@serfab/cadre-core 0.8.1 → 0.9.0

package/dist/strand-membership-writer.d.ts

@@ -1,6 +1,6 @@
 import type { Database } from '@quereus/quereus';
 import type { SAppConfig } from './types.js';
-import type { AuthorityKeyPair } from './authority-key.js';
+import type { Ed25519KeyPair } from './ed25519-key.js';
 /**
  * The engine (rules-logic system) assumed to manage every strand. Persisted in
  * `Strand.Header.Engine`.
@@ -23,7 +23,7 @@ export declare const STRAND_ENGINE_VERSION = "0.1.0";
  *
  * `schemas/strand.qsql` signs a single SHA-256 digest over a `'|'`-joined payload
  * (e.g. `Member.Authorized` verifies
- * `verify(digest(new.Key), context.AuthoritySignature, A.MemberKey, 'ed25519')`).
+ * `verify(digest(new.Key), context.ManagerSignature, A.MemberKey, 'ed25519')`).
  * So the signer hashes the payload to raw bytes and ed25519-signs *those bytes*:
  * SQL `digest(...)`'s default output is base64url and `verify(...)`'s default
  * `inputEncoding` is base64url, so signer and verifier operate on identical bytes.
@@ -61,16 +61,16 @@ export declare function verifyStrandPayload(payload: string, signatureB64: strin
 export interface FounderBootstrapParams {
     /** The strand id — written to `Header.Id`. */
     strandId: string;
-    /** Strand type: `'o'` (open, Header only) or `'c'` (closed, Header+Member+Authority). */
+    /** Strand type: `'o'` (open, Header only) or `'c'` (closed, Header+Member+Manager). */
     type: 'o' | 'c';
     /** The sApp config whose id/version/schema/signature populate the Header. */
     sApp: SAppConfig;
     /**
      * The founder's derived strand keypair (from {@link strandMemberKeyPair}). Its
-     * `publicKeyB64` becomes the founding `Member.Key` and `Authority.MemberKey`.
+     * `publicKeyB64` becomes the founding `Member.Key` and `Manager.MemberKey`.
      * Required for a closed strand; ignored for an open strand.
      */
-    founderKeyPair?: AuthorityKeyPair;
+    founderKeyPair?: Ed25519KeyPair;
 }
 /**
  * Founder-only one-time bootstrap of a strand's `Strand.*` membership/RBAC rows.
@@ -81,16 +81,16 @@ export interface FounderBootstrapParams {
  * restart / founder re-`addStrand` is a no-op and never double-inserts.
  *
  * Behavior by strand type:
- * - **Open (`'o'`)**: insert `Header` only. `Member`/`Authority`/`Invite` are
+ * - **Open (`'o'`)**: insert `Header` only. `Member`/`Manager`/`Invite` are
  *   `OnlyClosed` and would trip that constraint — they are skipped entirely.
  * - **Closed (`'c'`)**: insert `Header(Type='c')`, then the founding `Member`
- *   (`Key = founderKeyPair.publicKeyB64`), then the founding `Authority`
+ *   (`Key = founderKeyPair.publicKeyB64`), then the founding `Manager`
  *   (`MemberKey = founderKeyPair.publicKeyB64`). Insert order matters: the
- *   Header must commit before the deferred `OnlyClosed` checks on Member/Authority
+ *   Header must commit before the deferred `OnlyClosed` checks on Member/Manager
  *   evaluate at commit.
  *
  * A closed strand with no `founderKeyPair` throws: a closed strand with no founding
- * Authority could never admit anyone, so failing loudly here (which propagates out
+ * Manager could never admit anyone, so failing loudly here (which propagates out
  * of `StrandDatabase.initialize()` and triggers the runtime's rollback) is correct.
  *
  * @param db - The strand's Quereus database (schema already applied).
@@ -102,10 +102,10 @@ export declare function bootstrapFounderMembership(db: Database, params: Founder
 /** Parameters for {@link issueInvite}. */
 export interface IssueInviteParams {
     /**
-     * The issuing authority's strand keypair. Its `publicKeyB64` must already be a
-     * `Strand.Authority` row (the `InviteValid` constraint rejects a non-authority).
+     * The issuing manager's strand keypair. Its `publicKeyB64` must already be a
+     * `Strand.Manager` row (the `InviteValid` constraint rejects a non-manager).
      */
-    authorityKeyPair: AuthorityKeyPair;
+    managerKeyPair: Ed25519KeyPair;
     /**
      * Optional invite expiry as epoch milliseconds. When set, it is canonicalised
      * via {@link canonicalDatetime} so the signed payload segment byte-matches the
@@ -131,10 +131,10 @@ export interface IssuedInvite {
  *
  * Generates a fresh invite ed25519 keypair (the public key becomes `Invite.Key`),
  * builds the constraint's payload (`Key || '|' || coalesce(Expiration, '')`), and
- * signs it TWICE: with the authority private key (→ `AuthoritySignature`, proving
- * an authority issued it) and with the invite private key (→ `InviteSignature`,
+ * signs it TWICE: with the manager private key (→ `ManagerSignature`, proving
+ * a manager issued it) and with the invite private key (→ `InviteSignature`,
  * proving the issuer actually holds the invite secret). Both signatures plus the
- * authority public key are bound as constraint context for the `Invite` insert.
