@serfab/cadre-core 1.13.0 → 1.15.0

package/dist/claim-proof.d.ts

@@ -0,0 +1,45 @@
+import type { SeedRefusalCode } from './types.js';
+/** Length of a claim secret: 256 bits, so guessing one is infeasible. */
+export declare const CLAIM_SECRET_BYTES = 32;
+/**
+ * Thrown by `CadreNode.claimNode` when the node answered the claim seed with a refusal.
+ * Distinct from `PeerUnreachableError` (no connection to the node formed) and from a
+ * failure after the node was reached (thrown by `deliverSeed` as is): here the node was
+ * reached and said no. `code` is the node's machine-readable cause
+ * when its policy supplied one (`already-claimed`, `claim-proof-invalid`, ...), so a
+ * phone can tell "someone else owns it" from "wrong secret" without parsing `reason`.
+ */
+export declare class ClaimRefusedError extends Error {
+    readonly nodePeerId: string;
+    readonly reason: string;
+    readonly code?: SeedRefusalCode | undefined;
+    constructor(nodePeerId: string, reason: string, code?: SeedRefusalCode | undefined);
+}
+/**
+ * Decode a claim secret from the base64url text the host shows and the phone scans.
+ *
+ * Refuses anything that is not base64url of exactly {@link CLAIM_SECRET_BYTES} bytes,
+ * naming the problem. The rejected value is never echoed: unlike a public key, a
+ * mistyped secret may still be a secret.
+ *
+ * @returns The 32 secret bytes.
+ */
+export declare function parseClaimSecret(text: string): Uint8Array;
+/**
+ * Compute the claim proof the owner side sends beside its seed.
+ *
+ * @param secret - The parsed 32-byte claim secret ({@link parseClaimSecret}).
+ * @param nodePeerId - The peer id of the node being claimed.
+ * @param signerKey - The owner key that signed the seed (base64url).
+ * @param seedDigest - The seed's signature digest (`seedDigest()` in `seed-bootstrap.ts`).
+ * @returns The proof, base64url.
+ */
+export declare function claimProof(secret: Uint8Array, nodePeerId: string, signerKey: string, seedDigest: string): string;
+/**
+ * Check a presented proof against the receiver's own view of the three bound fields.
+ *
+ * Recomputes the tag and compares in constant time. A proof that does not decode as
+ * base64url is simply invalid. `nodePeerId` must be the RECEIVER's own peer id, never
+ * one the sender supplied; that is what makes a captured proof useless elsewhere.
+ */
+export declare function verifyClaimProof(secret: Uint8Array, nodePeerId: string, signerKey: string, seedDigest: string, proof: string): boolean;

