@serfab/cadre-core 1.14.0 → 1.16.0

package/dist/control-schema.d.ts

@@ -9,4 +9,4 @@
  * build if they drift. Any edit here must be mirrored in `schemas/control.qsql`
  * and vice versa.
  */
-export declare const CONTROL_SCHEMA = "-- A Sereus party's cadre (its nodes) and their participation in strands (networks).\n--\n-- Every write is authorized by a check: an owner signs an action-tagged digest of the row\n-- (cadre-core control-authorization.ts), or a peer signs its own record. Each digest leads\n-- with a 'CadreControl.<Table>' domain tag, an action tag and party_id(), the party this\n-- machine is configured for (a zero-argument function ControlDatabase registers on its own\n-- engine, never read from a context value or a replicated table), so an approval verifies\n-- only against the one rule, in the one party, it was minted for: two parties that share\n-- an owner key never accept each other's approvals. FormationUsage is the exception, its\n-- two digests scoped by the invitation token instead (FormationUsage.Authorized).\n--\n-- Rows of the guarded tables (OwnerKey, ValidationKey, Strand, StrandPartyKey, JoinedStrand,\n-- JoinRequest, CadrePeer, DeviceToken, CadreInvite) carry a one-off StampId bound into their\n-- add and remove digests. `unique` holds over live rows only, so a delete retires the stamp\n-- into Revocation in the same transaction (RevocationRecorded) and an insert refuses a retired\n-- stamp (NotRevoked): the never-expiring add approval cannot re-seat a removed row. A\n-- legitimate re-add mints a fresh stamp and a fresh signature. CadreInvite is the one guarded\n-- table that is never deleted: its tombstone withdraws the invitation while the row stays,\n-- because the rows it admitted prove their membership through it.\n--\n-- A check whose expression evaluates to null passes (SQL three-valued logic), so every\n-- comparison over a nullable column that is meant to pin a value is written null-safe\n-- (`coalesce(col, '')` or an explicit `is null`); a bare `new.Col = context.X` over a null\n-- column would pass with nothing pinned.\n--\n-- A check with a subquery defers to commit, so a sibling row written in the same transaction\n-- is visible to it; `committed.<Table>` reads the pre-transaction snapshot instead. Every\n-- check reads the rows this node holds: a node that has not converged on a Revocation row\n-- still accepts the replayed add, and the resurrected row then coexists with its tombstone.\n-- ControlDatabase drops retired stamps on the reads that matter (queryCadrePeers,\n-- queryPendingJoins, getOwnerKeys), and every owner lookup in the checks below drops them\n-- too (the `not exists ... Revocation` conjunct beside each OwnerKey read, reading live\n-- Revocation so a tombstone filed in the same transaction counts), so a removal is\n-- effective at the writer as soon as its tombstone arrives, whether or not the row's delete\n-- has. Only the founding count in OwnerKey.Authorized stays raw.\ndeclare schema CadreControl {\n    -- A key that can authorize control changes. A row is seated one of three ways, told apart\n    -- by the vouch columns: the founding row (all three null), an owner-signed add (VouchOwner\n    -- and VouchSig pinned to the insert context, VouchUsage null), or an owner-granting\n    -- invitation redeemed by consent (VouchOwner = the invitation's IssuerKey, VouchSig null,\n    -- VouchUsage = the CadreInviteUsage row that admitted it). A reader judges the stored proof\n    -- against its node-local anchor, never against this replicated table.\n    table OwnerKey (\n        Key text primary key,\n        StampId text unique,\n        VouchOwner text null,\n        VouchSig text null,\n        VouchUsage text null,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = new.StampId)\n        ),\n        -- The tombstone must name the removed row, not just its stamp (Revocation.RowKey).\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        -- Every other table's checks require an owner, so an empty table is a permanent denial of\n        -- the party's control plane. Counted post-delete, on this node's rows only: two partitioned\n        -- nodes removing different owners can still converge to zero.\n        constraint MinOneOwner check on delete (\n            (select count(1) from OwnerKey) >= 1\n        ),\n        -- Rotation is add-then-remove. An update branch would let the sole owner be re-pointed at\n        -- another key under a post-image count of one.\n        constraint NoUpdate check on update (false),\n        -- The authorizer is read from the pre-transaction snapshot: the check defers to commit, by\n        -- which point the inserted row (and any sibling) is live, so a plain OwnerKey read would let\n        -- a row authorize itself or two strangers seat each other. The founding transaction, whose\n        -- pre-transaction owner set is empty, needs no authorization; gating on the pre-transaction\n        -- count keeps a same-transaction swap of the sole owner off that branch. That count is\n        -- deliberately raw, the one owner read here that ignores Revocation: a machine holding only\n        -- a retired owner row must still be refused a second genesis, or a removed device could\n        -- re-found the party on its own copy. An owner cannot sign its own removal.\n        -- The consent branch seats an owner with no signature at all: a CadreInviteUsage row\n        -- written in the same transaction names this exact row (Key and stamp), and the\n        -- invitation it redeemed grants ownership and was issued by the stored VouchOwner. The\n        -- invitation is read from committed.CadreInvite, so an invitation cannot be seated and\n        -- redeemed in one transaction; the usage row carries the liveness conditions.\n        constraint Authorized check on insert, delete (\n            (old.Key is null and (select count(1) from committed.OwnerKey) = 0\n                and new.VouchOwner is null and new.VouchSig is null and new.VouchUsage is null)\n                or (old.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.OwnerKey', 'add', party_id(), new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and coalesce(new.VouchOwner, '') = context.OwnerKey\n                    and coalesce(new.VouchSig, '') = context.Signature\n                    and new.VouchUsage is null)\n                or (old.Key is null and new.VouchSig is null and new.VouchUsage is not null\n                    and exists (\n                        select 1 from CadreInviteUsage U\n                            where U.UsageStampId = new.VouchUsage\n                                and U.PeerKey = new.Key\n                                and U.OwnerStampId = new.StampId\n                                and exists (select 1 from committed.CadreInvite I where I.Key = U.InviteKey and I.GrantsOwner = 1 and I.IssuerKey = new.VouchOwner)\n                    ))\n                or (new.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and A.Key <> old.Key and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.OwnerKey', 'remove', party_id(), old.Key, old.StampId), context.Signature, A.Key, 'ed25519')))\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure (FormationUsage.Authorized).\n    table ValidationKey (\n        Key text primary key,\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.ValidationKey', 'add', party_id(), new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Owner-signed over the stored row, or a reap: a committed tombstone naming this exact row\n        -- incarnation lets a node that was offline at removal time delete the stale row unsigned\n        -- (ControlDatabase.reapRevokedRow). committed.*, so a tombstone filed in this transaction\n        -- cannot stand in for the signature; the stamp clause, so a tombstone of an earlier\n        -- incarnation cannot remove the current one.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.ValidationKey', 'remove', party_id(), old.Key, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'ValidationKey' and R.RowKey = old.Key and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing its cadre's peers. This\n    -- party's own strands; a strand joined from another party is a JoinedStrand row.\n    table Strand (\n        Id text primary key,                -- UUID\n        MemberPrivateKey text null unique,  -- the strand's shared read secret; closed strands only\n        Type text,                          -- 'o' open | 'c' closed: open gates writes in the sApp, only closed gates reads\n        FounderOwnerKey text null,          -- owner key of the machine that published the row, the founding machine\n                                            -- (cadre-node.ts launchStrand); null on a consent-seated strand, whose\n                                            -- insert carries no signature. Provenance, not content (strandRowMismatches).\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        -- The consent branch below carries no signature, so an update rule would let anyone rewrite\n        -- a consent-seated strand.\n        constraint NoUpdate check on update (false),\n        -- Owner-signed, with FounderOwnerKey pinned to the verified signer; or consent-seated by a\n        -- FormationUsage row naming this exact row (id and stamp), written in the same transaction\n        -- (ControlDatabase.redeemInvitation). Binding the stamp is what makes a removal stick:\n        -- the usage row outlives the strand, and keyed on the id alone it would re-authorize an\n        -- unsigned re-seat under a fresh stamp. The consent branch is narrow, each clause closing\n        -- one door:\n        --   * open and keyless: a closed strand with a caller-chosen read secret has no legitimate\n        --     producer;\n        --   * through an unbound invite only: a bound invite's host strand is owner-provisioned,\n        --     and consent-seating its id would downgrade the real row on a node it has not reached;\n        --   * no usage row under another stamp, and no tombstone for the id: an id is consent-seated\n        --     once, ever, and never after any removal. Re-joining a removed id is owner-signed.\n        -- A standalone tombstone (no accompanying delete, Revocation.Authorized) lets an owner\n        -- foreclose consent-seating of an id that never existed: owner-only, and ids are random.\n        constraint AuthorizedInsert check on insert (\n            (exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Strand', 'add', party_id(), new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n                and new.FounderOwnerKey = context.OwnerKey)\n                or (\n                    new.Type = 'o'\n                    and new.MemberPrivateKey is null\n                    and new.FounderOwnerKey is null\n                    and exists (\n                        select 1 from FormationUsage FU\n                            where FU.StrandId = new.Id\n                                and FU.StrandStampId = new.StampId\n                                and exists (select 1 from FormationInvite FI where FI.Token = FU.Token and FI.StrandId is null)\n                    )\n                    and not exists (\n                        select 1 from FormationUsage FU2\n                            where FU2.StrandId = new.Id and FU2.StrandStampId <> new.StampId\n                    )\n                    and not exists (\n                        select 1 from Revocation R\n                            where R.TableName = 'Strand' and R.RowKey = new.Id\n                    )\n                )\n        ),\n        -- No consent branch (an invitation forms a strand, never destroys one) and no reap branch:\n        -- MemberPrivateKey is stored nowhere else, so this delete is unrecoverable\n        -- (tickets/backlog/debt-strand-tombstone-reap.md owns any change).\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Strand', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- An open strand has no membership gate, so no member key.\n        constraint MemberKeyClosedOnly check (\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- This party's own membership identity for one strand: the private key whose public half\n    -- seats its Strand.Member / Strand.Manager rows. Separate from Strand.MemberPrivateKey, which\n    -- every joining party receives and so could forge (gotchoices/sereus#4). A side table because\n    -- a joiner holds no Strand row. Replicated in plaintext to every machine the party owns\n    -- (docs/strands.md \u2192 \"Closed-Strand Member Key Handling\") but never put on the formation wire.\n    table StrandPartyKey (\n        Id text primary key,        -- the strand id\n        PrivateKey text,            -- ed25519, base64 protobuf, as Strand.MemberPrivateKey (cadre-core strandMemberKeyPair)\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'StrandPartyKey' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'StrandPartyKey' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        constraint NoUpdate check on update (false),\n        -- Binding PrivateKey means a captured approval can only reproduce the key it approved.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.StrandPartyKey', 'add', party_id(), new.Id, new.PrivateKey, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- No reap branch: the key is stored nowhere else (as Strand.AuthorizedDelete).\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.StrandPartyKey', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A strand this party joined from another party, whose control database holds the Strand\n    -- row. Every machine of the party reads it, so a replica host keeps a copy and the party's\n    -- other machines can attach. A separate table because every reader of Strand takes it to\n    -- mean this party's own strand. MemberPrivateKey is held by the founding party and every\n    -- member, so a removed row is recoverable by re-forming, which is why this table has a reap\n    -- branch (unlike Strand and StrandPartyKey).\n    table JoinedStrand (\n        Id text primary key,            -- the founder's Strand.Id\n        Type text,                      -- 'o' | 'c', as Strand.Type\n        MemberPrivateKey text null,     -- the closed strand's shared read secret\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'JoinedStrand' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinedStrand' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        constraint NoUpdate check on update (false),\n        -- Readers cast Type (ControlDatabase.queryJoinedStrands).\n        constraint KnownType check (new.Type = 'o' or new.Type = 'c'),\n        constraint MemberKeyClosedOnly check (new.MemberPrivateKey is null or new.Type = 'c'),\n        -- Owner-signed only: every always-on machine of the party downloads the strands named\n        -- here, so a machine that is not an owner keeps its joins machine-local.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.JoinedStrand', 'add', party_id(), new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.JoinedStrand', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'JoinedStrand' and R.RowKey = old.Id and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A join this party asked for by redeeming another party's invitation, kept party-wide so\n    -- the request outlives the device that asked and any owner machine can carry it on\n    -- (docs/strands.md \u2192 \"Joining while the inviter is offline\"). The row is the request alone\n    -- and never changes; its outcome is a JoinSuccess or JoinFailure row keyed by this row's\n    -- stamp, so asking again (a fresh stamp) starts clean and a dismissal's tombstone retires\n    -- the outcome with the request. Invitation is a bearer credential, replicated in plaintext\n    -- to every machine the party owns, under the same accepted risk as JoinedStrand.\n    -- Owner-signed only; whether a machine that is not an owner may write here is\n    -- tickets/blocked/decide-non-owner-machine-completes-a-pending-join.md.\n    -- The three tables reference only tables declared before them, so an apply that fails\n    -- midway can drop them in reverse order. The two rules that would close a cycle are the\n    -- writer's (ControlDatabase): a request's delete takes its outcome row with it, and a join\n    -- recorded over a failure deletes the failure. An outcome row left behind is unreadable,\n    -- since readers start from the request.\n    table JoinRequest (\n        Id text primary key,            -- base64url sha256 of the invitation token (cadre-core pendingJoinId),\n                                        -- so the token never reaches Revocation\n        Invitation text,                -- CadreNode.encodeInvitation\n        Disclosure text,                -- canonicalJson of the disclosure the requester gave\n        RequestedAt integer,            -- epoch ms\n        ExpiresAt integer,              -- epoch ms; no attempt starts at or after it\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest('CadreControl.JoinRequest', 'add', party_id(), new.Id, new.Invitation, new.Disclosure, cast(new.RequestedAt as text), cast(new.ExpiresAt as text), new.StampId),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Reapable: the inviting party and the user hold the invitation too.