@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/edge-node/owner-grant.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `EdgeNode.redeemOwnerGrant`'s sequence: make the app an owner of the party it runs in with
+ * owner-grant text, seating the owner slot's key (docs/architecture.md → "Owner grants"). Runs
+ * over a narrow view of the runtime ({@link OwnerGrantRuntime}), inside one of its transitions,
+ * as the join does.
+ */
+import type { CadreNode } from '../cadre-node.js';
+import type { OwnerSigner } from '../owner-signer.js';
+import type { OwnerGenesisResult } from './config.js';
+/** The part of the edge-node runtime a redemption drives; the join's view has the same two calls. */
+export interface OwnerGrantRuntime {
+    /** The owner slot's key, created when the slot is empty: the key an owner grant seats. */
+    ownerSlotSigner(): Promise<OwnerSigner>;
+    /** `granted`: an owner grant has just seated the slot's key, so wait for the row. */
+    wireJoinedOwner(node: CadreNode, granted: boolean): Promise<OwnerGenesisResult>;
+}
+/** What {@link redeemOwnerGrantText} settled. */
+export interface RedeemedOwnerGrant {
+    /** The owner slot's key: the one the grant seated, or found already an owner. */
+    ownerKey: string;
+    /** The key was already a live owner of the party: nothing was signed or written, and the grant spent no use. */
+    alreadyOwner: boolean;
+    /**
+     * The key is wired as the node's owner signer. False when its row has not reached this node
+     * within the owner-step bound (a redemption at another member); a later start wires it.
+     */
+    wired: boolean;
+}
+/**
+ * Decode `text`, refuse a grant for another party, answer a slot key that is already an owner
+ * here, else redeem the grant for the slot's key (`CadreNode.redeemOwnerGrant`) and wire it.
+ *
+ * The already-owner answer comes first because the redemption's local path refuses `alone`
+ * before it asks whether the key is an owner, and a device that is one should hear so whether
+ * or not it is connected.
+ *
+ * @throws the decoder's error for text that is not an owner grant; `OwnerGrantRejectedError`
+ *   `party-mismatch` for a grant of another party, the code a member serving another cadre answers;
+ *   and what `CadreNode.redeemOwnerGrant` throws.
+ */
+export declare function redeemOwnerGrantText(runtime: OwnerGrantRuntime, node: CadreNode, text: string): Promise<RedeemedOwnerGrant>;

package/dist/edge-node/owner-grant.js

@@ -0,0 +1,38 @@
+/**
+ * `EdgeNode.redeemOwnerGrant`'s sequence: make the app an owner of the party it runs in with
+ * owner-grant text, seating the owner slot's key (docs/architecture.md → "Owner grants"). Runs
+ * over a narrow view of the runtime ({@link OwnerGrantRuntime}), inside one of its transitions,
+ * as the join does.
+ */
+import { decodeOwnerGrant, OwnerGrantRejectedError } from '../owner-grant-protocol.js';
+/**
+ * Decode `text`, refuse a grant for another party, answer a slot key that is already an owner
+ * here, else redeem the grant for the slot's key (`CadreNode.redeemOwnerGrant`) and wire it.
+ *
+ * The already-owner answer comes first because the redemption's local path refuses `alone`
+ * before it asks whether the key is an owner, and a device that is one should hear so whether
+ * or not it is connected.
+ *
+ * @throws the decoder's error for text that is not an owner grant; `OwnerGrantRejectedError`
+ *   `party-mismatch` for a grant of another party, the code a member serving another cadre answers;
+ *   and what `CadreNode.redeemOwnerGrant` throws.
+ */
+export async function redeemOwnerGrantText(runtime, node, text) {
+    const bundle = decodeOwnerGrant(text);
+    if (bundle.partyId !== node.partyId) {
+        throw new OwnerGrantRejectedError('party-mismatch', `This grant is for cadre ${bundle.partyId}, not the one this app runs in`);
+    }
+    // NOTE: a key created here stays in the slot when the redemption then fails, as a failed grant
+    // join's does (`edge-join.ts`), so a later import of a different exported key is refused as
+    // slot-occupied until a grant seats this one. If users meet that, delete a key this call created
+    // when the refusal is one that wrote nothing (every refusal but an unreachable member or an
+    // unverifiable reply, after either of which the row may exist).
