@serfab/cadre-core 1.16.0 → 1.17.0

package/dist/machine-removal.js

@@ -1,16 +1,14 @@
 /**
- * Removing a machine from a cadre: the listing an app shows (`CadreNode.listMachines`), the
- * read-only plan behind its confirmation step (`CadreNode.planMachineRemoval`), and the
- * check that a requested re-vouch stays inside that plan. Pure projections over rows the
- * node has already read; the reads and writes themselves are `CadreNode.removeMachine`'s and
- * `ControlDatabase.removeMachine`'s.
+ * Removing a machine from a cadre: the listing an app shows (`CadreNode.listMachines`) and the
+ * read-only plan behind its confirmation step (`CadreNode.planMachineRemoval`). Pure
+ * projections over rows the node has already read; the reads and writes themselves are
+ * `CadreNode.removeMachine`'s and `ControlDatabase.removeMachine`'s.
  *
- * A machine's owner key is its own identity key: an owner-granting invitation seats
- * `OwnerKey.Key = CadrePeer.PublicKey`, and `addOwner` takes the key behind a peer id. So
- * "this machine is an owner" is "the ed25519 key behind its peer id is a live `OwnerKey`",
- * and an owner key with no machine row is still listed, as the machine it names.
+ * A machine is a `CadrePeer` row and nothing more: an owner key is the person's, so removing a
+ * machine leaves every owner key standing, the one the machine's user signed with included
+ * (removing one is `CadreNode.removeOwner`, `owner-keys.ts`).
  */
-import { ed25519PublicKeyB64FromPeerId, peerIdFromEd25519PublicKeyB64 } from './ed25519-key.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import { verifyPeerRecordSignature } from './peer-record.js';
 /**
  * `CadreNode.removeMachine` refused by name, before any write. `code` says which rule
@@ -26,41 +24,18 @@ export class MachineRemovalRefusedError extends Error {
 }
 const MACHINE_REMOVAL_REFUSAL_REASON = {
     'not-an-owner': 'this node holds no enrolled owner key',
-    'self': 'an owner cannot remove its own machine; ask another owner',
-    'last-owner': 'it holds the only live owner key',
+    'self': 'it is this node; leaving a cadre is stopping the node and deleting its data',
 };
 /**
- * One entry per live `CadrePeer` row, then one per live `OwnerKey` whose key derives a peer
- * id with no row. `profile` and `lastPublishedAt` are reported only when the row's
- * self-signature verifies under the key behind its peer id, as `CadreNode.resolvePeerAddrs`
- * judges the same record: no insert rule constrains `Profile`, and an owner re-vouch may
- * bump `UpdatedAt` without re-signing.
+ * One entry per live `CadrePeer` row. `profile` and `lastPublishedAt` are reported only when
+ * the row's self-signature verifies under the key behind its peer id, as
+ * `CadreNode.resolvePeerAddrs` judges the same record: no insert rule constrains `Profile`, and
+ * an owner re-vouch may bump `UpdatedAt` without re-signing.
  */
 export function describeMachines(input) {
-    const ownerKeys = new Set(input.owners.map((owner) => owner.key));
-    const machines = input.rows.map((row) => describeMemberRow(input, row, ownerKeys));
-    const listed = new Set(machines.map((machine) => machine.peerId));
-    for (const owner of input.owners) {
-        const peerId = peerIdFromEd25519PublicKeyB64(owner.key);
-        if (peerId === null || listed.has(peerId)) {
-            continue;
-        }
-        listed.add(peerId);
-        machines.push({
-            peerId,
-            publicKey: owner.key,
-            isSelf: peerId === input.selfPeerId,
-            isOwner: true,
-            isMember: false,
-            trusted: false,
-            profile: null,
-            lastPublishedAt: null,
-            vouchedBy: owner.vouchOwner,
-        });
-    }
-    return machines;
+    return input.rows.map((row) => describeMemberRow(input, row));
 }
-function describeMemberRow(input, row, ownerKeys) {
+function describeMemberRow(input, row) {
     const publicKey = ed25519PublicKeyB64FromPeerId(row.peerId);
     const selfPublished = publicKey !== null && row.publicKey === publicKey && row.sig !== null
         && verifyPeerRecordSignature(input.partyId, {
@@ -75,8 +50,6 @@ function describeMemberRow(input, row, ownerKeys) {
         peerId: row.peerId,
         publicKey,
         isSelf: row.peerId === input.selfPeerId,
-        isOwner: publicKey !== null && ownerKeys.has(publicKey),
-        isMember: true,
         trusted: input.trusted(row),
         profile: selfPublished ? row.profile : null,
         lastPublishedAt: selfPublished ? row.updatedAt : null,
@@ -84,83 +57,36 @@ function describeMemberRow(input, row, ownerKeys) {
     };
 }
 /**
- * The plan for removing `peerId` from these rows. The refusals come first and by name: a
- * node that cannot sign, the node itself (an owner cannot sign its own `OwnerKey` removal;
- * refusing the whole self-removal keeps one rule for owners and non-owners), and a machine
- * holding the only live owner key. The last cannot coexist with this node being a different
- * owner, but the local count can be wrong under concurrency, so the name stays.
