@serfab/cadre-core 1.14.0 → 1.16.0

package/src/control-schema.ts

@@ -368,9 +368,15 @@ declare schema CadreControl {
                                         -- can pollute.
         VouchUsage text null,           -- the CadreInviteUsage.UsageStampId that admitted this row; null on an
                                         -- owner-vouched row. A row carries exactly one proof: a signature or a usage.
+        Profile text null,              -- the machine's own node profile (cadre-core NodeProfile): 'transaction' is an
+                                        -- app (phone, browser), 'storage' an always-on node; null until it self-publishes.
+                                        -- Self-declared and covered by Sig. No insert rule constrains it: an owner could
+                                        -- only mislabel a machine it already has full authority over, and that machine's
+                                        -- next self-publish corrects it.
         constraint NotRevoked check on insert (
             not exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = new.StampId)
         ),
+        constraint KnownProfile check (new.Profile is null or new.Profile in ('transaction', 'storage')),
         constraint RevocationRecorded check on delete (
             exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = old.StampId and R.RowKey = old.PeerId)
         ),
@@ -414,10 +420,16 @@ declare schema CadreControl {
             exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = A.StampId) and verify(digest('CadreControl.CadrePeer', 'remove', party_id(), old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))
                 or exists (select 1 from committed.Revocation R where R.TableName = 'CadrePeer' and R.RowKey = old.PeerId and R.StampId = old.StampId)
         ),
-        -- A peer re-publishes its own addrs and freshness under its own key (cadre-core
+        -- A peer re-publishes its own addrs, profile and freshness under its own key (cadre-core
         -- peer-record.ts); everything else is immutable and UpdatedAt must increase. Or an owner
         -- re-vouches the row over its current stamp, which also clears VouchUsage: the row then
-        -- stands on the signature and its invitation is no longer consulted for it. StampId never
+        -- stands on the signature and its invitation is no longer consulted for it. The owner
+        -- branch keeps what the machine itself declares (PublicKey, Multiaddr, Sig, Profile): the
+        -- row's stored VouchSig is a valid re-vouch signature, so any machine holding the row can
+        -- take this branch. NOTE: it may still bump UpdatedAt (reauthorizeCadrePeer's re-broadcast
+        -- needs it), which on a self-published row leaves Sig unverifiable until the machine's
+        -- next heartbeat re-signs past it; if that window ever matters, pin UpdatedAt here when
+        -- old.Sig is not null. StampId never
         -- changes on update: an update that rotated it would leave the old stamp free and
         -- untombstoned, so retiring a stamp is delete plus tombstone. The proof columns are
         -- compared null-safe: VouchSig and VouchUsage are null on one of the two row kinds, and a
@@ -432,7 +444,7 @@ declare schema CadreControl {
                 and coalesce(new.VouchUsage, '') = coalesce(old.VouchUsage, '')
                 and new.UpdatedAt > coalesce(old.UpdatedAt, 0)
                 and verify(
-                        digest('CadreControl.CadrePeer', 'publish', party_id(), new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text)),
+                        digest('CadreControl.CadrePeer', 'publish', party_id(), new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text), coalesce(new.Profile, '')),
                         new.Sig, new.PublicKey, 'ed25519')
             )
                 or (
@@ -441,6 +453,10 @@ declare schema CadreControl {
                     and coalesce(new.VouchOwner, '') = context.OwnerKey
                     and coalesce(new.VouchSig, '') = context.Signature
                     and new.VouchUsage is null
+                    and coalesce(new.PublicKey, '') = coalesce(old.PublicKey, '')
+                    and coalesce(new.Multiaddr, '') = coalesce(old.Multiaddr, '')
+                    and coalesce(new.Sig, '') = coalesce(old.Sig, '')
+                    and coalesce(new.Profile, '') = coalesce(old.Profile, '')
                 )
         )
     ) with context (OwnerKey text null, Signature text);

package/src/ed25519-key.ts

@@ -1,6 +1,7 @@
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
-import { peerIdFromString } from '@libp2p/peer-id';
+import { peerIdFromPublicKey, peerIdFromString } from '@libp2p/peer-id';
+import { publicKeyFromRaw } from '@libp2p/crypto/keys';
 import type { PrivateKey } from '@libp2p/interface';
 
 /**
@@ -95,6 +96,24 @@ export function ed25519PublicKeyB64FromPeerId(peerId: string): string | null {
   }
 }
 
+/**
+ * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
+ * is this ed25519 public key (base64url), or null when the value does not decode to a
+ * 32-byte key. How an `OwnerKey` row is matched to the machine it names
+ * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
+ */
+export function peerIdFromEd25519PublicKeyB64(publicKeyB64: string): string | null {
+  try {
+    const raw = uint8ArrayFromString(publicKeyB64, 'base64url');
+    if (raw.length !== 32) {
+      return null;
+    }
+    return peerIdFromPublicKey(publicKeyFromRaw(raw)).toString();
+  } catch {
+    return null;
+  }
+}
+
 /** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
 const REJECTED_VALUE_ECHO_LIMIT = 64;
 