+    const signer = await runtime.ownerSlotSigner();
+    if (await node.wireOwnKeyIfOwner(signer)) {
+        return { ownerKey: signer.publicKey, alreadyOwner: true, wired: true };
+    }
+    const { alreadyOwner } = await node.redeemOwnerGrant(bundle, signer);
+    const wired = (await runtime.wireJoinedOwner(node, true)) === 'enrolled';
+    return { ownerKey: signer.publicKey, alreadyOwner, wired };
+}
+//# sourceMappingURL=owner-grant.js.map

package/dist/edge-node/owner-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-grant.js","sourceRoot":"","sources":["../../src/edge-node/owner-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAyBvF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA0B,EAAE,IAAe,EAAE,IAAY;IACnG,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,EAAE,2BAA2B,MAAM,CAAC,OAAO,gCAAgC,CAAC,CAAC;IAChI,CAAC;IACD,+FAA+F;IAC/F,4FAA4F;IAC5F,iGAAiG;IACjG,4FAA4F;IAC5F,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC"}

package/dist/edge-node/platform.d.ts

@@ -0,0 +1,140 @@
+/**
+ * What an app supplies to run the edge node (`createEdgeNode`): its key store, its storage, and
+ * the platform choices (transports, listen addresses, Noise crypto) that cadre-core cannot make
+ * for it. Fixed for the app's lifetime.
+ */
+import type { IRawStorage, Libp2pTransports, NoiseCryptoInterface } from '@optimystic/db-p2p';
+import type { KeyStore } from '../key-store.js';
+import type { DurableSlot } from '../node-local-snapshot.js';
+import type { CadreNodeConfig } from '../types.js';
+import type { NodeLocalKv } from './node-local.js';
+import type { NoiseCryptoMode } from './options.js';
+export interface EdgeNodePlatform {
+    /**
+     * Everything secret: the identity (`DEFAULT_IDENTITY_KEY_ID`), the owner key in its own slot
+     * (`DEFAULT_OWNER_KEY_ID`), the joined-strand records (`KeyStoreJoinedStrandStore`) and the
+     * strand-move records. The phone's is the platform secure store; a browser's or a desktop
+     * app's may be a plaintext database, which is then where its identity already lives.
+     */
+    keyStore: KeyStore;
+    storage: EdgeNodeStorage;
+    /**
+     * libp2p transports, given the relays the node reserves on. Default: WebSockets and circuit
+     * relay. An app with WebRTC adds `webRTC({ rtcConfiguration: { iceServers } })`, `iceServers`
+     * from `resolveStunServers(relayAddrs)`.
+     */
+    transports?: (relayAddrs: readonly string[]) => Libp2pTransports;
+    /**
+     * Listen addresses besides the bare `/p2p-circuit` entry cadre-core adds for a named relay
+     * (`relay-addrs.ts` → `resolveListenAddrs`). Default `[]`: an edge device cannot accept a
+     * connection, so the only address it has is the one a relay reservation earns it. A browser
+     * tab returns `['/webrtc']` when it has relays, so a relayed connection can upgrade to a direct
+     * one.
+     */
+    listenAddrs?: (relayAddrs: readonly string[]) => string[];
+    /**
+     * Noise crypto built outside libp2p-noise: `build` returns the implementation for a mode,
+     * `defaultMode` the mode used when the start options name none. Absent: libp2p-noise's own
+     * crypto, pure JavaScript on a phone (the React Native kit's `/noise-crypto` is the native one).
+     */
+    noiseCrypto?: {
+        build: (mode: NoiseCryptoMode) => NoiseCryptoInterface | undefined;
+        defaultMode: NoiseCryptoMode;
+    };
+    /**
+     * The keys inside the node-local store. Each is a persistence contract: renaming one orphans
+     * every installed app's records. The defaults are the reference apps'; an app that names its
+     * own should pin them in a test.
+     */
+    names?: Partial<EdgeNodeNames>;
+    /**
+     * Dial loopback, private and plain `ws://` addresses. Default `true`: see the
+     * `connectionGater` comment in `buildEdgeNodeConfig`.