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.JoinRequest', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'JoinRequest' and R.RowKey = old.Id and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- The outcome of a JoinRequest that joined: the strand the formation returned and, for a\n    -- closed strand, the single-use membership invitation it delivered. Keyed by the request's\n    -- stamp, so it names one request incarnation and a replayed approval can only re-seat the\n    -- row it approved, against the request it approved. A join is final: it may be recorded\n    -- over a failure (whose row the writer deletes with it), and nothing is recorded over it.\n    table JoinSuccess (\n        RequestStampId text primary key,\n        RecordedAt integer,             -- epoch ms\n        StrandId text,\n        MembershipInvite text null,     -- JSON {inviteKey, invitePrivateKey}, the StrandMembershipInvite; closed strands only\n        constraint RequestExists check on insert (\n            exists (select 1 from JoinRequest R where R.StampId = new.RequestStampId)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest('CadreControl.JoinSuccess', 'add', party_id(), new.RequestStampId, cast(new.RecordedAt as text), new.StrandId, coalesce(new.MembershipInvite, '')),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Removed only with its request: the tombstone retiring the request's stamp (owner-signed,\n        -- or already committed for a reap) authorizes this delete.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = old.RequestStampId)\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- The outcome of a JoinRequest that failed for good. Keyed as JoinSuccess is.\n    table JoinFailure (\n        RequestStampId text primary key,\n        RecordedAt integer,             -- epoch ms\n        Code text,                      -- a FormationRejectionCode, 'expired' or 'local'\n        Reason text,                    -- human-readable\n        constraint RequestExists check on insert (\n            exists (select 1 from JoinRequest R where R.StampId = new.RequestStampId)\n        ),\n        -- A join is final: nothing records a failure over it.\n        constraint NotJoined check on insert (\n            not exists (select 1 from JoinSuccess S where S.RequestStampId = new.RequestStampId)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest('CadreControl.JoinFailure', 'add', party_id(), new.RequestStampId, cast(new.RecordedAt as text), new.Code, new.Reason),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Removed with its request (JoinSuccess.AuthorizedDelete), or superseded by a join\n        -- recorded in the same transaction.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = old.RequestStampId)\n                or exists (select 1 from JoinSuccess S where S.RequestStampId = old.RequestStampId)\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A node of the cadre, carrying its self-published, freshness-stamped, self-signed address\n    -- record (cadre-core PeerAddressRecord): a resolver re-verifies Sig against PublicKey,\n    -- checks UpdatedAt and trust, then dials Multiaddr.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) behind PeerId; null if not ed25519\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update\n        Sig text null,                  -- self-signature over the 'publish' digest; null until self-published\n        StampId text unique,\n        VouchOwner text null,           -- the owner key that vouched this membership (== insert context.OwnerKey), or\n                                        -- the issuer of the invitation that admitted it (CadreInvite.IssuerKey)\n        VouchSig text null,             -- that owner's 'vouch' signature (== insert context.Signature); null on an\n                                        -- invitation-admitted row. A reader checks VouchOwner against its node-local\n                                        -- trusted-owner anchor, not against this replicated table, which a self-owner\n                                        -- can pollute.\n        VouchUsage text null,           -- the CadreInviteUsage.UsageStampId that admitted this row; null on an\n                                        -- owner-vouched row. A row carries exactly one proof: a signature or a usage.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        -- The owner vouches membership and the PublicKey<->PeerId binding (cadre-core derives\n        -- PublicKey from PeerId) over (PeerId, StampId); the stored voucher must be the pair\n        -- verified here. The same 'vouch' digest serves the owner branch of AuthorizedUpdate:\n        -- both mean \"this owner vouches this membership row\".\n        -- Or admitted by consent: a CadreInviteUsage row written in the same transaction names\n        -- this exact row incarnation (PeerId, StampId and PublicKey), and the invitation it\n        -- redeemed, read from committed.CadreInvite, was issued by the stored VouchOwner. The\n        -- usage row carries the liveness conditions (unexpired, not withdrawn, uses left,\n        -- issuer still an owner); this branch only requires that it exists. A reader verifies\n        -- the chain row -> usage -> invitation against its anchor (cadre-core\n        -- verifyInvitationAdmission), so the invitation row must outlive the rows it admitted.\n        -- A removed device may redeem a still-live invitation again and come back: keeping a\n        -- device out is removing its row AND withdrawing the invitation.\n        constraint AuthorizedInsert check on insert (\n            (\n                exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'vouch', party_id(), new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                and coalesce(new.VouchOwner, '') = context.OwnerKey\n                and coalesce(new.VouchSig, '') = context.Signature\n                and new.VouchUsage is null\n            )\n                or (\n                    new.VouchSig is null\n                    and new.VouchOwner is not null\n                    and new.VouchUsage is not null\n                    and exists (\n                        select 1 from CadreInviteUsage U\n                            where U.UsageStampId = new.VouchUsage\n                                and U.PeerId = new.PeerId\n                                and U.PeerStampId = new.StampId\n                                and U.PeerKey = new.PublicKey\n                                and exists (select 1 from committed.CadreInvite I where I.Key = U.InviteKey and I.IssuerKey = new.VouchOwner)\n                    )\n                )\n        ),\n        -- The stored 'vouch' voucher never authorizes a delete; the 'remove' signature rides in\n        -- context and is never stored. Or a reap (ValidationKey.AuthorizedDelete).\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'remove', party_id(), old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'CadrePeer' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        -- A peer re-publishes its own addrs and freshness under its own key (cadre-core\n        -- peer-record.ts); everything else is immutable and UpdatedAt must increase. Or an owner\n        -- re-vouches the row over its current stamp, which also clears VouchUsage: the row then\n        -- stands on the signature and its invitation is no longer consulted for it. StampId never\n        -- changes on update: an update that rotated it would leave the old stamp free and\n        -- untombstoned, so retiring a stamp is delete plus tombstone. The proof columns are\n        -- compared null-safe: VouchSig and VouchUsage are null on one of the two row kinds, and a\n        -- bare `new.X = old.X` over a null would let a self-publish fill the column in.\n        constraint AuthorizedUpdate check on update (\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.StampId = old.StampId\n                and new.VouchOwner = old.VouchOwner\n                and coalesce(new.VouchSig, '') = coalesce(old.VouchSig, '')\n                and coalesce(new.VouchUsage, '') = coalesce(old.VouchUsage, '')\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest('CadreControl.CadrePeer', 'publish', party_id(), new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text)),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                or (\n                    new.StampId = old.StampId\n                    and exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'vouch', party_id(), new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and coalesce(new.VouchOwner, '') = context.OwnerKey\n                    and coalesce(new.VouchSig, '') = context.Signature\n                    and new.VouchUsage is null\n                )\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- A mobile peer's platform push token, self-published so a server peer can push-wake a\n    -- suspended app. A resolver re-verifies Sig against the CadrePeer.PublicKey for PeerId\n    -- (cadre-core device-token.ts), checks freshness, then hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,\n        Platform text,                  -- 'fcm' | 'apns'\n        Token text,                     -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update\n        Sig text null,                  -- self-signature over the 'publish' digest\n        StampId text unique,\n        -- A resurrected token has no freshness ceiling to retire it (resolveDeviceToken defaults\n        -- maxAgeMs to infinity), so stamp retirement is what makes a clear stick.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        -- The owner signs the whole row, nullable columns as '', so a replayed approval can only\n        -- reproduce the row it approved (cadre-core peer-authorization.ts deviceTokenAddDigest).\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.DeviceToken', 'add', party_id(),\n                    new.PeerId,\n                    new.Platform,\n                    new.Token,\n                    coalesce(cast(new.UpdatedAt as text), ''),\n                    coalesce(new.Sig, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.DeviceToken', 'remove', party_id(), old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'DeviceToken' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        -- Self-update only: Platform and Token may change, PeerId and StampId may not, UpdatedAt\n        -- must increase. No owner re-touch branch: one outside the monotonicity rule would let a\n        -- captured approval roll UpdatedAt back; an owner correcting a row deletes and re-inserts.\n        constraint AuthorizedUpdate check on update (\n            new.PeerId = old.PeerId\n            and new.StampId = old.StampId\n            and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n            and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                    digest('CadreControl.DeviceToken', 'publish', party_id(), new.PeerId, new.Platform, new.Token, cast(new.UpdatedAt as text)),\n                    new.Sig, P.PublicKey, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party.\n    table FormationInvite (\n        Token text primary key,     -- a random string\n        sAppId text,                -- the app of the strand to be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,    -- web hook sent the disclosure; a ValidationKey then signs off each redemption\n        StrandId text null,         -- bound invite: the host strand consent is recorded against;\n                                    -- null: the responder provisions a fresh open strand per redemption\n        StampId text unique,\n        -- The owner signs the whole row, nullable columns as ''.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'add', party_id(),\n                    new.Token,\n                    new.sAppId,\n                    coalesce(cast(new.ExpiresAt as text), ''),\n                    coalesce(cast(new.TotalUses as text), ''),\n                    coalesce(new.ValidationUrl, ''),\n                    coalesce(new.StrandId, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'remove', party_id(),\n                    old.Token,\n                    old.sAppId,\n                    coalesce(cast(old.ExpiresAt as text), ''),\n                    coalesce(cast(old.TotalUses as text), ''),\n                    coalesce(old.ValidationUrl, ''),\n                    coalesce(old.StrandId, ''),\n                    old.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Insert and delete only, so the consent parameters cannot change under a signature.\n        constraint Immutable check on update (false)\n    ) with context (OwnerKey text, Signature text);\n\n    -- Append-only record of formation invite redemptions, one row per redemption.\n    table FormationUsage (\n        Token text,                 -- the FormationInvite redeemed\n        UsageStampId text,          -- single-use nonce minted by the joining peer, signed into its 'consent' digest\n                                    -- and the approver's 'vouch' digest. The primary key: this table never\n                                    -- deletes, so the key alone makes a nonce permanent and there is no\n                                    -- NotRevoked pair here. Two nodes that have not converged can each admit\n                                    -- the same nonce: a duplicated audit row, never a join nobody approved.\n        PeerKey text,               -- the joining peer's ed25519 public key (base64url); its peer id derives from it\n        PeerSig text,               -- the joiner's signature over the 'consent' digest (PeerConsented)\n        Disclosure text,\n        StrandId text,\n        StrandStampId text,         -- the Strand.StampId this consent names: one strand row, not an id forever\n                                    -- (Strand.AuthorizedInsert). Not unique: a bound invite's redeemers share\n                                    -- a host strand.\n        primary key (UsageStampId),\n        constraint InsertOnly check on update, delete (false),\n        -- The use cap counts the pre-transaction snapshot, so concurrent redeemers on separate\n        -- nodes can over-admit by their number; both rows survive and removal is owner-gated. A\n        -- strict per-token sequence was rejected: a lost race would silently drop a consented\n        -- join. Two usage rows for one token in one transaction read the same count; no writer\n        -- does that.\n        -- A ValidationUrl invite needs a sign-off verified against a STORED ValidationKey row;\n        -- context.ValidationKey only selects which row, so a redeemer cannot approve itself with\n        -- a throwaway key. The sign-off covers (Token, UsageStampId, StrandId, PeerKey,\n        -- Disclosure), so it buys exactly one row; StrandStampId is not bound because the\n        -- unbound path mints it inside the redeeming transaction. Removing the key later does\n        -- not revisit rows it approved.\n        -- A bound invite may only name its own host strand. An unbound invite may name any\n        -- existing strand, which burns a use and forecloses that id's consent-seating: harmless.\n        -- Neither digest of this table binds party_id(), alone in this schema: the joiner signs\n        -- its consent before the responder's party id reaches it (it arrives in the result\n        -- frame) and with a key made fresh for this one formation, and the outside approver\n        -- behind ValidationUrl is sent only the five fields below. Both digests bind the\n        -- invitation Token, a random secret seated in one party's FormationInvite table, so\n        -- replaying either in another party needs that party's owner to seat the same token in\n        -- its own database, and the only database harmed would be its own.\n        constraint Authorized check on insert (\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        and (FI.TotalUses is null or FI.TotalUses > (select count(1) from committed.FormationUsage U where U.Token = new.Token))\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        and (FI.ValidationUrl is null or exists (\n                            select 1 from ValidationKey VK\n                                where VK.Key = context.ValidationKey\n                                    and verify(digest('CadreControl.FormationUsage', 'vouch', new.Token, new.UsageStampId, new.StrandId, new.PeerKey, new.Disclosure), context.ValidationSignature, VK.Key, 'ed25519')))\n                        and (FI.StrandId is null or FI.StrandId = new.StrandId)\n            )\n        ),\n        -- A usage row may only name a strand row that exists, so a consent record cannot be held\n        -- in reserve to re-seat an id after its removal.\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId and S.StampId = new.StrandStampId)),\n        -- The joiner proves it agreed. PeerKey is its own key, so there is nothing for a writer to\n        -- substitute; stored on the row so any reader can re-check it (verifyFormationConsent).