@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/control-write-retry.js

@@ -1,5 +1,5 @@
 import { CoordinatorPartialCommitError, SyncRetryExhaustedError, TornActionError } from '@optimystic/db-core';
-import { PartialCommitError } from '@optimystic/quereus-plugin-optimystic';
+import { ConcurrentModificationError, PartialCommitError } from '@optimystic/quereus-plugin-optimystic';
 import { causeChain, chainMessages, retryControlOperation } from './control-retry.js';
 /**
  * Bounded retry for TRANSIENT control-write failures — the classifier and loop behind
@@ -30,12 +30,13 @@ import { causeChain, chainMessages, retryControlOperation } from './control-retr
  * before any matcher runs. The one half-landed write that IS re-presented is a torn write the
  * library marks final — not saved and unable to land ({@link isFinalTornWrite}).
  *
- * TWO policies ship from here, and the split is deliberate: the default
+ * THREE policies ship from here, and the split is deliberate: the default
  * ({@link isRetriableControlWriteFailure}, {@link CONTROL_WRITE_ATTEMPTS}) sits under every
- * control write, and {@link SCHEMA_INIT_RETRY_POLICY} is opted into by
- * `ControlDatabase.loadSchema` alone. The widened one absorbs one extra failure class whose
- * re-run safety holds for schema DDL and NOT for writes in general; anything added to the default
- * list must be safe for all ~19 callers.
+ * control write; {@link SCHEMA_INIT_RETRY_POLICY} is opted into by
+ * `ControlDatabase.applyControlSchema` alone; {@link LOST_UPDATE_RETRY_POLICY} is opted into by
+ * the `CadrePeer` writers whose bodies re-read the row and decide again. Each widened one absorbs
+ * one extra failure class whose re-run safety holds for its opted-in bodies and NOT for writes in
+ * general; anything added to the default list must be safe for all ~19 callers.
  *
  * Lives outside `control-database.ts` so a spec can drive the classifier against real engine
  * errors without importing the whole database class. The loop itself lives in
@@ -324,6 +325,33 @@ function isFinalTornWrite(link) {
 function isUnansweredSuperMajorityShortfall(message) {
     return SUPER_MAJORITY_SHORTFALL_UNANSWERED.test(message);
 }
+/**
+ * A LOST UPDATE: the optimystic bridge refusing a commit because another writer changed or
+ * removed a row this statement read (`TransactionBridge.mapCommitRefusal` over a
+ * `TreeEntryChangedError`, `quereus-plugin-optimystic/src/optimystic-adapter/txn-bridge.ts`).
+ * Claimed by TYPE for {@link LOST_UPDATE_RETRY_POLICY} only.
+ *
+ * Why it is a proven non-commit: the refusal is raised inside the action's atomic handler, so
+ * none of that action's entries land. A refusal after a sibling tree or collection of the same
+ * transaction already synced is not delivered bare — the per-tree sweep wraps it in
+ * `PartialCommitError`, the coordinator path in `CoordinatorPartialCommitError` — and
+ * {@link reportsPossiblyStoredWrite} vetoes both by type before this predicate runs. A bare chain
+ * carrying this class therefore means nothing of the write is durable.
+ *
+ * Why it is not in the default list: the rejection is of the write's READ SET, not of its
+ * signature, so re-presenting the same statement is only right when the body re-reads the row and
+ * decides again over what it finds. That is a property of each opted-in body (see the policy's
+ * `NOTE:`), not of control writes in general.
+ *
+ * Not matched by text: `ConcurrentModificationError` is exported from both the plugin's root and
+ * `/plugin` entries over one shared chunk, as `PartialCommitError` is, so the one `instanceof`
+ * covers both (the `NOTE:` on {@link reportsPossiblyStoredWrite} applies to it too). A second
+ * loaded copy of the plugin would fail the `instanceof` and the lost update would then simply not
+ * be retried — the safe side.
+ */
+function isLostUpdate(link) {
+    return link instanceof ConcurrentModificationError;
+}
 /**
  * Optimystic refusing to let a node elect ITSELF coordinator because its last connection dropped
  * less than the guard's grace period ago (`Libp2pKeyPeerNetwork.shouldAllowSelfCoordination` →
@@ -382,14 +410,16 @@ const RETRIABLE_CONTROL_WRITE_MATCHERS = [
  * failed apply is taken back whole — Quereus unwinds every step it ran and verifies the catalog
  * against a pre-apply fingerprint — so a re-run emits exactly the DDL the live catalog is missing.
