@serfab/quereus-plugin-sereus 0.8.0 → 0.8.1

package/dist/strand-schema.d.ts

@@ -18,7 +18,7 @@
  *
  * Crypto idiom (matches `schemas/control.qsql` and the sApp RBAC fixture
  * `packages/integration-tests/fixtures/simple-sapp.qsql`): every signed write
- * proves itself with `verify(digest(<concatenated payload>, 'sha256', 'utf8'),
+ * proves itself with `verify(digest(<single joined payload>),
  * <signature>, <pubkey>, 'ed25519')`. Member keys are ed25519, so the explicit
  * curve arg is REQUIRED (verify() otherwise defaults to secp256k1).
  *
@@ -27,4 +27,4 @@
  * the founding `Authority`/`Member`, and the invite/peer flows is owned by
  * `strand-membership-lifecycle-population`.
  */
-export declare const STRAND_SCHEMA = "    table Header (\n        Id text,    -- UUID of this network - generated at inception - immutable\n\n        -- Types: 'o' = Open, 'c' = Closed\n        -- Any peers can join an open network, but only members can join a closed network\n        -- Open can still control writes in the app, but only Closed prevents reads\n        Type text check (Type in ('o', 'c')),\n\n        -- The app that this strand faciliates - public key from author to prevent tampering\n        sAppId text,\n\n        -- The version of the sApp that this strand faciliates\n        sAppVersion text,\n\n        -- The schema of the sApp that this strand faciliates\n        sAppSchema text,\n\n        -- The author's signature on the schema to guarantee authorship\n        sAppSignature text,\n\n        -- The engine (rules logic system) that is assumed to manage this strand\n        Engine text,\n\n        -- The version of the engine that is assumed to manage this strand\n        EngineVersion text,\n\n        primary key (/* empty - singleton */),\n        constraint InsertOnly check on update, delete (false),  -- One-time insert only for now - TODO: revisit for versioning\n    );\n\n    -- An invitation to join a strand as a member\n    table Invite (\n        Key text primary key,\n        Expiration datetime null,\n        -- TODO: ability to deactivate?\n        constraint InsertOnly check on update, delete (false),\n        constraint OnlyClosed check (\n            exists (select 1 from Header H where H.Type = 'c')\n        ),\n        constraint InviteValid check on insert (\n            -- Can only be inserted by an authority,\n            exists (select 1 from Authority A\n                where A.MemberKey = context.AuthorityKey\n                    and verify(digest(new.Key || '|' || coalesce(new.Expiration, ''), 'sha256', 'utf8'), context.AuthoritySignature, A.MemberKey, 'ed25519')\n            )\n                -- and must also prove invite private key held by issuing authority\n                and verify(digest(new.Key || '|' || coalesce(new.Expiration, ''), 'sha256', 'utf8'), context.InviteSignature, new.Key, 'ed25519')\n        )\n    ) with context (AuthorityKey text null, AuthoritySignature text null, InviteSignature text null);\n\n    -- Invite [InviteKey] has been used to add [MemberKey] as a member\n    table ConsumedInvite (\n        InviteKey text primary key,\n        MemberKey text,\n        constraint InsertOnly check on update, delete (false),\n        constraint InviteExists check (exists (select 1 from Invite I where I.Key = new.InviteKey)),\n        constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),\n        constraint ValidUsage check on insert (\n            exists (select 1 from Invite I where I.Key = new.InviteKey and verify(digest(new.InviteKey || '|' || new.MemberKey, 'sha256', 'utf8'), context.InviteSignature, new.InviteKey, 'ed25519'))\n        ),\n        constraint MemberValid check (exists (select 1 from Member M where M.Key = new.MemberKey))\n    ) with context (InviteSignature text null);\n\n    -- A party in the closed strand network\n    table Member (\n        Key text primary key,\n        constraint NoUpdate check on update (false),\n        constraint OnlyClosed check (\n            exists (select 1 from Header H where H.Type = 'c')\n        ),\n        constraint Authorized check on insert (\n            -- There are no other records - first member needs no authorization\n            (select count(1) from Member) <= 1\n\n                -- or added directly by authority\n                or exists (\n                    select 1 from Authority A\n                        where A.MemberKey = context.AuthorityKey\n                            and verify(digest(new.Key, 'sha256', 