@serfab/cadre-core 1.16.0 → 1.18.0

package/src/strand-move.ts

@@ -21,9 +21,9 @@
  * Built over `CadreNode`'s public surface, so `cadre-node.ts` does not grow by the feature.
  */
 import debug from 'debug';
-import { sign } from '@optimystic/quereus-plugin-crypto';
 import type { PersistedNetworkState } from '@optimystic/db-p2p';
 import type { CadreNode } from './cadre-node.js';
+import type { OwnerSign } from './owner-signer.js';
 import {
 	isPendingJoinConflict,
 	isStrandIdConflict,
@@ -98,10 +98,10 @@ export interface StrandMoveReport {
 	pendingJoinsMoved: number;
 }
 
-/** {@link adoptStrandBundle} refused before any write: the running node's key is not an owner of its party. */
+/** {@link adoptStrandBundle} refused before any write: the running node's owner key is not an owner of its party. */
 export class StrandMoveNotOwnerError extends Error {
 	constructor(readonly partyId: string) {
-		super(`Cannot adopt strands into party ${partyId}: this node's key is not one of its owners, and every re-seated row is owner-signed`);
+		super(`Cannot adopt strands into party ${partyId}: this node's owner key is not one of its owners, and every re-seated row is owner-signed`);
 		this.name = 'StrandMoveNotOwnerError';
 	}
 }
@@ -201,10 +201,11 @@ async function exportFormationInvites(database: ControlDatabase, now: number): P
 }
 
 /**
- * Seat `bundle` in the running node's party, every row owner-signed by the node's own identity
- * key. Refuses up front, with a typed error and no write, when that key is not an owner of the
- * party ({@link StrandMoveNotOwnerError}) or the bundle came from this very party
- * ({@link StrandMoveSamePartyError}).
+ * Seat `bundle` in the running node's party, every row owner-signed through the node's owner
+ * signer (`CadreNode.getOwnerSigner`, wired here by `wireOwnKeyIfOwner` when it is not yet),
+ * in one approval for the whole bundle. Refuses up front, with a typed error and no write, when
+ * that signer's key is not an owner of the party ({@link StrandMoveNotOwnerError}) or the
+ * bundle came from this very party ({@link StrandMoveSamePartyError}).
  *
  * Strands first, then the invitations, then the pending joins. Every write is idempotent (a row
  * already present with the same content is skipped and counted as moved), so the same bundle
@@ -221,11 +222,28 @@ export async function adoptStrandBundle(node: CadreNode, bundle: StrandBundle):
 	if (bundle.partyId === node.partyId) {
 		throw new StrandMoveSamePartyError(node.partyId);
 	}
-	if (!(await node.wireOwnKeyIfOwner())) {
+	const owner = (await node.wireOwnKeyIfOwner()) ? node.getOwnerSigner() : null;
+	if (owner === null) {
 		throw new StrandMoveNotOwnerError(node.partyId);
 	}
-	const owner = node.getIdentityOwnerKey();
-	const signer: OwnerSigner = { ownerKey: owner.publicKeyB64, signMessage: signMessageWith(owner.privateKeyB64) };
+	const action = `Move ${bundle.strands.length} strand(s) from the cadre ${bundle.partyId} into this one`;
+	return await owner.approve({ partyId: node.partyId, action }, (sign) =>
+		adoptUnderApproval(node, database, bundle, { ownerKey: owner.publicKey, sign }));
+}
+
+/** An open owner approval: the key every row is written under, and the approval's `sign`. */
+interface OwnerApproval {
+	ownerKey: string;
+	sign: OwnerSign;
+}
+
+/** {@link adoptStrandBundle}'s writes, every one signed inside the one approval `approval`. */
+async function adoptUnderApproval(
+	node: CadreNode,
+	database: ControlDatabase,
+	bundle: StrandBundle,
+	approval: OwnerApproval
+): Promise<StrandMoveReport> {
 	const report: StrandMoveReport = {
 		fromPartyId: bundle.partyId,
 		moved: [],
@@ -236,15 +254,15 @@ export async function adoptStrandBundle(node: CadreNode, bundle: StrandBundle):
 		pendingJoinsMoved: 0
 	};
 	for (const entry of bundle.strands) {
-		await adoptStrand(node, database, signer, entry, report);
+		await adoptStrand(node, database, approval, entry, report);
 	}
 	const settled = settledStrands(report);
 	const now = Date.now();
 	for (const invite of bundle.formationInvites) {
-		await adoptFormationInvite(node, database, invite, settled, report, now);
+		await adoptFormationInvite(node, database, approval.sign, invite, settled, report, now);
 	}
 	for (const join of bundle.pendingJoins) {
-		await adoptPendingJoin(database, signer, join, report);
+		await adoptPendingJoin(database, approval, join, report);
 	}
 	log('adopt(%s ← %s): %d moved, %d refused, %d failed; %d invitation(s) moved, %d dropped; %d pending join(s)',
 		node.partyId, bundle.partyId, report.moved.length, report.refused.length, report.failed.length,
@@ -252,11 +270,6 @@ export async function adoptStrandBundle(node: CadreNode, bundle: StrandBundle):
 	return report;
 }
 
