@serfab/cadre-host 0.7.1

package/dist/auth/trust-circle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-circle.js","sourceRoot":"","sources":["../../src/auth/trust-circle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAY1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,GAAG,EAAE,CAAC;AAyBvB;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IAK7B,YAAY,IAA+B;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAuC;QAMvD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;QAEtD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAElF,MAAM,OAAO,GAAkB;YAC7B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE/B,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,IAAuC;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,sEAAsE;YACtE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBACnE,mDAAmD;gBACnD,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,aAAa,GAAgB;YACjC,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,EAAE;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;YAChD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;QAEF,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,CAAC,CAAC;QAEhF,wEAAwE;QACxE,kEAAkE;QAClE,mCAAmC;QACnC,MAAM,MAAM,GAAsB;YAChC,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE7B,GAAG,CAAC,gDAAgD,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAEpF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAC/C,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAChC,4DAA4D,EAC5D,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAC/C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,EAAE,CAAC;gBAChF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAgB,CAAC;gBACpC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM;oBACN,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM;oBAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE;oBAC7B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,sEAAsE;QACtE,uDAAuD;QACvD,IAAI,EAAE,EAAE,CAAC;YACP,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iCAAiC;YACjC,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEzC,+BAA+B;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA2B;IACnE,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,mEAAmE;IACnE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Trust-circle types for cadre-host.
+ *
+ * The trust circle is the set of devices (peers) authorised to participate
+ * in the host's cadre. Membership is stored canonically in the cadre control
+ * network's `CadrePeer` table (via cadre-core). This module layers two pieces
+ * of *host-local* state on top:
+ *
+ *   - **Labels**: human-readable names ("Mom's phone") assigned by the host
+ *     admin. Display-only; loss just shows the bare peer ID.
+ *   - **Pending invites**: tokens that have been issued but not yet redeemed.
+ *     Operational state — lives on the issuing node, doesn't replicate.
+ *
+ * Both live in `<rootDir>/trust-circle.json`, written atomically.
+ */
+/** An authorised member of the trust circle (matches a `CadrePeer` row). */
+export interface TrustCircleMember {
+    /** libp2p peer ID. */
+    peerId: string;
+    /** Display label assigned by the host admin. */
+    label: string;
+    /** ISO timestamp when the peer was added. */
+    addedAt: string;
+    /** True if this row represents the host's own cadre node (self-enrolment). */
+    self?: boolean;
+}
+/** An invite that has been issued but not yet redeemed. */
+export interface PendingInvite {
+    /** Random token (base64url) used to match the redemption. */
+    token: string;
+    /** Display label that will be assigned to the redeemer on success. */
+    label: string;
+    /** ISO timestamp when the invite was issued. */
+    createdAt: string;
+    /** Optional ISO expiration timestamp. */
+    expiresAt?: string;
+}
+/** On-disk shape of `trust-circle.json`. */
+export interface TrustCircleFile {
+    version: 1;
+    /** keyed by peer ID. */
+    members: Record<string, Omit<TrustCircleMember, 'peerId'>>;
+    /** keyed by token. */
+    pendingInvites: Record<string, Omit<PendingInvite, 'token'>>;
+}
+/** Snapshot returned to the management UI. */
+export interface TrustCircleSnapshot {
+    members: TrustCircleMember[];
+    pending: PendingInvite[];
+}
+/**
+ * Typed HTTP handlers exposed to `cadre-host-local-ui` for Fastify wiring.
+ *
+ * Handlers take typed objects and either return typed results or throw a
+ * `TrustCircleError` whose `.code` the UI ticket maps to an HTTP status:
+ *
+ *   - `not_found`   → 404 (unknown token / unknown peer)
+ *   - `expired`     → 410 (invite past expiresAt)
+ *   - `already_redeemed` → 409 (token was used and is gone)
+ *   - default       → 500
+ */
+export interface TrustCircleHandlers {
+    postInvite(body: {
+        label: string;
+        ttlMs?: number;
+    }): Promise<{
+        encodedInvite: string;
+        token: string;
+        expiresAt?: string;
+    }>;
+    deleteInvite(token: string): Promise<void>;
+    deleteMember(peerId: string): Promise<void>;
+    listTrustCircle(): Promise<TrustCircleSnapshot>;
+}
+/** Error codes thrown by TrustCircleService. */
+export type TrustCircleErrorCode = 'not_found' | 'expired' | 'already_redeemed' | 'invalid_label' | 'invalid_token' | 'storage_error';
+/** Typed error carrying a stable `code` for HTTP mapping. */
+export declare class TrustCircleError extends Error {
+    readonly code: TrustCircleErrorCode;
+    constructor(code: TrustCircleErrorCode, message: string);
+}

package/dist/auth/types.js

@@ -0,0 +1,24 @@
+/**
+ * Trust-circle types for cadre-host.
+ *
+ * The trust circle is the set of devices (peers) authorised to participate
+ * in the host's cadre. Membership is stored canonically in the cadre control
+ * network's `CadrePeer` table (via cadre-core). This module layers two pieces
+ * of *host-local* state on top:
+ *
+ *   - **Labels**: human-readable names ("Mom's phone") assigned by the host
+ *     admin. Display-only; loss just shows the bare peer ID.
+ *   - **Pending invites**: tokens that have been issued but not yet redeemed.
+ *     Operational state — lives on the issuing node, doesn't replicate.
+ *
+ * Both live in `<rootDir>/trust-circle.json`, written atomically.
+ */
+/** Typed error carrying a stable `code` for HTTP mapping. */
+export class TrustCircleError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'TrustCircleError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwEH,6DAA6D;AAC7D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAGzC,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/bin/host.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * CLI entrypoint for cadre-host — the self-hosted cadre node manager.
+ *
+ * Most subcommands are still stubs at this stage (real implementations land
+ * in the sibling tickets cadre-host-nat, cadre-host-installer,
+ * cadre-host-local-ui).
+ *
+ * The `invite` and `trust` commands talk to the running cadre-host
+ * management API over loopback. They are thin HTTP clients — they don't
+ * spin up an inline service, so cadre-host must be running.
+ */
+export {};