@serfab/cadre-core 0.9.0 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (162) hide show
  1. package/README.md +4 -2
  2. package/dist/bootstrap-peer-store-file.d.ts +13 -0
  3. package/dist/bootstrap-peer-store-file.js +42 -0
  4. package/dist/bootstrap-peer-store-file.js.map +1 -0
  5. package/dist/bootstrap-peer-store.d.ts +73 -0
  6. package/dist/bootstrap-peer-store.js +128 -0
  7. package/dist/bootstrap-peer-store.js.map +1 -0
  8. package/dist/cadre-node.d.ts +918 -53
  9. package/dist/cadre-node.js +1843 -190
  10. package/dist/cadre-node.js.map +1 -1
  11. package/dist/control-authorization.d.ts +93 -0
  12. package/dist/control-authorization.js +57 -0
  13. package/dist/control-authorization.js.map +1 -0
  14. package/dist/control-database.d.ts +990 -50
  15. package/dist/control-database.js +1459 -108
  16. package/dist/control-database.js.map +1 -1
  17. package/dist/control-formation-recorder.d.ts +89 -10
  18. package/dist/control-formation-recorder.js +129 -14
  19. package/dist/control-formation-recorder.js.map +1 -1
  20. package/dist/control-schema.d.ts +1 -1
  21. package/dist/control-schema.js +774 -210
  22. package/dist/control-schema.js.map +1 -1
  23. package/dist/control-stream.d.ts +38 -4
  24. package/dist/control-stream.js +70 -4
  25. package/dist/control-stream.js.map +1 -1
  26. package/dist/control-write-retry.d.ts +151 -0
  27. package/dist/control-write-retry.js +411 -0
  28. package/dist/control-write-retry.js.map +1 -0
  29. package/dist/delegate-admission.d.ts +134 -0
  30. package/dist/delegate-admission.js +244 -0
  31. package/dist/delegate-admission.js.map +1 -0
  32. package/dist/device-token.d.ts +11 -11
  33. package/dist/device-token.js +14 -13
  34. package/dist/device-token.js.map +1 -1
  35. package/dist/ed25519-key.d.ts +26 -0
  36. package/dist/ed25519-key.js +56 -1
  37. package/dist/ed25519-key.js.map +1 -1
  38. package/dist/file-durable-slot.d.ts +20 -0
  39. package/dist/file-durable-slot.js +53 -0
  40. package/dist/file-durable-slot.js.map +1 -0
  41. package/dist/formation-approval.d.ts +157 -0
  42. package/dist/formation-approval.js +375 -0
  43. package/dist/formation-approval.js.map +1 -0
  44. package/dist/fs-atomic.d.ts +38 -0
  45. package/dist/fs-atomic.js +97 -0
  46. package/dist/fs-atomic.js.map +1 -0
  47. package/dist/identity-key.d.ts +49 -0
  48. package/dist/identity-key.js +81 -0
  49. package/dist/identity-key.js.map +1 -0
  50. package/dist/index.d.ts +16 -6
  51. package/dist/index.js +39 -5
  52. package/dist/index.js.map +1 -1
  53. package/dist/key-store-file.d.ts +2 -24
  54. package/dist/key-store-file.js +10 -77
  55. package/dist/key-store-file.js.map +1 -1
  56. package/dist/membership-connection-gater.d.ts +146 -0
  57. package/dist/membership-connection-gater.js +180 -0
  58. package/dist/membership-connection-gater.js.map +1 -0
  59. package/dist/node-local-snapshot.d.ts +109 -0
  60. package/dist/node-local-snapshot.js +182 -0
  61. package/dist/node-local-snapshot.js.map +1 -0
  62. package/dist/peer-authorization.d.ts +135 -18
  63. package/dist/peer-authorization.js +152 -21
  64. package/dist/peer-authorization.js.map +1 -1
  65. package/dist/peer-record.d.ts +21 -8
  66. package/dist/peer-record.js +26 -10
  67. package/dist/peer-record.js.map +1 -1
  68. package/dist/relay-addrs.d.ts +45 -0
  69. package/dist/relay-addrs.js +103 -0
  70. package/dist/relay-addrs.js.map +1 -0
  71. package/dist/relay-reservation.d.ts +266 -0
  72. package/dist/relay-reservation.js +613 -0
  73. package/dist/relay-reservation.js.map +1 -0
  74. package/dist/seed-bootstrap.d.ts +221 -56
  75. package/dist/seed-bootstrap.js +328 -188
  76. package/dist/seed-bootstrap.js.map +1 -1
  77. package/dist/seed-trust-policy.d.ts +47 -21
  78. package/dist/seed-trust-policy.js +24 -15
  79. package/dist/seed-trust-policy.js.map +1 -1
  80. package/dist/strand-addr-protocol.d.ts +42 -13
  81. package/dist/strand-addr-protocol.js +58 -52
  82. package/dist/strand-addr-protocol.js.map +1 -1
  83. package/dist/strand-backfill.d.ts +109 -0
  84. package/dist/strand-backfill.js +279 -0
  85. package/dist/strand-backfill.js.map +1 -0
  86. package/dist/strand-formation-manager.d.ts +38 -9
  87. package/dist/strand-formation-manager.js +120 -17
  88. package/dist/strand-formation-manager.js.map +1 -1
  89. package/dist/strand-formation-protocol.d.ts +103 -4
  90. package/dist/strand-formation-protocol.js +232 -4
  91. package/dist/strand-formation-protocol.js.map +1 -1
  92. package/dist/strand-instance-manager.d.ts +39 -1
  93. package/dist/strand-instance-manager.js +92 -14
  94. package/dist/strand-instance-manager.js.map +1 -1
  95. package/dist/strand-member-registry.d.ts +5 -5
  96. package/dist/strand-member-registry.js +18 -10
  97. package/dist/strand-member-registry.js.map +1 -1
  98. package/dist/strand-membership-writer.d.ts +482 -88
  99. package/dist/strand-membership-writer.js +757 -136
  100. package/dist/strand-membership-writer.js.map +1 -1
  101. package/dist/strand-solicitation.d.ts +99 -33
  102. package/dist/strand-solicitation.js +100 -52
  103. package/dist/strand-solicitation.js.map +1 -1
  104. package/dist/strand-transport-key.d.ts +40 -0
  105. package/dist/strand-transport-key.js +56 -0
  106. package/dist/strand-transport-key.js.map +1 -0
  107. package/dist/strand-wake-protocol.d.ts +9 -7
  108. package/dist/strand-wake-protocol.js +22 -46
  109. package/dist/strand-wake-protocol.js.map +1 -1
  110. package/dist/strand-watcher.d.ts +17 -2
  111. package/dist/strand-watcher.js +47 -3
  112. package/dist/strand-watcher.js.map +1 -1
  113. package/dist/trusted-owner-store-file.d.ts +12 -0
  114. package/dist/trusted-owner-store-file.js +39 -0
  115. package/dist/trusted-owner-store-file.js.map +1 -0
  116. package/dist/trusted-owner-store.d.ts +64 -0
  117. package/dist/trusted-owner-store.js +126 -0
  118. package/dist/trusted-owner-store.js.map +1 -0
  119. package/dist/types.d.ts +275 -20
  120. package/dist/types.js +13 -0
  121. package/dist/types.js.map +1 -1
  122. package/package.json +19 -8
  123. package/src/bootstrap-peer-store-file.ts +44 -0
  124. package/src/bootstrap-peer-store.ts +172 -0
  125. package/src/cadre-node.ts +1992 -202
  126. package/src/control-authorization.ts +114 -0
  127. package/src/control-database.ts +1704 -146
  128. package/src/control-formation-recorder.ts +172 -19
  129. package/src/control-schema.ts +786 -222
  130. package/src/control-stream.ts +81 -4
  131. package/src/control-write-retry.ts +473 -0
  132. package/src/delegate-admission.ts +302 -0
  133. package/src/device-token.ts +18 -13
  134. package/src/ed25519-key.ts +134 -69
  135. package/src/file-durable-slot.ts +61 -0
  136. package/src/formation-approval.ts +604 -0
  137. package/src/fs-atomic.ts +107 -0
  138. package/src/identity-key.ts +109 -0
  139. package/src/index.ts +136 -5
  140. package/src/key-store-file.ts +10 -81
  141. package/src/membership-connection-gater.ts +204 -0
  142. package/src/node-local-snapshot.ts +260 -0
  143. package/src/peer-authorization.ts +199 -21
  144. package/src/peer-record.ts +28 -10
  145. package/src/relay-addrs.ts +111 -0
  146. package/src/relay-reservation.ts +823 -0
  147. package/src/seed-bootstrap.ts +397 -197
  148. package/src/seed-trust-policy.ts +58 -25
  149. package/src/strand-addr-protocol.ts +84 -53
  150. package/src/strand-backfill.ts +366 -0
  151. package/src/strand-formation-manager.ts +145 -19
  152. package/src/strand-formation-protocol.ts +309 -8
  153. package/src/strand-instance-manager.ts +111 -14
  154. package/src/strand-member-registry.ts +18 -13
  155. package/src/strand-membership-writer.ts +1430 -640
  156. package/src/strand-solicitation.ts +155 -90
  157. package/src/strand-transport-key.ts +58 -0
  158. package/src/strand-wake-protocol.ts +29 -46
  159. package/src/strand-watcher.ts +66 -3
  160. package/src/trusted-owner-store-file.ts +41 -0
  161. package/src/trusted-owner-store.ts +171 -0
  162. package/src/types.ts +292 -21