  * The full argument, including the plugin-side dependency that unwind carries, is at the
- * `loadSchema` call site in `control-database.ts`.
+ * `applyControlSchema` call site in `control-database.ts`.
  *
  * RETRIED DELIBERATELY, not by oversight: the failures Quereus cannot take back. When the unwind
  * does not complete — an undo statement threw, the post-unwind catalog did not match the pre-apply
  * fingerprint, that catalog could not be re-collected to check, or a step the differ marks
  * irreversible because it discards data (dropping a table or a column, narrowing a column's type —
- * none of which a `CadreControl` diff generates today) poisoned the journal before it ran, leaving
- * nothing unwound — Quereus keeps the failing step's own message, APPENDS the reason the
+ * of which only dropping a column reaches a `CadreControl` apply, as the catalog-only migration
+ * step `refuseIncompatibleControlStore` in `control-schema-version.ts` lets through; it discards
+ * nothing there, since rows keep the field) poisoned the journal before it
+ * ran, leaving nothing unwound — Quereus keeps the failing step's own message, APPENDS the reason the
  * schema could not be restored, and carries the original as `cause`. So a transient cause
  * underneath still matches here, and neither veto ({@link reportsPossiblyStoredWrite},
  * {@link reportsIndeterminateCommit}) looks for that reason text. Retrying over a partially migrated
@@ -432,7 +462,7 @@ export function isRetriableControlWriteFailure(error) {
 }
 /**
  * {@link isRetriableControlWriteFailure} widened by exactly one class — the self-coordination
- * grace refusal ({@link RETRIABLE_SCHEMA_INIT_MATCHERS}) — for `ControlDatabase.loadSchema`.
+ * grace refusal ({@link RETRIABLE_SCHEMA_INIT_MATCHERS}) — for `ControlDatabase.applyControlSchema`.
  *
  * Opt-in per call site, via {@link SCHEMA_INIT_RETRY_POLICY}. Every other control write keeps the
  * default classifier untouched.
@@ -441,14 +471,26 @@ export function isRetriableSchemaInitFailure(error) {
     return matchesRetriableFailure(error, RETRIABLE_SCHEMA_INIT_MATCHERS);
 }
 /**
- * Shared body of both classifiers: walk the `cause` chain, let {@link reportsPossiblyStoredWrite}
- * and then {@link reportsIndeterminateCommit} veto it, then claim a final torn write
- * ({@link isFinalTornWrite}), then ask `matchers`. The vetoes run BEFORE any matcher for every
- * policy — a chain reporting a possibly-stored write or a commit-phase batch is never retried,
- * however transient some other level looks, and a final torn write carried by a partial commit is
- * still declined because a sibling collection landed.
+ * {@link isRetriableControlWriteFailure} widened by exactly one class — a lost update
+ * ({@link isLostUpdate}), claimed by type — for the `CadrePeer` writers that re-read the row inside
+ * their locked body. Opt-in per call site, via {@link LOST_UPDATE_RETRY_POLICY}; both vetoes still
+ * run first, so a lost update carried inside a partial commit, a spent sync budget or a non-final
+ * torn write stays declined.
  */
-function matchesRetriableFailure(error, matchers) {
+export function isRetriableLostUpdateFailure(error) {
+    return matchesRetriableFailure(error, RETRIABLE_CONTROL_WRITE_MATCHERS, isLostUpdate);
+}
+/**
+ * Shared body of the three classifiers: walk the `cause` chain, let
+ * {@link reportsPossiblyStoredWrite} and then {@link reportsIndeterminateCommit} veto it, then claim
+ * a final torn write ({@link isFinalTornWrite}) or any link `claimsLink` names, then ask `matchers`.
+ * The vetoes run BEFORE any claim for every policy — a chain reporting a possibly-stored write or a
+ * commit-phase batch is never retried, however transient some other level looks, and a final torn
+ * write or a lost update carried by a partial commit is still declined because a sibling collection
+ * landed. `claimsLink` is the one typed claim a policy may add; it sits here beside the torn-write
+ * claim so the vetoes stay in one place above both.