-interface OwnerSigner {
-	ownerKey: string;
-	signMessage: (message: Uint8Array) => string;
-}
-
 /** The strands an adoption has decided on, by outcome, for the invitations bound to them. */
 interface SettledStrands {
 	moved: Set<string>;
@@ -271,8 +284,8 @@ function settledStrands(report: StrandMoveReport): SettledStrands {
 }
 
 /**
- * Seat one strand, in the order the adopting node's strand watcher demands. The watcher polls
- * `Strand` and `JoinedStrand` every five seconds and launches, or offers, a new row at once; a
+ * Seat one strand, in the order the adopting node's strand watcher demands. The watcher runs
+ * on every change to `Strand` and `JoinedStrand` and launches, or offers, a new row at once; a
  * closed strand's founder launch resolves the party key and, finding none, mints a fresh one,
  * which would found the strand a second time under a stranger's identity. So the party key is
  * seated before the row, and the strand's peers (its saved routing table and carried addresses)
@@ -282,7 +295,7 @@ function settledStrands(report: StrandMoveReport): SettledStrands {
 async function adoptStrand(
 	node: CadreNode,
 	database: ControlDatabase,
-	signer: OwnerSigner,
+	approval: OwnerApproval,
 	entry: StrandBundleEntry,
 	report: StrandMoveReport
 ): Promise<void> {
@@ -297,12 +310,15 @@ async function adoptStrand(
 		}
 		await seatStrandPeers(node, entry);
 		if (entry.partyKey !== null) {
-			await node.ensureStrandPartyKey(strandId, entry.partyKey);
+			await node.ensureStrandPartyKey(strandId, entry.partyKey, approval.sign);
 		}
 		if (entry.kind === 'own') {
-			await node.publishStrand(strandId, entry.row.Type, entry.row.MemberPrivateKey ?? undefined);
+			// NOTE: with the party key seated first, a closed strand's founding transaction is refused
+			// on `StrandPartyKey.Id` and written again without a key: a local refusal, no extra commit.
+			// If moves of many closed strands get slow, let publishStrand take a known party key.
+			await node.publishStrand(strandId, entry.row.Type, entry.row.MemberPrivateKey ?? undefined, approval.sign);
 		} else {
-			await seatJoinedStrand(database, signer, entry.row, live.joined);
+			await seatJoinedStrand(database, approval, entry.row, live.joined);
 		}
 		report.moved.push(strandId);
 	} catch (error) {
@@ -377,7 +393,7 @@ async function seatStrandPeers(node: CadreNode, entry: StrandBundleEntry): Promi
  */
 async function seatJoinedStrand(
 	database: ControlDatabase,
-	signer: OwnerSigner,
+	approval: OwnerApproval,
 	row: StrandBundleEntry['row'],
 	existing: StrandRow | null
 ): Promise<void> {
@@ -385,7 +401,7 @@ async function seatJoinedStrand(
 		return;
 	}
 	try {
-		await database.insertJoinedStrand(row, signer.ownerKey, signer.signMessage);
+		await database.insertJoinedStrand(row, approval.ownerKey, approval.sign);
 	} catch (error) {
 		if (!isStrandIdConflict(error, 'JoinedStrand')) {
 			throw error;
@@ -412,6 +428,7 @@ async function seatJoinedStrand(
 async function adoptFormationInvite(
 	node: CadreNode,
 	database: ControlDatabase,
+	sign: OwnerSign,
 	invite: FormationInviteEntry,
 	settled: SettledStrands,
 	report: StrandMoveReport,
@@ -434,7 +451,7 @@ async function adoptFormationInvite(
 				expiresAtMs: invite.expiresAtMs ?? undefined,
 				totalUses: invite.usesLeft ?? undefined,
 				strandId: invite.strandId ?? undefined
-			});
+			}, sign);
 		}
 		report.invitationsMoved += 1;
 	} catch (error) {
@@ -464,15 +481,15 @@ async function adoptFormationInvite(
  */
 async function adoptPendingJoin(
 	database: ControlDatabase,
-	signer: OwnerSigner,
+	approval: OwnerApproval,
 	join: PendingJoin,
 	report: StrandMoveReport
 ): Promise<void> {
 	const { StampId: _stampId, outcome, ...request } = join;
 	try {
-		const live = await seatJoinRequest(database, signer, request);
+		const live = await seatJoinRequest(database, approval, request);
 		if (live !== null && outcome !== null && live.outcome === null) {
-			await database.recordJoinOutcome(live, outcome, signer.ownerKey, signer.signMessage);
+			await database.recordJoinOutcome(live, outcome, approval.ownerKey, approval.sign);
 		}
 		report.pendingJoinsMoved += 1;
 	} catch (error) {
@@ -487,9 +504,9 @@ async function adoptPendingJoin(
  * own ask, left alone) or a dismissed one whose retired stamp is still held until the reap
  * pass (the party chose not to have it).
  */
-async function seatJoinRequest(database: ControlDatabase, signer: OwnerSigner, request: JoinRequestFields): Promise<PendingJoin | null> {
+async function seatJoinRequest(database: ControlDatabase, approval: OwnerApproval, request: JoinRequestFields): Promise<PendingJoin | null> {
 	try {
-		return await database.insertJoinRequest(request, signer.ownerKey, signer.signMessage);
+		return await database.insertJoinRequest(request, approval.ownerKey, approval.sign);
 	} catch (error) {
 		if (!isPendingJoinConflict(error)) {
 			throw error;
@@ -557,7 +574,7 @@ function isOpenJoin(join: PendingJoin, nowMs: number): boolean {
 	return join.outcome === null && nowMs < join.ExpiresAt;
 }
 
