@serfab/cadre-core 1.16.0 → 1.17.0

package/src/joined-strand-store.ts

@@ -69,11 +69,11 @@ export interface JoinedStrandStore {
 
 /**
  * The {@link StrandRow} a record stands for — the shape `addStrand` and `strand:discovered`
- * carry. `FounderOwnerKey` is null because a joiner never founds; `CadreNode.launchStrand`
- * reads null as "not mine" and joins.
+ * carry. The founder columns are null because a joiner never founds; `CadreNode.launchStrand`
+ * reads a null `FounderPeerId` as "not mine" and joins.
  */
 export function joinedStrandRow(record: JoinedStrandRecord): StrandRow {
-	return { Id: record.Id, Type: record.Type, MemberPrivateKey: record.MemberPrivateKey, FounderOwnerKey: null };
+	return { Id: record.Id, Type: record.Type, MemberPrivateKey: record.MemberPrivateKey, FounderOwnerKey: null, FounderPeerId: null };
 }
 
 /**
@@ -234,7 +234,7 @@ function parseRecord(strandId: string, bytes: Uint8Array): JoinedStrandRecord |
  * key; this module sees only the seam, so it stays free of the runtime.
  */
 export interface PartyJoinedStrandLedger {
-	/** Every party-wide join, as offerable rows (`FounderOwnerKey: null`). */
+	/** Every party-wide join, as offerable rows (null founder columns). */
 	list(): Promise<StrandRow[]>;
 	/** Whether this party's control database names `strandId`, as its own strand or as a party-wide join. */
 	names(strandId: string): Promise<boolean>;

package/src/key-store.ts

@@ -2,10 +2,10 @@
  * Backend-agnostic store for raw private key material.
  *
  * Mobile cadre nodes hold sensitive key material at rest: the libp2p
- * peer/node identity key and (in the single-key reference model) the owner
- * signing key derived from it. This module defines the seam those keys flow
- * through so a platform-secure backend (iOS Keychain / Android Keystore) can be
- * plugged in without `@serfab/cadre-core` taking any platform dependency.
+ * peer/node identity key and, on a device the user made an owner, an owner key
+ * in a slot of its own (`owner-key-store.ts`). This module defines the seam those
+ * keys flow through so a platform-secure backend (iOS Keychain / Android Keystore)
+ * can be plugged in without `@serfab/cadre-core` taking any platform dependency.
  *
  * This file is dependency-free (no node:/RN imports) so it is safe in every
  * entry graph. The Node reference {@link FileKeyStore} lives in a separate
@@ -23,6 +23,12 @@ export type KeyId = string;
  */
 export const DEFAULT_IDENTITY_KEY_ID: KeyId = 'cadre/identity';
 
+/**
+ * Default slot id for an owner key (`owner-key-store.ts`). Not party-scoped: one
+ * owner key may own several cadres, each owner signature binding its party id.
+ */
+export const DEFAULT_OWNER_KEY_ID: KeyId = 'cadre/owner';
+
 /**
  * Backend-agnostic store for raw private key material. Implementations may be
  * file-based, OS-keyring, or platform secure-enclave backed (iOS Keychain /

package/src/machine-removal.ts

@@ -1,17 +1,15 @@
 /**
- * Removing a machine from a cadre: the listing an app shows (`CadreNode.listMachines`), the
- * read-only plan behind its confirmation step (`CadreNode.planMachineRemoval`), and the
- * check that a requested re-vouch stays inside that plan. Pure projections over rows the
- * node has already read; the reads and writes themselves are `CadreNode.removeMachine`'s and
- * `ControlDatabase.removeMachine`'s.
+ * Removing a machine from a cadre: the listing an app shows (`CadreNode.listMachines`) and the
+ * read-only plan behind its confirmation step (`CadreNode.planMachineRemoval`). Pure
+ * projections over rows the node has already read; the reads and writes themselves are
+ * `CadreNode.removeMachine`'s and `ControlDatabase.removeMachine`'s.
  *
- * A machine's owner key is its own identity key: an owner-granting invitation seats
- * `OwnerKey.Key = CadrePeer.PublicKey`, and `addOwner` takes the key behind a peer id. So
- * "this machine is an owner" is "the ed25519 key behind its peer id is a live `OwnerKey`",
- * and an owner key with no machine row is still listed, as the machine it names.
+ * A machine is a `CadrePeer` row and nothing more: an owner key is the person's, so removing a
+ * machine leaves every owner key standing, the one the machine's user signed with included
+ * (removing one is `CadreNode.removeOwner`, `owner-keys.ts`).
  */
 
-import { ed25519PublicKeyB64FromPeerId, peerIdFromEd25519PublicKeyB64 } from './ed25519-key.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import { verifyPeerRecordSignature } from './peer-record.js';
 import type {
   CadreInviteStatus,
@@ -20,8 +18,6 @@ import type {
   CadrePeerRow,
   MachineRemovalPlan,
   MachineRemovalRefusal,
-  OwnerKeyRow,
-  RemoveMachineOptions,
 } from './types.js';
 
