@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/membership-view.js

@@ -0,0 +1,110 @@
+/**
+ * An in-memory copy of one small control table's rows, kept until the table changes, so the
+ * membership, owner, peer-record and admission-chain reads that every flow repeats cost nothing
+ * after the first.
+ * `ControlDatabase` keeps one per cached table and drops it from its table-change subscription
+ * (`docs/architecture.md` → "Membership rows view"); this class holds only the caching rules, so
+ * they are testable without a database.
+ */
+/**
+ * How long installed rows are served before the next read reloads them, change or no change.
+ * The reload is the only path for a change that reaches this node with no storage event: a
+ * machine outside the block's cohort (a cadre larger than its replication breadth), or one in
+ * the cohort that the writer could not reach when it committed (one side of a NAT pair; the
+ * cohort auto-connect scenarios). Longer than Optimystic's read-repair window
+ * ({@link OPTIMYSTIC_READ_REPAIR_WINDOW_MS}), so the reload's storage read starts the cohort
+ * consult that brings such a change in instead of being served from the local copy, and
+ * shorter than any reconcile backstop (`DEFAULT_CONTROL_COHORT_RECONCILE_MS`, 2 minutes), so
+ * the backstop pass, the only reader on an idle party, reloads rather than serving kept rows.
+ * The reload rate on an idle party is therefore the pass rate, and the staleness bound for
+ * such a change is the backstop, not this value.
+ *
+ * A machine that was offline when a sibling committed is covered sooner than either:
+ * `CadreNode` drops every view when a sibling becomes reachable (its identify on a new
+ * connection; `ControlDatabase.invalidateMembershipViews`), so the pass that starts then reads
+ * storage.
+ */
+export const MEMBERSHIP_VIEW_MAX_AGE_MS = 15000;
+/**
+ * Optimystic's lazy read-repair window (`clusterPolicy.readRepairWindowMs`, which cadre does
+ * not set, so this is Optimystic's default): a read of a held block checked less than this
+ * long ago is served from the local copy without asking the cohort. A read after it is
+ * served locally too, but starts a cohort consult whose landing raises a table change.
+ *
+ * NOTE: a copy, since db-p2p exports no default for it. If cadre ever sets
+ * `readRepairWindowMs` in its cluster policy, derive this from that value.
+ */
+const OPTIMYSTIC_READ_REPAIR_WINDOW_MS = 10000;
+/**
+ * How long after a sibling becomes reachable (its identify on a new connection) `CadreNode`
+ * drops the views a second time: one read-repair window, plus a second for timer slop. The
+ * drop at the identify is not enough by itself. A node's reads before the sibling arrived
+ * (its start pass, with no cohort to ask) stamp the window, so the reload the identify
+ * starts is served from the local copy without a consult and the view would keep the
+ * pre-connection rows until {@link MEMBERSHIP_VIEW_MAX_AGE_MS}. The reload past the window
+ * starts the consults that bring in what the sibling committed while this node was away.
+ */
+export const MEMBERSHIP_VIEW_RECONNECT_RELOAD_MS = OPTIMYSTIC_READ_REPAIR_WINDOW_MS + 1000;
+export class MembershipView {
+    constructor(loader, options = {}) {
+        this.loader = loader;
+        /** When the load that produced {@link rows} started: the rows are no older than this. */
+        this.loadedAt = 0;
+        /** Bumped by every {@link invalidate}; a load installs only if it is unchanged since the load began. */
+        this.generation = 0;
+        /**
+         * The load each `retry` flag's callers share, current generation only. Separate per flag
+         * so a caller under the write lock never awaits a retrying load's backoff sleep.
+         */
+        this.inFlight = new Map();
+        this.maxAgeMs = options.maxAgeMs ?? MEMBERSHIP_VIEW_MAX_AGE_MS;
+        this.now = options.now ?? (() => performance.now());
+    }
+    /**
+     * The table's rows: the installed copy while it is younger than the maximum age, otherwise a
+     * load, shared with every caller of the same `retry` flag that arrives while it runs. A load
+     * that raced an {@link invalidate} answers its own callers with what it read, as an uncached
+     * read would have, and keeps nothing. A failed load keeps nothing and rejects.