'utf8'), context.AuthoritySignature, A.MemberKey, 'ed25519')\n                )\n\n                -- or added by invite\n                or exists (\n                    select 1 from ConsumedInvite CI where CI.MemberKey = new.Key\n                )\n        ),\n        -- TODO: handle member revocation constraint\n    ) with context (AuthorityKey text null, AuthoritySignature text null);\n\n    -- A member-associated peer (node)\n    table MemberPeer (\n        MemberKey text,\n        PeerId text,\n        primary key (MemberKey, PeerId),\n        constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),\n        constraint Authorized check (\n            verify(\n                digest(coalesce(new.MemberKey, old.MemberKey) || '|' || coalesce(new.PeerId, old.PeerId), 'sha256', 'utf8'),\n                context.Signature,\n                coalesce(new.MemberKey, old.MemberKey),\n                'ed25519'\n            )\n        ),\n    ) with context (Signature text null);\n\n    -- An authority is a member that can issue invites, authorize members, and rotate authorities\n    table Authority (\n        MemberKey text primary key,\n        constraint OnlyClosed check (\n            exists (select 1 from Header H where H.Type = 'c')\n        ),\n        constraint Authorized check (\n            -- There are no existing records - first authority needs no authorization\n            (select count(1) from Authority) <= 1\n\n                -- or authorized by this former authority\n                or (\n                    old.MemberKey is not null\n                        and old.MemberKey = context.AuthorityKey\n                        and verify(digest(old.MemberKey, 'sha256', 'utf8'), context.Signature, old.MemberKey, 'ed25519')\n                )\n\n                -- or authorized by another existing authority\n                or exists (\n                    select 1 from Authority A\n                        where A.MemberKey = context.AuthorityKey\n                            and verify(digest(coalesce(new.MemberKey, old.MemberKey), 'sha256', 'utf8'), context.Signature, A.MemberKey, 'ed25519')\n                )\n        )\n    ) with context (AuthorityKey text null, Signature text null);\n";
+export declare const STRAND_SCHEMA = "    table Header (\n        Id text,    -- UUID of this network - generated at inception - immutable\n\n        -- Types: 'o' = Open, 'c' = Closed\n        -- Any peers can join an open network, but only members can join a closed network\n        -- Open can still control writes in the app, but only Closed prevents reads\n        Type text check (Type in ('o', 'c')),\n\n        -- The app that this strand faciliates - public key from author to prevent tampering\n        sAppId text,\n\n        -- The version of the sApp that this strand faciliates\n        sAppVersion text,\n\n        -- The schema of the sApp that this strand faciliates\n        sAppSchema text,\n\n        -- The author's signature on the schema to guarantee authorship\n        sAppSignature text,\n\n        -- The engine (rules logic system) that is assumed to manage this strand\n        Engine text,\n\n        -- The version of the engine that is assumed to manage this strand\n        EngineVersion text,\n\n        primary key (/* empty - singleton */),\n        constraint InsertOnly check on update, delete (false),  -- One-time insert only for now - TODO: revisit for versioning\n    );\n\n    -- An invitation to join a strand as a member\n    table Invite (\n        Key text primary key,\n        Expiration datetime null,\n        -- TODO: ability to deactivate?\n        constraint InsertOnly check on update, delete (false),\n        constraint OnlyClosed check (\n            exists (select 1 from Header H where H.Type = 'c')\n        ),\n        constraint InviteValid check on insert (\n            -- Can only be inserted by an authority,\n            exists (select 1 from Authority A\n                where A.MemberKey = context.AuthorityKey\n                    and verify(digest(new.Key || '|' || coalesce(new.Expiration, '')), context.AuthoritySignature, A.MemberKey, 'ed25519')\n            )\n                -- and must also prove invite private key held by issuing authority\n                and verify(digest(new.Key || '|' || coalesce(new.Expiration, '')), context.InviteSignature, new.Key, 'ed25519')\n        )\n    ) with context (AuthorityKey text null, AuthoritySignature text null, InviteSignature text null);\n\n    -- Invite [InviteKey] has been used to add [MemberKey] as a member\n    table ConsumedInvite (\n        InviteKey text primary key,\n        MemberKey text,\n        constraint InsertOnly check on update, delete (false),\n        constraint InviteExists check (exists (select 1 from Invite I where I.Key = new.InviteKey)),\n        constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),\n        constraint ValidUsage check on insert (\n            exists (select 1 from Invite I where I.Key = new.InviteKey and verify(digest(new.InviteKey || '|' || new.MemberKey), context.InviteSignature, new.InviteKey, 'ed25519'))\n        ),\n        -- An invite with a non-null Expiration may only be consumed while it is still\n        -- in the future. context.Now is the canonical-datetime \"now\" supplied by the\n        -- consumeInvite writer (same canonicalDatetime() transform used to store\n        -- Invite.Expiration), so both sides of the comparison are byte-identical\n        -- canonical strings and the lexical \">\" comparison orders chronologically. A\n        -- null Expiration never expires. Mirrors CadreControl.FormationUsage's\n        -- \"FI.ExpiresAt is null or FI.ExpiresAt > context.Now\" gate.\n        constraint NotExpired check on insert (\n            exists (select 1 from Invite I where I.Key = new.InviteKey and (I.Expiration is null or I.Expiration > context.Now))\n        ),\n        constraint MemberValid check (exists (select 1 from Member M where M.Key = new.MemberKey))\n    ) with context (InviteSignature text null, Now datetime null);\n\n    -- A party in the closed strand network\n    table Member (\n        Key text primary key,\n        constraint NoUpdate check on update (false),\n        constraint OnlyClosed check (\n            exists (select 1 from Header H where H.Type = 'c')\n        ),\n        constraint Authorized check on insert (\n            -- There are no other records - first member needs no authorization\n            (select count(1) from Member) <= 1\n\n                -- or added directly by authority\n                or exists (\n                    select 1 from Authority A\n                        where A.MemberKey = context.AuthorityKey\n                            and verify(digest(new.Key), context.AuthoritySignature, A.MemberKey, 'ed25519')\n                )\n\n                -- or added by invite\n                or exists (\n                    select 1 from ConsumedInvite CI where CI.MemberKey = new.Key\n                )\n        ),\n        -- TODO: handle member revocation constraint\n    ) with context (AuthorityKey text null, AuthoritySignature text null);\n\n    -- A member-associated peer (node)\n    table MemberPeer (\n        MemberKey text,\n        PeerId text,\n        primary key (MemberKey, PeerId),\n        constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),\n        constraint Authorized check on insert, update, delete (\n            verify(\n                digest(coalesce(new.MemberKey, old.MemberKey) || '|' || coalesce(new.PeerId, old.PeerId)),\n                context.Signature,\n                coalesce(new.MemberKey, old.MemberKey),\n                'ed25519'\n            )\n        ),\n    ) with context (Signature text null);\n\n    -- An authority is a member that can issue invites, authorize members, and rotate authorities\n    table Authority (\n        MemberKey text primary key,\n        constraint OnlyClosed check (\n            exists (select 1 from Header H where H.Type = 'c')\n        ),\n        constraint Authorized check on insert, update, delete (\n            -- There are no existing records - first authority needs no authorization\n            (select count(1) from Authority) <= 1\n\n                -- or authorized by this former authority\n                or (\n                    old.MemberKey is not null\n                        and old.MemberKey = context.AuthorityKey\n                        and verify(digest(old.MemberKey), context.Signature, old.MemberKey, 'ed25519')\n                )\n\n                -- or authorized by another existing authority\n                or exists (\n                    select 1 from Authority A\n                        where A.MemberKey = context.AuthorityKey\n                            and verify(digest(coalesce(new.MemberKey, old.MemberKey)), context.Signature, A.MemberKey, 'ed25519')\n                )\n        )\n    ) with context (AuthorityKey text null, Signature text null);\n";