@@ -1 +1 @@
1
- {"version":3,"file":"strand-membership-writer.js","sourceRoot":"","sources":["../src/strand-membership-writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAG3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,aAAqB;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,YAAoB,EAAE,YAAoB;IAC7F,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;IACzE,OAAO,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC7G,CAAC;AAkBD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAsC;IAClF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,wCAAwC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjF,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,EAAY,EAAE,MAA8B;IAC9E,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,gDAAgD,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;uCAEmC,EACnC;QACE,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI,CAAC,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,OAAO;QACnB,MAAM,CAAC,IAAI,CAAC,MAAM;QAClB,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE;QAC3B,aAAa;QACb,qBAAqB;KACtB,CACF,CAAC;IACF,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,2BAA2B,CAAC,EAAY,EAAE,SAAiB,EAAE,QAAgB;IAC1F,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,+DAA+D,EAAE,QAAQ,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,GAAG,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,4BAA4B,CAAC,EAAY,EAAE,SAAiB,EAAE,QAAgB;IAC3F,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,iEAAiE,EAAE,QAAQ,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,GAAG,CAAC,yCAAyC,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAY,EAAE,MAA8B;IAC3F,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAClD,GAAG,CAAC,2CAA2C,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,uDAAuD;YACjG,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAEvC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,6EAA6E;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,cAAe,CAAC,YAAY,CAAC;IAC/C,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,4BAA4B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,GAAG,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,MAAyB;IACvE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAE9C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAW,CAAC;IAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;IAEhG,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5F,MAAM,gBAAgB,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAEvE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAC;IACpD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAErE,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,cAAc,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAC9F,CAAC;IACF,GAAG,CAAC,+BAA+B,EAAE,SAAS,EAAE,gBAAgB,IAAI,OAAO,CAAC,CAAC;IAE7E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AACzC,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,MAA2B;IAC3E,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEjE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAE1E,+EAA+E;IAC/E,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtE,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,EAAE,CAAC,IAAI,CACX;;oBAEc,EACd,CAAC,SAAS,CAAC,CACZ,CAAC;QAEF,+EAA+E;QAC/E,yEAAyE;QACzE,MAAM,EAAE,CAAC,IAAI,CACX;;uBAEiB,EACjB,CAAC,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACtD,CAAC;QAEF,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,iCAAiC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,GAAG,CAAC,sDAAsD,EAAE,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAY,EAAE,MAAgC;IACrF,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAC7E,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACpD,CAAC;IACF,GAAG,CAAC,kCAAkC,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;AAClF,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAY,EAAE,MAAgC;IACrF,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC;IAE7C,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,+CAA+C,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAC/B,CAAC;IACF,GAAG,CAAC,gCAAgC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,SAAiB,EAAE,MAAc;IAC7E,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAC7B,oFAAoF,EACpF,CAAC,SAAS,EAAE,MAAM,CAAC,CACpB,EAAE,CAAC;QACF,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAY,EAAE,MAAwB;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IACnD,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnF,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAC1D,CAAC;IACF,GAAG,CAAC,wBAAwB,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;AAC9E,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,MAA2B;IAC3E,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IACtD,MAAM,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACtF,MAAM,EAAE,CAAC,IAAI,CACX;;2BAEuB,EACvB,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAC7D,CAAC;IACF,GAAG,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnF,CAAC"}
1
+ {"version":3,"file":"strand-membership-writer.js","sourceRoot":"","sources":["../src/strand-membership-writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAGxH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,aAAqB;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,YAAoB,EAAE,YAAoB;IAC7F,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;IACzE,OAAO,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC7G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAsC,EAAE,aAAqB;IAC9F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IAClE,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB;IACnC,mEAAmE;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAe,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,EAAuB;IACtE,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC;QACxB,MAAM,EAAE,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,GAAG,CAAC,2DAA2D,EAAE,aAAa,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,EAAY,EACZ,SAA8C,EAC9C,OAAe,EACf,OAAuB;IAEvB,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjH,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CACtD,CAAC;AACJ,CAAC;AAkBD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAsC;IAClF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,wCAAwC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjF,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,EAAY,EAAE,MAA8B;IAC9E,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,gDAAgD,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;uCAEmC,EACnC;QACE,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI,CAAC,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,OAAO;QACnB,MAAM,CAAC,IAAI,CAAC,MAAM;QAClB,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE;QAC3B,aAAa;QACb,qBAAqB;KACtB,CACF,CAAC;IACF,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,2BAA2B,CAAC,EAAY,EAAE,SAAiB,EAAE,QAAgB;IAC1F,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,+DAA+D,EAAE,QAAQ,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC,CACrC,CAAC;IACF,GAAG,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,4BAA4B,CAAC,EAAY,EAAE,SAAiB,EAAE,QAAgB;IAC3F,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,iEAAiE,EAAE,QAAQ,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;wBAEoB,EACpB,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC,CACrC,CAAC;IACF,GAAG,CAAC,yCAAyC,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAY,EAAE,MAA8B;IAC3F,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAClD,GAAG,CAAC,2CAA2C,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,uDAAuD;YACjG,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAEvC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,6EAA6E;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,cAAe,CAAC,YAAY,CAAC;IAC/C,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,4BAA4B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,GAAG,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,MAAyB;IACvE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAE9C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAW,CAAC;IAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;