@serfab/cadre-core 1.14.0 → 1.16.0

package/dist/control-database.js

@@ -140,7 +140,7 @@ function parseStoredDatetimeMs(value) {
  * and "unparseable" to null — i.e. "no expiry". Shared by every `ExpiresAt`
  * reader so the NaN guard cannot drift between them.
  */
-function parseNullableStoredDatetimeMs(value) {
+export function parseNullableStoredDatetimeMs(value) {
     if (value === null || value === undefined)
         return null;
     const parsed = parseStoredDatetimeMs(value);
@@ -530,32 +530,43 @@ function joinedStrandRow(row) {
         FounderOwnerKey: null,
     };
 }
-const JOIN_REQUEST_INSERT_SQL = `
-  insert into CadreControl.JoinRequest (Id, Invitation, Disclosure, RequestedAt, ExpiresAt, StampId)
-    with context OwnerKey = ?, Signature = ?
-    values (?, ?, ?, ?, ?, ?)
+const FORMATION_INVITE_SELECT_SQL = 'select Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId from CadreControl.FormationInvite';
+function formationInviteRowOf(row) {
+    return {
+        token: row.Token,
+        sAppId: row.sAppId,
+        expiresAtMs: parseNullableStoredDatetimeMs(row.ExpiresAt),
+        totalUses: row.TotalUses ?? null,
+        validationUrl: row.ValidationUrl ?? null,
+        strandId: row.StrandId ?? null,
+    };
+}
+const JOIN_REQUEST_INSERT_SQL = `
+  insert into CadreControl.JoinRequest (Id, Invitation, Disclosure, RequestedAt, ExpiresAt, StampId)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?, ?, ?)
 `;
-const JOIN_SUCCESS_INSERT_SQL = `
-  insert into CadreControl.JoinSuccess (RequestStampId, RecordedAt, StrandId, MembershipInvite)
-    with context OwnerKey = ?, Signature = ?
-    values (?, ?, ?, ?)
+const JOIN_SUCCESS_INSERT_SQL = `
+  insert into CadreControl.JoinSuccess (RequestStampId, RecordedAt, StrandId, MembershipInvite)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?)
 `;
-const JOIN_FAILURE_INSERT_SQL = `
-  insert into CadreControl.JoinFailure (RequestStampId, RecordedAt, Code, Reason)
-    with context OwnerKey = ?, Signature = ?
-    values (?, ?, ?, ?)
+const JOIN_FAILURE_INSERT_SQL = `
+  insert into CadreControl.JoinFailure (RequestStampId, RecordedAt, Code, Reason)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?)
 `;
 /**
  * A request with its outcome in one statement: the outcome tables are keyed by the request's
  * stamp, so the join finds exactly this incarnation's outcome.
  */
-const PENDING_JOIN_SELECT_SQL = `
-  select R.Id, R.Invitation, R.Disclosure, R.RequestedAt, R.ExpiresAt, R.StampId,
-         S.RecordedAt as JoinedAt, S.StrandId, S.MembershipInvite,
-         F.RecordedAt as FailedAt, F.Code, F.Reason
-    from CadreControl.JoinRequest R
-      left join CadreControl.JoinSuccess S on S.RequestStampId = R.StampId
-      left join CadreControl.JoinFailure F on F.RequestStampId = R.StampId
+const PENDING_JOIN_SELECT_SQL = `
+  select R.Id, R.Invitation, R.Disclosure, R.RequestedAt, R.ExpiresAt, R.StampId,
+         S.RecordedAt as JoinedAt, S.StrandId, S.MembershipInvite,
+         F.RecordedAt as FailedAt, F.Code, F.Reason
+    from CadreControl.JoinRequest R
+      left join CadreControl.JoinSuccess S on S.RequestStampId = R.StampId
+      left join CadreControl.JoinFailure F on F.RequestStampId = R.StampId
 `;
 /** A {@link PENDING_JOIN_SELECT_SQL} row as read. */
 function pendingJoinOf(row) {
@@ -1220,14 +1231,22 @@ export class ControlDatabase {
         this.ensureInitialized();
         const revoked = await this.queryRevokedStamps('CadrePeer', retry);
         const rows = [];
-        for (const row of await this.readRows('select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.CadrePeer', undefined, 'cadre-peers', retry)) {
+        // The proof columns lead and the record columns follow, so this scan keeps a prefix no
+        // other `CadrePeer` statement shares (`queryPeerRecord` starts `PeerId, PublicKey`): the
+        // read-retry spec rigs the membership scan by that prefix.
