@serfab/cadre-core 0.8.1 → 0.9.0

package/src/types.ts

@@ -4,6 +4,7 @@ import type { IRepo } from '@optimystic/db-core';
 import type { StrandDatabase } from './strand-database.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
 import type { KeyStore, KeyId } from './key-store.js';
+import type { PushNotifier } from './push-notifier.js';
 
 /**
  * Extended Libp2p node with the coordinatedRepo attached by db-p2p's
@@ -165,7 +166,7 @@ export interface NetworkConfig {
   transports?: Libp2pTransports;
   /**
    * Optional async resolver returning the multiaddrs to embed in invites
-   * (and other authority-address contexts). When unset, `libp2pNode.getMultiaddrs()`
+   * (and other owner-address contexts). When unset, `libp2pNode.getMultiaddrs()`
    * is used. Hosts behind NAT supply this to substitute their DDNS hostname
    * and externally-mapped port — see `@serfab/cadre-host`'s NatService.
    */
@@ -190,8 +191,8 @@ export interface NetworkConfig {
    */
   controlCohort?: {
     /**
-     * Cap on the number of NON-authority siblings dialed per reconcile pass
-     * (backbone/authority members are always dialed and do not count). Defaults
+     * Cap on the number of NON-owner siblings dialed per reconcile pass
+     * (backbone/owner members are always dialed and do not count). Defaults
      * to {@link DEFAULT_CONTROL_COHORT_TARGET_DEGREE}.
      */
     targetDegree?: number;
@@ -254,10 +255,10 @@ export interface CadreNodeConfig {
    * form). Mutually exclusive with {@link privateKey}. Absent ⇒ legacy behavior
    * (use `privateKey`, else libp2p generates an ephemeral key).
    *
-   * In the single-key reference model the authority signing key is *derived from*
-   * the node identity (see {@link CadreNode.getIdentityAuthorityKey}), so
-   * protecting the identity in a secure enclave protects the authority key too.
-   * A future separate-authority slot (`authorityKeyId`) is anticipated but not
+   * In the single-key reference model the owner signing key is *derived from*
+   * the node identity (see {@link CadreNode.getIdentityOwnerKey}), so
+   * protecting the identity in a secure enclave protects the owner key too.
+   * A future separate-owner slot (`ownerKeyId`) is anticipated but not
    * built here.
    */
   keyStore?: KeyStore;
@@ -296,7 +297,7 @@ export interface CadreNodeConfig {
 
   /**
    * Node-wide default trust anchor for INBOUND control-network seeds. Forwarded
-   * into every SeedBootstrapService this node constructs (authority, receive-only
+   * into every SeedBootstrapService this node constructs (owner, receive-only
    * listener, and the temp service used by applySeed when no service exists), and
    * used as the service-level default the libp2p seed-protocol handler relies on
    * (that path has no per-call override seam). Defaults to dbAnchoredTrustPolicy()
@@ -308,13 +309,32 @@ export interface CadreNodeConfig {
   seedTrustPolicy?: SeedTrustPolicy;
 
   /**
-   * Platform push-delivery credentials (FCM and/or APNs). When present, the node
-   * can deliver strand-wake data messages to suspended mobile peers over the
-   * platform push channel — the server fan-out constructs a `PushNotifier` from
-   * this. Absent ⇒ no platform push (control-network push-wake only). Injected
-   * per node by `cadre-host`; `privateKey` fields are secrets and are never logged.
+   * Platform push-delivery for suspended mobile peers. When present, the node's
+   * server fan-out can deliver strand-wake data messages over the platform push
+   * channel (FCM/APNs). Absent ⇒ no platform push (control-network push-wake only).
+   *
+   * The `notifier` is **injected**, not constructed here: a Node host builds it
+   * from `@serfab/cadre-core/push-node` (`createPushNotifier(credentials)`) and
+   * passes the instance, so the FCM/APNs modules (`node:crypto`/`node:http2`)
+   * stay out of the cross-platform core graph. Ownership transfers to the node on
+   * injection — `CadreNode.stop` closes the notifier (via `PushFanoutService`),
+   * releasing its APNs HTTP/2 session; a host must NOT also close an injected
+   * notifier itself. `cooldownMs`/`debounceMs` carry the fan-out anti-spam policy.
    */
-  push?: PushCredentials;
+  push?: {
+    /** The Node-constructed push router (see `@serfab/cadre-core/push-node`). */
+    notifier: PushNotifier;
+    /**
+     * Per-`(peer, strand)` minimum gap between push-wakes the fan-out emits.
+     * Default {@link DEFAULT_PUSH_COOLDOWN_MS} (5 min).
+     */
+    cooldownMs?: number;
+    /**
+     * Per-strand burst-coalescing window: a second trigger within it is dropped.
+     * Default {@link DEFAULT_PUSH_DEBOUNCE_MS} (10 s).
+     */
+    debounceMs?: number;
+  };
 }
 
