read error,
+ * because that would silently orphan an existing but momentarily unreadable
+ * identity. Corrupt bytes in the slot likewise throw rather than regenerate.
+ *
+ * Idempotent in effect: a second call on a populated store loads the stored key
+ * and writes nothing.
+ *
+ * @param keyStore - Backend the identity is read from / persisted to.
+ * @param keyId - Slot id; defaults to {@link DEFAULT_IDENTITY_KEY_ID}.
+ * @returns The resolved libp2p private key.
+ */
+export async function loadOrCreateIdentityKey(keyStore, keyId = DEFAULT_IDENTITY_KEY_ID) {
+    // A rejection here (e.g. KeyStoreAccessError) must propagate — do NOT fall
+    // through to generation, which would orphan an existing but unreadable key.
+    const bytes = await keyStore.get(keyId);
+    if (bytes) {
+        // Corrupt/garbage bytes throw here; surface loudly rather than
+        // regenerating (which would orphan the real identity).
+        const loaded = privateKeyFromProtobuf(bytes);
+        log('Identity key loaded from key store (slot present)');
+        return loaded;
+    }
+    const generated = await generateKeyPair('Ed25519');
+    await keyStore.set(keyId, privateKeyToProtobuf(generated));
+    log('Identity key generated and persisted to key store (first run)');
+    return generated;
+}
+/**
+ * Wrap a libp2p private key as a {@link PeerKeySigner}.
+ *
+ * Ed25519 only: the peer id is derived as an identity multihash (so
+ * `publicKey.toString()` already *is* the base58btc peer id — no `@libp2p/peer-id`
+ * round trip needed), and verifiers of this proof accept nothing else.
+ *
+ * @param privateKey - The node's libp2p Ed25519 private key.
+ * @returns A signer exposing the peer id, the encoded public key, and `sign`.
+ * @throws If the key is not Ed25519.
+ */
+export function peerKeySigner(privateKey) {
+    if (privateKey.type !== 'Ed25519') {
+        throw new Error(`peerKeySigner requires an Ed25519 key, got ${privateKey.type}`);
+    }
+    const publicKey = privateKey.publicKey;
+    // For Ed25519 the public key's digest is an identity multihash, so its string
+    // form is the peer id itself — the same value `peerIdFromPrivateKey` produces.
+    const peerId = publicKey.toString();
+    const publicKeyB64 = uint8ArrayToString(publicKeyToProtobuf(publicKey), 'base64url');
+    return {
+        peerId,
+        publicKeyB64,
+        async sign(message) {
+            const signature = await privateKey.sign(new TextEncoder().encode(message));
+            return uint8ArrayToString(signature, 'base64url');
+        }
+    };
+}
+//# sourceMappingURL=identity-key.js.map

package/dist/identity-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-key.js","sourceRoot":"","sources":["../src/identity-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzH,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,uBAAuB,EAA6B,MAAM,gBAAgB,CAAC;AAEpF,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,QAAe,uBAAuB;IAEtC,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,+DAA+D;QAC/D,uDAAuD;QACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,UAAsB;IAClD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IAErF,OAAO;QACL,MAAM;QACN,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,OAAe;YACxB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,OAAO,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,23 +1,31 @@
 export * from './types.js';
 export { canonicalJson } from './canonical-json.js';
 export { CadreNode } from './cadre-node.js';
-export { ControlDatabase, buildAuthorizationMessage, type ControlDatabaseConfig, type ControlTable } from './control-database.js';
-export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, type Ed25519KeyPair } from './ed25519-key.js';
+export { ControlDatabase, MissingHostStrandError, buildAuthorizationMessage, formationVouchMessage, formationConsentMessage, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type MembershipChangeListener, type GuardedDeleteListener, type RevokedRowRef } from './control-database.js';
+export { CONTROL_WRITE_ATTEMPTS, CONTROL_WRITE_RETRY_BUDGET_MS, SCHEMA_INIT_ATTEMPTS, SCHEMA_INIT_RETRY_POLICY, isRetriableControlWriteFailure, isRetriableSchemaInitFailure, retryControlWrite, type ControlWriteRetryOptions } from './control-write-retry.js';
+export { controlAuthorizationFields, type ControlDomain, type ControlAction } from './control-authorization.js';
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
 export { InMemoryKeyStore, KeyStoreAccessError, DEFAULT_IDENTITY_KEY_ID, type KeyStore, type KeyId } from './key-store.js';
