@serfab/cadre-core 1.16.0 → 1.17.0

package/dist/delegate-admission.d.ts

@@ -38,6 +38,7 @@
  * {@link dueRelayAnnounces} and {@link prunePeerStrandKeys} are that
  * decision, pure and testable, kept here beside the TTL they are derived from.
  */
+import type { StrandAddrOutcome } from './strand-addr-protocol.js';
 /**
  * How long one announced delegate grant stays valid without a re-announce.
  * Announcers refresh at half this (`CadreNode`'s reconcile pass), so a live
@@ -121,6 +122,18 @@ export declare function extractCircuitRelayTargets(addrs: string[]): CircuitRela
  * {@link peerStrandKey} on the peer announced TO.
  */
 export declare function dueRelayAnnounces(announceAt: ReadonlyMap<string, number>, relays: readonly CircuitRelayTarget[], strandId: string, now: number, ttlMs?: number): CircuitRelayTarget[];
+/**
+ * Fold one announce pass's outcomes into `refusing`, the relay peerIds remembered
+ * as refusing the strand-addr protocol. A relay whose negotiation refused it
+ * (`unsupported`) is added; one that replied with any status is removed, because
+ * it serves the protocol now. A relay that did not reply (`unreachable`) is left
+ * as it was: being down says nothing about what it serves. Only `relayPeerIds`
+ * are read, so a sibling asked in the same pass is never recorded. Mutates in
+ * place.
+ */
+export declare function recordRelayRefusals(refusing: Set<string>, relayPeerIds: readonly string[], outcomes: ReadonlyMap<string, StrandAddrOutcome>): void;
+/** Of `relays`, the ones not remembered in `refusing` (see {@link recordRelayRefusals}). */
+export declare function relaysNotRefusing(relays: readonly CircuitRelayTarget[], refusing: ReadonlySet<string>): CircuitRelayTarget[];
 /**
  * Drop the entries of a {@link peerStrandKey}-keyed map whose strand is no longer
  * running, and — when `livePeerIds` is given — whose peer is not among them. A

package/dist/delegate-admission.js

@@ -183,6 +183,33 @@ export function extractCircuitRelayTargets(addrs) {
 export function dueRelayAnnounces(announceAt, relays, strandId, now, ttlMs = DELEGATE_GRANT_TTL_MS) {
     return relays.filter((relay) => now - (announceAt.get(peerStrandKey(relay.relayPeerId, strandId)) ?? 0) >= ttlMs / 2);
 }
+/**
+ * Fold one announce pass's outcomes into `refusing`, the relay peerIds remembered
+ * as refusing the strand-addr protocol. A relay whose negotiation refused it
+ * (`unsupported`) is added; one that replied with any status is removed, because
+ * it serves the protocol now. A relay that did not reply (`unreachable`) is left
+ * as it was: being down says nothing about what it serves. Only `relayPeerIds`
+ * are read, so a sibling asked in the same pass is never recorded. Mutates in
+ * place.
+ */
+export function recordRelayRefusals(refusing, relayPeerIds, outcomes) {
+    for (const relayPeerId of relayPeerIds) {
+        switch (outcomes.get(relayPeerId)) {
+            case 'unsupported':
+                refusing.add(relayPeerId);
+                break;
+            case 'answered':
+            case 'empty':
+            case 'unavailable':
+                refusing.delete(relayPeerId);
+                break;
+        }
+    }
+}
+/** Of `relays`, the ones not remembered in `refusing` (see {@link recordRelayRefusals}). */
+export function relaysNotRefusing(relays, refusing) {
+    return relays.filter((relay) => !refusing.has(relay.relayPeerId));
+}
 /**
  * Drop the entries of a {@link peerStrandKey}-keyed map whose strand is no longer
  * running, and — when `livePeerIds` is given — whose peer is not among them. A

package/dist/delegate-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegate-admission.js","sourceRoot":"","sources":["../src/delegate-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAcvC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,OAAO,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAIjC,YAAY,QAAgB,qBAAqB;QAHhC,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAIzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAuB,EAAE,QAAgB,EAAE,cAAsB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CACb,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAC7C,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,uDAAuD,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5H,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,oFAAoF;IACpF,GAAG,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,GAAW,EAAE,MAAyC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAA6B,CAAC;QAClC,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;gBACnC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,GAAG,CAAC,8EAA8E,EAChF,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAe;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAuC,EACvC,MAAqC,EACrC,QAAgB,EAChB,GAAW,EACX,QAAgB,qBAAqB;IAErC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAChG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,gBAAqC,EACrC,WAAiC;IAEjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B;IAC7D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"delegate-admission.js","sourceRoot":"","sources":["../src/delegate-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAcvC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,OAAO,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAIjC,YAAY,QAAgB,qBAAqB;QAHhC,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAIzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAuB,EAAE,QAAgB,EAAE,cAAsB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CACb,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAC7C,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,uDAAuD,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5H,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,oFAAoF;IACpF,GAAG,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,GAAW,EAAE,MAAyC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAA6B,CAAC;QAClC,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;gBACnC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,GAAG,CAAC,8EAA8E,EAChF,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAe;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAuC,EACvC,MAAqC,EACrC,QAAgB,EAChB,GAAW,EACX,QAAgB,qBAAqB;IAErC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAChG,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAqB,EACrB,YAA+B,EAC/B,QAAgD;IAEhD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,QAAQ,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,KAAK,aAAa;gBAChB,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,OAAO,CAAC;YACb,KAAK,aAAa;gBAChB,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC7B,MAAM;QACV,CAAC;IACH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAC/B,MAAqC,EACrC,QAA6B;IAE7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,gBAAqC,EACrC,WAAiC;IAEjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B;IAC7D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/ed25519-key.d.ts

@@ -40,6 +40,16 @@ export declare function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed2551
  * @returns The base64url-encoded Ed25519 public key.
