@serfab/cadre-core 1.14.0 → 1.15.0

package/src/index.ts

@@ -1,722 +1,789 @@
-// Core types
-export * from './types.js';
-
-// Canonical JSON serialization (shared signing payload format)
-export { canonicalJson } from './canonical-json.js';
-
-// Main CadreNode class
-export { CadreNode, OWNER_INVITATION_DEFAULT_TTL_MS, CADRE_INVITATION_DEFAULT_TTL_MS } from './cadre-node.js';
-
-// Control database
-export { ControlDatabase, MissingHostStrandError, InvitationExhaustedError, CadreInviteIssuerUnknownError, buildAuthorizationMessage, registerPartyIdFunction, formationVouchMessage, formationConsentMessage, cadreInviteAddMessage, cadreInviteRedeemMessage, cadreInviteConsentMessage, projectSeedPeers, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef } from './control-database.js';
-
-// Bounded retry for transient control-write failures (classifier + loop behind
-// ControlDatabase.lockedWithRetry; exported so the integration package can drive the
-// classifier against real engine errors)
-export {
-  CONTROL_WRITE_ATTEMPTS,
-  CONTROL_WRITE_RETRY_BUDGET_MS,
-  SCHEMA_INIT_ATTEMPTS,
-  SCHEMA_INIT_RETRY_POLICY,
-  isRetriableControlWriteFailure,
-  isRetriableSchemaInitFailure,
-  retryControlWrite,
-  type ControlWriteRetryOptions
-} from './control-write-retry.js';
-
-// Bounded retry for transient control-read failures (classifier + policy behind
-// ControlDatabase.readRows; the loop is shared with the write side via control-retry.ts)
-export {
-  CONTROL_READ_ATTEMPTS,
-  CONTROL_READ_RETRY_DELAYS_MS,
-  CONTROL_READ_RETRY_BUDGET_MS,
-  isRetriableControlReadFailure,
-  retryControlRead,
-  type ControlReadRetryOptions
-} from './control-read-retry.js';
-
-// The bounded retry loop both control policies share. Only the abandonment record leaves
-// this package: it is the payload of the `control:write-abandoned` node event, so an
-// embedding app can type a handler for it.
-export type {
-  ControlRetryAbandonment,
-  ControlRetryAbandonReason,
-  ControlRetryAbandonListener
-} from './control-retry.js';
-
-// Control-plane authorization field vector (the domain/action tagging every signer shares)
-export { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, type ControlDomain, type BoundControlDomain, type UnboundControlDomain, type ControlAction, type CadreInviteSignedFields } from './control-authorization.js';
-
-// Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
-export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
-
-// Pluggable key store (backend-agnostic identity/owner key material seam).
-// Dependency-free: the interface, error, default slot id, and in-memory backend
-// are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
-// separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
-// import never lands here.
-export {
-  InMemoryKeyStore,
-  KeyStoreAccessError,
-  DEFAULT_IDENTITY_KEY_ID,
-  type KeyStore,
-  type KeyId
-} from './key-store.js';
-
-// The KeyStore-backed identity rule, shared with embedding apps that need the
-// node key BEFORE `CadreNode` exists.
-export { loadOrCreateIdentityKey } from './identity-key.js';
-
-// Node-local trusted-owner anchor: the NON-replicated, per-party record of
-// out-of-band-established owner keys (the trust anchor the replicated OwnerKey
-// table cannot be). Cross-platform: interface + in-memory store only — the
-// file-backed store is the Node-only subpath
-// '@serfab/cadre-core/trusted-owner-store-file' (same isolation as
-// key-store-file) so node:fs never lands in this graph.
-export {
-  MemoryTrustedOwnerStore,
-  PersistentTrustedOwnerStore,
-  type TrustedOwnerStore,
-  type TrustSource
-} from './trusted-owner-store.js';
-
-// The one platform-specific piece of a persistent node-local store: a single
-// durable text slot the embedding app supplies (IndexedDB / SecureStore /
-// SQLite / a file). Everything else — envelope, load policy, snapshot write
-// chain — is cross-platform in node-local-snapshot.ts.
-export type { DurableSlot } from './node-local-snapshot.js';
-
-// Node-local cold-start bootstrap-peer store: the dial targets retained from an
-// applied seed so a node that could not connect on its first try keeps retrying
-// across restarts. Same cross-platform split as the trusted-owner anchor above —
-// interface + in-memory store here, Node-only file backend behind the subpath
-// '@serfab/cadre-core/bootstrap-peer-store-file'.
-export {
-  MemoryBootstrapPeerStore,
-  PersistentBootstrapPeerStore,
-  type BootstrapPeerStore,
-  type BootstrapPeerEntry
-} from './bootstrap-peer-store.js';
-
-// Node-local enrolled-machine count: the machines this party had enrolled the
-// last time this node looked, remembered across restarts so the CONTROL node can
-// declare a block-repair yardstick at bring-up — which is before the database
-// holding the membership rows exists. Same cross-platform split as the two
-// records above; Node-only file backend behind the subpath
-// '@serfab/cadre-core/enrolled-machine-store-file'. Its load policy deliberately
-// DIVERGES from theirs (an unreadable slot cold-starts rather than throwing) —
-// see the module comment before unifying the three.
-export {
-  MemoryEnrolledMachineStore,
-  PersistentEnrolledMachineStore,
-  type EnrolledMachineStore
-} from './enrolled-machine-store.js';
-
-// Node-local record of the strands this node joined from ANOTHER party and has not yet
-// published party-wide, re-offered on every start as `strand:discovered`.
-// Cross-platform: its durable form rides the KeyStore seam above (the record carries a
-// closed strand's read secret), so there is no file-backed subpath.
-export {
-  MemoryJoinedStrandStore,
-  KeyStoreJoinedStrandStore,
-  type JoinedStrandStore,
-  type JoinedStrandRecord
-} from './joined-strand-store.js';
-
-// Node-local strand network state: per strand, the state Optimystic's db-p2p saves for
-// the strand node (its FRET routing table with each peer's signed address record), so a
-// restarted strand node re-imports the peers it was talking to. Same cross-platform
-// split as the bootstrap-peer store above — interface + in-memory + slot-backed stores
-// here, Node-only file backend behind '@serfab/cadre-core/strand-network-state-file'.
-export {
-  MemoryStrandNetworkStateStore,
-  PersistentStrandNetworkStateStore,
-  strandNetworkStatePersistence,
-  type StrandNetworkStateStore
-} from './strand-network-state.js';
-// The signed address records a running strand node's FRET table holds, as per-peer dial
-// addresses: what the periodic refresh re-merges into the node's address book, and a
-// diagnostic for "whom could this strand node redial right now?".
-export { strandFretPeerAddrs, type FretAddrHost, type FretPeerAddrs } from './strand-fret-addrs.js';
-
-// Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
-// strand's key is its strand id; the control database's key carries the party id,
-// so two parties on one device never share a control store. Every key stays within
-// `[a-z0-9._-]` — lowercase, so distinct keys stay distinct on a case-insensitive
-// filesystem: the control key by lowercase hex encoding, a strand's by
-// `assertStrandScopeKey`, which every strand launch runs.
-export {
-  controlStorageScope,
-  isControlStorageScope,
-  isValidStrandScopeKey,
-  assertStrandScopeKey,
-  InvalidStrandIdError
-} from './storage-scope.js';
-
-// Strand database
-export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
-
-// Strand management
-export {
-  StrandWatcher,
-  type StrandWatcherCallbacks,
-  type StrandQueryable,
-  type SAppIdLookup,
-  type StrandRowWithApp
-} from './strand-watcher.js';
-export {
-  StrandInstanceManager,
-  type StartStrandConfig,
-  type ResumeStrandOverrides,
-  getStrandStoragePath,
-  isAwaitingFirstSync,
-  liveStrandStatus
-} from './strand-instance-manager.js';
-
-// The joining machine's first-sync write gate: a non-founder launch withholds its
-// database (status 'syncing') until the strand's Header has arrived from a peer, so a
-// write before the first sync can never fork the strand's tables.