\n        -- StrandId and the party id are not signed: the joiner cannot know them when it signs\n        -- (Authorized, above).\n        constraint PeerConsented check on insert (\n            verify(digest('CadreControl.FormationUsage', 'consent',\n                          new.Token, new.UsageStampId, new.PeerKey, new.Disclosure),\n                   new.PeerSig, new.PeerKey, 'ed25519')\n        )\n    ) with context (Now datetime, ValidationKey text null, ValidationSignature text null);\n\n    -- Serves the per-token reads (the cap count above; cadre-core's countFormationUsage,\n    -- isTokenUsed and hasOutstandingFormationInvite) on an append-only table. Its cross-machine\n    -- convergence is guarded by the integration scenario strand-formation-concurrent-redemption.\n    index FormationUsageByToken on FormationUsage (Token);\n\n    -- An owner-signed invitation to join this cadre, redeemable on the owner's behalf by any\n    -- member machine (ControlDatabase.redeemCadreInvite). The invitation is a keypair, not a\n    -- bearer token: the row holds the public half and the holder proves possession by signing\n    -- with the private half (CadreInviteUsage.InvitePossessed), so the member that redeems it\n    -- can verify but never redeem it for itself. Rows are never deleted: a device admitted\n    -- through one carries no owner signature of its own, and its membership is the chain\n    -- invitation -> usage -> peer row, verified at read time, so the row must outlive every\n    -- device it admitted. Withdrawing an invitation is an owner-signed Revocation tombstone\n    -- over the row's stamp with the row kept (Revocation.RowIsGone); liveness is read as no\n    -- tombstone, unexpired, uses left, issuer still an owner (CadreInviteUsage.Authorized).\n    -- NOTE: expired and withdrawn rows accumulate for the life of the party; the same tripwire\n    -- as hasOutstandingFormationInvite applies (ControlDatabase.hasLiveCadreInvite). An owner\n    -- retires a device's dependency on its invitation by re-vouching the row (the owner branch\n    -- of CadrePeer.AuthorizedUpdate).\n    table CadreInvite (\n        Key text primary key,       -- the invitation's ed25519 public key (base64url)\n        PeerId text null,           -- the device this invitation is for; null: whoever redeems first designates it\n        GrantsOwner integer check (GrantsOwner = 0 or GrantsOwner = 1),   -- 1: redemption also seats an OwnerKey row\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        IssuerKey text,             -- the owner that signed the row (== insert context.OwnerKey). A reader checks it\n                                    -- against its node-local anchor, never against the replicated OwnerKey table.\n        IssuerSig text,             -- that owner's 'add' signature (== insert context.Signature), stored so any reader\n                                    -- can re-verify the row from the holder's copy or the replicated one\n        StampId text unique,\n        -- A withdrawn invitation cannot be re-seated from the signed copy its holder keeps, on\n        -- any node that holds the tombstone (schema header for the node that does not).\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'CadreInvite' and R.StampId = new.StampId)\n        ),\n        -- The owner signs the whole row, nullable columns as '' (cadre-core cadreInviteRowFields),\n        -- and the stored issuer pair must be the pair verified here, as CadrePeer pins its voucher.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.CadreInvite', 'add', party_id(),\n                    new.Key,\n                    coalesce(new.PeerId, ''),\n                    cast(new.GrantsOwner as text),\n                    coalesce(cast(new.ExpiresAt as text), ''),\n                    coalesce(cast(new.TotalUses as text), ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n            and coalesce(new.IssuerKey, '') = context.OwnerKey\n            and coalesce(new.IssuerSig, '') = context.Signature\n        ),\n        constraint NoUpdate check on update (false),\n        -- Never deleted (table comment). Withdrawal is the tombstone alone.\n        constraint NoDelete check on delete (false)\n    ) with context (OwnerKey text, Signature text);\n\n    -- Append-only record of cadre invitation redemptions, one row per redemption: the proof a\n    -- CadrePeer row (and, for an owner-granting invitation, an OwnerKey row) was admitted by\n    -- consent rather than by an owner signature.\n    table CadreInviteUsage (\n        UsageStampId text primary key,  -- nonce minted by the redeeming device and signed into both signatures\n                                        -- below. The primary key: this table never deletes, so the key alone\n                                        -- makes a nonce permanent and there is no NotRevoked pair here. Two nodes\n                                        -- that have not converged can each admit the same nonce (FormationUsage).\n        InviteKey text,                 -- the CadreInvite redeemed\n        PeerId text,                    -- the redeeming device: the identity multihash of PeerKey. The writer\n                                        -- asserts the pair and a reader re-derives it (verifyInvitationAdmission);\n                                        -- the schema cannot unwrap a multihash.\n        PeerKey text,                   -- the redeeming device's ed25519 public key (base64url)\n        PeerStampId text,               -- the CadrePeer.StampId this usage seats: one row incarnation, not a peer id\n                                        -- forever. Minted by the writer inside the redeeming transaction and not\n                                        -- signed (FormationUsage.StrandStampId).\n        OwnerStampId text null,         -- the OwnerKey.StampId this usage seats when the invitation grants ownership\n        InviteSig text,                 -- by the invitation's private key over the 'redeem' digest: proof of possession\n        PeerSig text,                   -- by PeerKey over the 'consent' digest: the device agreed to join\n        constraint InsertOnly check on update, delete (false),\n        -- The invitation is read from the pre-transaction snapshot, so an invitation cannot be\n        -- seated and redeemed in one transaction (the OwnerKey consent branch rests on that).\n        -- NOTE: accepted tradeoff \u2014 the use cap counts committed usage, so two redeemers racing\n        -- for a single-use invitation on different machines may both be admitted until merge,\n        -- and after merge both rows stand (FormationUsage.Authorized), for owner grants too.\n        -- Serializing would need cross-machine coordination the control plane does not have;\n        -- the mitigations are the defaults the redemption protocol sets (untargeted owner\n        -- invitations single-use with a short expiry), the targeted form for owner grants, and\n        -- the owner seeing the extra owner and removing it. Revisit if the control plane gains\n        -- a cross-machine sequencer. An issuer removed since issuing takes its outstanding\n        -- invitations with it (the committed.OwnerKey clause, which a tombstone alone\n        -- satisfies); devices it already admitted stay members.\n        constraint Authorized check on insert (\n            exists (\n                select 1 from committed.CadreInvite I\n                    where I.Key = new.InviteKey\n                        and not exists (select 1 from Revocation R where R.TableName = 'CadreInvite' and R.StampId = I.StampId)\n                        and (I.ExpiresAt is null or I.ExpiresAt > context.Now)\n                        and (I.TotalUses is null or I.TotalUses > (select count(1) from committed.CadreInviteUsage U where U.InviteKey = new.InviteKey))\n                        and (I.PeerId is null or I.PeerId = new.PeerId)\n                        and exists (select 1 from committed.OwnerKey K where K.Key = I.IssuerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = K.StampId))\n            )\n        ),\n        -- Verified against the invitation key itself: the member writing the row can check this\n        -- signature but, holding only the public half, cannot produce it.\n        constraint InvitePossessed check on insert (\n            verify(digest('CadreControl.CadreInviteUsage', 'redeem', party_id(), new.InviteKey, new.UsageStampId, new.PeerKey),\n                   new.InviteSig, new.InviteKey, 'ed25519')\n        ),\n        -- The device proves it agreed (FormationUsage.PeerConsented).\n        constraint PeerConsented check on insert (\n            verify(digest('CadreControl.CadreInviteUsage', 'consent', party_id(), new.InviteKey, new.UsageStampId, new.PeerKey),\n                   new.PeerSig, new.PeerKey, 'ed25519')\n        ),\n        -- Deferred, so the same-transaction peer insert counts: a usage row can never be held in\n        -- reserve to seat a row later (FormationUsage.StrandExists). PeerKey must be the key the\n        -- peer row stores: a redemption that only completes an already-admitted device with its\n        -- OwnerKey row (no peer insert to pin it) cannot name a key other than that device's.\n        constraint PeerExists check (exists (\n            select 1 from CadrePeer P where P.PeerId = new.PeerId and P.StampId = new.PeerStampId and P.PublicKey = new.PeerKey\n        )),\n        constraint OwnerExists check (\n            new.OwnerStampId is null\n                or exists (select 1 from OwnerKey K where K.Key = new.PeerKey and K.StampId = new.OwnerStampId)\n        )\n    ) with context (Now datetime);\n\n    -- Serves the cap count above and the liveness reads (cadre-core countCadreInviteUsage,\n    -- hasLiveCadreInvite) on an append-only table, as FormationUsageByToken does.\n    index CadreInviteUsageByInvite on CadreInviteUsage (InviteKey);\n\n    -- Append-only retirement record for the stamps of removed rows of every guarded table, with\n    -- the removed row's key. Every append is owner-signed, so the growth surface is the owner\n    -- keys. One singleton marker row, ('Revocation', 'ledger', 'opened'), retires nothing: an\n    -- owner's connected reconcile pass files it (ControlDatabase.openRevocationLedger) so this\n    -- table is never a never-written block, which the storage layer would consult the cohort\n    -- for on every guarded insert and membership lookup. Readers filter on their own guarded\n    -- TableName, and queryRevocations skips it. A 'CadreInvite' row withdraws an invitation\n    -- whose row stays (CadreInvite table comment).\n    table Revocation (\n        TableName text,             -- 'OwnerKey' | 'ValidationKey' | 'Strand' | 'StrandPartyKey' | 'JoinedStrand' |\n                                    -- 'JoinRequest' | 'CadrePeer' | 'DeviceToken' | 'CadreInvite', or 'Revocation'\n                                    -- for the marker\n        RowKey text,                -- primary key of the removed row\n        StampId text,               -- the retired stamp\n        ReissuedAt integer default 0,   -- bumped by an owner-signed re-issue so a tombstone committed while the\n                                        -- node was alone can be re-written and so re-broadcast; nothing reads it\n        SignerKey text null,        -- the owner that filed the tombstone (== insert context.OwnerKey)\n        SignerSig text null,        -- that owner's 'remove' signature (== insert context.Signature). A node that\n                                    -- received the row by replication re-verifies the pair and judges SignerKey\n                                    -- against its node-local trusted-owner anchor (cadre-core\n                                    -- verifyRevocationSigner), not against this replicated table.\n        -- Keyed on the stamp: one row key may carry several tombstones over its life.\n        primary key (TableName, StampId),\n        -- Retirement is permanent.\n        constraint NoDelete check on delete (false),\n        -- Pinned at 0 so an owner cannot seat a tombstone at a counter its own re-issues cannot pass.\n        constraint FreshTombstone check on insert (new.ReissuedAt = 0),\n        -- A re-issue moves nothing but the counter, and only upward. The signer pair stays the\n        -- filing owner's; the re-issuing owner's signature rides in context only.\n        constraint ReissueOnly check on update (\n            new.TableName = old.TableName and new.RowKey = old.RowKey\n                and new.StampId = old.StampId and new.ReissuedAt > old.ReissuedAt\n                and coalesce(new.SignerKey, '') = coalesce(old.SignerKey, '')\n                and coalesce(new.SignerSig, '') = coalesce(old.SignerSig, '')\n        ),\n        -- A stamp is retired only once its row is gone (deferred, so the same-transaction delete\n        -- counts). Keyed on the stamp, not RowKey: a node that converges on a re-admission before\n        -- the earlier removal's tombstone must still accept that tombstone. Retiring a stamp that\n        -- never existed is harmless: stamps carry 128 random bits (generateStampId). For\n        -- 'CadreInvite' there is no row-gone test: a tombstone there is a withdrawal, and the\n        -- row stays (CadreInvite table comment). The last branch admits the marker row and\n        -- nothing else under 'Revocation'.\n        constraint RowIsGone check on insert (\n            (new.TableName = 'OwnerKey' and not exists (select 1 from OwnerKey K where K.StampId = new.StampId))\n                or (new.TableName = 'CadrePeer' and not exists (select 1 from CadrePeer P where P.StampId = new.StampId))\n                or (new.TableName = 'ValidationKey' and not exists (select 1 from ValidationKey V where V.StampId = new.StampId))\n                or (new.TableName = 'Strand' and not exists (select 1 from Strand S where S.StampId = new.StampId))\n                or (new.TableName = 'StrandPartyKey' and not exists (select 1 from StrandPartyKey K where K.StampId = new.StampId))\n                or (new.TableName = 'JoinedStrand' and not exists (select 1 from JoinedStrand J where J.StampId = new.StampId))\n                or (new.TableName = 'JoinRequest' and not exists (select 1 from JoinRequest J where J.StampId = new.StampId))\n                or (new.TableName = 'DeviceToken' and not exists (select 1 from DeviceToken D where D.StampId = new.StampId))\n                or (new.TableName = 'CadreInvite')\n                or (new.TableName = 'Revocation' and new.RowKey = 'ledger' and new.StampId = 'opened')\n        ),\n        -- Owner-signed over the whole row under its own domain tag, so the delete's 'remove'\n        -- signature filed in the same transaction never doubles as the tombstone's. Ungated, any\n        -- writer could evict a peer party-wide and block its re-admission. RowKey is not checked\n        -- against the retired row here (that would reject a tombstone re-issued later, or filed on\n        -- a node that never held the row); each guarded table's RevocationRecorded binds it\n        -- instead. Reads live OwnerKey like the sibling tables. The marker is signed under this\n        -- rule too, over ('Revocation', 'ledger', 'opened'). The stored signer pair must be the\n        -- pair verified here.\n        constraint Authorized check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Revocation', 'remove', party_id(), new.TableName, new.RowKey, new.StampId), context.Signature, A.Key, 'ed25519'))\n                and coalesce(new.SignerKey, '') = context.OwnerKey\n                and coalesce(new.SignerSig, '') = context.Signature\n        ),\n        -- Distinct 'reissue' tag, binding ReissuedAt, so neither approval replays as the other.\n        constraint AuthorizedReissue check on update (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey\n                and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId)\n                and verify(digest('CadreControl.Revocation', 'reissue', party_id(),\n                                  new.TableName, new.RowKey, new.StampId, cast(new.ReissuedAt as text)),\n                           context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n}\n\napply schema CadreControl;\n";