+     */
+    read(retry) {
+        if (this.rows !== undefined && this.now() - this.loadedAt < this.maxAgeMs) {
+            return Promise.resolve(this.rows);
+        }
+        return this.inFlight.get(retry) ?? this.startLoad(retry);
+    }
+    /** Read the table without serving, joining or keeping anything. */
+    async readThrough(retry) {
+        return (await this.loader(retry)).rows;
+    }
+    /**
+     * Drop the installed rows and every load in flight, so the next read loads afresh and no
+     * earlier load installs. Synchronous and flag-setting only: the table-change handler calls
+     * it inside the committing call.
+     */
+    invalidate() {
+        this.generation++;
+        this.rows = undefined;
+        this.inFlight.clear();
+    }
+    startLoad(retry) {
+        const load = this.load(retry, this.generation, this.now());
+        this.inFlight.set(retry, load);
+        const forget = () => {
+            if (this.inFlight.get(retry) === load) {
+                this.inFlight.delete(retry);
+            }
+        };
+        // Both arms handled, so a failed load rejects only for the callers awaiting it.
+        void load.then(forget, forget);
+        return load;
+    }
+    async load(retry, generation, startedAt) {
+        const { rows, installable } = await this.loader(retry);
+        if (installable && generation === this.generation) {
+            this.rows = rows;
+            this.loadedAt = startedAt;
+        }
+        return rows;
+    }
+}
+//# sourceMappingURL=membership-view.js.map

package/dist/membership-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-view.js","sourceRoot":"","sources":["../src/membership-view.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAM,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,gCAAgC,GAAG,KAAM,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,gCAAgC,GAAG,IAAK,CAAC;AA0B5F,MAAM,OAAO,cAAc;IAc1B,YAA6B,MAAiC,EAAE,UAAiC,EAAE;QAAtE,WAAM,GAAN,MAAM,CAA2B;QAZ9D,yFAAyF;QACjF,aAAQ,GAAG,CAAC,CAAC;QACrB,wGAAwG;QAChG,eAAU,GAAG,CAAC,CAAC;QACvB;;;WAGG;QACc,aAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;QAKvE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,0BAA0B,CAAC;QAC/D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,KAAc;QAClB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3E,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,WAAW,CAAC,KAAc;QAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,UAAU;QACT,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,SAAS,CAAC,KAAc;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAS,EAAE;YACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC,CAAC;QACF,gFAAgF;QAChF,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAc,EAAE,UAAkB,EAAE,SAAiB;QACvE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,WAAW,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/owner-anchor-sync.d.ts

@@ -1,5 +1,5 @@
 import type { TrustSource } from './trusted-owner-store.js';
-import type { InvitationChain, OwnerKeyRow, RevocationRow } from './types.js';
+import type { OwnerGrantChain, OwnerKeyRow, RevocationRow } from './types.js';
 export interface OwnerAnchorInputs {
     /** The party whose table is being read; every stored proof is judged for it, so a voucher or tombstone signed for another party neither seats nor removes a key. */
     partyId: string;
@@ -9,8 +9,8 @@ export interface OwnerAnchorInputs {
     rows: readonly OwnerKeyRow[];
     /** `Revocation` rows; only those with `tableName === 'OwnerKey'` are consulted. */
     tombstones: readonly RevocationRow[];
-    /** The usage and invitation rows, when some owner row is invitation-admitted; null skips those rows. */
-    chain: InvitationChain | null;
+    /** The usage and grant rows, when some owner row is grant-seated; null when none is, which skips every consent-seated row. */
+    grantChain: OwnerGrantChain | null;
 }
 export interface OwnerAnchorDerivation {
     /** The keys the anchor should hold after this pass. */
@@ -19,4 +19,4 @@ export interface OwnerAnchorDerivation {
     refusedRemovals: readonly string[];
 }
 /** The rule above, as one pure function. */
-export declare function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, chain }: OwnerAnchorInputs): OwnerAnchorDerivation;
+export declare function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, grantChain }: OwnerAnchorInputs): OwnerAnchorDerivation;

package/dist/owner-anchor-sync.js

@@ -1,7 +1,7 @@
 /**
  * How the node-local trusted-owner anchor follows the replicated `OwnerKey` table along
  * VERIFIABLE chains — the pure rule, with no I/O, so it can be tested without a database.