package/dist/claim-proof.js

@@ -0,0 +1,132 @@
+/**
+ * Claim proof: how the first seed delivered to a brand-new node proves that its sender
+ * holds the node's one-time claim secret.
+ *
+ * A node that belongs to nobody yet (a cadre-host child before its owner scans the QR
+ * code) has an empty trusted-owner anchor, so every seed trust policy refuses its first
+ * seed. The claim secret is the out-of-band channel that breaks the deadlock: the host
+ * mints 32 random bytes, shows them beside the node's addresses, and the owner's phone
+ * proves possession by sending, next to the seed, an HMAC keyed by those bytes.
+ *
+ * The proof is `base64url(HMAC-SHA256(secret, utf8(canonicalJson(payload))))` where
+ * `payload` is `{ purpose: 'sereus-node-claim', v: 1, nodePeerId, signerKey, seedDigest }`:
+ *
+ *  - `nodePeerId` binds the proof to one node, so a captured proof cannot claim another
+ *    node minted with the same secret;
+ *  - `signerKey` binds it to one owner, so it cannot anchor a different key;
+ *  - `seedDigest` (the same digest the seed signature covers, `seedDigest()` in
+ *    `seed-bootstrap.ts`) binds it to one seed, so it cannot be reattached to another.
+ *
+ * A passive observer of one delivery therefore learns a proof that is useless anywhere
+ * else, and useless on this node once it is claimed. A keyed MAC is the standard way to
+ * prove possession of a secret without revealing it; the crypto plugin's framed
+ * `digest([...])` helper is not specified as one, so the secret is never fed to it.
+ *
+ * Verified by `claimSecretTrustPolicy` (`seed-trust-policy.ts`). Imports only
+ * `@noble/hashes`, `uint8arrays` and `canonical-json.ts`: this module loads on React
+ * Native and in the browser as well as Node.
+ */
+import debug from 'debug';
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+import { canonicalJson } from './canonical-json.js';
+const log = debug('sereus:cadre:claim-proof');
+/** Length of a claim secret: 256 bits, so guessing one is infeasible. */
+export const CLAIM_SECRET_BYTES = 32;
+/**
+ * Thrown by `CadreNode.claimNode` when the node answered the claim seed with a refusal.
+ * Distinct from `PeerUnreachableError` (no connection to the node formed) and from a
+ * failure after the node was reached (thrown by `deliverSeed` as is): here the node was
+ * reached and said no. `code` is the node's machine-readable cause
+ * when its policy supplied one (`already-claimed`, `claim-proof-invalid`, ...), so a
+ * phone can tell "someone else owns it" from "wrong secret" without parsing `reason`.
+ */
+export class ClaimRefusedError extends Error {
+    constructor(nodePeerId, reason, code) {
+        super(`Node ${nodePeerId} refused the claim${code ? ` (${code})` : ''}: ${reason}`);
+        this.nodePeerId = nodePeerId;
+        this.reason = reason;
+        this.code = code;
+        this.name = 'ClaimRefusedError';
+    }
+}
+/**
+ * Decode a claim secret from the base64url text the host shows and the phone scans.
+ *
+ * Refuses anything that is not base64url of exactly {@link CLAIM_SECRET_BYTES} bytes,
+ * naming the problem. The rejected value is never echoed: unlike a public key, a
+ * mistyped secret may still be a secret.
+ *
+ * @returns The 32 secret bytes.
+ */
+export function parseClaimSecret(text) {
+    const trimmed = text.trim();
+    if (trimmed.length === 0) {
+        throw new Error('A claim secret is required (received an empty or whitespace-only value)');
+    }
+    let decoded;
+    try {
+        decoded = uint8ArrayFromString(trimmed, 'base64url');
+    }
+    catch (error) {
+        throw new Error('A claim secret must be base64url text (the value could not be decoded as base64url)', { cause: error });
+    }
+    if (decoded.length !== CLAIM_SECRET_BYTES) {
+        throw new Error(`A claim secret must decode to exactly ${CLAIM_SECRET_BYTES} bytes (the value decoded to ${decoded.length})`);
+    }
+    return decoded;
+}
+/** The HMAC tag bytes over the canonical claim payload (see the module doc). */
+function claimProofBytes(secret, nodePeerId, signerKey, seedDigest) {
+    const payload = canonicalJson({ purpose: 'sereus-node-claim', v: 1, nodePeerId, signerKey, seedDigest });
+    return hmac(sha256, secret, new TextEncoder().encode(payload));
+}
+/**
+ * Compute the claim proof the owner side sends beside its seed.
+ *
+ * @param secret - The parsed 32-byte claim secret ({@link parseClaimSecret}).
+ * @param nodePeerId - The peer id of the node being claimed.
+ * @param signerKey - The owner key that signed the seed (base64url).
+ * @param seedDigest - The seed's signature digest (`seedDigest()` in `seed-bootstrap.ts`).
+ * @returns The proof, base64url.
+ */
+export function claimProof(secret, nodePeerId, signerKey, seedDigest) {
+    return uint8ArrayToString(claimProofBytes(secret, nodePeerId, signerKey, seedDigest), 'base64url');
+}
+/**
+ * Check a presented proof against the receiver's own view of the three bound fields.
+ *
+ * Recomputes the tag and compares in constant time. A proof that does not decode as
+ * base64url is simply invalid. `nodePeerId` must be the RECEIVER's own peer id, never
+ * one the sender supplied; that is what makes a captured proof useless elsewhere.
+ */
+export function verifyClaimProof(secret, nodePeerId, signerKey, seedDigest, proof) {
+    let presented;
+    try {
+        presented = uint8ArrayFromString(proof, 'base64url');
+    }
+    catch (error) {
+        log('claim proof is not base64url: %o', error);
+        return false;
+    }
+    return constantTimeEqual(presented, claimProofBytes(secret, nodePeerId, signerKey, seedDigest));
+}
+/**
+ * Byte equality whose running time does not depend on WHERE the arrays differ, so a
+ * remote cannot learn a valid proof prefix from response timing. The length check
+ * short-circuits, which leaks nothing: a valid proof's length is public. A plain loop
+ * rather than `node:crypto`'s `timingSafeEqual` because this module must load on React
+ * Native and in the browser.
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=claim-proof.js.map