+export declare const CONTROL_SCHEMA = "-- A Sereus party's cadre (its nodes) and their participation in strands (networks).\n--\n-- Every write is authorized by a check: an owner signs an action-tagged digest of the row\n-- (cadre-core control-authorization.ts), or a peer signs its own record. Each digest leads\n-- with a 'CadreControl.<Table>' domain tag, an action tag and party_id(), the party this\n-- machine is configured for (a zero-argument function ControlDatabase registers on its own\n-- engine, never read from a context value or a replicated table), so an approval verifies\n-- only against the one rule, in the one party, it was minted for: two parties that share\n-- an owner key never accept each other's approvals. FormationUsage is the exception, its\n-- two digests scoped by the invitation token instead (FormationUsage.Authorized).\n--\n-- Rows of the guarded tables (OwnerKey, ValidationKey, Strand, StrandPartyKey, JoinedStrand,\n-- JoinRequest, CadrePeer, DeviceToken, CadreInvite) carry a one-off StampId bound into their\n-- add and remove digests. `unique` holds over live rows only, so a delete retires the stamp\n-- into Revocation in the same transaction (RevocationRecorded) and an insert refuses a retired\n-- stamp (NotRevoked): the never-expiring add approval cannot re-seat a removed row. A\n-- legitimate re-add mints a fresh stamp and a fresh signature. CadreInvite is the one guarded\n-- table that is never deleted: its tombstone withdraws the invitation while the row stays,\n-- because the rows it admitted prove their membership through it.\n--\n-- A check whose expression evaluates to null passes (SQL three-valued logic), so every\n-- comparison over a nullable column that is meant to pin a value is written null-safe\n-- (`coalesce(col, '')` or an explicit `is null`); a bare `new.Col = context.X` over a null\n-- column would pass with nothing pinned.\n--\n-- A check with a subquery defers to commit, so a sibling row written in the same transaction\n-- is visible to it; `committed.<Table>` reads the pre-transaction snapshot instead. Every\n-- check reads the rows this node holds: a node that has not converged on a Revocation row\n-- still accepts the replayed add, and the resurrected row then coexists with its tombstone.\n-- ControlDatabase drops retired stamps on the reads that matter (queryCadrePeers,\n-- queryPendingJoins, getOwnerKeys), and every owner lookup in the checks below drops them\n-- too (the `not exists ... Revocation` conjunct beside each OwnerKey read, reading live\n-- Revocation so a tombstone filed in the same transaction counts), so a removal is\n-- effective at the writer as soon as its tombstone arrives, whether or not the row's delete\n-- has. Only the founding count in OwnerKey.Authorized stays raw.\ndeclare schema CadreControl {\n    -- A key that can authorize control changes. A row is seated one of three ways, told apart\n    -- by the vouch columns: the founding row (all three null), an owner-signed add (VouchOwner\n    -- and VouchSig pinned to the insert context, VouchUsage null), or an owner-granting\n    -- invitation redeemed by consent (VouchOwner = the invitation's IssuerKey, VouchSig null,\n    -- VouchUsage = the CadreInviteUsage row that admitted it). A reader judges the stored proof\n    -- against its node-local anchor, never against this replicated table.\n    table OwnerKey (\n        Key text primary key,\n        StampId text unique,\n        VouchOwner text null,\n        VouchSig text null,\n        VouchUsage text null,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = new.StampId)\n        ),\n        -- The tombstone must name the removed row, not just its stamp (Revocation.RowKey).\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        -- Every other table's checks require an owner, so an empty table is a permanent denial of\n        -- the party's control plane. Counted post-delete, on this node's rows only: two partitioned\n        -- nodes removing different owners can still converge to zero.\n        constraint MinOneOwner check on delete (\n            (select count(1) from OwnerKey) >= 1\n        ),\n        -- Rotation is add-then-remove. An update branch would let the sole owner be re-pointed at\n        -- another key under a post-image count of one.\n        constraint NoUpdate check on update (false),\n        -- The authorizer is read from the pre-transaction snapshot: the check defers to commit, by\n        -- which point the inserted row (and any sibling) is live, so a plain OwnerKey read would let\n        -- a row authorize itself or two strangers seat each other. The founding transaction, whose\n        -- pre-transaction owner set is empty, needs no authorization; gating on the pre-transaction\n        -- count keeps a same-transaction swap of the sole owner off that branch. That count is\n        -- deliberately raw, the one owner read here that ignores Revocation: a machine holding only\n        -- a retired owner row must still be refused a second genesis, or a removed device could\n        -- re-found the party on its own copy. An owner cannot sign its own removal.\n        -- The consent branch seats an owner with no signature at all: a CadreInviteUsage row\n        -- written in the same transaction names this exact row (Key and stamp), and the\n        -- invitation it redeemed grants ownership and was issued by the stored VouchOwner. The\n        -- invitation is read from committed.CadreInvite, so an invitation cannot be seated and\n        -- redeemed in one transaction; the usage row carries the liveness conditions.\n        constraint Authorized check on insert, delete (\n            (old.Key is null and (select count(1) from committed.OwnerKey) = 0\n                and new.VouchOwner is null and new.VouchSig is null and new.VouchUsage is null)\n                or (old.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.OwnerKey', 'add', party_id(), new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and coalesce(new.VouchOwner, '') = context.OwnerKey\n                    and coalesce(new.VouchSig, '') = context.Signature\n                    and new.VouchUsage is null)\n                or (old.Key is null and new.VouchSig is null and new.VouchUsage is not null\n                    and exists (\n                        select 1 from CadreInviteUsage U\n                            where U.UsageStampId = new.VouchUsage\n                                and U.PeerKey = new.Key\n                                and U.OwnerStampId = new.StampId\n                                and exists (select 1 from committed.CadreInvite I where I.Key = U.InviteKey and I.GrantsOwner = 1 and I.IssuerKey = new.VouchOwner)\n                    ))\n                or (new.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and A.Key <> old.Key and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.OwnerKey', 'remove', party_id(), old.Key, old.StampId), context.Signature, A.Key, 'ed25519')))\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure (FormationUsage.Authorized).\n    table ValidationKey (\n        Key text primary key,\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.ValidationKey', 'add', party_id(), new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Owner-signed over the stored row, or a reap: a committed tombstone naming this exact row\n        -- incarnation lets a node that was offline at removal time delete the stale row unsigned\n        -- (ControlDatabase.reapRevokedRow). committed.*, so a tombstone filed in this transaction\n        -- cannot stand in for the signature; the stamp clause, so a tombstone of an earlier\n        -- incarnation cannot remove the current one.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.ValidationKey', 'remove', party_id(), old.Key, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'ValidationKey' and R.RowKey = old.Key and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing its cadre's peers. This\n    -- party's own strands; a strand joined from another party is a JoinedStrand row.\n    table Strand (\n        Id text primary key,                -- UUID\n        MemberPrivateKey text null unique,  -- the strand's shared read secret; closed strands only\n        Type text,                          -- 'o' open | 'c' closed: open gates writes in the sApp, only closed gates reads\n        FounderOwnerKey text null,          -- owner key of the machine that published the row, the founding machine\n                                            -- (cadre-node.ts launchStrand); null on a consent-seated strand, whose\n                                            -- insert carries no signature. Provenance, not content (strandRowMismatches).\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        -- The consent branch below carries no signature, so an update rule would let anyone rewrite\n        -- a consent-seated strand.\n        constraint NoUpdate check on update (false),\n        -- Owner-signed, with FounderOwnerKey pinned to the verified signer; or consent-seated by a\n        -- FormationUsage row naming this exact row (id and stamp), written in the same transaction\n        -- (ControlDatabase.redeemInvitation). Binding the stamp is what makes a removal stick:\n        -- the usage row outlives the strand, and keyed on the id alone it would re-authorize an\n        -- unsigned re-seat under a fresh stamp. The consent branch is narrow, each clause closing\n        -- one door:\n        --   * open and keyless: a closed strand with a caller-chosen read secret has no legitimate\n        --     producer;\n        --   * through an unbound invite only: a bound invite's host strand is owner-provisioned,\n        --     and consent-seating its id would downgrade the real row on a node it has not reached;\n        --   * no usage row under another stamp, and no tombstone for the id: an id is consent-seated\n        --     once, ever, and never after any removal. Re-joining a removed id is owner-signed.\n        -- A standalone tombstone (no accompanying delete, Revocation.Authorized) lets an owner\n        -- foreclose consent-seating of an id that never existed: owner-only, and ids are random.\n        constraint AuthorizedInsert check on insert (\n            (exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Strand', 'add', party_id(), new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n                and new.FounderOwnerKey = context.OwnerKey)\n                or (\n                    new.Type = 'o'\n                    and new.MemberPrivateKey is null\n                    and new.FounderOwnerKey is null\n                    and exists (\n                        select 1 from FormationUsage FU\n                            where FU.StrandId = new.Id\n                                and FU.StrandStampId = new.StampId\n                                and exists (select 1 from FormationInvite FI where FI.Token = FU.Token and FI.StrandId is null)\n                    )\n                    and not exists (\n                        select 1 from FormationUsage FU2\n                            where FU2.StrandId = new.Id and FU2.StrandStampId <> new.StampId\n                    )\n                    and not exists (\n                        select 1 from Revocation R\n                            where R.TableName = 'Strand' and R.RowKey = new.Id\n                    )\n                )\n        ),\n        -- No consent branch (an invitation forms a strand, never destroys one) and no reap branch:\n        -- MemberPrivateKey is stored nowhere else, so this delete is unrecoverable\n        -- (tickets/backlog/debt-strand-tombstone-reap.md owns any change).\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Strand', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- An open strand has no membership gate, so no member key.\n        constraint MemberKeyClosedOnly check (\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- This party's own membership identity for one strand: the private key whose public half\n    -- seats its Strand.Member / Strand.Manager rows. Separate from Strand.MemberPrivateKey, which\n    -- every joining party receives and so could forge (gotchoices/sereus#4). A side table because\n    -- a joiner holds no Strand row. Replicated in plaintext to every machine the party owns\n    -- (docs/strands.md \u2192 \"Closed-Strand Member Key Handling\") but never put on the formation wire.\n    table StrandPartyKey (\n        Id text primary key,        -- the strand id\n        PrivateKey text,            -- ed25519, base64 protobuf, as Strand.MemberPrivateKey (cadre-core strandMemberKeyPair)\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'StrandPartyKey' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'StrandPartyKey' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        constraint NoUpdate check on update (false),\n        -- Binding PrivateKey means a captured approval can only reproduce the key it approved.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.StrandPartyKey', 'add', party_id(), new.Id, new.PrivateKey, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- No reap branch: the key is stored nowhere else (as Strand.AuthorizedDelete).\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.StrandPartyKey', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A strand this party joined from another party, whose control database holds the Strand\n    -- row. Every machine of the party reads it, so a replica host keeps a copy and the party's\n    -- other machines can attach. A separate table because every reader of Strand takes it to\n    -- mean this party's own strand. MemberPrivateKey is held by the founding party and every\n    -- member, so a removed row is recoverable by re-forming, which is why this table has a reap\n    -- branch (unlike Strand and StrandPartyKey).\n    table JoinedStrand (\n        Id text primary key,            -- the founder's Strand.Id\n        Type text,                      -- 'o' | 'c', as Strand.Type\n        MemberPrivateKey text null,     -- the closed strand's shared read secret\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'JoinedStrand' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinedStrand' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        constraint NoUpdate check on update (false),\n        -- Readers cast Type (ControlDatabase.queryJoinedStrands).\n        constraint KnownType check (new.Type = 'o' or new.Type = 'c'),\n        constraint MemberKeyClosedOnly check (new.MemberPrivateKey is null or new.Type = 'c'),\n        -- Owner-signed only: every always-on machine of the party downloads the strands named\n        -- here, so a machine that is not an owner keeps its joins machine-local.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.JoinedStrand', 'add', party_id(), new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.JoinedStrand', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'JoinedStrand' and R.RowKey = old.Id and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A join this party asked for by redeeming another party's invitation, kept party-wide so\n    -- the request outlives the device that asked and any owner machine can carry it on\n    -- (docs/strands.md \u2192 \"Joining while the inviter is offline\"). The row is the request alone\n    -- and never changes; its outcome is a JoinSuccess or JoinFailure row keyed by this row's\n    -- stamp, so asking again (a fresh stamp) starts clean and a dismissal's tombstone retires\n    -- the outcome with the request. Invitation is a bearer credential, replicated in plaintext\n    -- to every machine the party owns, under the same accepted risk as JoinedStrand.\n    -- Owner-signed only; whether a machine that is not an owner may write here is\n    -- tickets/blocked/decide-non-owner-machine-completes-a-pending-join.md.\n    -- The three tables reference only tables declared before them, so an apply that fails\n    -- midway can drop them in reverse order. The two rules that would close a cycle are the\n    -- writer's (ControlDatabase): a request's delete takes its outcome row with it, and a join\n    -- recorded over a failure deletes the failure. An outcome row left behind is unreadable,\n    -- since readers start from the request.\n    table JoinRequest (\n        Id text primary key,            -- base64url sha256 of the invitation token (cadre-core pendingJoinId),\n                                        -- so the token never reaches Revocation\n        Invitation text,                -- CadreNode.encodeInvitation\n        Disclosure text,                -- canonicalJson of the disclosure the requester gave\n        RequestedAt integer,            -- epoch ms\n        ExpiresAt integer,              -- epoch ms; no attempt starts at or after it\n        StampId text unique,\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest('CadreControl.JoinRequest', 'add', party_id(), new.Id, new.Invitation, new.Disclosure, cast(new.RequestedAt as text), cast(new.ExpiresAt as text), new.StampId),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Reapable: the inviting party and the user hold the invitation too.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.JoinRequest', 'remove', party_id(), old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'JoinRequest' and R.RowKey = old.Id and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- The outcome of a JoinRequest that joined: the strand the formation returned and, for a\n    -- closed strand, the single-use membership invitation it delivered. Keyed by the request's\n    -- stamp, so it names one request incarnation and a replayed approval can only re-seat the\n    -- row it approved, against the request it approved. A join is final: it may be recorded\n    -- over a failure (whose row the writer deletes with it), and nothing is recorded over it.