+export { loadOrCreateIdentityKey, peerKeySigner, type PeerKeySigner } from './identity-key.js';
+export { MemoryTrustedOwnerStore, PersistentTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
+export type { DurableSlot } from './node-local-snapshot.js';
+export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore, type BootstrapPeerStore, type BootstrapPeerEntry } from './bootstrap-peer-store.js';
 export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
 export { StrandWatcher, type StrandWatcherCallbacks, type StrandQueryable, type SAppIdLookup, type StrandRowWithApp } from './strand-watcher.js';
 export { StrandInstanceManager, type StartStrandConfig, type ResumeStrandOverrides, getStrandStoragePath } from './strand-instance-manager.js';
+export { StrandBackfill, DEFAULT_STRAND_BACKFILL, MAX_BLOCK_MESSAGE_BYTES, type StrandBackfillConfig, type StrandBackfillDeps, type StrandBackfillResult, type StrandBackfillPushClient } from './strand-backfill.js';
 export { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
 export { ArachnodeStub, createArachnodeStub, type RingConfig } from './arachnode-stub.js';
 export { EnrollmentService, type MemberVerifier, type MemberRegistry } from './enrollment.js';
-export { StrandSolicitationService, createDefaultFormationResponseValidator, type DisclosureValidator, type FormationUsageRecorder, type ResolvedHostStrand, type StrandProvisioner, type FormationSigner, type FormationResponseValidator, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
+export { StrandSolicitationService, createDefaultFormationResponseValidator, type DisclosureValidator, type FormationUsageRecorder, type ResolvedHostStrand, type StrandProvisioner, type FormationResponseValidator, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
+export { createHttpFormationApprover, signFormationApproval, verifyFormationApproval, FormationApprovalError, type FormationApprovalRequest, type FormationVouchFields, type FormationApproval, type FormationApprover, type FormationApprovalFailure } from './formation-approval.js';
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-export { signStrandPayload, verifyStrandPayload, bootstrapFounderMembership, issueInvite, consumeInvite, addMemberByManager, registerMemberPeer, addManager, removeManager, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type AddMemberByManagerParams, type RegisterMemberPeerParams, type AddManagerParams, type RemoveManagerParams } from './strand-membership-writer.js';
+export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, issueInvite, consumeInvite, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, STRAND_ENGINE, STRAND_ENGINE_VERSION, type FounderBootstrapParams, type IssueInviteParams, type IssuedInvite, type ConsumeInviteParams, type CancelInviteParams, type OutstandingInvite, type AddMemberByManagerParams, type RevokeMemberParams, type LeaveStrandParams, type RegisterMemberPeerParams, type RemoveOwnPeerParams, type RemoveMemberPeerByManagerParams, type RemoveMemberPeerParams, type AddManagerParams, type AdmitManagerParams, type RemoveManagerParams } from './strand-membership-writer.js';
 export { canonicalDatetime } from './canonical-datetime.js';
 export { StrandMemberRegistry, StrandMemberVerifier, memberRegistrationPayload, type StrandAdmission } from './strand-member-registry.js';
 export { SeedBootstrapService, SEED_PROTOCOL, ed25519PublicKeyB64FromPeerId, type SeedBootstrapConfig, type SeedEventCallbacks } from './seed-bootstrap.js';
-export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, verifyPeerAuthorization } from './peer-authorization.js';
+export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, deviceTokenAddDigest, deviceTokenRemoveDigest, formationConsentDigest, verifyPeerAuthorization, verifyCadrePeerVoucher, verifyFormationConsent, type DeviceTokenAuthorizedRow } from './peer-authorization.js';
 export { StrandWakeService, dialWake, WAKE_PROTOCOL, type StrandWakeServiceOptions, type DialWakeOptions } from './strand-wake-protocol.js';
 export { StrandAddrService, collectStrandAddrs, STRAND_ADDR_PROTOCOL, type StrandAddrServiceOptions, type StrandAddrPeer, type CollectStrandAddrsOptions } from './strand-addr-protocol.js';
 export { peerRecordSignedPayload, signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, isSignalingAddr, orderSignalingFirst, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
@@ -27,8 +35,10 @@ export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.