-export {
-  StrandAwaitingFirstSyncError,
-  DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS,
-  DEFAULT_STRAND_FIRST_SYNC_POLL_MS,
-  strandHeaderHeld,
-  appTablesReadable,
-  strandFirstSyncComplete,
-  type StrandFirstSyncConfig
-} from './strand-first-sync-gate.js';
-
-// Peer-join block catch-up (push this network's own blocks to each newly
-// connected peer, so a late joiner physically holds pre-join blocks). Shared
-// by the strand networks (ungated) and the control network (membership-gated).
-export {
-  PeerJoinBackfill,
-  DEFAULT_PEER_JOIN_BACKFILL,
-  MAX_BLOCK_MESSAGE_BYTES,
-  PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES,
-  type PeerJoinBackfillConfig,
-  type PeerJoinBackfillDeps,
-  type PeerJoinBackfillResult,
-  type PeerJoinBackfillPushClient
-} from './peer-join-backfill.js';
-
-// Operator opt-in to Optimystic change notifications on chosen strand nodes
-// (`CadreNodeConfig.strandReactivity`).
-export { strandCohortTopicOption, type StrandReactivityConfig } from './strand-reactivity.js';
-
-// Closed-strand revoked-peer enforcement (deny the network nodes of removed
-// members at the stream and connection layers, and hang up the sessions they
-// already hold — see the module doc for the settled deny-list design, the
-// teardown seam, and the fail directions).
-export {
-  StrandRevocationEnforcer,
-  createRevocationConnectionGater,
-  readStrandRevocationRows,
-  DEFAULT_REVOCATION_POLL_INTERVAL_MS,
-  type StrandRevocationEnforcementConfig,
-  type StrandRevocationEnforcerDeps,
-  type StrandRevocationRows,
-  type StrandMemberPeerBinding,
-  type StrandRevocationJudge,
-  type StrandRevocationNetwork,
-  type RevocationRefreshScheduler
-} from './strand-revocation-enforcer.js';
-
-// Closed-strand membership reconciliation: the bring-up loop that finishes a
-// party's join on every machine — redeem the staged formation invitation, then
-// write the durable machine→party MemberPeer binding — without ever blocking
-// bring-up (see the module doc for the pass ladder and terminal states).
-export {
-  StrandMembershipReconciler,
-  IDLE_PASSES_BEFORE_ESCALATION,
-  INITIAL_JOIN_RETRY_INTERVAL_MS,
-  type StrandMembershipReconcilerDeps,
-  type StrandMembershipReconciliationConfig,
-  type PendingMembershipInviteSource
-} from './strand-membership-reconciler.js';
-
-// The timer seam the self-rescheduling strand bring-up loops share (first-sync gate
-// probe loop, membership retry ladder) — injected by tests as a hand-cranked clock.
-export { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
-
-// Hibernation
-export {
-  HibernationManager,
-  type HibernationCallbacks
-} from './hibernation-manager.js';
-
-// Arachnode (stub)
-export {
-  ArachnodeStub,
-  createArachnodeStub,
-  type RingConfig
-} from './arachnode-stub.js';
-
-// Enrollment
-export {
-  EnrollmentService,
-  type MemberVerifier,
-  type MemberRegistry
-} from './enrollment.js';
-
-// Strand Solicitation
-export {
-  StrandSolicitationService,
-  createDefaultFormationResponseValidator,
-  type DisclosureValidator,
-  type FormationUsageRecorder,
-  type FormationUsageParams,
-  type AuthorizedFormationUsage,
-  type ResolvedHostStrand,
-  type StrandProvisioner,
-  type FormationResponseValidator,
-  type StrandSolicitationServiceOptions
-} from './strand-solicitation.js';
-
-// Formation approval client: asks an invite's ValidationUrl hook whether ONE redemption
-// may proceed, and checks the answer against the bytes the control database will verify.
-export {
-  createHttpFormationApprover,
-  signFormationApproval,
-  verifyFormationApproval,
-  FormationApprovalError,
-  type FormationApprovalRequest,
-  type FormationVouchFields,
-  type FormationApproval,
-  type FormationApprover,
-  type FormationApprovalFailure
-} from './formation-approval.js';
-
-// DB-backed FormationUsageRecorder (reads/writes the real CadreControl tables)
-export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
-
-// Closed-strand member key generation (ed25519 protobuf, base64) + the
-// protobuf->base64url bridge that derives the founding Member/Manager key.
-export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-
-// Strand membership writer (founder bootstrap, invite issuance/consumption,
-// manager-admit, member-peer registration, manager rotation, sealing — the sole
-// manager permanently freezing admission — + shared signing primitives reused
-// across the flows).
-export {
-  signStrandPayload,
-  verifyStrandPayload,
-  signStrandApproval,
-  generateStrandStampId,
-  bootstrapFounderMembership,
-  PreSplitStrandIdentityError,
-  issueInvite,
-  consumeInvite,
-  burnInvite,
-  isStrandMember,
-  cancelInvite,
-  listOutstandingInvites,
-  addMemberByManager,
-  revokeMember,
-  leaveStrand,
-  registerMemberPeer,
-  listMemberPeers,
-  removeMemberPeer,
-  addManager,
-  admitManager,
-  removeManager,
-  sealStrand,
-  isStrandSealed,
-  StrandTransactionBusyError,
-  STRAND_ENGINE,
-  STRAND_ENGINE_VERSION,
-  type FounderBootstrapParams,
-  type IssueInviteParams,
-  type IssuedInvite,
-  type ConsumeInviteParams,
-  type CancelInviteParams,
-  type OutstandingInvite,
-  type AddMemberByManagerParams,
-  type RevokeMemberParams,
-  type LeaveStrandParams,
-  type RegisterMemberPeerParams,
-  type RemoveOwnPeerParams,
-  type RemoveMemberPeerByManagerParams,
-  type RemoveMemberPeerParams,
-  type AddManagerParams,
-  type AdmitManagerParams,
-  type RemoveManagerParams,
-  type SealStrandParams,
-  type StrandWriteOptions
-} from './strand-membership-writer.js';
-
-// Engine-canonical datetime helper (shared by control + strand signed-write flows
-// so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
-export { canonicalDatetime } from './canonical-datetime.js';
-
-// Strand-DB-backed EnrollmentService backing: concrete MemberRegistry +
-// MemberVerifier that write/read the real Strand.* membership tables.
-export {
-  StrandMemberRegistry,
-  StrandMemberVerifier,
-  memberRegistrationPayload,
-  type StrandAdmission
-} from './strand-member-registry.js';
-
-// Seed Bootstrap
-export {
-  SeedBootstrapService,
-  SEED_PROTOCOL,
-  mergeSeedPeers,
-  seedDigest,
-  type SeedBootstrapConfig,
-  type SeedEventCallbacks
-} from './seed-bootstrap.js';
-
-// Peer Authorization (shared owner-signature digest + offline verifier)
-export {
-  peerAuthorizationDigest,
-  cadrePeerVoucherDigest,
-  cadrePeerRemoveDigest,
-  deviceTokenAddDigest,
-  deviceTokenRemoveDigest,
-  formationConsentDigest,
-  cadreInviteAddDigest,
-  cadreInviteRedeemDigest,
-  cadreInviteConsentDigest,
-  ownerKeyAddDigest,
-  verifyPeerAuthorization,
-  verifyCadrePeerVoucher,
-  verifyOwnerKeyVoucher,
-  verifyRevocationSigner,
-  verifyFormationConsent,
-  verifyInvitationAdmission,
-  verifyInvitationOwnerAdmission,
-  verifyCadreInviteRow,
-  verifyCadreInviteRedemption,
-  type DeviceTokenAuthorizedRow
-} from './peer-authorization.js';
-
-// How the trusted-owner anchor follows the replicated OwnerKey table along verifiable
-// chains: the pure derivation rule `CadreNode.syncOwnerAnchor` applies on every membership
-// refresh (owner-anchor-sync.ts).