IAEhG,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5F,MAAM,gBAAgB,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAEvE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAC;IACpD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAErE,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,cAAc,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAC9F,CAAC;IACF,GAAG,CAAC,+BAA+B,EAAE,SAAS,EAAE,gBAAgB,IAAI,OAAO,CAAC,CAAC;IAE7E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AACzC,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,MAA2B;IAC3E,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEjE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAE1E,+EAA+E;IAC/E,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtE,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACvC,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,EAAE,CAAC,IAAI,CACX;;uBAEiB,EACjB,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC,CACrC,CAAC;QAEF,+EAA+E;QAC/E,yEAAyE;QACzE,MAAM,EAAE,CAAC,IAAI,CACX;;uBAEiB,EACjB,CAAC,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,iCAAiC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,cAAc,CAAC,EAAY,EAAE,KAA2C;IACrF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,gCAAgC,KAAK,EAAE,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,MAA0B;IACzE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE7C,IAAI,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,uCAAuC,EAAE,SAAS,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAClC,CAAC,wBAAwB,EAAE,QAAQ,EAAE,SAAS,CAAC,EAC/C,cAAc,CAAC,aAAa,CAC7B,CAAC;IACF,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACpD,CAAC;IACF,GAAG,CAAC,mCAAmC,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;AACnF,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAY,EAAE,KAAc;IACvE,oFAAoF;IACpF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,2CAA2C,CAAC,EAAE,CAAC;QAC7E,MAAM,SAAS,GAAG,GAAG,CAAC,GAAa,CAAC;QACpC,MAAM,UAAU,GAAI,GAAG,CAAC,UAA4B,IAAI,IAAI,CAAC;QAC7D,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,SAAS;QACX,CAAC;QACD,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,SAAiB;IAC1D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,wCAAwC,CAAC,EAAE,CAAC;QAC1E,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAiB,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAY,EAAE,MAAgC;IACrF,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IACjH,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAC7D,CAAC;IACF,GAAG,CAAC,kCAAkC,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;AAClF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,MAA0B;IACzE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,2CAA2C,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IACpH,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,CAAC,IAAI,CACX;;uBAEiB,EACjB,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACpD,CAAC;QACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,iCAAiC,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;AACjF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,MAAyB;IACvE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,0CAA0C,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAClH,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,CAAC,IAAI,CACX;;uBAEiB,EACjB,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;QACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAY,EAAE,MAAgC;IACrF,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC;IAE7C,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,+CAA+C,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,kBAAkB,CAClC,CAAC,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EACxD,aAAa,CAAC,aAAa,CAC5B,CAAC;IACF,MAAM,EAAE,CAAC,IAAI,CACX;;wBAEoB,EACpB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CACxC,CAAC;IACF,GAAG,CAAC,gCAAgC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,SAAS,CAAC,CAAC,eAAe,CAAC,EAAY,EAAE,SAAiB;IAC7D,oFAAoF;IACpF,sFAAsF;IACtF,oFAAoF;IACpF,2BAA2B;IAC3B,qFAAqF;IACrF,mFAAmF;IACnF,0BAA0B;IAC1B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAC7B,8EAA8E,EAC9E,CAAC,SAAS,CAAC,CACZ,EAAE,CAAC;QACF,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAiB,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAY,EAAE,SAAiB;IACnE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,SAAiB,EAAE,MAAc;IAC9E,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,MAA8B;IACjF,MAAM,SAAS,GAAG,eAAe,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACnG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,8CAA8C,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACvC,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,mFAAmF;IACnF,+EAA+E;IAC/E,uFAAuF;IACvF,uFAAuF;IACvF,uFAAuF;IACvF,iFAAiF;IACjF,sFAAsF;IACtF,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,KAAK,MAAM,8BAA8B,CAAC,CAAC;IACrF,CAAC;IACD,GAAG,CAAC,6BAA6B,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,MAA2B,EAAE,OAAe;IAC3F,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC;IAC7C,MAAM,SAAS,GAAG,kBAAkB,CAClC,CAAC,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAC3D,aAAa,CAAC,aAAa,CAC5B,CAAC;IACF,MAAM,EAAE,CAAC,IAAI,CACX;;0CAEsC,EACtC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAC/B,CAAC;IACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACnE,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,yBAAyB,CACtC,EAAY,EACZ,MAAuC,EACvC,OAAe;IAEf,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACrD,MAAM,SAAS,GAAG,kBAAkB,CAClC,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EACnE,cAAc,CAAC,aAAa,CAC7B,CAAC;IACF,MAAM,EAAE,CAAC,IAAI,CACX;;0CAEsC,EACtC,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAC5D,CAAC;IACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AACpE,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,KAAK,UAAU,UAAU,CAAC,EAAY,EAAE,SAAiB;IACvD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,2DAA2D,CAAC,EAAE,CAAC;QAC7F,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAiB,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAY,EAAE,MAAwB;IACrE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACvE,oFAAoF;IACpF,oFAAoF;IACpF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,MAAM,UAAU,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,kBAAkB,CAClC,CAAC,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,EAC7D,gBAAgB,CAAC,aAAa,CAC/B,CAAC;IACF,MAAM,EAAE,CAAC,IAAI,CACX;;wBAEoB,EACpB,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,wCAAwC,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;AAC1G,CAAC;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,MAA0B;IACzE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IACnD,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7F,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,sCAAsC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;AAC5F,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,MAA2B;IAC3E,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,6CAA6C,EAAE,gBAAgB,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,MAAM,SAAS,GAAG,kBAAkB,CAClC,CAAC,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,EACzD,gBAAgB,CAAC,aAAa,CAC/B,CAAC;IACF,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,CAAC,IAAI,CACX;;6BAEuB,EACvB,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAC7D,CAAC;QACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnF,CAAC"}
@@ -1,5 +1,5 @@
1
1
  import type { Libp2p } from '@libp2p/interface';
2
- import type { OpenInvitation, FormStrandResult, ValidateFormationResult, StrandFormationDisclosure } from './types.js';
2
+ import type { OpenInvitation, FormStrandResult, StrandFormationDisclosure } from './types.js';
3
3
  import { type StrandFormationManagerConfig } from './strand-formation-manager.js';
4
4
  import { type FormationResultMessage } from './strand-formation-protocol.js';
5
5
  /**
@@ -28,6 +28,10 @@ export interface DisclosureValidator {
28
28
  *
29
29
  * Replaces the older `{ strandId, memberPrivateKey } | null` shape, which conflated `bound`
30
30
  * and `missing` (both produced a non-null result whenever the invite had a `StrandId`).