 export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
 export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS, type PushFanoutOptions, type FanoutMember } from './push-fanout.js';
 export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE, type ControlCohortSelection } from './control-cohort.js';
-export { dbAnchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy, type SeedTrustPolicy, type SeedTrustContext, type SeedTrustDecision } from './seed-trust-policy.js';
+export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy, type SeedTrustPolicy, type SeedTrustContext, type SeedTrustDecision } from './seed-trust-policy.js';
 export { signSchema, verifySchema, assertSchemaSignature, SchemaVerificationError } from './schema-verification.js';
 export { FormationListener, dialFormation, isValidResponderCreatesResult, FORMATION_PROTOCOL, type FormationParty, type FormationContactMessage, type FormationResultMessage, type FormationProvisionResult, type FormationStrandInfo, type FormationDbConnectionInfo, type FormationListenerOptions, type FormationDialOptions, type ResponderProvisionOutcome } from './strand-formation-protocol.js';
 export { StrandFormationManager, createStrandFormationManager, type StrandFormationManagerConfig, type StrandFormationManagerOptions } from './strand-formation-manager.js';
+export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROLLMENT_WINDOW_MS, ADMISSION_DECISION_TIMEOUT_MS, type InboundAdmissionPolicy } from './membership-connection-gater.js';
+export { circuitMultiaddrs, superviseRelayReservation, DEFAULT_RELAY_RESERVE_TIMEOUT_MS, DEFAULT_RELAY_RESERVE_POLL_MS, DEFAULT_RELAY_CHECK_MS, DEFAULT_RELAY_MIN_BACKOFF_MS, DEFAULT_RELAY_MAX_BACKOFF_MS, type RelayReservationStatus, type RelayReservationState, type RelayReserveOptions, type RelayReservationSupervisor, type RelayReservationSupervisorOptions } from './relay-reservation.js';
 export { classifyTransport, classifyConnectionPath, summarizeConnectionPaths, emptyConnectionPathSummary, DEFAULT_SETTLE_WINDOW_MS, type ConnectionPathKind, type ConnectionTransport, type ConnectionPath, type ConnectionPathSummary, type ConnectionLike } from './diagnostics/connection-path.js';

package/dist/index.js

@@ -5,20 +5,46 @@ export { canonicalJson } from './canonical-json.js';
 // Main CadreNode class
 export { CadreNode } from './cadre-node.js';
 // Control database
-export { ControlDatabase, buildAuthorizationMessage } from './control-database.js';
+export { ControlDatabase, MissingHostStrandError, buildAuthorizationMessage, formationVouchMessage, formationConsentMessage, REAPABLE_TABLES } from './control-database.js';
+// Bounded retry for transient control-write failures (classifier + loop behind
+// ControlDatabase.lockedWithRetry; exported so the integration package can drive the
+// classifier against real engine errors)
+export { CONTROL_WRITE_ATTEMPTS, CONTROL_WRITE_RETRY_BUDGET_MS, SCHEMA_INIT_ATTEMPTS, SCHEMA_INIT_RETRY_POLICY, isRetriableControlWriteFailure, isRetriableSchemaInitFailure, retryControlWrite } from './control-write-retry.js';
+// Control-plane authorization field vector (the domain/action tagging every signer shares)
+export { controlAuthorizationFields } from './control-authorization.js';
 // Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
-export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate } from './ed25519-key.js';
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64 } from './ed25519-key.js';
 // Pluggable key store (backend-agnostic identity/owner key material seam).