- *
- * `dependents` are the rows the machine's owner key vouched, which every reader judges
- * against its anchor through `VouchOwner`: once the key is removed they stop passing the
- * membership predicate on every machine unless re-vouched first. This node's own rows are
- * reported as `ownDependency` instead, since it cannot re-vouch them itself.
+ * The plan for removing `peerId` from these rows. The refusals come first and by name: a node
+ * that cannot sign, and the node itself (leaving a cadre is the embedder's flow, which stops
+ * the node and deletes its data; the removal notice a machine acts on is built around another
+ * machine removing it).
  *
  * `invitations` are the live ones the machine could redeem to come back: targeted at it,
  * or already redeemed by it and still redeemable (a multi-use invitation, or an open
- * owner invitation inside its lifetime). The schema's rule: keeping a device out is removing
+ * invitation inside its lifetime). The schema's rule: keeping a device out is removing
  * its row and withdrawing the invitation.
  */
 export function planMachineRemoval(input) {
-    const machine = input.machines.find((candidate) => candidate.peerId === input.peerId) ?? null;
-    const key = machine?.isOwner ? machine.publicKey : null;
-    const refusal = refusalFor(input, machine);
-    const removesOwnerKey = key !== null;
     return {
-        machine,
-        refusal,
-        removesOwnerKey,
-        dependents: removesOwnerKey ? dependentsOf(input, key) : { owners: [], peers: [] },
+        machine: input.machines.find((candidate) => candidate.peerId === input.peerId) ?? null,
+        refusal: refusalFor(input),
         invitations: invitationsOpenTo(input),
-        ownDependency: removesOwnerKey && isOwnDependency(input, key),
     };
 }
-function refusalFor(input, machine) {
-    if (input.selfOwnerKey === null) {
+function refusalFor(input) {
+    if (!input.canSign) {
         return 'not-an-owner';
     }
     if (input.peerId === input.selfPeerId) {
         return 'self';
     }
-    if (machine?.isOwner && input.owners.length <= 1) {
-        return 'last-owner';
-    }
     return null;
 }
-function dependentsOf(input, key) {
-    return {
-        owners: input.owners
-            .filter((owner) => owner.vouchOwner === key && owner.key !== key && owner.key !== input.selfOwnerKey)
-            .map((owner) => owner.key),
-        peers: input.rows
-            .filter((row) => row.vouchOwner === key && row.peerId !== input.peerId && row.peerId !== input.selfPeerId)
-            .map((row) => row.peerId),
-    };
-}
-function isOwnDependency(input, key) {
-    const ownRow = input.rows.find((row) => row.peerId === input.selfPeerId);
-    const ownOwner = input.owners.find((owner) => owner.key === input.selfOwnerKey);
-    return ownRow?.vouchOwner === key || ownOwner?.vouchOwner === key;
-}
 function invitationsOpenTo(input) {
     const redeemed = new Set(input.usages.filter((usage) => usage.peerId === input.peerId).map((usage) => usage.inviteKey));
     return input.invites
         .filter((status) => status.live && (status.invite.peerId === input.peerId || redeemed.has(status.invite.key)))
         .map((status) => status.invite.key);
 }
-/**
- * The re-vouch a caller asked for, checked against the plan: every key and peer must be in
- * `plan.dependents`, so a caller cannot re-vouch a row the removed owner never vouched (nor
- * the machine itself, which `dependents.peers` excludes). Throws naming the offenders, before
- * `CadreNode.removeMachine` writes anything. Duplicates are dropped.
