@serfab/cadre-core 0.8.1 → 0.9.0

package/src/seed-trust-policy.ts

@@ -3,20 +3,20 @@
  *
  * A seed carries an ed25519 signature over its body and the `signerKey` that
  * produced it. Verifying that signature only proves the seed is internally
- * consistent — it does NOT prove the signer is an authority, because both the
- * signer key and the seed's own `isAuthority` peer flags are attacker-supplied.
+ * consistent — it does NOT prove the signer is an owner, because both the
+ * signer key and the seed's own `isOwner` peer flags are attacker-supplied.
  * The trust decision must therefore rest on an anchor that does not come from
  * the seed body:
  *
- *  1. DB-anchored — keys already in the receiver's `CadreControl.AuthorityKey`
+ *  1. DB-anchored — keys already in the receiver's `CadreControl.OwnerKey`
  *     table (steady state: the node is enrolled / has synced control state).
  *  2. Pinned out-of-band — keys handed to the node from outside the seed
- *     (carried by a `CadreInvite.authorityKeys`, or pinned by an operator).
+ *     (carried by a `CadreInvite.ownerKeys`, or pinned by an operator).
  *  3. TOFU (opt-in) — an explicit confirmation callback invoked on first sight
  *     of an unknown signer key. Interactive hosts only; off by default.
  *
  * Secure default (`dbAnchoredTrustPolicy`): a cold-start node with an empty
- * `AuthorityKey` table and no pinned keys rejects the seed — a seed can no
+ * `OwnerKey` table and no pinned keys rejects the seed — a seed can no
  * longer vouch for its own signer.
  */
 export interface SeedTrustContext {
@@ -25,10 +25,10 @@ export interface SeedTrustContext {
   /** ed25519 base64url signer key — already signature-verified by `applySeed`. */
   signerKey: string;
   /**
-   * The receiver's known authority keys, sourced from its `AuthorityKey`
+   * The receiver's known owner keys, sourced from its `OwnerKey`
    * table — NOT from the seed. Empty for a cold-start node.
    */
-  knownAuthorityKeys: ReadonlySet<string>;
+  knownOwnerKeys: ReadonlySet<string>;
 }
 
 export interface SeedTrustDecision {
@@ -48,45 +48,45 @@ export interface SeedTrustPolicy {
 
 /**
  * Default policy: trust only keys already present in the receiver's
- * `AuthorityKey` table. A cold-start node (empty table) rejects every seed.
+ * `OwnerKey` table. A cold-start node (empty table) rejects every seed.
  */
 export function dbAnchoredTrustPolicy(): SeedTrustPolicy {
   return {
-    evaluate({ signerKey, knownAuthorityKeys }) {
-      if (knownAuthorityKeys.has(signerKey)) {
+    evaluate({ signerKey, knownOwnerKeys }) {
+      if (knownOwnerKeys.has(signerKey)) {
         return { trusted: true };
       }
       return {
         trusted: false,
-        reason: 'Signer key is not a known authority (DB-anchored trust policy)',
+        reason: 'Signer key is not a known owner (DB-anchored trust policy)',
       };
     },
   };
 }
 
 /**
- * Cold-start policy: trust keys in the receiver's `AuthorityKey` table plus a
- * set pinned out-of-band (typically `CadreInvite.authorityKeys` or operator
+ * Cold-start policy: trust keys in the receiver's `OwnerKey` table plus a
+ * set pinned out-of-band (typically `CadreInvite.ownerKeys` or operator
  * config). Lets an unenrolled invitee accept its first seed without the seed
  * vouching for itself.
  */
 export function pinnedKeyTrustPolicy(pinned: Iterable<string>): SeedTrustPolicy {
   const pinnedSet = new Set(pinned);
   return {
-    evaluate({ signerKey, knownAuthorityKeys }) {
-      if (knownAuthorityKeys.has(signerKey) || pinnedSet.has(signerKey)) {
+    evaluate({ signerKey, knownOwnerKeys }) {
+      if (knownOwnerKeys.has(signerKey) || pinnedSet.has(signerKey)) {
         return { trusted: true };
       }
       return {
         trusted: false,
-        reason: 'Signer key is neither a known nor a pinned authority (pinned-key trust policy)',
+        reason: 'Signer key is neither a known nor a pinned owner (pinned-key trust policy)',
       };
     },
   };
 }
 