+ * manager public key are bound as constraint context for the `Invite` insert.
  *
  * The returned `invitePrivateKey` is the only secret the invitee needs to redeem
  * the invite — it is NOT stored in the strand (only `Invite.Key`, the public half,
@@ -142,7 +142,7 @@ export interface IssuedInvite {
  * is `InviteKey`, so a given invite can be consumed at most once.
  *
  * @param db - The closed strand's database (founder already bootstrapped).
- * @param params - The issuing authority keypair and optional expiry.
+ * @param params - The issuing manager keypair and optional expiry.
  * @returns The invite public key and the out-of-band private seed.
  */
 export declare function issueInvite(db: Database, params: IssueInviteParams): Promise<IssuedInvite>;
@@ -204,44 +204,44 @@ export interface ConsumeInviteParams {
  *   `ConsumedInvite` row survives).
  */
 export declare function consumeInvite(db: Database, params: ConsumeInviteParams): Promise<void>;
-/** Parameters for {@link addMemberByAuthority}. */
-export interface AddMemberByAuthorityParams {
+/** Parameters for {@link addMemberByManager}. */
+export interface AddMemberByManagerParams {
     /**
-     * The admitting authority's strand keypair. Its `publicKeyB64` must be a
-     * `Strand.Authority` row; it signs the new member key directly.
+     * The admitting manager's strand keypair. Its `publicKeyB64` must be a
+     * `Strand.Manager` row; it signs the new member key directly.
      */
-    authorityKeyPair: AuthorityKeyPair;
+    managerKeyPair: Ed25519KeyPair;
     /** The joining member's ed25519 PUBLIC key (base64url) — the new `Member.Key`. */
     memberKey: string;
 }
 /**
- * Admit a `Member` directly by authority signature — the sibling of the invite
- * path on `Member.Authorized`'s direct-authority branch.
+ * Admit a `Member` directly by manager signature — the sibling of the invite
+ * path on `Member.Authorized`'s direct-manager branch.
  *
- * The constraint verifies `digest(new.Key)` against an `Authority` row matching
- * `context.AuthorityKey`, so the payload is just the member key (no `'|'` join).
- * No `ConsumedInvite` is involved: this is the path an authority uses to seat a
- * member it already trusts (e.g. an authority-side enrollment that admits a
+ * The constraint verifies `digest(new.Key)` against a `Manager` row matching
+ * `context.ManagerKey`, so the payload is just the member key (no `'|'` join).
+ * No `ConsumedInvite` is involved: this is the path a manager uses to seat a
+ * member it already trusts (e.g. a manager-side enrollment that admits a
  * party already authorised out-of-band).
  *
  * @param db - The closed strand's database.
- * @param params - The admitting authority keypair and the new member key.
- * @throws If `Member.Authorized` rejects (e.g. a non-authority key); the insert
+ * @param params - The admitting manager keypair and the new member key.
+ * @throws If `Member.Authorized` rejects (e.g. a non-manager key); the insert
  *   rolls back, leaving no `Member` row.
  */
-export declare function addMemberByAuthority(db: Database, params: AddMemberByAuthorityParams): Promise<void>;
+export declare function addMemberByManager(db: Database, params: AddMemberByManagerParams): Promise<void>;
 /** Parameters for {@link registerMemberPeer}. */
 export interface RegisterMemberPeerParams {
     /**
      * The member's OWN strand keypair (`{ privateKeyB64, publicKeyB64 }`). Its
      * `publicKeyB64` becomes `MemberPeer.MemberKey` and it self-signs the binding —
      * `MemberPeer.Authorized` verifies the signature against `MemberKey` itself, so a
-     * peer can only be registered by the very member it belongs to (no authority
+     * peer can only be registered by the very member it belongs to (no manager
      * involved). The founder passes its `strandMemberKeyPair`; an invited member
-     * passes its own keypair. Typed as {@link AuthorityKeyPair} only for the shared
-     * base64url keypair shape — no authority privilege is implied.
+     * passes its own keypair. Typed as {@link Ed25519KeyPair} only for the shared
+     * base64url keypair shape — no manager privilege is implied.
      */
-    memberKeyPair: AuthorityKeyPair;
+    memberKeyPair: Ed25519KeyPair;
     /** The peer/node id (libp2p peer id string) to associate with the member. */
     peerId: string;
 }
@@ -272,90 +272,90 @@ export interface RegisterMemberPeerParams {
  *   matching `Member` row); the insert rolls back, leaving no `MemberPeer` row.