+ */
+function matchesRetriableFailure(error, matchers, claimsLink) {
     if (!(error instanceof Error)) {
         return false;
     }
@@ -460,13 +502,13 @@ function matchesRetriableFailure(error, matchers) {
     if (reportsIndeterminateCommit(messages)) {
         return false;
     }
-    if (links.some(isFinalTornWrite)) {
+    if (links.some(link => isFinalTornWrite(link) || claimsLink?.(link) === true)) {
         return true;
     }
     return messages.some(message => matchers.some(matches => matches(message)));
 }
 /**
- * The one non-default retry policy: `ControlDatabase.loadSchema`'s distributed DDL, which
+ * The schema-init policy: `ControlDatabase.applyControlSchema`'s distributed DDL, which
  * additionally absorbs optimystic's self-coordination grace refusal and gets more attempts over a
  * longer backoff to do it (see {@link SCHEMA_INIT_ATTEMPTS} and
  * {@link SCHEMA_INIT_RETRY_DELAYS_MS}). Still bounded by the shared
@@ -474,16 +516,44 @@ function matchesRetriableFailure(error, matchers) {
  *
  * NOTE: exactly one call site opts in today, and the re-run safety this policy assumes is that
  * site's, not a general property — `apply schema` is a diff, and a failed apply is unwound whole
- * and verified against the pre-apply catalog (full argument at the `loadSchema` call site in
- * `control-database.ts`). A second opt-in must re-derive that argument for its own write body
+ * and verified against the pre-apply catalog (full argument at the `applyControlSchema` call site
+ * in `control-database.ts`). A second opt-in must re-derive that argument for its own write body
  * first; if this policy ever grows a third consumer, rename it for what the callers share rather
- * than widening it by default.
+ * than widening it by default. {@link LOST_UPDATE_RETRY_POLICY} is a separate policy for a
+ * separate class, not a second consumer of this one.
  */
 export const SCHEMA_INIT_RETRY_POLICY = {
     attempts: SCHEMA_INIT_ATTEMPTS,
     delaysMs: SCHEMA_INIT_RETRY_DELAYS_MS,
     isRetriable: isRetriableSchemaInitFailure,
 };
+/**
+ * The lost-update policy: the default classifier plus a lost update claimed by type
+ * ({@link isRetriableLostUpdateFailure}), over the default attempts, backoff and budget. A re-run
+ * here is a RE-DECISION, not a re-presentation: the body reads the row again under the lock and
+ * signs over what it finds, so the write that lost to a rival is replaced by one made over the
+ * rival's result. The budget bounds it as it bounds every write — a losing attempt whose read
+ * phase waited out one per-peer read deadline (~7.5 s measured in the degraded-cohort scenario's
+ * trio boot) gets exactly one retry, which is the ceiling to expect; one that waited out two
+ * (14.7 s, measured once in 18 of that scenario's boots, on the member that cannot reach one
+ * sibling) gets none and is abandoned on the budget, and the lost publish is then the reconcile
+ * pass's or the heartbeat's to redo, as every abandoned self-publish is.
+ *
+ * NOTE: the re-run safety this policy assumes is each opted-in body's, not a general property. A
+ * body may opt in only when its read of the row, its decision and its signature ALL run inside
+ * the locked body, so that the re-run presents a write made over the row as it now stands rather
+ * than the first attempt's signed record (which the rival may have stamped past, or which may
+ * overwrite what the rival wrote). Three `CadrePeer` writers opt in, through
+ * `ControlDatabase.mutateCadrePeer`'s policy parameter or `lockedWithRetry` directly:
+ * `updateSelfPeerRecord` (re-reads and re-signs the node's own record), `reauthorizeCadrePeer`
+ * (re-reads the stamp and decides again whether the row is still the owner's to re-touch) and
+ * the two removals `deleteCadrePeer` / `removeMachine` (stamp read and signature already inside
+ * the body, and a self-publish never changes the stamp the `'remove'` digest binds). A new opt-in
+ * must re-derive that argument for its own body first.