-export { deriveOwnerAnchor, type OwnerAnchorInputs, type OwnerAnchorDerivation } from './owner-anchor-sync.js';
-
-// Strand Wake (control-network push-wake protocol)
-export {
-  StrandWakeService,
-  dialWake,
-  WAKE_PROTOCOL,
-  DEFAULT_WAKE_DIAL_BUDGET_MS,
-  type StrandWakeServiceOptions,
-  type DialWakeOptions
-} from './strand-wake-protocol.js';
-
-// Strand Address (control-network strand-address RPC) — wire types come via
-// `export * from './types.js'` (StrandAddrRequest / StrandAddrResponse / StrandAddrStatus).
-export {
-  StrandAddrService,
-  collectStrandAddrs,
-  STRAND_ADDR_PROTOCOL,
-  type StrandAddrServiceOptions,
-  type StrandAddrPeer,
-  type CollectStrandAddrsOptions,
-  type StrandAddrOutcome,
-  type StrandAddrCollection
-} from './strand-addr-protocol.js';
-
-// Peer-address record (self-published, signed, freshness-stamped CadrePeer row)
-export {
-  peerRecordSignedPayload,
-  signPeerRecord,
-  verifyPeerRecordSignature,
-  isPeerRecordFresh,
-  isSignalingAddr,
-  orderSignalingFirst,
-  withTrailingPeerId,
-  currentMemberTrustPolicy,
-  DEFAULT_PEER_RECORD_MAX_AGE_MS,
-  DEFAULT_PEER_RECORD_HEARTBEAT_MS
-} from './peer-record.js';
-
-// Device-token record (self-published, signed FCM/APNs push token — CadrePeer sibling)
-export {
-  deviceTokenSignedPayload,
-  signDeviceTokenRecord,
-  verifyDeviceTokenSignature,
-  isPushPlatform
-} from './device-token.js';
-
-// Strand-wake payload contract (canonical; shared by the server sender + RN receiver)
-export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.js';
-
-// Platform push delivery — the cross-platform `PushNotifier` *contract* only.
-// The FCM/APNs implementations (node:http2/node:crypto) and the
-// `createPushNotifier` router that builds them live behind the Node-only subpath
-// `@serfab/cadre-core/push-node` (`push-node.ts`), never in this graph. A Node
-// host constructs a notifier from that subpath and injects the instance into
-// `CadreNodeConfig.push.notifier`. These re-exports are type-only (erased at
-// emit), so the RN/browser entry graph never pulls the Node modules in.
-export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
-
-// Push-credential validation + log redaction. Dependency-free (type-only imports),
-// so a provisioner (cadre-host / cadre-provider) can reject a partial credential
-// set and produce a key-safe log view without pulling the FCM/APNs sender graph.
-export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
-
-// Server-side push-wake trigger policy + fan-out (who/when to wake). Cross-platform
-// clean — it imports only the PushNotifier *type*, so exporting it as a runtime
-// value pulls no node:http2/node:crypto edge into the RN/browser graph.
-export {
-  PushFanoutService,
-  DEFAULT_PUSH_COOLDOWN_MS,
-  DEFAULT_PUSH_DEBOUNCE_MS,
-  type PushFanoutOptions,
-  type FanoutMember
-} from './push-fanout.js';
-
-// Control-cohort dial selection (backbone-preferential, bounded out-degree) +
-// the cadence/degree defaults the proactive reconcile routine reads.
-export {
-  selectControlCohortDials,
-  DEFAULT_CONTROL_COHORT_RECONCILE_MS,
-  DEFAULT_CONTROL_COHORT_TARGET_DEGREE,
-  type ControlCohortSelection,
-  type ControlCohortReconcileResult
-} from './control-cohort.js';
-
-// Dialing one peer from several candidate addresses, each under its own time
-// limit, so an address that never answers cannot starve the rest.
-export {
-  dialPeerAddrs,
-  SelfRelayOnlyError,
-  PeerUnreachableError,
-  tryAddrsInTurn,
-  directBeforeRelayed,
-  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
-  DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
-  CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
-  DEFAULT_PEER_DIAL_BUDGET,
-  type PeerDialBudget,
-  type AddrDialer
-} from './peer-dial.js';
-
-// Dial and reservation budgets counted in link round trips rather than fixed milliseconds, so
-// one declared assumption about the link moves them all — see `NetworkConfig.linkRoundTripMs`.
-export {
-  DECLARED_LINK_ROUND_TRIP_MS,
-  CIRCUIT_DIAL_ROUND_TRIPS,
-  RELAY_DIAL_ROUND_TRIPS,
-  RELAYED_DIAL_ROUND_TRIPS,
-  RELAY_RESERVATION_ROUND_TRIPS,
-  CIRCUIT_REQUEST_ROUND_TRIPS,
-  RELAYED_REQUEST_ROUND_TRIPS,
-  PUSH_TRANSFER_ALLOWANCE_MS,
-  ADMISSION_DECISION_TIMEOUT_MS,
-  resolveLinkRoundTripMs,
-  relayedDialBudgetMs,
-  relayReservationBudgetMs,
-  circuitRequestBudgetMs,
-  relayedRequestBudgetMs,
-  peerJoinPushBudget,
-  type PeerJoinPushBudget,
-  DIAL_ADMISSION_DECISIONS,
-  optimysticDialLimits,
-  type OptimysticDialLimits
-} from './link-budget.js';
-
-// Seed trust policy (trust anchor for incoming seeds)
-export {
-  anchoredTrustPolicy,
-  pinnedKeyTrustPolicy,
-  tofuTrustPolicy,
-  claimSecretTrustPolicy,
-  type SeedTrustPolicy,
-  type SeedTrustContext,
-  type SeedTrustDecision,
-  type ClaimSecretTrustPolicyOptions
-} from './seed-trust-policy.js';
-
-// Claim proof: how a brand-new node's first seed proves its sender holds the node's
-// one-time claim secret. The owner side builds the proof over `seedDigest` (exported
-// with the seed bootstrap above); `claimSecretTrustPolicy` verifies it.
-// `ClaimRefusedError` is what `CadreNode.claimNode` throws when the node said no;
-// `PeerUnreachableError` (exported with the peer dial above) when it was never reached.
-export {
-  parseClaimSecret,
-  claimProof,
-  verifyClaimProof,
-  ClaimRefusedError,
-  CLAIM_SECRET_BYTES
-} from './claim-proof.js';
-
-// The claim payload: the node's peer id, addresses and claim secret as the text a host
-// shows as a QR code and a phone scans (`CadreNode.claimNode` takes the decoded form).
