@serfab/cadre-core 0.9.0 → 0.11.0

package/src/strand-instance-manager.ts

@@ -1,7 +1,9 @@
 import debug from 'debug';
 import type { PrivateKey } from '@libp2p/interface';
 import { createLibp2pNode, type IRawStorage } from '@optimystic/db-p2p';
+import { wrapStorageWithCache, disposeStorageCache } from '@serfab/quereus-plugin-sereus';
 import { StrandDatabase } from './strand-database.js';
+import { StrandBackfill, type StrandBackfillConfig } from './strand-backfill.js';
 import { assertSchemaSignature } from './schema-verification.js';
 import type {
   StrandInstance,
@@ -13,9 +15,10 @@ import type {
   SAppConfig,
   SAppInfo,
   RawStorageProvider,
-  StrandMode,
   Libp2pNodeWithRepo
 } from './types.js';
+import { resolveStrandClusterSize, STRAND_CLUSTER_POLICY } from './types.js';
+import { resolveListenAddrs } from './relay-addrs.js';
 
 const log = debug('sereus:cadre:strand-manager');
 const timing = debug('sereus:cadre:timing');
@@ -34,12 +37,6 @@ export interface StartStrandConfig {
   privateKey?: PrivateKey;
   /** Cohort-derived discovery seed (multiaddr strings). Defaults to [] when omitted. */
   bootstrapNodes?: string[];
-  /**
-   * Lifecycle mode for this strand; selects the default transactor used by the
-   * StrandDatabase. When omitted, the StrandDatabase falls back to `'networked'`;
-   * callers (CadreNode) infer it from cohort membership before reaching here.
-   */
-  mode?: StrandMode;
   /**
    * Require a valid author signature on the sApp schema before bring-up.
    * Defaults to true (fail closed) when omitted; set false only for dev/test
@@ -53,18 +50,35 @@ export interface StartStrandConfig {
    * {@link StrandConfig.founder}.
    */
   founder?: boolean;
+  /**
+   * Number of nodes Optimystic is told this strand's replication cluster should
+   * have. Same rule as {@link CadreNodeConfig.strandClusterSize}, which CadreNode
+   * forwards here: every node on the strand should use the same value, and it is
+   * frozen when the strand's libp2p node is created. Defaults to
+   * `DEFAULT_STRAND_CLUSTER_SIZE` (4); values below `MIN_CLUSTER_SIZE` (2) are
+   * rejected by `resolveStrandClusterSize`. Strand-only — the
+   * control network's breadth is the fixed `CONTROL_REPLICATION_BREADTH`.
+   */
+  clusterSize?: number;
+  /**
+   * Tuning for the strand peer-join block catch-up ({@link StrandBackfill}),
+   * forwarded from {@link CadreNodeConfig.strandBackfill}. When the strand's
+   * libp2p node connects to a peer this runtime has not yet caught up, every
+   * block in the strand's own raw store is pushed to it. Runs only on strands
+   * with per-strand storage; `{ enabled: false }` restores the pre-existing
+   * no-backfill behaviour.
+   */
+  backfill?: StrandBackfillConfig;
 }
 
 /**
- * Volatile inputs re-resolved when resuming a quiesced strand. These may have
- * changed since the strand first launched — the cohort discovery seed grows as
- * peers are learned, and cohort membership can push a strand `bootstrap → networked`.
+ * Volatile inputs re-resolved when resuming a quiesced strand. The cohort
+ * discovery seed is the only one — it grows as peers are learned since the
+ * strand first launched.
  */
 export interface ResumeStrandOverrides {
   /** Freshly-resolved cohort discovery seed (multiaddr strings). */
   bootstrapNodes?: string[];
-  /** Freshly-resolved lifecycle mode. */
-  mode?: StrandMode;
 }
 