+        const sql = 'select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage, PublicKey, UpdatedAt, Profile, Sig from CadreControl.CadrePeer';
+        for (const row of await this.readRows(sql, undefined, 'cadre-peers', retry)) {
             const stampId = row.StampId ?? null;
             if (stampId !== null && revoked.has(stampId)) {
                 continue;
             }
             rows.push({
                 peerId: row.PeerId,
+                publicKey: row.PublicKey ?? null,
                 multiaddr: row.Multiaddr ?? null,
+                updatedAt: row.UpdatedAt ?? 0,
+                profile: row.Profile ?? null,
+                sig: row.Sig ?? null,
                 stampId,
                 vouchOwner: row.VouchOwner ?? null,
                 vouchSig: row.VouchSig ?? null,
@@ -1483,7 +1502,7 @@ export class ControlDatabase {
     async queryPeerRecord(peerId) {
         this.ensureInitialized();
         const revoked = await this.queryRevokedStamps('CadrePeer');
-        for (const row of await this.readRows('select PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId from CadreControl.CadrePeer where PeerId = ?', [peerId], 'peer-record')) {
+        for (const row of await this.readRows('select PeerId, PublicKey, Multiaddr, UpdatedAt, Profile, Sig, StampId from CadreControl.CadrePeer where PeerId = ?', [peerId], 'peer-record')) {
             const stampId = row.StampId ?? null;
             if (stampId !== null && revoked.has(stampId)) {
                 return null;
@@ -1494,6 +1513,7 @@ export class ControlDatabase {
                 publicKey: row.PublicKey ?? '',
                 addrs: multiaddr.length > 0 ? multiaddr.split(',') : [],
                 updatedAt: row.UpdatedAt ?? 0,
+                profile: row.Profile ?? null,
                 sig: row.Sig ?? '',
             };
         }
@@ -1525,12 +1545,12 @@ export class ControlDatabase {
     async updateSelfPeerRecord(record) {
         this.ensureInitialized();
         const multiaddr = record.addrs.join(',');
-        await this.execWrite(`
-      update CadreControl.CadrePeer
-        with context OwnerKey = null, Signature = ?
-        set Multiaddr = ?, UpdatedAt = ?, Sig = ?
-        where PeerId = ?
-    `, [record.sig, multiaddr, record.updatedAt, record.sig, record.peerId], 'self-record-update');
+        await this.execWrite(`
+      update CadreControl.CadrePeer
+        with context OwnerKey = null, Signature = ?
+        set Multiaddr = ?, UpdatedAt = ?, Profile = ?, Sig = ?
+        where PeerId = ?
+    `, [record.sig, multiaddr, record.updatedAt, record.profile, record.sig, record.peerId], 'self-record-update');
         log('Self peer record updated: %s (updatedAt=%d)', record.peerId, record.updatedAt);
     }
     /**
@@ -1573,11 +1593,11 @@ export class ControlDatabase {
      */
     async updateSelfDeviceToken(record) {
         this.ensureInitialized();
-        await this.execWrite(`
-      update CadreControl.DeviceToken
-        with context OwnerKey = null, Signature = ?
-        set Platform = ?, Token = ?, UpdatedAt = ?, Sig = ?
-        where PeerId = ?
+        await this.execWrite(`
+      update CadreControl.DeviceToken
+        with context OwnerKey = null, Signature = ?
+        set Platform = ?, Token = ?, UpdatedAt = ?, Sig = ?
+        where PeerId = ?
     `, [record.sig, record.platform, record.token, record.updatedAt, record.sig, record.peerId], 'device-token-update');
         log('Self device token updated: %s (platform=%s, updatedAt=%d)', record.peerId, record.platform, record.updatedAt);
     }
@@ -1596,10 +1616,10 @@ export class ControlDatabase {
         // not-null/unique anti-replay constraint — the StampId is a real column value, not the
         // optimystic `StampId()` SQL function.
         const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
-        await this.execWrite(`
-      insert into CadreControl.OwnerKey (Key, StampId)
-        with context OwnerKey = null, Signature = null
-        values (?, ?)
