@serfab/cadre-core 1.13.0 → 1.14.0

package/dist/trusted-owner-store.js

@@ -6,9 +6,10 @@
  * row replicates into every peer's copy, so "is this key in `OwnerKey`?" can be
  * made true by a stranger. This store is the anchor that CAN be trusted — a
  * per-party, on-device record of owner keys established OUT OF BAND: founding
- * the party (genesis self-trust), the pinned keys carried by the `CadreInvite`
- * that enrolled this node, or an explicit operator pin. It is never written
- * from replicated control state; that is the whole point.
+ * the party (genesis self-trust), the pinned keys carried by the cadre invitation
+ * that enrolled this node, an explicit operator pin, or the claim of a brand-new
+ * node by whoever holds its one-time claim secret. It is never written from
+ * replicated control state; that is the whole point.
  *
  * Three implementations:
  *  - {@link MemoryTrustedOwnerStore} (this module, cross-platform) — ephemeral;
@@ -23,8 +24,16 @@
  *    `@serfab/cadre-core/trusted-owner-store-file` (same isolation pattern as
  *    `key-store-file`) so `node:fs` never lands in the RN/browser entry graph.
  *
- * Keys are additive: nothing in this interface removes a key (owner revocation
- * is out of scope here and tracked with the broader control-sync design).
+ * The anchor follows the replicated `OwnerKey` table along VERIFIABLE chains only
+ * (`CadreNode.syncOwnerAnchor`, `owner-anchor-sync.ts`): a key whose stored proof verifies
+ * against a key already anchored enters under source `chain`, and a key named by a
+ * tombstone whose stored signer is anchored leaves. The out-of-band entries are the base
+ * that derivation starts from; a replicated row can never seat itself here.
+ *
+ * Two callers remove keys: the claim-secret trust policy rolling back a claim whose
+ * persist failed (`claimSecretTrustPolicy` in `seed-trust-policy.ts`), and the anchor
+ * sync applying a verifiable `OwnerKey` tombstone or pruning a `chain` entry whose row
+ * is gone. Nothing else removes a key.
  */
 import debug from 'debug';
 import { NodeLocalSnapshot } from './node-local-snapshot.js';
@@ -45,15 +54,35 @@ export class MemoryTrustedOwnerStore {
     all() {
         return new Set(this.keys.keys());
     }
+    sources() {
+        return new Map(this.keys);
+    }
     async trust(ownerKey, source) {
-        if (this.keys.has(ownerKey)) {
+        if (!provenanceChanges(this.keys.get(ownerKey), source)) {
             return;
         }
         this.keys.set(ownerKey, source);
         log('trusted owner key anchored (party=%s, source=%s)', this.partyId, source);
     }
+    async remove(ownerKey) {
+        if (this.keys.delete(ownerKey)) {
+            log('trusted owner key removed (party=%s)', this.partyId);
+        }
+    }
+}
+/**
+ * Does `trust(key, source)` write, given the key's current provenance (`undefined` when
+ * absent)? The one rule both backends share (see {@link TrustedOwnerStore.trust}): an absent
+ * key always lands; a `chain` entry is promoted by any out-of-band source; everything else
+ * keeps its original provenance.
+ */
+function provenanceChanges(current, source) {
+    return current === undefined || (current === 'chain' && source !== 'chain');
 }
-const KNOWN_SOURCES = new Set(['genesis', 'invite', 'operator']);
+// Every TrustSource must be listed: under the discard-all policy below, one entry with a
+// source this set does not know discards the WHOLE anchor on reload, so a node whose only
+// owner was anchored by a claim would silently come back unclaimed.
+const KNOWN_SOURCES = new Set(['genesis', 'invite', 'operator', 'claim', 'chain']);
 /**
  * What the anchor persists: `owners` maps ownerKey (base64url) -> provenance.
  *
@@ -104,12 +133,15 @@ export class PersistentTrustedOwnerStore {
     all() {
         return this.snapshot.keySnapshot();
     }
+    sources() {
+        return new Map(Array.from(this.snapshot.entrySnapshot(), ([key, entry]) => [key, entry.source]));
+    }
     /**
      * Anchor a key: visible via {@link has} / {@link all} synchronously, then the
      * full snapshot is persisted (see `NodeLocalSnapshot.put`).
      */
     trust(ownerKey, source) {
-        if (this.snapshot.has(ownerKey)) {
+        if (!provenanceChanges(this.snapshot.get(ownerKey)?.source, source)) {
             // Idempotent: re-enrollment / restart re-seeding keeps the original
             // provenance and skips the write entirely.
             // NOTE: this resolves immediately rather than joining the write chain, so
@@ -122,5 +154,15 @@ export class PersistentTrustedOwnerStore {
         log('trusted owner key anchored (party=%s, source=%s); persisting', this.partyId, source);
         return this.snapshot.put(ownerKey, { source, trustedAt: Date.now() });
     }
+    /**
+     * Drop a key: gone from {@link has} / {@link all} synchronously, then the full
+     * snapshot is persisted (see `NodeLocalSnapshot.remove`).
+     */
+    remove(ownerKey) {
+        if (this.snapshot.has(ownerKey)) {
+            log('trusted owner key removed (party=%s); persisting', this.partyId);
+        }
+        return this.snapshot.remove(ownerKey);
+    }
 }
 //# sourceMappingURL=trusted-owner-store.js.map