 /**
@@ -106,6 +120,9 @@ export function getStrandStoragePath(basePath: string, strandId: string): string
  * Resolve a storage provider for a specific strand.
  * If the provider is a factory function, call it with the strandId.
  *
+ * Called only from {@link StrandInstanceManager.startStrand}, which owns the result
+ * for the instance's lifetime — see `strandStorages`.
+ *
  * @param provider - Storage provider (instance or factory)
  * @param strandId - The strand ID to create storage for
  * @returns The resolved IRawStorage instance, or undefined if no provider
@@ -117,7 +134,11 @@ function resolveStrandStorage(
   if (!provider) {
     return undefined;
   }
-  return typeof provider === 'function' ? provider(strandId) : provider;
+  const storage = typeof provider === 'function' ? provider(strandId) : provider;
+  // Wrapped in the write-through raw-storage cache (quereus-plugin-sereus's cached-storage.ts).
+  // Called ONCE per strand launch — `startStrand` keeps the result for the instance's
+  // lifetime — so the wrap survives every runtime rebuild the instance goes through.
+  return wrapStorageWithCache(storage, strandId);
 }
 
 /**
@@ -132,6 +153,35 @@ export class StrandInstanceManager {
    * without the caller re-threading storage/network/profile/key/sApp config.
    */
   private launchConfigs: Map<string, StartStrandConfig> = new Map();
+  /**
+   * The per-strand peer-join block catch-up, keyed by strand id. Private (not on
+   * the public {@link StrandInstance}) because it is runtime plumbing with the
+   * same lifetime as the strand's libp2p node: created in `buildStrandRuntime`,
+   * stopped and dropped in `releaseRuntime` — so quiesce → resume rebuilds it
+   * with a fresh caught-up-peer memo, which is intended (a resumed node may have
+   * missed writes).
+   */
+  private backfills: Map<string, StrandBackfill> = new Map();
+  /**
+   * The resolved (cache-wrapped) raw storage per strand id — the instance's OWN
+   * store, resolved once in `startStrand` and held until `stopStrand` disposes it.
+   * Private for the same reason `backfills` is: runtime plumbing, not part of the
+   * public {@link StrandInstance}.
+   *
+   * Deliberately NOT touched by `releaseRuntime`: that is what lets a quiesce →
+   * resume cycle rebuild the libp2p node over the SAME store, keeping its
+   * write-through cache warm (and, on an in-memory backend, keeping the strand's
+   * blocks at all). An entry exists iff `instances` does AND the launch config
+   * supplied a storage provider.
+   *
+   * NOTE: a hibernating strand therefore keeps its store — and its share of the
+   * process-wide cache pool — resident for as long as the instance is tracked. That
+   * is the point (a warm wake), and the pool evicts under pressure, so the cost is
+   * one map entry per hibernating strand today. If a device ever hibernates strands
+   * by the hundred, revisit: dropping the store at quiesce and paying for a cold
+   * wake becomes the better trade.
+   */
+  private strandStorages: Map<string, IRawStorage> = new Map();
   private stopping = false;
 
   constructor() {
@@ -160,7 +210,20 @@ export class StrandInstanceManager {
   }
 
   /**
-   * Start a new strand instance
+   * Start a new strand instance.
+   *
+   * A failed launch leaves NOTHING tracked: the instance and its retained launch
+   * config are both dropped before the error is rethrown, so the strand id is
+   * free for a genuine retry. This matches the pre-registration failure path
+   * (a rejected schema signature, which throws before anything is recorded) —
+   * both failure modes of this call leave the same residue: none. Callers learn
+   * of the failure from the rejected promise (and, on the control-discovered
+   * path, from CadreNode's `strand:error` event), not from an error record left
+   * behind in `instances`.
+   *
+   * The strand's raw storage is resolved HERE, once, and held for the instance's
+   * lifetime (see `strandStorages`) — `buildStrandRuntime` only reads it, so a
+   * hibernation wake never re-enters the embedder's provider.
    */
   async startStrand(config: StartStrandConfig): Promise<StrandInstance> {
     const { strandRow, sAppConfig } = config;
@@ -191,6 +254,15 @@ export class StrandInstanceManager {
       signature: sAppConfig.signature
     };
 
+    // Resolve this strand's storage ONCE, before anything is recorded. If a factory
+    // function is provided, it is called with the strandId to create strand-specific
+    // storage (e.g. strand-isolated directories). A provider that throws therefore
+    // fails the launch alongside the schema-signature check, leaving nothing tracked.
+    const strandStorage = resolveStrandStorage(config.storage?.provider, strandId);
+    if (strandStorage) {
+      log('Strand %s using provided storage provider', strandId);
+    }
+
     // Determine latency hint: sApp config > default
     const latencyHint = sAppConfig.latencyHint ?? config.defaultLatencyHint;
 
