@serfab/cadre-core 1.16.0 → 1.18.0

package/src/index.ts

@@ -1,789 +1,899 @@
-// Core types
-export * from './types.js';
-
-// Canonical JSON serialization (shared signing payload format)
-export { canonicalJson } from './canonical-json.js';
-
-// Main CadreNode class
-export { CadreNode, OWNER_INVITATION_DEFAULT_TTL_MS, CADRE_INVITATION_DEFAULT_TTL_MS } from './cadre-node.js';
-
-// Removing a machine from a cadre: the by-name refusal `CadreNode.removeMachine` throws
-// (the listing, plan and result types are in types.ts)
-export { MachineRemovalRefusedError } from './machine-removal.js';
-
-// Control database
-export { ControlDatabase, parseNullableStoredDatetimeMs, MissingHostStrandError, InvitationExhaustedError, CadreInviteIssuerUnknownError, buildAuthorizationMessage, registerPartyIdFunction, formationVouchMessage, formationConsentMessage, cadreInviteAddMessage, cadreInviteRedeemMessage, cadreInviteConsentMessage, projectSeedPeers, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type FormationInviteRow, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef, type MachineRemovalWrites } from './control-database.js';
-
-// Bounded retry for transient control-write failures (classifier + loop behind
-// ControlDatabase.lockedWithRetry; exported so the integration package can drive the
-// classifier against real engine errors)
-export {
-  CONTROL_WRITE_ATTEMPTS,
-  CONTROL_WRITE_RETRY_BUDGET_MS,
-  SCHEMA_INIT_ATTEMPTS,
-  SCHEMA_INIT_RETRY_POLICY,
-  isRetriableControlWriteFailure,
-  isRetriableSchemaInitFailure,
-  retryControlWrite,
-  type ControlWriteRetryOptions
-} from './control-write-retry.js';
-
-// Bounded retry for transient control-read failures (classifier + policy behind
-// ControlDatabase.readRows; the loop is shared with the write side via control-retry.ts)
-export {
-  CONTROL_READ_ATTEMPTS,
-  CONTROL_READ_RETRY_DELAYS_MS,
-  CONTROL_READ_RETRY_BUDGET_MS,
-  isRetriableControlReadFailure,
-  retryControlRead,
-  type ControlReadRetryOptions
-} from './control-read-retry.js';
-
-// The bounded retry loop both control policies share. Only the abandonment record leaves
-// this package: it is the payload of the `control:write-abandoned` node event, so an
-// embedding app can type a handler for it.
-export type {
-  ControlRetryAbandonment,
-  ControlRetryAbandonReason,
-  ControlRetryAbandonListener
-} from './control-retry.js';
-
-// Control-plane authorization field vector (the domain/action tagging every signer shares)
-export { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, type ControlDomain, type BoundControlDomain, type UnboundControlDomain, type ControlAction, type CadreInviteSignedFields } from './control-authorization.js';
-
-// Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
-export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
-
-// Pluggable key store (backend-agnostic identity/owner key material seam).
-// Dependency-free: the interface, error, default slot id, and in-memory backend
-// are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
-// separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
-// import never lands here.
-export {
-  InMemoryKeyStore,
-  KeyStoreAccessError,
-  DEFAULT_IDENTITY_KEY_ID,
-  type KeyStore,
-  type KeyId
-} from './key-store.js';
-
-// The filename-safe form of an id that every Node-only per-party file store names its file
-// with (`<name>.<encoded party>.json`), for an embedder keeping its own file beside theirs.
-export { encodeFileSafeComponent } from './file-safe-name.js';
-
-// The KeyStore-backed identity rule, shared with embedding apps that need the
-// node key BEFORE `CadreNode` exists.
-export { loadOrCreateIdentityKey } from './identity-key.js';
-
-// Node-local trusted-owner anchor: the NON-replicated, per-party record of
-// out-of-band-established owner keys (the trust anchor the replicated OwnerKey
-// table cannot be). Cross-platform: interface + in-memory store only — the
-// file-backed store is the Node-only subpath
-// '@serfab/cadre-core/trusted-owner-store-file' (same isolation as
-// key-store-file) so node:fs never lands in this graph.
-export {
-  MemoryTrustedOwnerStore,
-  PersistentTrustedOwnerStore,
-  type TrustedOwnerStore,
-  type TrustSource
-} from './trusted-owner-store.js';
-
-// The one platform-specific piece of a persistent node-local store: a single
-// durable text slot the embedding app supplies (IndexedDB / SecureStore /
-// SQLite / a file). Everything else — envelope, load policy, snapshot write
-// chain — is cross-platform in node-local-snapshot.ts.
-export type { DurableSlot } from './node-local-snapshot.js';
-
-// Node-local cold-start bootstrap-peer store: the dial targets retained from an
-// applied seed so a node that could not connect on its first try keeps retrying
-// across restarts. Same cross-platform split as the trusted-owner anchor above —
-// interface + in-memory store here, Node-only file backend behind the subpath
-// '@serfab/cadre-core/bootstrap-peer-store-file'.
-export {
-  MemoryBootstrapPeerStore,
-  PersistentBootstrapPeerStore,
-  type BootstrapPeerStore,
-  type BootstrapPeerEntry
-} from './bootstrap-peer-store.js';
-
-// Node-local enrolled-machine count: the machines this party had enrolled the
-// last time this node looked, remembered across restarts so the CONTROL node can
-// declare a block-repair yardstick at bring-up — which is before the database
-// holding the membership rows exists. Same cross-platform split as the two
-// records above; Node-only file backend behind the subpath
-// '@serfab/cadre-core/enrolled-machine-store-file'. Its load policy deliberately
-// DIVERGES from theirs (an unreadable slot cold-starts rather than throwing) —
-// see the module comment before unifying the three.
-export {
-  MemoryEnrolledMachineStore,
-  PersistentEnrolledMachineStore,
-  type EnrolledMachineStore
-} from './enrolled-machine-store.js';
-
-// Node-local record of the strands this node joined from ANOTHER party and has not yet
-// published party-wide, re-offered on every start as `strand:discovered`.
-// Cross-platform: its durable form rides the KeyStore seam above (the record carries a
-// closed strand's read secret), so there is no file-backed subpath.
-export {
-  MemoryJoinedStrandStore,
-  KeyStoreJoinedStrandStore,
-  type JoinedStrandStore,
-  type JoinedStrandRecord
-} from './joined-strand-store.js';
-
-// Node-local strand network state: per strand, the state Optimystic's db-p2p saves for
-// the strand node (its FRET routing table with each peer's signed address record), so a
-// restarted strand node re-imports the peers it was talking to. Same cross-platform
-// split as the bootstrap-peer store above — interface + in-memory + slot-backed stores
-// here, Node-only file backend behind '@serfab/cadre-core/strand-network-state-file'.
-export {
-  MemoryStrandNetworkStateStore,
-  PersistentStrandNetworkStateStore,
-  strandNetworkStatePersistence,
-  type StrandNetworkStateStore
-} from './strand-network-state.js';
-// The signed address records a running strand node's FRET table holds, as per-peer dial
-// addresses: what the periodic refresh re-merges into the node's address book, and a
-// diagnostic for "whom could this strand node redial right now?".
-export { strandFretPeerAddrs, type FretAddrHost, type FretPeerAddrs } from './strand-fret-addrs.js';
-
-// Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
-// strand's key is its strand id; the control database's key carries the party id,
-// so two parties on one device never share a control store. Every key stays within
-// `[a-z0-9._-]` — lowercase, so distinct keys stay distinct on a case-insensitive
-// filesystem: the control key by lowercase hex encoding, a strand's by
-// `assertStrandScopeKey`, which every strand launch runs.
-export {
-  controlStorageScope,
-  isControlStorageScope,
-  isValidStrandScopeKey,
-  assertStrandScopeKey,
-  InvalidStrandIdError
-} from './storage-scope.js';
-
-// Strand database
-export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
-export type { StrandCommitDurability, StrandCommitHeld } from './strand-commit-durability.js';
-
-// Strand management
-export {
-  StrandWatcher,
-  type StrandWatcherCallbacks,
-  type StrandQueryable,
-  type SAppIdLookup,
-  type StrandRowWithApp
-} from './strand-watcher.js';
-export {
-  StrandInstanceManager,
-  type StartStrandConfig,
-  type ResumeStrandOverrides,
-  getStrandStoragePath,
-  isAwaitingFirstSync,
-  liveStrandStatus
-} from './strand-instance-manager.js';
-
-// The joining machine's first-sync write gate: a non-founder launch withholds its
-// database (status 'syncing') until the strand's Header has arrived from a peer, so a
-// write before the first sync can never fork the strand's tables.
-export {
-  StrandAwaitingFirstSyncError,
-  DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS,
-  DEFAULT_STRAND_FIRST_SYNC_POLL_MS,
-  strandHeaderHeld,
-  appTablesReadable,
-  strandFirstSyncComplete,
-  type StrandFirstSyncConfig
-} from './strand-first-sync-gate.js';
-
-// Peer-join block catch-up (push this network's own blocks to each newly
-// connected peer, so a late joiner physically holds pre-join blocks). Shared
-// by the strand networks (ungated) and the control network (membership-gated).