package/dist/trusted-owner-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-owner-store.js","sourceRoot":"","sources":["../src/trusted-owner-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAgD,MAAM,0BAA0B,CAAC;AAE3G,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AAiCtD;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAGnC,YAAqB,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAFnB,SAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhB,CAAC;IAExC,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,GAAG;QACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,MAAmB;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,kDAAkD,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;CACD;AAQD,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEnG;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAA6C;IACxE,KAAK,EAAE,sBAAsB;IAC7B,UAAU,EAAE,QAAQ;IACpB,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAkD,CAAC;QACjF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,MAAqB,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;CACD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA2B;IACvC,YAAqC,QAA8C;QAA9C,aAAQ,GAAR,QAAQ,CAAsC;IAAG,CAAC;IAEvF,2DAA2D;IAC3D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,OAAe;QACnD,OAAO,IAAI,2BAA2B,CACrC,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,CAAC,CACnE,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,GAAG;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAgB,EAAE,MAAmB;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,oEAAoE;YACpE,2CAA2C;YAC3C,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,iEAAiE;YACjE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,8DAA8D,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACD"}
+{"version":3,"file":"trusted-owner-store.js","sourceRoot":"","sources":["../src/trusted-owner-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAgD,MAAM,0BAA0B,CAAC;AAE3G,MAAM,GAAG,GAAG,KAAK,CAAC,kCAAkC,CAAC,CAAC;AAyDtD;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAGnC,YAAqB,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAFnB,SAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhB,CAAC;IAExC,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,GAAG;QACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;QACN,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,MAAmB;QAChD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO;QACR,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,kDAAkD,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;CACD;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,OAAgC,EAAE,MAAmB;IAC/E,OAAO,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;AAC7E,CAAC;AAQD,yFAAyF;AACzF,0FAA0F;AAC1F,oEAAoE;AACpE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAErH;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAA6C;IACxE,KAAK,EAAE,sBAAsB;IAC7B,UAAU,EAAE,QAAQ;IACpB,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAkD,CAAC;QACjF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,MAAqB,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;CACD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA2B;IACvC,YAAqC,QAA8C;QAA9C,aAAQ,GAAR,QAAQ,CAAsC;IAAG,CAAC;IAEvF,2DAA2D;IAC3D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,OAAe;QACnD,OAAO,IAAI,2BAA2B,CACrC,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,CAAC,CACnE,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,GAAG;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACN,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAgB,EAAE,MAAmB;QAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACrE,oEAAoE;YACpE,2CAA2C;YAC3C,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,iEAAiE;YACjE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,8DAA8D,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,QAAgB;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,kDAAkD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;CACD"}