\n    table JoinSuccess (\n        RequestStampId text primary key,\n        RecordedAt integer,             -- epoch ms\n        StrandId text,\n        MembershipInvite text null,     -- JSON {inviteKey, invitePrivateKey}, the StrandMembershipInvite; closed strands only\n        constraint RequestExists check on insert (\n            exists (select 1 from JoinRequest R where R.StampId = new.RequestStampId)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest('CadreControl.JoinSuccess', 'add', party_id(), new.RequestStampId, cast(new.RecordedAt as text), new.StrandId, coalesce(new.MembershipInvite, '')),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Removed only with its request: the tombstone retiring the request's stamp (owner-signed,\n        -- or already committed for a reap) authorizes this delete.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = old.RequestStampId)\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- The outcome of a JoinRequest that failed for good. Keyed as JoinSuccess is.\n    table JoinFailure (\n        RequestStampId text primary key,\n        RecordedAt integer,             -- epoch ms\n        Code text,                      -- a FormationRejectionCode, 'expired' or 'local'\n        Reason text,                    -- human-readable\n        constraint RequestExists check on insert (\n            exists (select 1 from JoinRequest R where R.StampId = new.RequestStampId)\n        ),\n        -- A join is final: nothing records a failure over it.\n        constraint NotJoined check on insert (\n            not exists (select 1 from JoinSuccess S where S.RequestStampId = new.RequestStampId)\n        ),\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest('CadreControl.JoinFailure', 'add', party_id(), new.RequestStampId, cast(new.RecordedAt as text), new.Code, new.Reason),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Removed with its request (JoinSuccess.AuthorizedDelete), or superseded by a join\n        -- recorded in the same transaction.\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'JoinRequest' and R.StampId = old.RequestStampId)\n                or exists (select 1 from JoinSuccess S where S.RequestStampId = old.RequestStampId)\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A node of the cadre, carrying its self-published, freshness-stamped, self-signed address\n    -- record (cadre-core PeerAddressRecord): a resolver re-verifies Sig against PublicKey,\n    -- checks UpdatedAt and trust, then dials Multiaddr.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) behind PeerId; null if not ed25519\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update\n        Sig text null,                  -- self-signature over the 'publish' digest; null until self-published\n        StampId text unique,\n        VouchOwner text null,           -- the owner key that vouched this membership (== insert context.OwnerKey), or\n                                        -- the issuer of the invitation that admitted it (CadreInvite.IssuerKey)\n        VouchSig text null,             -- that owner's 'vouch' signature (== insert context.Signature); null on an\n                                        -- invitation-admitted row. A reader checks VouchOwner against its node-local\n                                        -- trusted-owner anchor, not against this replicated table, which a self-owner\n                                        -- can pollute.\n        VouchUsage text null,           -- the CadreInviteUsage.UsageStampId that admitted this row; null on an\n                                        -- owner-vouched row. A row carries exactly one proof: a signature or a usage.\n        Profile text null,              -- the machine's own node profile (cadre-core NodeProfile): 'transaction' is an\n                                        -- app (phone, browser), 'storage' an always-on node; null until it self-publishes.\n                                        -- Self-declared and covered by Sig. No insert rule constrains it: an owner could\n                                        -- only mislabel a machine it already has full authority over, and that machine's\n                                        -- next self-publish corrects it.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = new.StampId)\n        ),\n        constraint KnownProfile check (new.Profile is null or new.Profile in ('transaction', 'storage')),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        -- The owner vouches membership and the PublicKey<->PeerId binding (cadre-core derives\n        -- PublicKey from PeerId) over (PeerId, StampId); the stored voucher must be the pair\n        -- verified here. The same 'vouch' digest serves the owner branch of AuthorizedUpdate:\n        -- both mean \"this owner vouches this membership row\".\n        -- Or admitted by consent: a CadreInviteUsage row written in the same transaction names\n        -- this exact row incarnation (PeerId, StampId and PublicKey), and the invitation it\n        -- redeemed, read from committed.CadreInvite, was issued by the stored VouchOwner. The\n        -- usage row carries the liveness conditions (unexpired, not withdrawn, uses left,\n        -- issuer still an owner); this branch only requires that it exists. A reader verifies\n        -- the chain row -> usage -> invitation against its anchor (cadre-core\n        -- verifyInvitationAdmission), so the invitation row must outlive the rows it admitted.\n        -- A removed device may redeem a still-live invitation again and come back: keeping a\n        -- device out is removing its row AND withdrawing the invitation.\n        constraint AuthorizedInsert check on insert (\n            (\n                exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'vouch', party_id(), new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                and coalesce(new.VouchOwner, '') = context.OwnerKey\n                and coalesce(new.VouchSig, '') = context.Signature\n                and new.VouchUsage is null\n            )\n                or (\n                    new.VouchSig is null\n                    and new.VouchOwner is not null\n                    and new.VouchUsage is not null\n                    and exists (\n                        select 1 from CadreInviteUsage U\n                            where U.UsageStampId = new.VouchUsage\n                                and U.PeerId = new.PeerId\n                                and U.PeerStampId = new.StampId\n                                and U.PeerKey = new.PublicKey\n                                and exists (select 1 from committed.CadreInvite I where I.Key = U.InviteKey and I.IssuerKey = new.VouchOwner)\n                    )\n                )\n        ),\n        -- The stored 'vouch' voucher never authorizes a delete; the 'remove' signature rides in\n        -- context and is never stored. Or a reap (ValidationKey.AuthorizedDelete).\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'remove', party_id(), old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'CadrePeer' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        -- A peer re-publishes its own addrs, profile and freshness under its own key (cadre-core\n        -- peer-record.ts); everything else is immutable and UpdatedAt must increase. Or an owner\n        -- re-vouches the row over its current stamp, which also clears VouchUsage: the row then\n        -- stands on the signature and its invitation is no longer consulted for it. The owner\n        -- branch keeps what the machine itself declares (PublicKey, Multiaddr, Sig, Profile): the\n        -- row's stored VouchSig is a valid re-vouch signature, so any machine holding the row can\n        -- take this branch. NOTE: it may still bump UpdatedAt (reauthorizeCadrePeer's re-broadcast\n        -- needs it), which on a self-published row leaves Sig unverifiable until the machine's\n        -- next heartbeat re-signs past it; if that window ever matters, pin UpdatedAt here when\n        -- old.Sig is not null. StampId never\n        -- changes on update: an update that rotated it would leave the old stamp free and\n        -- untombstoned, so retiring a stamp is delete plus tombstone. The proof columns are\n        -- compared null-safe: VouchSig and VouchUsage are null on one of the two row kinds, and a\n        -- bare `new.X = old.X` over a null would let a self-publish fill the column in.\n        constraint AuthorizedUpdate check on update (\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.StampId = old.StampId\n                and new.VouchOwner = old.VouchOwner\n                and coalesce(new.VouchSig, '') = coalesce(old.VouchSig, '')\n                and coalesce(new.VouchUsage, '') = coalesce(old.VouchUsage, '')\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest('CadreControl.CadrePeer', 'publish', party_id(), new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text), coalesce(new.Profile, '')),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                or (\n                    new.StampId = old.StampId\n                    and exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'vouch', party_id(), new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and coalesce(new.VouchOwner, '') = context.OwnerKey\n                    and coalesce(new.VouchSig, '') = context.Signature\n                    and new.VouchUsage is null\n                    and coalesce(new.PublicKey, '') = coalesce(old.PublicKey, '')\n                    and coalesce(new.Multiaddr, '') = coalesce(old.Multiaddr, '')\n                    and coalesce(new.Sig, '') = coalesce(old.Sig, '')\n                    and coalesce(new.Profile, '') = coalesce(old.Profile, '')\n                )\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- A mobile peer's platform push token, self-published so a server peer can push-wake a\n    -- suspended app. A resolver re-verifies Sig against the CadrePeer.PublicKey for PeerId\n    -- (cadre-core device-token.ts), checks freshness, then hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,\n        Platform text,                  -- 'fcm' | 'apns'\n        Token text,                     -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update\n        Sig text null,                  -- self-signature over the 'publish' digest\n        StampId text unique,\n        -- A resurrected token has no freshness ceiling to retire it (resolveDeviceToken defaults\n        -- maxAgeMs to infinity), so stamp retirement is what makes a clear stick.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = new.StampId)\n        ),\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        -- The owner signs the whole row, nullable columns as '', so a replayed approval can only\n        -- reproduce the row it approved (cadre-core peer-authorization.ts deviceTokenAddDigest).\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.DeviceToken', 'add', party_id(),\n                    new.PeerId,\n                    new.Platform,\n                    new.Token,\n                    coalesce(cast(new.UpdatedAt as text), ''),\n                    coalesce(new.Sig, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.DeviceToken', 'remove', party_id(), old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n                or exists (select 1 from committed.Revocation R where R.TableName = 'DeviceToken' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        -- Self-update only: Platform and Token may change, PeerId and StampId may not, UpdatedAt\n        -- must increase. No owner re-touch branch: one outside the monotonicity rule would let a\n        -- captured approval roll UpdatedAt back; an owner correcting a row deletes and re-inserts.\n        constraint AuthorizedUpdate check on update (\n            new.PeerId = old.PeerId\n            and new.StampId = old.StampId\n            and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n            and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                    digest('CadreControl.DeviceToken', 'publish', party_id(), new.PeerId, new.Platform, new.Token, cast(new.UpdatedAt as text)),\n                    new.Sig, P.PublicKey, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party.\n    table FormationInvite (\n        Token text primary key,     -- a random string\n        sAppId text,                -- the app of the strand to be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,    -- web hook sent the disclosure; a ValidationKey then signs off each redemption\n        StrandId text null,         -- bound invite: the host strand consent is recorded against;\n                                    -- null: the responder provisions a fresh open strand per redemption\n        StampId text unique,\n        -- The owner signs the whole row, nullable columns as ''.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'add', party_id(),\n                    new.Token,\n                    new.sAppId,\n                    coalesce(cast(new.ExpiresAt as text), ''),\n                    coalesce(cast(new.TotalUses as text), ''),\n                    coalesce(new.ValidationUrl, ''),\n                    coalesce(new.StrandId, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'remove', party_id(),\n                    old.Token,\n                    old.sAppId,\n                    coalesce(cast(old.ExpiresAt as text), ''),\n                    coalesce(cast(old.TotalUses as text), ''),\n                    coalesce(old.ValidationUrl, ''),\n                    coalesce(old.StrandId, ''),\n                    old.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Insert and delete only, so the consent parameters cannot change under a signature.\n        constraint Immutable check on update (false)\n    ) with context (OwnerKey text, Signature text);\n\n    -- Append-only record of formation invite redemptions, one row per redemption.\n    table FormationUsage (\n        Token text,                 -- the FormationInvite redeemed\n        UsageStampId text,          -- single-use nonce minted by the joining peer, signed into its 'consent' digest\n                                    -- and the approver's 'vouch' digest. The primary key: this table never\n                                    -- deletes, so the key alone makes a nonce permanent and there is no\n                                    -- NotRevoked pair here. Two nodes that have not converged can each admit\n                                    -- the same nonce: a duplicated audit row, never a join nobody approved.\n        PeerKey text,               -- the joining peer's ed25519 public key (base64url); its peer id derives from it\n        PeerSig text,               -- the joiner's signature over the 'consent' digest (PeerConsented)\n        Disclosure text,\n        StrandId text,\n        StrandStampId text,         -- the Strand.StampId this consent names: one strand row, not an id forever\n                                    -- (Strand.AuthorizedInsert). Not unique: a bound invite's redeemers share\n                                    -- a host strand.\n        primary key (UsageStampId),\n        constraint InsertOnly check on update, delete (false),\n        -- The use cap counts the pre-transaction snapshot, so concurrent redeemers on separate\n        -- nodes can over-admit by their number; both rows survive and removal is owner-gated. A\n        -- strict per-token sequence was rejected: a lost race would silently drop a consented\n        -- join. Two usage rows for one token in one transaction read the same count; no writer\n        -- does that.\n        -- A ValidationUrl invite needs a sign-off verified against a STORED ValidationKey row;\n        -- context.ValidationKey only selects which row, so a redeemer cannot approve itself with\n        -- a throwaway key. The sign-off covers (Token, UsageStampId, StrandId, PeerKey,\n        -- Disclosure), so it buys exactly one row; StrandStampId is not bound because the\n        -- unbound path mints it inside the redeeming transaction. Removing the key later does\n        -- not revisit rows it approved.\n        -- A bound invite may only name its own host strand. An unbound invite may name any\n        -- existing strand, which burns a use and forecloses that id's consent-seating: harmless.\n        -- Neither digest of this table binds party_id(), alone in this schema: the joiner signs\n        -- its consent before the responder's party id reaches it (it arrives in the result\n        -- frame) and with a key made fresh for this one formation, and the outside approver\n        -- behind ValidationUrl is sent only the five fields below. Both digests bind the\n        -- invitation Token, a random secret seated in one party's FormationInvite table, so\n        -- replaying either in another party needs that party's owner to seat the same token in\n        -- its own database, and the only database harmed would be its own.