- * `CadreNode.syncOwnerAnchor` reads the table, the tombstones and the invitation chain,
+ * `CadreNode.syncOwnerAnchor` reads the table, the tombstones and the owner-grant chain,
  * calls {@link deriveOwnerAnchor}, and applies the difference to the store.
  *
  * Why not simply trust the table: an empty local copy can seat any key through the
@@ -19,9 +19,10 @@
  *   retired, although nothing could re-derive it from the remaining base.
  * - **derivable from S**: a live row whose stored proof verifies against S — owner-signed
  *   (`vouchSig` set): `vouchOwner` is in S and `verifyOwnerKeyVoucher` holds;
- *   invitation-admitted (`vouchSig` null, `vouchUsage` set): `verifyInvitationOwnerAdmission`
- *   holds with S as the anchor. The founding row (all three null) is never derivable:
- *   founders enter anchors only out of band.
+ *   grant-seated (`vouchSig` null, `vouchUsage` naming an `OwnerGrantUsage` row):
+ *   `verifyOwnerGrantAdmission` holds with S as the anchor. The founding row (all three null)
+ *   is never derivable: founders enter anchors only out of band. A machine invitation admits a
+ *   machine and never seats an owner row, so no `CadreInviteUsage` row is read here.
  * - **derived**: the least fixpoint from base ∪ kept — add every key whose live row is
  *   derivable from what is already in the set, until nothing changes. **chainDerived** is the
  *   keys whose live row was derivable in this pass, base keys included.
@@ -45,9 +46,9 @@
  * two cannot be told apart from replicated state; keeping is the only rule under which a
  * sole owner can rotate at all.
  */
-import { verifyInvitationOwnerAdmission, verifyOwnerKeyVoucher, verifyRevocationSigner } from './peer-authorization.js';
+import { verifyOwnerGrantAdmission, verifyOwnerKeyVoucher, verifyRevocationSigner } from './peer-authorization.js';
 /** The rule above, as one pure function. */
-export function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, chain }) {
+export function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, grantChain }) {
     const ownerTombstones = tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey');
     // NOTE: a stamp is retired by any tombstone that names it, verified or not — the same
     // reading `queryCadrePeers` and `getOwnerKeys` give the table. A forged tombstone can
@@ -56,7 +57,7 @@ export function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, chain })
     const retired = new Set(ownerTombstones.map(tombstone => tombstone.stampId));
     const liveRows = rows.filter(row => !retired.has(row.stampId));
     const derived = passStartSet(anchor, liveRows);
-    const chainDerived = deriveFixpoint(partyId, derived, liveRows, chain);
+    const chainDerived = deriveFixpoint(partyId, derived, liveRows, grantChain);
     const removed = removedKeys(partyId, derived, chainDerived, ownerTombstones);
     if (removed.size > 0 && removed.size === derived.size) {
         return { target: derived, refusedRemovals: Array.from(removed) };
@@ -81,7 +82,7 @@ function passStartSet(anchor, liveRows) {
  * trust only grows within a pass, and a proof that failed against a trusted voucher cannot
  * pass later, so no row is verified twice.