  */
 export declare function registerMemberPeer(db: Database, params: RegisterMemberPeerParams): Promise<void>;
-/** Parameters for {@link addAuthority}. */
-export interface AddAuthorityParams {
+/** Parameters for {@link addManager}. */
+export interface AddManagerParams {
     /**
-     * An EXISTING authority's strand keypair. Its `publicKeyB64` must already be a
-     * `Strand.Authority` row (the existing-authority branch of `Authority.Authorized`
-     * rejects a non-authority once the founder authority exists); it signs the new
-     * authority key and is bound as `context.AuthorityKey`.
+     * An EXISTING manager's strand keypair. Its `publicKeyB64` must already be a
+     * `Strand.Manager` row (the existing-manager branch of `Manager.Authorized`
+     * rejects a non-manager once the founder manager exists); it signs the new
+     * manager key and is bound as `context.ManagerKey`.
      */
-    byAuthorityKeyPair: AuthorityKeyPair;
-    /** The member key to promote — the new `Authority.MemberKey` row. */
-    newAuthorityKey: string;
+    byManagerKeyPair: Ed25519KeyPair;
+    /** The member key to promote — the new `Manager.MemberKey` row. */
+    newManagerKey: string;
 }
 /**
- * Promote a member to `Authority` on the signature of an existing authority.
+ * Promote a member to `Manager` on the signature of an existing manager.
  *
- * The existing-authority branch of `Authority.Authorized` verifies
+ * The existing-manager branch of `Manager.Authorized` verifies
  * `digest(coalesce(new.MemberKey, old.MemberKey))` — `new.MemberKey` =
- * `newAuthorityKey` on insert — against an `Authority` row matching
- * `context.AuthorityKey`. So the signer signs the new authority key directly (no
- * `'|'` join) and binds itself as `context.AuthorityKey`.
+ * `newManagerKey` on insert — against a `Manager` row matching
+ * `context.ManagerKey`. So the signer signs the new manager key directly (no
+ * `'|'` join) and binds itself as `context.ManagerKey`.
  *
- * Once the founder authority exists, the schema's `(select count(1) from Authority)
+ * Once the founder manager exists, the schema's `(select count(1) from Manager)
  * <= 1` bootstrap shortcut no longer applies to a second add (at commit the count
  * includes the new row, so it is ≥ 2), so this genuinely exercises signature
- * verification — a non-authority signer, or a signature over the wrong key, is
+ * verification — a non-manager signer, or a signature over the wrong key, is
  * rejected.
  *
- * @param db - The closed strand's database (founder authority already seated).
- * @param params - The authorizing authority's keypair and the new authority key.
- * @throws If `Authority.Authorized` rejects; the insert rolls back.
+ * @param db - The closed strand's database (founder manager already seated).
+ * @param params - The authorizing manager's keypair and the new manager key.
+ * @throws If `Manager.Authorized` rejects; the insert rolls back.
  */
-export declare function addAuthority(db: Database, params: AddAuthorityParams): Promise<void>;
-/** Parameters for {@link removeAuthority}. */
-export interface RemoveAuthorityParams {
+export declare function addManager(db: Database, params: AddManagerParams): Promise<void>;
+/** Parameters for {@link removeManager}. */
+export interface RemoveManagerParams {
     /**
-     * The keypair authorizing the removal, bound as `context.AuthorityKey` and
-     * signing `digest(targetAuthorityKey)`. For an ADMIN removal this is a DIFFERENT
-     * existing authority (satisfying the existing-authority branch); for a
+     * The keypair authorizing the removal, bound as `context.ManagerKey` and
+     * signing `digest(targetManagerKey)`. For an ADMIN removal this is a DIFFERENT
+     * existing manager (satisfying the existing-manager branch); for a
      * SELF-resignation it is the target's OWN keypair (`publicKeyB64 ===
-     * targetAuthorityKey`, satisfying the former-authority self branch). The same
+     * targetManagerKey`, satisfying the former-manager self branch). The same
      * context construction satisfies whichever branch applies — see
-     * {@link removeAuthority}.
+     * {@link removeManager}.
      */
-    byAuthorityKeyPair: AuthorityKeyPair;
-    /** The `Authority.MemberKey` row to delete. */
-    targetAuthorityKey: string;
+    byManagerKeyPair: Ed25519KeyPair;
+    /** The `Manager.MemberKey` row to delete. */
+    targetManagerKey: string;
 }
 /**
- * Remove an `Authority` row — either an admin removing a different authority or an
- * authority resigning itself.
+ * Remove a `Manager` row — either an admin removing a different manager or a
+ * manager resigning itself.