- */
-export function revouchWithinPlan(plan, revouch) {
-    const owners = [...new Set(revouch?.owners ?? [])];
-    const peers = [...new Set(revouch?.peers ?? [])];
-    const strayOwners = owners.filter((key) => !plan.dependents.owners.includes(key));
-    const strayPeers = peers.filter((peerId) => !plan.dependents.peers.includes(peerId));
-    if (strayOwners.length > 0 || strayPeers.length > 0) {
-        throw new Error(`removeMachine: re-vouch names rows the removed machine did not vouch: ${[...strayOwners, ...strayPeers].join(', ')}`);
-    }
-    return { owners, peers };
-}
 //# sourceMappingURL=machine-removal.js.map

package/dist/machine-removal.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-removal.js","sourceRoot":"","sources":["../src/machine-removal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAY7D;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAInD,YAAY,MAAc,EAAE,IAA2B;QACrD,KAAK,CAAC,yBAAyB,MAAM,KAAK,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,8BAA8B,GAA0C;IAC5E,cAAc,EAAE,uCAAuC;IACvD,MAAM,EAAE,2DAA2D;IACnE,YAAY,EAAE,kCAAkC;CACjD,CAAC;AAcF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,MAAM,EAAE,MAAM,KAAK,KAAK,CAAC,UAAU;YACnC,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA0B,EAAE,GAAiB,EAAE,SAA8B;IACtG,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;WACtF,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE;YAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACpD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;IACL,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;QACvD,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC3C,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACrD,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,GAAG,KAAK,IAAI,CAAC;IACrC,OAAO;QACL,OAAO;QACP,OAAO;QACP,eAAe;QACf,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClF,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC;QACrC,aAAa,EAAE,eAAe,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,OAA4B;IAC9E,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,GAAW;IAC/D,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;aACjB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,CAAC;aACpG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5B,KAAK,EAAE,KAAK,CAAC,IAAI;aACd,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC;aACzG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;IAChF,OAAO,MAAM,EAAE,UAAU,KAAK,GAAG,IAAI,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC,OAAO;SACjB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;SAC7G,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB,EAAE,OAAwC;IAClG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"machine-removal.js","sourceRoot":"","sources":["../src/machine-removal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAU7D;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAInD,YAAY,MAAc,EAAE,IAA2B;QACrD,KAAK,CAAC,yBAAyB,MAAM,KAAK,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,8BAA8B,GAA0C;IAC5E,cAAc,EAAE,uCAAuC;IACvD,MAAM,EAAE,6EAA6E;CACtF,CAAC;AAYF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA0B,EAAE,GAAiB;IACtE,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;WACtF,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE;YAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACpD,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;IACL,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC3C,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACrD,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI;QACtF,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;QAC1B,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC,OAAO;SACjB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;SAC7G,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/dist/member-redemption.d.ts

@@ -0,0 +1,250 @@
+/**
+ * The member-dialed redemption exchange shared by cadre invitations
+ * (`cadre-invite-protocol.ts`) and owner grants (`owner-grant-protocol.ts`): a holder dials ANY
+ * member machine its bundle names, proves possession in one signed frame, and the member writes
+ * rows on the issuer's behalf and answers in one frame. The issuer need not be online.
+ *
+ * What is the same for both credentials lives here, generic over the request and reply types:
+ *
+ * - the member side's hardening and sequencing ({@link MemberRedemptionHandler}): a concurrency
+ *   cap, a read timeout, the checks before any database work, the push of this member's control
+ *   store to the holder for a credential still live here, and the writes under that admission;
+ * - the holder side's dialing ({@link dialRedemption}, {@link dialRedemptionInPasses}): the
+ *   bundle's addresses one at a time under a per-address deadline, one signed request for every
+ *   address and every pass, and the pacing between passes;
+ * - the shape checks both directions apply off the wire, and the frame cap.
+ *
+ * What differs — the bundle, the request's fields and signatures, the refusal codes, the rows
+ * written and the reply's contents — stays in each protocol module, which passes it in. Same
+ * shape as the seed and wake protocols underneath: one length-prefixed JSON frame each way over
+ * the primitives in `control-stream.ts`.