+     */
+    allowPrivateDial?: boolean;
+    /** Bound on owner genesis; default 60 s. See `runOwnerGenesis`. */
+    ownerGenesisTimeoutMs?: number;
+    /**
+     * A version naming the format of the data this build writes, for example the stack version it
+     * was built against. Saved with each successful start and reported by `loadSavedStart` as
+     * `writtenBy`, so a later build can tell data it cannot use from data it can.
+     */
+    dataVersion?: string;
+    /**
+     * The last word on the config the edge node built: strand filter, schema-signing policy,
+     * hibernation, `linkRoundTripMs`, or anything the parameters above do not cover.
+     */
+    configure?: (config: CadreNodeConfig) => CadreNodeConfig;
+}
+/** The keys inside the node-local store (`EdgeNodeStorage.nodeLocal`) that are the edge node's. */
+export interface EdgeNodeNames {
+    /**
+     * Key of the saved-start record. One per app, not per party: it is what names the party every
+     * other record is filed under. Dot-free, so it cannot collide with the `<record>.<partyId>`
+     * keys of `node-local.ts`.
+     */
+    savedStartKey: string;
+    /**
+     * Key of the record naming a party whose dissolve has begun. Dot-free and one per app, as
+     * {@link EdgeNodeNames.savedStartKey} is.
+     */
+    dissolveMarkerKey: string;
+    /**
+     * Key of the join request this app opened as a link to another app (`LinkRequestStore` in
+     * `@serfab/cadre-rn/app-link`). Dot-free and one per app, as {@link EdgeNodeNames.savedStartKey} is.
+     */
+    linkRequestKey: string;
+    /**
+     * Key of the apps the user allowed to join before they asked (`AppRecommendationStore` in
+     * `@serfab/cadre-rn/app-link`). Dot-free and one per app, as {@link EdgeNodeNames.savedStartKey}
+     * is; each entry names its party.
+     */
+    recommendationsKey: string;
+}
+export declare const DEFAULT_EDGE_NODE_NAMES: EdgeNodeNames;
+/**
+ * The app's storage, as the edge node opens, closes and deletes it: one raw block store per
+ * cadre-core storage scope, and one node-local key-value store beside them. The platform owns
+ * every handle; the edge node only says when it is done with them (`close`).
+ */
+export interface EdgeNodeStorage {
+    /**
+     * Names the storage. `createEdgeNode` refuses a second starting, joining or running edge node
+     * over the same id in one process, and replaces a stopped one: two over the same storage
+     * would share databases and an identity.
+     */
+    readonly id: string;
+    /**
+     * One storage scope's raw block storage: `controlStorageScope(partyId)` for the control
+     * network, the strand id for each strand. The key is already safe as a database-name segment;
+     * use it verbatim, do not parse it. Synchronous, as `CadreNodeConfig.storage.provider` is; a
+     * platform whose opener is async returns `lazyRawStorage(...)`. The same handle for the same
+     * scope until {@link close}: cadre-core asks once per scope per runtime, and again after a
+     * strand stops.
+     */
+    rawStorage(scope: string): IRawStorage;
+    /** Delete a scope's storage. No handle on it may be open. Resolves when it is gone or was absent. */
+    destroyScope(scope: string): Promise<void>;
+    /**
+     * The node-local key-value store, holding the saved start, the dissolve marker, the app-link
+     * records and the per-party records of `node-local.ts`. Usable with no node running: reopens
+     * after {@link close}.
+     */
+    nodeLocal(): NodeLocalKv;
+    /**
+     * Flush and close the node-local store, then close every handle {@link rawStorage} opened. A
+     * failure closing one is logged and the rest still close; the call does not reject.
+     */
+    close(): Promise<void>;
+    /**
+     * Per-party slot for the trusted-owner anchor (`PersistentTrustedOwnerStore`). Absent: the
+     * node-local key `trustedOwnersKvKey(partyId)`. The anchor is not secret but it is
+     * trust-bearing, so the phone puts it in its secure store, beside the identity it qualifies.
+     */
+    trustedOwnerSlot?(partyId: string): RemovableSlot;
+}
+/** A {@link DurableSlot} a removal can delete: the trusted-owner anchor of a party being removed. */
+export interface RemovableSlot extends DurableSlot {
+    /** Delete the slot's record, durably. Resolves when it is gone or was absent. */
+    remove(): Promise<void>;
+}

package/dist/edge-node/platform.js

@@ -0,0 +1,12 @@
+/**
+ * What an app supplies to run the edge node (`createEdgeNode`): its key store, its storage, and
+ * the platform choices (transports, listen addresses, Noise crypto) that cadre-core cannot make
+ * for it. Fixed for the app's lifetime.