@@ -206,6 +278,9 @@ export class StrandInstanceManager {
 
     this.instances.set(strandId, instance);
     this.launchConfigs.set(strandId, config);
+    if (strandStorage) {
+      this.strandStorages.set(strandId, strandStorage);
+    }
 
     try {
       await this.buildStrandRuntime(instance, config);
@@ -213,9 +288,18 @@ export class StrandInstanceManager {
       log('Strand %s started successfully with sApp %s', strandId, sAppConfig.id);
       return instance;
     } catch (error) {
+      // Status/error first — the (now discarded) record is still what `log` reports on.
       instance.status = 'error';
       instance.error = error instanceof Error ? error.message : String(error);
       log('Failed to start strand %s: %s', strandId, instance.error);
+      // Drop the dead record so this strand id can be launched again. Keep the
+      // `launchConfigs` has an entry iff `instances` does invariant — resumeStrand
+      // reads both, and a config without an instance would strand the config.
+      this.instances.delete(strandId);
+      this.launchConfigs.delete(strandId);
+      // The store this launch resolved goes with it: nothing owns it any more, and a
+      // retained cache wrapper would be handed back (already retired) on a retry.
+      await this.disposeStrandStorage(strandId);
       throw error;
     }
   }
@@ -224,61 +308,68 @@ export class StrandInstanceManager {
    * Build (or rebuild) the libp2p node + StrandDatabase for an instance and
    * attach them, transitioning it to `active`. Shared by `startStrand` (fresh
    * launch) and `resumeStrand` (rehydrating a quiesced instance). Reads all
-   * volatile inputs (bootstrapNodes, mode, storage, network, profile,
-   * privateKey, sApp config) from `config`, so the caller controls the
-   * cohort-derived values.
+   * volatile inputs (bootstrapNodes, network, profile, privateKey, sApp config)
+   * from `config`, so the caller controls the cohort-derived values. Storage is the
+   * one input it does NOT re-read from `config`: that belongs to the instance and
+   * comes from `strandStorages`.
    */
   private async buildStrandRuntime(instance: StrandInstance, config: StartStrandConfig): Promise<void> {
     const strandId = instance.strandId;
     const { sAppConfig } = config;
 
-    // Resolve storage for this strand. If a factory function is provided, it is
-    // called with the strandId to create strand-specific storage (e.g.,
-    // strand-isolated directories).
-    const strandStorage = resolveStrandStorage(config.storage?.provider, strandId);
-    if (strandStorage) {
-      log('Strand %s using provided storage provider', strandId);
-    }
+    // The store the instance OWNS (resolved once in `startStrand`), not a fresh
+    // resolution: a rebuild must reach the same backend through the same warm cache.
+    const strandStorage = this.strandStorages.get(strandId);
 
-    // Note: protocolPrefix would be used by libp2p services, but createLibp2pNode
-    // may not support it yet - tracked for future implementation.
-    const _protocolPrefix = `/sereus/strand/${strandId}`;
+    // db-p2p namespaces every one of the node's protocol ids by network name
+    // (`/optimystic/<networkName>/...`), so anything dialing this node's own
+    // services must derive its prefix from the SAME string the node was built
+    // with — hence one binding for both, not two literals that can drift.
+    const networkName = `strand-${strandId}`;
+    const protocolPrefix = `/optimystic/${networkName}`;
 
     // Determine relay mode: if explicitly set in config, use that;
     // otherwise default to true for storage profile nodes.
     const enableRelay = config.network?.enableRelay ?? (config.profile === 'storage');
+    const listenAddrs = resolveListenAddrs(config.network);
 