package/dist/claim-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-proof.js","sourceRoot":"","sources":["../src/claim-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC3C,YACU,UAAkB,EAClB,MAAc,EACd,IAAsB;QAE/B,KAAK,CAAC,QAAQ,UAAU,qBAAqB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ3E,eAAU,GAAV,UAAU,CAAQ;QAClB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAkB;QAG/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qFAAqF,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,kBAAkB,gCAAgC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAkB,EAAE,UAAkB,EAAE,SAAiB,EAAE,UAAkB;IACrG,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,UAAkB,EAAE,SAAiB,EAAE,UAAkB;IACvG,OAAO,kBAAkB,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAkB,EAClB,UAAkB,EAClB,SAAiB,EACjB,UAAkB,EAClB,KAAa;IAEb,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,iBAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACtD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/control-authorization.d.ts

@@ -6,14 +6,24 @@
  * byte layout cannot drift between them or away from the SQL constraints in
  * `schemas/control.qsql`.
  *
- * Every vector leads with two fixed literals:
+ * Every vector leads with two fixed literals and the party id:
  *
- *   digest(<domain>, <action>, <row field 1>, ..., <row field n>)
+ *   digest(<domain>, <action>, <party id>, <row field 1>, ..., <row field n>)
  *
- * so a signature verifies ONLY against the one rule it was minted for. Without
- * the tags, several rules built byte-identical tuples (e.g. `ValidationKey`
- * insert and `OwnerKey` insert both signed `digest(Key, StampId)`), so an
- * approval for a narrow grant doubled as an approval for full ownership.
+ * so a signature verifies ONLY against the one rule, in the one party, it was
+ * minted for. Without the tags, several rules built byte-identical tuples (e.g.
+ * `ValidationKey` insert and `OwnerKey` insert both signed `digest(Key, StampId)`),
+ * so an approval for a narrow grant doubled as an approval for full ownership.
+ * Without the party, two parties sharing an owner key (one node key owning two
+ * cadres, a hardware owner key) would accept each other's approvals. The SQL side
+ * reads the party from the node-local `party_id()` function `ControlDatabase`
+ * registers (never from a context value or a replicated table), and every
+ * TypeScript signer and verifier passes the party it is configured for.
+ *
+ * Two digests carry NO party ({@link UnboundControlDomain}): the `FormationUsage`
+ * `'consent'` and `'vouch'` digests, whose signers do not know the party (see the
+ * schema's `FormationUsage.Authorized` comment), and the offline `'Cadre.Enrollment'`
+ * vouch, which no table checks.
  *
  * This module deliberately has no Quereus / Optimystic / libp2p imports so the
  * lightweight verifiers (`peer-authorization.ts`, consumed by the offline
@@ -33,7 +43,7 @@
  * CHECK the `'reissue'`-tagged digest `ControlDatabase.reissueRevocations`
  * signs — and `countRows` counts it.
  */
-export declare const CONTROL_TABLES: readonly ["OwnerKey", "ValidationKey", "Strand", "StrandPartyKey", "JoinedStrand", "PendingJoin", "CadrePeer", "DeviceToken", "FormationInvite", "FormationUsage", "Revocation"];
+export declare const CONTROL_TABLES: readonly ["OwnerKey", "ValidationKey", "Strand", "StrandPartyKey", "JoinedStrand", "JoinRequest", "JoinSuccess", "JoinFailure", "CadrePeer", "DeviceToken", "FormationInvite", "FormationUsage", "CadreInvite", "CadreInviteUsage", "Revocation"];
 /**
  * Name of a CadreControl table. Doubles as the table half of a
  * {@link ControlDomain} tag.
@@ -47,11 +57,17 @@ export type ControlTable = typeof CONTROL_TABLES[number];
  * {@link ControlTable} rather than a fresh literal list, so a renamed table is a
  * compile error here instead of a silently dead branch.
  *
+ * `CadreInvite` is the one member whose rows are never deleted: its tombstone is a
+ * withdrawal over a row that stays (`NotRevoked` refuses re-seating the withdrawn
+ * row; there is no `RevocationRecorded`, since nothing is ever removed), so it is
+ * revocable without being removable — `control-database.ts`'s `RemovableTable`
+ * excludes it.
+ *
  * Lives in this import-free module rather than beside its main consumer
  * (`control-database.ts`) so the lightweight signers — `peer-authorization.ts`'s
  * `revocationDigest` — can type against it without pulling in the runtime.
  */
-export type RevocableTable = Extract<ControlTable, 'OwnerKey' | 'CadrePeer' | 'ValidationKey' | 'Strand' | 'StrandPartyKey' | 'JoinedStrand' | 'PendingJoin' | 'DeviceToken'>;
+export type RevocableTable = Extract<ControlTable, 'OwnerKey' | 'CadrePeer' | 'ValidationKey' | 'Strand' | 'StrandPartyKey' | 'JoinedStrand' | 'JoinRequest' | 'DeviceToken' | 'CadreInvite'>;
 /**
  * What a signature authorizes, scoped to one table rule — or, for
  * `'Cadre.Enrollment'`, the offline peer vouch that `cadre enroll register`
@@ -59,6 +75,15 @@ export type RevocableTable = Extract<ControlTable, 'OwnerKey' | 'CadrePeer' | 'V
  * from every table rule).
  */
 export type ControlDomain = `CadreControl.${ControlTable}` | 'Cadre.Enrollment';