+        await this.execWrite(`
+      insert into CadreControl.OwnerKey (Key, StampId)
+        with context OwnerKey = null, Signature = null
+        values (?, ?)
     `, [key, stampId], 'owner-key-insert');
         log('Owner key inserted');
     }
@@ -1642,10 +1662,10 @@ export class ControlDatabase {
             const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
             const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, stampId));
             // Bare `exec`: already inside the write lock, which is NOT re-entrant.
-            await this.db.exec(`
-        insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
-          with context OwnerKey = ?, Signature = ?
-          values (?, ?, ?, ?)
+            await this.db.exec(`
+        insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?)
       `, [ownerKey, signature, key, stampId, ownerKey, signature]);
             log('Owner key %s added (vouched by %s)', key, ownerKey);
             return true;
@@ -1685,6 +1705,145 @@ export class ControlDatabase {
             return await this.deleteGuardedRow('OwnerKey', key, ownerKey, signMessage);
         });
     }
+    /**
+     * Re-vouch a live `OwnerKey` row under this owner's signature: in ONE transaction, the
+     * current row's guarded delete plus tombstone ({@link deleteOwnerKey}'s body) and an insert
+     * of the same key under a fresh stamp, signed by `ownerKey` ({@link insertOwnerKeyVouched}'s
+     * body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
+     * this is the only way to rebind a row's voucher; the anchor derivation lets the re-add
+     * under a fresh stamp beat the older tombstone (`deriveOwnerAnchor`). For
+     * {@link removeMachine}: the owners a machine being removed had added keep their anchor
+     * place everywhere once their row stands on a remaining owner's signature.
+     *
+     * Through {@link mutateCadrePeer}, the membership hub. The stamp read runs inside the locked
+     * body; a row whose stamp is already retired (held without its delete) is reported as absent
+     * rather than tombstoned twice.
+     *
+     * @returns `true` when the row was re-vouched, `false` when `key` is not a live owner here.
+     * @throws when `key` is `ownerKey` (an owner cannot sign its own row's removal).
+     */
+    async revouchOwnerKey(key, ownerKey, signMessage) {
+        if (key === ownerKey) {
+            throw new Error(`Cannot re-vouch owner key ${key}: an owner cannot re-vouch itself`);
+        }
+        return await this.mutateCadrePeer('owner-key-revouch', async () => {
+            // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
+            const stampId = await this.queryStampId('OwnerKey', key, false);
+            if (stampId === null || (await this.queryRevokedStamps('OwnerKey', false)).has(stampId)) {
+                log('revouchOwnerKey: %s is not a live owner here (nothing to re-vouch)', key);
+                return false;
+            }
+            const removal = signGuardedRemoval(this.config.partyId, 'OwnerKey', key, stampId, signMessage);
+            const freshStampId = generateStampId(this.config.libp2pNode.peerId.toString());
+            const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, freshStampId));
+            await this.inTransaction('revouch OwnerKey', async () => {
+                await this.execGuardedRemoval(removal, ownerKey);
+                await this.db.exec(`
+          insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
+            with context OwnerKey = ?, Signature = ?
+            values (?, ?, ?, ?)
+        `, [ownerKey, signature, key, freshStampId, ownerKey, signature]);
+            });
+            log('Owner key %s re-vouched by %s (stamp %s retired)', key, ownerKey, stampId);
+            this.notifyGuardedDelete(removal.ref);
+            return true;
+        });
+    }
+    /**
+     * Remove one machine completely, in ONE transaction: its `CadrePeer` row, its `OwnerKey`
+     * row when `target.ownerKey` names one, its `DeviceToken` row when it has one, each with
+     * the `Revocation` tombstone retiring its stamp ({@link deleteGuardedRow}'s statement pair,
+     * composed bare as {@link deleteStrandAndPartyKey} composes it), plus a withdrawal tombstone
+     * for every `CadreInvite` in `target.inviteKeys` that is still live here
+     * ({@link withdrawCadreInvite}'s body). One transaction so no reader sees the machine half
+     * removed: a row gone but its push token resolvable, or its owner key gone but an invitation
+     * it could redeem again still open.