     try {
       let t0 = performance.now();
       const node = await createLibp2pNode({
         port: 0, // Random port
         bootstrapNodes: config.bootstrapNodes ?? [],
-        networkName: `strand-${strandId}`,
+        networkName,
         storage: strandStorage,
         fretProfile: config.profile === 'storage' ? 'core' : 'edge',
         relay: enableRelay,
-        clusterSize: 3,
-        clusterPolicy: {
-          allowDownsize: true,
-          sizeTolerance: 0.5
-        },
+        clusterSize: resolveStrandClusterSize(config.clusterSize),
+        // Deliberately NOT CONTROL_CLUSTER_POLICY: a strand is application data with its own
+        // breadth reasoning, and the shape match with the control policy is a coincidence.
+        clusterPolicy: STRAND_CLUSTER_POLICY,
         arachnode: {
           enableRingZulu: config.profile === 'storage'
         },
         ...(config.privateKey && { privateKey: config.privateKey }),
         ...(config.network?.transports && { transports: config.network.transports }),
-        ...(config.network?.listenAddrs && { listenAddrs: config.network.listenAddrs }),
+        // NOTE: strand nodes receive the same RESOLVED listen addrs as the
+        // control node. A fixed-port listen addr (e.g. cadre-cli's example
+        // `/ip4/0.0.0.0/tcp/4001`) would have control + strand nodes racing to
+        // bind one port — EADDRINUSE. Unverified; if a deployment configures a
+        // fixed port and strands fail to start, rewrite the port per node here.
+        // An inherited `/p2p-circuit` addr, by contrast, is deliberate — it is
+        // what gives a NAT'd strand node a reachable relay slot — and works
+        // because the launch path announces this strand's derived peerId to
+        // the relay first (delegate admission; see cadre-node.ts). Those circuit
+        // entries come either from a hand-written `network.listenAddrs` or from
+        // `network.relayAddrs`, which `resolveListenAddrs` folds into the same list.
+        ...(listenAddrs && { listenAddrs }),
         ...(config.network?.connectionGater && { connectionGater: config.network.connectionGater })
       }) as Libp2pNodeWithRepo;
       timing('[buildStrandRuntime:%s] createLibp2pNode: %dms', strandId, Math.round(performance.now() - t0));
 
       instance.libp2pNode = node;
 
-      // Create and initialize the StrandDatabase. In bootstrap mode the same
-      // strandStorage instance also backs the optimystic local transactor so
-      // DML lands on the host's persistent storage (e.g. MMKV on RN). Sharing
-      // the instance — not creating a second one over the same id+prefix —
-      // avoids cache divergence between the libp2p and database paths.
+      // Create and initialize the StrandDatabase.
       //
       // Attach before initialize so a failed init is cleaned up by
       // releaseRuntime below (close() is safe on a partially-initialized db).
@@ -288,8 +379,6 @@ export class StrandInstanceManager {
         sAppConfig,
         libp2pNode: node,
         coordinatedRepo: node.coordinatedRepo,
-        mode: config.mode ?? 'networked',
-        rawStorage: strandStorage,
         // Founder bootstrap inputs: the strand's type drives which membership rows
         // are written, and the closed-strand MemberPrivateKey derives the founding
         // Member/Manager key. Both come off the control-network strand row.
@@ -301,6 +390,37 @@ export class StrandInstanceManager {
       await strandDb.initialize();
       timing('[buildStrandRuntime:%s] strandDatabase.initialize: %dms', strandId, Math.round(performance.now() - t0));
 
+      // Peer-join block catch-up: push this strand's own blocks to each newly
+      // connected peer, so a machine that joined after blocks were committed
+      // still ends up physically holding them (without per-strand storage there
+      // is nothing to copy). Armed for EVERY stored strand: `StrandBackfill`
+      // only does work when the strand's libp2p node reports a peer connection,
+      // so on a device that is genuinely alone it is inert, and arming it at
+      // launch is what closes the "founded alone, never replicates" hole — a
+      // peer that joins later gets the founder's blocks without any relaunch.
+      //
+      // NOTE: cost is one StrandBackfill object + one `connection:open` listener
+      // per running strand — linear in strand count, negligible at the handful a
+      // device or host runs today. If a node ever hosts strands by the hundred,
+      // move to one shared listener that dispatches by strand id.
+      if (strandStorage && config.backfill?.enabled !== false) {
+        if (node.keyNetwork) {
+          const backfill = new StrandBackfill({
+            strandId,
+            libp2p: node,
+            peerNetwork: node.keyNetwork,
+            storage: strandStorage,
+            // The same prefix the receiver registered its block-transfer handler
+            // under — derived from networkName above, never re-spelled here.
+            protocolPrefix
+          }, config.backfill);
+          backfill.start();
+          this.backfills.set(strandId, backfill);
+        } else {
+          log('Strand %s: libp2p node exposes no keyNetwork; peer-join block catch-up is inert', strandId);
+        }
+      }
+
       instance.status = 'active';
       instance.lastActivity = new Date();
     } catch (error) {
@@ -321,8 +441,19 @@ export class StrandInstanceManager {
    * and zeroing connectedPeers. Tolerant of partially-built state — either handle
    * may be absent — so it doubles as rollback for a failed `buildStrandRuntime`.
    * Shared by `quiesceStrand`, `stopStrand`, and that rollback path.
+   *
+   * Leaves `strandStorages` untouched by design — the store outlives the runtime it
+   * was built into, which is what makes a resume warm. Only `stopStrand` disposes it.
    */
   private async releaseRuntime(instance: StrandInstance): Promise<void> {
+    // Backfill first — before the database closes and the libp2p node stops — so
+    // no NEW catch-up push is issued against a torn-down transport. A push already
+    // in flight is not awaited; it fails into the module's own per-chunk catch.
+    const backfill = this.backfills.get(instance.strandId);
+    if (backfill) {
+      backfill.stop();
+      this.backfills.delete(instance.strandId);
+    }
     if (instance.database) {
       await instance.database.close();
       instance.database = undefined;
@@ -334,6 +465,29 @@ export class StrandInstanceManager {
     instance.connectedPeers = 0;
   }
 