  */
 export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): string;
+/**
+ * Reject a value that isn't a base64url-encoded 32-byte Ed25519 seed, the private-key form
+ * {@link ed25519PublicKeyFromPrivate} and the crypto plugin's `sign` take. Unlike
+ * {@link requireEd25519PublicKeyB64}, no message names the value: it is a private key.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 seed; surrounding whitespace is ignored.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The seed re-encoded as canonical base64url, so two spellings of one key compare equal.
+ */
+export declare function requireEd25519PrivateKeyB64(value: string, label: string): string;
 /**
  * Derive the base64url ed25519 public key embedded in an Ed25519 libp2p PeerId.
  *
@@ -55,13 +65,6 @@ export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): stri
  * without importing the seed-bootstrap runtime.
  */
 export declare function ed25519PublicKeyB64FromPeerId(peerId: string): string | null;
-/**
- * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
- * is this ed25519 public key (base64url), or null when the value does not decode to a
- * 32-byte key. How an `OwnerKey` row is matched to the machine it names
- * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
- */
-export declare function peerIdFromEd25519PublicKeyB64(publicKeyB64: string): string | null;
 /**
  * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
  * before it reaches the control database, where a malformed key would otherwise sit

package/dist/ed25519-key.js

@@ -1,7 +1,6 @@
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
-import { peerIdFromPublicKey, peerIdFromString } from '@libp2p/peer-id';
-import { publicKeyFromRaw } from '@libp2p/crypto/keys';
+import { peerIdFromString } from '@libp2p/peer-id';
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
  * control- and strand-database signing constraints.
@@ -50,6 +49,28 @@ export function ed25519KeyPairFromLibp2p(privateKey) {
 export function ed25519PublicKeyFromPrivate(privateKeyB64) {
     return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url');
 }
+/**
+ * Reject a value that isn't a base64url-encoded 32-byte Ed25519 seed, the private-key form
+ * {@link ed25519PublicKeyFromPrivate} and the crypto plugin's `sign` take. Unlike
+ * {@link requireEd25519PublicKeyB64}, no message names the value: it is a private key.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 seed; surrounding whitespace is ignored.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The seed re-encoded as canonical base64url, so two spellings of one key compare equal.
+ */
+export function requireEd25519PrivateKeyB64(value, label) {
+    let decoded;
+    try {
+        decoded = uint8ArrayFromString(value.trim(), 'base64url');
+    }
+    catch (error) {
+        throw new Error(`The ${label} must be a base64url-encoded Ed25519 private key (it does not decode as base64url)`, { cause: error });
+    }
+    if (decoded.length !== 32) {
+        throw new Error(`The ${label} must be a base64url-encoded 32-byte Ed25519 private key (it decoded to ${decoded.length} bytes)`);
+    }
+    return uint8ArrayToString(decoded, 'base64url');
+}
 /**
  * Derive the base64url ed25519 public key embedded in an Ed25519 libp2p PeerId.