  *
  * On a DELETE, `coalesce(new.MemberKey, old.MemberKey)` binds `old.MemberKey =
- * targetAuthorityKey` (there is no `new` row), so the signed payload is the target
- * key for BOTH accepting branches of `Authority.Authorized`, and a single context
+ * targetManagerKey` (there is no `new` row), so the signed payload is the target
+ * key for BOTH accepting branches of `Manager.Authorized`, and a single context
  * construction serves both:
- * - **Admin removal**: `byAuthorityKeyPair` is a different existing authority; the
- *   existing-authority branch verifies the signature against `A.MemberKey =
- *   context.AuthorityKey`.
- * - **Self-resignation**: `byAuthorityKeyPair` IS the target (its `publicKeyB64`
- *   equals `targetAuthorityKey`); the former-authority self branch verifies
- *   `old.MemberKey = context.AuthorityKey` and the self-signature over `old.MemberKey`.
+ * - **Admin removal**: `byManagerKeyPair` is a different existing manager; the
+ *   existing-manager branch verifies the signature against `A.MemberKey =
+ *   context.ManagerKey`.
+ * - **Self-resignation**: `byManagerKeyPair` IS the target (its `publicKeyB64`
+ *   equals `targetManagerKey`); the former-manager self branch verifies
+ *   `old.MemberKey = context.ManagerKey` and the self-signature over `old.MemberKey`.
  *
  * The caller selects the case purely by which keypair it passes — no branching here.
  *
  * KNOWN PLATFORM GAP (not fixable here): the optimystic bootstrap-mode transactor
  * evaluates deferred (subquery-bearing) CHECK constraints only on INSERT, not on
- * DELETE. `Authority.Authorized` is deferred, so the platform currently accepts ANY
- * `Authority` delete regardless of signature — `removeAuthority`'s authorization is
+ * DELETE. `Manager.Authorized` is deferred, so the platform currently accepts ANY
+ * `Manager` delete regardless of signature — `removeManager`'s authorization is
  * effectively unenforced at runtime until that gap is closed (filed as
  * `optimystic-deferred-check-not-enforced-on-delete`). This writer still builds the
  * correct, signed delete so it works unchanged once enforcement lands — exactly as
  * the invite path issues correct inserts despite the open PK-uniqueness gap.
  *
- * KNOWN SCHEMA HAZARD (not guarded here): even with enforcement, `Authority.
- * Authorized`'s `(select count(1) from Authority) <= 1` bootstrap branch is true at
+ * KNOWN SCHEMA HAZARD (not guarded here): even with enforcement, `Manager.
+ * Authorized`'s `(select count(1) from Manager) <= 1` bootstrap branch is true at
  * commit whenever a delete drops the count to ≤ 1, so removing the strand's LAST (or
- * second-to-last) authority would be accepted regardless of signature — and removing
+ * second-to-last) manager would be accepted regardless of signature — and removing
  * the last one orphans the strand (no one can ever add another). The schema does not
- * prevent this; a "min-one-authority" invariant is deferred to a future schema change
+ * prevent this; a "min-one-manager" invariant is deferred to a future schema change
  * rather than grown into this writer.
  *
  * @param db - The closed strand's database.
- * @param params - The authorizing keypair and the target authority key.
- * @throws If `Authority.Authorized` rejects (e.g. a non-authority admin removal
- *   while > 2 authorities remain); the delete rolls back.
+ * @param params - The authorizing keypair and the target manager key.
+ * @throws If `Manager.Authorized` rejects (e.g. a non-manager admin removal
+ *   while > 2 managers remain); the delete rolls back.
  */
-export declare function removeAuthority(db: Database, params: RemoveAuthorityParams): Promise<void>;
+export declare function removeManager(db: Database, params: RemoveManagerParams): Promise<void>;

package/dist/strand-membership-writer.js

@@ -24,7 +24,7 @@ export const STRAND_ENGINE_VERSION = '0.1.0';
  *
  * `schemas/strand.qsql` signs a single SHA-256 digest over a `'|'`-joined payload
  * (e.g. `Member.Authorized` verifies
- * `verify(digest(new.Key), context.AuthoritySignature, A.MemberKey, 'ed25519')`).
+ * `verify(digest(new.Key), context.ManagerSignature, A.MemberKey, 'ed25519')`).
  * So the signer hashes the payload to raw bytes and ed25519-signs *those bytes*:
  * SQL `digest(...)`'s default output is base64url and `verify(...)`'s default
  * `inputEncoding` is base64url, so signer and verifier operate on identical bytes.
@@ -109,7 +109,7 @@ async function insertHeaderIfAbsent(db, params) {
  * Insert the founding `Strand.Member` if no member exists yet.
  *
  * The empty-table state satisfies the `count(1) from Member <= 1` bootstrap branch
- * of `Member.Authorized`, so no authority signature is needed — the context fields
+ * of `Member.Authorized`, so no manager signature is needed — the context fields
  * are explicit nulls. Guarding on the count makes this idempotent: a re-run (the
  * founder re-`addStrand`/`resumeStrand`) finds the member present and skips.