+  /**
+   * Drop the strand's owned store and release its cache registration with the shared
+   * pool. Called only where the strand's whole lifetime ends (`stopStrand`, and the
+   * failed-launch rollback) — never on a quiesce.
+   *
+   * A dispose failure is logged, not thrown: the store is already unreferenced here,
+   * and failing the stop over a cache-bookkeeping error would leave the caller unable
+   * to tear the strand down. `disposeStorageCache` no-ops for an unwrapped store
+   * (e.g. `MemoryRawStorage`), so no instanceof test is needed.
+   */
+  private async disposeStrandStorage(strandId: string): Promise<void> {
+    const storage = this.strandStorages.get(strandId);
+    if (!storage) {
+      return;
+    }
+    this.strandStorages.delete(strandId);
+    try {
+      await disposeStorageCache(storage);
+    } catch (error) {
+      log('Failed to dispose storage cache for strand %s: %o', strandId, error);
+    }
+  }
+
   /**
    * Quiesce a strand: release its strand-network resources (stop the libp2p node,
    * close the StrandDatabase) while RETAINING the instance record — identity,
@@ -362,9 +516,9 @@ export class StrandInstanceManager {
    * Resume a previously-quiesced strand: rebuild its libp2p node + StrandDatabase
    * from the retained launch config and re-attach them, transitioning it back to
    * `active`. `overrides` re-applies volatile inputs that may have changed since
-   * launch (cohort `bootstrapNodes`, lifecycle `mode`) and updates the retained
-   * config so a later resume reuses the latest values. Returns the live instance
-   * unchanged if it is already running.
+   * launch (the cohort `bootstrapNodes` seed) and updates the retained config so
+   * a later resume reuses the latest values. Returns the live instance unchanged
+   * if it is already running.
    */
   async resumeStrand(strandId: string, overrides?: ResumeStrandOverrides): Promise<StrandInstance> {
     if (this.stopping) {
@@ -389,8 +543,7 @@ export class StrandInstanceManager {
     // Re-apply volatile inputs and persist them so a subsequent resume reuses them.
     const resumeConfig: StartStrandConfig = {
       ...launchConfig,
-      bootstrapNodes: overrides?.bootstrapNodes ?? launchConfig.bootstrapNodes,
-      mode: overrides?.mode ?? launchConfig.mode
+      bootstrapNodes: overrides?.bootstrapNodes ?? launchConfig.bootstrapNodes
     };
     this.launchConfigs.set(strandId, resumeConfig);
 