+ */
+export const LOST_UPDATE_RETRY_POLICY = {
+    isRetriable: isRetriableLostUpdateFailure,
+};
 /**
  * Run `attempt` up to {@link CONTROL_WRITE_ATTEMPTS} times (or `options.attempts`), retrying only
  * failures the policy's classifier — {@link isRetriableControlWriteFailure} by default —

package/dist/control-write-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-write-retry.js","sourceRoot":"","sources":["../src/control-write-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,0NAA0N;AAC1N,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAM,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,GAAG,EAAE,IAAK,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,mCAAmC,GACxC,+EAA+E,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC/D,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CAAC,KAAuB;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxB,IAAI,YAAY,uBAAuB;WACpC,CAAC,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;WACxD,IAAI,YAAY,6BAA6B;WAC7C,IAAI,YAAY,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,gBAAgB,CAAC,IAAW;IACpC,OAAO,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,kCAAkC,CAAC,OAAe;IAC1D,OAAO,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,+BAA+B,GACpC,0FAA0F,CAAC;AAE5F,wFAAwF;AACxF,SAAS,8BAA8B,CAAC,OAAe;IACtD,OAAO,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAA8C;IACnF,gCAAgC;IAChC,kCAAkC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,8BAA8B,GAA8C;IACjF,GAAG,gCAAgC;IACnC,8BAA8B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC/B,KAAc,EACd,QAAmD;IAEnD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAyB,EACzB,UAAoC,EAAE;IAEtC,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,6BAA6B;QACvC,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EAAE,8BAA8B;QAC3C,4EAA4E;QAC5E,mDAAmD;QACnD,SAAS,EAAE,eAAe;KAC1B,EAAE,OAAO,CAAC,CAAC;AACb,CAAC"}
+{"version":3,"file":"control-write-retry.js","sourceRoot":"","sources":["../src/control-write-retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AACxG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,0NAA0N;AAC1N,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAM,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,GAAG,EAAE,IAAK,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,IAAK,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D;;;GAGG;AACH,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,mCAAmC,GACxC,+EAA+E,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC/D,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,0BAA0B,CAAC,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CAAC,KAAuB;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxB,IAAI,YAAY,uBAAuB;WACpC,CAAC,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;WACxD,IAAI,YAAY,6BAA6B;WAC7C,IAAI,YAAY,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,gBAAgB,CAAC,IAAW;IACpC,OAAO,IAAI,YAAY,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,mFAAmF;AACnF,SAAS,kCAAkC,CAAC,OAAe;IAC1D,OAAO,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,YAAY,CAAC,IAAW;IAChC,OAAO,IAAI,YAAY,2BAA2B,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,+BAA+B,GACpC,0FAA0F,CAAC;AAE5F,wFAAwF;AACxF,SAAS,8BAA8B,CAAC,OAAe;IACtD,OAAO,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAA8C;IACnF,gCAAgC;IAChC,kCAAkC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,8BAA8B,GAA8C;IACjF,GAAG,gCAAgC;IACnC,8BAA8B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,OAAO,uBAAuB,CAAC,KAAK,EAAE,gCAAgC,EAAE,YAAY,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC/B,KAAc,EACd,QAAmD,EACnD,UAAqC;IAErC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAcD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,2BAA2B;IACrC,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,WAAW,EAAE,4BAA4B;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAyB,EACzB,UAAoC,EAAE;IAEtC,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,6BAA6B;QACvC,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EAAE,8BAA8B;QAC3C,4EAA4E;QAC5E,mDAAmD;QACnD,SAAS,EAAE,eAAe;KAC1B,EAAE,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/delegate-admission.d.ts

@@ -38,6 +38,7 @@
  * {@link dueRelayAnnounces} and {@link prunePeerStrandKeys} are that
  * decision, pure and testable, kept here beside the TTL they are derived from.
  */
+import type { StrandAddrOutcome } from './strand-addr-protocol.js';
 /**
  * How long one announced delegate grant stays valid without a re-announce.
  * Announcers refresh at half this (`CadreNode`'s reconcile pass), so a live
@@ -121,6 +122,18 @@ export declare function extractCircuitRelayTargets(addrs: string[]): CircuitRela
  * {@link peerStrandKey} on the peer announced TO.
  */
 export declare function dueRelayAnnounces(announceAt: ReadonlyMap<string, number>, relays: readonly CircuitRelayTarget[], strandId: string, now: number, ttlMs?: number): CircuitRelayTarget[];
+/**
+ * Fold one announce pass's outcomes into `refusing`, the relay peerIds remembered
+ * as refusing the strand-addr protocol. A relay whose negotiation refused it
+ * (`unsupported`) is added; one that replied with any status is removed, because
+ * it serves the protocol now. A relay that did not reply (`unreachable`) is left
+ * as it was: being down says nothing about what it serves. Only `relayPeerIds`
+ * are read, so a sibling asked in the same pass is never recorded. Mutates in
+ * place.