@@ -122,15 +141,6 @@ function describeRejected(value: string): string {
  * are a valid point on the Ed25519 curve — a well-formed-but-off-curve key still fails
  * signature verification later exactly like any other wrong key.
  *
- * **This rule is restated once outside this package**, in `validateOwnerKey`
- * (`packages/cadre-provider/src/server/owner-key-validation.ts`): cadre-provider declares no
- * `workspace:` dependencies and validates `POST /containers` pins over `uint8arrays`
- * directly. Change the rule here and change it there — the copies are kept in step by
- * hand, since neither package can import the other's. Each side pins its own copy to the
- * same accept/reject table (`test/ed25519-key.spec.ts` here,
- * `create-container-owner-keys.test.ts` there), so a change fails the suite of the
- * package it was made in and lands the editor on this pointer.
- *
  * @param value - Candidate base64url-encoded Ed25519 public key.
  * @param label - Human-readable name of the field, used in error messages.
  * @returns The trimmed value, so callers write the same bytes they validated.

package/src/fetch-impl.ts

@@ -0,0 +1,23 @@
+/**
+ * The `fetch` a cross-platform HTTP caller in this package uses: the one injected for tests
+ * and embedders, else the runtime's global. Shared by the formation-approval client and the
+ * provider client, so both resolve it the same way.
+ *
+ * Bound to `globalThis` because an unbound global `fetch` is an illegal invocation in browsers
+ * (and in any runtime whose `fetch` is a branded method rather than a plain function).
+ */
+
+/** The injected `fetch`, else the bound global; undefined when the runtime has none. */
+export function resolveFetch(fetchImpl?: typeof fetch): typeof fetch | undefined {
+	if (fetchImpl) return fetchImpl;
+	return typeof globalThis.fetch === 'function' ? globalThis.fetch.bind(globalThis) : undefined;
+}
+
+/** {@link resolveFetch}, throwing when the runtime has no `fetch` and none was injected. */
+export function requireFetch(fetchImpl?: typeof fetch): typeof fetch {
+	const resolved = resolveFetch(fetchImpl);
+	if (!resolved) {
+		throw new Error('No fetch implementation: globalThis.fetch is missing and none was supplied');
+	}
+	return resolved;
+}

package/src/file-durable-slot.ts

@@ -1,63 +1,64 @@
-/**
- * Node-only {@link DurableSlot} backend: one JSON file per party under `dir`,
- * at `<dir>/<name>.<encoded partyId>.json` (0600, atomically replaced on every
- * save), so one directory can hold the same node-local record for several
- * parties without cross-party leakage.
- *
- * This is the whole platform-specific part of the file-backed node-local
- * stores (`trusted-owner-store-file.ts`, `bootstrap-peer-store-file.ts`,
- * `enrolled-machine-store-file.ts`); the load policy, envelope and write chain
- * are cross-platform — in `node-local-snapshot.ts` for the first two, and in
- * `enrolled-machine-store.ts` for the third, which deliberately does not share
- * that machinery. Like its three importers, this module imports
- * `node:fs/promises`, so it is kept OUT of the package's cross-platform
- * default entry and is not itself an exported subpath.
- */
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { encodeFileSafeComponent, isNotFound, writeFileAtomically } from './fs-atomic.js';
-import type { DurableSlot } from './node-local-snapshot.js';
-
-export class FileDurableSlot implements DurableSlot {
-	/** Filename-safe form of the party id, shared by the record and temp paths. */
-	private readonly encodedParty: string;
-
-	constructor(
-		private readonly dir: string,
-		private readonly name: string,
-		partyId: string
-	) {
-		this.encodedParty = encodeFileSafeComponent(partyId);
-	}
-
-	/**
-	 * The record's bytes as text. An absent file (ENOENT — including an absent
-	 * directory) is `undefined`, a cold start. Every other read failure
-	 * (EACCES, EISDIR, EIO, …) THROWS, per {@link DurableSlot.load}: the caller
-	 * must not mistake an unreadable file for an empty one and snapshot-write
-	 * over it.
-	 */
-	async load(): Promise<string | undefined> {
-		try {
-			return (await readFile(this.filePath())).toString('utf8');
-		} catch (error) {
-			if (isNotFound(error)) return undefined;
-			throw new Error(`FileDurableSlot: ${this.filePath()} is present but unreadable`, { cause: error });
-		}
-	}
-
-	async save(text: string): Promise<void> {
-		await writeFileAtomically(this.dir, this.tempPath(), this.filePath(), new TextEncoder().encode(text));
-	}
-
-	private filePath(): string {
-		return join(this.dir, `${this.name}.${this.encodedParty}.json`);
-	}
-
-	/** Sibling temp path for the atomic replace (random component: collide-free). */
-	private tempPath(): string {
-		const unique = randomBytes(6).toString('hex');
-		return join(this.dir, `${this.name}.${this.encodedParty}.${unique}.tmp`);
-	}
-}
+/**
+ * Node-only {@link DurableSlot} backend: one JSON file per party under `dir`,
+ * at `<dir>/<name>.<encoded partyId>.json` (0600, atomically replaced on every
+ * save), so one directory can hold the same node-local record for several
+ * parties without cross-party leakage.
+ *
+ * This is the whole platform-specific part of the file-backed node-local
+ * stores (`trusted-owner-store-file.ts`, `bootstrap-peer-store-file.ts`,
+ * `enrolled-machine-store-file.ts`); the load policy, envelope and write chain
+ * are cross-platform — in `node-local-snapshot.ts` for the first two, and in
+ * `enrolled-machine-store.ts` for the third, which deliberately does not share
+ * that machinery. Like its three importers, this module imports
+ * `node:fs/promises`, so it is kept OUT of the package's cross-platform
+ * default entry and is not itself an exported subpath.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { isNotFound, writeFileAtomically } from './fs-atomic.js';
+import { encodeFileSafeComponent } from './file-safe-name.js';
+import type { DurableSlot } from './node-local-snapshot.js';
+
+export class FileDurableSlot implements DurableSlot {
+	/** Filename-safe form of the party id, shared by the record and temp paths. */
+	private readonly encodedParty: string;
+
+	constructor(
+		private readonly dir: string,
+		private readonly name: string,
+		partyId: string
+	) {
+		this.encodedParty = encodeFileSafeComponent(partyId);
+	}
+
+	/**
+	 * The record's bytes as text. An absent file (ENOENT — including an absent
+	 * directory) is `undefined`, a cold start. Every other read failure
+	 * (EACCES, EISDIR, EIO, …) THROWS, per {@link DurableSlot.load}: the caller
+	 * must not mistake an unreadable file for an empty one and snapshot-write
+	 * over it.
+	 */
+	async load(): Promise<string | undefined> {
+		try {
+			return (await readFile(this.filePath())).toString('utf8');
+		} catch (error) {
+			if (isNotFound(error)) return undefined;
+			throw new Error(`FileDurableSlot: ${this.filePath()} is present but unreadable`, { cause: error });
+		}
+	}
+
+	async save(text: string): Promise<void> {
+		await writeFileAtomically(this.dir, this.tempPath(), this.filePath(), new TextEncoder().encode(text));
+	}
+
+	private filePath(): string {
+		return join(this.dir, `${this.name}.${this.encodedParty}.json`);
+	}
+
+	/** Sibling temp path for the atomic replace (random component: collide-free). */
+	private tempPath(): string {
+		const unique = randomBytes(6).toString('hex');
+		return join(this.dir, `${this.name}.${this.encodedParty}.${unique}.tmp`);
+	}
+}