  */
-function deriveFixpoint(partyId, derived, liveRows, chain) {
+function deriveFixpoint(partyId, derived, liveRows, grantChain) {
     const chainDerived = new Set();
     const pending = new Set(liveRows);
     let progress = true;
@@ -92,7 +93,7 @@ function deriveFixpoint(partyId, derived, liveRows, chain) {
                 continue;
             }
             pending.delete(row);
-            if (proofVerifies(partyId, row, derived, chain)) {
+            if (proofVerifies(partyId, row, derived, grantChain)) {
                 chainDerived.add(row.key);
                 derived.add(row.key);
                 progress = true;
@@ -102,22 +103,22 @@ function deriveFixpoint(partyId, derived, liveRows, chain) {
     return chainDerived;
 }
 /** Does `row`'s stored proof verify against `trusted`, for `partyId`, by the kind of proof it carries (see the module doc)? */
-function proofVerifies(partyId, row, trusted, chain) {
+function proofVerifies(partyId, row, trusted, grantChain) {
     if (row.vouchOwner === null) {
         return false;
     }
     if (row.vouchSig !== null) {
-        return verifyOwnerKeyVoucher(partyId, row.key, row.stampId, row.vouchOwner, row.vouchSig);
+        return verifyOwnerKeyVoucher(partyId, row.key, row.label, row.stampId, row.vouchOwner, row.vouchSig);
     }
     if (row.vouchUsage === null) {
         return false;
     }
-    const usage = chain?.usages.get(row.vouchUsage);
-    const invite = usage === undefined ? undefined : chain?.invites.get(usage.inviteKey);
-    if (usage === undefined || invite === undefined) {
+    const grantUsage = grantChain?.usages.get(row.vouchUsage);
+    const grant = grantUsage === undefined ? undefined : grantChain?.grants.get(grantUsage.grantKey);
+    if (grantUsage === undefined || grant === undefined) {
         return false;
     }
-    return verifyInvitationOwnerAdmission(partyId, row, usage, invite, key => trusted.has(key));
+    return verifyOwnerGrantAdmission(partyId, row, grantUsage, grant, (key) => trusted.has(key));
 }
 /**
  * The keys of `derived` that a verifiable tombstone removes (see the module doc), every

package/dist/owner-anchor-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-anchor-sync.js","sourceRoot":"","sources":["../src/owner-anchor-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAwBxH,4CAA4C;AAC5C,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAqB;IAChG,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC;IAC3F,sFAAsF;IACtF,sFAAsF;IACtF,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,MAAwC,EAAE,QAAgC;IAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,OAAoB,EAAE,QAAgC,EAAE,KAA6B;IAC7H,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,OAAO,QAAQ,EAAE,CAAC;QACjB,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,+HAA+H;AAC/H,SAAS,aAAa,CAAC,OAAe,EAAE,GAAgB,EAAE,OAA4B,EAAE,KAA6B;IACpH,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,8BAA8B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,OAA4B,EAAE,YAAiC,EAAE,eAAyC;IAC/I,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,SAAS;QACV,CAAC;QACD,IAAI,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"owner-anchor-sync.js","sourceRoot":"","sources":["../src/owner-anchor-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAwBnH,4CAA4C;AAC5C,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAqB;IACrG,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC;IAC3F,sFAAsF;IACtF,sFAAsF;IACtF,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,MAAwC,EAAE,QAAgC;IAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,OAAoB,EAAE,QAAgC,EAAE,UAAkC;IAClI,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,OAAO,QAAQ,EAAE,CAAC;QACjB,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBACtD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,+HAA+H;AAC/H,SAAS,aAAa,CAAC,OAAe,EAAE,GAAgB,EAAE,OAA4B,EAAE,UAAkC;IACzH,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjG,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,OAA4B,EAAE,YAAiC,EAAE,eAAyC;IAC/I,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,SAAS;QACV,CAAC;QACD,IAAI,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/owner-grant-protocol.d.ts

@@ -0,0 +1,251 @@
+/**
+ * Owner grant redemption transport: `/sereus/owner-grant/1.0.0`.