-export {
-  encodeNodeClaimPayload,
-  decodeNodeClaimPayload,
-  NODE_CLAIM_PAYLOAD_PREFIX,
-  type NodeClaimPayload
-} from './node-claim-payload.js';
-
-// Schema Verification
-export {
-  signSchema,
-  verifySchema,
-  assertSchemaSignature,
-  SchemaVerificationError
-} from './schema-verification.js';
-
-// Strand Formation transport (native cadre-core protocol)
-export {
-  FormationListener,
-  dialFormation,
-  dialFormationByMachine,
-  isValidResponderCreatesResult,
-  isWellFormedMembershipInvite,
-  sanitizeStrandAddrs,
-  FORMATION_PROTOCOL,
-  type FormationParty,
-  type FormationContactMessage,
-  type FormationResultMessage,
-  type FormationProvisionResult,
-  type FormationStrandInfo,
-  type FormationDbConnectionInfo,
-  type FormationListenerOptions,
-  type FormationDialOptions,
-  type FormationDialResult,
-  type FormationRejection,
-  type FormationTokenCheck,
-  type ResponderProvisionOutcome
-} from './strand-formation-protocol.js';
-// How a formation dial fails: a typed refusal (with a fixed code) or no answer at all
-export {
-  FormationRejectedError,
-  FormationUnreachableError,
-  FormationPostApprovalError,
-  FORMATION_REJECTION_RETRYABLE,
-  isFormationRejectionCode,
-  type FormationRejectionCode
-} from './strand-formation-rejection.js';
-export { formationDeadlines, type FormationDeadlines } from './strand-formation-deadlines.js';
-// Cadre invitation redemption transport: the bundle an owner hands out, the wire messages, the
-// member-side handler and the device-side dialer, and how a redemption fails
-export {
-  CadreInviteHandler,
-  redeemAtMembers,
-  signRedeemRequest,
-  verifyRedeemReply,
-  encodeCadreInvitation,
-  decodeCadreInvitation,
-  isWellFormedCadreInviteRow,
-  sanitizeAddrs,
-  CadreInviteRejectedError,
-  CadreInviteUnreachableError,
-  CadreInviteReplyInvalidError,
-  CADRE_INVITE_PROTOCOL,
-  CADRE_INVITE_REJECTION_RETRYABLE,
-  isCadreInviteRejectionCode,
-  type CadreInvitation,
-  type CadreInviteRedeemRequest,
-  type CadreInviteRedeemReply,
-  type CadreInviteAccepted,
-  type CadreInviteRejectionCode,
-  type CadreInviteAddressOutcome,
-  type CadreInviteHandlerOptions,
-  type CadreInviteStore,
-  type RedeemAtMembersOptions,
-  type RedeemSigner,
-  type CadreInviteRedemption
-} from './cadre-invite-protocol.js';
-// The pending-join retry loop behind CadreNode.requestJoin (PendingJoinStatus is in types.ts)
-export { PENDING_JOIN_POLL_MS, PENDING_JOIN_MAX_BACKOFF_MS, MAX_PENDING_JOIN_MS } from './pending-join-runner.js';
-
-// Strand Formation manager (drives the native transport)
-export {
-  StrandFormationManager,
-  createStrandFormationManager,
-  MEMBERSHIP_INVITE_TTL_MS,
-  MEMBERSHIP_INVITE_UNAVAILABLE_REASON,
-  HOST_STRAND_MUST_BE_RECREATED_REASON,
-  type CadrePeerAddrsSource,
-  type MembershipInviteIssuer,
-  type StrandFormationManagerConfig,
-  type StrandFormationManagerOptions
-} from './strand-formation-manager.js';
-
-// Control-network per-stream protocol guard (which peers may open which protocol)
-export {
-  controlProtocolClasses,
-  type ControlProtocolClass
-} from './control-protocol-guard.js';
-
-// Control-network inbound connection gate (membership defense-in-depth)
-export {
-  createMembershipConnectionGater,
-  PROVISIONAL_ADMISSION_DEADLINE_MS,
-  PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS,
-  MAX_UNAUTHORIZED_RELAY_RESERVATIONS,
-  UnauthorizedReservationBudget,
-  type InboundAdmissionPolicy,
-  type InboundConnectionVerdict
-} from './membership-connection-gater.js';
-
-// Thrown out of `CadreNode.start()` when a `network.relayAddrs` reservation does
-// not land on its first attempt — the fail-fast posture of that config field now
-// that the control node reserves AFTER control-database bring-up (relay-addrs.ts).
-// `UnbindableListenAddressError` is the same posture for the OTHER half of the listen
-// config: a `network.listenAddrs` entry whose transport the node will not have refuses
-// start instead of being silently dropped by libp2p's transport manager.
-//
-// `resolveListenAddrs` and `strandNodeAddrs` are the derivations themselves — what a
-// `NetworkConfig` actually turns into for the control node and for each strand node.
-// Exported so an embedder that hand-writes a `network` block (the React Native and web
-// reference apps) can assert on the resulting SHAPE rather than on its own field names,
-// which is the difference between a test that proves reachability and one that proves a
-// spelling.
-export {
-  RelayReservationFailedError,
-  UnbindableListenAddressError,
-  RELAY_SEARCH_LISTEN_ADDR,
-  resolveListenAddrs
-} from './relay-addrs.js';
-export { strandNodeAddrs, type StrandNodeAddrs } from './strand-network-config.js';
-// STUN for an embedder's WebRTC transport, derived from the relays it already uses: each
-// Sereus relay also answers STUN (`ops/docs/ice-servers.md`).
-export { RELAY_STUN_PORT, relayStunUrl, resolveStunServers, type StunServer } from './relay-stun.js';
-// The circuit-relay SERVER a node runs, and with which init — one resolution shared by the
-// control node and every strand node. Exported alongside the listen derivations above for the
-// same reason: an embedder can assert on what its `network` block resolves to.
-export {
-  resolveRelayServer,
-  PARTY_RELAY_MAX_RESERVATIONS,
-  PARTY_RELAY_RESERVATION_TTL_MS,
-  type ResolvedRelayServer,
-  type ResolvedRelayReservations
-} from './relay-server.js';
-
-// Relay reservation via the bare `/p2p-circuit` search listener — the one route
-// every control node takes; `network.relayAddrs` is its fail-fast posture
-// (see relay-reservation.ts)
-export {
-  circuitMultiaddrs,
-  superviseRelayReservation,
-  DEFAULT_RELAY_RESERVE_TIMEOUT_MS,
-  DEFAULT_RELAY_RESERVE_POLL_MS,
-  DEFAULT_RELAY_CHECK_MS,
-  DEFAULT_RELAY_MIN_BACKOFF_MS,
-  DEFAULT_RELAY_MAX_BACKOFF_MS,
-  type RelayReservationStatus,
-  type RelayReservationState,
-  type RelayReserveOptions,
-  type RelayReservationSupervisor,
-  type RelayReservationSupervisorOptions
-} from './relay-reservation.js';
-
-// Connection-path diagnostics (relayed vs direct classification + summary)
-export {
-  classifyTransport,
-  summarizeConnectionPaths,
-  emptyConnectionPathSummary,
-  DEFAULT_SETTLE_WINDOW_MS,
-  type ConnectionPathKind,
-  type ConnectionTransport,
-  type ConnectionPath,
-  type ConnectionPathSummary,
-  type ConnectionLike
-} from './diagnostics/connection-path.js';
+// Core types
+export * from './types.js';
+
+// Canonical JSON serialization (shared signing payload format)
+export { canonicalJson } from './canonical-json.js';
+
+// Main CadreNode class
+export { CadreNode, OWNER_INVITATION_DEFAULT_TTL_MS, CADRE_INVITATION_DEFAULT_TTL_MS } from './cadre-node.js';
+
+// Removing a machine from a cadre: the by-name refusal `CadreNode.removeMachine` throws
+// (the listing, plan and result types are in types.ts)
+export { MachineRemovalRefusedError } from './machine-removal.js';
+
+// Control database
+export { ControlDatabase, parseNullableStoredDatetimeMs, MissingHostStrandError, InvitationExhaustedError, CadreInviteIssuerUnknownError, buildAuthorizationMessage, registerPartyIdFunction, formationVouchMessage, formationConsentMessage, cadreInviteAddMessage, cadreInviteRedeemMessage, cadreInviteConsentMessage, projectSeedPeers, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type FormationInviteRow, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef, type MachineRemovalWrites } from './control-database.js';
+
+// Bounded retry for transient control-write failures (classifier + loop behind
+// ControlDatabase.lockedWithRetry; exported so the integration package can drive the
+// classifier against real engine errors)
+export {
+  CONTROL_WRITE_ATTEMPTS,
+  CONTROL_WRITE_RETRY_BUDGET_MS,
+  SCHEMA_INIT_ATTEMPTS,
+  SCHEMA_INIT_RETRY_POLICY,
+  isRetriableControlWriteFailure,
+  isRetriableSchemaInitFailure,
+  retryControlWrite,
+  type ControlWriteRetryOptions
+} from './control-write-retry.js';
+
+// Bounded retry for transient control-read failures (classifier + policy behind
+// ControlDatabase.readRows; the loop is shared with the write side via control-retry.ts)
+export {
+  CONTROL_READ_ATTEMPTS,
+  CONTROL_READ_RETRY_DELAYS_MS,
+  CONTROL_READ_RETRY_BUDGET_MS,
+  isRetriableControlReadFailure,
+  retryControlRead,
+  type ControlReadRetryOptions
+} from './control-read-retry.js';
+
+// The bounded retry loop both control policies share. Only the abandonment record leaves
+// this package: it is the payload of the `control:write-abandoned` node event, so an
+// embedding app can type a handler for it.