  */
@@ -119,28 +119,28 @@ async function insertFounderMemberIfAbsent(db, memberKey, strandId) {
         return;
     }
     await db.exec(`insert into Strand.Member (Key)
-       with context AuthorityKey = null, AuthoritySignature = null
+       with context ManagerKey = null, ManagerSignature = null
        values (?)`, [memberKey]);
     log('Inserted founding Member for strand %s', strandId);
 }
 /**
- * Insert the founding `Strand.Authority` if no authority exists yet.
+ * Insert the founding `Strand.Manager` if no manager exists yet.
  *
- * The empty-table state satisfies the `count(1) from Authority <= 1` bootstrap
- * branch of `Authority.Authorized`, so no signature is needed. Idempotent via the
- * same count guard. Must run AFTER the Header insert: `Authority.OnlyClosed` is a
+ * The empty-table state satisfies the `count(1) from Manager <= 1` bootstrap
+ * branch of `Manager.Authorized`, so no signature is needed. Idempotent via the
+ * same count guard. Must run AFTER the Header insert: `Manager.OnlyClosed` is a
  * deferred (subquery) check evaluated at commit, and the sequential auto-commit
- * Header→Member→Authority order ensures the closed `Header` is committed first.
+ * Header→Member→Manager order ensures the closed `Header` is committed first.
  */
-async function insertFounderAuthorityIfAbsent(db, memberKey, strandId) {
-    if (await strandTableCount(db, 'Authority') > 0) {
-        log('Authority already present for strand %s; skipping founder Authority', strandId);
+async function insertFounderManagerIfAbsent(db, memberKey, strandId) {
+    if (await strandTableCount(db, 'Manager') > 0) {
+        log('Manager already present for strand %s; skipping founder Manager', strandId);
         return;
     }
-    await db.exec(`insert into Strand.Authority (MemberKey)
-       with context AuthorityKey = null, Signature = null
+    await db.exec(`insert into Strand.Manager (MemberKey)
+       with context ManagerKey = null, Signature = null
        values (?)`, [memberKey]);
-    log('Inserted founding Authority for strand %s', strandId);
+    log('Inserted founding Manager for strand %s', strandId);
 }
 /**
  * Founder-only one-time bootstrap of a strand's `Strand.*` membership/RBAC rows.
@@ -151,16 +151,16 @@ async function insertFounderAuthorityIfAbsent(db, memberKey, strandId) {
  * restart / founder re-`addStrand` is a no-op and never double-inserts.
  *
  * Behavior by strand type:
- * - **Open (`'o'`)**: insert `Header` only. `Member`/`Authority`/`Invite` are
+ * - **Open (`'o'`)**: insert `Header` only. `Member`/`Manager`/`Invite` are
  *   `OnlyClosed` and would trip that constraint — they are skipped entirely.
  * - **Closed (`'c'`)**: insert `Header(Type='c')`, then the founding `Member`
- *   (`Key = founderKeyPair.publicKeyB64`), then the founding `Authority`
+ *   (`Key = founderKeyPair.publicKeyB64`), then the founding `Manager`
  *   (`MemberKey = founderKeyPair.publicKeyB64`). Insert order matters: the
- *   Header must commit before the deferred `OnlyClosed` checks on Member/Authority
+ *   Header must commit before the deferred `OnlyClosed` checks on Member/Manager
  *   evaluate at commit.
  *
  * A closed strand with no `founderKeyPair` throws: a closed strand with no founding
- * Authority could never admit anyone, so failing loudly here (which propagates out
+ * Manager could never admit anyone, so failing loudly here (which propagates out
  * of `StrandDatabase.initialize()` and triggers the runtime's rollback) is correct.
  *
  * @param db - The strand's Quereus database (schema already applied).
@@ -172,21 +172,21 @@ export async function bootstrapFounderMembership(db, params) {
     const { strandId, type, founderKeyPair } = params;
     log('Founder bootstrap for strand %s (type %s)', strandId, type);
     // Validate BEFORE writing anything: a closed strand with no founder key must
-    // fail without leaving a closed `Header` that has no founding Member/Authority
+    // fail without leaving a closed `Header` that has no founding Member/Manager
     // (such a strand could never admit anyone).
     if (type === 'c' && !founderKeyPair) {
         throw new Error(`Cannot bootstrap closed strand ${strandId}: no founder key pair derived from MemberPrivateKey. ` +
-            'A closed strand needs a founding Member + Authority or it can never admit members.');
+            'A closed strand needs a founding Member + Manager or it can never admit members.');
     }
-    // Header is written for every strand; Member/Authority are closed-only.
+    // Header is written for every strand; Member/Manager are closed-only.
     await insertHeaderIfAbsent(db, params);
     if (type === 'o') {
-        // Open strand: Member/Authority/Invite are OnlyClosed — nothing else to write.