-export {
-  PeerJoinBackfill,
-  DEFAULT_PEER_JOIN_BACKFILL,
-  MAX_BLOCK_MESSAGE_BYTES,
-  PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES,
-  type PeerJoinBackfillConfig,
-  type PeerJoinBackfillDeps,
-  type PeerJoinBackfillResult,
-  type PeerJoinBackfillPushClient
-} from './peer-join-backfill.js';
-
-// Operator opt-in to Optimystic change notifications on chosen strand nodes
-// (`CadreNodeConfig.strandReactivity`).
-export { strandCohortTopicOption, type StrandReactivityConfig } from './strand-reactivity.js';
-
-// Closed-strand revoked-peer enforcement (deny the network nodes of removed
-// members at the stream and connection layers, and hang up the sessions they
-// already hold — see the module doc for the settled deny-list design, the
-// teardown seam, and the fail directions).
-export {
-  StrandRevocationEnforcer,
-  createRevocationConnectionGater,
-  readStrandRevocationRows,
-  DEFAULT_REVOCATION_POLL_INTERVAL_MS,
-  type StrandRevocationEnforcementConfig,
-  type StrandRevocationEnforcerDeps,
-  type StrandRevocationRows,
-  type StrandMemberPeerBinding,
-  type StrandRevocationJudge,
-  type StrandRevocationNetwork,
-  type RevocationRefreshScheduler
-} from './strand-revocation-enforcer.js';
-
-// Closed-strand membership reconciliation: the bring-up loop that finishes a
-// party's join on every machine — redeem the staged formation invitation, then
-// write the durable machine→party MemberPeer binding — without ever blocking
-// bring-up (see the module doc for the pass ladder and terminal states).
-export {
-  StrandMembershipReconciler,
-  IDLE_PASSES_BEFORE_ESCALATION,
-  INITIAL_JOIN_RETRY_INTERVAL_MS,
-  type StrandMembershipReconcilerDeps,
-  type StrandMembershipReconciliationConfig,
-  type PendingMembershipInviteSource
-} from './strand-membership-reconciler.js';
-
-// The timer seam the self-rescheduling strand bring-up loops share (first-sync gate
-// probe loop, membership retry ladder) — injected by tests as a hand-cranked clock.
-export { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
-
-// Hibernation
-export {
-  HibernationManager,
-  type HibernationCallbacks
-} from './hibernation-manager.js';
-
-// Arachnode (stub)
-export {
-  ArachnodeStub,
-  createArachnodeStub,
-  type RingConfig
-} from './arachnode-stub.js';
-
-// Enrollment
-export {
-  EnrollmentService,
-  type MemberVerifier,
-  type MemberRegistry
-} from './enrollment.js';
-
-// Strand Solicitation
-export {
-  StrandSolicitationService,
-  createDefaultFormationResponseValidator,
-  type DisclosureValidator,
-  type FormationUsageRecorder,
-  type FormationUsageParams,
-  type AuthorizedFormationUsage,
-  type ResolvedHostStrand,
-  type StrandProvisioner,
-  type FormationResponseValidator,
-  type StrandSolicitationServiceOptions
-} from './strand-solicitation.js';
-
-// Formation approval client: asks an invite's ValidationUrl hook whether ONE redemption
-// may proceed, and checks the answer against the bytes the control database will verify.
-export {
-  createHttpFormationApprover,
-  signFormationApproval,
-  verifyFormationApproval,
-  FormationApprovalError,
-  type FormationApprovalRequest,
-  type FormationVouchFields,
-  type FormationApproval,
-  type FormationApprover,
-  type FormationApprovalFailure
-} from './formation-approval.js';
-
-// DB-backed FormationUsageRecorder (reads/writes the real CadreControl tables)
-export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
-
-// Closed-strand member key generation (ed25519 protobuf, base64) + the
-// protobuf->base64url bridge that derives the founding Member/Manager key.
-export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-
-// Strand membership writer (founder bootstrap, invite issuance/consumption,
-// manager-admit, member-peer registration, manager rotation, sealing — the sole
-// manager permanently freezing admission — + shared signing primitives reused
-// across the flows).
-export {
-  signStrandPayload,
-  verifyStrandPayload,
-  signStrandApproval,
-  generateStrandStampId,
-  bootstrapFounderMembership,
-  PreSplitStrandIdentityError,
-  issueInvite,
-  consumeInvite,
-  burnInvite,
-  isStrandMember,
-  cancelInvite,
-  listOutstandingInvites,
-  addMemberByManager,
-  revokeMember,
-  leaveStrand,
-  registerMemberPeer,
-  listMemberPeers,
-  removeMemberPeer,
-  addManager,
-  admitManager,
-  removeManager,
-  sealStrand,
-  isStrandSealed,
-  StrandTransactionBusyError,
-  STRAND_ENGINE,
-  STRAND_ENGINE_VERSION,
-  type FounderBootstrapParams,
-  type IssueInviteParams,
-  type IssuedInvite,
-  type ConsumeInviteParams,
-  type CancelInviteParams,
-  type OutstandingInvite,
-  type AddMemberByManagerParams,
-  type RevokeMemberParams,
-  type LeaveStrandParams,
-  type RegisterMemberPeerParams,
-  type RemoveOwnPeerParams,
-  type RemoveMemberPeerByManagerParams,
-  type RemoveMemberPeerParams,
-  type AddManagerParams,
-  type AdmitManagerParams,
-  type RemoveManagerParams,
-  type SealStrandParams,
-  type StrandWriteOptions
-} from './strand-membership-writer.js';
-
-// Engine-canonical datetime helper (shared by control + strand signed-write flows
-// so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
-export { canonicalDatetime } from './canonical-datetime.js';
-
-// Strand-DB-backed EnrollmentService backing: concrete MemberRegistry +
-// MemberVerifier that write/read the real Strand.* membership tables.
-export {
-  StrandMemberRegistry,
-  StrandMemberVerifier,
-  memberRegistrationPayload,
-  type StrandAdmission
-} from './strand-member-registry.js';
-
-// Seed Bootstrap
-export {
-  SeedBootstrapService,
-  SEED_PROTOCOL,
-  mergeSeedPeers,
-  seedDigest,
-  type SeedBootstrapConfig,
-  type SeedEventCallbacks
-} from './seed-bootstrap.js';
-
-// Peer Authorization (shared owner-signature digest + offline verifier)
-export {
-  peerAuthorizationDigest,
-  cadrePeerVoucherDigest,
-  cadrePeerRemoveDigest,
-  deviceTokenAddDigest,
-  deviceTokenRemoveDigest,
-  formationConsentDigest,
-  cadreInviteAddDigest,
-  cadreInviteRedeemDigest,
-  cadreInviteConsentDigest,
-  ownerKeyAddDigest,
-  verifyPeerAuthorization,
-  verifyCadrePeerVoucher,
-  verifyOwnerKeyVoucher,
-  verifyRevocationSigner,
-  verifyFormationConsent,
-  verifyInvitationAdmission,
-  verifyInvitationOwnerAdmission,
-  verifyCadreInviteRow,
-  verifyCadreInviteRedemption,
-  type DeviceTokenAuthorizedRow
-} from './peer-authorization.js';
-
-// How the trusted-owner anchor follows the replicated OwnerKey table along verifiable
-// chains: the pure derivation rule `CadreNode.syncOwnerAnchor` applies on every membership
-// refresh (owner-anchor-sync.ts).
-export { deriveOwnerAnchor, type OwnerAnchorInputs, type OwnerAnchorDerivation } from './owner-anchor-sync.js';
-
-// Strand Wake (control-network push-wake protocol)
-export {
-  StrandWakeService,
-  dialWake,
-  WAKE_PROTOCOL,
-  DEFAULT_WAKE_DIAL_BUDGET_MS,
-  type StrandWakeServiceOptions,
-  type DialWakeOptions
-} from './strand-wake-protocol.js';
-
-// Strand Address (control-network strand-address RPC) — wire types come via
-// `export * from './types.js'` (StrandAddrRequest / StrandAddrResponse / StrandAddrStatus).
-export {
-  StrandAddrService,
-  collectStrandAddrs,
-  STRAND_ADDR_PROTOCOL,
-  type StrandAddrServiceOptions,
-  type StrandAddrPeer,
-  type CollectStrandAddrsOptions,
-  type StrandAddrOutcome,
-  type StrandAddrCollection
-} from './strand-addr-protocol.js';
-
-// Peer-address record (self-published, signed, freshness-stamped CadrePeer row)
-export {
-  peerRecordSignedPayload,
-  signPeerRecord,
-  verifyPeerRecordSignature,
-  isPeerRecordFresh,
-  isSignalingAddr,
-  orderSignalingFirst,
-  currentMemberTrustPolicy,
-  DEFAULT_PEER_RECORD_MAX_AGE_MS,
-  DEFAULT_PEER_RECORD_HEARTBEAT_MS
-} from './peer-record.js';
-
-// Device-token record (self-published, signed FCM/APNs push token — CadrePeer sibling)
-export {
-  deviceTokenSignedPayload,
-  signDeviceTokenRecord,
-  verifyDeviceTokenSignature,
-  isPushPlatform
-} from './device-token.js';
-
-// Strand-wake payload contract (canonical; shared by the server sender + RN receiver)
-export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.js';
-
-// Platform push delivery — the cross-platform `PushNotifier` *contract* only.