+ *
+ * A holder of an owner grant (an owner-signed `OwnerGrant` row plus the private half of the
+ * grant keypair, see {@link OwnerGrantBundle}) dials ANY member machine the grant names and
+ * proves possession of the grant and of the key it wants seated; the member seats the row if
+ * it does not hold it yet and writes the holder's `OwnerKey` row through
+ * `ControlDatabase.redeemOwnerGrant`. No machine is admitted and no peer id is named: the
+ * holder's network identity has nothing to do with the key it seats, so unlike the invitation
+ * protocol there is no connecting-identity check — both signatures already bind the grant, the
+ * nonce and the key. The owner that minted the grant need not be online.
+ *
+ * The exchange shape — one frame each way, the member's hardening and admission of the
+ * holder, the holder's address-by-address dialing in passes — is `member-redemption.ts`'s,
+ * shared with the invitation protocol; this module supplies the grant's bundle, request,
+ * checks, writes and refusal codes. Stranger-facing by design, classed `stranger-open` in
+ * `control-protocol-guard.ts`; the handler's own trust decision is the two signatures.
+ */
+import type { Libp2p } from '@libp2p/interface';
+import { type ControlDatabase } from './control-database.js';
+import { MemberRedemptionHandler, type MemberRedemption, type MemberRedemptionHandlerOptions, type RedemptionAddressOutcome, type RedemptionRejection } from './member-redemption.js';
+import type { OwnerSign } from './owner-signer.js';
+import type { CadreJoinProgress, OwnerGrantRow } from './types.js';
+/** Protocol id for owner grant redemption (parallel to `/sereus/cadre-invite/1.0.0`). */
+export declare const OWNER_GRANT_PROTOCOL = "/sereus/owner-grant/1.0.0";
+/**
+ * What an owner hands out (QR, paste, file) and a holder redeems. A grant is an ed25519
+ * keypair: the row holds the public half, `grantPrivateKey` is the proof of possession, and
+ * whoever holds this bundle can become an owner of the party — a bearer credential for admin
+ * rights for the row's lifetime (15 minutes by default; a backup grant has no expiry and is
+ * kept as carefully as an owner key).
+ *
+ * Carrying the signed row is what makes redemption work at a member that has not received
+ * the row by replication: the member seats it from the bundle under its stored issuer
+ * signature. The row's own signature covers every column, so a bundle whose row was altered
+ * cannot be seated anywhere. `members` are the party's addresses at mint time, so a backup
+ * grant can go stale if every member's address changes.
+ */
+export interface OwnerGrantBundle {
+    v: 1;
+    /** The cadre the grant makes an owner of; a holder refuses one for another party. */
+    partyId: string;
+    /** The grant's ed25519 seed, base64url: the proof of possession. */
+    grantPrivateKey: string;
+    /** The owner-signed row exactly as issued (`ControlDatabase.insertOwnerGrant`). */
+    grant: OwnerGrantRow;
+    /**
+     * The issuer's anchored owner keys. The holder pins them before it dials
+     * (`CadreNode.trustOwnerKeys`) and checks the member's reply against them. Sourced from the
+     * issuer's node-local anchor only, never the replicated `OwnerKey` table, for the reason the
+     * invitation gives: the holder anchors whatever arrives here.
+     */
+    ownerKeys: string[];
+    /** As `CadreInvitation.members`: multiaddrs ending in `/p2p/<peerId>`, the issuer's first, at most six in all. */
+    members: string[];
+}
+/**
+ * Encode a bundle for out-of-band delivery: {@link OWNER_GRANT_PREFIX}, then base64url over
+ * JSON. The prefix lets an app tell a grant from an invitation, a join request or an owner key
+ * and name the mistake when one is pasted for the other.
+ */
+export declare function encodeOwnerGrant(bundle: OwnerGrantBundle): string;
+/**
+ * Decode a bundle, refusing anything that is not a well-formed version-1
+ * {@link OwnerGrantBundle} behind {@link OWNER_GRANT_PREFIX}. Standalone, like
+ * `decodeCadreInvitation`, so a client without a node can decode one.