@@ -426,6 +579,8 @@ export class StrandInstanceManager {
       instance.status = 'stopped';
       this.instances.delete(strandId);
       this.launchConfigs.delete(strandId);
+      // Storage is released only here — NOT in releaseRuntime, which a quiesce shares.
+      await this.disposeStrandStorage(strandId);
       log('Strand %s stopped successfully', strandId);
     } catch (error) {
       instance.status = 'error';

package/src/strand-member-key.ts

@@ -1,39 +1,39 @@
-import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
-import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import { ed25519KeyPairFromLibp2p, type Ed25519KeyPair } from './ed25519-key.js';
-
-/**
- * Mint a fresh ed25519 strand member private key, encoded as base64 protobuf.
- *
- * Closed strands (`Type:'c'`) gate membership on a `MemberPrivateKey` column
- * (see the `Strand` control-schema table). This produces one in the SAME
- * encoding {@link StrandSolicitationService.formStrand} uses for its
- * `invitePrivateKey`, so a host-minted key and a formation-issued key are
- * interchangeable when attaching a closed strand.
- */
-export async function generateStrandMemberKey(): Promise<string> {
-  const privateKey = await generateKeyPair('Ed25519');
-  return uint8ArrayToString(privateKeyToProtobuf(privateKey), 'base64');
-}
-
-/**
- * Bridge a strand's `MemberPrivateKey` (base64 protobuf libp2p ed25519 key, as
- * minted by {@link generateStrandMemberKey} or issued by formation) into the
- * base64url keypair the strand RBAC constraints consume.
- *
- * The `Strand` control-layer `MemberPrivateKey` is the closed-strand read-gating
- * secret; the founding `Member.Key`/`Manager.MemberKey` (the strand RBAC layer)
- * are *derived from it* — they are the `publicKeyB64` of the keypair this returns.
- * Decode the protobuf to a libp2p private key, then reuse
- * {@link ed25519KeyPairFromLibp2p} so the same seed→public derivation used for node
- * owner keys yields a stable `{ privateKeyB64, publicKeyB64 }` whose public
- * key a later strand signature verifies against.
- *
- * @param memberPrivateKey - The strand's `MemberPrivateKey` (base64 protobuf).
- * @returns The base64url seed/public-key pair for founding membership/manager.
- * @throws If the decoded key is not Ed25519 or the raw bytes are malformed.
- */
-export function strandMemberKeyPair(memberPrivateKey: string): Ed25519KeyPair {
-  const privateKey = privateKeyFromProtobuf(uint8ArrayFromString(memberPrivateKey, 'base64'));
-  return ed25519KeyPairFromLibp2p(privateKey);
-}
+import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+import { ed25519KeyPairFromLibp2p, type Ed25519KeyPair } from './ed25519-key.js';
+
+/**
+ * Mint a fresh ed25519 strand member private key, encoded as base64 protobuf.
+ *
+ * Closed strands (`Type:'c'`) gate membership on a `MemberPrivateKey` column
+ * (see the `Strand` control-schema table). This produces one in the SAME
+ * encoding {@link StrandSolicitationService.formStrand} uses for its
+ * `invitePrivateKey`, so a host-minted key and a formation-issued key are
+ * interchangeable when attaching a closed strand.
+ */
+export async function generateStrandMemberKey(): Promise<string> {
+  const privateKey = await generateKeyPair('Ed25519');
+  return uint8ArrayToString(privateKeyToProtobuf(privateKey), 'base64');
+}
+
+/**
+ * Bridge a strand's `MemberPrivateKey` (base64 protobuf libp2p ed25519 key, as
+ * minted by {@link generateStrandMemberKey} or issued by formation) into the
+ * base64url keypair the strand RBAC constraints consume.
+ *
+ * The `Strand` control-layer `MemberPrivateKey` is the closed-strand read-gating
+ * secret; the founding `Member.Key`/`Manager.MemberKey` (the strand RBAC layer)
+ * are *derived from it* — they are the `publicKeyB64` of the keypair this returns.
+ * Decode the protobuf to a libp2p private key, then reuse
+ * {@link ed25519KeyPairFromLibp2p} so the same seed→public derivation used for node
+ * owner keys yields a stable `{ privateKeyB64, publicKeyB64 }` whose public
+ * key a later strand signature verifies against.
+ *
+ * @param memberPrivateKey - The strand's `MemberPrivateKey` (base64 protobuf).
+ * @returns The base64url seed/public-key pair for founding membership/manager.
+ * @throws If the decoded key is not Ed25519 or the raw bytes are malformed.
+ */
+export function strandMemberKeyPair(memberPrivateKey: string): Ed25519KeyPair {
+  const privateKey = privateKeyFromProtobuf(uint8ArrayFromString(memberPrivateKey, 'base64'));
+  return ed25519KeyPairFromLibp2p(privateKey);
+}