+ */
+export declare function recordRelayRefusals(refusing: Set<string>, relayPeerIds: readonly string[], outcomes: ReadonlyMap<string, StrandAddrOutcome>): void;
+/** Of `relays`, the ones not remembered in `refusing` (see {@link recordRelayRefusals}). */
+export declare function relaysNotRefusing(relays: readonly CircuitRelayTarget[], refusing: ReadonlySet<string>): CircuitRelayTarget[];
 /**
  * Drop the entries of a {@link peerStrandKey}-keyed map whose strand is no longer
  * running, and — when `livePeerIds` is given — whose peer is not among them. A

package/dist/delegate-admission.js

@@ -183,6 +183,33 @@ export function extractCircuitRelayTargets(addrs) {
 export function dueRelayAnnounces(announceAt, relays, strandId, now, ttlMs = DELEGATE_GRANT_TTL_MS) {
     return relays.filter((relay) => now - (announceAt.get(peerStrandKey(relay.relayPeerId, strandId)) ?? 0) >= ttlMs / 2);
 }
+/**
+ * Fold one announce pass's outcomes into `refusing`, the relay peerIds remembered
+ * as refusing the strand-addr protocol. A relay whose negotiation refused it
+ * (`unsupported`) is added; one that replied with any status is removed, because
+ * it serves the protocol now. A relay that did not reply (`unreachable`) is left
+ * as it was: being down says nothing about what it serves. Only `relayPeerIds`
+ * are read, so a sibling asked in the same pass is never recorded. Mutates in
+ * place.
+ */
+export function recordRelayRefusals(refusing, relayPeerIds, outcomes) {
+    for (const relayPeerId of relayPeerIds) {
+        switch (outcomes.get(relayPeerId)) {
+            case 'unsupported':
+                refusing.add(relayPeerId);
+                break;
+            case 'answered':
+            case 'empty':
+            case 'unavailable':
+                refusing.delete(relayPeerId);
+                break;
+        }
+    }
+}
+/** Of `relays`, the ones not remembered in `refusing` (see {@link recordRelayRefusals}). */
+export function relaysNotRefusing(relays, refusing) {
+    return relays.filter((relay) => !refusing.has(relay.relayPeerId));
+}
 /**
  * Drop the entries of a {@link peerStrandKey}-keyed map whose strand is no longer
  * running, and — when `livePeerIds` is given — whose peer is not among them. A

package/dist/delegate-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegate-admission.js","sourceRoot":"","sources":["../src/delegate-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAcvC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,OAAO,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAIjC,YAAY,QAAgB,qBAAqB;QAHhC,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAIzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAuB,EAAE,QAAgB,EAAE,cAAsB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CACb,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAC7C,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,uDAAuD,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5H,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,oFAAoF;IACpF,GAAG,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,GAAW,EAAE,MAAyC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAA6B,CAAC;QAClC,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;gBACnC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,GAAG,CAAC,8EAA8E,EAChF,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAe;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAuC,EACvC,MAAqC,EACrC,QAAgB,EAChB,GAAW,EACX,QAAgB,qBAAqB;IAErC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAChG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,gBAAqC,EACrC,WAAiC;IAEjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B;IAC7D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"delegate-admission.js","sourceRoot":"","sources":["../src/delegate-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAcvC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,OAAO,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAIjC,YAAY,QAAgB,qBAAqB;QAHhC,WAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAIzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAuB,EAAE,QAAgB,EAAE,cAAsB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CACb,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,eAAe,CAC7C,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,uDAAuD,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5H,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,oFAAoF;IACpF,GAAG,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,GAAW,EAAE,MAAyC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,SAA6B,CAAC;QAClC,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;gBACnC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,GAAG,CAAC,8EAA8E,EAChF,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAe;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAuC,EACvC,MAAqC,EACrC,QAAgB,EAChB,GAAW,EACX,QAAgB,qBAAqB;IAErC,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAChG,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAqB,EACrB,YAA+B,EAC/B,QAAgD;IAEhD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,QAAQ,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,KAAK,aAAa;gBAChB,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,OAAO,CAAC;YACb,KAAK,aAAa;gBAChB,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC7B,MAAM;QACV,CAAC;IACH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAC/B,MAAqC,EACrC,QAA6B;IAE7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,gBAAqC,EACrC,WAAiC;IAEjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gFAAgF,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B;IAC7D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/ed25519-key.d.ts

@@ -40,6 +40,16 @@ export declare function ed25519KeyPairFromLibp2p(privateKey: PrivateKey): Ed2551
  * @returns The base64url-encoded Ed25519 public key.