+ */
+export const DEFAULT_EDGE_NODE_NAMES = {
+    savedStartKey: 'start-options',
+    dissolveMarkerKey: 'dissolving-party',
+    linkRequestKey: 'link-join-request',
+    recommendationsKey: 'recommended-apps',
+};
+//# sourceMappingURL=platform.js.map

package/dist/edge-node/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/edge-node/platform.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6FH,MAAM,CAAC,MAAM,uBAAuB,GAAkB;IACrD,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,kBAAkB;IACrC,cAAc,EAAE,mBAAmB;IACnC,kBAAkB,EAAE,kBAAkB;CACtC,CAAC"}

package/dist/edge-node/strand-move.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Carrying the strands of the party this app founded into the party it joins
+ * (docs/architecture.md → "An app joins an existing cadre" → "Moving the app's strands").
+ *
+ * The app runs one node, so cadre-core's two ends of a move run on two nodes, one after the
+ * other: `exportStrandBundle` on the left party's node before the switch, `adoptStrandBundle` on
+ * the joined party's node once the app's key is wired as an owner there. Between them the bundle
+ * is kept here, one record per left party, so a join killed partway, or an owner key wired only
+ * on a later launch, finishes the move on a later start. The bundle carries read secrets, party
+ * keys and bearer invitations, so the record lives in the key store beside the identity.
+ */
+import type { StrandBundle, StrandMoveReport } from '../strand-move.js';
+import type { CadreNode } from '../cadre-node.js';
+import type { KeyStore } from '../key-store.js';
+import { type JoinCredential } from './join-credential.js';
+/** How a join's strand move settled: `JoinCadreResult.strandMove`. */
+export type StrandMoveOutcome = 
+/** Adopted. `partial`: `report.failed` lists what the next start, or `finishStrandMove`, retries. */
+{
+    state: 'done' | 'partial';
+    report: StrandMoveReport;
+}
+/** Not adopted yet: the app's key is not wired as an owner of the joined party. A start after it is adopts. */
+ | {
+    state: 'deferred';
+    reason: 'owner-key-not-wired';
+}
+/** Not adopted yet: the adoption threw (logged). The next start, or `finishStrandMove`, retries. */
+ | {
+    state: 'deferred';
+    reason: 'adoption-failed';
+    error: Error;
+};
+/** A move still waiting: `EdgeNode.pendingStrandMove`. */
+export interface PendingStrandMove {
+    fromPartyId: string;
+    /** The party the strands move into; the record is adopted there and nowhere else. */
+    toPartyId: string;
+    /** Strands of `fromPartyId` not seated in `toPartyId` yet. */
+    strandIds: string[];
+    /** Strands `toPartyId` refused permanently so far: it participates in them under its own identity. */
+    refused: StrandMoveReport['refused'];
+}
+/**
+ * `EdgeNode.joinCadre` refused before anything stopped: the party this app founded holds strands,
+ * pending joins or invitations, and a machine invitation does not make the app an owner of the
+ * party it joins. Every row a move seats there is owner-signed, so a member's join would leave
+ * them in a party the app no longer runs. Joining with an owner grant moves them.
+ */
+export declare class StrandsNeedOwnerJoinError extends Error {
+    readonly fromPartyId: string;
+    readonly toPartyId: string;
+    readonly strandCount: number;
+    constructor(bundle: StrandBundle, toPartyId: string);
+}
+/** What the key store holds for one left party between the export and a complete adoption. */
+interface StrandMoveRecord {
+    v: typeof RECORD_VERSION;
+    targetPartyId: string;
+    bundle: StrandBundle;
+    /** Strand ids an earlier adoption seated. Never left out of a retry: an invitation bound to one needs it under `moved`. */
+    moved: string[];
+    /** Permanent refusals from earlier adoptions, left out of a retry and reported each time. */
+    refused: StrandMoveReport['refused'];
+}
+declare const RECORD_VERSION = 1;
+/** The move records, one key-store slot per left party. A read the key store refuses throws; it is never read as "no record". */
+export declare class StrandMoveRecords {
+    private readonly keyStore;
+    constructor(keyStore: KeyStore);
+    /**
+     * Replaces the left party's record: a newer export is the fuller one.