  *
@@ -76,24 +97,6 @@ export function ed25519PublicKeyB64FromPeerId(peerId) {
         return null;
     }
 }
-/**
- * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
- * is this ed25519 public key (base64url), or null when the value does not decode to a
- * 32-byte key. How an `OwnerKey` row is matched to the machine it names
- * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
- */
-export function peerIdFromEd25519PublicKeyB64(publicKeyB64) {
-    try {
-        const raw = uint8ArrayFromString(publicKeyB64, 'base64url');
-        if (raw.length !== 32) {
-            return null;
-        }
-        return peerIdFromPublicKey(publicKeyFromRaw(raw)).toString();
-    }
-    catch {
-        return null;
-    }
-}
 /** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
 const REJECTED_VALUE_ECHO_LIMIT = 64;
 /**

package/dist/ed25519-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgBvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAgBnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,KAAa;IACtE,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,oFAAoF,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,2EAA2E,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/edge-node/config.d.ts

@@ -0,0 +1,122 @@
+/**
+ * The edge node's `CadreNodeConfig` and how a start settles its owner key. Nothing here needs a
+ * node started, so a test can build the node shape an edge device runs.
+ */
+import { type KeyStore } from '../key-store.js';
+import type { CadreNode } from '../cadre-node.js';
+import type { CadreNodeConfig } from '../types.js';
+import type { BootstrapPeerStore } from '../bootstrap-peer-store.js';
+import type { EnrolledMachineStore } from '../enrolled-machine-store.js';
+import type { StrandNetworkStateStore } from '../strand-network-state.js';
+import type { TrustedOwnerStore } from '../trusted-owner-store.js';
+import type { IRawStorage, Libp2pTransports, NoiseCryptoInterface } from '@optimystic/db-p2p';
+import type { EdgeNodeOptions } from './options.js';
+/** What {@link buildEdgeNodeConfig} takes: one start's options plus what the platform built. */
+export interface EdgeNodeConfigInputs extends EdgeNodeOptions {
+    /** `undefined` keeps libp2p-noise's own crypto. */
+    noiseCrypto?: NoiseCryptoInterface;
+    /**
+     * Holds the node identity, which the node loads on start, generating it on first run, and the
+     * owner key in its own slot (`DEFAULT_OWNER_KEY_ID`), which only {@link runOwnerGenesis} creates.
+     */
+    keyStore: KeyStore;
+    /**
+     * Raw block storage per cadre-core storage scope: `controlStorageScope(partyId)` for the
+     * control network, the strand id for each strand. The key is already safe as a database-name
+     * segment — use it verbatim, do not parse it.
+     */
+    storageProvider: (scope: string) => IRawStorage;
+    /** libp2p transport factories: what the node dials with, and what listens on `listenAddrs`. */
+    transports: Libp2pTransports;
+    /**
+     * Listen addresses besides the bare `/p2p-circuit` entry cadre-core adds for a named relay.
+     * Default `[]`: an edge device accepts no inbound connection. See `EdgeNodePlatform.listenAddrs`.
+     */
+    listenAddrs?: string[];
+    /** See `EdgeNodePlatform.allowPrivateDial`. */
+    allowPrivateDial: boolean;
+    trustedOwnerStore: TrustedOwnerStore;
+    bootstrapPeerStore: BootstrapPeerStore;
+    enrolledMachineStore: EnrolledMachineStore;
+    strandNetworkStateStore: StrandNetworkStateStore;
+}
+/**
+ * The edge node's config: transaction profile (Ring Zulu only, intermittent connectivity), no
+ * listen address unless the platform names one, reachability through the configured relays (if
+ * any) but never a hard requirement for one, every strand the control network lists, and no
+ * automatic hibernation (the app's lifecycle runner hibernates on background). Schema signing is
+ * left at cadre-core's fail-closed default; an app with unsigned schemas relaxes it in
+ * `EdgeNodePlatform.configure`.
+ */
+export declare function buildEdgeNodeConfig(inputs: EdgeNodeConfigInputs): CadreNodeConfig;
+/**
+ * How the start settled this node's owner key: `EdgeNodeStatus.owner`. `'enrolled'`: a key is
+ * an owner and wired for signing. `'member'`: the party lists no key this app holds (a party it
+ * joined, or one it founded whose owner slot was lost). `'failed'` and `'timed-out'`: see
+ * {@link runOwnerGenesis}.
+ */
+export type OwnerGenesisResult = 'enrolled' | 'member' | 'failed' | 'timed-out';
+/**
+ * Default bound on {@link runOwnerGenesis} and {@link wireJoinedOwnerKey}: what a start can wait
+ * for its owner step, which runs control reads and one control write, before it goes on without
+ * it. Not derived from the link, since a start that waited out a stalled write (about 84 s, see
+ * `docs/cadre-consistency.md`) would be a start the user gave up on.