  */
 export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): string;
+/**
+ * Reject a value that isn't a base64url-encoded 32-byte Ed25519 seed, the private-key form
+ * {@link ed25519PublicKeyFromPrivate} and the crypto plugin's `sign` take. Unlike
+ * {@link requireEd25519PublicKeyB64}, no message names the value: it is a private key.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 seed; surrounding whitespace is ignored.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The seed re-encoded as canonical base64url, so two spellings of one key compare equal.
+ */
+export declare function requireEd25519PrivateKeyB64(value: string, label: string): string;
 /**
  * Derive the base64url ed25519 public key embedded in an Ed25519 libp2p PeerId.
  *
@@ -55,13 +65,6 @@ export declare function ed25519PublicKeyFromPrivate(privateKeyB64: string): stri
  * without importing the seed-bootstrap runtime.
  */
 export declare function ed25519PublicKeyB64FromPeerId(peerId: string): string | null;
-/**
- * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
- * is this ed25519 public key (base64url), or null when the value does not decode to a
- * 32-byte key. How an `OwnerKey` row is matched to the machine it names
- * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
- */
-export declare function peerIdFromEd25519PublicKeyB64(publicKeyB64: string): string | null;
 /**
  * Reject a value that isn't shaped like a base64url-encoded 32-byte Ed25519 public key
  * before it reaches the control database, where a malformed key would otherwise sit

package/dist/ed25519-key.js

@@ -1,7 +1,6 @@
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import { getPublicKey } from '@optimystic/quereus-plugin-crypto';
-import { peerIdFromPublicKey, peerIdFromString } from '@libp2p/peer-id';
-import { publicKeyFromRaw } from '@libp2p/crypto/keys';
+import { peerIdFromString } from '@libp2p/peer-id';
 /**
  * Bridge a libp2p Ed25519 private key into the base64url keypair used by the
  * control- and strand-database signing constraints.
@@ -50,6 +49,28 @@ export function ed25519KeyPairFromLibp2p(privateKey) {
 export function ed25519PublicKeyFromPrivate(privateKeyB64) {
     return getPublicKey(privateKeyB64, 'ed25519', 'base64url', 'base64url');
 }
+/**
+ * Reject a value that isn't a base64url-encoded 32-byte Ed25519 seed, the private-key form
+ * {@link ed25519PublicKeyFromPrivate} and the crypto plugin's `sign` take. Unlike
+ * {@link requireEd25519PublicKeyB64}, no message names the value: it is a private key.
+ *
+ * @param value - Candidate base64url-encoded Ed25519 seed; surrounding whitespace is ignored.
+ * @param label - Human-readable name of the field, used in error messages.
+ * @returns The seed re-encoded as canonical base64url, so two spellings of one key compare equal.
+ */
+export function requireEd25519PrivateKeyB64(value, label) {
+    let decoded;
+    try {
+        decoded = uint8ArrayFromString(value.trim(), 'base64url');
+    }
+    catch (error) {
+        throw new Error(`The ${label} must be a base64url-encoded Ed25519 private key (it does not decode as base64url)`, { cause: error });
+    }
+    if (decoded.length !== 32) {
+        throw new Error(`The ${label} must be a base64url-encoded 32-byte Ed25519 private key (it decoded to ${decoded.length} bytes)`);
+    }
+    return uint8ArrayToString(decoded, 'base64url');
+}
 /**
  * Derive the base64url ed25519 public key embedded in an Ed25519 libp2p PeerId.
  *
@@ -76,24 +97,6 @@ export function ed25519PublicKeyB64FromPeerId(peerId) {
         return null;
     }
 }
-/**
- * The inverse of {@link ed25519PublicKeyB64FromPeerId}: the libp2p peer id whose identity
- * is this ed25519 public key (base64url), or null when the value does not decode to a
- * 32-byte key. How an `OwnerKey` row is matched to the machine it names
- * (`machine-removal.ts`), since a machine's owner key is the key behind its peer id.