 /**
- * Opt-in interactive policy: trust keys already in the `AuthorityKey` table,
+ * Opt-in interactive policy: trust keys already in the `OwnerKey` table,
  * and on an unknown key invoke `confirm` (e.g. a trust-circle UI prompt). The
  * key is trusted iff `confirm` resolves true. Not enabled by default.
  */
@@ -95,7 +95,7 @@ export function tofuTrustPolicy(
 ): SeedTrustPolicy {
   return {
     async evaluate(ctx) {
-      if (ctx.knownAuthorityKeys.has(ctx.signerKey)) {
+      if (ctx.knownOwnerKeys.has(ctx.signerKey)) {
         return { trusted: true };
       }
       const accepted = await confirm(ctx);

package/src/strand-database.ts

@@ -38,13 +38,13 @@ export interface StrandDatabaseConfig {
   /**
    * Strand type (`'o'` open / `'c'` closed) from the control-network strand row.
    * Drives the founder bootstrap: open strands get a `Header` only; closed strands
-   * also get the founding `Member`+`Authority`.
+   * also get the founding `Member`+`Manager`.
    */
   strandType: 'o' | 'c';
   /**
    * The closed-strand `MemberPrivateKey` (base64 protobuf) from the strand row.
    * Required when `founder` is true and `strandType` is `'c'` — it derives the
-   * founding `Member.Key`/`Authority.MemberKey`. Absent for open strands.
+   * founding `Member.Key`/`Manager.MemberKey`. Absent for open strands.
    */
   memberPrivateKey?: string;
   /**
@@ -136,8 +136,8 @@ export class StrandDatabase {
    * Run the founder membership bootstrap against the freshly-composed strand DB.
    *
    * Derives the founding keypair from the closed-strand `memberPrivateKey` (the
-   * `Member.Key`/`Authority.MemberKey` are its public key); a closed strand with no
-   * `memberPrivateKey` throws, because it could never seat a founding authority.
+   * `Member.Key`/`Manager.MemberKey` are its public key); a closed strand with no
+   * `memberPrivateKey` throws, because it could never seat a founding manager.
    * Open strands derive no keypair (Header only). Idempotent — see
    * {@link bootstrapFounderMembership}.
    */
@@ -157,13 +157,13 @@ export class StrandDatabase {
   /**
    * Derive the founding keypair for a closed strand from its `memberPrivateKey`,
    * failing loudly when the key is absent (a closed strand with no founding
-   * Authority can never admit anyone).
+   * Manager can never admit anyone).
    */
   private deriveFounderKeyPair(strandId: string, memberPrivateKey: string | undefined) {
     if (!memberPrivateKey) {
       throw new Error(
         `Cannot found closed strand ${strandId}: the strand row has no MemberPrivateKey. ` +
-        'A closed strand needs a founding Member/Authority derived from that key.',
+        'A closed strand needs a founding Member/Manager derived from that key.',
       );
     }
     return strandMemberKeyPair(memberPrivateKey);

package/src/strand-formation-protocol.ts

@@ -174,7 +174,7 @@ const PLACEHOLDER_CADRE_ADDR = /^cadre-[ab]-\d+\.local$/;
  * placeholders), and returned a strand vouched for by the responder party with a real id.
  *
  * `createdBy: 'responder'` means "the responder party vouches for / returns this strand."
- * Under provision-then-record that strand was minted authority-signed earlier (not created
+ * Under provision-then-record that strand was minted owner-signed earlier (not created
  * in-session), but it is still the responder party returning its own strand, so the marker
  * — and this structural validator — stay unchanged.
  *

package/src/strand-instance-manager.ts

@@ -48,7 +48,7 @@ export interface StartStrandConfig {
   requireSignedSchemas?: boolean;
   /**
    * Whether this node founds the strand (vs. joins it). Forwarded to the
-   * StrandDatabase so the founder bootstrap (Header, founding Member/Authority)
+   * StrandDatabase so the founder bootstrap (Header, founding Member/Manager)
    * runs once at bring-up. Joiners leave this unset and write nothing. See
    * {@link StrandConfig.founder}.
    */
@@ -292,7 +292,7 @@ export class StrandInstanceManager {
         rawStorage: strandStorage,
         // Founder bootstrap inputs: the strand's type drives which membership rows
         // are written, and the closed-strand MemberPrivateKey derives the founding
-        // Member/Authority key. Both come off the control-network strand row.
+        // Member/Manager key. Both come off the control-network strand row.
         strandType: config.strandRow.Type,
         memberPrivateKey: config.strandRow.MemberPrivateKey ?? undefined,
         founder: config.founder

package/src/strand-member-key.ts

@@ -1,6 +1,6 @@
 import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import { authorityKeyFromLibp2p, type AuthorityKeyPair } from './authority-key.js';
+import { ed25519KeyPairFromLibp2p, type Ed25519KeyPair } from './ed25519-key.js';
 