 // Dependency-free: the interface, error, default slot id, and in-memory backend
 // are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
 // separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
 // import never lands here.
 export { InMemoryKeyStore, KeyStoreAccessError, DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
+// The KeyStore-backed identity rule, shared with embedding apps that need the
+// node key BEFORE `CadreNode` exists (RN resolves it to sign its ICE-manifest
+// request), plus the generic "prove you hold this node key" signer built on it.
+export { loadOrCreateIdentityKey, peerKeySigner } from './identity-key.js';
+// Node-local trusted-owner anchor: the NON-replicated, per-party record of
+// out-of-band-established owner keys (the trust anchor the replicated OwnerKey
+// table cannot be). Cross-platform: interface + in-memory store only — the
+// file-backed store is the Node-only subpath
+// '@serfab/cadre-core/trusted-owner-store-file' (same isolation as
+// key-store-file) so node:fs never lands in this graph.
+export { MemoryTrustedOwnerStore, PersistentTrustedOwnerStore } from './trusted-owner-store.js';
+// Node-local cold-start bootstrap-peer store: the dial targets retained from an
+// applied seed so a node that could not connect on its first try keeps retrying
+// across restarts. Same cross-platform split as the trusted-owner anchor above —
+// interface + in-memory store here, Node-only file backend behind the subpath
+// '@serfab/cadre-core/bootstrap-peer-store-file'.
+export { MemoryBootstrapPeerStore, PersistentBootstrapPeerStore } from './bootstrap-peer-store.js';
 // Strand database
 export { StrandDatabase } from './strand-database.js';
 // Strand management
 export { StrandWatcher } from './strand-watcher.js';
 export { StrandInstanceManager, getStrandStoragePath } from './strand-instance-manager.js';
+// Strand peer-join block catch-up (push this strand's own blocks to each newly
+// connected strand peer, so a late joiner physically holds pre-join blocks).
+export { StrandBackfill, DEFAULT_STRAND_BACKFILL, MAX_BLOCK_MESSAGE_BYTES } from './strand-backfill.js';
 // Hibernation
 export { HibernationManager } from './hibernation-manager.js';
 // Arachnode (stub)
@@ -27,6 +53,9 @@ export { ArachnodeStub, createArachnodeStub } from './arachnode-stub.js';
 export { EnrollmentService } from './enrollment.js';
 // Strand Solicitation
 export { StrandSolicitationService, createDefaultFormationResponseValidator } from './strand-solicitation.js';
+// Formation approval client: asks an invite's ValidationUrl hook whether ONE redemption
+// may proceed, and checks the answer against the bytes the control database will verify.
+export { createHttpFormationApprover, signFormationApproval, verifyFormationApproval, FormationApprovalError } from './formation-approval.js';
 // DB-backed FormationUsageRecorder (reads/writes the real CadreControl tables)
 export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 // Closed-strand member key generation (ed25519 protobuf, base64) + the
@@ -35,7 +64,7 @@ export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-ke
 // Strand membership writer (founder bootstrap, invite issuance/consumption,
 // manager-admit, member-peer registration, manager rotation, + shared signing
 // primitives reused across the flows).