+        // Open strand: Member/Manager/Invite are OnlyClosed — nothing else to write.
         return;
     }
     const memberKey = founderKeyPair.publicKeyB64;
     await insertFounderMemberIfAbsent(db, memberKey, strandId);
-    await insertFounderAuthorityIfAbsent(db, memberKey, strandId);
+    await insertFounderManagerIfAbsent(db, memberKey, strandId);
     log('Founder bootstrap complete for closed strand %s', strandId);
 }
 /**
@@ -194,10 +194,10 @@ export async function bootstrapFounderMembership(db, params) {
  *
  * Generates a fresh invite ed25519 keypair (the public key becomes `Invite.Key`),
  * builds the constraint's payload (`Key || '|' || coalesce(Expiration, '')`), and
- * signs it TWICE: with the authority private key (→ `AuthoritySignature`, proving
- * an authority issued it) and with the invite private key (→ `InviteSignature`,
+ * signs it TWICE: with the manager private key (→ `ManagerSignature`, proving
+ * a manager issued it) and with the invite private key (→ `InviteSignature`,
  * proving the issuer actually holds the invite secret). Both signatures plus the
- * authority public key are bound as constraint context for the `Invite` insert.
+ * manager public key are bound as constraint context for the `Invite` insert.
  *
  * The returned `invitePrivateKey` is the only secret the invitee needs to redeem
  * the invite — it is NOT stored in the strand (only `Invite.Key`, the public half,
@@ -205,11 +205,11 @@ export async function bootstrapFounderMembership(db, params) {
  * is `InviteKey`, so a given invite can be consumed at most once.
  *
  * @param db - The closed strand's database (founder already bootstrapped).
- * @param params - The issuing authority keypair and optional expiry.
+ * @param params - The issuing manager keypair and optional expiry.
  * @returns The invite public key and the out-of-band private seed.
  */
 export async function issueInvite(db, params) {
-    const { authorityKeyPair, expiration } = params;
+    const { managerKeyPair, expiration } = params;
     const invitePrivateKey = generatePrivateKey('ed25519', 'base64url');
     const inviteKey = getPublicKey(invitePrivateKey, 'ed25519', 'base64url', 'base64url');
     // Canonicalise the expiry to the engine's stored `datetime` form so the signed
@@ -217,11 +217,11 @@ export async function issueInvite(db, params) {
     const expirationSegment = expiration == null ? '' : await canonicalDatetime(db, expiration);
     const expirationColumn = expiration == null ? null : expirationSegment;
     const payload = `${inviteKey}|${expirationSegment}`;
-    const authoritySignature = signStrandPayload(payload, authorityKeyPair.privateKeyB64);
+    const managerSignature = signStrandPayload(payload, managerKeyPair.privateKeyB64);
     const inviteSignature = signStrandPayload(payload, invitePrivateKey);
     await db.exec(`insert into Strand.Invite (Key, Expiration)
-       with context AuthorityKey = ?, AuthoritySignature = ?, InviteSignature = ?
-       values (?, ?)`, [authorityKeyPair.publicKeyB64, authoritySignature, inviteSignature, inviteKey, expirationColumn]);
+       with context ManagerKey = ?, ManagerSignature = ?, InviteSignature = ?
+       values (?, ?)`, [managerKeyPair.publicKeyB64, managerSignature, inviteSignature, inviteKey, expirationColumn]);
     log('Issued invite %s (expires=%s)', inviteKey, expirationColumn ?? 'never');
     return { inviteKey, invitePrivateKey };
 }
@@ -278,9 +278,9 @@ export async function consumeInvite(db, params) {
     await db.beginTransaction();
     try {
         // 1. Member — admitted by the deferred invite branch (the matching
-        //    ConsumedInvite below), so no authority signature is supplied.
+        //    ConsumedInvite below), so no manager signature is supplied.
         await db.exec(`insert into Strand.Member (Key)
-         with context AuthorityKey = null, AuthoritySignature = null
+         with context ManagerKey = null, ManagerSignature = null
          values (?)`, [memberKey]);
         // 2. ConsumedInvite — proves possession of the invite private key and that the
         //    invite has not expired (NotExpired gate against the canonical Now).
@@ -303,27 +303,27 @@ export async function consumeInvite(db, params) {
     }
 }
 /**
- * Admit a `Member` directly by authority signature — the sibling of the invite
- * path on `Member.Authorized`'s direct-authority branch.
+ * Admit a `Member` directly by manager signature — the sibling of the invite
+ * path on `Member.Authorized`'s direct-manager branch.
  *
- * The constraint verifies `digest(new.Key)` against an `Authority` row matching
- * `context.AuthorityKey`, so the payload is just the member key (no `'|'` join).