\n        constraint Authorized check on insert (\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        and (FI.TotalUses is null or FI.TotalUses > (select count(1) from committed.FormationUsage U where U.Token = new.Token))\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        and (FI.ValidationUrl is null or exists (\n                            select 1 from ValidationKey VK\n                                where VK.Key = context.ValidationKey\n                                    and verify(digest('CadreControl.FormationUsage', 'vouch', new.Token, new.UsageStampId, new.StrandId, new.PeerKey, new.Disclosure), context.ValidationSignature, VK.Key, 'ed25519')))\n                        and (FI.StrandId is null or FI.StrandId = new.StrandId)\n            )\n        ),\n        -- A usage row may only name a strand row that exists, so a consent record cannot be held\n        -- in reserve to re-seat an id after its removal.\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId and S.StampId = new.StrandStampId)),\n        -- The joiner proves it agreed. PeerKey is its own key, so there is nothing for a writer to\n        -- substitute; stored on the row so any reader can re-check it (verifyFormationConsent).\n        -- StrandId and the party id are not signed: the joiner cannot know them when it signs\n        -- (Authorized, above).\n        constraint PeerConsented check on insert (\n            verify(digest('CadreControl.FormationUsage', 'consent',\n                          new.Token, new.UsageStampId, new.PeerKey, new.Disclosure),\n                   new.PeerSig, new.PeerKey, 'ed25519')\n        )\n    ) with context (Now datetime, ValidationKey text null, ValidationSignature text null);\n\n    -- Serves the per-token reads (the cap count above; cadre-core's countFormationUsage,\n    -- isTokenUsed and hasOutstandingFormationInvite) on an append-only table. Its cross-machine\n    -- convergence is guarded by the integration scenario strand-formation-concurrent-redemption.\n    index FormationUsageByToken on FormationUsage (Token);\n\n    -- An owner-signed invitation to join this cadre, redeemable on the owner's behalf by any\n    -- member machine (ControlDatabase.redeemCadreInvite). The invitation is a keypair, not a\n    -- bearer token: the row holds the public half and the holder proves possession by signing\n    -- with the private half (CadreInviteUsage.InvitePossessed), so the member that redeems it\n    -- can verify but never redeem it for itself. Rows are never deleted: a device admitted\n    -- through one carries no owner signature of its own, and its membership is the chain\n    -- invitation -> usage -> peer row, verified at read time, so the row must outlive every\n    -- device it admitted. Withdrawing an invitation is an owner-signed Revocation tombstone\n    -- over the row's stamp with the row kept (Revocation.RowIsGone); liveness is read as no\n    -- tombstone, unexpired, uses left, issuer still an owner (CadreInviteUsage.Authorized).\n    -- NOTE: expired and withdrawn rows accumulate for the life of the party; the same tripwire\n    -- as hasOutstandingFormationInvite applies (ControlDatabase.hasLiveCadreInvite). An owner\n    -- retires a device's dependency on its invitation by re-vouching the row (the owner branch\n    -- of CadrePeer.AuthorizedUpdate).\n    table CadreInvite (\n        Key text primary key,       -- the invitation's ed25519 public key (base64url)\n        PeerId text null,           -- the device this invitation is for; null: whoever redeems first designates it\n        GrantsOwner integer check (GrantsOwner = 0 or GrantsOwner = 1),   -- 1: redemption also seats an OwnerKey row\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        IssuerKey text,             -- the owner that signed the row (== insert context.OwnerKey). A reader checks it\n                                    -- against its node-local anchor, never against the replicated OwnerKey table.\n        IssuerSig text,             -- that owner's 'add' signature (== insert context.Signature), stored so any reader\n                                    -- can re-verify the row from the holder's copy or the replicated one\n        StampId text unique,\n        -- A withdrawn invitation cannot be re-seated from the signed copy its holder keeps, on\n        -- any node that holds the tombstone (schema header for the node that does not).\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'CadreInvite' and R.StampId = new.StampId)\n        ),\n        -- The owner signs the whole row, nullable columns as '' (cadre-core cadreInviteRowFields),\n        -- and the stored issuer pair must be the pair verified here, as CadrePeer pins its voucher.\n        constraint AuthorizedInsert check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(\n                digest(\n                    'CadreControl.CadreInvite', 'add', party_id(),\n                    new.Key,\n                    coalesce(new.PeerId, ''),\n                    cast(new.GrantsOwner as text),\n                    coalesce(cast(new.ExpiresAt as text), ''),\n                    coalesce(cast(new.TotalUses as text), ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n            and coalesce(new.IssuerKey, '') = context.OwnerKey\n            and coalesce(new.IssuerSig, '') = context.Signature\n        ),\n        constraint NoUpdate check on update (false),\n        -- Never deleted (table comment). Withdrawal is the tombstone alone.\n        constraint NoDelete check on delete (false)\n    ) with context (OwnerKey text, Signature text);\n\n    -- Append-only record of cadre invitation redemptions, one row per redemption: the proof a\n    -- CadrePeer row (and, for an owner-granting invitation, an OwnerKey row) was admitted by\n    -- consent rather than by an owner signature.\n    table CadreInviteUsage (\n        UsageStampId text primary key,  -- nonce minted by the redeeming device and signed into both signatures\n                                        -- below. The primary key: this table never deletes, so the key alone\n                                        -- makes a nonce permanent and there is no NotRevoked pair here. Two nodes\n                                        -- that have not converged can each admit the same nonce (FormationUsage).\n        InviteKey text,                 -- the CadreInvite redeemed\n        PeerId text,                    -- the redeeming device: the identity multihash of PeerKey. The writer\n                                        -- asserts the pair and a reader re-derives it (verifyInvitationAdmission);\n                                        -- the schema cannot unwrap a multihash.\n        PeerKey text,                   -- the redeeming device's ed25519 public key (base64url)\n        PeerStampId text,               -- the CadrePeer.StampId this usage seats: one row incarnation, not a peer id\n                                        -- forever. Minted by the writer inside the redeeming transaction and not\n                                        -- signed (FormationUsage.StrandStampId).\n        OwnerStampId text null,         -- the OwnerKey.StampId this usage seats when the invitation grants ownership\n        InviteSig text,                 -- by the invitation's private key over the 'redeem' digest: proof of possession\n        PeerSig text,                   -- by PeerKey over the 'consent' digest: the device agreed to join\n        constraint InsertOnly check on update, delete (false),\n        -- The invitation is read from the pre-transaction snapshot, so an invitation cannot be\n        -- seated and redeemed in one transaction (the OwnerKey consent branch rests on that).\n        -- NOTE: accepted tradeoff \u2014 the use cap counts committed usage, so two redeemers racing\n        -- for a single-use invitation on different machines may both be admitted until merge,\n        -- and after merge both rows stand (FormationUsage.Authorized), for owner grants too.\n        -- Serializing would need cross-machine coordination the control plane does not have;\n        -- the mitigations are the defaults the redemption protocol sets (untargeted owner\n        -- invitations single-use with a short expiry), the targeted form for owner grants, and\n        -- the owner seeing the extra owner and removing it. Revisit if the control plane gains\n        -- a cross-machine sequencer. An issuer removed since issuing takes its outstanding\n        -- invitations with it (the committed.OwnerKey clause, which a tombstone alone\n        -- satisfies); devices it already admitted stay members.\n        constraint Authorized check on insert (\n            exists (\n                select 1 from committed.CadreInvite I\n                    where I.Key = new.InviteKey\n                        and not exists (select 1 from Revocation R where R.TableName = 'CadreInvite' and R.StampId = I.StampId)\n                        and (I.ExpiresAt is null or I.ExpiresAt > context.Now)\n                        and (I.TotalUses is null or I.TotalUses > (select count(1) from committed.CadreInviteUsage U where U.InviteKey = new.InviteKey))\n                        and (I.PeerId is null or I.PeerId = new.PeerId)\n                        and exists (select 1 from committed.OwnerKey K where K.Key = I.IssuerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = K.StampId))\n            )\n        ),\n        -- Verified against the invitation key itself: the member writing the row can check this\n        -- signature but, holding only the public half, cannot produce it.\n        constraint InvitePossessed check on insert (\n            verify(digest('CadreControl.CadreInviteUsage', 'redeem', party_id(), new.InviteKey, new.UsageStampId, new.PeerKey),\n                   new.InviteSig, new.InviteKey, 'ed25519')\n        ),\n        -- The device proves it agreed (FormationUsage.PeerConsented).\n        constraint PeerConsented check on insert (\n            verify(digest('CadreControl.CadreInviteUsage', 'consent', party_id(), new.InviteKey, new.UsageStampId, new.PeerKey),\n                   new.PeerSig, new.PeerKey, 'ed25519')\n        ),\n        -- Deferred, so the same-transaction peer insert counts: a usage row can never be held in\n        -- reserve to seat a row later (FormationUsage.StrandExists). PeerKey must be the key the\n        -- peer row stores: a redemption that only completes an already-admitted device with its\n        -- OwnerKey row (no peer insert to pin it) cannot name a key other than that device's.\n        constraint PeerExists check (exists (\n            select 1 from CadrePeer P where P.PeerId = new.PeerId and P.StampId = new.PeerStampId and P.PublicKey = new.PeerKey\n        )),\n        constraint OwnerExists check (\n            new.OwnerStampId is null\n                or exists (select 1 from OwnerKey K where K.Key = new.PeerKey and K.StampId = new.OwnerStampId)\n        )\n    ) with context (Now datetime);\n\n    -- Serves the cap count above and the liveness reads (cadre-core countCadreInviteUsage,\n    -- hasLiveCadreInvite) on an append-only table, as FormationUsageByToken does.\n    index CadreInviteUsageByInvite on CadreInviteUsage (InviteKey);\n\n    -- Append-only retirement record for the stamps of removed rows of every guarded table, with\n    -- the removed row's key. Every append is owner-signed, so the growth surface is the owner\n    -- keys. One singleton marker row, ('Revocation', 'ledger', 'opened'), retires nothing: an\n    -- owner's connected reconcile pass files it (ControlDatabase.openRevocationLedger) so this\n    -- table is never a never-written block, which the storage layer would consult the cohort\n    -- for on every guarded insert and membership lookup. Readers filter on their own guarded\n    -- TableName, and queryRevocations skips it. A 'CadreInvite' row withdraws an invitation\n    -- whose row stays (CadreInvite table comment).\n    table Revocation (\n        TableName text,             -- 'OwnerKey' | 'ValidationKey' | 'Strand' | 'StrandPartyKey' | 'JoinedStrand' |\n                                    -- 'JoinRequest' | 'CadrePeer' | 'DeviceToken' | 'CadreInvite', or 'Revocation'\n                                    -- for the marker\n        RowKey text,                -- primary key of the removed row\n        StampId text,               -- the retired stamp\n        ReissuedAt integer default 0,   -- bumped by an owner-signed re-issue so a tombstone committed while the\n                                        -- node was alone can be re-written and so re-broadcast; nothing reads it\n        SignerKey text null,        -- the owner that filed the tombstone (== insert context.OwnerKey)\n        SignerSig text null,        -- that owner's 'remove' signature (== insert context.Signature). A node that\n                                    -- received the row by replication re-verifies the pair and judges SignerKey\n                                    -- against its node-local trusted-owner anchor (cadre-core\n                                    -- verifyRevocationSigner), not against this replicated table.\n        -- Keyed on the stamp: one row key may carry several tombstones over its life.\n        primary key (TableName, StampId),\n        -- Retirement is permanent.\n        constraint NoDelete check on delete (false),\n        -- Pinned at 0 so an owner cannot seat a tombstone at a counter its own re-issues cannot pass.\n        constraint FreshTombstone check on insert (new.ReissuedAt = 0),\n        -- A re-issue moves nothing but the counter, and only upward. The signer pair stays the\n        -- filing owner's; the re-issuing owner's signature rides in context only.\n        constraint ReissueOnly check on update (\n            new.TableName = old.TableName and new.RowKey = old.RowKey\n                and new.StampId = old.StampId and new.ReissuedAt > old.ReissuedAt\n                and coalesce(new.SignerKey, '') = coalesce(old.SignerKey, '')\n                and coalesce(new.SignerSig, '') = coalesce(old.SignerSig, '')\n        ),\n        -- A stamp is retired only once its row is gone (deferred, so the same-transaction delete\n        -- counts). Keyed on the stamp, not RowKey: a node that converges on a re-admission before\n        -- the earlier removal's tombstone must still accept that tombstone. Retiring a stamp that\n        -- never existed is harmless: stamps carry 128 random bits (generateStampId). For\n        -- 'CadreInvite' there is no row-gone test: a tombstone there is a withdrawal, and the\n        -- row stays (CadreInvite table comment). The last branch admits the marker row and\n        -- nothing else under 'Revocation'.\n        constraint RowIsGone check on insert (\n            (new.TableName = 'OwnerKey' and not exists (select 1 from OwnerKey K where K.StampId = new.StampId))\n                or (new.TableName = 'CadrePeer' and not exists (select 1 from CadrePeer P where P.StampId = new.StampId))\n                or (new.TableName = 'ValidationKey' and not exists (select 1 from ValidationKey V where V.StampId = new.StampId))\n                or (new.TableName = 'Strand' and not exists (select 1 from Strand S where S.StampId = new.StampId))\n                or (new.TableName = 'StrandPartyKey' and not exists (select 1 from StrandPartyKey K where K.StampId = new.StampId))\n                or (new.TableName = 'JoinedStrand' and not exists (select 1 from JoinedStrand J where J.StampId = new.StampId))\n                or (new.TableName = 'JoinRequest' and not exists (select 1 from JoinRequest J where J.StampId = new.StampId))\n                or (new.TableName = 'DeviceToken' and not exists (select 1 from DeviceToken D where D.StampId = new.StampId))\n                or (new.TableName = 'CadreInvite')\n                or (new.TableName = 'Revocation' and new.RowKey = 'ledger' and new.StampId = 'opened')\n        ),\n        -- Owner-signed over the whole row under its own domain tag, so the delete's 'remove'\n        -- signature filed in the same transaction never doubles as the tombstone's. Ungated, any\n        -- writer could evict a peer party-wide and block its re-admission. RowKey is not checked\n        -- against the retired row here (that would reject a tombstone re-issued later, or filed on\n        -- a node that never held the row); each guarded table's RevocationRecorded binds it\n        -- instead. Reads live OwnerKey like the sibling tables. The marker is signed under this\n        -- rule too, over ('Revocation', 'ledger', 'opened'). The stored signer pair must be the\n        -- pair verified here.\n        constraint Authorized check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.Revocation', 'remove', party_id(), new.TableName, new.RowKey, new.StampId), context.Signature, A.Key, 'ed25519'))\n                and coalesce(new.SignerKey, '') = context.OwnerKey\n                and coalesce(new.SignerSig, '') = context.Signature\n        ),\n        -- Distinct 'reissue' tag, binding ReissuedAt, so neither approval replays as the other.\n        constraint AuthorizedReissue check on update (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey\n                and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId)\n                and verify(digest('CadreControl.Revocation', 'reissue', party_id(),\n                                  new.TableName, new.RowKey, new.StampId, cast(new.ReissuedAt as text)),\n                           context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n}\n\napply schema CadreControl;\n";