+ */
+export declare const DEFAULT_OWNER_GENESIS_TIMEOUT_MS = 60000;
+/** Default `EdgeNodeOptions.ownerKeyLabel`: the founding owner key's name on its `OwnerKey` row. */
+export declare const DEFAULT_OWNER_KEY_LABEL = "phone";
+/**
+ * Refuses an `ownerKeyLabel` the founding `OwnerKey` row would refuse, so a start naming one
+ * fails outright: fail-soft genesis would only log it, on that start and every later one.
+ */
+export declare function requireOwnerKeyLabel(label: string | undefined): void;
+/** What {@link runOwnerGenesis} takes. */
+export interface OwnerGenesisOptions {
+    /** The key store whose owner slot holds this app's owner key: the one the identity is in. */
+    keyStore: KeyStore;
+    /** The founding row's label; default {@link DEFAULT_OWNER_KEY_LABEL}. */
+    label?: string;
+    /** Default {@link DEFAULT_OWNER_GENESIS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}
+/** What {@link wireJoinedOwnerKey} takes. */
+export interface JoinedOwnerKeyOptions {
+    /** The key store whose owner slot holds this app's owner key, if it holds one. */
+    keyStore: KeyStore;
+    /** Default {@link DEFAULT_OWNER_GENESIS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /** An owner grant has just seated the slot's key: keep asking until the row arrives. */
+    granted?: boolean;
+}
+/**
+ * The owner step of a party this app founded. On a party with no `OwnerKey` row yet, the owner
+ * slot's key (created there now unless the slot already holds one) becomes the founding owner
+ * under `label` and is wired for signing, which also lets the node author its own `CadrePeer` row.
+ * On a party that has owners, the slot's key is wired only when it is a live owner, and no key is
+ * created: a new one could not be seated without another owner's signature. A node must be an
+ * enrolled owner to publish strands, and `CadreNode.requestJoin` works only on one. A joined
+ * party's start runs {@link wireJoinedOwnerKey} instead.
+ *
+ * Fail-soft and bounded: a failure or a genesis that has not settled within `timeoutMs` is logged
+ * and returned, and the start stands — the app can still join discovered strands and sync. A
+ * genesis that times out keeps running; its later failure is logged.
+ *
+ * NOTE: the bound is here, in cadre-core, so every edge node gets it; a Node host runs genesis
+ * through the CLI's own flow instead. Since v1.10 a control write against an unresponsive member
+ * can hold the write lock for about 84 s, so an unbounded wait here would be a real stall. A bound
+ * on that write itself, in `ControlDatabase`, would make this one redundant; drop `timeoutMs` then.
+ */
+export declare function runOwnerGenesis(node: CadreNode, options: OwnerGenesisOptions): Promise<OwnerGenesisResult>;
+/**
+ * The owner step of a party this app joined: wire a key only when the party lists it as a live
+ * owner, never insert an `OwnerKey` row, so a joined app can neither seat itself as a founder nor
+ * anchor a key that is no owner's. Only the owner slot's key is tried: the key an owner grant
+ * seated, one imported here, or one an owner of the party added. The identity key is never
+ * tried, since a machine's network identity is never an owner key. Fail-soft and bounded as
+ * {@link runOwnerGenesis} is.
+ *
+ * `granted`: an owner grant has just made this app an owner, so a key not listed yet means the
+ * row has not reached this node, not that it is no owner. It is asked again every 2 s until it
+ * is wired or the bound passes; a start that timed out wires it on the next start.
+ */
+export declare function wireJoinedOwnerKey(node: CadreNode, options: JoinedOwnerKeyOptions): Promise<OwnerGenesisResult>;

package/dist/edge-node/config.js

@@ -0,0 +1,199 @@
+/**
+ * The edge node's `CadreNodeConfig` and how a start settles its owner key. Nothing here needs a
+ * node started, so a test can build the node shape an edge device runs.
+ */
+import { DEFAULT_IDENTITY_KEY_ID } from '../key-store.js';
+import { createOwnerKey, loadOwnerSigner } from '../owner-key-store.js';
+import { OWNER_KEY_MAX_LABEL } from '../owner-key-export.js';
+/**
+ * The edge node's config: transaction profile (Ring Zulu only, intermittent connectivity), no
+ * listen address unless the platform names one, reachability through the configured relays (if
+ * any) but never a hard requirement for one, every strand the control network lists, and no
+ * automatic hibernation (the app's lifecycle runner hibernates on background). Schema signing is
+ * left at cadre-core's fail-closed default; an app with unsigned schemas relaxes it in
+ * `EdgeNodePlatform.configure`.