+export type {
+  ControlRetryAbandonment,
+  ControlRetryAbandonReason,
+  ControlRetryAbandonListener
+} from './control-retry.js';
+
+// Control-plane authorization field vector (the domain/action tagging every signer shares)
+export { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, type ControlDomain, type BoundControlDomain, type UnboundControlDomain, type ControlAction, type CadreInviteSignedFields } from './control-authorization.js';
+
+// Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
+
+// Pluggable key store (backend-agnostic identity/owner key material seam).
+// Dependency-free: the interface, error, default slot id, and in-memory backend
+// are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
+// separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
+// import never lands here.
+export {
+  InMemoryKeyStore,
+  KeyStoreAccessError,
+  DEFAULT_IDENTITY_KEY_ID,
+  type KeyStore,
+  type KeyId
+} from './key-store.js';
+
+// The filename-safe form of an id that every Node-only per-party file store names its file
+// with (`<name>.<encoded party>.json`), for an embedder keeping its own file beside theirs.
+export { encodeFileSafeComponent } from './file-safe-name.js';
+
+// The KeyStore-backed identity rule, shared with embedding apps that need the
+// node key BEFORE `CadreNode` exists.
+export { loadOrCreateIdentityKey } from './identity-key.js';
+
+// Node-local trusted-owner anchor: the NON-replicated, per-party record of
+// out-of-band-established owner keys (the trust anchor the replicated OwnerKey
+// table cannot be). Cross-platform: interface + in-memory store only — the
+// file-backed store is the Node-only subpath
+// '@serfab/cadre-core/trusted-owner-store-file' (same isolation as
+// key-store-file) so node:fs never lands in this graph.
+export {
+  MemoryTrustedOwnerStore,
+  PersistentTrustedOwnerStore,
+  type TrustedOwnerStore,
+  type TrustSource
+} from './trusted-owner-store.js';
+
+// The one platform-specific piece of a persistent node-local store: a single
+// durable text slot the embedding app supplies (IndexedDB / SecureStore /
+// SQLite / a file). Everything else — envelope, load policy, snapshot write
+// chain — is cross-platform in node-local-snapshot.ts.
+export type { DurableSlot } from './node-local-snapshot.js';
+
+// Node-local cold-start bootstrap-peer store: the dial targets retained from an
+// applied seed so a node that could not connect on its first try keeps retrying
+// across restarts. Same cross-platform split as the trusted-owner anchor above —
+// interface + in-memory store here, Node-only file backend behind the subpath
+// '@serfab/cadre-core/bootstrap-peer-store-file'.
+export {
+  MemoryBootstrapPeerStore,
+  PersistentBootstrapPeerStore,
+  type BootstrapPeerStore,
+  type BootstrapPeerEntry
+} from './bootstrap-peer-store.js';
+
+// Node-local enrolled-machine count: the machines this party had enrolled the
+// last time this node looked, remembered across restarts so the CONTROL node can
+// declare a block-repair yardstick at bring-up — which is before the database
+// holding the membership rows exists. Same cross-platform split as the two
+// records above; Node-only file backend behind the subpath
+// '@serfab/cadre-core/enrolled-machine-store-file'. Its load policy deliberately
+// DIVERGES from theirs (an unreadable slot cold-starts rather than throwing) —
+// see the module comment before unifying the three.
+export {
+  MemoryEnrolledMachineStore,
+  PersistentEnrolledMachineStore,
+  type EnrolledMachineStore
+} from './enrolled-machine-store.js';
+
+// Node-local record of the strands this node joined from ANOTHER party and has not yet
+// published party-wide, re-offered on every start as `strand:discovered`.
+// Cross-platform: its durable form rides the KeyStore seam above (the record carries a
+// closed strand's read secret), so there is no file-backed subpath.
+export {
+  MemoryJoinedStrandStore,
+  KeyStoreJoinedStrandStore,
+  type JoinedStrandStore,
+  type JoinedStrandRecord
+} from './joined-strand-store.js';
+
+// Node-local strand network state: per strand, the state Optimystic's db-p2p saves for
+// the strand node (its FRET routing table with each peer's signed address record), so a
+// restarted strand node re-imports the peers it was talking to. Same cross-platform
+// split as the bootstrap-peer store above — interface + in-memory + slot-backed stores
+// here, Node-only file backend behind '@serfab/cadre-core/strand-network-state-file'.
+export {
+  MemoryStrandNetworkStateStore,
+  PersistentStrandNetworkStateStore,
+  strandNetworkStatePersistence,
+  type StrandNetworkStateStore
+} from './strand-network-state.js';
+// The signed address records a running strand node's FRET table holds, as per-peer dial
+// addresses: what the periodic refresh re-merges into the node's address book, and a
+// diagnostic for "whom could this strand node redial right now?".
+export { strandFretPeerAddrs, type FretAddrHost, type FretPeerAddrs } from './strand-fret-addrs.js';
+
+// Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
+// strand's key is its strand id; the control database's key carries the party id,
+// so two parties on one device never share a control store. Every key stays within
+// `[a-z0-9._-]` — lowercase, so distinct keys stay distinct on a case-insensitive
+// filesystem: the control key by lowercase hex encoding, a strand's by
+// `assertStrandScopeKey`, which every strand launch runs.
+export {
+  controlStorageScope,
+  isControlStorageScope,
+  isValidStrandScopeKey,
+  assertStrandScopeKey,
+  InvalidStrandIdError
+} from './storage-scope.js';
+
+// Strand database
+export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
+export type { StrandCommitDurability, StrandCommitHeld } from './strand-commit-durability.js';
+
+// Strand management
+export {
+  StrandWatcher,
+  type StrandWatcherCallbacks,
+  type StrandQueryable,
+  type SAppIdLookup,
+  type StrandRowWithApp
+} from './strand-watcher.js';
+export {
+  StrandInstanceManager,
+  type StartStrandConfig,
+  type ResumeStrandOverrides,
+  getStrandStoragePath,
+  isAwaitingFirstSync,
+  liveStrandStatus
+} from './strand-instance-manager.js';
+
+// The joining machine's first-sync write gate: a non-founder launch withholds its
+// database (status 'syncing') until the strand's Header has arrived from a peer, so a
+// write before the first sync can never fork the strand's tables.
+export {
+  StrandAwaitingFirstSyncError,
+  DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS,
+  DEFAULT_STRAND_FIRST_SYNC_POLL_MS,
+  strandHeaderHeld,
+  appTablesReadable,
+  strandFirstSyncComplete,
+  type StrandFirstSyncConfig
+} from './strand-first-sync-gate.js';
+
+// Peer-join block catch-up (push this network's own blocks to each newly
+// connected peer, so a late joiner physically holds pre-join blocks). Shared
+// by the strand networks (ungated) and the control network (membership-gated).
+export {
+  PeerJoinBackfill,
+  DEFAULT_PEER_JOIN_BACKFILL,
+  MAX_BLOCK_MESSAGE_BYTES,
+  PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES,
+  type PeerJoinBackfillConfig,
+  type PeerJoinBackfillDeps,
+  type PeerJoinBackfillResult,
+  type PeerJoinBackfillPushClient
+} from './peer-join-backfill.js';
+
+// Operator opt-in to Optimystic change notifications on chosen strand nodes
+// (`CadreNodeConfig.strandReactivity`).