+/**
+ * The domains whose digests bind no party id — the only two
+ * {@link unboundAuthorizationFields} accepts. `FormationUsage`: neither signer knows
+ * the party, and the invitation token scopes the digest instead (the reason is at the
+ * schema's `FormationUsage.Authorized` comment). `Cadre.Enrollment`: no table checks it.
+ */
+export type UnboundControlDomain = 'CadreControl.FormationUsage' | 'Cadre.Enrollment';
+/** Every domain whose digests bind the party id — the only ones {@link controlAuthorizationFields} accepts. */
+export type BoundControlDomain = Exclude<ControlDomain, UnboundControlDomain>;
 /**
  * The action half of the tag:
  *  - `'add'` / `'remove'` — insert / delete of the named row.
@@ -72,22 +97,58 @@ export type ControlDomain = `CadreControl.${ControlTable}` | 'Cadre.Enrollment';
  *  - `'publish'` — a peer self-signs its OWN record (the `CadrePeer` /
  *    `DeviceToken` self-update branches), with its own key rather than an
  *    owner key.
- *  - `'consent'` — a peer self-signs its OWN `FormationUsage` redemption (the
- *    joiner proving it agreed to join), with its own key. Distinct from the
- *    approver's `'vouch'` over the same table so the two stored signatures are
- *    never interchangeable.
+ *  - `'consent'` — a peer self-signs its OWN `FormationUsage` or
+ *    `CadreInviteUsage` redemption (the joiner proving it agreed to join), with
+ *    its own key. Distinct from the approver's `'vouch'` over the same table so
+ *    the two stored signatures are never interchangeable.
+ *  - `'redeem'` — the holder of a `CadreInvite`'s private key proves possession
+ *    on a `CadreInviteUsage` row. Distinct from the device's `'consent'` over the
+ *    same fields: the two signatures are by different keys and neither may stand
+ *    in for the other.
  *  - `'reissue'` — an owner re-writes an existing `Revocation` tombstone,
  *    bumping its `ReissuedAt` counter so a tombstone committed while the node
  *    was alone can be re-broadcast. Distinct from `'remove'` so a tombstone
  *    append approval can never be replayed as a re-issue and vice versa.
  */
-export type ControlAction = 'add' | 'remove' | 'vouch' | 'publish' | 'consent' | 'reissue';
+export type ControlAction = 'add' | 'remove' | 'vouch' | 'publish' | 'consent' | 'redeem' | 'reissue';
+/**
+ * The `CadreInvite` columns its `'add'` signature binds, in the schema's order and
+ * with the row's stored forms: `expiresAt` is the engine-canonical `datetime` string
+ * (`canonicalDatetime`), never epoch ms, because the SQL side digests
+ * `cast(new.ExpiresAt as text)` after coercion. Structurally satisfied by a
+ * `CadreInviteRow` (`types.ts`), which adds the issuer pair the signature does not cover.
+ */
+export interface CadreInviteSignedFields {
+    key: string;
+    peerId: string | null;
+    grantsOwner: boolean;
+    expiresAt: string | null;
+    totalUses: number | null;
+    stampId: string;
+}
+/**
+ * The row-field half of a `CadreInvite` `'add'` digest, shared by the signer
+ * (`control-database.ts`'s `cadreInviteAddMessage`, raw bytes) and the verifier
+ * (`peer-authorization.ts`'s `cadreInviteAddDigest`, base64url) so the two cannot
+ * drift. SQL mirror, in `CadreInvite.AuthorizedInsert`:
+ * `new.Key, coalesce(new.PeerId, ''), cast(new.GrantsOwner as text),
+ * coalesce(cast(new.ExpiresAt as text), ''), coalesce(cast(new.TotalUses as text), ''), new.StampId`.
+ */
+export declare function cadreInviteRowFields(row: CadreInviteSignedFields): string[];
+/**
+ * The full ordered field vector a party-bound control-plane signature covers. Digest
+ * this with the crypto plugin's injective multi-field encoding (every field TEXT);
+ * the SQL mirror passes the same literals as leading `digest(...)` arguments and
+ * reads the party from its node-local `party_id()`:
+ *
+ *   TS:  digest(controlAuthorizationFields('CadreControl.X', 'add', partyId, [a, b]), 'sha256', ...)
+ *   SQL: digest('CadreControl.X', 'add', party_id(), new.A, new.B)
+ */
+export declare function controlAuthorizationFields(domain: BoundControlDomain, action: ControlAction, partyId: string, rowFields: string[]): string[];
 /**
- * The full ordered field vector a control-plane signature covers. Digest this
- * with the crypto plugin's injective multi-field encoding (every field TEXT);
- * the SQL mirror passes the same literals as leading `digest(...)` arguments:
+ * The field vector of the two party-free digests ({@link UnboundControlDomain}):
  *
- *   TS:  digest(controlAuthorizationFields('CadreControl.X', 'add', [a, b]), 'sha256', ...)
- *   SQL: digest('CadreControl.X', 'add', new.A, new.B)
+ *   TS:  digest(unboundAuthorizationFields('CadreControl.FormationUsage', 'consent', [a, b]), 'sha256', ...)
+ *   SQL: digest('CadreControl.FormationUsage', 'consent', new.A, new.B)
  */
-export declare function controlAuthorizationFields(domain: ControlDomain, action: ControlAction, rowFields: string[]): string[];
+export declare function unboundAuthorizationFields(domain: UnboundControlDomain, action: ControlAction, rowFields: string[]): string[];