-// The FCM/APNs implementations (node:http2/node:crypto) and the
-// `createPushNotifier` router that builds them live behind the Node-only subpath
-// `@serfab/cadre-core/push-node` (`push-node.ts`), never in this graph. A Node
-// host constructs a notifier from that subpath and injects the instance into
-// `CadreNodeConfig.push.notifier`. These re-exports are type-only (erased at
-// emit), so the RN/browser entry graph never pulls the Node modules in.
-export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
-
-// Push-credential validation + log redaction. Dependency-free (type-only imports),
-// so a provisioner (cadre-host / cadre-provider) can reject a partial credential
-// set and produce a key-safe log view without pulling the FCM/APNs sender graph.
-export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
-
-// Server-side push-wake trigger policy + fan-out (who/when to wake). Cross-platform
-// clean — it imports only the PushNotifier *type*, so exporting it as a runtime
-// value pulls no node:http2/node:crypto edge into the RN/browser graph.
-export {
-  PushFanoutService,
-  DEFAULT_PUSH_COOLDOWN_MS,
-  DEFAULT_PUSH_DEBOUNCE_MS,
-  type PushFanoutOptions,
-  type FanoutMember
-} from './push-fanout.js';
-
-// Control-cohort dial selection (backbone-preferential, bounded out-degree) +
-// the cadence/degree defaults the proactive reconcile routine reads.
-export {
-  selectControlCohortDials,
-  DEFAULT_CONTROL_COHORT_RECONCILE_MS,
-  DEFAULT_CONTROL_COHORT_TARGET_DEGREE,
-  type ControlCohortSelection,
-  type ControlCohortReconcileResult
-} from './control-cohort.js';
-
-// Dialing one peer from several candidate addresses, each under its own time
-// limit, so an address that never answers cannot starve the rest. Each address is
-// bound to the peer expected and dialed outside libp2p's dial queue (`dialAddr`),
-// so another dial of the same peer in flight cannot capture the attempt.
-export {
-  dialAddr,
-  withTrailingPeerId,
-  dialPeerAddrs,
-  SelfRelayOnlyError,
-  PeerUnreachableError,
-  tryAddrsInTurn,
-  directBeforeRelayed,
-  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
-  DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
-  CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
-  DEFAULT_PEER_DIAL_BUDGET,
-  type PeerDialBudget,
-  type AddrDialer
-} from './peer-dial.js';
-
-// Dial and reservation budgets counted in link round trips rather than fixed milliseconds, so
-// one declared assumption about the link moves them all — see `NetworkConfig.linkRoundTripMs`.
-export {
-  DECLARED_LINK_ROUND_TRIP_MS,
-  CIRCUIT_DIAL_ROUND_TRIPS,
-  RELAY_DIAL_ROUND_TRIPS,
-  RELAYED_DIAL_ROUND_TRIPS,
-  RELAY_RESERVATION_ROUND_TRIPS,
-  CIRCUIT_REQUEST_ROUND_TRIPS,
-  RELAYED_REQUEST_ROUND_TRIPS,
-  PUSH_TRANSFER_ALLOWANCE_MS,
-  ADMISSION_DECISION_TIMEOUT_MS,
-  resolveLinkRoundTripMs,
-  relayedDialBudgetMs,
-  relayReservationBudgetMs,
-  circuitRequestBudgetMs,
-  relayedRequestBudgetMs,
-  peerJoinPushBudget,
-  type PeerJoinPushBudget,
-  DIAL_ADMISSION_DECISIONS,
-  optimysticDialLimits,
-  type OptimysticDialLimits
-} from './link-budget.js';
-
-// Seed trust policy (trust anchor for incoming seeds)
-export {
-  anchoredTrustPolicy,
-  pinnedKeyTrustPolicy,
-  tofuTrustPolicy,
-  claimSecretTrustPolicy,
-  type SeedTrustPolicy,
-  type SeedTrustContext,
-  type SeedTrustDecision,
-  type ClaimSecretTrustPolicyOptions
-} from './seed-trust-policy.js';
-
-// Claim proof: how a brand-new node's first seed proves its sender holds the node's
-// one-time claim secret. The owner side builds the proof over `seedDigest` (exported
-// with the seed bootstrap above); `claimSecretTrustPolicy` verifies it.
-// `ClaimRefusedError` is what `CadreNode.claimNode` throws when the node said no;
-// `PeerUnreachableError` (exported with the peer dial above) when it was never reached.
-export {
-  parseClaimSecret,
-  claimProof,
-  verifyClaimProof,
-  ClaimRefusedError,
-  CLAIM_SECRET_BYTES
-} from './claim-proof.js';
-
-// The claim payload: the node's peer id, addresses and claim secret as the text a host
-// shows as a QR code and a phone scans (`CadreNode.claimNode` takes the decoded form).
-export {
-  encodeNodeClaimPayload,
-  decodeNodeClaimPayload,
-  selectNodeClaimAddresses,
-  withClaimDestination,
-  destinationPeerIdOf,
-  classifyDialAddress,
-  NODE_CLAIM_PAYLOAD_PREFIX,
-  type NodeClaimPayload,
-  type NodeClaimAddressOptions,
-  type DialAddressKind
-} from './node-claim-payload.js';
-
-// Moving a party's strands into another party of the same owner, so an app's strands follow
-// the app into the user's main cadre: the bundle one node exports from the party it leaves,
-// its adoption by a node of the party it joined, and the check that the party it left holds
-// nothing the joined one lacks before it is dissolved.
-export {
-  exportStrandBundle,
-  adoptStrandBundle,
-  readStrandHoldings,
-  unheldBundleContent,
-  StrandMoveNotOwnerError,
-  StrandMoveSamePartyError,
-  type StrandHoldings,
-  type StrandBundle,
-  type StrandBundleEntry,
-  type FormationInviteEntry,
-  type StrandMoveReport,
-  type StrandMoveFailure
-} from './strand-move.js';
-
-// The join request: what an app that wants to join a cadre copies to the app that manages it,
-// which mints an invitation targeted at the request's peer id. Both paste-text prefixes live here.
-export {
-  encodeCadreJoinRequest,
-  decodeCadreJoinRequest,
-  requireCadreJoinReply,
-  CADRE_JOIN_REQUEST_PREFIX,
-  CADRE_INVITATION_PREFIX,
-  CADRE_JOIN_REQUEST_MAX_APP_NAME,
-  type CadreJoinReply,
-  type CadreJoinRequest
-} from './cadre-join-request.js';
-
-// Renting a node from a hosting provider: the provider's descriptor, the app's side of the
-// OAuth 2 + PKCE sign-in, the typed client for its container API, and `rentNode` /
-// `finishRental`, which add the rented container to this node's cadre by invitation or by
-// claim. Global `fetch` and `crypto.getRandomValues` only, so the whole set loads on React
-// Native and in the browser (`docs/architecture.md` → "Renting a node from an app"). The
-// barrel is the curated list; it is not repeated here.