 /**
@@ -42,8 +38,7 @@ export class MachineRemovalRefusedError extends Error {
 
 const MACHINE_REMOVAL_REFUSAL_REASON: Record<MachineRemovalRefusal, string> = {
   'not-an-owner': 'this node holds no enrolled owner key',
-  'self': 'an owner cannot remove its own machine; ask another owner',
-  'last-owner': 'it holds the only live owner key',
+  'self': 'it is this node; leaving a cadre is stopping the node and deleting its data',
 };
 
 /** What {@link describeMachines} projects from: one node's live rows and its own predicate. */
@@ -52,45 +47,21 @@ export interface MachineListingInput {
   selfPeerId: string | null;
   /** Live `CadrePeer` rows (`ControlDatabase.queryCadrePeers`). */
   rows: readonly CadrePeerRow[];
-  /** Live `OwnerKey` rows (`ControlDatabase.queryOwnerKeyRows`). */
-  owners: readonly OwnerKeyRow[];
   /** This node's authorized-membership predicate for one row (`CadreNode.listAuthorizedMembers`'s). */
   trusted: (row: CadrePeerRow) => boolean;
 }
 
 /**
- * One entry per live `CadrePeer` row, then one per live `OwnerKey` whose key derives a peer
- * id with no row. `profile` and `lastPublishedAt` are reported only when the row's
- * self-signature verifies under the key behind its peer id, as `CadreNode.resolvePeerAddrs`
- * judges the same record: no insert rule constrains `Profile`, and an owner re-vouch may
- * bump `UpdatedAt` without re-signing.
+ * One entry per live `CadrePeer` row. `profile` and `lastPublishedAt` are reported only when
+ * the row's self-signature verifies under the key behind its peer id, as
+ * `CadreNode.resolvePeerAddrs` judges the same record: no insert rule constrains `Profile`, and
+ * an owner re-vouch may bump `UpdatedAt` without re-signing.
  */
 export function describeMachines(input: MachineListingInput): CadreMachine[] {
-  const ownerKeys = new Set(input.owners.map((owner) => owner.key));
-  const machines = input.rows.map((row) => describeMemberRow(input, row, ownerKeys));
-  const listed = new Set(machines.map((machine) => machine.peerId));
-  for (const owner of input.owners) {
-    const peerId = peerIdFromEd25519PublicKeyB64(owner.key);
-    if (peerId === null || listed.has(peerId)) {
-      continue;
-    }
-    listed.add(peerId);
-    machines.push({
-      peerId,
-      publicKey: owner.key,
-      isSelf: peerId === input.selfPeerId,
-      isOwner: true,
-      isMember: false,
-      trusted: false,
-      profile: null,
-      lastPublishedAt: null,
-      vouchedBy: owner.vouchOwner,
-    });
-  }
-  return machines;
+  return input.rows.map((row) => describeMemberRow(input, row));
 }
 
-function describeMemberRow(input: MachineListingInput, row: CadrePeerRow, ownerKeys: ReadonlySet<string>): CadreMachine {
+function describeMemberRow(input: MachineListingInput, row: CadrePeerRow): CadreMachine {
   const publicKey = ed25519PublicKeyB64FromPeerId(row.peerId);
   const selfPublished = publicKey !== null && row.publicKey === publicKey && row.sig !== null
     && verifyPeerRecordSignature(input.partyId, {
@@ -105,8 +76,6 @@ function describeMemberRow(input: MachineListingInput, row: CadrePeerRow, ownerK
     peerId: row.peerId,
     publicKey,
     isSelf: row.peerId === input.selfPeerId,
-    isOwner: publicKey !== null && ownerKeys.has(publicKey),
-    isMember: true,
     trusted: input.trusted(row),
     profile: selfPublished ? row.profile : null,
     lastPublishedAt: selfPublished ? row.updatedAt : null,
@@ -118,99 +87,45 @@ function describeMemberRow(input: MachineListingInput, row: CadrePeerRow, ownerK
 export interface MachineRemovalPlanInput {
   peerId: string;
   machines: readonly CadreMachine[];
-  rows: readonly CadrePeerRow[];
-  owners: readonly OwnerKeyRow[];
   selfPeerId: string | null;
-  /** This node's enrolled owner key (`CadreNode.enrolledOwnerSigningKey`), or null when it cannot sign owner writes. */
-  selfOwnerKey: string | null;
+  /** Whether this node's owner signer is an enrolled owner (`CadreNode.ownerSignerEnrolledIn`), so it can sign the removal. */
+  canSign: boolean;
   invites: readonly CadreInviteStatus[];
   usages: readonly CadreInviteUsageRow[];
 }
 