+ *
+ * @throws on an owner key, a cadre invitation or a join request, a string without the prefix
+ *   or that is not base64url JSON after it, or one that decodes to another shape or version.
+ */
+export declare function decodeOwnerGrant(encoded: string): OwnerGrantBundle;
+/** Is `value` an {@link OwnerGrantRow} with every column in its stored form and bounded? */
+export declare function isWellFormedOwnerGrantRow(value: unknown): value is OwnerGrantRow;
+/** Holder → member: one frame, the whole redemption. */
+export interface OwnerGrantRedeemRequest {
+    v: 1;
+    /** The cadre the holder believes it is becoming an owner of; a machine serving another party refuses by name. */
+    partyId: string;
+    /** The owner-signed row from the bundle. */
+    grant: OwnerGrantRow;
+    /** The ed25519 public key to seat as an owner, base64url: the holder's, fresh or already held. */
+    ownerKey: string;
+    /** Single-use nonce the holder minted (`generateStampId`); both signatures cover it. */
+    usageStampId: string;
+    /** By `grantPrivateKey` over the `'redeem'` digest. */
+    grantSig: string;
+    /** By `ownerKey` over the `'consent'` digest. */
+    ownerSig: string;
+}
+/**
+ * Why a member refused a redemption: the invitation's codes with grant wording. Retryability
+ * is {@link OWNER_GRANT_REJECTION_RETRYABLE}'s; a retryable code moves the holder to the next
+ * address the bundle names.
+ */
+export type OwnerGrantRejectionCode = 
+/** The issuer's `OwnerKey` row is not on this member (not replicated yet), or the issuer was removed; the member cannot tell which. */
+'issuer-unknown'
+/** A signature does not verify, or the request or the row is malformed. */
+ | 'grant-invalid'
+/** Expired, withdrawn, exhausted, or issued by a key that is no longer an owner here. */
+ | 'grant-spent'
+/** This machine serves another cadre than the one the grant names. */
+ | 'party-mismatch'
+/** The member is at its cap on concurrent redemptions. */
+ | 'busy'
+/** The write failed transiently (the write retry gave up), or the member has not synced the grant row the cadre holds; nothing was recorded. */
+ | 'conflict'
+/** An unexpected member-side failure, or a request frame the member could not read: nothing was proved either way. */
+ | 'internal';
+/** Which refusals are worth repeating at the next address — the one place that says so. */
+export declare const OWNER_GRANT_REJECTION_RETRYABLE: Readonly<Record<OwnerGrantRejectionCode, boolean>>;
+/** Is `value` a code this build knows? Own keys only, so a peer's `'constructor'` does not pass. */
+export declare function isOwnerGrantRejectionCode(value: unknown): value is OwnerGrantRejectionCode;
+/** Member → holder. No dial hints: the holder is not joining the cadre's network, only seating a key. */
+export interface OwnerGrantRedeemReply {
+    accepted: boolean;
+    /** Present iff `!accepted`. */
+    code?: OwnerGrantRejectionCode;
+    /** Human-facing text; present iff `!accepted`. */
+    reason?: string;
+    /** The member's party id; present iff `accepted`. */
+    partyId?: string;
+    /** The grant row as this member holds it; present iff `accepted`. */
+    grant?: OwnerGrantRow;
+    /** The key was already a live owner here, so nothing was written and no use was spent; present iff `accepted`. */
+    alreadyOwner?: boolean;
+}
+/** An accepting reply, every optional field present. */
+export interface OwnerGrantAccepted extends OwnerGrantRedeemReply {
+    accepted: true;
+    partyId: string;
+    grant: OwnerGrantRow;
+    alreadyOwner: boolean;
+}
+type OwnerGrantRejection = RedemptionRejection<OwnerGrantRejectionCode>;
+/**
+ * A member answered and refused (on `CadreNode.redeemOwnerGrant`'s local path, the member is
+ * this node). `code` is `'unrecognized'` when the frame carried none this build knows, and such
+ * a refusal counts as retryable, as the invitation's does.