+     *
+     * Through {@link mutateCadrePeer}, the membership hub. Every stamp is read inside the locked
+     * body, and a row whose stamp is already retired (held without its delete) is skipped rather
+     * than tombstoned twice. The by-name owner refusals of {@link deleteOwnerKey} apply to the
+     * owner-key arm. Nothing to remove writes nothing and returns all false.
+     *
+     * The caller decides WHAT to remove, which owner key is the machine's and which invitations
+     * it could use, from its plan (`CadreNode.planMachineRemoval`); this method only refuses to
+     * write an inconsistent set.
+     *
+     * @throws when `target.ownerKey` is `ownerKey`, or is the only live owner here.
+     */
+    async removeMachine(target, ownerKey, signMessage) {
+        if (target.ownerKey === ownerKey) {
+            throw new Error(`Cannot remove owner key ${ownerKey}: an owner cannot remove itself`);
+        }
+        return await this.mutateCadrePeer('machine-remove', async () => {
+            const removals = await this.signMachineRemovals(target, signMessage);
+            const withdrawals = await this.signCadreInviteWithdrawals(target.inviteKeys, signMessage);
+            if (removals.length === 0 && withdrawals.length === 0) {
+                log('removeMachine: nothing live names %s here (already removed)', target.peerId);
+                return { removedPeer: false, removedOwnerKey: false, removedDeviceToken: false, withdrawnInvitations: [] };
+            }
+            await this.inTransaction('remove machine', async () => {
+                for (const removal of removals) {
+                    await this.execGuardedRemoval(removal, ownerKey);
+                }
+                for (const withdrawal of withdrawals) {
+                    await this.execTombstone(withdrawal.ref, withdrawal.signature, ownerKey);
+                }
+            });
+            const removed = new Set(removals.map((removal) => removal.ref.tableName));
+            log('Machine %s removed: %s; %d invitation(s) withdrawn', target.peerId, [...removed].join(', ') || 'no row', withdrawals.length);
+            for (const removal of removals) {
+                this.notifyGuardedDelete(removal.ref);
+            }
+            for (const withdrawal of withdrawals) {
+                this.notifyGuardedDelete(withdrawal.ref);
+            }
+            return {
+                removedPeer: removed.has('CadrePeer'),
+                removedOwnerKey: removed.has('OwnerKey'),
+                removedDeviceToken: removed.has('DeviceToken'),
+                withdrawnInvitations: withdrawals.map((withdrawal) => withdrawal.ref.rowKey),
+            };
+        });
+    }
+    /**
+     * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
+     * the `CadrePeer` row, the `OwnerKey` row when named, the `DeviceToken` row when present.
+     * Inside the locked body (every read `retry: false`); one `Revocation` scan serves the
+     * retired-stamp check for all three tables and the last-owner refusal.
+     */
+    async signMachineRemovals(target, signMessage) {
+        const retiredByTable = new Map();
+        for (const tombstone of await this.queryRevocations(false)) {
+            const stamps = retiredByTable.get(tombstone.tableName) ?? new Set();
+            stamps.add(tombstone.stampId);
+            retiredByTable.set(tombstone.tableName, stamps);
+        }
+        const retired = (table) => retiredByTable.get(table) ?? new Set();
+        const liveStamp = async (table, keyValue) => {
+            const stampId = await this.queryStampId(table, keyValue, false);
+            return stampId !== null && !retired(table).has(stampId) ? stampId : null;
+        };
+        const removals = [];
+        const peerStamp = await liveStamp('CadrePeer', target.peerId);
+        if (peerStamp !== null) {
+            removals.push(signGuardedRemoval(this.config.partyId, 'CadrePeer', target.peerId, peerStamp, signMessage));
+        }
+        if (target.ownerKey !== null) {
+            const ownerStamp = await liveStamp('OwnerKey', target.ownerKey);
+            if (ownerStamp !== null) {
+                const owners = await this.queryOwnerKeyRows(false, retired('OwnerKey'));
+                if (owners.length <= 1) {
+                    throw new Error(`Cannot remove owner key ${target.ownerKey}: cannot remove the last owner`);
+                }
+                removals.push(signGuardedRemoval(this.config.partyId, 'OwnerKey', target.ownerKey, ownerStamp, signMessage));
+            }
+        }
+        const tokenStamp = await liveStamp('DeviceToken', target.peerId);
+        if (tokenStamp !== null) {
+            removals.push(signGuardedRemoval(this.config.partyId, 'DeviceToken', target.peerId, tokenStamp, signMessage));
+        }
+        return removals;
+    }
     /**
      * Insert a strand into the control database using an owner signature.