 /**
- * The plan for removing `peerId` from these rows. The refusals come first and by name: a
- * node that cannot sign, the node itself (an owner cannot sign its own `OwnerKey` removal;
- * refusing the whole self-removal keeps one rule for owners and non-owners), and a machine
- * holding the only live owner key. The last cannot coexist with this node being a different
- * owner, but the local count can be wrong under concurrency, so the name stays.
- *
- * `dependents` are the rows the machine's owner key vouched, which every reader judges
- * against its anchor through `VouchOwner`: once the key is removed they stop passing the
- * membership predicate on every machine unless re-vouched first. This node's own rows are
- * reported as `ownDependency` instead, since it cannot re-vouch them itself.
+ * The plan for removing `peerId` from these rows. The refusals come first and by name: a node
+ * that cannot sign, and the node itself (leaving a cadre is the embedder's flow, which stops
+ * the node and deletes its data; the removal notice a machine acts on is built around another
+ * machine removing it).
  *
  * `invitations` are the live ones the machine could redeem to come back: targeted at it,
  * or already redeemed by it and still redeemable (a multi-use invitation, or an open
- * owner invitation inside its lifetime). The schema's rule: keeping a device out is removing
+ * invitation inside its lifetime). The schema's rule: keeping a device out is removing
  * its row and withdrawing the invitation.
  */
 export function planMachineRemoval(input: MachineRemovalPlanInput): MachineRemovalPlan {
-  const machine = input.machines.find((candidate) => candidate.peerId === input.peerId) ?? null;
-  const key = machine?.isOwner ? machine.publicKey : null;
-  const refusal = refusalFor(input, machine);
-  const removesOwnerKey = key !== null;
   return {
-    machine,
-    refusal,
-    removesOwnerKey,
-    dependents: removesOwnerKey ? dependentsOf(input, key) : { owners: [], peers: [] },
+    machine: input.machines.find((candidate) => candidate.peerId === input.peerId) ?? null,
+    refusal: refusalFor(input),
     invitations: invitationsOpenTo(input),
-    ownDependency: removesOwnerKey && isOwnDependency(input, key),
   };
 }
 
-function refusalFor(input: MachineRemovalPlanInput, machine: CadreMachine | null): MachineRemovalRefusal | null {
-  if (input.selfOwnerKey === null) {
+function refusalFor(input: MachineRemovalPlanInput): MachineRemovalRefusal | null {
+  if (!input.canSign) {
     return 'not-an-owner';
   }
   if (input.peerId === input.selfPeerId) {
     return 'self';
   }
-  if (machine?.isOwner && input.owners.length <= 1) {
-    return 'last-owner';
-  }
   return null;
 }
 
-function dependentsOf(input: MachineRemovalPlanInput, key: string): MachineRemovalPlan['dependents'] {
-  return {
-    owners: input.owners
-      .filter((owner) => owner.vouchOwner === key && owner.key !== key && owner.key !== input.selfOwnerKey)
-      .map((owner) => owner.key),
-    peers: input.rows
-      .filter((row) => row.vouchOwner === key && row.peerId !== input.peerId && row.peerId !== input.selfPeerId)
-      .map((row) => row.peerId),
-  };
-}
-
-function isOwnDependency(input: MachineRemovalPlanInput, key: string): boolean {
-  const ownRow = input.rows.find((row) => row.peerId === input.selfPeerId);
-  const ownOwner = input.owners.find((owner) => owner.key === input.selfOwnerKey);
-  return ownRow?.vouchOwner === key || ownOwner?.vouchOwner === key;
-}
-
 function invitationsOpenTo(input: MachineRemovalPlanInput): string[] {
   const redeemed = new Set(input.usages.filter((usage) => usage.peerId === input.peerId).map((usage) => usage.inviteKey));
   return input.invites
     .filter((status) => status.live && (status.invite.peerId === input.peerId || redeemed.has(status.invite.key)))
     .map((status) => status.invite.key);
 }
-
-/**
- * The re-vouch a caller asked for, checked against the plan: every key and peer must be in
- * `plan.dependents`, so a caller cannot re-vouch a row the removed owner never vouched (nor
- * the machine itself, which `dependents.peers` excludes). Throws naming the offenders, before
- * `CadreNode.removeMachine` writes anything. Duplicates are dropped.
- */
-export function revouchWithinPlan(plan: MachineRemovalPlan, revouch: RemoveMachineOptions['revouch']): MachineRemovalPlan['dependents'] {
-  const owners = [...new Set(revouch?.owners ?? [])];
-  const peers = [...new Set(revouch?.peers ?? [])];
-  const strayOwners = owners.filter((key) => !plan.dependents.owners.includes(key));
-  const strayPeers = peers.filter((peerId) => !plan.dependents.peers.includes(peerId));
-  if (strayOwners.length > 0 || strayPeers.length > 0) {
-    throw new Error(
-      `removeMachine: re-vouch names rows the removed machine did not vouch: ${[...strayOwners, ...strayPeers].join(', ')}`,
-    );
-  }
-  return { owners, peers };
-}