31
+ *
32
+ * The invite's `ValidationUrl` (the outside approval hook) is deliberately NOT surfaced here:
33
+ * the recorder that performs the write reads it itself, so the choice of which hook to trust
34
+ * never travels through a caller.
31
35
  */
32
36
  export type ResolvedHostStrand = {
33
37
  kind: 'unbound';
@@ -46,7 +50,20 @@ export interface FormationUsageRecorder {
46
50
  /**
47
51
  * Record that a formation invite was used
48
52
  */
49
- recordUsage(token: string, initiatorKey: string, strandId: string): Promise<void>;
53
+ recordUsage(params: {
54
+ token: string;
55
+ /** The joining peer's own ed25519 public key — written to `FormationUsage.PeerKey` and inside BOTH signed digests. */
56
+ peerKey: string;
57
+ /** The joiner's signature over the `'consent'` digest — written to `FormationUsage.PeerSig`. */
58
+ peerSignature: string;
59
+ /** Joiner-minted single-use nonce; both signed digests cover it. */
60
+ usageStampId: string;
61
+ strandId: string;
62
+ /** Exact text to write to `FormationUsage.Disclosure`; joiner and approver both sign these bytes. */
63
+ disclosure: string;
64
+ /** Aborted when the caller has given up; observed BEFORE any write so the invite stays unspent. */
65
+ signal?: AbortSignal;
66
+ }): Promise<void>;
50
67
  /**
51
68
  * Check if a token has already been used (for single-use invites)
52
69
  */
@@ -71,13 +88,34 @@ export interface FormationUsageRecorder {
71
88
  * ATOMICALLY (single `FormationUsage` row → single-use enforced on the next redemption).
72
89
  * Optional: a recorder that only supports provision-then-record omits it, and the
73
90
  * manager falls back to its {@link StrandProvisioner}. Mirrors the create-strand-by-consent
74
- * path the schema's `Strand.Authorized` `FormationUsage` branch authorizes. Returns the
91
+ * path the schema's `Strand.AuthorizedInsert` `FormationUsage` branch authorizes. Returns the
75
92
  * minted strand id plus its membership key (null for an open responder-provisioned strand).
76
93
  */
77
- provisionAndRecord?(token: string, initiatorKey: string, sAppId: string): Promise<{
94
+ provisionAndRecord?(params: {
95
+ token: string;
96
+ /** The joining peer's own ed25519 public key — written to `FormationUsage.PeerKey` and inside BOTH signed digests. */
97
+ peerKey: string;
98
+ /** The joiner's signature over the `'consent'` digest — written to `FormationUsage.PeerSig`. */
99
+ peerSignature: string;
100
+ /** Joiner-minted single-use nonce; both signed digests cover it. */
101
+ usageStampId: string;
102
+ sAppId: string;
103
+ /** Exact text to write to `FormationUsage.Disclosure`; joiner and approver both sign these bytes. */
104
+ disclosure: string;
105
+ /** Aborted when the caller has given up; observed BEFORE any write so the invite stays unspent. */
106
+ signal?: AbortSignal;
107
+ }): Promise<{
78
108
  strandId: string;
79
109
  memberPrivateKey: string | null;
80
110
  }>;
111
+ /**
112
+ * Is ANY invitation this recorder knows about unexpired and not fully
113
+ * consumed? Optional: a recorder that cannot enumerate invitations omits it,
114
+ * and only locally-minted invitations hold the connection gate's formation
115
+ * exemption open. Distinct from the per-token {@link isTokenValid} /
116
+ * {@link isTokenUsed} pair — the connection gate has no token to ask about.
117
+ */
118
+ hasOutstandingInvitation?(): Promise<boolean>;
81
119
  }
82
120
  /**
83
121
  * Interface for strand provisioning during formation
@@ -90,18 +128,6 @@ export interface StrandProvisioner {
90
128
  strandId: string;
91
129
  }>;
92
130
  }
93
- /**
94
- * Interface for signing formation approvals
95
- */
96
- export interface FormationSigner {
97
- /**
98
- * Sign a formation approval
99
- */
100
- signFormation(token: string, disclosure: StrandFormationDisclosure): Promise<{
101
- validationKey: string;
102
- validationSignature: string;
103
- }>;
104
- }
105
131
  /**
106
132
  * Interface for validating the responder's formation result on the initiator side.
107
133
  *
@@ -132,7 +158,6 @@ export interface StrandSolicitationServiceOptions {
132
158
  disclosureValidator?: DisclosureValidator;
133
159
  formationUsageRecorder?: FormationUsageRecorder;
134
160
  strandProvisioner?: StrandProvisioner;
135
- formationSigner?: FormationSigner;
136
161
  /** Validates the responder's result on the initiator side (defaults to a structural check) */
137
162
  formationResponseValidator?: FormationResponseValidator;
138
163
  /** Party ID for this node (used in protocol messages) */
@@ -147,7 +172,10 @@ export interface StrandSolicitationServiceOptions {
147
172
  *
148
173
  * This service handles the high-level API defined in api.md:
149
174
  * - formStrand(invitation, disclosure, node) - called by initiator
150
- * - validateStrandFormation(token, disclosure) - called by responder
175
+ *
176
+ * Outside approval of a redemption (an invite's `ValidationUrl`) is NOT here: it belongs to
177
+ * the redeeming node, which alone mints the nonce the approval is bound to. See
178
+ * `formation-approval.ts`.
151
179
  *
152
180
  * When a libp2p node is provided, the underlying protocol is handled by the
153
181
  * native cadre-core formation transport via StrandFormationManager.
@@ -156,12 +184,23 @@ export declare class StrandSolicitationService {
156
184
  private readonly disclosureValidator?;
157
185
  private readonly formationUsageRecorder?;
158
186
  private readonly strandProvisioner?;
159
- private readonly formationSigner?;
160
187
  private readonly formationResponseValidator?;
161
188
  private readonly partyId;
162
189
  private readonly cadrePeerAddrs;
163
190
  private formationManager?;
164
191
  private readonly formationConfig?;
192
+ /**
193
+ * Tokens this process has minted (or published), mapped to their expiry
194
+ * epoch-ms — the in-memory half of {@link hasOutstandingInvitation}. Dies with
195
+ * the process, exactly like `CadreNode`'s enrollment window; a token that also
196
+ * reached the durable `FormationInvite` table survives via the recorder.