+export { strandCohortTopicOption, type StrandReactivityConfig } from './strand-reactivity.js';
+
+// Closed-strand revoked-peer enforcement (deny the network nodes of removed
+// members at the stream and connection layers, and hang up the sessions they
+// already hold — see the module doc for the settled deny-list design, the
+// teardown seam, and the fail directions).
+export {
+  StrandRevocationEnforcer,
+  createRevocationConnectionGater,
+  readStrandRevocationRows,
+  DEFAULT_REVOCATION_POLL_INTERVAL_MS,
+  type StrandRevocationEnforcementConfig,
+  type StrandRevocationEnforcerDeps,
+  type StrandRevocationRows,
+  type StrandMemberPeerBinding,
+  type StrandRevocationJudge,
+  type StrandRevocationNetwork,
+  type RevocationRefreshScheduler
+} from './strand-revocation-enforcer.js';
+
+// Closed-strand membership reconciliation: the bring-up loop that finishes a
+// party's join on every machine — redeem the staged formation invitation, then
+// write the durable machine→party MemberPeer binding — without ever blocking
+// bring-up (see the module doc for the pass ladder and terminal states).
+export {
+  StrandMembershipReconciler,
+  IDLE_PASSES_BEFORE_ESCALATION,
+  INITIAL_JOIN_RETRY_INTERVAL_MS,
+  type StrandMembershipReconcilerDeps,
+  type StrandMembershipReconciliationConfig,
+  type PendingMembershipInviteSource
+} from './strand-membership-reconciler.js';
+
+// The timer seam the self-rescheduling strand bring-up loops share (first-sync gate
+// probe loop, membership retry ladder) — injected by tests as a hand-cranked clock.
+export { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
+
+// Hibernation
+export {
+  HibernationManager,
+  type HibernationCallbacks
+} from './hibernation-manager.js';
+
+// Arachnode (stub)
+export {
+  ArachnodeStub,
+  createArachnodeStub,
+  type RingConfig
+} from './arachnode-stub.js';
+
+// Enrollment
+export {
+  EnrollmentService,
+  type MemberVerifier,
+  type MemberRegistry
+} from './enrollment.js';
+
+// Strand Solicitation
+export {
+  StrandSolicitationService,
+  createDefaultFormationResponseValidator,
+  type DisclosureValidator,
+  type FormationUsageRecorder,
+  type FormationUsageParams,
+  type AuthorizedFormationUsage,
+  type ResolvedHostStrand,
+  type StrandProvisioner,
+  type FormationResponseValidator,
+  type StrandSolicitationServiceOptions
+} from './strand-solicitation.js';
+
+// Formation approval client: asks an invite's ValidationUrl hook whether ONE redemption
+// may proceed, and checks the answer against the bytes the control database will verify.
+export {
+  createHttpFormationApprover,
+  signFormationApproval,
+  verifyFormationApproval,
+  FormationApprovalError,
+  type FormationApprovalRequest,
+  type FormationVouchFields,
+  type FormationApproval,
+  type FormationApprover,
+  type FormationApprovalFailure
+} from './formation-approval.js';
+
+// DB-backed FormationUsageRecorder (reads/writes the real CadreControl tables)
+export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
+
+// Closed-strand member key generation (ed25519 protobuf, base64) + the
+// protobuf->base64url bridge that derives the founding Member/Manager key.
+export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
+
+// Strand membership writer (founder bootstrap, invite issuance/consumption,
+// manager-admit, member-peer registration, manager rotation, sealing — the sole
+// manager permanently freezing admission — + shared signing primitives reused
+// across the flows).
+export {
+  signStrandPayload,
+  verifyStrandPayload,
+  signStrandApproval,
+  generateStrandStampId,
+  bootstrapFounderMembership,
+  PreSplitStrandIdentityError,
+  issueInvite,
+  consumeInvite,
+  burnInvite,
+  isStrandMember,
+  cancelInvite,
+  listOutstandingInvites,
+  addMemberByManager,
+  revokeMember,
+  leaveStrand,
+  registerMemberPeer,
+  listMemberPeers,
+  removeMemberPeer,
+  addManager,
+  admitManager,
+  removeManager,
+  sealStrand,
+  isStrandSealed,
+  StrandTransactionBusyError,
+  STRAND_ENGINE,
+  STRAND_ENGINE_VERSION,
+  type FounderBootstrapParams,
+  type IssueInviteParams,
+  type IssuedInvite,
+  type ConsumeInviteParams,
+  type CancelInviteParams,
+  type OutstandingInvite,
+  type AddMemberByManagerParams,
+  type RevokeMemberParams,
+  type LeaveStrandParams,
+  type RegisterMemberPeerParams,
+  type RemoveOwnPeerParams,
+  type RemoveMemberPeerByManagerParams,
+  type RemoveMemberPeerParams,
+  type AddManagerParams,
+  type AdmitManagerParams,
+  type RemoveManagerParams,
+  type SealStrandParams,
+  type StrandWriteOptions
+} from './strand-membership-writer.js';
+
+// Engine-canonical datetime helper (shared by control + strand signed-write flows
+// so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
+export { canonicalDatetime } from './canonical-datetime.js';
+
+// Strand-DB-backed EnrollmentService backing: concrete MemberRegistry +
+// MemberVerifier that write/read the real Strand.* membership tables.
+export {
+  StrandMemberRegistry,
+  StrandMemberVerifier,
+  memberRegistrationPayload,
+  type StrandAdmission
+} from './strand-member-registry.js';
+
+// Seed Bootstrap
+export {
+  SeedBootstrapService,
+  SEED_PROTOCOL,
+  mergeSeedPeers,
+  seedDigest,
+  type SeedBootstrapConfig,
+  type SeedEventCallbacks
+} from './seed-bootstrap.js';
+
+// Peer Authorization (shared owner-signature digest + offline verifier)
+export {
+  peerAuthorizationDigest,
+  cadrePeerVoucherDigest,
+  cadrePeerRemoveDigest,
+  deviceTokenAddDigest,
+  deviceTokenRemoveDigest,
+  formationConsentDigest,
+  cadreInviteAddDigest,
+  cadreInviteRedeemDigest,
+  cadreInviteConsentDigest,
+  ownerKeyAddDigest,
+  verifyPeerAuthorization,
+  verifyCadrePeerVoucher,
+  verifyOwnerKeyVoucher,
+  verifyRevocationSigner,
+  verifyFormationConsent,
+  verifyInvitationAdmission,
+  verifyInvitationOwnerAdmission,
+  verifyCadreInviteRow,
+  verifyCadreInviteRedemption,
+  type DeviceTokenAuthorizedRow
+} from './peer-authorization.js';
+
+// How the trusted-owner anchor follows the replicated OwnerKey table along verifiable
+// chains: the pure derivation rule `CadreNode.syncOwnerAnchor` applies on every membership
+// refresh (owner-anchor-sync.ts).
+export { deriveOwnerAnchor, type OwnerAnchorInputs, type OwnerAnchorDerivation } from './owner-anchor-sync.js';
+
+// Strand Wake (control-network push-wake protocol)
+export {
+  StrandWakeService,
+  dialWake,
+  WAKE_PROTOCOL,
+  DEFAULT_WAKE_DIAL_BUDGET_MS,
+  type StrandWakeServiceOptions,
+  type DialWakeOptions
+} from './strand-wake-protocol.js';
+
+// Strand Address (control-network strand-address RPC) — wire types come via
+// `export * from './types.js'` (StrandAddrRequest / StrandAddrResponse / StrandAddrStatus).