package/dist/control-authorization.js

@@ -6,14 +6,24 @@
  * byte layout cannot drift between them or away from the SQL constraints in
  * `schemas/control.qsql`.
  *
- * Every vector leads with two fixed literals:
+ * Every vector leads with two fixed literals and the party id:
  *
- *   digest(<domain>, <action>, <row field 1>, ..., <row field n>)
+ *   digest(<domain>, <action>, <party id>, <row field 1>, ..., <row field n>)
  *
- * so a signature verifies ONLY against the one rule it was minted for. Without
- * the tags, several rules built byte-identical tuples (e.g. `ValidationKey`
- * insert and `OwnerKey` insert both signed `digest(Key, StampId)`), so an
- * approval for a narrow grant doubled as an approval for full ownership.
+ * so a signature verifies ONLY against the one rule, in the one party, it was
+ * minted for. Without the tags, several rules built byte-identical tuples (e.g.
+ * `ValidationKey` insert and `OwnerKey` insert both signed `digest(Key, StampId)`),
+ * so an approval for a narrow grant doubled as an approval for full ownership.
+ * Without the party, two parties sharing an owner key (one node key owning two
+ * cadres, a hardware owner key) would accept each other's approvals. The SQL side
+ * reads the party from the node-local `party_id()` function `ControlDatabase`
+ * registers (never from a context value or a replicated table), and every
+ * TypeScript signer and verifier passes the party it is configured for.
+ *
+ * Two digests carry NO party ({@link UnboundControlDomain}): the `FormationUsage`
+ * `'consent'` and `'vouch'` digests, whose signers do not know the party (see the
+ * schema's `FormationUsage.Authorized` comment), and the offline `'Cadre.Enrollment'`
+ * vouch, which no table checks.
  *
  * This module deliberately has no Quereus / Optimystic / libp2p imports so the
  * lightweight verifiers (`peer-authorization.ts`, consumed by the offline
@@ -39,22 +49,54 @@ export const CONTROL_TABLES = [
     'Strand',
     'StrandPartyKey',
     'JoinedStrand',
-    'PendingJoin',
+    'JoinRequest',
+    'JoinSuccess',
+    'JoinFailure',
     'CadrePeer',
     'DeviceToken',
     'FormationInvite',
     'FormationUsage',
+    'CadreInvite',
+    'CadreInviteUsage',
     'Revocation',
 ];
 /**
- * The full ordered field vector a control-plane signature covers. Digest this
- * with the crypto plugin's injective multi-field encoding (every field TEXT);
- * the SQL mirror passes the same literals as leading `digest(...)` arguments:
+ * The row-field half of a `CadreInvite` `'add'` digest, shared by the signer
+ * (`control-database.ts`'s `cadreInviteAddMessage`, raw bytes) and the verifier
+ * (`peer-authorization.ts`'s `cadreInviteAddDigest`, base64url) so the two cannot
+ * drift. SQL mirror, in `CadreInvite.AuthorizedInsert`:
+ * `new.Key, coalesce(new.PeerId, ''), cast(new.GrantsOwner as text),
+ * coalesce(cast(new.ExpiresAt as text), ''), coalesce(cast(new.TotalUses as text), ''), new.StampId`.
+ */
+export function cadreInviteRowFields(row) {
+    return [
+        row.key,
+        row.peerId ?? '',
+        row.grantsOwner ? '1' : '0',
+        row.expiresAt ?? '',
+        row.totalUses === null ? '' : String(row.totalUses),
+        row.stampId,
+    ];
+}
+/**
+ * The full ordered field vector a party-bound control-plane signature covers. Digest
+ * this with the crypto plugin's injective multi-field encoding (every field TEXT);
+ * the SQL mirror passes the same literals as leading `digest(...)` arguments and
+ * reads the party from its node-local `party_id()`:
+ *
+ *   TS:  digest(controlAuthorizationFields('CadreControl.X', 'add', partyId, [a, b]), 'sha256', ...)
+ *   SQL: digest('CadreControl.X', 'add', party_id(), new.A, new.B)
+ */
+export function controlAuthorizationFields(domain, action, partyId, rowFields) {
+    return [domain, action, partyId, ...rowFields];
+}
+/**
+ * The field vector of the two party-free digests ({@link UnboundControlDomain}):
  *
- *   TS:  digest(controlAuthorizationFields('CadreControl.X', 'add', [a, b]), 'sha256', ...)
- *   SQL: digest('CadreControl.X', 'add', new.A, new.B)
+ *   TS:  digest(unboundAuthorizationFields('CadreControl.FormationUsage', 'consent', [a, b]), 'sha256', ...)
+ *   SQL: digest('CadreControl.FormationUsage', 'consent', new.A, new.B)
  */
-export function controlAuthorizationFields(domain, action, rowFields) {
+export function unboundAuthorizationFields(domain, action, rowFields) {
     return [domain, action, ...rowFields];
 }
 //# sourceMappingURL=control-authorization.js.map