197
+ *
198
+ * NOTE: pruned only while {@link hasOutstandingInvitation} runs, so a node that
199
+ * mints steadily and never receives an inbound stranger retains every entry for
200
+ * the process's life. Bounded by mint rate today; if a host ever mints at scale,
201
+ * prune on a timer (or cap the map) instead of only on read.
202
+ */
203
+ private readonly mintedInvitations;
165
204
  constructor(options?: StrandSolicitationServiceOptions);
166
205
  /**
167
206
  * Get or create the StrandFormationManager.
@@ -190,19 +229,6 @@ export declare class StrandSolicitationService {
190
229
  * @returns The member key and strand info if successful
191
230
  */
192
231
  formStrand(invitation: OpenInvitation | string, disclosure: StrandFormationDisclosure, node?: Libp2p): Promise<FormStrandResult>;
193
- /**
194
- * Validate a strand formation request.
195
- *
196
- * Called by the responder (the party who created the open invitation) when
197
- * an initiator contacts them to form a strand. Validates the disclosure
198
- * and returns a signed approval.
199
- *
200
- * @param token The invitation token being used
201
- * @param disclosure The disclosure from the initiator
202
- * @returns Validation key and signature if approved
203
- * @throws If validation fails or token is invalid
204
- */
205
- validateStrandFormation(token: string, disclosure: StrandFormationDisclosure): Promise<ValidateFormationResult>;
206
232
  /**
207
233
  * Create an open invitation for others to form strands with this party.
208
234
  *
@@ -212,9 +238,49 @@ export declare class StrandSolicitationService {
212
238
  * @returns The open invitation to share out-of-band
213
239
  */
214
240
  createOpenInvitation(sAppId: string, expirationMs: number, bootstrap: string[]): Promise<OpenInvitation>;
241
+ /**
242
+ * Remember a token this node minted (or published) so
243
+ * {@link hasOutstandingInvitation} can answer "yes" before the durable
244
+ * `FormationInvite` row is readable — or when there is no durable store at
245
+ * all. `expiresAtMs` may be `Number.POSITIVE_INFINITY` for an invitation that
246
+ * never expires.
247
+ */
248
+ registerMintedInvitation(token: string, expiresAtMs: number): void;
249
+ /**
250
+ * Does this node currently expect a stranger — i.e. is at least one open
251
+ * invitation unexpired and not yet fully consumed? Sole input to the
252
+ * control-network connection gate's formation exemption.
253
+ *
254
+ * Two sources, in order:
255
+ *
256
+ * 1. The local mint registry ({@link registerMintedInvitation}), which is
257
+ * in-memory and dies with the process. Expired entries are dropped. With
258
+ * no {@link FormationUsageRecorder} configured there is no consumption
259
+ * oracle, so an unexpired minted token counts as outstanding by
260
+ * construction; with one, a token it reports used is deleted (consumption
261
+ * is permanent, so the registry never reconsiders it).
262
+ * 2. The recorder's optional {@link FormationUsageRecorder.hasOutstandingInvitation},
263
+ * which survives restarts and sees invitations replicated in from siblings.
264
+ *
265
+ * Re-entrant: concurrent inbound connections each call this independently and
266
+ * the only mutation is deleting expired/consumed entries, which is monotonic.
267
+ */
268
+ hasOutstandingInvitation(): Promise<boolean>;
215
269
  /**
216
270
  * Record that a formation was completed successfully.
217
271
  * Called after strand provisioning to track usage.
272
+ *
273
+ * `consent` carries the joiner-signed fields `recordUsage` now requires
274
+ * (see {@link FormationUsageRecorder.recordUsage}); this helper only passes them through.
275
+ *
276
+ * NOTE: this reaches `recordUsage` without passing through
277
+ * `StrandFormationManager.provisionAsResponder`, so `disclosure` skips that path's
278
+ * `MAX_DISCLOSURE_BYTES` cap. Harmless today — its only callers are integration-test mocks
279
+ * that all default to `''` — but if a production caller ever passes a real disclosure here,
280
+ * cap it too (the approver signs those bytes verbatim).
218
281
  */
219
- recordFormationComplete(token: string, initiatorKey: string, strandId: string): Promise<void>;
282
+ recordFormationComplete(token: string, peerKey: string, strandId: string, consent: {
283
+ usageStampId: string;
284
+ peerSignature: string;
285
+ }, disclosure?: string): Promise<void>;
220
286
  }
@@ -2,6 +2,11 @@ import debug from 'debug';
2
2
  import { toString as uint8ArrayToString } from 'uint8arrays';
3
3
  import { generateKeyPair, privateKeyToProtobuf } from '@libp2p/crypto/keys';
4
4
  import { peerIdFromPrivateKey } from '@libp2p/peer-id';
5
+ import { sign } from '@optimystic/quereus-plugin-crypto';
6
+ // control-database does not import this service, so these imports introduce no cycle.
7
+ import { generateStampId, formationConsentMessage } from './control-database.js';
8
+ import { canonicalJson } from './canonical-json.js';
9
+ import { ed25519KeyPairFromLibp2p } from './ed25519-key.js';
5
10
  import { StrandFormationManager } from './strand-formation-manager.js';
6
11
  import { isValidResponderCreatesResult } from './strand-formation-protocol.js';
7
12
  const log = debug('sereus:cadre:solicitation');
@@ -25,17 +30,31 @@ export function createDefaultFormationResponseValidator() {
25
30
  *
26
31
  * This service handles the high-level API defined in api.md:
27
32
  * - formStrand(invitation, disclosure, node) - called by initiator
28
- * - validateStrandFormation(token, disclosure) - called by responder
33
+ *
34
+ * Outside approval of a redemption (an invite's `ValidationUrl`) is NOT here: it belongs to
35
+ * the redeeming node, which alone mints the nonce the approval is bound to. See
36
+ * `formation-approval.ts`.
29
37
  *
30
38
  * When a libp2p node is provided, the underlying protocol is handled by the
31
39
  * native cadre-core formation transport via StrandFormationManager.
32
40
  */
33
41
  export class StrandSolicitationService {
34
42
  constructor(options) {
43
+ /**
44
+ * Tokens this process has minted (or published), mapped to their expiry
45
+ * epoch-ms — the in-memory half of {@link hasOutstandingInvitation}. Dies with
46
+ * the process, exactly like `CadreNode`'s enrollment window; a token that also
47
+ * reached the durable `FormationInvite` table survives via the recorder.