+ */
+import type { Libp2p } from '@libp2p/interface';
+import { type ControlStream } from './control-stream.js';
+import type { CadreJoinProgress } from './types.js';
+/**
+ * Cap on either frame of either protocol. A request is one signed row, two signatures and a few
+ * addresses; a reply adds at most a peer list of a cadre's size. Both fit in a few KB; 64 KiB is
+ * the defensive bound a stranger can make the handler buffer.
+ */
+export declare const MAX_REDEMPTION_FRAME_BYTES: number;
+/** Longest string field accepted off the wire; a stamp is 342 base64url chars, a signature 86. */
+export declare const MAX_WIRE_FIELD_LENGTH = 1024;
+export declare function isBoundedString(value: unknown, max?: number): value is string;
+export declare function isEd25519KeyB64(value: unknown): value is string;
+/** Is `value` a null-or-bounded-string column, as the nullable text columns of a travelling row are? */
+export declare function isNullableBoundedString(value: unknown, max?: number): value is string | null;
+/** Is `value` a null-or-positive-integer use cap? */
+export declare function isNullableUseCap(value: unknown): value is number | null;
+/** A refusal as the member sends it: a code, a reason, nothing else. */
+export interface RedemptionRejection<Code extends string> {
+    accepted: false;
+    code: Code;
+    reason: string;
+}
+/**
+ * A refusal as the holder reads it: the code and reason verbatim off the wire, untyped, so each
+ * protocol's rejected-error is the one place that classifies a code this build does not know
+ * (as `'unrecognized'`, retryable) rather than the decoder folding it into a code it does.
+ */
+export interface RedemptionRefusalFrame {
+    accepted: false;
+    code: unknown;
+    reason: unknown;
+}
+export declare function rejection<Code extends string>(code: Code, reason: string): RedemptionRejection<Code>;
+/** One row of a protocol's constraint table: the constraint names the schema refuses a write with, and the code and reason each maps to. */
+export type ConstraintRefusalRow<Code extends string> = readonly [RegExp, Code, string];
+/** Which named constraint, if any, refused the write — read off the error's cause chain. */
+export declare function constraintRefusal<Code extends string>(error: unknown, table: ReadonlyArray<ConstraintRefusalRow<Code>>): RedemptionRejection<Code> | null;
+/**
+ * A write failure that is not a refusal: this member cannot read the credential row the cadre
+ * holds yet, or the retry gave up (`conflict`), or something else (`internal`).
+ */
+export declare function writeFailureRefusal(error: unknown): RedemptionRejection<'conflict' | 'internal'>;
+export interface MemberRedemptionHandlerOptions {
+    /** This member's party id; a request for another party is refused by name. */
+    partyId: string;
+    /**
+     * Push this member's control store to the holder, resolving once the push has finished, and
+     * keep the holder counted in this member's control write cohort until the returned release
+     * is called. Called after the request verified and before the row is seated and the
+     * redemption is written; the handler releases once both have settled. Absent, the writes go
+     * ahead with the holder neither caught up nor in the cohort, so it does not hold them; see
+     * {@link MemberRedemptionHandler.admitIfLive}.
+     */
+    admitDevice?: (peerId: string) => Promise<() => void>;
+    /** Time to wait for the request frame; default {@link DEFAULT_REDEEM_READ_TIMEOUT_MS}. */
+    redeemReadTimeoutMs?: number;
+    /** Cap on concurrent inbound redemptions; default {@link DEFAULT_MAX_CONCURRENT_REDEMPTIONS}. */
+    maxConcurrentRedemptions?: number;
+}
+/**
+ * Member side of one redemption protocol: registers the handler and drives each inbound stream
+ * through the checks in cost order — shape, then whatever the protocol checks without database
+ * work (party, signatures, and for an invitation the connecting identity and target device) —
+ * so no database work happens for a stranger that cannot prove anything; then admits the holder
+ * to this member's control replication (`admitDevice`) when the credential is live here, and
+ * runs the protocol's writes. Hardened as the seed handler is: a concurrency cap (over it,
+ * `busy`) and a read timeout.
+ *
+ * Registered only by a started `CadreNode`, after its control database is up, like the
+ * formation responder; nothing here is reachable on a node without one.
+ *
+ * A subclass supplies the five credential-specific pieces: the request's shape, the checks after
+ * it, the liveness read behind the push, the writes, and the two fixed refusals the base sends
+ * on its own (`busy`, and `internal` for a frame it could not read or a failure it did not
+ * expect).