package/src/file-safe-name.ts

@@ -0,0 +1,32 @@
+/**
+ * The filename-safe encoding of an id, shared by every Node-only file store that keys a file on
+ * a party or key id (`<name>.<encoded id>.json`). A pure string function, so it lives outside
+ * `fs-atomic.ts` and is exported from the cross-platform entry: an embedder that keeps its own
+ * per-party file beside cadre-core's (cadre-cli's removal marker) names it the same way.
+ */
+
+/**
+ * Percent-encode a string into a filesystem-safe filename component. Beyond
+ * `encodeURIComponent` (which already escapes `/`, spaces, and unicode), this
+ * also escapes the unreserved characters `encodeURIComponent` leaves intact but
+ * that are unsafe in filenames on some platforms (notably `*` on Windows) — and
+ * `.`, so a file suffix appended by the caller is the only literal dot, making
+ * suffix-stripping unambiguous — and every uppercase letter, because Windows
+ * (NTFS) and macOS (APFS/HFS+ by default) ignore case in file names. Reversed by
+ * `decodeURIComponent`.
+ *
+ * The result contains only `a-z0-9-_` and `%XX` escapes (uppercase hex). Since a
+ * literal `%` is itself escaped, every `%` starts an escape, so ignoring case
+ * can change only escape hex digits — which decode case-insensitively — and two
+ * different inputs never yield names equal ignoring case. The escapes keep
+ * `encodeURIComponent`'s uppercase hex so a name built from an id with no
+ * capital letters (the identity slot `cadre%2Fidentity.key`, a lowercase party
+ * id) is the same as before uppercase letters were escaped.
+ */
+export function encodeFileSafeComponent(component: string): string {
+	// NOTE: a file left from before uppercase letters were escaped (`trusted-owners.Alice.json`) has, ignoring case, the new name of the all-lowercase id (`alice`), so on Windows/macOS a lookup for that id opens it; the per-party records' envelope party-id check rejects it (cold start), and `FileKeyStore` needs two parties in one key directory whose ids fold to the same lowercase string. The release note says to delete old files; if a store ever reads another id's old file in practice, rename or remove old-format files when the store opens.
+	return encodeURIComponent(component).replace(
+		/(%[0-9A-F]{2})|[!'()*~.A-Z]/g,
+		(c, escape: string | undefined) => escape ?? `%${c.charCodeAt(0).toString(16).toUpperCase()}`
+	);
+}