-export * from './provider/index.js';
-
-// Schema Verification
-export {
-  signSchema,
-  verifySchema,
-  assertSchemaSignature,
-  SchemaVerificationError
-} from './schema-verification.js';
-
-// Strand Formation transport (native cadre-core protocol)
-export {
-  FormationListener,
-  dialFormation,
-  dialFormationByMachine,
-  isValidResponderCreatesResult,
-  isWellFormedMembershipInvite,
-  sanitizeStrandAddrs,
-  FORMATION_PROTOCOL,
-  type FormationParty,
-  type FormationContactMessage,
-  type FormationResultMessage,
-  type FormationProvisionResult,
-  type FormationStrandInfo,
-  type FormationDbConnectionInfo,
-  type FormationListenerOptions,
-  type FormationDialOptions,
-  type FormationDialResult,
-  type FormationRejection,
-  type FormationTokenCheck,
-  type ResponderProvisionOutcome
-} from './strand-formation-protocol.js';
-// How a formation dial fails: a typed refusal (with a fixed code) or no answer at all
-export {
-  FormationRejectedError,
-  FormationUnreachableError,
-  FormationPostApprovalError,
-  FORMATION_REJECTION_RETRYABLE,
-  isFormationRejectionCode,
-  type FormationRejectionCode
-} from './strand-formation-rejection.js';
-export { formationDeadlines, type FormationDeadlines } from './strand-formation-deadlines.js';
-// Cadre invitation redemption transport: the bundle an owner hands out, the wire messages, the
-// member-side handler and the device-side dialer, and how a redemption fails
-export {
-  CadreInviteHandler,
-  redeemAtMembers,
-  redeemInPasses,
-  signRedeemRequest,
-  verifyRedeemReply,
-  encodeCadreInvitation,
-  decodeCadreInvitation,
-  isWellFormedCadreInviteRow,
-  sanitizeAddrs,
-  CadreInviteRejectedError,
-  CadreInviteUnreachableError,
-  CadreInviteReplyInvalidError,
-  CADRE_INVITE_PROTOCOL,
-  CADRE_INVITE_REJECTION_RETRYABLE,
-  isCadreInviteRejectionCode,
-  type CadreInvitation,
-  type CadreInviteRedeemRequest,
-  type CadreInviteRedeemReply,
-  type CadreInviteAccepted,
-  type CadreInviteRejectionCode,
-  type CadreInviteAddressOutcome,
-  type CadreInviteHandlerOptions,
-  type CadreInviteStore,
-  type RedeemAtMembersOptions,
-  type RedeemInPassesOptions,
-  type RedeemSigner,
-  type CadreInviteRedemption
-} from './cadre-invite-protocol.js';
-// Which machines, and how many addresses of each, an invitation names; how far a cadre invitation reaches
-export {
-  selectCadreInvitationMembers,
-  cadreInvitationReach,
-  CADRE_INVITATION_MAX_ADDRS,
-  CADRE_INVITATION_ADDRS_PER_SIBLING
-} from './invitation-bootstrap.js';
-// The pending-join retry loop behind CadreNode.requestJoin (PendingJoinStatus is in types.ts)
-export { PENDING_JOIN_POLL_MS, PENDING_JOIN_MAX_BACKOFF_MS, MAX_PENDING_JOIN_MS } from './pending-join-runner.js';
-
-// Strand Formation manager (drives the native transport)
-export {
-  StrandFormationManager,
-  createStrandFormationManager,
-  MEMBERSHIP_INVITE_TTL_MS,
-  MEMBERSHIP_INVITE_UNAVAILABLE_REASON,
-  HOST_STRAND_MUST_BE_RECREATED_REASON,
-  type CadrePeerAddrsSource,
-  type MembershipInviteIssuer,
-  type StrandFormationManagerConfig,
-  type StrandFormationManagerOptions
-} from './strand-formation-manager.js';
-
-// Control-network per-stream protocol guard (which peers may open which protocol)
-export {
-  controlProtocolClasses,
-  type ControlProtocolClass
-} from './control-protocol-guard.js';
-
-// Control-network inbound connection gate (membership defense-in-depth)
-export {
-  createMembershipConnectionGater,
-  PROVISIONAL_ADMISSION_DEADLINE_MS,
-  PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS,
-  MAX_UNAUTHORIZED_RELAY_RESERVATIONS,
-  UnauthorizedReservationBudget,
-  type InboundAdmissionPolicy,
-  type InboundConnectionVerdict
-} from './membership-connection-gater.js';
-
-// Thrown out of `CadreNode.start()` when a `network.relayAddrs` reservation does
-// not land on its first attempt — the fail-fast posture of that config field now
-// that the control node reserves AFTER control-database bring-up (relay-addrs.ts).
-// `UnbindableListenAddressError` is the same posture for the OTHER half of the listen
-// config: a `network.listenAddrs` entry whose transport the node will not have refuses
-// start instead of being silently dropped by libp2p's transport manager.
-//
-// `resolveListenAddrs` and `strandNodeAddrs` are the derivations themselves — what a
-// `NetworkConfig` actually turns into for the control node and for each strand node.
-// Exported so an embedder that hand-writes a `network` block (the React Native and web
-// reference apps) can assert on the resulting SHAPE rather than on its own field names,
-// which is the difference between a test that proves reachability and one that proves a
-// spelling.
-export {
-  RelayReservationFailedError,
-  UnbindableListenAddressError,
-  RELAY_SEARCH_LISTEN_ADDR,
-  resolveListenAddrs
-} from './relay-addrs.js';
-export { strandNodeAddrs, type StrandNodeAddrs } from './strand-network-config.js';
-// STUN for an embedder's WebRTC transport, derived from the relays it already uses: each
-// Sereus relay also answers STUN (`ops/docs/ice-servers.md`).
-export { RELAY_STUN_PORT, relayStunUrl, resolveStunServers, type StunServer } from './relay-stun.js';
-// The circuit-relay SERVER a node runs, and with which init — one resolution shared by the
-// control node and every strand node. Exported alongside the listen derivations above for the
-// same reason: an embedder can assert on what its `network` block resolves to.
-export {
-  resolveRelayServer,
-  PARTY_RELAY_MAX_RESERVATIONS,
-  PARTY_RELAY_RESERVATION_TTL_MS,
-  type ResolvedRelayServer,
-  type ResolvedRelayReservations
-} from './relay-server.js';
-
-// Relay reservation via the bare `/p2p-circuit` search listener — the one route
-// every control node takes; `network.relayAddrs` is its fail-fast posture
-// (see relay-reservation.ts)
-export {
-  circuitMultiaddrs,
-  superviseRelayReservation,
-  DEFAULT_RELAY_RESERVE_TIMEOUT_MS,
-  DEFAULT_RELAY_RESERVE_POLL_MS,
-  DEFAULT_RELAY_CHECK_MS,
-  DEFAULT_RELAY_MIN_BACKOFF_MS,
-  DEFAULT_RELAY_MAX_BACKOFF_MS,
-  type RelayReservationStatus,
-  type RelayReservationState,
-  type RelayReserveOptions,
-  type RelayReservationSupervisor,
-  type RelayReservationSupervisorOptions
-} from './relay-reservation.js';
-
-// Connection-path diagnostics (relayed vs direct classification + summary)
-export {
-  classifyTransport,
-  summarizeConnectionPaths,
-  emptyConnectionPathSummary,
-  DEFAULT_SETTLE_WINDOW_MS,
-  type ConnectionPathKind,
-  type ConnectionTransport,
-  type ConnectionPath,
-  type ConnectionPathSummary,
-  type ConnectionLike
-} from './diagnostics/connection-path.js';
+// Core types
+export * from './types.js';
+
+// Canonical JSON serialization (shared signing payload format)
+export { canonicalJson } from './canonical-json.js';
+
+// Main CadreNode class
+export { CadreNode, CADRE_INVITATION_DEFAULT_TTL_MS, OWNER_GRANT_DEFAULT_TTL_MS } from './cadre-node.js';
+
+// Removing a machine from a cadre: the by-name refusal `CadreNode.removeMachine` throws
+// (the listing, plan and result types are in types.ts)
+export { MachineRemovalRefusedError } from './machine-removal.js';
+
+// Adding and removing an owner key: the by-name refusals `CadreNode.addOwner` and
+// `CadreNode.removeOwner` throw (the listing, plan and result types are in types.ts)
+export { OwnerKeyAddRefusedError, OwnerKeyRemovalRefusedError } from './owner-keys.js';
+
+// Control database
+export { ControlDatabase, parseNullableStoredDatetimeMs, MissingHostStrandError, InvitationExhaustedError, CadreInviteIssuerUnknownError, OwnerGrantIssuerUnknownError, IssuedRowNotHereYetError, buildAuthorizationMessage, registerPartyIdFunction, formationVouchMessage, formationConsentMessage, cadreInviteAddMessage, cadreInviteRedeemMessage, cadreInviteConsentMessage, ownerGrantAddMessage, ownerGrantRedeemMessage, ownerGrantConsentMessage, projectSeedPeers, REAPABLE_TABLES, type ReapableTable, type ControlDatabaseConfig, type ControlTable, type RevocableTable, type FormationUsageResult, type FormationInviteRow, type FoundingRows, type FoundingInvite, type MembershipChangeListener, type GuardedDeleteListener, type ControlWriteAbandonedListener, type RevokedRowRef, type ControlSign, type SelfRecordSigner, type CadrePeerRetouchMode, type CadrePeerRetouchOutcome, type OwnerGrantRedemptionFields } from './control-database.js';
+
+// The control schema version a store is migrated to on start, and what `start()` throws, with a
+// reason, when the store must not be migrated (docs/architecture.md → "Control schema versions and
+// migrations")
+export { CONTROL_SCHEMA_VERSION, CONTROL_SCHEMA_BASELINE_VERSION, CONTROL_SCHEMA_VERSION_TAG } from './control-schema.js';
+export { ControlStoreIncompatibleError, type ControlStoreIncompatibility } from './control-schema-version.js';
+
+// Bounded retry for transient control-write failures (classifier + loop behind
+// ControlDatabase.lockedWithRetry; exported so the integration package can drive the
+// classifier against real engine errors)
+export {
+  CONTROL_WRITE_ATTEMPTS,
+  CONTROL_WRITE_RETRY_BUDGET_MS,
+  LOST_UPDATE_RETRY_POLICY,
+  SCHEMA_INIT_ATTEMPTS,
+  SCHEMA_INIT_RETRY_POLICY,
+  isRetriableControlWriteFailure,
+  isRetriableLostUpdateFailure,
+  isRetriableSchemaInitFailure,
+  retryControlWrite,
+  type ControlWriteRetryOptions
+} from './control-write-retry.js';
+
+// Bounded retry for transient control-read failures (classifier + policy behind
+// ControlDatabase.readRows; the loop is shared with the write side via control-retry.ts)
+export {
+  CONTROL_READ_ATTEMPTS,
+  CONTROL_READ_RETRY_DELAYS_MS,
+  CONTROL_READ_RETRY_BUDGET_MS,
+  isRetriableControlReadFailure,
+  retryControlRead,
+  type ControlReadRetryOptions
+} from './control-read-retry.js';
+
+// The bounded retry loop both control policies share. Only the abandonment record leaves
+// this package: it is the payload of the `control:write-abandoned` node event, so an
+// embedding app can type a handler for it.