48
+ *
49
+ * NOTE: pruned only while {@link hasOutstandingInvitation} runs, so a node that
50
+ * mints steadily and never receives an inbound stranger retains every entry for
51
+ * the process's life. Bounded by mint rate today; if a host ever mints at scale,
52
+ * prune on a timer (or cap the map) instead of only on read.
53
+ */
54
+ this.mintedInvitations = new Map();
35
55
  this.disclosureValidator = options?.disclosureValidator;
36
56
  this.formationUsageRecorder = options?.formationUsageRecorder;
37
57
  this.strandProvisioner = options?.strandProvisioner;
38
- this.formationSigner = options?.formationSigner;
39
58
  this.formationResponseValidator = options?.formationResponseValidator;
40
59
  this.partyId = options?.partyId ?? `party-${Date.now()}`;
41
60
  this.cadrePeerAddrs = options?.cadrePeerAddrs ?? [];
@@ -101,7 +120,19 @@ export class StrandSolicitationService {
101
120
  // If we have a full invitation and a node, use the real protocol
102
121
  if (typeof invitation !== 'string' && node) {
103
122
  log('Using native cadre-core formation transport');
104
- const result = await this.getFormationManager().formStrand(invitation, { ...disclosure, partyId: memberKey }, node);
123
+ const { privateKeyB64, publicKeyB64 } = ed25519KeyPairFromLibp2p(privateKey);
124
+ const usageStampId = generateStampId(memberKey);
125
+ // Built ONCE, AFTER the partyId override: this exact object travels to the
126
+ // responder, and its canonical serialization is the disclosure text the consent
127
+ // signature covers and the responder writes to `FormationUsage.Disclosure`.
128
+ const fullDisclosure = { ...disclosure, partyId: memberKey };
129
+ const peerSignature = sign(formationConsentMessage({
130
+ token,
131
+ usageStampId,
132
+ peerKey: publicKeyB64,
133
+ disclosure: canonicalJson(fullDisclosure)
134
+ }), privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url');
135
+ const result = await this.getFormationManager().formStrand(invitation, fullDisclosure, { peerKey: publicKeyB64, usageStampId, peerSignature }, node);
105
136
  return {
106
137
  memberKey,
107
138
  invitePrivateKey,
@@ -120,53 +151,6 @@ export class StrandSolicitationService {
120
151
  strandId
121
152
  };
122
153
  }
123
- /**
124
- * Validate a strand formation request.
125
- *
126
- * Called by the responder (the party who created the open invitation) when
127
- * an initiator contacts them to form a strand. Validates the disclosure
128
- * and returns a signed approval.
129
- *
130
- * @param token The invitation token being used
131
- * @param disclosure The disclosure from the initiator
132
- * @returns Validation key and signature if approved
133
- * @throws If validation fails or token is invalid
134
- */
135
- async validateStrandFormation(token, disclosure) {
136
- log('Validating strand formation for token: %s', token);
137
- // Check token validity
138
- if (this.formationUsageRecorder) {
139
- const tokenCheck = await this.formationUsageRecorder.isTokenValid(token);
140
- if (!tokenCheck.valid) {
141
- log('Token invalid or expired: %s', token);
142
- throw new Error('Invalid or expired token');
143
- }
144
- // Check if already used (for single-use tokens)
145
- const isUsed = await this.formationUsageRecorder.isTokenUsed(token);
146
- if (isUsed) {
147
- log('Token already used: %s', token);
148
- throw new Error('Token has already been used');
149
- }
150
- }
151
- // Validate the disclosure
152
- if (this.disclosureValidator) {
153
- const isValid = await this.disclosureValidator.validateDisclosure(token, disclosure);
154
- if (!isValid) {
155
- log('Disclosure validation failed for token: %s', token);
156
- throw new Error('Disclosure validation failed');
157
- }
158
- }
159
- // Sign the formation approval
160
- if (!this.formationSigner) {
161
- throw new Error('FormationSigner not configured');
162
- }
163
- const { validationKey, validationSignature } = await this.formationSigner.signFormation(token, disclosure);
164
- log('Formation validated, key: %s', validationKey);
165
- return {
166
- validationKey,
167
- validationSignature
168
- };
169
- }
170
154
  /**
171
155
  * Create an open invitation for others to form strands with this party.
172
156
  *
@@ -179,6 +163,7 @@ export class StrandSolicitationService {
179
163
  // Generate a unique token
180
164
  const token = `invite-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
181
165
  const expiration = new Date(Date.now() + expirationMs);
166
+ this.registerMintedInvitation(token, expiration.getTime());
182
167
  log('Created open invitation: %s (expires %s)', token, expiration.toISOString());
183
168
  return {
184
169
  token,
@@ -187,13 +172,76 @@ export class StrandSolicitationService {
187
172
  bootstrap
188
173
  };
189
174
  }
175
+ /**
176
+ * Remember a token this node minted (or published) so
177
+ * {@link hasOutstandingInvitation} can answer "yes" before the durable
178
+ * `FormationInvite` row is readable — or when there is no durable store at
179
+ * all. `expiresAtMs` may be `Number.POSITIVE_INFINITY` for an invitation that
180
+ * never expires.
181
+ */
182
+ registerMintedInvitation(token, expiresAtMs) {
183
+ this.mintedInvitations.set(token, expiresAtMs);
184
+ log('Registered minted invitation %s (expires %d)', token, expiresAtMs);
185
+ }
186
+ /**
187
+ * Does this node currently expect a stranger — i.e. is at least one open
188
+ * invitation unexpired and not yet fully consumed? Sole input to the
189
+ * control-network connection gate's formation exemption.
190
+ *
191
+ * Two sources, in order:
192
+ *
193
+ * 1. The local mint registry ({@link registerMintedInvitation}), which is
194
+ * in-memory and dies with the process. Expired entries are dropped. With
195
+ * no {@link FormationUsageRecorder} configured there is no consumption
196
+ * oracle, so an unexpired minted token counts as outstanding by
197
+ * construction; with one, a token it reports used is deleted (consumption
198
+ * is permanent, so the registry never reconsiders it).
199
+ * 2. The recorder's optional {@link FormationUsageRecorder.hasOutstandingInvitation},
200
+ * which survives restarts and sees invitations replicated in from siblings.
201
+ *
202
+ * Re-entrant: concurrent inbound connections each call this independently and
203
+ * the only mutation is deleting expired/consumed entries, which is monotonic.
204
+ */
205
+ async hasOutstandingInvitation() {
206
+ const now = Date.now();
207
+ for (const [token, expiresAtMs] of this.mintedInvitations) {
208
+ if (expiresAtMs <= now) {
209
+ this.mintedInvitations.delete(token);
210
+ continue;
211
+ }
212
+ if (!this.formationUsageRecorder) {
213
+ return true;
214
+ }
215
+ if (!(await this.formationUsageRecorder.isTokenUsed(token))) {
216
+ return true;
217
+ }
218
+ this.mintedInvitations.delete(token);
219
+ }
220
+ return (await this.formationUsageRecorder?.hasOutstandingInvitation?.()) ?? false;
221
+ }
190
222
  /**
191
223
  * Record that a formation was completed successfully.