 /**
  * Mint a fresh ed25519 strand member private key, encoded as base64 protobuf.
@@ -22,18 +22,18 @@ export async function generateStrandMemberKey(): Promise<string> {
  * base64url keypair the strand RBAC constraints consume.
  *
  * The `Strand` control-layer `MemberPrivateKey` is the closed-strand read-gating
- * secret; the founding `Member.Key`/`Authority.MemberKey` (the strand RBAC layer)
+ * secret; the founding `Member.Key`/`Manager.MemberKey` (the strand RBAC layer)
  * are *derived from it* — they are the `publicKeyB64` of the keypair this returns.
  * Decode the protobuf to a libp2p private key, then reuse
- * {@link authorityKeyFromLibp2p} so the same seed→public derivation used for node
- * authority keys yields a stable `{ privateKeyB64, publicKeyB64 }` whose public
+ * {@link ed25519KeyPairFromLibp2p} so the same seed→public derivation used for node
+ * owner keys yields a stable `{ privateKeyB64, publicKeyB64 }` whose public
  * key a later strand signature verifies against.
  *
  * @param memberPrivateKey - The strand's `MemberPrivateKey` (base64 protobuf).
- * @returns The base64url seed/public-key pair for founding membership/authority.
+ * @returns The base64url seed/public-key pair for founding membership/manager.
  * @throws If the decoded key is not Ed25519 or the raw bytes are malformed.
  */
-export function strandMemberKeyPair(memberPrivateKey: string): AuthorityKeyPair {
+export function strandMemberKeyPair(memberPrivateKey: string): Ed25519KeyPair {
   const privateKey = privateKeyFromProtobuf(uint8ArrayFromString(memberPrivateKey, 'base64'));
-  return authorityKeyFromLibp2p(privateKey);
+  return ed25519KeyPairFromLibp2p(privateKey);
 }

package/src/strand-member-registry.ts

@@ -2,11 +2,11 @@ import debug from 'debug';
 import type { Database, SqlValue } from '@quereus/quereus';
 import type { MemberRegistration } from './types.js';
 import type { MemberRegistry, MemberVerifier } from './enrollment.js';
-import type { AuthorityKeyPair } from './authority-key.js';
+import type { Ed25519KeyPair } from './ed25519-key.js';
 import {
   verifyStrandPayload,
   consumeInvite,
-  addMemberByAuthority,
+  addMemberByManager,
 } from './strand-membership-writer.js';
 import { canonicalDatetime } from './canonical-datetime.js';
 
@@ -37,10 +37,10 @@ export type StrandAdmission =
       readonly invitePrivateKey: string;
     }
   | {
-      /** Admit directly by authority signature (the authority-side join). */
-      readonly mode: 'authority';
-      /** The admitting authority's strand keypair. */
-      readonly authorityKeyPair: AuthorityKeyPair;
+      /** Admit directly by manager signature (the manager-side join). */
+      readonly mode: 'manager';
+      /** The admitting manager's strand keypair. */
+      readonly managerKeyPair: Ed25519KeyPair;
     };
 
 /**
@@ -115,8 +115,8 @@ export class StrandMemberVerifier implements MemberVerifier {
  * `Member.Authorized` is taken:
  * - `invite`  → {@link consumeInvite} (atomic `Member` + `ConsumedInvite`), the
  *   invitee-side flow that redeems a single-use invite.
- * - `authority` → {@link addMemberByAuthority}, the authority-side flow that
- *   seats a member already trusted by an authority.
+ * - `manager` → {@link addMemberByManager}, the manager-side flow that
+ *   seats a member already trusted by a manager.
  *
  * Scoped to one strand's db; the `strandId` argument is accepted for interface
  * compatibility but writes target this db's `Strand.*` tables.
@@ -152,8 +152,8 @@ export class StrandMemberRegistry implements MemberRegistry {
       return;
     }
 
-    await addMemberByAuthority(this.db, {
-      authorityKeyPair: this.admission.authorityKeyPair,
+    await addMemberByManager(this.db, {
+      managerKeyPair: this.admission.managerKeyPair,
       memberKey,
     });
   }