+ */
+export function buildEdgeNodeConfig(inputs) {
+    return {
+        // Identity comes from the key store (loaded when present, generated and persisted on first
+        // run). Mutually exclusive with `privateKey`, which would take it out of the key store.
+        keyStore: inputs.keyStore,
+        identityKeyId: DEFAULT_IDENTITY_KEY_ID,
+        controlNetwork: {
+            partyId: inputs.partyId,
+            bootstrapNodes: inputs.bootstrapAddrs,
+        },
+        profile: 'transaction',
+        storage: {
+            provider: inputs.storageProvider,
+        },
+        network: {
+            transports: inputs.transports,
+            // An edge device accepts no inbound connection, so by default it listens on nothing:
+            // the only address it ever has is the `/p2p-circuit` address a relay reservation earns
+            // it. An explicitly empty `listenAddrs` stays empty through cadre-core's derivation, and
+            // naming a relay adds the bare `/p2p-circuit` search entry to it
+            // (`cadre-core/src/relay-addrs.ts` → `resolveListenAddrs`). A browser adds `/webrtc`.
+            listenAddrs: inputs.listenAddrs ?? [],
+            // Through this config field rather than `CadreNode.reserveRelays()`, which reaches the
+            // control node only: formation has the invitee dial the control node and then the strand
+            // nodes, so both need a circuit address.
+            //
+            // NOTE: naming a relay starts a reservation supervisor that runs for as long as the
+            // control node does, including while backgrounded (hibernation stops strands, not the
+            // control node): a 5 s local check while the reservation holds, a dial every backoff
+            // interval (2 s → 60 s) while it does not. If background battery use becomes a complaint,
+            // raise `checkMs`/`maxBackoffMs` in cadre-core rather than stopping the supervisor here,
+            // which would leave a device that silently stopped being invitable.
+            relayAddrs: inputs.relayAddrs,
+            // An edge device must come up with its relay down — on a plane, on dead Wi-Fi, or with
+            // none configured. A first reservation attempt that lands nothing is logged and retried in
+            // the background instead of failing `start()`. A malformed entry still throws.
+            requireRelay: false,
+            // The platform's Noise primitives (native SHA-256 / ChaCha20-Poly1305, and X25519 in
+            // `full` mode, on a phone); only local primitives change, not the wire protocol.
+            noiseCrypto: inputs.noiseCrypto,
+            // libp2p's `connection-gater` points its `react-native` and `browser` fields at a build
+            // that refuses to dial plain `ws://`, loopback and private addresses. A cadre-host node
+            // claimed by its code on the same Wi-Fi, an emulator reaching `10.0.2.2` and a self-run
+            // relay without TLS are all of those. Only the dial is permitted: the connection is still
+            // Noise, the pinned `/p2p/<id>` decides which machine answers, and membership is still
+            // gated by `denyDialPeer` and the inbound hooks. cadre-core hands this gater to strand nodes too.
+            ...(inputs.allowPrivateDial ? { connectionGater: { denyDialMultiaddr: () => false } } : {}),
+        },
+        strandFilter: { mode: 'all' },
+        hibernation: { enabled: false },
+        trustedOwners: { store: inputs.trustedOwnerStore },
+        bootstrapPeers: { store: inputs.bootstrapPeerStore },
+        enrolledMachines: { store: inputs.enrolledMachineStore },
+        strandNetworkState: { store: inputs.strandNetworkStateStore },
+    };
+}
+/**
+ * Default bound on {@link runOwnerGenesis} and {@link wireJoinedOwnerKey}: what a start can wait
+ * for its owner step, which runs control reads and one control write, before it goes on without
+ * it. Not derived from the link, since a start that waited out a stalled write (about 84 s, see
+ * `docs/cadre-consistency.md`) would be a start the user gave up on.
+ */
+// eslint-disable-next-line no-restricted-syntax -- cuts off by design: a start goes on without its owner step rather than wait out a stalled control write; see docs/cadre-consistency.md → "Deadlines Over Optimystic's Reads and Commits"
+export const DEFAULT_OWNER_GENESIS_TIMEOUT_MS = 60000;
+/** Default `EdgeNodeOptions.ownerKeyLabel`: the founding owner key's name on its `OwnerKey` row. */
+export const DEFAULT_OWNER_KEY_LABEL = 'phone';
+/**
+ * Refuses an `ownerKeyLabel` the founding `OwnerKey` row would refuse, so a start naming one
+ * fails outright: fail-soft genesis would only log it, on that start and every later one.