+     *
+     * NOTE: on a phone, a bundle with a routing table per strand runs past expo-secure-store's
+     * 2048-byte value guideline; version 14 warns and stores it, and the iOS Keychain and Android's
+     * encrypted preferences hold more. If a later SDK throws instead, keep the routing tables
+     * (not secret) in the node-local store and only the secrets here.
+     */
+    save(record: StrandMoveRecord): Promise<void>;
+    load(fromPartyId: string): Promise<StrandMoveRecord | undefined>;
+    remove(fromPartyId: string): Promise<void>;
+    /** Every record naming `toPartyId`, in slot order. */
+    naming(toPartyId: string): Promise<StrandMoveRecord[]>;
+    /**
+     * The record in `slot`. One that does not parse is deleted with a warning: nothing can adopt
+     * it, and the strands are still in the left party's storage. Its absence then reads as
+     * "nothing waiting", so code that deletes that storage must not take a missing record alone
+     * as proof that every strand reached the joined party.
+     */
+    private read;
+}
+/**
+ * The record a join writes before the switch, or `undefined` when the bundle holds nothing to
+ * move. Throws {@link StrandsNeedOwnerJoinError} when it does and `credential` is a machine
+ * invitation, which does not make the app an owner of the party it joins.
+ */
+export declare function joinMoveRecord(bundle: StrandBundle, credential: JoinCredential): StrandMoveRecord | undefined;
+/**
+ * Adopt `record` on `node`, running in the record's target party, without the strands an earlier
+ * attempt had refused; then delete the record when nothing failed, or save this attempt's
+ * progress. The report lists every refusal so far. Throws what `adoptStrandBundle` throws. A
+ * failure updating the record is only logged: the record left behind is adopted again, without
+ * harm, by the next start.
+ */
+export declare function adoptMoveRecord(node: CadreNode, records: StrandMoveRecords, record: StrandMoveRecord): Promise<StrandMoveReport>;
+/**
+ * Adopt every record naming the node's party, by left party. A record the key store refuses to
+ * read throws; an adoption that throws is logged and reported as deferred, and its record kept.
+ */
+export declare function adoptMovesInto(node: CadreNode, records: StrandMoveRecords): Promise<Map<string, StrandMoveOutcome>>;
+export declare function deferredOutcome(err: unknown): StrandMoveOutcome;
+/** A thrown value as an `Error`, for a status or outcome that carries one. */
+export declare function toError(err: unknown): Error;
+export declare function pendingMove(record: StrandMoveRecord): PendingStrandMove;
+export {};

package/dist/edge-node/strand-move.js

@@ -0,0 +1,223 @@
+/**
+ * Carrying the strands of the party this app founded into the party it joins
+ * (docs/architecture.md → "An app joins an existing cadre" → "Moving the app's strands").
+ *
+ * The app runs one node, so cadre-core's two ends of a move run on two nodes, one after the
+ * other: `exportStrandBundle` on the left party's node before the switch, `adoptStrandBundle` on
+ * the joined party's node once the app's key is wired as an owner there. Between them the bundle
+ * is kept here, one record per left party, so a join killed partway, or an owner key wired only
+ * on a later launch, finishes the move on a later start. The bundle carries read secrets, party
+ * keys and bearer invitations, so the record lives in the key store beside the identity.
+ */
+import { adoptStrandBundle, StrandMoveNotOwnerError } from '../strand-move.js';
+import { isOwnerGrant } from './join-credential.js';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+/**
+ * `EdgeNode.joinCadre` refused before anything stopped: the party this app founded holds strands,
+ * pending joins or invitations, and a machine invitation does not make the app an owner of the
+ * party it joins. Every row a move seats there is owner-signed, so a member's join would leave
+ * them in a party the app no longer runs. Joining with an owner grant moves them.