192
224
  * Called after strand provisioning to track usage.
225
+ *
226
+ * `consent` carries the joiner-signed fields `recordUsage` now requires
227
+ * (see {@link FormationUsageRecorder.recordUsage}); this helper only passes them through.
228
+ *
229
+ * NOTE: this reaches `recordUsage` without passing through
230
+ * `StrandFormationManager.provisionAsResponder`, so `disclosure` skips that path's
231
+ * `MAX_DISCLOSURE_BYTES` cap. Harmless today — its only callers are integration-test mocks
232
+ * that all default to `''` — but if a production caller ever passes a real disclosure here,
233
+ * cap it too (the approver signs those bytes verbatim).
193
234
  */
194
- async recordFormationComplete(token, initiatorKey, strandId) {
235
+ async recordFormationComplete(token, peerKey, strandId, consent, disclosure = '') {
195
236
  if (this.formationUsageRecorder) {
196
- await this.formationUsageRecorder.recordUsage(token, initiatorKey, strandId);
237
+ await this.formationUsageRecorder.recordUsage({
238
+ token,
239
+ peerKey,
240
+ peerSignature: consent.peerSignature,
241
+ usageStampId: consent.usageStampId,
242
+ strandId,
243
+ disclosure
244
+ });
197
245
  log('Recorded formation usage: token=%s strand=%s', token, strandId);
198
246
  }
199
247
  }
@@ -1 +1 @@
1
- {"version":3,"file":"strand-solicitation.js","sourceRoot":"","sources":["../src/strand-solicitation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAQvD,OAAO,EACL,sBAAsB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAE9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AA2H/C;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC;IACrD,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;YACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;;;;;GASG;AACH,MAAM,OAAO,yBAAyB;IAWpC,YAAY,OAA0C;QACpD,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,CAAC;QACxD,IAAI,CAAC,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QAChD,IAAI,CAAC,0BAA0B,GAAG,OAAO,EAAE,0BAA0B,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QAChD,GAAG,CAAC,iDAAiD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,sBAAsB,CAAC;gBACjD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;gBAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY;QAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACnD,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,IAAI,CAAC,mBAAmB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CACd,UAAmC,EACnC,UAAqC,EACrC,IAAa;QAEb,gDAAgD;QAChD,MAAM,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7E,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAE5C,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEvE,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;QAE3C,iEAAiE;QACjE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAC,6CAA6C,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,UAAU,CACxD,UAAU,EACV,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,EACrC,IAAI,CACL,CAAC;YACF,OAAO;gBACL,SAAS;gBACT,gBAAgB;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,oFAAoF;gBACpF,wFAAwF;gBACxF,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAElF,OAAO;YACL,SAAS;YACT,gBAAgB;YAChB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,UAAqC;QAErC,GAAG,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAExD,uBAAuB;QACvB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,GAAG,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YAED,gDAAgD;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACrF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CACrF,KAAK,EACL,UAAU,CACX,CAAC;QAEF,GAAG,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAEnD,OAAO;YACL,aAAa;YACb,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,YAAoB,EACpB,SAAmB;QAEnB,0BAA0B;QAC1B,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAEvD,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjF,OAAO;YACL,KAAK;YACL,MAAM;YACN,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,YAAoB,EACpB,QAAgB;QAEhB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC7E,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}
1
+ {"version":3,"file":"strand-solicitation.js","sourceRoot":"","sources":["../src/strand-solicitation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AAMzD,sFAAsF;AACtF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAE9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAiJ/C;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC;IACrD,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;YACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAAyB;IAsBpC,YAAY,OAA0C;QAbtD;;;;;;;;;;WAUG;QACc,sBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAG7D,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,CAAC;QACxD,IAAI,CAAC,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,0BAA0B,GAAG,OAAO,EAAE,0BAA0B,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QAChD,GAAG,CAAC,iDAAiD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,sBAAsB,CAAC;gBACjD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;gBAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY;QAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACnD,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,IAAI,CAAC,mBAAmB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CACd,UAAmC,EACnC,UAAqC,EACrC,IAAa;QAEb,gDAAgD;QAChD,MAAM,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7E,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAE5C,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEvE,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;QAE3C,iEAAiE;QACjE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAC,6CAA6C,CAAC,CAAC;YACnD,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAC7E,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAChD,2EAA2E;YAC3E,gFAAgF;YAChF,4EAA4E;YAC5E,MAAM,cAAc,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CACxB,uBAAuB,CAAC;gBACtB,KAAK;gBACL,YAAY;gBACZ,OAAO,EAAE,YAAY;gBACrB,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC;aAC1C,CAAC,EACF,aAAa,EACb,SAAS,EACT,OAAO,EACP,WAAW,EACX,WAAW,CACF,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,UAAU,CACxD,UAAU,EACV,cAAc,EACd,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,EACtD,IAAI,CACL,CAAC;YACF,OAAO;gBACL,SAAS;gBACT,gBAAgB;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,oFAAoF;gBACpF,wFAAwF;gBACxF,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAElF,OAAO;YACL,SAAS;YACT,gBAAgB;YAChB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,YAAoB,EACpB,SAAmB;QAEnB,0BAA0B;QAC1B,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3D,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjF,OAAO;YACL,KAAK;YACL,MAAM;YACN,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAa,EAAE,WAAmB;QACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC/C,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,wBAAwB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1D,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IACpF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,OAAe,EACf,QAAgB,EAChB,OAAwD,EACxD,UAAU,GAAG,EAAE;QAEf,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC5C,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ;gBACR,UAAU;aACX,CAAC,CAAC;YACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}
@@ -0,0 +1,40 @@
1
+ import type { PrivateKey } from '@libp2p/interface';
2
+ /**
3
+ * Derive a strand node's libp2p transport key from the cadre identity key and
4
+ * the strand id.
5
+ *
6
+ * A `CadreNode` runs its control node and each strand node as separate libp2p
7
+ * instances. Handing them all the same private key gives them all the same
8
+ * peerId, and `@libp2p/circuit-relay-v2` keys reservations and hop-connects by
9
+ * peerId — so a control node and a strand node reserving through one shared
10
+ * relay collide, and relayed streams for one land on the other
11
+ * (https://github.com/gotchoices/sereus/issues/1). Each strand node therefore
12
+ * gets its own transport identity. Cadre *authority* is untouched: the control
13
+ * node keeps the identity key, and every peerId→authority derivation
14
+ * (`ed25519PublicKeyB64FromPeerId`) is a control-network path.
15
+ *
16
+ * The derivation is deterministic — `sha256(domain, identity seed, strandId)`
17
+ * as an Ed25519 seed — rather than a fresh random key per launch, so the
18
+ * strand's transport peerId survives restarts. The identity *private* seed is
19
+ * an input (not the public key) so that no third party can enumerate a member's
20
+ * strand peerIds from public data; only the key holder can compute them.