+export type {
+  ControlRetryAbandonment,
+  ControlRetryAbandonReason,
+  ControlRetryAbandonListener
+} from './control-retry.js';
+
+// Control-plane authorization field vector (the domain/action tagging every signer shares)
+export { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, ownerGrantRowFields, type ControlDomain, type BoundControlDomain, type UnboundControlDomain, type ControlAction, type CadreInviteSignedFields, type OwnerGrantSignedFields } from './control-authorization.js';
+
+// Ed25519 key bridge (libp2p Ed25519 -> base64url keypair)
+export { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64, requireEd25519PrivateKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
+
+// Pluggable key store (backend-agnostic identity/owner key material seam).
+// Dependency-free: the interface, error, default slot id, and in-memory backend
+// are safe in every (RN/browser/Node) entry graph. The Node FileKeyStore is a
+// separate subpath module ('@serfab/cadre-core/key-store-file') so its node:fs
+// import never lands here.
+export {
+  InMemoryKeyStore,
+  KeyStoreAccessError,
+  DEFAULT_IDENTITY_KEY_ID,
+  DEFAULT_OWNER_KEY_ID,
+  type KeyStore,
+  type KeyId
+} from './key-store.js';
+
+// The filename-safe form of an id that every Node-only per-party file store names its file
+// with (`<name>.<encoded party>.json`), for an embedder keeping its own file beside theirs.
+export { encodeFileSafeComponent } from './file-safe-name.js';
+
+// The KeyStore-backed identity rule, shared with embedding apps that need the
+// node key BEFORE `CadreNode` exists.
+export { loadOrCreateIdentityKey } from './identity-key.js';
+
+// Owner keys (`docs/architecture.md` → Owner Keys): the one interface owner signatures go
+// through, the key-store slot an owner key lives in apart from the identity slot, and the
+// text form a key is exported and imported in. Cross-platform: pure JS crypto only.
+export {
+  softwareOwnerSigner,
+  OwnerSigningDeclinedError,
+  type OwnerSigner,
+  type OwnerSign,
+  type OwnerSigningRequest
+} from './owner-signer.js';
+export {
+  createOwnerKey,
+  loadOwnerSigner,
+  importOwnerKey,
+  readOwnerPrivateKey,
+  OwnerKeySlotOccupiedError
+} from './owner-key-store.js';
+export {
+  encodeOwnerKeyExport,
+  decodeOwnerKeyExport,
+  unlockOwnerKeyExport,
+  OwnerKeyExportError,
+  OWNER_KEY_EXPORT_PREFIX,
+  LOCKED_OWNER_KEY_EXPORT_PREFIX,
+  OWNER_KEY_MAX_LABEL,
+  type OwnerKeyExportErrorCode,
+  type OwnerKeyExportContents,
+  type OwnerKeyExportInput,
+  type DecodedOwnerKeyExport
+} from './owner-key-export.js';
+export {
+  exportOwnerKey,
+  importOwnerKeyInto,
+  type ExportedOwnerKey,
+  type ImportedOwnerKey,
+  type OwnerKeyExportOptions
+} from './owner-key-flows.js';
+
+// Node-local trusted-owner anchor: the NON-replicated, per-party record of
+// out-of-band-established owner keys (the trust anchor the replicated OwnerKey
+// table cannot be). Cross-platform: interface + in-memory store only — the
+// file-backed store is the Node-only subpath
+// '@serfab/cadre-core/trusted-owner-store-file' (same isolation as
+// key-store-file) so node:fs never lands in this graph.
+export {
+  MemoryTrustedOwnerStore,
+  PersistentTrustedOwnerStore,
+  type TrustedOwnerStore,
+  type TrustSource
+} from './trusted-owner-store.js';
+
+// The one platform-specific piece of a persistent node-local store: a single
+// durable text slot the embedding app supplies (IndexedDB / SecureStore /
+// SQLite / a file). Everything else — envelope, load policy, snapshot write
+// chain — is cross-platform in node-local-snapshot.ts.
+export type { DurableSlot } from './node-local-snapshot.js';
+
+// Node-local cold-start bootstrap-peer store: the dial targets retained from an
+// applied seed so a node that could not connect on its first try keeps retrying
+// across restarts. Same cross-platform split as the trusted-owner anchor above —
+// interface + in-memory store here, Node-only file backend behind the subpath
+// '@serfab/cadre-core/bootstrap-peer-store-file'.
+export {
+  MemoryBootstrapPeerStore,
+  PersistentBootstrapPeerStore,
+  type BootstrapPeerStore,
+  type BootstrapPeerEntry
+} from './bootstrap-peer-store.js';
+
+// Node-local enrolled-machine count: the machines this party had enrolled the
+// last time this node looked, remembered across restarts so the CONTROL node can
+// declare a block-repair yardstick at bring-up — which is before the database
+// holding the membership rows exists. Same cross-platform split as the two
+// records above; Node-only file backend behind the subpath
+// '@serfab/cadre-core/enrolled-machine-store-file'. Its load policy deliberately
+// DIVERGES from theirs (an unreadable slot cold-starts rather than throwing) —
+// see the module comment before unifying the three.
+export {
+  MemoryEnrolledMachineStore,
+  PersistentEnrolledMachineStore,
+  type EnrolledMachineStore
+} from './enrolled-machine-store.js';
+
+// Node-local record of the strands this node joined from ANOTHER party and has not yet
+// published party-wide, re-offered on every start as `strand:discovered`.
+// Cross-platform: its durable form rides the KeyStore seam above (the record carries a
+// closed strand's read secret), so there is no file-backed subpath.
+export {
+  MemoryJoinedStrandStore,
+  KeyStoreJoinedStrandStore,
+  type JoinedStrandStore,
+  type JoinedStrandRecord
+} from './joined-strand-store.js';
+
+// Node-local strand network state: per strand, the state Optimystic's db-p2p saves for
+// the strand node (its FRET routing table with each peer's signed address record), so a
+// restarted strand node re-imports the peers it was talking to. Same cross-platform
+// split as the bootstrap-peer store above — interface + in-memory + slot-backed stores
+// here, Node-only file backend behind '@serfab/cadre-core/strand-network-state-file'.
+export {
+  MemoryStrandNetworkStateStore,
+  PersistentStrandNetworkStateStore,
+  strandNetworkStatePersistence,
+  type StrandNetworkStateStore
+} from './strand-network-state.js';
+// The signed address records a running strand node's FRET table holds, as per-peer dial
+// addresses: what the periodic refresh re-merges into the node's address book, and a
+// diagnostic for "whom could this strand node redial right now?".
+export { strandFretPeerAddrs, type FretAddrHost, type FretPeerAddrs } from './strand-fret-addrs.js';
+
+// Storage scope keys — what `CadreNodeConfig.storage.provider` is called with. A
+// strand's key is its strand id; the control database's key carries the party id,
+// so two parties on one device never share a control store. Every key stays within
+// `[a-z0-9._-]` — lowercase, so distinct keys stay distinct on a case-insensitive
+// filesystem: the control key by lowercase hex encoding, a strand's by
+// `assertStrandScopeKey`, which every strand launch runs.
+export {
+  controlStorageScope,
+  isControlStorageScope,
+  isValidStrandScopeKey,
+  assertStrandScopeKey,
+  InvalidStrandIdError
+} from './storage-scope.js';
+
+// Strand database
+export { StrandDatabase, type StrandDatabaseConfig } from './strand-database.js';
+export type { StrandCommitDurability, StrandCommitHeld } from './strand-commit-durability.js';
+
+// Strand management
+export {
+  StrandWatcher,
+  type StrandWatcherCallbacks,
+  type StrandQueryable,
+  type SAppIdLookup,
+  type StrandRowWithApp
+} from './strand-watcher.js';
+export {
+  StrandInstanceManager,
+  type StartStrandConfig,
+  type ResumeStrandOverrides,
+  getStrandStoragePath,
+  isAwaitingFirstSync,
+  liveStrandStatus
+} from './strand-instance-manager.js';
+
+// The joining machine's first-sync write gate: a non-founder launch withholds its
+// database (status 'syncing') until the strand's Header has arrived from a peer, so a
+// write before the first sync can never fork the strand's tables.