- * No `ConsumedInvite` is involved: this is the path an authority uses to seat a
- * member it already trusts (e.g. an authority-side enrollment that admits a
+ * The constraint verifies `digest(new.Key)` against a `Manager` row matching
+ * `context.ManagerKey`, so the payload is just the member key (no `'|'` join).
+ * No `ConsumedInvite` is involved: this is the path a manager uses to seat a
+ * member it already trusts (e.g. a manager-side enrollment that admits a
  * party already authorised out-of-band).
  *
  * @param db - The closed strand's database.
- * @param params - The admitting authority keypair and the new member key.
- * @throws If `Member.Authorized` rejects (e.g. a non-authority key); the insert
+ * @param params - The admitting manager keypair and the new member key.
+ * @throws If `Member.Authorized` rejects (e.g. a non-manager key); the insert
  *   rolls back, leaving no `Member` row.
  */
-export async function addMemberByAuthority(db, params) {
-    const { authorityKeyPair, memberKey } = params;
-    const signature = signStrandPayload(memberKey, authorityKeyPair.privateKeyB64);
+export async function addMemberByManager(db, params) {
+    const { managerKeyPair, memberKey } = params;
+    const signature = signStrandPayload(memberKey, managerKeyPair.privateKeyB64);
     await db.exec(`insert into Strand.Member (Key)
-       with context AuthorityKey = ?, AuthoritySignature = ?
-       values (?)`, [authorityKeyPair.publicKeyB64, signature, memberKey]);
-    log('Admitted member %s by authority %s', memberKey, authorityKeyPair.publicKeyB64);
+       with context ManagerKey = ?, ManagerSignature = ?
+       values (?)`, [managerKeyPair.publicKeyB64, signature, memberKey]);
+    log('Admitted member %s by manager %s', memberKey, managerKeyPair.publicKeyB64);
 }
 /**
  * Register a network node (`PeerId`) as acting on behalf of a member.
@@ -373,77 +373,77 @@ async function memberPeerExists(db, memberKey, peerId) {
     return false;
 }
 /**
- * Promote a member to `Authority` on the signature of an existing authority.
+ * Promote a member to `Manager` on the signature of an existing manager.
  *
- * The existing-authority branch of `Authority.Authorized` verifies
+ * The existing-manager branch of `Manager.Authorized` verifies
  * `digest(coalesce(new.MemberKey, old.MemberKey))` — `new.MemberKey` =
- * `newAuthorityKey` on insert — against an `Authority` row matching
- * `context.AuthorityKey`. So the signer signs the new authority key directly (no
- * `'|'` join) and binds itself as `context.AuthorityKey`.
+ * `newManagerKey` on insert — against a `Manager` row matching
+ * `context.ManagerKey`. So the signer signs the new manager key directly (no
+ * `'|'` join) and binds itself as `context.ManagerKey`.
  *
- * Once the founder authority exists, the schema's `(select count(1) from Authority)
+ * Once the founder manager exists, the schema's `(select count(1) from Manager)
  * <= 1` bootstrap shortcut no longer applies to a second add (at commit the count
  * includes the new row, so it is ≥ 2), so this genuinely exercises signature
- * verification — a non-authority signer, or a signature over the wrong key, is
+ * verification — a non-manager signer, or a signature over the wrong key, is
  * rejected.
  *
- * @param db - The closed strand's database (founder authority already seated).
- * @param params - The authorizing authority's keypair and the new authority key.
- * @throws If `Authority.Authorized` rejects; the insert rolls back.
+ * @param db - The closed strand's database (founder manager already seated).
+ * @param params - The authorizing manager's keypair and the new manager key.
+ * @throws If `Manager.Authorized` rejects; the insert rolls back.
  */
-export async function addAuthority(db, params) {
-    const { byAuthorityKeyPair, newAuthorityKey } = params;
-    const signature = signStrandPayload(newAuthorityKey, byAuthorityKeyPair.privateKeyB64);
-    await db.exec(`insert into Strand.Authority (MemberKey)
-       with context AuthorityKey = ?, Signature = ?
-       values (?)`, [byAuthorityKeyPair.publicKeyB64, signature, newAuthorityKey]);
-    log('Added authority %s by %s', newAuthorityKey, byAuthorityKeyPair.publicKeyB64);
+export async function addManager(db, params) {
+    const { byManagerKeyPair, newManagerKey } = params;
+    const signature = signStrandPayload(newManagerKey, byManagerKeyPair.privateKeyB64);
+    await db.exec(`insert into Strand.Manager (MemberKey)
+       with context ManagerKey = ?, Signature = ?
+       values (?)`, [byManagerKeyPair.publicKeyB64, signature, newManagerKey]);
+    log('Added manager %s by %s', newManagerKey, byManagerKeyPair.publicKeyB64);
 }
 /**
- * Remove an `Authority` row — either an admin removing a different authority or an
- * authority resigning itself.