package/dist/control-schema.js

@@ -368,9 +368,15 @@ declare schema CadreControl {
                                         -- can pollute.
         VouchUsage text null,           -- the CadreInviteUsage.UsageStampId that admitted this row; null on an
                                         -- owner-vouched row. A row carries exactly one proof: a signature or a usage.
+        Profile text null,              -- the machine's own node profile (cadre-core NodeProfile): 'transaction' is an
+                                        -- app (phone, browser), 'storage' an always-on node; null until it self-publishes.
+                                        -- Self-declared and covered by Sig. No insert rule constrains it: an owner could
+                                        -- only mislabel a machine it already has full authority over, and that machine's
+                                        -- next self-publish corrects it.
         constraint NotRevoked check on insert (
             not exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = new.StampId)
         ),
+        constraint KnownProfile check (new.Profile is null or new.Profile in ('transaction', 'storage')),
         constraint RevocationRecorded check on delete (
             exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = old.StampId and R.RowKey = old.PeerId)
         ),
@@ -414,10 +420,16 @@ declare schema CadreControl {
             exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'remove', party_id(), old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))
                 or exists (select 1 from committed.Revocation R where R.TableName = 'CadrePeer' and R.RowKey = old.PeerId and R.StampId = old.StampId)
         ),
-        -- A peer re-publishes its own addrs and freshness under its own key (cadre-core
+        -- A peer re-publishes its own addrs, profile and freshness under its own key (cadre-core
         -- peer-record.ts); everything else is immutable and UpdatedAt must increase. Or an owner
         -- re-vouches the row over its current stamp, which also clears VouchUsage: the row then
-        -- stands on the signature and its invitation is no longer consulted for it. StampId never
+        -- stands on the signature and its invitation is no longer consulted for it. The owner
+        -- branch keeps what the machine itself declares (PublicKey, Multiaddr, Sig, Profile): the
+        -- row's stored VouchSig is a valid re-vouch signature, so any machine holding the row can
+        -- take this branch. NOTE: it may still bump UpdatedAt (reauthorizeCadrePeer's re-broadcast
+        -- needs it), which on a self-published row leaves Sig unverifiable until the machine's
+        -- next heartbeat re-signs past it; if that window ever matters, pin UpdatedAt here when
+        -- old.Sig is not null. StampId never
         -- changes on update: an update that rotated it would leave the old stamp free and
         -- untombstoned, so retiring a stamp is delete plus tombstone. The proof columns are
         -- compared null-safe: VouchSig and VouchUsage are null on one of the two row kinds, and a
@@ -432,7 +444,7 @@ declare schema CadreControl {
                 and coalesce(new.VouchUsage, '') = coalesce(old.VouchUsage, '')
                 and new.UpdatedAt > coalesce(old.UpdatedAt, 0)
                 and verify(
-                        digest('CadreControl.CadrePeer', 'publish', party_id(), new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text)),
+                        digest('CadreControl.CadrePeer', 'publish', party_id(), new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text), coalesce(new.Profile, '')),
                         new.Sig, new.PublicKey, 'ed25519')
             )
                 or (
@@ -441,6 +453,10 @@ declare schema CadreControl {
                     and coalesce(new.VouchOwner, '') = context.OwnerKey
                     and coalesce(new.VouchSig, '') = context.Signature
                     and new.VouchUsage is null
+                    and coalesce(new.PublicKey, '') = coalesce(old.PublicKey, '')
+                    and coalesce(new.Multiaddr, '') = coalesce(old.Multiaddr, '')
+                    and coalesce(new.Sig, '') = coalesce(old.Sig, '')
+                    and coalesce(new.Profile, '') = coalesce(old.Profile, '')
                 )
         )
     ) with context (OwnerKey text null, Signature text);