package/dist/strand-schema.js

@@ -18,7 +18,7 @@
  *
  * Crypto idiom (matches `schemas/control.qsql` and the sApp RBAC fixture
  * `packages/integration-tests/fixtures/simple-sapp.qsql`): every signed write
- * proves itself with `verify(digest(<concatenated payload>, 'sha256', 'utf8'),
+ * proves itself with `verify(digest(<single joined payload>),
  * <signature>, <pubkey>, 'ed25519')`. Member keys are ed25519, so the explicit
  * curve arg is REQUIRED (verify() otherwise defaults to secp256k1).
  *
@@ -70,10 +70,10 @@ export const STRAND_SCHEMA = `    table Header (
             -- Can only be inserted by an authority,
             exists (select 1 from Authority A
                 where A.MemberKey = context.AuthorityKey
-                    and verify(digest(new.Key || '|' || coalesce(new.Expiration, ''), 'sha256', 'utf8'), context.AuthoritySignature, A.MemberKey, 'ed25519')
+                    and verify(digest(new.Key || '|' || coalesce(new.Expiration, '')), context.AuthoritySignature, A.MemberKey, 'ed25519')
             )
                 -- and must also prove invite private key held by issuing authority
-                and verify(digest(new.Key || '|' || coalesce(new.Expiration, ''), 'sha256', 'utf8'), context.InviteSignature, new.Key, 'ed25519')
+                and verify(digest(new.Key || '|' || coalesce(new.Expiration, '')), context.InviteSignature, new.Key, 'ed25519')
         )
     ) with context (AuthorityKey text null, AuthoritySignature text null, InviteSignature text null);
 
@@ -85,10 +85,20 @@ export const STRAND_SCHEMA = `    table Header (
         constraint InviteExists check (exists (select 1 from Invite I where I.Key = new.InviteKey)),
         constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),
         constraint ValidUsage check on insert (
-            exists (select 1 from Invite I where I.Key = new.InviteKey and verify(digest(new.InviteKey || '|' || new.MemberKey, 'sha256', 'utf8'), context.InviteSignature, new.InviteKey, 'ed25519'))
+            exists (select 1 from Invite I where I.Key = new.InviteKey and verify(digest(new.InviteKey || '|' || new.MemberKey), context.InviteSignature, new.InviteKey, 'ed25519'))
+        ),
+        -- An invite with a non-null Expiration may only be consumed while it is still
+        -- in the future. context.Now is the canonical-datetime "now" supplied by the
+        -- consumeInvite writer (same canonicalDatetime() transform used to store
+        -- Invite.Expiration), so both sides of the comparison are byte-identical
+        -- canonical strings and the lexical ">" comparison orders chronologically. A
+        -- null Expiration never expires. Mirrors CadreControl.FormationUsage's
+        -- "FI.ExpiresAt is null or FI.ExpiresAt > context.Now" gate.
+        constraint NotExpired check on insert (
+            exists (select 1 from Invite I where I.Key = new.InviteKey and (I.Expiration is null or I.Expiration > context.Now))
         ),
         constraint MemberValid check (exists (select 1 from Member M where M.Key = new.MemberKey))
-    ) with context (InviteSignature text null);
+    ) with context (InviteSignature text null, Now datetime null);
 
     -- A party in the closed strand network
     table Member (
@@ -105,7 +115,7 @@ export const STRAND_SCHEMA = `    table Header (
                 or exists (
                     select 1 from Authority A
                         where A.MemberKey = context.AuthorityKey
-                            and verify(digest(new.Key, 'sha256', 'utf8'), context.AuthoritySignature, A.MemberKey, 'ed25519')
+                            and verify(digest(new.Key), context.AuthoritySignature, A.MemberKey, 'ed25519')
                 )
 
                 -- or added by invite
@@ -122,9 +132,9 @@ export const STRAND_SCHEMA = `    table Header (
         PeerId text,
         primary key (MemberKey, PeerId),
         constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),
-        constraint Authorized check (
+        constraint Authorized check on insert, update, delete (
             verify(
-                digest(coalesce(new.MemberKey, old.MemberKey) || '|' || coalesce(new.PeerId, old.PeerId), 'sha256', 'utf8'),
+                digest(coalesce(new.MemberKey, old.MemberKey) || '|' || coalesce(new.PeerId, old.PeerId)),
                 context.Signature,
                 coalesce(new.MemberKey, old.MemberKey),
                 'ed25519'
@@ -138,7 +148,7 @@ export const STRAND_SCHEMA = `    table Header (
         constraint OnlyClosed check (
             exists (select 1 from Header H where H.Type = 'c')
         ),
-        constraint Authorized check (
+        constraint Authorized check on insert, update, delete (
             -- There are no existing records - first authority needs no authorization
             (select count(1) from Authority) <= 1
 