+ */
+export declare abstract class MemberRedemptionHandler<Request, Reply extends {
+    accepted: boolean;
+}> {
+    protected readonly label: string;
+    protected readonly protocolId: string;
+    protected readonly partyId: string;
+    private readonly admitDevice;
+    private readonly readTimeoutMs;
+    private readonly maxConcurrent;
+    private readonly registered;
+    private active;
+    /**
+     * @param label - Names the credential in log lines and stream labels ("Cadre invite", "Owner grant").
+     * @param protocolId - The protocol id {@link register} handles by default.
+     */
+    protected constructor(label: string, protocolId: string, options: MemberRedemptionHandlerOptions);
+    /** The refusal for a caller over the concurrency cap. */
+    protected abstract readonly busyRefusal: Reply;
+    /** The refusal for a request frame the member could not read, or an unexpected failure: nothing was proved either way, so the holder stays free to try the next address. */
+    protected abstract readonly internalRefusal: Reply;
+    /** The refusal for a frame that is not a well-formed request. */
+    protected abstract readonly malformedRefusal: Reply;
+    /** The request's shape, every field in its wire form and bounded. */
+    protected abstract isWellFormedRequest(value: unknown): value is Request;
+    /** The checks after the shape that cost no database work; null to go on to the writes. */
+    protected abstract checkRequest(request: Request, remotePeerId: string): Reply | null;
+    /** Is the credential the (checked) request carries still live on this member? Decides whether the holder is pushed the store (see {@link admitIfLive}). */
+    protected abstract isLive(request: Request): Promise<boolean>;
+    /** The protocol's writes under the admission, each answered by name when it fails. */
+    protected abstract redeemAdmitted(request: Request, remotePeerId: string): Promise<Reply>;
+    /** In-flight inbound redemptions. */
+    get activeCount(): number;
+    /**
+     * Register on `node`; rejects when libp2p refuses the registration. `runOnLimitedConnection`
+     * because a phone redeems through a relay, whose connection libp2p marks limited; the
+     * exchange is two small frames, well inside any relay's cap.
+     */
+    register(node: Libp2p, protocolId?: string): Promise<void>;
+    unregister(node: Libp2p, protocolId?: string): Promise<void>;
+    /**
+     * One inbound redemption: read the frame, decide, reply, close. Public as the seam a protocol
+     * spec drives directly; `remotePeerId` is the connection's authenticated peer.
+     */
+    handleStream(stream: ControlStream, remotePeerId: string): Promise<void>;
+    /**
+     * Read the request frame to EOF, bounded and size-capped; JSON only, shape is the subclass's.
+     * Throws on a frame that cannot be read, which {@link handleStream} answers `internal`: a read
+     * timeout or a cut frame proves nothing about the credential, so the holder must stay free to
+     * try the next address.
+     */
+    private readRequest;
+    private decide;
+    /**
+     * Admit the holder to this member's control replication before the first write of the
+     * exchange (the seat, when this member does not hold the row; otherwise the redemption), and
+     * resolve to the release that ends the admission. The holder is not a member, so only this
+     * puts it in this member's control write cohort, and it must be there to hold the rows the
+     * exchange writes. It is pushed the control store first, because a cohort node with no base
+     * revision of a block refuses a commit to it; a member alone with the holder would then have
+     * half its cohort refusing, and the write would tear instead of committing.
+     *
+     * Only for a credential still live here ({@link isLive}, judged on the row this member holds
+     * or, before the seat, on the bundle's copy once its issuer signature verifies): the holder
+     * of a withdrawn, expired or spent one, or of a forged copy naming a real owner, is refused
+     * without being sent anything. The retry of a redemption already written can read as spent
+     * too and is sent nothing; it needs nothing, since the rows it would hold are written and
+     * the ordinary catch-up reaches a member. Best-effort: a failed check or push is logged and
+     * the writes go ahead without the holder admitted, then commit or are answered retryably.