- */
-export function peerIdFromEd25519PublicKeyB64(publicKeyB64) {
-    try {
-        const raw = uint8ArrayFromString(publicKeyB64, 'base64url');
-        if (raw.length !== 32) {
-            return null;
-        }
-        return peerIdFromPublicKey(publicKeyFromRaw(raw)).toString();
-    }
-    catch {
-        return null;
-    }
-}
 /** Longest rejected key value echoed back in an error — a real key is 43 base64url chars. */
 const REJECTED_VALUE_ECHO_LIMIT = 64;
 /**

package/dist/ed25519-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgBvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"ed25519-key.js","sourceRoot":"","sources":["../src/ed25519-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAgBnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,KAAa;IACtE,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,oFAAoF,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,2EAA2E,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB;QAC9C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,2DAA2D,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,sEAAsE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAC1H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,KAAK,KAAK,6DAA6D,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,MAAM,SAAS,CACxI,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/edge-node/config.d.ts

@@ -0,0 +1,122 @@
+/**
+ * The edge node's `CadreNodeConfig` and how a start settles its owner key. Nothing here needs a
+ * node started, so a test can build the node shape an edge device runs.
+ */
+import { type KeyStore } from '../key-store.js';
+import type { CadreNode } from '../cadre-node.js';
+import type { CadreNodeConfig } from '../types.js';
+import type { BootstrapPeerStore } from '../bootstrap-peer-store.js';
+import type { EnrolledMachineStore } from '../enrolled-machine-store.js';
+import type { StrandNetworkStateStore } from '../strand-network-state.js';
+import type { TrustedOwnerStore } from '../trusted-owner-store.js';
+import type { IRawStorage, Libp2pTransports, NoiseCryptoInterface } from '@optimystic/db-p2p';
+import type { EdgeNodeOptions } from './options.js';
+/** What {@link buildEdgeNodeConfig} takes: one start's options plus what the platform built. */
+export interface EdgeNodeConfigInputs extends EdgeNodeOptions {
+    /** `undefined` keeps libp2p-noise's own crypto. */
+    noiseCrypto?: NoiseCryptoInterface;
+    /**
+     * Holds the node identity, which the node loads on start, generating it on first run, and the
+     * owner key in its own slot (`DEFAULT_OWNER_KEY_ID`), which only {@link runOwnerGenesis} creates.
+     */
+    keyStore: KeyStore;
+    /**
+     * Raw block storage per cadre-core storage scope: `controlStorageScope(partyId)` for the
+     * control network, the strand id for each strand. The key is already safe as a database-name
+     * segment — use it verbatim, do not parse it.
+     */
+    storageProvider: (scope: string) => IRawStorage;
+    /** libp2p transport factories: what the node dials with, and what listens on `listenAddrs`. */
+    transports: Libp2pTransports;
+    /**
+     * Listen addresses besides the bare `/p2p-circuit` entry cadre-core adds for a named relay.
+     * Default `[]`: an edge device accepts no inbound connection. See `EdgeNodePlatform.listenAddrs`.
+     */
+    listenAddrs?: string[];
+    /** See `EdgeNodePlatform.allowPrivateDial`. */
+    allowPrivateDial: boolean;
+    trustedOwnerStore: TrustedOwnerStore;
+    bootstrapPeerStore: BootstrapPeerStore;
+    enrolledMachineStore: EnrolledMachineStore;
+    strandNetworkStateStore: StrandNetworkStateStore;
+}
+/**
+ * The edge node's config: transaction profile (Ring Zulu only, intermittent connectivity), no
+ * listen address unless the platform names one, reachability through the configured relays (if
+ * any) but never a hard requirement for one, every strand the control network lists, and no
+ * automatic hibernation (the app's lifecycle runner hibernates on background). Schema signing is
+ * left at cadre-core's fail-closed default; an app with unsigned schemas relaxes it in
+ * `EdgeNodePlatform.configure`.
+ */
+export declare function buildEdgeNodeConfig(inputs: EdgeNodeConfigInputs): CadreNodeConfig;
+/**
+ * How the start settled this node's owner key: `EdgeNodeStatus.owner`. `'enrolled'`: a key is
+ * an owner and wired for signing. `'member'`: the party lists no key this app holds (a party it
+ * joined, or one it founded whose owner slot was lost). `'failed'` and `'timed-out'`: see
+ * {@link runOwnerGenesis}.