package/dist/control-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-authorization.js","sourceRoot":"","sources":["../src/control-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,eAAe;IACf,QAAQ;IACR,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,YAAY;CACJ,CAAC;AAsDX;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAqB,EACrB,MAAqB,EACrB,SAAmB;IAEnB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"control-authorization.js","sourceRoot":"","sources":["../src/control-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,eAAe;IACf,QAAQ;IACR,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,YAAY;CACJ,CAAC;AA2FX;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAA4B;IAC/D,OAAO;QACL,GAAG,CAAC,GAAG;QACP,GAAG,CAAC,MAAM,IAAI,EAAE;QAChB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAC3B,GAAG,CAAC,SAAS,IAAI,EAAE;QACnB,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACnD,GAAG,CAAC,OAAO;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,MAAqB,EACrB,OAAe,EACf,SAAmB;IAEnB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA4B,EAC5B,MAAqB,EACrB,SAAmB;IAEnB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AACxC,CAAC"}

package/dist/control-cohort.js

@@ -20,7 +20,7 @@
  * correct, cheap, and matches what the convergence tests do by hand; for a large
  * party it bounds out-degree to `backbone + targetDegree`.
  */
-import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 /**
  * Default recurring cadence for {@link CadreNode.reconcileControlCohort} (ms).
  * In the same spirit as the 5s strand-watch poll but lighter, since a control

package/dist/control-cohort.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-cohort.js","sourceRoot":"","sources":["../src/control-cohort.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAM,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAkCtD,mFAAmF;AACnF,SAAS,QAAQ,CAAC,CAAgB,EAAE,CAAgB;IAClD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAyB,EACzB,SAA8B,EAC9B,YAAoB;IAEpB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEhC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC7B,cAAc,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"control-cohort.js","sourceRoot":"","sources":["../src/control-cohort.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAM,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAkCtD,mFAAmF;AACnF,SAAS,QAAQ,CAAC,CAAgB,EAAE,CAAgB;IAClD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAyB,EACzB,SAA8B,EAC9B,YAAoB;IAEpB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEhC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC7B,cAAc,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;KAC1C,CAAC;AACJ,CAAC"}