+ * Remove a `Manager` row — either an admin removing a different manager or a
+ * manager resigning itself.
  *
  * On a DELETE, `coalesce(new.MemberKey, old.MemberKey)` binds `old.MemberKey =
- * targetAuthorityKey` (there is no `new` row), so the signed payload is the target
- * key for BOTH accepting branches of `Authority.Authorized`, and a single context
+ * targetManagerKey` (there is no `new` row), so the signed payload is the target
+ * key for BOTH accepting branches of `Manager.Authorized`, and a single context
  * construction serves both:
- * - **Admin removal**: `byAuthorityKeyPair` is a different existing authority; the
- *   existing-authority branch verifies the signature against `A.MemberKey =
- *   context.AuthorityKey`.
- * - **Self-resignation**: `byAuthorityKeyPair` IS the target (its `publicKeyB64`
- *   equals `targetAuthorityKey`); the former-authority self branch verifies
- *   `old.MemberKey = context.AuthorityKey` and the self-signature over `old.MemberKey`.
+ * - **Admin removal**: `byManagerKeyPair` is a different existing manager; the
+ *   existing-manager branch verifies the signature against `A.MemberKey =
+ *   context.ManagerKey`.
+ * - **Self-resignation**: `byManagerKeyPair` IS the target (its `publicKeyB64`
+ *   equals `targetManagerKey`); the former-manager self branch verifies
+ *   `old.MemberKey = context.ManagerKey` and the self-signature over `old.MemberKey`.
  *
  * The caller selects the case purely by which keypair it passes — no branching here.
  *
  * KNOWN PLATFORM GAP (not fixable here): the optimystic bootstrap-mode transactor
  * evaluates deferred (subquery-bearing) CHECK constraints only on INSERT, not on
- * DELETE. `Authority.Authorized` is deferred, so the platform currently accepts ANY
- * `Authority` delete regardless of signature — `removeAuthority`'s authorization is
+ * DELETE. `Manager.Authorized` is deferred, so the platform currently accepts ANY
+ * `Manager` delete regardless of signature — `removeManager`'s authorization is
  * effectively unenforced at runtime until that gap is closed (filed as
  * `optimystic-deferred-check-not-enforced-on-delete`). This writer still builds the
  * correct, signed delete so it works unchanged once enforcement lands — exactly as
  * the invite path issues correct inserts despite the open PK-uniqueness gap.
  *
- * KNOWN SCHEMA HAZARD (not guarded here): even with enforcement, `Authority.
- * Authorized`'s `(select count(1) from Authority) <= 1` bootstrap branch is true at
+ * KNOWN SCHEMA HAZARD (not guarded here): even with enforcement, `Manager.
+ * Authorized`'s `(select count(1) from Manager) <= 1` bootstrap branch is true at
  * commit whenever a delete drops the count to ≤ 1, so removing the strand's LAST (or
- * second-to-last) authority would be accepted regardless of signature — and removing
+ * second-to-last) manager would be accepted regardless of signature — and removing
  * the last one orphans the strand (no one can ever add another). The schema does not
- * prevent this; a "min-one-authority" invariant is deferred to a future schema change
+ * prevent this; a "min-one-manager" invariant is deferred to a future schema change
  * rather than grown into this writer.
  *
  * @param db - The closed strand's database.
- * @param params - The authorizing keypair and the target authority key.
- * @throws If `Authority.Authorized` rejects (e.g. a non-authority admin removal
- *   while > 2 authorities remain); the delete rolls back.
+ * @param params - The authorizing keypair and the target manager key.
+ * @throws If `Manager.Authorized` rejects (e.g. a non-manager admin removal
+ *   while > 2 managers remain); the delete rolls back.
  */
-export async function removeAuthority(db, params) {
-    const { byAuthorityKeyPair, targetAuthorityKey } = params;
-    const signature = signStrandPayload(targetAuthorityKey, byAuthorityKeyPair.privateKeyB64);
-    await db.exec(`delete from Strand.Authority
-       with context AuthorityKey = ?, Signature = ?
-       where MemberKey = ?`, [byAuthorityKeyPair.publicKeyB64, signature, targetAuthorityKey]);
-    log('Removed authority %s by %s', targetAuthorityKey, byAuthorityKeyPair.publicKeyB64);
+export async function removeManager(db, params) {
+    const { byManagerKeyPair, targetManagerKey } = params;
+    const signature = signStrandPayload(targetManagerKey, byManagerKeyPair.privateKeyB64);
+    await db.exec(`delete from Strand.Manager
+       with context ManagerKey = ?, Signature = ?
+       where MemberKey = ?`, [byManagerKeyPair.publicKeyB64, signature, targetManagerKey]);
+    log('Removed manager %s by %s', targetManagerKey, byManagerKeyPair.publicKeyB64);
 }
 //# sourceMappingURL=strand-membership-writer.js.map