@@ -146,14 +156,14 @@ export const STRAND_SCHEMA = `    table Header (
                 or (
                     old.MemberKey is not null
                         and old.MemberKey = context.AuthorityKey
-                        and verify(digest(old.MemberKey, 'sha256', 'utf8'), context.Signature, old.MemberKey, 'ed25519')
+                        and verify(digest(old.MemberKey), context.Signature, old.MemberKey, 'ed25519')
                 )
 
                 -- or authorized by another existing authority
                 or exists (
                     select 1 from Authority A
                         where A.MemberKey = context.AuthorityKey
-                            and verify(digest(coalesce(new.MemberKey, old.MemberKey), 'sha256', 'utf8'), context.Signature, A.MemberKey, 'ed25519')
+                            and verify(digest(coalesce(new.MemberKey, old.MemberKey)), context.Signature, A.MemberKey, 'ed25519')
                 )
         )
     ) with context (AuthorityKey text null, Signature text null);

package/dist/strand-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-schema.js","sourceRoot":"","sources":["../src/strand-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkI5B,CAAC"}
+{"version":3,"file":"strand-schema.js","sourceRoot":"","sources":["../src/strand-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4I5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serfab/quereus-plugin-sereus",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "module",
   "description": "Quereus plugin that connects to a Sereus strand for SQL access",
   "main": "dist/index.js",
@@ -67,13 +67,13 @@
     "@libp2p/circuit-relay-v2": "^4.1.3",
     "@libp2p/interface": "^3.1.0",
     "@libp2p/websockets": "^10.1.3",
-    "@optimystic/db-core": "^0.13.5",
-    "@optimystic/db-p2p": "^0.13.5",
-    "@optimystic/db-p2p-storage-fs": "^0.13.5",
-    "@optimystic/db-p2p-storage-web": "^0.13.5",
-    "@optimystic/quereus-plugin-crypto": "^0.13.5",
-    "@optimystic/quereus-plugin-optimystic": "^0.13.5",
-    "@quereus/quereus": "^3.2.1",
+    "@optimystic/db-core": "^0.14.1",
+    "@optimystic/db-p2p": "^0.14.1",
+    "@optimystic/db-p2p-storage-fs": "^0.14.1",
+    "@optimystic/db-p2p-storage-web": "^0.14.1",
+    "@optimystic/quereus-plugin-crypto": "^0.14.1",
+    "@optimystic/quereus-plugin-optimystic": "^0.14.1",
+    "@quereus/quereus": "^4.2.1",
     "debug": "^4.4.3"
   },
   "quereus": {

package/src/compose-strand.ts

@@ -1,5 +1,5 @@
 import debug from 'debug';
-import type { Database } from '@quereus/quereus';
+import type { Database, VTablePluginInfo, FunctionPluginInfo, CollationPluginInfo } from '@quereus/quereus';
 import optimysticPlugin from '@optimystic/quereus-plugin-optimystic/plugin';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
@@ -27,9 +27,9 @@ interface CollectionFactory {
  */
 interface OptimysticPluginResult {
 	collectionFactory: CollectionFactory;
-	vtables: Array<{ name: string; module: unknown; auxData: unknown }>;
-	functions: Array<{ schema: unknown }>;
-	collations?: Array<{ name: string; func: unknown; normalizer?: unknown }>;
+	vtables: VTablePluginInfo[];
+	functions: FunctionPluginInfo[];
+	collations?: CollationPluginInfo[];
 	/**
 	 * Hydrate Quereus's in-memory catalog from persisted optimystic vtab schemas.
 	 * Must run BEFORE `apply schema App;` on a warm restart so the declarative
@@ -43,9 +43,9 @@ interface OptimysticPluginResult {
 
 /** Registration shape shared by the crypto and optimystic plugin results. */
 interface PluginRegistrations {
-	vtables?: Array<{ name: string; module: unknown; auxData: unknown }>;
-	functions?: Array<{ schema: unknown }>;
-	collations?: Array<{ name: string; func: unknown; normalizer?: unknown }>;
+	vtables?: VTablePluginInfo[];
+	functions?: FunctionPluginInfo[];
+	collations?: CollationPluginInfo[];
 }
 