      *
@@ -1718,10 +1877,10 @@ export class ControlDatabase {
         const signature = signMessage(message);
         // StampId is a real, unique column (single-use anti-replay), no longer a context value.
         // FounderOwnerKey must equal the signing owner or the constraint rejects the row.
-        await this.execWrite(`
-      insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?)
+        await this.execWrite(`
+      insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?)
     `, [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey], 'strand-insert');
         log('Strand inserted: %s', strandId);
     }
@@ -1818,10 +1977,10 @@ export class ControlDatabase {
         // Id, PrivateKey, StampId.
         const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', this.config.partyId, [strandId, privateKey, stampId]);
         const signature = signMessage(message);
-        await this.execWrite(`
-      insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?)
+        await this.execWrite(`
+      insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?)
     `, [ownerKey, signature, strandId, privateKey, stampId], 'strand-party-key-insert');
         log('Strand party key inserted for strand: %s', strandId);
     }
@@ -1860,10 +2019,10 @@ export class ControlDatabase {
         // Id, Type, MemberPrivateKey ('' when null), StampId.
         const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', this.config.partyId, [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
         const signature = signMessage(message);
-        await this.execWrite(`
-      insert into CadreControl.JoinedStrand (Id, Type, MemberPrivateKey, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?)
+        await this.execWrite(`
+      insert into CadreControl.JoinedStrand (Id, Type, MemberPrivateKey, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?)
     `, [ownerKey, signature, row.Id, row.Type, row.MemberPrivateKey, stampId], 'joined-strand-insert');
         log('Joined strand inserted: %s', row.Id);
     }
@@ -1990,10 +2149,10 @@ export class ControlDatabase {
     }
     /** One unsigned outcome delete (see {@link deleteJoinOutcomes}; a failure's is also authorized by the join superseding it). */
     async deleteJoinOutcome(table, requestStampId) {
-        await this.db.exec(`
-      delete from CadreControl.${table}
-        with context OwnerKey = null, Signature = null
-        where RequestStampId = ?
+        await this.db.exec(`
+      delete from CadreControl.${table}
+        with context OwnerKey = null, Signature = null
+        where RequestStampId = ?
     `, [requestStampId]);
     }
     /**
@@ -2017,10 +2176,10 @@ export class ControlDatabase {
         // Field order MUST match the schema's ValidationKey `AuthorizedInsert` verify: Key, StampId.
         const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', this.config.partyId, [key, stampId]);
         const signature = signMessage(message);
-        await this.execWrite(`
-      insert into CadreControl.ValidationKey (Key, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?)
+        await this.execWrite(`
+      insert into CadreControl.ValidationKey (Key, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?)
     `, [ownerKey, signature, key, stampId], 'validation-key-insert');
         log('Validation key inserted: %s', key);
     }
@@ -2098,11 +2257,11 @@ export class ControlDatabase {
             // Persist the vouching (owner, signature) onto the row (VouchOwner/VouchSig) —
             // identical to the context pair, which the AuthorizedInsert constraint binds — so a
             // reader can later re-check the voucher against its node-local trusted-owner anchor.
-            await this.db.exec(`
-        insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig)
-          with context OwnerKey = ?, Signature = ?
-          values (?, ?, ?, ?, ?, ?, ?, ?)
-      `, [ownerKey, signature, row.peerId, row.publicKey, row.multiaddr, row.updatedAt, row.sig, stampId, ownerKey, signature]);
+            await this.db.exec(`
+        insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, Profile, StampId, VouchOwner, VouchSig)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `, [ownerKey, signature, row.peerId, row.publicKey, row.multiaddr, row.updatedAt, row.sig, row.profile, stampId, ownerKey, signature]);
             return true;
         });
     }
@@ -2116,7 +2275,8 @@ export class ControlDatabase {
      * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it grows, by
      * re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because the row
      * already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness stamp
-     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` are left intact — so it is safe
+     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact (the
+     * owner branch requires them kept: they are the machine's own claim) — so it is safe
      * over a row whose peer has not self-published (`Sig` null); the caller must skip a row
      * that already carries a self-`Sig` (that row is the owning peer's to refresh, and bumping
      * `UpdatedAt` without re-signing would invalidate its self-signature).