+ */
+export declare class OwnerGrantRejectedError extends Error {
+    readonly code: OwnerGrantRejectionCode | 'unrecognized';
+    readonly reason: string;
+    readonly retryable: boolean;
+    /** Both arguments come straight off the wire, so neither is trusted to have its declared type. */
+    constructor(code: unknown, reason: unknown);
+}
+/** Every address the bundle names was tried and none accepted. Always retryable; `outcomes` says what each address did. */
+export declare class OwnerGrantUnreachableError extends Error {
+    readonly outcomes: readonly RedemptionAddressOutcome[];
+    readonly retryable = true;
+    constructor(outcomes: readonly RedemptionAddressOutcome[]);
+}
+/**
+ * A member accepted but its reply does not check out: another party id, another grant key, or
+ * a row not signed by one of the pinned owner keys. Final, for the invitation's reason: such a
+ * machine is not a member of the cadre the grant names.
+ */
+export declare class OwnerGrantReplyInvalidError extends Error {
+    readonly retryable = false;
+    constructor(message: string);
+}
+/**
+ * Build and sign the request for `bundle`: the holder's `'redeem'` signature with the grant's
+ * private key (held in memory for the length of this call) and the seated key's `'consent'`
+ * signature through `signConsent`, the `sign` of an open owner approval on the signer that
+ * holds `ownerKey`; both over (grant key, `usageStampId`, `ownerKey`) for the grant's party. The
+ * same bytes the schema verifies at the member (`ownerGrantRedeemMessage` /
+ * `ownerGrantConsentMessage`), and the same request goes to every member and every pass.
+ */
+export declare function signOwnerGrantRequest(bundle: OwnerGrantBundle, ownerKey: string, signConsent: OwnerSign, usageStampId: string): Promise<OwnerGrantRedeemRequest>;
+/**
+ * The holder's check on an acceptance: the same party, the same grant key, and a row signed by
+ * an issuer the holder pinned from the bundle. Throws {@link OwnerGrantReplyInvalidError} naming
+ * the first failure. Bounded as `verifyRedeemReply` is: it catches a wrong-party or wrong-row
+ * answer, not a forged member, which the holder's anchor settles once its store syncs.
+ */
+export declare function verifyOwnerGrantReply(reply: OwnerGrantAccepted, bundle: OwnerGrantBundle, isTrustedIssuer: (ownerKey: string) => boolean): void;
+/** The control-database surface a redemption needs; a `ControlDatabase` satisfies it. */
+export type OwnerGrantStore = Pick<ControlDatabase, 'queryOwnerGrant' | 'seatOwnerGrant' | 'isOwnerGrantLive' | 'redeemOwnerGrant'>;
+export interface OwnerGrantHandlerOptions extends MemberRedemptionHandlerOptions {
+    store: OwnerGrantStore;
+}
+/**
+ * Member side of the grant protocol (`MemberRedemptionHandler` has the shape): after the
+ * request's shape, it checks the party and both signatures — nothing about the connecting
+ * peer, whose identity is unrelated to the key it seats — then seats the row from the bundle
+ * when this member holds none and redeems. An issuer this member does not know as an owner is
+ * the one retryable refusal left: the holder tries the next address, which may hold the
+ * issuer's row.