-export { signStrandPayload, verifyStrandPayload, bootstrapFounderMembership, issueInvite, consumeInvite, addMemberByManager, registerMemberPeer, addManager, removeManager, STRAND_ENGINE, STRAND_ENGINE_VERSION } from './strand-membership-writer.js';
+export { signStrandPayload, verifyStrandPayload, signStrandApproval, generateStrandStampId, bootstrapFounderMembership, issueInvite, consumeInvite, cancelInvite, listOutstandingInvites, addMemberByManager, revokeMember, leaveStrand, registerMemberPeer, listMemberPeers, removeMemberPeer, addManager, admitManager, removeManager, STRAND_ENGINE, STRAND_ENGINE_VERSION } from './strand-membership-writer.js';
 // Engine-canonical datetime helper (shared by control + strand signed-write flows
 // so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
 export { canonicalDatetime } from './canonical-datetime.js';
@@ -45,7 +74,7 @@ export { StrandMemberRegistry, StrandMemberVerifier, memberRegistrationPayload }
 // Seed Bootstrap
 export { SeedBootstrapService, SEED_PROTOCOL, ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
 // Peer Authorization (shared owner-signature digest + offline verifier)
-export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, verifyPeerAuthorization } from './peer-authorization.js';
+export { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest, deviceTokenAddDigest, deviceTokenRemoveDigest, formationConsentDigest, verifyPeerAuthorization, verifyCadrePeerVoucher, verifyFormationConsent } from './peer-authorization.js';
 // Strand Wake (control-network push-wake protocol)
 export { StrandWakeService, dialWake, WAKE_PROTOCOL } from './strand-wake-protocol.js';
 // Strand Address (control-network strand-address RPC) — wire types come via
@@ -69,13 +98,18 @@ export { PushFanoutService, DEFAULT_PUSH_COOLDOWN_MS, DEFAULT_PUSH_DEBOUNCE_MS }
 // the cadence/degree defaults the proactive reconcile routine reads.
 export { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
 // Seed trust policy (trust anchor for incoming seeds)
-export { dbAnchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy } from './seed-trust-policy.js';
+export { anchoredTrustPolicy, pinnedKeyTrustPolicy, tofuTrustPolicy } from './seed-trust-policy.js';
 // Schema Verification
 export { signSchema, verifySchema, assertSchemaSignature, SchemaVerificationError } from './schema-verification.js';
 // Strand Formation transport (native cadre-core protocol)
 export { FormationListener, dialFormation, isValidResponderCreatesResult, FORMATION_PROTOCOL } from './strand-formation-protocol.js';
 // Strand Formation manager (drives the native transport)
 export { StrandFormationManager, createStrandFormationManager } from './strand-formation-manager.js';
+// Control-network inbound connection gate (membership defense-in-depth)
+export { createMembershipConnectionGater, STRANGER_OPEN_PROTOCOLS, DEFAULT_ENROLLMENT_WINDOW_MS, ADMISSION_DECISION_TIMEOUT_MS } from './membership-connection-gater.js';
+// Relay reservation via the bare `/p2p-circuit` search listener (fail-soft;
+// the fail-fast alternative is `network.relayAddrs`, see relay-reservation.ts)
+export { circuitMultiaddrs, superviseRelayReservation, DEFAULT_RELAY_RESERVE_TIMEOUT_MS, DEFAULT_RELAY_RESERVE_POLL_MS, DEFAULT_RELAY_CHECK_MS, DEFAULT_RELAY_MIN_BACKOFF_MS, DEFAULT_RELAY_MAX_BACKOFF_MS } from './relay-reservation.js';
 // Connection-path diagnostics (relayed vs direct classification + summary)
 export { classifyTransport, classifyConnectionPath, summarizeConnectionPaths, emptyConnectionPathSummary, DEFAULT_SETTLE_WINDOW_MS } from './diagnostics/connection-path.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAiD,MAAM,uBAAuB,CAAC;AAElI,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAuB,MAAM,kBAAkB,CAAC;AAE9G,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAQxC,MAAM,0BAA0B,CAAC;AAElC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,8EAA8E;AAC9E,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,aAAa,EACb,qBAAqB,EAStB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EAGd,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAErC,MAAM,qBAAqB,CAAC;AAE7B,sDAAsD;AACtD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,kBAAkB,EAUnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAG7B,MAAM,+BAA+B,CAAC;AAEvC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,cAAc,YAAY,CAAC;AAE3B,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,uBAAuB;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAoM,MAAM,uBAAuB,CAAC;AAE9W,+EAA+E;AAC/E,qFAAqF;AACrF,