@@ -2169,11 +2329,11 @@ export class ControlDatabase {
         const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId]));
         await this.mutateCadrePeer('peer-reauthorize', async () => {
             // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
-            await this.db.exec(`
-        update CadreControl.CadrePeer
-          with context OwnerKey = ?, Signature = ?
-          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
-          where PeerId = ?
+            await this.db.exec(`
+        update CadreControl.CadrePeer
+          with context OwnerKey = ?, Signature = ?
+          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
+          where PeerId = ?
       `, [ownerKey, signature, updatedAt, ownerKey, signature, peerId]);
         });
         return true;
@@ -2276,10 +2436,10 @@ export class ControlDatabase {
      */
     async execGuardedRemoval(removal, ownerKey) {
         const { tableName, rowKey, stampId } = removal.ref;
-        await this.db.exec(`
-      delete from CadreControl.${tableName}
-        with context OwnerKey = ?, Signature = ?
-        where ${GUARDED_KEY_COLUMN[tableName]} = ? and StampId = ?
+        await this.db.exec(`
+      delete from CadreControl.${tableName}
+        with context OwnerKey = ?, Signature = ?
+        where ${GUARDED_KEY_COLUMN[tableName]} = ? and StampId = ?
     `, [ownerKey, removal.signature, rowKey, stampId]);
         await this.execTombstone(removal.ref, removal.revocationSignature, ownerKey);
     }
@@ -2298,10 +2458,10 @@ export class ControlDatabase {
      * equal), so a node that receives the row by replication can tell which owner filed it.
      */
     async execTombstone(ref, revocationSignature, ownerKey) {
-        await this.db.exec(`
-      insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, 0, ?, ?)
+        await this.db.exec(`
+      insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, 0, ?, ?)
     `, [ownerKey, revocationSignature, ref.tableName, ref.rowKey, ref.stampId, ownerKey, revocationSignature]);
     }
     /**
@@ -2384,10 +2544,10 @@ export class ControlDatabase {
             log('reap %s: %s holds a fresh incarnation (live stamp differs from the tombstoned one); leaving it', table, rowKey);
             return false;
         }
-        const sql = `
-      delete from CadreControl.${table}
-        with context OwnerKey = null, Signature = null
-        where ${GUARDED_KEY_COLUMN[table]} = ? and StampId = ?
+        const sql = `
+      delete from CadreControl.${table}
+        with context OwnerKey = null, Signature = null
+        where ${GUARDED_KEY_COLUMN[table]} = ? and StampId = ?
     `;
         if (table === 'CadrePeer') {
             // Through mutateCadrePeer so the "EVERY CadrePeer writer goes through here"
@@ -2449,8 +2609,8 @@ export class ControlDatabase {
      *   a retired stamp, and which a revoked drone cannot produce at all. The trade is
      *   recurring failure noise every cycle against removing the one stale row nobody else
      *   reads from this node (every other node already filters it by tombstone). A revoked
-     *   node therefore keeps its own copy of its own row; "a node that learns it has been
-     *   revoked should shut itself down" is a distinct behaviour and its own ticket.
+     *   node therefore keeps its own copy of its own row; learning that it was removed is a
+     *   separate behaviour (`CadreNode.removedFromCadre`, the `cadre:removed` event).
      *   `ValidationKey`, `JoinedStrand` and `JoinRequest` have no self notion and are not
      *   special-cased.
      *
@@ -2560,11 +2720,11 @@ export class ControlDatabase {
                     // output minted per row incarnation (generateStampId), so it identifies one
                     // row across all TableName values. Do NOT "fix" this by adding TableName to
                     // the where clause.
-                    await this.db.exec(`
-            update CadreControl.Revocation
-              with context OwnerKey = ?, Signature = ?
-              set ReissuedAt = ?
-              where StampId = ?
+                    await this.db.exec(`
+            update CadreControl.Revocation
+              with context OwnerKey = ?, Signature = ?
+              set ReissuedAt = ?
+              where StampId = ?