+export {
+  StrandAddrService,
+  collectStrandAddrs,
+  STRAND_ADDR_PROTOCOL,
+  type StrandAddrServiceOptions,
+  type StrandAddrPeer,
+  type CollectStrandAddrsOptions,
+  type StrandAddrOutcome,
+  type StrandAddrCollection
+} from './strand-addr-protocol.js';
+
+// Peer-address record (self-published, signed, freshness-stamped CadrePeer row)
+export {
+  peerRecordSignedPayload,
+  signPeerRecord,
+  verifyPeerRecordSignature,
+  isPeerRecordFresh,
+  isSignalingAddr,
+  orderSignalingFirst,
+  currentMemberTrustPolicy,
+  DEFAULT_PEER_RECORD_MAX_AGE_MS,
+  DEFAULT_PEER_RECORD_HEARTBEAT_MS
+} from './peer-record.js';
+
+// Device-token record (self-published, signed FCM/APNs push token — CadrePeer sibling)
+export {
+  deviceTokenSignedPayload,
+  signDeviceTokenRecord,
+  verifyDeviceTokenSignature,
+  isPushPlatform
+} from './device-token.js';
+
+// Strand-wake payload contract (canonical; shared by the server sender + RN receiver)
+export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.js';
+
+// Platform push delivery — the cross-platform `PushNotifier` *contract* only.
+// The FCM/APNs implementations (node:http2/node:crypto) and the
+// `createPushNotifier` router that builds them live behind the Node-only subpath
+// `@serfab/cadre-core/push-node` (`push-node.ts`), never in this graph. A Node
+// host constructs a notifier from that subpath and injects the instance into
+// `CadreNodeConfig.push.notifier`. These re-exports are type-only (erased at
+// emit), so the RN/browser entry graph never pulls the Node modules in.
+export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
+
+// Push-credential validation + log redaction. Dependency-free (type-only imports),
+// so a provisioner (cadre-host / cadre-provider) can reject a partial credential
+// set and produce a key-safe log view without pulling the FCM/APNs sender graph.
+export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
+
+// Server-side push-wake trigger policy + fan-out (who/when to wake). Cross-platform
+// clean — it imports only the PushNotifier *type*, so exporting it as a runtime
+// value pulls no node:http2/node:crypto edge into the RN/browser graph.
+export {
+  PushFanoutService,
+  DEFAULT_PUSH_COOLDOWN_MS,
+  DEFAULT_PUSH_DEBOUNCE_MS,
+  type PushFanoutOptions,
+  type FanoutMember
+} from './push-fanout.js';
+
+// Control-cohort dial selection (backbone-preferential, bounded out-degree) +
+// the cadence/degree defaults the proactive reconcile routine reads.
+export {
+  selectControlCohortDials,
+  DEFAULT_CONTROL_COHORT_RECONCILE_MS,
+  DEFAULT_CONTROL_COHORT_TARGET_DEGREE,
+  type ControlCohortSelection,
+  type ControlCohortReconcileResult
+} from './control-cohort.js';
+
+// Dialing one peer from several candidate addresses, each under its own time
+// limit, so an address that never answers cannot starve the rest. Each address is
+// bound to the peer expected and dialed outside libp2p's dial queue (`dialAddr`),
+// so another dial of the same peer in flight cannot capture the attempt.
+export {
+  dialAddr,
+  withTrailingPeerId,
+  dialPeerAddrs,
+  SelfRelayOnlyError,
+  PeerUnreachableError,
+  tryAddrsInTurn,
+  directBeforeRelayed,
+  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
+  DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
+  CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
+  DEFAULT_PEER_DIAL_BUDGET,
+  type PeerDialBudget,
+  type AddrDialer
+} from './peer-dial.js';
+
+// Dial and reservation budgets counted in link round trips rather than fixed milliseconds, so
+// one declared assumption about the link moves them all — see `NetworkConfig.linkRoundTripMs`.
+export {
+  DECLARED_LINK_ROUND_TRIP_MS,
+  CIRCUIT_DIAL_ROUND_TRIPS,
+  RELAY_DIAL_ROUND_TRIPS,
+  RELAYED_DIAL_ROUND_TRIPS,
+  RELAY_RESERVATION_ROUND_TRIPS,
+  CIRCUIT_REQUEST_ROUND_TRIPS,
+  RELAYED_REQUEST_ROUND_TRIPS,
+  PUSH_TRANSFER_ALLOWANCE_MS,
+  ADMISSION_DECISION_TIMEOUT_MS,
+  resolveLinkRoundTripMs,
+  relayedDialBudgetMs,
+  relayReservationBudgetMs,
+  circuitRequestBudgetMs,
+  relayedRequestBudgetMs,
+  peerJoinPushBudget,
+  type PeerJoinPushBudget,
+  DIAL_ADMISSION_DECISIONS,
+  optimysticDialLimits,
+  type OptimysticDialLimits
+} from './link-budget.js';
+
+// Seed trust policy (trust anchor for incoming seeds)
+export {
+  anchoredTrustPolicy,
+  pinnedKeyTrustPolicy,
+  tofuTrustPolicy,
+  claimSecretTrustPolicy,
+  type SeedTrustPolicy,
+  type SeedTrustContext,
+  type SeedTrustDecision,
+  type ClaimSecretTrustPolicyOptions
+} from './seed-trust-policy.js';
+
+// Claim proof: how a brand-new node's first seed proves its sender holds the node's
+// one-time claim secret. The owner side builds the proof over `seedDigest` (exported
+// with the seed bootstrap above); `claimSecretTrustPolicy` verifies it.
+// `ClaimRefusedError` is what `CadreNode.claimNode` throws when the node said no;
+// `PeerUnreachableError` (exported with the peer dial above) when it was never reached.
+export {
+  parseClaimSecret,
+  claimProof,
+  verifyClaimProof,
+  ClaimRefusedError,
+  CLAIM_SECRET_BYTES
+} from './claim-proof.js';
+
+// The claim payload: the node's peer id, addresses and claim secret as the text a host
+// shows as a QR code and a phone scans (`CadreNode.claimNode` takes the decoded form).
+export {
+  encodeNodeClaimPayload,
+  decodeNodeClaimPayload,
+  selectNodeClaimAddresses,
+  withClaimDestination,
+  destinationPeerIdOf,
+  classifyDialAddress,
+  NODE_CLAIM_PAYLOAD_PREFIX,
+  type NodeClaimPayload,
+  type NodeClaimAddressOptions,
+  type DialAddressKind
+} from './node-claim-payload.js';
+
+// Moving a party's strands into another party of the same owner, so an app's strands follow
+// the app into the user's main cadre: the bundle one node exports from the party it leaves,
+// its adoption by a node of the party it joined, and the check that the party it left holds
+// nothing the joined one lacks before it is dissolved.
+export {
+  exportStrandBundle,
+  adoptStrandBundle,
+  readStrandHoldings,
+  unheldBundleContent,
+  StrandMoveNotOwnerError,
+  StrandMoveSamePartyError,
+  type StrandHoldings,
+  type StrandBundle,
+  type StrandBundleEntry,
+  type FormationInviteEntry,
+  type StrandMoveReport,
+  type StrandMoveFailure
+} from './strand-move.js';
+
+// The join request: what an app that wants to join a cadre copies to the app that manages it,
+// which mints an invitation targeted at the request's peer id. Both paste-text prefixes live here.
+export {
+  encodeCadreJoinRequest,
+  decodeCadreJoinRequest,
+  requireCadreJoinReply,
+  CADRE_JOIN_REQUEST_PREFIX,
+  CADRE_INVITATION_PREFIX,
+  CADRE_JOIN_REQUEST_MAX_APP_NAME,
+  type CadreJoinReply,
+  type CadreJoinRequest
+} from './cadre-join-request.js';
+
+// Renting a node from a hosting provider: the provider's descriptor, the app's side of the
+// OAuth 2 + PKCE sign-in, the typed client for its container API, and `rentNode` /
+// `finishRental`, which add the rented container to this node's cadre by invitation or by
+// claim. Global `fetch` and `crypto.getRandomValues` only, so the whole set loads on React
+// Native and in the browser (`docs/architecture.md` → "Renting a node from an app"). The
+// barrel is the curated list; it is not repeated here.