+ */
+export function requireOwnerKeyLabel(label) {
+    const length = label?.trim().length ?? 0;
+    if (length > OWNER_KEY_MAX_LABEL) {
+        throw new Error(`ownerKeyLabel must be at most ${OWNER_KEY_MAX_LABEL} characters (this one has ${length})`);
+    }
+}
+/** How often {@link wireJoinedOwnerKey} asks again for an owner key an owner grant just seated. */
+const GRANTED_OWNER_RECHECK_MS = 2000;
+/**
+ * The owner step of a party this app founded. On a party with no `OwnerKey` row yet, the owner
+ * slot's key (created there now unless the slot already holds one) becomes the founding owner
+ * under `label` and is wired for signing, which also lets the node author its own `CadrePeer` row.
+ * On a party that has owners, the slot's key is wired only when it is a live owner, and no key is
+ * created: a new one could not be seated without another owner's signature. A node must be an
+ * enrolled owner to publish strands, and `CadreNode.requestJoin` works only on one. A joined
+ * party's start runs {@link wireJoinedOwnerKey} instead.
+ *
+ * Fail-soft and bounded: a failure or a genesis that has not settled within `timeoutMs` is logged
+ * and returned, and the start stands — the app can still join discovered strands and sync. A
+ * genesis that times out keeps running; its later failure is logged.
+ *
+ * NOTE: the bound is here, in cadre-core, so every edge node gets it; a Node host runs genesis
+ * through the CLI's own flow instead. Since v1.10 a control write against an unresponsive member
+ * can hold the write lock for about 84 s, so an unbounded wait here would be a real stall. A bound
+ * on that write itself, in `ControlDatabase`, would make this one redundant; drop `timeoutMs` then.
+ */
+export function runOwnerGenesis(node, options) {
+    const label = options.label ?? DEFAULT_OWNER_KEY_LABEL;
+    return withinBound('owner self-genesis', enrollFoundedOwner(node, options.keyStore, label), options.timeoutMs ?? DEFAULT_OWNER_GENESIS_TIMEOUT_MS);
+}
+/**
+ * The owner step of a party this app joined: wire a key only when the party lists it as a live
+ * owner, never insert an `OwnerKey` row, so a joined app can neither seat itself as a founder nor
+ * anchor a key that is no owner's. Only the owner slot's key is tried: the key an owner grant
+ * seated, one imported here, or one an owner of the party added. The identity key is never
+ * tried, since a machine's network identity is never an owner key. Fail-soft and bounded as
+ * {@link runOwnerGenesis} is.
+ *
+ * `granted`: an owner grant has just made this app an owner, so a key not listed yet means the
+ * row has not reached this node, not that it is no owner. It is asked again every 2 s until it
+ * is wired or the bound passes; a start that timed out wires it on the next start.
+ */
+export function wireJoinedOwnerKey(node, options) {
+    let expired = false;
+    const wiring = async () => {
+        const held = await loadOwnerSigner(options.keyStore);
+        while (!(await wireJoinedOwner(node, held))) {
+            if (!options.granted)
+                return 'member';
+            await new Promise((resolve) => setTimeout(resolve, GRANTED_OWNER_RECHECK_MS));
+            // Past the bound the start has gone on as `'timed-out'`, and may have stopped the node.
+            if (expired)
+                return 'member';
+        }
+        return 'enrolled';
+    };
+    return withinBound('wiring the joined owner key', wiring(), options.timeoutMs ?? DEFAULT_OWNER_GENESIS_TIMEOUT_MS)
+        .finally(() => {
+        expired = true;
+    });
+}
+/** `settling`, or `'failed'` when it rejects (logged), or `'timed-out'` when it has not settled within `timeoutMs` (logged). */
+async function withinBound(label, settling, timeoutMs) {
+    const settled = settling.catch((err) => {
+        console.warn(`[cadre-core/edge-node] ${label} failed:`, err);
+        return 'failed';
+    });
+    let timer;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => resolve('timed-out'), timeoutMs);
+    });
+    try {
+        const result = await Promise.race([settled, deadline]);
+        if (result === 'timed-out') {
+            console.warn(`[cadre-core/edge-node] ${label} has not settled after ${timeoutMs} ms; starting without it`);
+        }
+        return result;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function enrollFoundedOwner(node, keyStore, label) {
+    const controlDb = node.getControlDatabase();
+    if (!controlDb) {
+        throw new Error('control database unavailable after start; cannot run owner genesis');
+    }
+    const held = await loadOwnerSigner(keyStore);
+    if (await controlDb.hasOwnerKey()) {
+        return held ? wiredIfOwner(node, held) : 'member';
+    }
+    // Loaded rather than created when the slot already holds a key: one imported before founding,
+    // or one an iOS reinstall kept in the Keychain while the app's data went.