           `, [ownerKey, signature, reissuedAt, row.stampId]);
                     executed++;
                 }
@@ -2988,10 +3148,10 @@ export class ControlDatabase {
         // Persist the canonical ExpiresAt string (datetime parse is idempotent on it) so the
         // signed source-of-truth and the stored value are produced once. StampId is a real,
         // unique column (single-use anti-replay), no longer a context value.
-        await this.execWrite(`
-      insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?)
+        await this.execWrite(`
+      insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?, ?)
     `, [
             ownerKey, signature,
             token, sAppId,
@@ -3060,10 +3220,10 @@ export class ControlDatabase {
                 //    Hard-coded open + keyless + explicit null FounderOwnerKey: the
                 //    consent branch admits no other shape (no signature means no
                 //    trustworthy founder machine to record — see the schema's NOTE).
-                await this.db.exec(`
-          insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
-            with context OwnerKey = null, Signature = null
-            values (?, 'o', null, ?, null)
+                await this.db.exec(`
+          insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
+            with context OwnerKey = null, Signature = null
+            values (?, 'o', null, ?, null)
         `, [strandId, strandStampId]);
                 // 2. FormationUsage row — authorised by the matching FormationInvite, and
                 //    carrying the strand's stamp so it authorizes THIS row and no other.
@@ -3183,10 +3343,10 @@ export class ControlDatabase {
         // robustness/consistency change, matching the strand layer's `consumeInvite`,
         // not a fix for an observable mis-ordering.
         const nowCanonical = await canonicalDatetime(this.db, opts.nowMs);
-        await this.db.exec(`
-      insert into CadreControl.FormationUsage (Token, UsageStampId, PeerKey, PeerSig, Disclosure, StrandId, StrandStampId)
-        with context Now = ?, ValidationKey = ?, ValidationSignature = ?
-        values (?, ?, ?, ?, ?, ?, ?)
+        await this.db.exec(`
+      insert into CadreControl.FormationUsage (Token, UsageStampId, PeerKey, PeerSig, Disclosure, StrandId, StrandStampId)
+        with context Now = ?, ValidationKey = ?, ValidationSignature = ?
+        values (?, ?, ?, ?, ?, ?, ?)
     `, [
             nowCanonical, opts.validationKey, opts.validationSignature,
             opts.token, opts.usageStampId, opts.peerKey,
@@ -3204,18 +3364,18 @@ export class ControlDatabase {
      */
     async queryFormationInvite(token, retry = true) {
         this.ensureInitialized();
-        const sql = 'select Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId from CadreControl.FormationInvite where Token = ?';
-        for (const row of await this.readRows(sql, [token], 'formation-invite', retry)) {
-            return {
-                token: row.Token,
-                sAppId: row.sAppId,
-                expiresAtMs: parseNullableStoredDatetimeMs(row.ExpiresAt),
-                totalUses: row.TotalUses ?? null,
-                validationUrl: row.ValidationUrl ?? null,
-                strandId: row.StrandId ?? null,
-            };
-        }
-        return null;
+        const rows = await this.readRows(`${FORMATION_INVITE_SELECT_SQL} where Token = ?`, [token], 'formation-invite', retry);
+        return rows.length === 0 ? null : formationInviteRowOf(rows[0]);
+    }
+    /**
+     * Every `FormationInvite` row, expired and spent ones included, in the shape
+     * {@link queryFormationInvite} returns one. Read by a strand move
+     * (`exportStrandBundle`), which decides per row what is still redeemable.
+     */
+    async queryFormationInvites() {
+        this.ensureInitialized();
+        const rows = await this.readRows(FORMATION_INVITE_SELECT_SQL, undefined, 'formation-invites');
+        return rows.map(formationInviteRowOf);
     }
     /**
      * Count `FormationUsage` rows recorded against a token (uses consumed so far).
@@ -3392,10 +3552,10 @@ export class ControlDatabase {
     }
     /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
     async execCadreInviteInsert(row) {
-        await this.db.exec(`
-      insert into CadreControl.CadreInvite (Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?, ?)
+        await this.db.exec(`
+      insert into CadreControl.CadreInvite (Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?, ?, ?)