+export * from './provider/index.js';
+
+// Schema Verification
+export {
+  signSchema,
+  verifySchema,
+  assertSchemaSignature,
+  SchemaVerificationError
+} from './schema-verification.js';
+
+// Strand Formation transport (native cadre-core protocol)
+export {
+  FormationListener,
+  dialFormation,
+  dialFormationByMachine,
+  isValidResponderCreatesResult,
+  isWellFormedMembershipInvite,
+  sanitizeStrandAddrs,
+  FORMATION_PROTOCOL,
+  type FormationParty,
+  type FormationContactMessage,
+  type FormationResultMessage,
+  type FormationProvisionResult,
+  type FormationStrandInfo,
+  type FormationDbConnectionInfo,
+  type FormationListenerOptions,
+  type FormationDialOptions,
+  type FormationDialResult,
+  type FormationRejection,
+  type FormationTokenCheck,
+  type ResponderProvisionOutcome
+} from './strand-formation-protocol.js';
+// How a formation dial fails: a typed refusal (with a fixed code) or no answer at all
+export {
+  FormationRejectedError,
+  FormationUnreachableError,
+  FormationPostApprovalError,
+  FORMATION_REJECTION_RETRYABLE,
+  isFormationRejectionCode,
+  type FormationRejectionCode
+} from './strand-formation-rejection.js';
+export { formationDeadlines, type FormationDeadlines } from './strand-formation-deadlines.js';
+// Cadre invitation redemption transport: the bundle an owner hands out, the wire messages, the
+// member-side handler and the device-side dialer, and how a redemption fails
+export {
+  CadreInviteHandler,
+  redeemAtMembers,
+  redeemInPasses,
+  signRedeemRequest,
+  verifyRedeemReply,
+  encodeCadreInvitation,
+  decodeCadreInvitation,
+  isWellFormedCadreInviteRow,
+  sanitizeAddrs,
+  CadreInviteRejectedError,
+  CadreInviteUnreachableError,
+  CadreInviteReplyInvalidError,
+  CADRE_INVITE_PROTOCOL,
+  CADRE_INVITE_REJECTION_RETRYABLE,
+  isCadreInviteRejectionCode,
+  type CadreInvitation,
+  type CadreInviteRedeemRequest,
+  type CadreInviteRedeemReply,
+  type CadreInviteAccepted,
+  type CadreInviteRejectionCode,
+  type CadreInviteAddressOutcome,
+  type CadreInviteHandlerOptions,
+  type CadreInviteStore,
+  type RedeemAtMembersOptions,
+  type RedeemInPassesOptions,
+  type RedeemSigner,
+  type CadreInviteRedemption
+} from './cadre-invite-protocol.js';
+// Which machines, and how many addresses of each, an invitation names; how far a cadre invitation reaches
+export {
+  selectCadreInvitationMembers,
+  cadreInvitationReach,
+  CADRE_INVITATION_MAX_ADDRS,
+  CADRE_INVITATION_ADDRS_PER_SIBLING
+} from './invitation-bootstrap.js';
+// The pending-join retry loop behind CadreNode.requestJoin (PendingJoinStatus is in types.ts)
+export { PENDING_JOIN_POLL_MS, PENDING_JOIN_MAX_BACKOFF_MS, MAX_PENDING_JOIN_MS } from './pending-join-runner.js';
+
+// Strand Formation manager (drives the native transport)
+export {
+  StrandFormationManager,
+  createStrandFormationManager,
+  MEMBERSHIP_INVITE_TTL_MS,
+  MEMBERSHIP_INVITE_UNAVAILABLE_REASON,
+  HOST_STRAND_MUST_BE_RECREATED_REASON,
+  type CadrePeerAddrsSource,
+  type MembershipInviteIssuer,
+  type StrandFormationManagerConfig,
+  type StrandFormationManagerOptions
+} from './strand-formation-manager.js';
+
+// Control-network per-stream protocol guard (which peers may open which protocol)
+export {
+  controlProtocolClasses,
+  type ControlProtocolClass
+} from './control-protocol-guard.js';
+
+// Control-network inbound connection gate (membership defense-in-depth)
+export {
+  createMembershipConnectionGater,
+  PROVISIONAL_ADMISSION_DEADLINE_MS,
+  PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS,
+  MAX_UNAUTHORIZED_RELAY_RESERVATIONS,
+  UnauthorizedReservationBudget,
+  type InboundAdmissionPolicy,
+  type InboundConnectionVerdict
+} from './membership-connection-gater.js';
+
+// Thrown out of `CadreNode.start()` when a `network.relayAddrs` reservation does
+// not land on its first attempt — the fail-fast posture of that config field now
+// that the control node reserves AFTER control-database bring-up (relay-addrs.ts).
+// `UnbindableListenAddressError` is the same posture for the OTHER half of the listen
+// config: a `network.listenAddrs` entry whose transport the node will not have refuses
+// start instead of being silently dropped by libp2p's transport manager.
+//
+// `resolveListenAddrs` and `strandNodeAddrs` are the derivations themselves — what a
+// `NetworkConfig` actually turns into for the control node and for each strand node.
+// Exported so an embedder that hand-writes a `network` block (the React Native and web
+// reference apps) can assert on the resulting SHAPE rather than on its own field names,
+// which is the difference between a test that proves reachability and one that proves a
+// spelling.
+export {
+  RelayReservationFailedError,
+  UnbindableListenAddressError,
+  RELAY_SEARCH_LISTEN_ADDR,
+  resolveListenAddrs
+} from './relay-addrs.js';
+export { strandNodeAddrs, type StrandNodeAddrs } from './strand-network-config.js';
+// STUN for an embedder's WebRTC transport, derived from the relays it already uses: each
+// Sereus relay also answers STUN (`ops/docs/ice-servers.md`).
+export { RELAY_STUN_PORT, relayStunUrl, resolveStunServers, type StunServer } from './relay-stun.js';
+// The circuit-relay SERVER a node runs, and with which init — one resolution shared by the
+// control node and every strand node. Exported alongside the listen derivations above for the
+// same reason: an embedder can assert on what its `network` block resolves to.
+export {
+  resolveRelayServer,
+  PARTY_RELAY_MAX_RESERVATIONS,
+  PARTY_RELAY_RESERVATION_TTL_MS,
+  type ResolvedRelayServer,
+  type ResolvedRelayReservations
+} from './relay-server.js';
+
+// Relay reservation via the bare `/p2p-circuit` search listener — the one route
+// every control node takes; `network.relayAddrs` is its fail-fast posture
+// (see relay-reservation.ts)
+export {
+  circuitMultiaddrs,
+  superviseRelayReservation,
+  DEFAULT_RELAY_RESERVE_TIMEOUT_MS,
+  DEFAULT_RELAY_RESERVE_POLL_MS,
+  DEFAULT_RELAY_CHECK_MS,
+  DEFAULT_RELAY_MIN_BACKOFF_MS,
+  DEFAULT_RELAY_MAX_BACKOFF_MS,
+  type RelayReservationStatus,
+  type RelayReservationState,
+  type RelayReserveOptions,
+  type RelayReservationSupervisor,
+  type RelayReservationSupervisorOptions
+} from './relay-reservation.js';
+
+// Connection-path diagnostics (relayed vs direct classification + summary)
+export {
+  classifyTransport,
+  summarizeConnectionPaths,
+  emptyConnectionPathSummary,
+  DEFAULT_SETTLE_WINDOW_MS,
+  type ConnectionPathKind,
+  type ConnectionTransport,
+  type ConnectionPath,
+  type ConnectionPathSummary,
+  type ConnectionLike
+} from './diagnostics/connection-path.js';