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AAElC,2FAA2F;AAC3F,OAAO,EAAE,0BAA0B,EAA0C,MAAM,4BAA4B,CAAC;AAEhH,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,0BAA0B,EAAuB,MAAM,kBAAkB,CAAC;AAE1I,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,6CAA6C;AAC7C,mEAAmE;AACnE,wDAAwD;AACxD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAG5B,MAAM,0BAA0B,CAAC;AAQlC,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAG7B,MAAM,2BAA2B,CAAC;AAEnC,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAA6B,MAAM,sBAAsB,CAAC;AAEjF,oBAAoB;AACpB,OAAO,EACL,aAAa,EAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EAGrB,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,+EAA+E;AAC/E,6EAA6E;AAC7E,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EAKxB,MAAM,sBAAsB,CAAC;AAE9B,cAAc;AACd,OAAO,EACL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,aAAa;AACb,OAAO,EACL,iBAAiB,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,sBAAsB;AACtB,OAAO,EACL,yBAAyB,EACzB,uCAAuC,EAOxC,MAAM,0BAA0B,CAAC;AAElC,wFAAwF;AACxF,yFAAyF;AACzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,uEAAuE;AACvE,2EAA2E;AAC3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,4EAA4E;AAC5E,8EAA8E;AAC9E,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,qBAAqB,EAiBtB,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,wEAAwE;AACxE,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,iBAAiB;AACjB,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,6BAA6B,EAG9B,MAAM,qBAAqB,CAAC;AAE7B,wEAAwE;AACxE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAEjC,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EAGd,MAAM,2BAA2B,CAAC;AAEnC,4EAA4E;AAC5E,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EAIrB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kBAAkB,CAAC;AAE1B,uFAAuF;AACvF,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,OAAO,EAAE,gBAAgB,EAA0B,MAAM,0BAA0B,CAAC;AAWpF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjG,oFAAoF;AACpF,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EAGzB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,oCAAoC,EAErC,MAAM,qBAAqB,CAAC;AAE7B,sDAAsD;AACtD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EAIhB,MAAM,wBAAwB,CAAC;AAEhC,sBAAsB;AACtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0DAA0D;AAC1D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAC7B,kBAAkB,EAUnB,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAG7B,MAAM,+BAA+B,CAAC;AAEvC,wEAAwE;AACxE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAE9B,MAAM,kCAAkC,CAAC;AAE1C,4EAA4E;AAC5E,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAM7B,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EAMzB,MAAM,kCAAkC,CAAC"}

package/dist/key-store-file.d.ts

@@ -21,32 +21,10 @@ export declare class FileKeyStore implements KeyStore {
      * Crash-atomic write: a concurrent reader sees either the complete previous
      * bytes or the complete new bytes, never a torn slot. The new material is
      * written to a sibling temp file, fsync'd, then atomically renamed over the
-     * slot. A failure at any point removes the temp file and leaves the previous
-     * slot untouched.
+     * slot (see {@link writeFileAtomically}). A failure at any point removes the
+     * temp file and leaves the previous slot untouched.
      */
     set(keyId: KeyId, keyMaterial: Uint8Array): Promise<void>;
-    /**
-     * Write material to `tmpPath`, durably land it, then atomically swap it onto
-     * `finalPath`.
-     *
-     * Durability bar: the temp file is fsync'd before the rename so a power loss
-     * cannot surface a slot whose bytes never reached the platter, and the slot
-     * directory is fsync'd afterwards (best-effort — see {@link syncDir}) so the
-     * rename itself survives a crash. On POSIX `rename(2)` replaces atomically;
-     * Node maps to `MoveFileEx(MOVEFILE_REPLACE_EXISTING)` on Windows, which is
-     * also atomic — though it can fail with `EPERM`/`EBUSY` if another process
-     * holds the destination open. That cross-process case is out of scope here
-     * (the in-process identity path is single-flight); such a failure surfaces
-     * to the caller with the previous slot left intact.
-     */
-    private writeSlotAtomically;
-    /**
-     * Best-effort fsync of the slot directory so a fresh slot's directory entry is
-     * durable across power loss. Opening a directory for fsync is not portable
-     * (unsupported on Windows and some filesystems), and rename atomicity does not
-     * depend on it — so a failure here is logged and swallowed, never surfaced.