     `, [
             row.issuerKey, row.issuerSig,
             row.key, row.peerId, row.grantsOwner ? 1 : 0, row.expiresAt, row.totalUses,
@@ -3571,19 +3731,12 @@ export class ControlDatabase {
     async withdrawCadreInvite(key, ownerKey, signMessage) {
         this.ensureInitialized();
         const filed = await this.lockedWithRetry(async () => {
-            // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
-            const stampId = await this.queryStampId('CadreInvite', key, false);
-            if (stampId === null) {
-                log('withdrawCadreInvite: no CadreInvite row for %s (nothing to withdraw)', key);
+            const [withdrawal] = await this.signCadreInviteWithdrawals([key], signMessage);
+            if (withdrawal === undefined) {
                 return null;
             }
-            if ((await this.queryRevokedStamps('CadreInvite', false)).has(stampId)) {
-                log('withdrawCadreInvite: %s already withdrawn (stamp %s retired)', key, stampId);
-                return null;
-            }
-            const ref = { tableName: 'CadreInvite', rowKey: key, stampId };
-            await this.execTombstone(ref, signMessage(revocationTombstoneMessage(this.config.partyId, ref)), ownerKey);
-            return ref;
+            await this.execTombstone(withdrawal.ref, withdrawal.signature, ownerKey);
+            return withdrawal.ref;
         }, {}, 'cadre-invite-withdraw');
         if (filed === null) {
             return false;
@@ -3592,6 +3745,34 @@ export class ControlDatabase {
         this.notifyGuardedDelete(filed);
         return true;
     }
+    /**
+     * The withdrawal tombstones for the `CadreInvite` rows among `keys` that are held here and
+     * not yet withdrawn, signed and ready for {@link execTombstone}: the body
+     * {@link withdrawCadreInvite} files one of and {@link removeMachine} files several of in one
+     * transaction. Inside the locked body (every read `retry: false`); an absent or already
+     * withdrawn key is logged and left out.
+     */
+    async signCadreInviteWithdrawals(keys, signMessage) {
+        if (keys.length === 0) {
+            return [];
+        }
+        const withdrawn = await this.queryRevokedStamps('CadreInvite', false);
+        const withdrawals = [];
+        for (const key of keys) {
+            const stampId = await this.queryStampId('CadreInvite', key, false);
+            if (stampId === null) {
+                log('withdrawCadreInvite: no CadreInvite row for %s (nothing to withdraw)', key);
+                continue;
+            }
+            if (withdrawn.has(stampId)) {
+                log('withdrawCadreInvite: %s already withdrawn (stamp %s retired)', key, stampId);
+                continue;
+            }
+            const ref = { tableName: 'CadreInvite', rowKey: key, stampId };
+            withdrawals.push({ ref, signature: signMessage(revocationTombstoneMessage(this.config.partyId, ref)) });
+        }
+        return withdrawals;
+    }
     /**
      * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
      * when the invitation grants ownership, as an owner — with NO owner signature. One
@@ -3647,23 +3828,23 @@ export class ControlDatabase {
             const nowCanonical = await canonicalDatetime(this.db, nowMs);
             await this.inTransaction('cadre-invite-redeem', async () => {
                 if (seated.peerStampId === null) {
-                    await this.db.exec(`
-            insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
-              with context OwnerKey = null, Signature = null
-              values (?, ?, ?, ?, null, ?, ?, null, ?)
+                    await this.db.exec(`
+            insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
+              with context OwnerKey = null, Signature = null
+              values (?, ?, ?, ?, null, ?, ?, null, ?)
           `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
                 }
                 if (ownerStampId !== null && seated.ownerStampId === null) {
-                    await this.db.exec(`
-            insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig, VouchUsage)
-              with context OwnerKey = null, Signature = null
-              values (?, ?, ?, null, ?)
+                    await this.db.exec(`
+            insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig, VouchUsage)
+              with context OwnerKey = null, Signature = null
+              values (?, ?, ?, null, ?)
           `, [peerKey, ownerStampId, invite.issuerKey, usageStampId]);
                 }
-                await this.db.exec(`
-          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig)
-            with context Now = ?
-            values (?, ?, ?, ?, ?, ?, ?, ?)
+                await this.db.exec(`
+          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig)
+            with context Now = ?
+            values (?, ?, ?, ?, ?, ?, ?, ?)
         `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, ownerStampId, inviteSig, peerSig]);
             });
             log('Redeemed cadre invitation %s: %s admitted (owner=%s, usage %s)', inviteKey, peerId, ownerStampId !== null, usageStampId);