21
+ *
22
+ * NOTE: the derived peerId *is* attested at runtime: before a strand node
23
+ * starts, its control node announces it over the strand-addr RPC, and a
24
+ * membership-gated relay (a party control node running the relay server) holds
25
+ * a short-lived delegate admission grant for it (`delegate-admission.ts`) —
26
+ * without that grant the relay denies the strand node's reservation and
27
+ * `libp2p.start()` fails. The strand *mesh* itself still does not gate
28
+ * admission by peerId (strand peers are legitimately cross-party); if
29
+ * strand-mesh admission control is ever added, the durable binding it needs is
30
+ * a `MemberPeer(MemberKey, PeerId)` row: the table and its self-signed
31
+ * `Authorized` constraint already exist in `schemas/strand.qsql`; production
32
+ * code simply never writes one.
33
+ *
34
+ * @param identityKey - The cadre's Ed25519 identity key (the control node's key).
35
+ * @param strandId - The strand whose transport key to derive.
36
+ * @returns A stable, per-strand Ed25519 libp2p private key, distinct from the
37
+ * identity key and from every other strand's.
38
+ * @throws If the identity key is not Ed25519.
39
+ */
40
+ export declare function strandTransportKey(identityKey: PrivateKey, strandId: string): Promise<PrivateKey>;
@@ -0,0 +1,56 @@
1
+ import { generateKeyPairFromSeed } from '@libp2p/crypto/keys';
2
+ import { digest } from '@optimystic/quereus-plugin-crypto';
3
+ import { ed25519KeyPairFromLibp2p } from './ed25519-key.js';
4
+ /**
5
+ * Domain-separation tag for the strand-transport-key derivation. Versioned so a
6
+ * future change to the derivation (different KDF, different inputs) can bump to
7
+ * `.v2` and be recognized as a deliberate identity migration rather than silent
8
+ * peerId churn — a strand node's transport peerId must stay stable across
9
+ * process restarts, or any peer-store entry or `MemberPeer` row that names it
10
+ * goes stale on every boot.
11
+ */
12
+ const STRAND_TRANSPORT_KEY_DOMAIN = 'sereus.strand-transport-key.v1';
13
+ /**
14
+ * Derive a strand node's libp2p transport key from the cadre identity key and
15
+ * the strand id.
16
+ *
17
+ * A `CadreNode` runs its control node and each strand node as separate libp2p
18
+ * instances. Handing them all the same private key gives them all the same
19
+ * peerId, and `@libp2p/circuit-relay-v2` keys reservations and hop-connects by
20
+ * peerId — so a control node and a strand node reserving through one shared
21
+ * relay collide, and relayed streams for one land on the other
22
+ * (https://github.com/gotchoices/sereus/issues/1). Each strand node therefore
23
+ * gets its own transport identity. Cadre *authority* is untouched: the control
24
+ * node keeps the identity key, and every peerId→authority derivation
25
+ * (`ed25519PublicKeyB64FromPeerId`) is a control-network path.
26
+ *
27
+ * The derivation is deterministic — `sha256(domain, identity seed, strandId)`
28
+ * as an Ed25519 seed — rather than a fresh random key per launch, so the
29
+ * strand's transport peerId survives restarts. The identity *private* seed is
30
+ * an input (not the public key) so that no third party can enumerate a member's
31
+ * strand peerIds from public data; only the key holder can compute them.
32
+ *
33
+ * NOTE: the derived peerId *is* attested at runtime: before a strand node
34
+ * starts, its control node announces it over the strand-addr RPC, and a
35
+ * membership-gated relay (a party control node running the relay server) holds
36
+ * a short-lived delegate admission grant for it (`delegate-admission.ts`) —
37
+ * without that grant the relay denies the strand node's reservation and
38
+ * `libp2p.start()` fails. The strand *mesh* itself still does not gate
39
+ * admission by peerId (strand peers are legitimately cross-party); if
40
+ * strand-mesh admission control is ever added, the durable binding it needs is
41
+ * a `MemberPeer(MemberKey, PeerId)` row: the table and its self-signed
42
+ * `Authorized` constraint already exist in `schemas/strand.qsql`; production
43
+ * code simply never writes one.
44
+ *
45
+ * @param identityKey - The cadre's Ed25519 identity key (the control node's key).
46
+ * @param strandId - The strand whose transport key to derive.
47
+ * @returns A stable, per-strand Ed25519 libp2p private key, distinct from the
48
+ * identity key and from every other strand's.
49
+ * @throws If the identity key is not Ed25519.
50
+ */
51
+ export async function strandTransportKey(identityKey, strandId) {
52
+ const { privateKeyB64 } = ed25519KeyPairFromLibp2p(identityKey);
53
+ const seed = digest([STRAND_TRANSPORT_KEY_DOMAIN, privateKeyB64, strandId], 'sha256', 'bytes');
54
+ return generateKeyPairFromSeed('Ed25519', seed);
55
+ }
56
+ //# sourceMappingURL=strand-transport-key.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"strand-transport-key.js","sourceRoot":"","sources":["../src/strand-transport-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAuB,EAAE,QAAgB;IAChF,MAAM,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,2BAA2B,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IAC7G,OAAO,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC"}
@@ -14,13 +14,15 @@
14
14
  * stream (like seed delivery), so each side reads to EOF (under a read timeout)
15
15
  * and decodes one frame via the shared {@link decodeLengthPrefixedFrame} guard.
16
16
  *
17
- * **Authorization (v1):** the control network already restricts membership —
18
- * only this party's cadre peers connect (schema-gated `CadrePeer`). A wake is
19
- * low-risk: it only causes the receiver to spend resources coming online for a
20
- * strand it already participates in. So the receiver verifies the remote peer is
21
- * a `CadrePeer` member (via the injected `isMember` gate) and requires no
22
- * signature beyond control-network membership. A richer per-request signature is
23
- * deliberately out of scope for v1.
17
+ * **Authorization (v1):** a wake is low-risk — it only causes the receiver to
18
+ * spend resources coming online for a strand it already participates in — so the
19
+ * receiver carries no per-request signature and instead defers entirely to the
20
+ * injected `isMember` predicate. `CadreNode` injects its AUTHORIZED-membership
21
+ * predicate there (`isAuthorizedMember`: the sender's `CadrePeer` row must carry
22
+ * a voucher that verifies against an owner key in the receiver's node-local
23
+ * trusted-owner anchor), so a peer that merely published rows into the replicated
24
+ * control DB is refused. This module stays agnostic: it enforces whatever
25
+ * predicate it is given.
24
26
  */
25
27
  import type { Libp2p } from '@libp2p/interface';
26
28
  import type { Multiaddr } from '@multiformats/multiaddr';