+ */
+export type OwnerGenesisResult = 'enrolled' | 'member' | 'failed' | 'timed-out';
+/**
+ * Default bound on {@link runOwnerGenesis} and {@link wireJoinedOwnerKey}: what a start can wait
+ * for its owner step, which runs control reads and one control write, before it goes on without
+ * it. Not derived from the link, since a start that waited out a stalled write (about 84 s, see
+ * `docs/cadre-consistency.md`) would be a start the user gave up on.
+ */
+export declare const DEFAULT_OWNER_GENESIS_TIMEOUT_MS = 60000;
+/** Default `EdgeNodeOptions.ownerKeyLabel`: the founding owner key's name on its `OwnerKey` row. */
+export declare const DEFAULT_OWNER_KEY_LABEL = "phone";
+/**
+ * Refuses an `ownerKeyLabel` the founding `OwnerKey` row would refuse, so a start naming one
+ * fails outright: fail-soft genesis would only log it, on that start and every later one.
+ */
+export declare function requireOwnerKeyLabel(label: string | undefined): void;
+/** What {@link runOwnerGenesis} takes. */
+export interface OwnerGenesisOptions {
+    /** The key store whose owner slot holds this app's owner key: the one the identity is in. */
+    keyStore: KeyStore;
+    /** The founding row's label; default {@link DEFAULT_OWNER_KEY_LABEL}. */
+    label?: string;
+    /** Default {@link DEFAULT_OWNER_GENESIS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}
+/** What {@link wireJoinedOwnerKey} takes. */
+export interface JoinedOwnerKeyOptions {
+    /** The key store whose owner slot holds this app's owner key, if it holds one. */
+    keyStore: KeyStore;
+    /** Default {@link DEFAULT_OWNER_GENESIS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /** An owner grant has just seated the slot's key: keep asking until the row arrives. */
+    granted?: boolean;
+}
+/**
+ * The owner step of a party this app founded. On a party with no `OwnerKey` row yet, the owner
+ * slot's key (created there now unless the slot already holds one) becomes the founding owner
+ * under `label` and is wired for signing, which also lets the node author its own `CadrePeer` row.
+ * On a party that has owners, the slot's key is wired only when it is a live owner, and no key is
+ * created: a new one could not be seated without another owner's signature. A node must be an
+ * enrolled owner to publish strands, and `CadreNode.requestJoin` works only on one. A joined
+ * party's start runs {@link wireJoinedOwnerKey} instead.
+ *
+ * Fail-soft and bounded: a failure or a genesis that has not settled within `timeoutMs` is logged
+ * and returned, and the start stands — the app can still join discovered strands and sync. A
+ * genesis that times out keeps running; its later failure is logged.
+ *
+ * NOTE: the bound is here, in cadre-core, so every edge node gets it; a Node host runs genesis
+ * through the CLI's own flow instead. Since v1.10 a control write against an unresponsive member
+ * can hold the write lock for about 84 s, so an unbounded wait here would be a real stall. A bound
+ * on that write itself, in `ControlDatabase`, would make this one redundant; drop `timeoutMs` then.
+ */
+export declare function runOwnerGenesis(node: CadreNode, options: OwnerGenesisOptions): Promise<OwnerGenesisResult>;
+/**
+ * The owner step of a party this app joined: wire a key only when the party lists it as a live
+ * owner, never insert an `OwnerKey` row, so a joined app can neither seat itself as a founder nor
+ * anchor a key that is no owner's. Only the owner slot's key is tried: the key an owner grant
+ * seated, one imported here, or one an owner of the party added. The identity key is never
+ * tried, since a machine's network identity is never an owner key. Fail-soft and bounded as
+ * {@link runOwnerGenesis} is.
+ *
+ * `granted`: an owner grant has just made this app an owner, so a key not listed yet means the
+ * row has not reached this node, not that it is no owner. It is asked again every 2 s until it
+ * is wired or the bound passes; a start that timed out wires it on the next start.
+ */
+export declare function wireJoinedOwnerKey(node: CadreNode, options: JoinedOwnerKeyOptions): Promise<OwnerGenesisResult>;