+export {
+  StrandAwaitingFirstSyncError,
+  DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS,
+  DEFAULT_STRAND_FIRST_SYNC_BACKSTOP_MS,
+  type StrandFirstSyncConfig
+} from './strand-first-sync-gate.js';
+
+// Peer-join block catch-up (push this network's own blocks to each newly
+// connected peer, so a late joiner physically holds pre-join blocks). Shared
+// by the strand networks (ungated) and the control network (membership-gated).
+export {
+  PeerJoinBackfill,
+  DEFAULT_PEER_JOIN_BACKFILL,
+  MAX_BLOCK_MESSAGE_BYTES,
+  PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES,
+  type PeerJoinBackfillConfig,
+  type PeerJoinBackfillDeps,
+  type PeerJoinBackfillResult,
+  type PeerJoinBackfillPushClient
+} from './peer-join-backfill.js';
+
+// Operator opt-in to Optimystic change notifications on chosen strand nodes
+// (`CadreNodeConfig.strandReactivity`).
+export { strandCohortTopicOption, type StrandReactivityConfig } from './strand-reactivity.js';
+
+// Closed-strand revoked-peer enforcement (deny the network nodes of removed
+// members at the stream and connection layers, and hang up the sessions they
+// already hold — see the module doc for the settled deny-list design, the
+// teardown seam, and the fail directions).
+export {
+  StrandRevocationEnforcer,
+  createRevocationConnectionGater,
+  readStrandRevocationRows,
+  DEFAULT_REVOCATION_BACKSTOP_MS,
+  REVOCATION_REFRESH_RETRY_MS,
+  REVOCATION_WIDE_STRAND_REFRESH_MS,
+  type StrandRevocationEnforcementConfig,
+  type StrandRevocationEnforcerDeps,
+  type StrandRevocationRows,
+  type StrandMemberPeerBinding,
+  type StrandRevocationJudge,
+  type StrandRevocationNetwork
+} from './strand-revocation-enforcer.js';
+
+// Closed-strand membership reconciliation: the bring-up loop that finishes a
+// party's join on every machine — redeem the staged formation invitation, then
+// write the durable machine→party MemberPeer binding — without ever blocking
+// bring-up (see the module doc for the pass ladder and terminal states).
+export {
+  StrandMembershipReconciler,
+  DEFAULT_MEMBERSHIP_RECONCILE_INTERVAL_MS,
+  IDLE_PASSES_BEFORE_ESCALATION,
+  INITIAL_JOIN_RETRY_INTERVAL_MS,
+  type StrandMembershipReconcilerDeps,
+  type StrandMembershipReconciliationConfig,
+  type PendingMembershipInviteSource
+} from './strand-membership-reconciler.js';
+
+// The timer seam the self-rescheduling loops share (membership retry ladder, the table
+// change schedule the first-sync gate probes on) — injected by tests as a hand-cranked clock.
+export { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
+
+// Hibernation
+export {
+  HibernationManager,
+  type HibernationCallbacks
+} from './hibernation-manager.js';
+
+// Arachnode (stub)
+export {
+  ArachnodeStub,
+  createArachnodeStub,
+  type RingConfig
+} from './arachnode-stub.js';
+
+// Enrollment
+export {
+  EnrollmentService,
+  type MemberVerifier,
+  type MemberRegistry
+} from './enrollment.js';
+
+// Strand Solicitation
+export {
+  StrandSolicitationService,
+  createDefaultFormationResponseValidator,
+  type DisclosureValidator,
+  type FormationUsageRecorder,
+  type FormationUsageParams,
+  type AuthorizedFormationUsage,
+  type BoundHostStrand,
+  type ResolvedHostStrand,
+  type StrandProvisioner,
+  type FormationResponseValidator,
+  type StrandSolicitationServiceOptions
+} from './strand-solicitation.js';
+
+// Formation approval client: asks an invite's ValidationUrl hook whether ONE redemption
+// may proceed, and checks the answer against the bytes the control database will verify.
+export {
+  createHttpFormationApprover,
+  signFormationApproval,
+  verifyFormationApproval,
+  FormationApprovalError,
+  type FormationApprovalRequest,
+  type FormationVouchFields,
+  type FormationApproval,
+  type FormationApprover,
+  type FormationApprovalFailure
+} from './formation-approval.js';
+
+// DB-backed FormationUsageRecorder (reads/writes the real CadreControl tables)
+export { ControlFormationUsageRecorder } from './control-formation-recorder.js';
+
+// Closed-strand member key generation (ed25519 protobuf, base64) + the
+// protobuf->base64url bridge that derives the founding Member/Manager key.
+export { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
+
+// Strand membership writer (founder bootstrap, invite issuance/consumption,
+// manager-admit, member-peer registration, manager rotation, sealing — the sole
+// manager permanently freezing admission — + shared signing primitives reused
+// across the flows).
+export {
+  signStrandPayload,
+  verifyStrandPayload,
+  signStrandApproval,
+  generateStrandStampId,
+  bootstrapFounderMembership,
+  PreSplitStrandIdentityError,
+  issueInvite,
+  consumeInvite,
+  burnInvite,
+  isStrandMember,
+  cancelInvite,
+  listOutstandingInvites,
+  addMemberByManager,
+  revokeMember,
+  leaveStrand,
+  registerMemberPeer,
+  listMemberPeers,
+  removeMemberPeer,
+  addManager,
+  admitManager,
+  removeManager,
+  sealStrand,
+  isStrandSealed,
+  StrandTransactionBusyError,
+  STRAND_ENGINE,
+  STRAND_ENGINE_VERSION,
+  type FounderBootstrapParams,
+  type IssueInviteParams,
+  type IssuedInvite,
+  type ConsumeInviteParams,
+  type CancelInviteParams,
+  type OutstandingInvite,
+  type AddMemberByManagerParams,
+  type RevokeMemberParams,
+  type LeaveStrandParams,
+  type RegisterMemberPeerParams,
+  type RemoveOwnPeerParams,
+  type RemoveMemberPeerByManagerParams,
+  type RemoveMemberPeerParams,
+  type AddManagerParams,
+  type AdmitManagerParams,
+  type RemoveManagerParams,
+  type SealStrandParams,
+  type StrandWriteOptions
+} from './strand-membership-writer.js';
+
+// Engine-canonical datetime helper (shared by control + strand signed-write flows
+// so a signed timestamp byte-matches the datetime-coerced column the CHECK sees).
+export { canonicalDatetime } from './canonical-datetime.js';
+
+// Strand-DB-backed EnrollmentService backing: concrete MemberRegistry +
+// MemberVerifier that write/read the real Strand.* membership tables.
+export {
+  StrandMemberRegistry,
+  StrandMemberVerifier,
+  memberRegistrationPayload,
+  type StrandAdmission
+} from './strand-member-registry.js';
+
+// Seed Bootstrap
+export {
+  SeedBootstrapService,
+  SEED_PROTOCOL,
+  mergeSeedPeers,
+  seedDialTargets,
+  seedDigest,
+  type SeedBootstrapConfig,
+  type SeedEventCallbacks
+} from './seed-bootstrap.js';
+
+// Peer Authorization (shared owner-signature digest + offline verifier)
+export {
+  peerAuthorizationDigest,
+  cadrePeerVoucherDigest,
+  cadrePeerRemoveDigest,
+  deviceTokenAddDigest,
+  deviceTokenRemoveDigest,
+  formationConsentDigest,
+  cadreInviteAddDigest,
+  cadreInviteRedeemDigest,
+  cadreInviteConsentDigest,
+  ownerKeyAddDigest,
+  verifyPeerAuthorization,
+  verifyCadrePeerVoucher,
+  verifyOwnerKeyVoucher,
+  verifyRevocationSigner,
+  verifyFormationConsent,
+  verifyInvitationAdmission,
+  verifyCadreInviteRow,
+  verifyCadreInviteRedemption,
+  ownerGrantAddDigest,
+  ownerGrantRedeemDigest,
+  ownerGrantConsentDigest,
+  verifyOwnerGrantRow,
+  verifyOwnerGrantRedemption,
+  verifyOwnerGrantAdmission,
+  type DeviceTokenAuthorizedRow
+} from './peer-authorization.js';
+
+// How the trusted-owner anchor follows the replicated OwnerKey table along verifiable
+// chains: the pure derivation rule `CadreNode.syncOwnerAnchor` applies on every membership
+// refresh (owner-anchor-sync.ts).
+export { deriveOwnerAnchor, type OwnerAnchorInputs, type OwnerAnchorDerivation } from './owner-anchor-sync.js';
+
+// Strand Wake (control-network push-wake protocol)
+export {
+  StrandWakeService,
+  dialWake,
+  WAKE_PROTOCOL,
+  DEFAULT_WAKE_DIAL_BUDGET_MS,
+  type StrandWakeServiceOptions,
+  type DialWakeOptions
+} from './strand-wake-protocol.js';
+
+// Strand Address (control-network strand-address RPC) — wire types come via
+// `export * from './types.js'` (StrandAddrRequest / StrandAddrResponse / StrandAddrStatus).