+     */
+    private admitIfLive;
+}
+/** What one address the bundle named came to. */
+export interface RedemptionAddressOutcome {
+    addr: string;
+    /** A dial or exchange failure, or a retryable refusal. */
+    error: Error;
+}
+/** A member's refusal as the holder classifies it; `retryable` decides whether the next address is tried. */
+export type RedemptionRefusal = Error & {
+    readonly retryable: boolean;
+};
+/** What a successful redemption yields the holder. */
+export interface MemberRedemption<Accepted> {
+    reply: Accepted;
+    /** The answering member's peer id, from the address's trailing `/p2p/`; null when it named none. */
+    memberPeerId: string | null;
+    /** The address that answered. */
+    memberAddr: string;
+}
+export interface MemberRedemptionOptions<Accepted> {
+    /** Names the credential in log lines and deadline labels ("Cadre invitation", "Owner grant"). */
+    label: string;
+    protocolId: string;
+    /** The bundle's multiaddrs ending in `/p2p/<peerId>`, dialed in order. */
+    members: readonly string[];
+    /** The signed request; the same one goes to every address (and every pass). */
+    request: unknown;
+    /** Read an acceptance frame's fields into `Accepted`, sanitizing them; throws on a malformed one, which moves the holder to the next address. */
+    decodeAccepted(frame: Record<string, unknown>): Accepted;
+    /** A refusal frame's code and reason, as the protocol classifies them. */
+    refusal(code: unknown, reason: unknown): RedemptionRefusal;
+    /** The holder's check on an acceptance; throws when it does not check out, which ends the call. */
+    verifyAccepted(reply: Accepted): void;
+    /** The error for every address tried and none accepting. */
+    unreachable(outcomes: readonly RedemptionAddressOutcome[]): Error;
+    /**
+     * This machine's declared link round trip (`NetworkConfig.linkRoundTripMs`), from which the
+     * per-address deadline derives: a dial that may need a relay plus one request
+     * (`relayedRequestBudgetMs`, 28.5 s at the default declaration), as seed delivery's is.
+     */
+    linkRoundTripMs?: number;
+    /** Per-address deadline override; default derived from `linkRoundTripMs`. */
+    addressBudgetMs?: number;
+    /** Cancels the dial or stream in flight and ends the pass; the call throws the signal's reason. */
+    signal?: AbortSignal;
+}
+/**
+ * Holder side: try the bundle's addresses one at a time ({@link dialOnce}) and throw the
+ * protocol's unreachable error when none accepts.
+ *
+ * Every address gets the SAME request, with one usage nonce: the usage table is keyed by it,
+ * so a member the holder gave up on that was still committing cannot redeem it twice, and a
+ * retry at the next member after a dropped reply is answered as already done.
+ *
+ * @throws the protocol's rejected error on a final refusal, its reply-invalid error on an
+ *   acceptance that fails `verifyAccepted`, its unreachable error when every address was tried
+ *   and none accepted, and the reason of `options.signal` once it aborts.
+ */
+export declare function dialRedemption<Accepted>(node: Libp2p, options: MemberRedemptionOptions<Accepted>): Promise<MemberRedemption<Accepted>>;
+export interface MemberRedemptionPassOptions<Accepted> extends MemberRedemptionOptions<Accepted> {
+    /** Keep making passes while every answer is retryable; false makes exactly one. */
+    waitForMember: boolean;
+    /** Called at each pass and each pause; an exception it throws is logged and ignored. */
+    onProgress?: (progress: CadreJoinProgress) => void;
+    /** The credential's stored expiry (its row's `expiresAt`, a `datetime` string); null for none. */
+    expiresAt: string | null;
+    /** The refusal a member would give the credential once expired, thrown when this holder's own clock says it has. */
+    expired(): Error;
+}
+/**
+ * Holder side, in passes: one {@link dialOnce} pass over the bundle's addresses, or, with
+ * `waitForMember`, as many as it takes, pausing between them (5 s after the first, doubling to
+ * 60 s, never past the credential's expiry). Every pass sends the same signed request, so a
+ * member that wrote the redemption on a pass whose reply was lost answers a later pass as
+ * already done, with no second usage row.
+ *
+ * A wait ends at the first acceptance, at a final refusal or an invalid reply (thrown as
+ * {@link dialRedemption} throws them), when the credential expires by this holder's clock
+ * (thrown as `expired()`), when `signal` aborts (its reason thrown), and when `node` stops. A
+ * bundle that names no address has nothing to wait for and throws at once.
+ */
+export declare function dialRedemptionInPasses<Accepted>(node: Libp2p, options: MemberRedemptionPassOptions<Accepted>): Promise<MemberRedemption<Accepted>>;