package/dist/control-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgyB7B,CAAC"}
+{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgzB7B,CAAC"}

package/dist/ed25519-key.d.ts

@@ -55,6 +55,13 @@ export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): stri
  * without importing the seed-bootstrap runtime.
  */
 export declare function ed25519PublicKeyB64FromPeerId(peerId: string): string | null;
+/**
+ * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
+ * is this ed25519 public key (base64url), or null when the value does not decode to a
+ * 32-byte key. How an `OwnerKey` row is matched to the machine it names
+ * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
+ */
+export declare function peerIdFromEd25519PublicKeyB64(publicKeyB64: string): string | null;
 /**
  * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
  * before it reaches the control database, where a malformed key would otherwise sit
@@ -67,15 +74,6 @@ export declare function ed25519PublicKeyB64FromPeerId(peerId: string): string |
  * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
  * signature verification later exactly like any other wrong key.
  *
- * **This rule is restated once outside this package**, in `validateOwnerKey`
- * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
- * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
- * directly. Change the rule here and change it there — the copies are kept in step by
- * hand, since neither package can import the other's. Each side pins its own copy to the
- * same accept/reject table (`test/ed25519-key.spec.ts` here,
- * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
- * package it was made in and lands the editor on this pointer.
- *
  * @param value - Candidate base64url-encoded Ed25519 public key.
  * @param label - Human-readable name of the field, used in error messages.
  * @returns The trimmed value, so callers write the same bytes they validated.

package/dist/ed25519-key.js

@@ -1,6 +1,7 @@
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
-import { peerIdFromString } from '@libp2p/peer-id';
+import { peerIdFromPublicKey, peerIdFromString } from '@libp2p/peer-id';
+import { publicKeyFromRaw } from '@libp2p/crypto/keys';
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
  * control- and strand-database signing constraints.
@@ -75,6 +76,24 @@ export function ed25519PublicKeyB64FromPeerId(peerId) {
         return null;
     }
 }
+/**
+ * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
+ * is this ed25519 public key (base64url), or null when the value does not decode to a
+ * 32-byte key. How an `OwnerKey` row is matched to the machine it names
+ * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
+ */
+export function peerIdFromEd25519PublicKeyB64(publicKeyB64) {
+    try {
+        const raw = uint8ArrayFromString(publicKeyB64, 'base64url');
+        if (raw.length !== 32) {
+            return null;
+        }
+        return peerIdFromPublicKey(publicKeyFromRaw(raw)).toString();
+    }
+    catch {
+        return null;
+    }
+}
 /** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
 const REJECTED_VALUE_ECHO_LIMIT = 64;
 /**
@@ -100,15 +119,6 @@ function describeRejected(value) {
  * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
  * signature verification later exactly like any other wrong key.
  *
- * **This rule is restated once outside this package**, in `validateOwnerKey`
- * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
- * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
- * directly. Change the rule here and change it there — the copies are kept in step by
- * hand, since neither package can import the other's. Each side pins its own copy to the
- * same accept/reject table (`test/ed25519-key.spec.ts` here,
- * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
- * package it was made in and lands the editor on this pointer.
- *
  * @param value - Candidate base64url-encoded Ed25519 public key.
  * @param label - Human-readable name of the field, used in error messages.
  * @returns The trimmed value, so callers write the same bytes they validated.

package/dist/ed25519-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAgBnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgBvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/fetch-impl.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The `fetch` a cross-platform HTTP caller in this package uses: the one injected for tests
+ * and embedders, else the runtime's global. Shared by the formation-approval client and the
+ * provider client, so both resolve it the same way.
+ *
+ * Bound to `globalThis` because an unbound global `fetch` is an illegal invocation in browsers
+ * (and in any runtime whose `fetch` is a branded method rather than a plain function).
+ */
+/** The injected `fetch`, else the bound global; undefined when the runtime has none. */
+export declare function resolveFetch(fetchImpl?: typeof fetch): typeof fetch | undefined;
+/** {@link resolveFetch}, throwing when the runtime has no `fetch` and none was injected. */
+export declare function requireFetch(fetchImpl?: typeof fetch): typeof fetch;

package/dist/fetch-impl.js

@@ -0,0 +1,23 @@
+/**
+ * The `fetch` a cross-platform HTTP caller in this package uses: the one injected for tests
+ * and embedders, else the runtime's global. Shared by the formation-approval client and the
+ * provider client, so both resolve it the same way.
+ *
+ * Bound to `globalThis` because an unbound global `fetch` is an illegal invocation in browsers
+ * (and in any runtime whose `fetch` is a branded method rather than a plain function).
+ */
+/** The injected `fetch`, else the bound global; undefined when the runtime has none. */
+export function resolveFetch(fetchImpl) {
+    if (fetchImpl)
+        return fetchImpl;
+    return typeof globalThis.fetch === 'function' ? globalThis.fetch.bind(globalThis) : undefined;
+}
+/** {@link resolveFetch}, throwing when the runtime has no `fetch` and none was injected. */
+export function requireFetch(fetchImpl) {
+    const resolved = resolveFetch(fetchImpl);
+    if (!resolved) {
+        throw new Error('No fetch implementation: globalThis.fetch is missing and none was supplied');
+    }
+    return resolved;
+}
+//# sourceMappingURL=fetch-impl.js.map

package/dist/fetch-impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-impl.js","sourceRoot":"","sources":["../src/fetch-impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,SAAwB;IACpD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,SAAwB;IACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/file-durable-slot.js

@@ -16,7 +16,8 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { encodeFileSafeComponent, isNotFound, writeFileAtomically } from './fs-atomic.js';
+import { isNotFound, writeFileAtomically } from './fs-atomic.js';
+import { encodeFileSafeComponent } from './file-safe-name.js';
 export class FileDurableSlot {
     constructor(dir, name, partyId) {
         this.dir = dir;

package/dist/file-durable-slot.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-durable-slot.js","sourceRoot":"","sources":["../src/file-durable-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1F,MAAM,OAAO,eAAe;IAI3B,YACkB,GAAW,EACX,IAAY,EAC7B,OAAe;QAFE,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAG7B,IAAI,CAAC,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI;QACT,IAAI,CAAC;YACJ,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvG,CAAC;IAEO,QAAQ;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,iFAAiF;IACzE,QAAQ;QACf,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC;IAC1E,CAAC;CACD"}
+{"version":3,"file":"file-durable-slot.js","sourceRoot":"","sources":["../src/file-durable-slot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAG9D,MAAM,OAAO,eAAe;IAI3B,YACkB,GAAW,EACX,IAAY,EAC7B,OAAe;QAFE,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAG7B,IAAI,CAAC,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI;QACT,IAAI,CAAC;YACJ,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvG,CAAC;IAEO,QAAQ;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,iFAAiF;IACzE,QAAQ;QACf,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC;IAC1E,CAAC;CACD"}

package/dist/file-safe-name.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The filename-safe encoding of an id, shared by every Node-only file store that keys a file on
+ * a party or key id (`<name>.<encoded id>.json`). A pure string function, so it lives outside
+ * `fs-atomic.ts` and is exported from the cross-platform entry: an embedder that keeps its own
+ * per-party file beside cadre-core's (cadre-cli's removal marker) names it the same way.
+ */
+/**
+ * Percent-encode a string into a filesystem-safe filename component. Beyond
+ * `encodeURIComponent` (which already escapes `/`, spaces, and unicode), this
+ * also escapes the unreserved characters `encodeURIComponent` leaves intact but
+ * that are unsafe in filenames on some platforms (notably `*` on Windows) — and
+ * `.`, so a file suffix appended by the caller is the only literal dot, making
+ * suffix-stripping unambiguous — and every uppercase letter, because Windows
+ * (NTFS) and macOS (APFS/HFS+ by default) ignore case in file names. Reversed by
+ * `decodeURIComponent`.
+ *
+ * The result contains only `a-z0-9-_` and `%XX` escapes (uppercase hex). Since a
+ * literal `%` is itself escaped, every `%` starts an escape, so ignoring case
+ * can change only escape hex digits — which decode case-insensitively — and two
+ * different inputs never yield names equal ignoring case. The escapes keep
+ * `encodeURIComponent`'s uppercase hex so a name built from an id with no
+ * capital letters (the identity slot `cadre%2Fidentity.key`, a lowercase party
+ * id) is the same as before uppercase letters were escaped.
+ */
+export declare function encodeFileSafeComponent(component: string): string;

package/dist/file-safe-name.js

@@ -0,0 +1,29 @@
+/**
+ * The filename-safe encoding of an id, shared by every Node-only file store that keys a file on
+ * a party or key id (`<name>.<encoded id>.json`). A pure string function, so it lives outside
+ * `fs-atomic.ts` and is exported from the cross-platform entry: an embedder that keeps its own
+ * per-party file beside cadre-core's (cadre-cli's removal marker) names it the same way.
+ */
+/**
+ * Percent-encode a string into a filesystem-safe filename component. Beyond
+ * `encodeURIComponent` (which already escapes `/`, spaces, and unicode), this
+ * also escapes the unreserved characters `encodeURIComponent` leaves intact but
+ * that are unsafe in filenames on some platforms (notably `*` on Windows) — and
+ * `.`, so a file suffix appended by the caller is the only literal dot, making
+ * suffix-stripping unambiguous — and every uppercase letter, because Windows
+ * (NTFS) and macOS (APFS/HFS+ by default) ignore case in file names. Reversed by
+ * `decodeURIComponent`.
+ *
+ * The result contains only `a-z0-9-_` and `%XX` escapes (uppercase hex). Since a
+ * literal `%` is itself escaped, every `%` starts an escape, so ignoring case
+ * can change only escape hex digits — which decode case-insensitively — and two
+ * different inputs never yield names equal ignoring case. The escapes keep
+ * `encodeURIComponent`'s uppercase hex so a name built from an id with no
+ * capital letters (the identity slot `cadre%2Fidentity.key`, a lowercase party
+ * id) is the same as before uppercase letters were escaped.
+ */
+export function encodeFileSafeComponent(component) {
+    // NOTE: a file left from before uppercase letters were escaped (`trusted-owners.Alice.json`) has, ignoring case, the new name of the all-lowercase id (`alice`), so on Windows/macOS a lookup for that id opens it; the per-party records' envelope party-id check rejects it (cold start), and `FileKeyStore` needs two parties in one key directory whose ids fold to the same lowercase string. The release note says to delete old files; if a store ever reads another id's old file in practice, rename or remove old-format files when the store opens.
+    return encodeURIComponent(component).replace(/(%[0-9A-F]{2})|[!'()*~.A-Z]/g, (c, escape) => escape ?? `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+//# sourceMappingURL=file-safe-name.js.map

package/dist/file-safe-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-safe-name.js","sourceRoot":"","sources":["../src/file-safe-name.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACxD,+hBAA+hB;IAC/hB,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,OAAO,CAC3C,8BAA8B,EAC9B,CAAC,CAAC,EAAE,MAA0B,EAAE,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7F,CAAC;AACH,CAAC"}