+    const founding = held ?? (await createOwnerKey(keyStore));
+    if (!(await controlDb.ensureOwnerKey(founding.publicKey, label))) {
+        // A row arrived between the two reads: the party has an owner now, so judge the key as above.
+        return wiredIfOwner(node, founding);
+    }
+    await node.useOwnerSigner(founding);
+    return 'enrolled';
+}
+async function wiredIfOwner(node, signer) {
+    return (await node.wireOwnKeyIfOwner(signer)) ? 'enrolled' : 'member';
+}
+/**
+ * Wire `held`, the owner slot's key, when the party lists it. A node takes one owner signer, so
+ * a signer already wired is asked about instead (is it still a live owner?) and never replaced.
+ */
+async function wireJoinedOwner(node, held) {
+    if (node.getOwnerSigner() !== null)
+        return await node.wireOwnKeyIfOwner();
+    return held !== undefined && (await node.wireOwnKeyIfOwner(held));
+}
+//# sourceMappingURL=config.js.map

package/dist/edge-node/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/edge-node/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,uBAAuB,EAAiB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAyC7D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC/D,OAAO;QACN,2FAA2F;QAC3F,wFAAwF;QACxF,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,uBAAuB;QACtC,cAAc,EAAE;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;SACrC;QACD,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,eAAe;SAChC;QACD,OAAO,EAAE;YACR,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,qFAAqF;YACrF,uFAAuF;YACvF,yFAAyF;YACzF,iEAAiE;YACjE,sFAAsF;YACtF,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,uFAAuF;YACvF,yFAAyF;YACzF,yCAAyC;YACzC,EAAE;YACF,oFAAoF;YACpF,sFAAsF;YACtF,qFAAqF;YACrF,0FAA0F;YAC1F,yFAAyF;YACzF,oEAAoE;YACpE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,uFAAuF;YACvF,2FAA2F;YAC3F,+EAA+E;YAC/E,YAAY,EAAE,KAAK;YACnB,qFAAqF;YACrF,iFAAiF;YACjF,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,wFAAwF;YACxF,wFAAwF;YACxF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,kGAAkG;YAClG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F;QACD,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAC7B,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC/B,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE;QAClD,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACpD,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,uBAAuB,EAAE;KAC7D,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,4OAA4O;AAC5O,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAM,CAAC;AAEvD,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC7D,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iCAAiC,mBAAmB,6BAA6B,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;AACF,CAAC;AAsBD,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,IAAK,CAAC;AAEvC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,OAA4B;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,uBAAuB,CAAC;IACvD,OAAO,WAAW,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,gCAAgC,CAAC,CAAC;AACpJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAe,EAAE,OAA8B;IACjF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,KAAK,IAAiC,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YACtC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;YAC9E,wFAAwF;YACxF,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC;QAC9B,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,WAAW,CAAC,6BAA6B,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,gCAAgC,CAAC;SAChH,OAAO,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gIAAgI;AAChI,KAAK,UAAU,WAAW,CACzB,KAAa,EACb,QAAqC,EACrC,SAAiB;IAEjB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAY,EAAsB,EAAE;QACnE,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,UAAU,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QAC5D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,0BAA0B,SAAS,0BAA0B,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAe,EAAE,QAAkB,EAAE,KAAa;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,CAAC;IACD,8FAA8F;IAC9F,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClE,8FAA8F;QAC9F,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAe,EAAE,MAAmB;IAC/D,OAAO,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,IAAe,EAAE,IAA6B;IAC5E,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI;QAAE,OAAO,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC1E,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/edge-node/dissolve.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Dissolving the party this app founded and left (docs/architecture.md → "An app joins an
+ * existing cadre" → "Dissolving the party it left"): the check that the running party holds
+ * everything the left one holds, and the removal of the left party's local storage. The same
+ * removal deletes a party whose owner removed this app ("Removed from A"), with no check.
+ *
+ * The removal is local: it writes nothing to either party's control database. A marker in the
+ * node-local database names the party from before the first deletion until after the saved
+ * start stops naming it, so a removal that a crash or a failed step interrupts is finished by
+ * the next start or the next dissolve without checking again: the decision to remove was made
+ * before the marker was written. Every step deletes what may already be gone.