+ */
+export declare class OwnerGrantHandler extends MemberRedemptionHandler<OwnerGrantRedeemRequest, OwnerGrantRedeemReply, OwnerGrantRow> {
+    private readonly store;
+    protected readonly busyRefusal: RedemptionRejection<"busy">;
+    protected readonly internalRefusal: RedemptionRejection<"internal">;
+    protected readonly malformedRefusal: RedemptionRejection<"grant-invalid">;
+    constructor(options: OwnerGrantHandlerOptions);
+    protected isWellFormedRequest(value: unknown): value is OwnerGrantRedeemRequest;
+    protected checkRequest(request: OwnerGrantRedeemRequest): OwnerGrantRejection | null;
+    protected readHeld(request: OwnerGrantRedeemRequest): Promise<OwnerGrantRow | null>;
+    protected isLive(request: OwnerGrantRedeemRequest, held: OwnerGrantRow | null): Promise<boolean>;
+    /** The two writes — the seat only when this member holds no row, and the redemption, carrying the held row — as `CadreInviteHandler.redeemAdmitted`. */
+    protected redeemAdmitted(request: OwnerGrantRedeemRequest, remotePeerId: string, held: OwnerGrantRow | null): Promise<OwnerGrantRedeemReply>;
+    /** Seat the bundle's copy of the row; a refusal answered by name, or null once it is held. */
+    private seat;
+}
+export interface RedeemOwnerGrantAtMembersOptions {
+    /** The bundle: its `members` are dialed in order. */
+    bundle: OwnerGrantBundle;
+    /** The signed request ({@link signOwnerGrantRequest}); the same one goes to every address. */
+    request: OwnerGrantRedeemRequest;
+    /** Is this owner key one the holder pinned from the bundle? The reply check's input. */
+    isTrustedIssuer: (ownerKey: string) => boolean;
+    /** See `MemberRedemptionOptions.linkRoundTripMs`. */
+    linkRoundTripMs?: number;
+    /** Per-address deadline override; default derived from `linkRoundTripMs`. */
+    addressBudgetMs?: number;
+    protocolId?: string;
+    /** Cancels the dial or stream in flight and ends the pass; the call throws the signal's reason. */
+    signal?: AbortSignal;
+}
+/** What a successful redemption yields the holder. */
+export type OwnerGrantRedemption = MemberRedemption<OwnerGrantAccepted>;
+/**
+ * Holder side: try the bundle's addresses one at a time and stop at the first acceptance or
+ * the first final refusal (`dialRedemption` in `member-redemption.ts`). Every address gets the
+ * SAME request, with one `usageStampId`: `OwnerGrantUsage` is keyed by it, so a member the
+ * holder gave up on that was still committing cannot spend a second use, and a retry after a
+ * dropped reply is answered `alreadyOwner`.
+ *
+ * @throws {OwnerGrantRejectedError} on a final refusal (its `retryable` is false).
+ * @throws {OwnerGrantReplyInvalidError} on an acceptance that fails {@link verifyOwnerGrantReply}.
+ * @throws {OwnerGrantUnreachableError} when every address was tried and none accepted.
+ * @throws the reason of `options.signal` once it aborts.
+ */
+export declare function redeemOwnerGrantAtMembers(node: Libp2p, options: RedeemOwnerGrantAtMembersOptions): Promise<OwnerGrantRedemption>;
+export interface RedeemOwnerGrantInPassesOptions extends RedeemOwnerGrantAtMembersOptions {
+    /** Keep making passes while every answer is retryable; false makes exactly one. */
+    waitForMember: boolean;
+    /** Called at each pass and each pause; an exception it throws is logged and ignored. */
+    onProgress?: (progress: CadreJoinProgress) => void;
+}
+/**
+ * Holder side, in passes (`dialRedemptionInPasses` in `member-redemption.ts`): one
+ * {@link redeemOwnerGrantAtMembers} pass, or, with `waitForMember`, as many as it takes,
+ * pausing between them and never past the grant's expiry, which by this holder's clock is
+ * thrown as the `grant-spent` refusal a member would give. A backup grant has no expiry, so a
+ * wait on one ends only by acceptance, a final refusal, the signal or the node stopping.
+ */
+export declare function redeemOwnerGrantInPasses(node: Libp2p, options: RedeemOwnerGrantInPassesOptions): Promise<OwnerGrantRedemption>;
+export {};