+export {
+  StrandAddrService,
+  collectStrandAddrs,
+  STRAND_ADDR_PROTOCOL,
+  type StrandAddrServiceOptions,
+  type StrandAddrPeer,
+  type CollectStrandAddrsOptions,
+  type StrandAddrOutcome,
+  type StrandAddrCollection
+} from './strand-addr-protocol.js';
+
+// Peer-address record (self-published, signed, freshness-stamped CadrePeer row)
+export {
+  peerRecordSignedPayload,
+  signPeerRecord,
+  verifyPeerRecordSignature,
+  isPeerRecordFresh,
+  isSignalingAddr,
+  orderSignalingFirst,
+  currentMemberTrustPolicy,
+  DEFAULT_PEER_RECORD_MAX_AGE_MS,
+  DEFAULT_PEER_RECORD_HEARTBEAT_MS
+} from './peer-record.js';
+
+// Device-token record (self-published, signed FCM/APNs push token — CadrePeer sibling)
+export {
+  deviceTokenSignedPayload,
+  signDeviceTokenRecord,
+  verifyDeviceTokenSignature,
+  isPushPlatform
+} from './device-token.js';
+
+// Strand-wake payload contract (canonical; shared by the server sender + RN receiver)
+export { STRAND_WAKE_TYPE, type StrandWakePayload } from './strand-wake-payload.js';
+
+// Platform push delivery — the cross-platform `PushNotifier` *contract* only.
+// The FCM/APNs implementations (node:http2/node:crypto) and the
+// `createPushNotifier` router that builds them live behind the Node-only subpath
+// `@serfab/cadre-core/push-node` (`push-node.ts`), never in this graph. A Node
+// host constructs a notifier from that subpath and injects the instance into
+// `CadreNodeConfig.push.notifier`. These re-exports are type-only (erased at
+// emit), so the RN/browser entry graph never pulls the Node modules in.
+export type { PushNotifier, PushMessage, PushSendResult } from './push-notifier.js';
+
+// Push-credential validation + log redaction. Dependency-free (type-only imports),
+// so a provisioner (cadre-host / cadre-provider) can reject a partial credential
+// set and produce a key-safe log view without pulling the FCM/APNs sender graph.
+export { validatePushCredentials, redactPushCredentials, REDACTED } from './push-credentials.js';
+
+// Server-side push-wake trigger policy + fan-out (who/when to wake). Cross-platform
+// clean — it imports only the PushNotifier *type*, so exporting it as a runtime
+// value pulls no node:http2/node:crypto edge into the RN/browser graph.
+export {
+  PushFanoutService,
+  DEFAULT_PUSH_COOLDOWN_MS,
+  DEFAULT_PUSH_DEBOUNCE_MS,
+  type PushFanoutOptions,
+  type FanoutMember
+} from './push-fanout.js';
+
+// Control-cohort dial selection (backbone-preferential, bounded out-degree) +
+// the backstop, redial and degree defaults the proactive reconcile routine reads.
+export {
+  selectControlCohortDials,
+  DEFAULT_CONTROL_COHORT_RECONCILE_MS,
+  DEFAULT_CONTROL_COHORT_TARGET_DEGREE,
+  CONTROL_COHORT_REDIAL_MS,
+  type ControlCohortSelection,
+  type ControlCohortReconcileResult
+} from './control-cohort.js';
+
+// Dialing one peer from several candidate addresses, each under its own time
+// limit, so an address that never answers cannot starve the rest. Each address is
+// bound to the peer expected and dialed outside libp2p's dial queue (`dialAddr`),
+// so another dial of the same peer in flight cannot capture the attempt.
+export {
+  dialAddr,
+  withTrailingPeerId,
+  dialPeerAddrs,
+  SelfRelayOnlyError,
+  PeerUnreachableError,
+  tryAddrsInTurn,
+  directBeforeRelayed,
+  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
+  DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
+  CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
+  DEFAULT_PEER_DIAL_BUDGET,
+  type PeerDialBudget,
+  type AddrDialer
+} from './peer-dial.js';
+
+// Dial and reservation budgets counted in link round trips rather than fixed milliseconds, so
+// one declared assumption about the link moves them all — see `NetworkConfig.linkRoundTripMs`.
+export {
+  DECLARED_LINK_ROUND_TRIP_MS,
+  CIRCUIT_DIAL_ROUND_TRIPS,
+  RELAY_DIAL_ROUND_TRIPS,
+  RELAYED_DIAL_ROUND_TRIPS,
+  RELAY_RESERVATION_ROUND_TRIPS,
+  CIRCUIT_REQUEST_ROUND_TRIPS,
+  RELAYED_REQUEST_ROUND_TRIPS,
+  PUSH_TRANSFER_ALLOWANCE_MS,
+  ADMISSION_DECISION_TIMEOUT_MS,
+  resolveLinkRoundTripMs,
+  relayedDialBudgetMs,
+  relayReservationBudgetMs,
+  circuitRequestBudgetMs,
+  relayedRequestBudgetMs,
+  peerJoinPushBudget,
+  type PeerJoinPushBudget,
+  DIAL_ADMISSION_DECISIONS,
+  optimysticDialLimits,
+  type OptimysticDialLimits
+} from './link-budget.js';
+
+// Seed trust policy (trust anchor for incoming seeds)
+export {
+  anchoredTrustPolicy,
+  pinnedKeyTrustPolicy,
+  tofuTrustPolicy,
+  claimSecretTrustPolicy,
+  type SeedTrustPolicy,
+  type SeedTrustContext,
+  type SeedTrustDecision,
+  type ClaimSecretTrustPolicyOptions
+} from './seed-trust-policy.js';
+
+// Claim proof: how a brand-new node's first seed proves its sender holds the node's
+// one-time claim secret. The owner side builds the proof over `seedDigest` (exported
+// with the seed bootstrap above); `claimSecretTrustPolicy` verifies it.
+// `ClaimRefusedError` is what `CadreNode.claimNode` throws when the node said no;
+// `PeerUnreachableError` (exported with the peer dial above) when it was never reached.
+export {
+  parseClaimSecret,
+  claimProof,
+  verifyClaimProof,
+  ClaimRefusedError,
+  CLAIM_SECRET_BYTES
+} from './claim-proof.js';
+
+// The claim payload: the node's peer id, addresses and claim secret as the text a host
+// shows as a QR code and a phone scans (`CadreNode.claimNode` takes the decoded form).
+export {
+  encodeNodeClaimPayload,
+  decodeNodeClaimPayload,
+  selectNodeClaimAddresses,
+  withClaimDestination,
+  destinationPeerIdOf,
+  classifyDialAddress,
+  NODE_CLAIM_PAYLOAD_PREFIX,
+  type NodeClaimPayload,
+  type NodeClaimAddressOptions,
+  type DialAddressKind
+} from './node-claim-payload.js';
+
+// Moving a party's strands into another party of the same owner, so an app's strands follow
+// the app into the user's main cadre: the bundle one node exports from the party it leaves,
+// its adoption by a node of the party it joined, and the check that the party it left holds
+// nothing the joined one lacks before it is dissolved.
+export {
+  exportStrandBundle,
+  adoptStrandBundle,
+  readStrandHoldings,
+  unheldBundleContent,
+  StrandMoveNotOwnerError,
+  StrandMoveSamePartyError,
+  type StrandHoldings,
+  type StrandBundle,
+  type StrandBundleEntry,
+  type FormationInviteEntry,
+  type StrandMoveReport,
+  type StrandMoveFailure
+} from './strand-move.js';
+
+// The join request: what an app that wants to join a cadre copies to the app that manages it,
+// which mints an invitation targeted at the request's peer id. Both paste-text prefixes live here.
+export {
+  encodeCadreJoinRequest,
+  decodeCadreJoinRequest,
+  requireCadreJoinReply,
+  CADRE_JOIN_REQUEST_PREFIX,
+  CADRE_INVITATION_PREFIX,
+  OWNER_KEY_EXPORT_STEM,
+  OWNER_GRANT_PREFIX,
+  CADRE_JOIN_REQUEST_MAX_APP_NAME,
+  type CadreJoinReply,
+  type CadreJoinRequest
+} from './cadre-join-request.js';
+
+// Renting a node from a hosting provider: the provider's descriptor, the app's side of the
+// OAuth 2 + PKCE sign-in, the typed client for its container API, and `rentNode` /
+// `finishRental`, which add the rented container to this node's cadre by invitation or by
+// claim. Global `fetch` and `crypto.getRandomValues` only, so the whole set loads on React
+// Native and in the browser (`docs/architecture.md` → "Renting a node from an app"). The
+// barrel is the curated list; it is not repeated here.