+ */
+export class StrandsNeedOwnerJoinError extends Error {
+    constructor(bundle, toPartyId) {
+        super(`Cannot join party ${toPartyId} as a member: ${describeContent(bundle)} of party ${bundle.partyId} ` +
+            'would be left behind, and only an owner can move them. Join with an owner grant instead, made under the owner app\'s Owner keys.');
+        this.name = 'StrandsNeedOwnerJoinError';
+        this.fromPartyId = bundle.partyId;
+        this.toPartyId = toPartyId;
+        this.strandCount = bundle.strands.length;
+    }
+}
+const RECORD_VERSION = 1;
+/** Key-store id prefix of every move record; the left party's id follows, base64url. */
+const SLOT_PREFIX = 'cadre/strand-move/';
+/**
+ * A persistence contract: `cadre/strand-move/<base64url of the party id's UTF-8 bytes>`, the
+ * id the React Native kit wrote before the records moved here (its `secureStoreKeySegment`
+ * encodes the same way), so an installed phone's record is read back.
+ */
+function slotId(fromPartyId) {
+    return SLOT_PREFIX + uint8ArrayToString(uint8ArrayFromString(fromPartyId, 'utf8'), 'base64url');
+}
+/** The move records, one key-store slot per left party. A read the key store refuses throws; it is never read as "no record". */
+export class StrandMoveRecords {
+    constructor(keyStore) {
+        this.keyStore = keyStore;
+    }
+    /**
+     * Replaces the left party's record: a newer export is the fuller one.
+     *
+     * NOTE: on a phone, a bundle with a routing table per strand runs past expo-secure-store's
+     * 2048-byte value guideline; version 14 warns and stores it, and the iOS Keychain and Android's
+     * encrypted preferences hold more. If a later SDK throws instead, keep the routing tables
+     * (not secret) in the node-local store and only the secrets here.
+     */
+    save(record) {
+        return this.keyStore.set(slotId(record.bundle.partyId), uint8ArrayFromString(JSON.stringify(record), 'utf8'));
+    }
+    load(fromPartyId) {
+        return this.read(slotId(fromPartyId));
+    }
+    remove(fromPartyId) {
+        return this.keyStore.delete(slotId(fromPartyId));
+    }
+    /** Every record naming `toPartyId`, in slot order. */
+    async naming(toPartyId) {
+        const slots = (await this.keyStore.list()).filter((slot) => slot.startsWith(SLOT_PREFIX)).sort();
+        const records = [];
+        for (const slot of slots) {
+            const record = await this.read(slot);
+            if (record?.targetPartyId === toPartyId)
+                records.push(record);
+        }
+        return records;
+    }
+    /**
+     * The record in `slot`. One that does not parse is deleted with a warning: nothing can adopt
+     * it, and the strands are still in the left party's storage. Its absence then reads as
+     * "nothing waiting", so code that deletes that storage must not take a missing record alone
+     * as proof that every strand reached the joined party.
+     */
+    async read(slot) {
+        const bytes = await this.keyStore.get(slot);
+        if (bytes === undefined)
+            return undefined;
+        const record = parseRecord(uint8ArrayToString(bytes, 'utf8'));
+        if (record !== undefined && slotId(record.bundle.partyId) === slot)
+            return record;
+        console.warn(`[cadre-core/edge-node] deleting the strand move record in ${slot}: it is not one this kit wrote`);
+        try {
+            await this.keyStore.delete(slot);
+        }
+        catch (err) {
+            // Read as absent either way; failing every start over a record nothing can use would be worse.
+            console.warn(`[cadre-core/edge-node] could not delete the strand move record in ${slot}:`, err);
+        }
+        return undefined;
+    }
+}
+/**
+ * The record a join writes before the switch, or `undefined` when the bundle holds nothing to
+ * move. Throws {@link StrandsNeedOwnerJoinError} when it does and `credential` is a machine
+ * invitation, which does not make the app an owner of the party it joins.
+ */
+export function joinMoveRecord(bundle, credential) {
+    if (bundle.strands.length + bundle.pendingJoins.length + bundle.formationInvites.length === 0)
+        return undefined;
+    if (!isOwnerGrant(credential))
+        throw new StrandsNeedOwnerJoinError(bundle, credential.partyId);
+    return { v: RECORD_VERSION, targetPartyId: credential.partyId, bundle, moved: [], refused: [] };
+}
+/**
+ * Adopt `record` on `node`, running in the record's target party, without the strands an earlier
+ * attempt had refused; then delete the record when nothing failed, or save this attempt's
+ * progress. The report lists every refusal so far. Throws what `adoptStrandBundle` throws. A
+ * failure updating the record is only logged: the record left behind is adopted again, without
+ * harm, by the next start.