 /**
@@ -458,7 +478,7 @@ export interface StrandConfig {
    * published the strand (the responder in formation, the creator in host/solo
    * paths; the same party that calls {@link CadreNode.publishStrand}). The founder
    * runs the one-time membership bootstrap at bring-up (writes `Strand.Header`, and
-   * for a closed strand the founding `Member`+`Authority`). A joiner leaves this
+   * for a closed strand the founding `Member`+`Manager`). A joiner leaves this
    * `false`/unset and writes nothing — it receives those rows via Optimystic sync.
    * Defaults to `false`.
    */
@@ -638,11 +658,11 @@ export interface PeerAddressRecord {
 
 /**
  * Outcome of {@link CadreNode.registerSelf}, surfaced so callers (e.g. the CLI
- * `--authority` branch) can log what happened:
- * - `inserted` — the first authority-signed INSERT of this node's `CadrePeer` row.
+ * `--owner` branch) can log what happened:
+ * - `inserted` — the first owner-signed INSERT of this node's `CadrePeer` row.
  * - `refreshed` — a self-signed UPDATE of an existing row (heartbeat / addr change).
  * - `skipped` — nothing written (no self-signing key, or not yet a member with no
- *   authority service to self-insert).
+ *   owner service to self-insert).
  */
 export type SelfRegistrationOutcome = 'inserted' | 'refreshed' | 'skipped';
 
@@ -661,7 +681,7 @@ export interface ResolveOpts {
   /**
    * Pluggable trust gate, evaluated after signature + freshness pass. Defaults
    * to {@link currentMemberTrustPolicy} (any existing — therefore
-   * authority-vouched — CadrePeer member is trusted). Inject a stricter policy
+   * owner-vouched — CadrePeer member is trusted). Inject a stricter policy
    * (e.g. from `seed-signerkey-trust-policy`) to reject otherwise-valid records
    * before dialing.
    */
@@ -809,9 +829,9 @@ export interface SeedPeer {
   peerId: string;
   /** Multiaddrs for connecting to this peer */
   multiaddrs: string[];
-  /** Whether this peer holds an authority key */
-  isAuthority: boolean;
-  /** ed25519 public key (base64url) — present on authority peers for signerKey verification */
+  /** Whether this peer holds an owner key */
+  isOwner: boolean;
+  /** ed25519 public key (base64url) — present on owner peers for signerKey verification */
   publicKey?: string;
 }
 
@@ -826,9 +846,9 @@ export interface ControlNetworkSeed {
   partyId: string;
   /** Known peers in the cadre */
   peers: SeedPeer[];
-  /** Signature over the seed by an authority key */
+  /** Signature over the seed by an owner key */
   signature: string;
-  /** The authority key that signed this seed */
+  /** The owner key that signed this seed */
   signerKey: string;
 }
 
@@ -841,9 +861,9 @@ export interface SeedMessage {
   partyId: string;
   /** Known peers in the cadre */
   peers: SeedPeer[];
-  /** Signature by an authority key */
+  /** Signature by an owner key */
   signature: string;
-  /** The authority key that signed this message */
+  /** The owner key that signed this message */
   signerKey: string;
 }
 
@@ -953,15 +973,15 @@ export type NodeTopology = 'public' | 'nat';
 export interface CadreInvite {
   /** Party ID of the cadre */
   partyId: string;
-  /** Multiaddrs to dial the authority */
-  authorityAddrs: string[];
+  /** Multiaddrs to dial the owner */
+  ownerAddrs: string[];
   /**
-   * Authority ed25519 public keys (base64url) of the cadre, carried out-of-band
-   * so a cold-start invitee can pin the trusted authority set before applying
+   * Owner ed25519 public keys (base64url) of the cadre, carried out-of-band
+   * so a cold-start invitee can pin the trusted owner set before applying
    * any seed (the seed itself cannot vouch for its own signer). Populated by
-   * `createInvite` from the issuer's `AuthorityKey` table.
+   * `createInvite` from the issuer's `OwnerKey` table.
    */
-  authorityKeys?: string[];
+  ownerKeys?: string[];
   /** Optional invite token for validation */
   token?: string;
   /** Timestamp when invite was created */

package/dist/authority-key.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority-key.js","sourceRoot":"","sources":["../src/authority-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAcjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAsB;IAC3D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uDAAuD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;QACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAAC,aAAqB;IACjE,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AACpF,CAAC"}