+export * from './provider/index.js';
+
+// Schema Verification
+export {
+  signSchema,
+  verifySchema,
+  assertSchemaSignature,
+  SchemaVerificationError
+} from './schema-verification.js';
+
+// Strand Formation transport (native cadre-core protocol)
+export {
+  FormationListener,
+  dialFormation,
+  dialFormationByMachine,
+  isValidResponderCreatesResult,
+  isWellFormedMembershipInvite,
+  sanitizeStrandAddrs,
+  FORMATION_PROTOCOL,
+  type FormationParty,
+  type FormationContactMessage,
+  type FormationResultMessage,
+  type FormationProvisionResult,
+  type FormationStrandInfo,
+  type FormationDbConnectionInfo,
+  type FormationListenerOptions,
+  type FormationDialOptions,
+  type FormationDialResult,
+  type FormationRejection,
+  type ResponderProvisionOutcome
+} from './strand-formation-protocol.js';
+// A responder session's one read of its formation token, and the check made from it
+export {
+  classifyTokenRead,
+  isTokenReadSpent,
+  type FormationInviteFacts,
+  type FormationTokenRead,
+  type FormationTokenCheck
+} from './formation-token.js';
+// How a formation dial fails: a typed refusal (with a fixed code) or no answer at all
+export {
+  FormationRejectedError,
+  FormationUnreachableError,
+  FormationPostApprovalError,
+  FORMATION_REJECTION_RETRYABLE,
+  isFormationRejectionCode,
+  type FormationRejectionCode
+} from './strand-formation-rejection.js';
+export { formationDeadlines, type FormationDeadlines } from './strand-formation-deadlines.js';
+// Cadre invitation redemption transport: the bundle an owner hands out, the wire messages, the
+// member-side handler and the device-side dialer, and how a redemption fails
+export {
+  CadreInviteHandler,
+  redeemAtMembers,
+  redeemInPasses,
+  signRedeemRequest,
+  verifyRedeemReply,
+  encodeCadreInvitation,
+  decodeCadreInvitation,
+  isWellFormedCadreInviteRow,
+  sanitizeAddrs,
+  CadreInviteRejectedError,
+  CadreInviteUnreachableError,
+  CadreInviteReplyInvalidError,
+  CADRE_INVITE_PROTOCOL,
+  CADRE_INVITE_REJECTION_RETRYABLE,
+  isCadreInviteRejectionCode,
+  type CadreInvitation,
+  type CadreInviteRedeemRequest,
+  type CadreInviteRedeemReply,
+  type CadreInviteAccepted,
+  type CadreInviteRejectionCode,
+  type CadreInviteAddressOutcome,
+  type CadreInviteHandlerOptions,
+  type CadreInviteStore,
+  type RedeemAtMembersOptions,
+  type RedeemInPassesOptions,
+  type RedeemSigner,
+  type RedeemSelfRecord,
+  type CadreInviteRedemption
+} from './cadre-invite-protocol.js';
+// Owner grant redemption transport: the bundle an owner hands out, the wire messages, the
+// member-side handler and the holder-side dialer, and how a redemption fails
+export {
+  OwnerGrantHandler,
+  redeemOwnerGrantAtMembers,
+  redeemOwnerGrantInPasses,
+  signOwnerGrantRequest,
+  verifyOwnerGrantReply,
+  encodeOwnerGrant,
+  decodeOwnerGrant,
+  isWellFormedOwnerGrantRow,
+  OwnerGrantRejectedError,
+  OwnerGrantUnreachableError,
+  OwnerGrantReplyInvalidError,
+  OWNER_GRANT_PROTOCOL,
+  OWNER_GRANT_REJECTION_RETRYABLE,
+  isOwnerGrantRejectionCode,
+  type OwnerGrantBundle,
+  type OwnerGrantRedeemRequest,
+  type OwnerGrantRedeemReply,
+  type OwnerGrantAccepted,
+  type OwnerGrantRejectionCode,
+  type OwnerGrantHandlerOptions,
+  type OwnerGrantStore,
+  type RedeemOwnerGrantAtMembersOptions,
+  type RedeemOwnerGrantInPassesOptions,
+  type OwnerGrantRedemption
+} from './owner-grant-protocol.js';
+// The exchange shape both redemption protocols are built on
+export {
+  MemberRedemptionHandler,
+  dialRedemption,
+  dialRedemptionInPasses,
+  MAX_REDEMPTION_FRAME_BYTES,
+  type MemberRedemptionHandlerOptions,
+  type MemberRedemptionOptions,
+  type MemberRedemptionPassOptions,
+  type MemberRedemption,
+  type RedemptionAddressOutcome,
+  type RedemptionRejection,
+  type RedemptionRefusalFrame
+} from './member-redemption.js';
+// Which machines, and how many addresses of each, an invitation names; how far a cadre invitation reaches
+export {
+  selectCadreInvitationMembers,
+  cadreInvitationReach,
+  CADRE_INVITATION_MAX_ADDRS,
+  CADRE_INVITATION_ADDRS_PER_SIBLING
+} from './invitation-bootstrap.js';
+// The pending-join retry loop behind CadreNode.requestJoin (PendingJoinStatus is in types.ts)
+export { PENDING_JOIN_BACKSTOP_MS, PENDING_JOIN_MAX_BACKOFF_MS, MAX_PENDING_JOIN_MS } from './pending-join-runner.js';
+
+// Strand Formation manager (drives the native transport)
+export {
+  StrandFormationManager,
+  createStrandFormationManager,
+  MEMBERSHIP_INVITE_TTL_MS,
+  MEMBERSHIP_INVITE_UNAVAILABLE_REASON,
+  HOST_STRAND_MUST_BE_RECREATED_REASON,
+  type CadrePeerAddrsSource,
+  type MembershipInviteIssuer,
+  type StrandFormationManagerConfig,
+  type StrandFormationManagerOptions
+} from './strand-formation-manager.js';
+
+// Control-network per-stream protocol guard (which peers may open which protocol)
+export {
+  controlProtocolClasses,
+  type ControlProtocolClass
+} from './control-protocol-guard.js';
+
+// Control-network inbound connection gate (membership defense-in-depth)
+export {
+  createMembershipConnectionGater,
+  PROVISIONAL_ADMISSION_DEADLINE_MS,
+  PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS,
+  MAX_UNAUTHORIZED_RELAY_RESERVATIONS,
+  UnauthorizedReservationBudget,
+  type InboundAdmissionPolicy,
+  type InboundConnectionVerdict
+} from './membership-connection-gater.js';
+
+// Thrown out of `CadreNode.start()` when a `network.relayAddrs` reservation does
+// not land on its first attempt — the fail-fast posture of that config field now
+// that the control node reserves AFTER control-database bring-up (relay-addrs.ts).
+// `UnbindableListenAddressError` is the same posture for the OTHER half of the listen
+// config: a `network.listenAddrs` entry whose transport the node will not have refuses
+// start instead of being silently dropped by libp2p's transport manager.
+//
+// `resolveListenAddrs` and `strandNodeAddrs` are the derivations themselves — what a
+// `NetworkConfig` actually turns into for the control node and for each strand node.
+// Exported so an embedder that hand-writes a `network` block (the React Native and web
+// reference apps) can assert on the resulting SHAPE rather than on its own field names,
+// which is the difference between a test that proves reachability and one that proves a
+// spelling.
+export {
+  RelayReservationFailedError,
+  UnbindableListenAddressError,
+  RELAY_SEARCH_LISTEN_ADDR,
+  resolveListenAddrs
+} from './relay-addrs.js';
+export { strandNodeAddrs, type StrandNodeAddrs } from './strand-network-config.js';
+// STUN for an embedder's WebRTC transport, derived from the relays it already uses: each
+// Sereus relay also answers STUN (`ops/docs/ice-servers.md`).
+export { RELAY_STUN_PORT, relayStunUrl, resolveStunServers, type StunServer } from './relay-stun.js';
+// The circuit-relay SERVER a node runs, and with which init — one resolution shared by the
+// control node and every strand node. Exported alongside the listen derivations above for the
+// same reason: an embedder can assert on what its `network` block resolves to.
+export {
+  resolveRelayServer,
+  PARTY_RELAY_MAX_RESERVATIONS,
+  PARTY_RELAY_RESERVATION_TTL_MS,
+  type ResolvedRelayServer,
+  type ResolvedRelayReservations
+} from './relay-server.js';
+
+// Relay reservation via the bare `/p2p-circuit` search listener — the one route
+// every control node takes; `network.relayAddrs` is its fail-fast posture
+// (see relay-reservation.ts)
+export {
+  circuitMultiaddrs,
+  superviseRelayReservation,
+  DEFAULT_RELAY_RESERVE_TIMEOUT_MS,
+  DEFAULT_RELAY_RESERVE_POLL_MS,
+  DEFAULT_RELAY_CHECK_MS,
+  DEFAULT_RELAY_MIN_BACKOFF_MS,
+  DEFAULT_RELAY_MAX_BACKOFF_MS,
+  type RelayReservationStatus,
+  type RelayReservationState,
+  type RelayReserveOptions,
+  type RelayReservationSupervisor,
+  type RelayReservationSupervisorOptions
+} from './relay-reservation.js';
+
+// Connection-path diagnostics (relayed vs direct classification + summary)
+export {
+  classifyTransport,
+  summarizeConnectionPaths,
+  emptyConnectionPathSummary,
+  DEFAULT_SETTLE_WINDOW_MS,
+  type ConnectionPathKind,
+  type ConnectionTransport,
+  type ConnectionPath,
+  type ConnectionPathSummary,
+  type ConnectionLike
+} from './diagnostics/connection-path.js';