-/** Content only: `Type` and the read secret. `FounderOwnerKey` is provenance, and a moved strand's changes. */
+/** Content only: `Type` and the read secret. The founder columns are provenance, and a moved strand's change. */
 function sameStrandContent(live: StrandRow, desired: StrandBundleEntry['row']): boolean {
 	return live.Type === desired.Type && (live.MemberPrivateKey ?? null) === (desired.MemberPrivateKey ?? null);
 }
@@ -575,11 +592,6 @@ function requireControlDatabase(node: CadreNode, action: string): ControlDatabas
 	return database;
 }
 
-function signMessageWith(privateKeyB64: string): (message: Uint8Array) => string {
-	return (message: Uint8Array): string =>
-		sign(message, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url') as string;
-}
-
 function errorText(error: unknown): string {
 	return error instanceof Error ? error.message : String(error);
 }

package/src/strand-peer-redial.ts

@@ -234,9 +234,8 @@ class StrandPeerRedialLoop implements StrandPeerRedial {
    *
    * NOTE: a round whose dials failed within milliseconds (a relay connection that is still
    * closing, the member's relay reservation not back yet) waits as long as one whose dials ran
-   * out their budget. In `joiner-first-commit-over-slow-relay`'s third arm that first wait is what
-   * leaves the joiner writable with no member connected. If reconnecting within seconds of a cut
-   * ever matters, retry a round that failed that fast after a short delay instead.
+   * out their budget. If reconnecting within seconds of a cut ever matters, retry a round that
+   * failed that fast after a short delay instead.
    *
    * NOTE: one such fast failure is `ConnectionClosedError: The connection muxer is "closed"`. A
    * relay that aborts its connection to this node cannot tell it so (`@libp2p/websockets`'