+ */
+export async function adoptMoveRecord(node, records, record) {
+    const refused = new Set(record.refused.map((entry) => entry.strandId));
+    const strands = record.bundle.strands.filter((entry) => !refused.has(entry.row.Id));
+    const adopted = await adoptStrandBundle(node, { ...record.bundle, strands });
+    const report = { ...adopted, refused: [...record.refused, ...adopted.refused] };
+    await keepWhatIsLeft(records, record, report);
+    return report;
+}
+async function keepWhatIsLeft(records, record, report) {
+    const fromPartyId = record.bundle.partyId;
+    try {
+        if (report.failed.length === 0) {
+            await records.remove(fromPartyId);
+        }
+        else {
+            const moved = [...new Set([...record.moved, ...report.moved])];
+            await records.save({ ...record, moved, refused: report.refused });
+        }
+    }
+    catch (err) {
+        console.warn(`[cadre-core/edge-node] could not update the strand move record of party ${fromPartyId}; the next start adopts it again:`, err);
+    }
+}
+/**
+ * Adopt every record naming the node's party, by left party. A record the key store refuses to
+ * read throws; an adoption that throws is logged and reported as deferred, and its record kept.
+ */
+export async function adoptMovesInto(node, records) {
+    const outcomes = new Map();
+    for (const record of await records.naming(node.partyId)) {
+        outcomes.set(record.bundle.partyId, await adoptOrDefer(node, records, record));
+    }
+    return outcomes;
+}
+async function adoptOrDefer(node, records, record) {
+    try {
+        const report = await adoptMoveRecord(node, records, record);
+        return { state: report.failed.length === 0 ? 'done' : 'partial', report };
+    }
+    catch (err) {
+        console.warn(`[cadre-core/edge-node] moving the strands of party ${record.bundle.partyId} failed; the next start retries:`, err);
+        return deferredOutcome(err);
+    }
+}
+export function deferredOutcome(err) {
+    if (err instanceof StrandMoveNotOwnerError)
+        return { state: 'deferred', reason: 'owner-key-not-wired' };
+    return { state: 'deferred', reason: 'adoption-failed', error: toError(err) };
+}
+/** A thrown value as an `Error`, for a status or outcome that carries one. */
+export function toError(err) {
+    return err instanceof Error ? err : new Error(String(err));
+}
+export function pendingMove(record) {
+    const settled = new Set([...record.moved, ...record.refused.map((entry) => entry.strandId)]);
+    return {
+        fromPartyId: record.bundle.partyId,
+        toPartyId: record.targetPartyId,
+        strandIds: record.bundle.strands.map((entry) => entry.row.Id).filter((strandId) => !settled.has(strandId)),
+        refused: record.refused,
+    };
+}
+/** The record in `text`, or `undefined` (logged) when it is not one. */
+function parseRecord(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        console.warn('[cadre-core/edge-node] a strand move record is not JSON:', err);
+        return undefined;
+    }
+    return isRecord(raw) ? raw : undefined;
+}
+/** The record's shape down to the bundle's lists; their entries are cadre-core's export, written by this module. */
+function isRecord(value) {
+    if (!isObject(value) || value.v !== RECORD_VERSION || typeof value.targetPartyId !== 'string')
+        return false;
+    if (!Array.isArray(value.moved) || !Array.isArray(value.refused))
+        return false;
+    const bundle = value.bundle;
+    return isObject(bundle)
+        && bundle.v === 1
+        && typeof bundle.partyId === 'string'
+        && Array.isArray(bundle.strands)
+        && Array.isArray(bundle.pendingJoins)
+        && Array.isArray(bundle.formationInvites);
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** "2 strands and 1 invitation": the bundle's non-empty lists. */
+function describeContent(bundle) {
+    const parts = [
+        count(bundle.strands.length, 'strand'),
+        count(bundle.pendingJoins.length, 'pending join'),
+        count(bundle.formationInvites.length, 'invitation'),
+    ].filter((part) => part !== null);
+    return parts.length > 1 ? `${parts.slice(0, -1).join(', ')} and ${parts[parts.length - 1]}` : parts.join('');
+}
+function count(n, noun) {
+    if (n === 0)
+        return null;
+    return `${n} ${noun}${n === 1 ? '' : 's'}`;
+}
+//# sourceMappingURL=strand-move.js.map