+ */
+import type { StrandBundle, StrandHoldings } from '../strand-move.js';
+import type { CadreNode } from '../cadre-node.js';
+import type { KeyStore } from '../key-store.js';
+import { type NodeLocalKv } from './node-local.js';
+import type { RemovableSlot } from './platform.js';
+import { type EdgeNodeOptions } from './options.js';
+import { type PendingStrandMove, type StrandMoveRecords } from './strand-move.js';
+/** How `EdgeNode.dissolveFormerParty` runs. */
+export interface DissolveFormerPartyOptions {
+    /** Strand and pending-join ids of the former party to give up although the running party does not hold them; from a `FormerPartyNotEmptyError`. */
+    discard?: readonly string[];
+}
+/**
+ * `EdgeNode.dissolveFormerParty` refused, nothing stopped: moving the former party's strands has
+ * not finished. A move into the running party finishes with `finishStrandMove()`; one into
+ * another party is adopted only there.
+ */
+export declare class StrandMovePendingError extends Error {
+    readonly pending: PendingStrandMove;
+    constructor(pending: PendingStrandMove);
+}
+/** What keeps a former party from being dissolved: `FormerPartyNotEmptyError`'s lists. */
+interface FormerPartyRemains {
+    otherMachines: string[];
+    strandIds: string[];
+    pendingJoinIds: string[];
+}
+/** `EdgeNode.dissolveFormerParty` refused, nothing deleted: the former party holds what the running party lacks, or has other machines. */
+export declare class FormerPartyNotEmptyError extends Error {
+    readonly partyId: string;
+    /** Peer ids of `CadrePeer` rows other than this node's. Not discardable: removing them is the user's choice, made in that party. */
+    readonly otherMachines: string[];
+    /** Not held by the running party and not in `discard`. */
+    readonly strandIds: string[];
+    /** Open pending joins the running party does not hold, and not in `discard`. */
+    readonly pendingJoinIds: string[];
+    constructor(partyId: string, remains: FormerPartyRemains);
+}
+/** What the former party holds, read from a node started for it alone. */
+export interface FormerPartyContent {
+    bundle: StrandBundle;
+    /** Peer ids of its `CadrePeer` rows other than the reading node's. */
+    otherMachines: string[];
+}
+export declare function readFormerParty(node: CadreNode): Promise<FormerPartyContent>;
+/** The refusal `content` earns against what the running party holds, or null when it may be dissolved. */
+export declare function formerPartyRefusal(content: FormerPartyContent, holdings: StrandHoldings, discard: readonly string[], nowMs: number): FormerPartyNotEmptyError | null;
+/** The former party's start for {@link readFormerParty}: nothing to dial or reserve on, the running Noise mode. */
+export declare function formerPartyRead(partyId: string, running: EdgeNodeOptions): EdgeNodeOptions;
+/** `options` without `formerPartyId` when it names `partyId`. */
+export declare function withoutFormerParty(options: EdgeNodeOptions, partyId: string | undefined): EdgeNodeOptions;
+/** The edge node's storage a removal reaches. No handle on the party removed may be open. */
+export interface PartyStorage {
+    /** The node-local key-value store (`EdgeNodeStorage.nodeLocal`). */
+    nodeLocal: NodeLocalKv;
+    /** `EdgeNodeNames.dissolveMarkerKey`. */
+    markerKey: string;
+    /** `EdgeNodeNames.savedStartKey`. */
+    savedStartKey: string;
+    /** `EdgeNodeStorage.destroyScope`. */
+    destroyScope: (scope: string) => Promise<void>;
+    /** The party's trusted-owner anchor slot, the platform's own or the node-local default, for its removal. */
+    trustedOwnerSlot: (partyId: string) => RemovableSlot;
+    keyStore: KeyStore;
+    moves: StrandMoveRecords;
+}
+/** Mark `partyId` as being removed, then remove its local storage. Only once removing it is decided: a dissolve's check passed, or an owner removed this app. */
+export declare function removeParty(storage: PartyStorage, partyId: string): Promise<void>;
+/** Finish the removal a marker names, if any. */
+export declare function finishMarkedRemoval(storage: PartyStorage): Promise<void>;
+/** What {@link finishRemovalAtStart} found: the party the marker named, if any, and why finishing its removal failed, if it did. */
+export interface RemovalAtStart {
+    /** Absent when there was no marker, or when it could not be read (`error` says so). */
+    partyId?: string;
+    error?: Error;
+}
+/**
+ * {@link finishMarkedRemoval} before a start, which must then not keep the party it names as
+ * `formerPartyId`, finished or not. A failure is logged and reported, and the start goes on; the
+ * marker stays for the next.
+ */
+export declare function finishRemovalAtStart(storage: PartyStorage): Promise<RemovalAtStart>;
+export {};