-     */
-    private syncDir;
     delete(keyId: KeyId): Promise<void>;
     list(): Promise<KeyId[]>;
 }

package/dist/key-store-file.js

@@ -14,10 +14,11 @@
  * `node:fs` edge never reaches a bundler that cannot satisfy it.
  */
 import debug from 'debug';
-import { mkdir, readFile, rm, readdir, rename, open } from 'node:fs/promises';
+import { readFile, rm, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { KeyStoreAccessError } from './key-store.js';
+import { encodeFileSafeComponent, isNotFound, writeFileAtomically } from './fs-atomic.js';
 const log = debug('sereus:cadre:key-store-file');
 /** Suffix appended to the encoded keyId to form a slot filename. */
 const SLOT_SUFFIX = '.key';
@@ -27,20 +28,14 @@ const SLOT_SUFFIX = '.key';
  * only `.key`) never surfaces an in-flight or crash-orphaned temp file.
  */
 const TEMP_SUFFIX = '.tmp';
-/** Best-effort POSIX permissions (ignored on Windows / unsupported FSes). */
-const DIR_MODE = 0o700;
-const FILE_MODE = 0o600;
 /**
- * Percent-encode a keyId into a filesystem-safe filename component. Beyond
- * `encodeURIComponent` (which already escapes `/`, spaces, and unicode), this
- * also escapes the unreserved characters `encodeURIComponent` leaves intact but
- * that are unsafe in filenames on some platforms (notably `*` on Windows) — and
- * `.` so the `.key` suffix is the only literal dot, making suffix-stripping in
- * {@link decodeKeyId} unambiguous. {@link decodeKeyId} reverses every escape via
- * `decodeURIComponent`. The result contains only `A-Za-z0-9-_` and `%XX`.
+ * Percent-encode a keyId into a filesystem-safe filename component (see
+ * {@link encodeFileSafeComponent} — `.` is escaped so the `.key` suffix is the
+ * only literal dot, making suffix-stripping in {@link decodeKeyId} unambiguous;
+ * {@link decodeKeyId} reverses every escape via `decodeURIComponent`).
  */
 function encodeKeyId(keyId) {
-    return encodeURIComponent(keyId).replace(/[!'()*~.]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+    return encodeFileSafeComponent(keyId);
 }
 /**
  * Reverse {@link encodeKeyId}: strip the slot suffix and percent-decode. Returns
@@ -59,11 +54,6 @@ function decodeKeyId(fileName) {
         return undefined;
     }
 }
-/** Whether an unknown error is a Node "file/dir not found" (ENOENT). */
-function isNotFound(error) {
-    return typeof error === 'object' && error !== null
-        && error.code === 'ENOENT';
-}
 /**
  * File-backed {@link KeyStore}. Each slot is `<dir>/<encoded keyId>.key`
  * containing the raw material bytes. The directory is created lazily on first
@@ -107,68 +97,11 @@ export class FileKeyStore {
      * Crash-atomic write: a concurrent reader sees either the complete previous
      * bytes or the complete new bytes, never a torn slot. The new material is
      * written to a sibling temp file, fsync'd, then atomically renamed over the
-     * slot. A failure at any point removes the temp file and leaves the previous
-     * slot untouched.
+     * slot (see {@link writeFileAtomically}). A failure at any point removes the
+     * temp file and leaves the previous slot untouched.
      */
     async set(keyId, keyMaterial) {
-        await mkdir(this.dir, { recursive: true, mode: DIR_MODE });
-        await this.writeSlotAtomically(this.tempPath(keyId), this.slotPath(keyId), keyMaterial);
-    }
-    /**
-     * Write material to `tmpPath`, durably land it, then atomically swap it onto
-     * `finalPath`.