 /**
@@ -57,13 +57,13 @@ interface PluginRegistrations {
  */
 export function applyRegistrations(db: Database, result: PluginRegistrations): void {
 	for (const vtable of result.vtables ?? []) {
-		db.registerModule(vtable.name, vtable.module as any, vtable.auxData);
+		db.registerModule(vtable.name, vtable.module, vtable.auxData);
 	}
 	for (const func of result.functions ?? []) {
-		db.registerFunction(func.schema as any);
+		db.registerFunction(func.schema);
 	}
 	for (const collation of result.collations ?? []) {
-		db.registerCollation(collation.name, collation.func as any, collation.normalizer as any);
+		db.registerCollation(collation.name, collation.func, collation.normalizer);
 	}
 }
 
@@ -185,7 +185,7 @@ export async function composeStrand(
 	const pluginResult = optimysticPlugin(
 		db,
 		pluginConfig as unknown as Parameters<typeof optimysticPlugin>[1],
-	) as OptimysticPluginResult;
+	) as unknown as OptimysticPluginResult;
 	applyRegistrations(db, pluginResult);
 	log('Registered optimystic vtables and functions');
 

package/src/connect-browser.ts

@@ -1,4 +1,4 @@
-import type { Database } from '@quereus/quereus';
+import type { Database, VTablePluginInfo, FunctionPluginInfo, CollationPluginInfo } from '@quereus/quereus';
 import cryptoPlugin from '@optimystic/quereus-plugin-crypto/plugin';
 import { createLibp2pNode } from '@optimystic/db-p2p/rn';
 import { webSockets } from '@libp2p/websockets';
@@ -10,9 +10,9 @@ import { composeStrand, applyRegistrations } from './compose-strand.js';
 
 /** The subset of the crypto plugin result we register inline in the browser. */
 interface CryptoPluginResult {
-	vtables: Array<{ name: string; module: unknown; auxData: unknown }>;
-	functions: Array<{ schema: unknown }>;
-	collations: Array<{ name: string; func: unknown; normalizer?: unknown }>;
+	vtables: VTablePluginInfo[];
+	functions: FunctionPluginInfo[];
+	collations: CollationPluginInfo[];
 }
 
 /**
@@ -32,7 +32,7 @@ export async function connectToStrandBrowser(
 ): Promise<SereusPluginResult> {
 	return composeStrand(db, options, {
 		registerCrypto(database) {
-			applyRegistrations(database, cryptoPlugin(database, {}) as CryptoPluginResult);
+			applyRegistrations(database, cryptoPlugin(database, {}) as unknown as CryptoPluginResult);
 		},
 		async resolveStorage({ strandId, resolvedTransactor, requestedStorage }) {
 			if (requestedStorage) return requestedStorage;

package/src/strand-schema.ts

@@ -18,7 +18,7 @@
  *
  * Crypto idiom (matches `schemas/control.qsql` and the sApp RBAC fixture
  * `packages/integration-tests/fixtures/simple-sapp.qsql`): every signed write
- * proves itself with `verify(digest(<concatenated payload>, 'sha256', 'utf8'),
+ * proves itself with `verify(digest(<single joined payload>),
  * <signature>, <pubkey>, 'ed25519')`. Member keys are ed25519, so the explicit
  * curve arg is REQUIRED (verify() otherwise defaults to secp256k1).
  *
@@ -70,10 +70,10 @@ export const STRAND_SCHEMA = `    table Header (
             -- Can only be inserted by an authority,
             exists (select 1 from Authority A
                 where A.MemberKey = context.AuthorityKey
-                    and verify(digest(new.Key || '|' || coalesce(new.Expiration, ''), 'sha256', 'utf8'), context.AuthoritySignature, A.MemberKey, 'ed25519')
+                    and verify(digest(new.Key || '|' || coalesce(new.Expiration, '')), context.AuthoritySignature, A.MemberKey, 'ed25519')
             )
                 -- and must also prove invite private key held by issuing authority
-                and verify(digest(new.Key || '|' || coalesce(new.Expiration, ''), 'sha256', 'utf8'), context.InviteSignature, new.Key, 'ed25519')
+                and verify(digest(new.Key || '|' || coalesce(new.Expiration, '')), context.InviteSignature, new.Key, 'ed25519')
         )
     ) with context (AuthorityKey text null, AuthoritySignature text null, InviteSignature text null);
 