package/dist/edge-node/strand-move.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strand-move.js","sourceRoot":"","sources":["../../src/edge-node/strand-move.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAI/E,OAAO,EAAE,YAAY,EAAuB,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsBjG;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAKnD,YAAY,MAAoB,EAAE,SAAiB;QAClD,KAAK,CACJ,qBAAqB,SAAS,iBAAiB,eAAe,CAAC,MAAM,CAAC,aAAa,MAAM,CAAC,OAAO,GAAG;YACpG,kIAAkI,CAClI,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1C,CAAC;CACD;AAaD,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,wFAAwF;AACxF,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC;;;;GAIG;AACH,SAAS,MAAM,CAAC,WAAmB;IAClC,OAAO,WAAW,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;AACjG,CAAC;AAED,iIAAiI;AACjI,MAAM,OAAO,iBAAiB;IAC7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD;;;;;;;OAOG;IACH,IAAI,CAAC,MAAwB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,WAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC7B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjG,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,MAAM,EAAE,aAAa,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAAC,IAAW;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,6DAA6D,IAAI,gCAAgC,CAAC,CAAC;QAChH,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,+FAA+F;YAC/F,OAAO,CAAC,IAAI,CAAC,qEAAqE,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,UAA0B;IAC9E,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChH,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAe,EAAE,OAA0B,EAAE,MAAwB;IAC1G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAqB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAClG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAA0B,EAAE,MAAwB,EAAE,MAAwB;IAC3G,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAC1C,IAAI,CAAC;QACJ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACP,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,2EAA2E,WAAW,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAC9I,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,OAA0B;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAe,EAAE,OAA0B,EAAE,MAAwB;IAChG,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,sDAAsD,MAAM,CAAC,MAAM,CAAC,OAAO,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACjI,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAuB;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACxG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,GAAY;IACnC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAwB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QAClC,SAAS,EAAE,MAAM,CAAC,aAAa;QAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1G,OAAO,EAAE,MAAM,CAAC,OAAO;KACvB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,IAAY;IAChC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,GAAG,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,oHAAoH;AACpH,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,cAAc,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,OAAO,QAAQ,CAAC,MAAM,CAAC;WACnB,MAAM,CAAC,CAAC,KAAK,CAAC;WACd,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;WAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;WAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;WAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,kEAAkE;AAClE,SAAS,eAAe,CAAC,MAAoB;IAC5C,MAAM,KAAK,GAAG;QACb,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC;KACnD,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,IAAY;IACrC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC"}

package/dist/edge-node/strands.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Strand helpers every edge app needs around a running node, from sereus-chat's bring-up.
+ */
+import type { CadreNode } from '../cadre-node.js';
+import type { StrandConfig, StrandInstance } from '../types.js';
+/** Default patience for {@link attachStrandWhenWritable}: generous enough that running out means something is wrong. */
+export declare const DEFAULT_STRAND_PATIENCE_MS = 240000;
+/**
+ * `addStrand`, then keep waiting when the first sync outlasts its budget.
+ *
+ * `addStrand` rejects with `StrandAwaitingFirstSyncError` when the first sync has not finished,
+ * and leaves the strand launched and syncing: the timeout is a progress report, not an outcome.
+ * Measured on a link with a 1.8 s round trip, a first sync completed at about 150 s against a
+ * 120 s budget. So this waits for the strand to become writable, and rejects only when it has not
+ * within `patienceMs`.
+ */
+export declare function attachStrandWhenWritable(node: CadreNode, config: StrandConfig, options?: {
+    patienceMs?: number;
+}): Promise<StrandInstance>;
+/**
+ * Run a write, retrying only on the transient super-majority failure the first writes after a lone
+ * restart hit (v1.9 release notes): `attempts` tries, `delayMs` apart. Any other error, and the
+ * last attempt's, propagates.
+ */
+export declare function retryAfterRestart<T>(write: () => Promise<T>, options?: {
+    attempts?: number;
+    delayMs?: number;
+}): Promise<T>;