-     *
-     * Durability bar: the temp file is fsync'd before the rename so a power loss
-     * cannot surface a slot whose bytes never reached the platter, and the slot
-     * directory is fsync'd afterwards (best-effort — see {@link syncDir}) so the
-     * rename itself survives a crash. On POSIX `rename(2)` replaces atomically;
-     * Node maps to `MoveFileEx(MOVEFILE_REPLACE_EXISTING)` on Windows, which is
-     * also atomic — though it can fail with `EPERM`/`EBUSY` if another process
-     * holds the destination open. That cross-process case is out of scope here
-     * (the in-process identity path is single-flight); such a failure surfaces
-     * to the caller with the previous slot left intact.
-     */
-    async writeSlotAtomically(tmpPath, finalPath, keyMaterial) {
-        // 'wx' creates the temp file exclusively; a name collision (astronomically
-        // unlikely given the random component) fails here before we own anything.
-        const handle = await open(tmpPath, 'wx', FILE_MODE);
-        try {
-            try {
-                await handle.writeFile(keyMaterial);
-                await handle.sync(); // land bytes on disk before the rename exposes them
-            }
-            finally {
-                await handle.close().catch(() => { });
-            }
-            await rename(tmpPath, finalPath);
-        }
-        catch (error) {
-            // Any failure after creation (write, sync, or rename): drop the temp
-            // file so a retry leaves no `.tmp` debris. The slot is only ever
-            // swapped by the atomic rename, so the previous bytes stay intact.
-            await rm(tmpPath, { force: true }).catch(() => { });
-            throw error;
-        }
-        await this.syncDir();
-    }
-    /**
-     * Best-effort fsync of the slot directory so a fresh slot's directory entry is
-     * durable across power loss. Opening a directory for fsync is not portable
-     * (unsupported on Windows and some filesystems), and rename atomicity does not
-     * depend on it — so a failure here is logged and swallowed, never surfaced.
-     */
-    async syncDir() {
-        let dirHandle;
-        try {
-            dirHandle = await open(this.dir, 'r');
-            await dirHandle.sync();
-        }
-        catch (error) {
-            log('FileKeyStore: directory fsync skipped for %s: %o', this.dir, error);
-        }
-        finally {
-            await dirHandle?.close().catch(() => { });
-        }
+        await writeFileAtomically(this.dir, this.tempPath(keyId), this.slotPath(keyId), keyMaterial);
     }
     async delete(keyId) {
         // force:true makes removing an absent slot a no-op (idempotent).

package/dist/key-store-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-store-file.js","sourceRoot":"","sources":["../src/key-store-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B;;;;GAIG;AACH,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,KAAY;IAChC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACvC,YAAY,EACZ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACvD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,yDAAyD,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChF,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;WAC7C,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACxB,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEpC,QAAQ,CAAC,KAAY;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,KAAY;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,kEAAkE;YAClE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,6DAA6D;YAC7D,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,yCAAyC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,WAAuB;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,SAAiB,EAAE,WAAuB;QAC5F,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC;YACJ,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACpC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,oDAAoD;YAC1E,CAAC;oBAAS,CAAC;gBACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,OAAO;QACpB,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,kDAAkD,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACV,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY;QACxB,iEAAiE;QACjE,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,0DAA0D;YAC1D,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO;aACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aAC5C,GAAG,CAAC,WAAW,CAAC;aAChB,MAAM,CAAC,CAAC,EAAE,EAAe,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACjD,CAAC;CACD"}
+{"version":3,"file":"key-store-file.js","sourceRoot":"","sources":["../src/key-store-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1F,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B;;;;GAIG;AACH,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAY;IAChC,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,yDAAyD,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChF,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACxB,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEpC,QAAQ,CAAC,KAAY;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,KAAY;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,kEAAkE;YAClE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,6DAA6D;YAC7D,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,yCAAyC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,WAAuB;QAC9C,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY;QACxB,iEAAiE;QACjE,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,0DAA0D;YAC1D,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO;aACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aAC5C,GAAG,CAAC,WAAW,CAAC;aAChB,MAAM,CAAC,CAAC,EAAE,EAAe,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACjD,CAAC;CACD"}