@@ -85,10 +85,20 @@ export const STRAND_SCHEMA = `    table Header (
         constraint InviteExists check (exists (select 1 from Invite I where I.Key = new.InviteKey)),
         constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),
         constraint ValidUsage check on insert (
-            exists (select 1 from Invite I where I.Key = new.InviteKey and verify(digest(new.InviteKey || '|' || new.MemberKey, 'sha256', 'utf8'), context.InviteSignature, new.InviteKey, 'ed25519'))
+            exists (select 1 from Invite I where I.Key = new.InviteKey and verify(digest(new.InviteKey || '|' || new.MemberKey), context.InviteSignature, new.InviteKey, 'ed25519'))
+        ),
+        -- An invite with a non-null Expiration may only be consumed while it is still
+        -- in the future. context.Now is the canonical-datetime "now" supplied by the
+        -- consumeInvite writer (same canonicalDatetime() transform used to store
+        -- Invite.Expiration), so both sides of the comparison are byte-identical
+        -- canonical strings and the lexical ">" comparison orders chronologically. A
+        -- null Expiration never expires. Mirrors CadreControl.FormationUsage's
+        -- "FI.ExpiresAt is null or FI.ExpiresAt > context.Now" gate.
+        constraint NotExpired check on insert (
+            exists (select 1 from Invite I where I.Key = new.InviteKey and (I.Expiration is null or I.Expiration > context.Now))
         ),
         constraint MemberValid check (exists (select 1 from Member M where M.Key = new.MemberKey))
-    ) with context (InviteSignature text null);
+    ) with context (InviteSignature text null, Now datetime null);
 
     -- A party in the closed strand network
     table Member (
@@ -105,7 +115,7 @@ export const STRAND_SCHEMA = `    table Header (
                 or exists (
                     select 1 from Authority A
                         where A.MemberKey = context.AuthorityKey
-                            and verify(digest(new.Key, 'sha256', 'utf8'), context.AuthoritySignature, A.MemberKey, 'ed25519')
+                            and verify(digest(new.Key), context.AuthoritySignature, A.MemberKey, 'ed25519')
                 )
 
                 -- or added by invite
@@ -122,9 +132,9 @@ export const STRAND_SCHEMA = `    table Header (
         PeerId text,
         primary key (MemberKey, PeerId),
         constraint MemberExists check (exists (select 1 from Member M where M.Key = new.MemberKey)),
-        constraint Authorized check (
+        constraint Authorized check on insert, update, delete (
             verify(
-                digest(coalesce(new.MemberKey, old.MemberKey) || '|' || coalesce(new.PeerId, old.PeerId), 'sha256', 'utf8'),
+                digest(coalesce(new.MemberKey, old.MemberKey) || '|' || coalesce(new.PeerId, old.PeerId)),
                 context.Signature,
                 coalesce(new.MemberKey, old.MemberKey),
                 'ed25519'
@@ -138,7 +148,7 @@ export const STRAND_SCHEMA = `    table Header (
         constraint OnlyClosed check (
             exists (select 1 from Header H where H.Type = 'c')
         ),
-        constraint Authorized check (
+        constraint Authorized check on insert, update, delete (
             -- There are no existing records - first authority needs no authorization
             (select count(1) from Authority) <= 1
 
@@ -146,14 +156,14 @@ export const STRAND_SCHEMA = `    table Header (
                 or (
                     old.MemberKey is not null
                         and old.MemberKey = context.AuthorityKey
-                        and verify(digest(old.MemberKey, 'sha256', 'utf8'), context.Signature, old.MemberKey, 'ed25519')
+                        and verify(digest(old.MemberKey), context.Signature, old.MemberKey, 'ed25519')
                 )
 
                 -- or authorized by another existing authority
                 or exists (
                     select 1 from Authority A
                         where A.MemberKey = context.AuthorityKey
-                            and verify(digest(coalesce(new.MemberKey, old.MemberKey), 'sha256', 'utf8'), context.Signature, A.MemberKey, 'ed25519')
+                            and verify(digest(coalesce(new.MemberKey, old.MemberKey)), context.Signature, A.MemberKey, 'ed25519')
                 )
         )
     ) with context (AuthorityKey text null, Signature text null);