@serfab/cadre-host 0.8.1 → 0.10.0

package/dist/{authority/authority-node-client.js → owner/owner-node-client.js}

@@ -1,41 +1,42 @@
 /**
- * HTTP client for the authority node's loopback admin channel (the 6.6
+ * HTTP client for the owner node's loopback admin channel (the 6.6
  * `cadre-node-admin-channel` contract).
  *
  * cadre-host's manager process holds no in-process `CadreNode`; it spawns the
- * admin's authority node as a managed child (see `HostProcessOrchestrator`)
- * and delegates all authority/membership/identity operations to it over this
- * client. The client implements **both** trimmed `CadreNodeLike` interfaces —
- * the trust-circle one (`auth/trust-circle.ts`) and the NAT one
- * (`nat/nat-service.ts`) — plus `pushInviteAddresses`.
+ * admin's owner node as a managed child (see `HostProcessOrchestrator`)
+ * and delegates all owner/membership/identity operations to it over this
+ * client. The client implements **all three** trimmed `CadreNodeLike`
+ * interfaces — the trust-circle one (`auth/trust-circle.ts`), the NAT one
+ * (`nat/nat-service.ts`), and the strand one (`strands/strand-service.ts`) —
+ * plus `pushInviteAddresses` and `addDrone` (the node-donation requester side).
  *
  * Transport: `Authorization: Bearer <token>` against
  * `http://127.0.0.1:<adminPort>`. Every response uses the cadre-provider
  * envelope `{ ok: true, data }` / `{ ok: false, error: { code, message } }`.
  * A refused connection, a transport error, or any non-2xx response surfaces
- * as {@link AuthorityNodeUnavailableError}; the trust-circle / NAT services
+ * as {@link OwnerNodeUnavailableError}; the trust-circle / NAT services
  * translate that into a `node_unavailable` domain error so the management API
  * returns a clear 503 rather than a raw 500.
  */
 import debug from 'debug';
-const log = debug('cadre:host:authority-client');
+const log = debug('cadre:host:owner-client');
 /**
- * Raised when the authority node's admin channel can't be reached or returns
+ * Raised when the owner node's admin channel can't be reached or returns
  * a non-success response. Carries the node's stable error `code` when one was
  * present in the envelope (e.g. `not_ready`, `not_authorized`).
  */
-export class AuthorityNodeUnavailableError extends Error {
+export class OwnerNodeUnavailableError extends Error {
     constructor(message, nodeCode) {
         super(message);
-        this.name = 'AuthorityNodeUnavailableError';
+        this.name = 'OwnerNodeUnavailableError';
         if (nodeCode !== undefined)
             this.nodeCode = nodeCode;
     }
 }
-export class AuthorityNodeClient {
+export class OwnerNodeClient {
     /**
      * @param endpoint Either a fixed `{ baseUrl, token }` or a getter returning
-     *   the current endpoint (pass `orchestrator.getAuthorityAdminEndpoint`
+     *   the current endpoint (pass `orchestrator.getOwnerAdminEndpoint`
      *   bound, so a restart's new bearer token is picked up automatically).
      */
     constructor(endpoint, opts = {}) {
@@ -78,6 +79,15 @@ export class AuthorityNodeClient {
         const data = await this.request('GET', `/admin/members/${encodeURIComponent(peerId)}`);
         return data.member;
     }
+    /** Authorized-membership surface (excludes self) — see {@link listMembers} for the addressable one. */
+    async listAuthorizedMembers() {
+        const data = await this.request('GET', '/admin/authorized-members');
+        return data.members;
+    }
+    async isAuthorizedMember(peerId) {
+        const data = await this.request('GET', `/admin/authorized-members/${encodeURIComponent(peerId)}`);
+        return data.member;
+    }
     // --- NAT CadreNodeLike ---
     async getPeerId() {
         const data = await this.request('GET', '/admin/identity');
@@ -87,6 +97,37 @@ export class AuthorityNodeClient {
         const data = await this.request('GET', '/admin/multiaddrs');
         return data.multiaddrs;
     }
+    // --- strand CadreNodeLike ---
+    /** This party's strands plus the node's current control-connection count. */
+    async listStrands() {
+        return await this.request('GET', '/admin/strands');
+    }
+    /**
+     * Remove this party's participation in one strand.
+     *
+     * `?confirm=1` is appended **only** when the caller asked for it. The node
+     * refuses an unconfirmed closed-strand removal with `confirmation_required`;
+     * that refusal is surfaced, never retried with the flag added — the row holds
+     * this party's membership key for the strand and nothing else does.
+     */
+    async removeStrand(strandId, opts) {
+        const query = opts.confirm ? '?confirm=1' : '';
+        return await this.request('DELETE', `/admin/strands/${encodeURIComponent(strandId)}${query}`);
+    }
+    // --- drone seeding (node-donation requester side) ---
+    /**
+     * Mint a seed authorizing a drone — a provider-hosted / donated node — to join
+     * this node's cadre. The node signs the seed with its own authority key; only
+     * the signed, public `encodedSeed` is returned (the private key never leaves
+     * the node). This is the requester ("phone") side of the node-donation flow:
+     * the donor host presents the returned seed to the donated node's `POST /seed`.
+     */
+    async addDrone(options) {
+        return await this.request('POST', '/admin/add-drone', {
+            dronePeerId: options.dronePeerId,
+            droneMultiaddrs: options.droneMultiaddrs,
+        });
+    }
     // --- push-model invite addresses ---
     /** Push the NAT-resolved addresses the node should embed in future invites. */
     async pushInviteAddresses(addresses) {
@@ -96,7 +137,7 @@ export class AuthorityNodeClient {
     resolveEndpoint() {
         const ep = typeof this.endpointSource === 'function' ? this.endpointSource() : this.endpointSource;
         if (!ep) {
-            throw new AuthorityNodeUnavailableError('Authority node admin endpoint is not available');
+            throw new OwnerNodeUnavailableError('Owner node admin endpoint is not available');
         }
         return ep;
     }
@@ -115,14 +156,14 @@ export class AuthorityNodeClient {
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             log('admin %s %s transport error: %s', method, path, message);
-            throw new AuthorityNodeUnavailableError(`Authority node unreachable: ${message}`);
+            throw new OwnerNodeUnavailableError(`Owner node unreachable: ${message}`);
         }
         const envelope = await this.parseEnvelope(res);
         if (!res.ok || !envelope.ok) {
             const code = envelope.error?.code;
             const message = envelope.error?.message ?? `admin ${method} ${path} → HTTP ${res.status}`;
             log('admin %s %s failed: [%s] %s', method, path, code ?? res.status, message);
-            throw new AuthorityNodeUnavailableError(message, code);
+            throw new OwnerNodeUnavailableError(message, code);
         }
         return envelope.data;
     }
@@ -140,4 +181,4 @@ export class AuthorityNodeClient {
         return {};
     }
 }
-//# sourceMappingURL=authority-node-client.js.map
+//# sourceMappingURL=owner-node-client.js.map

package/dist/owner/owner-node-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-node-client.js","sourceRoot":"","sources":["../../src/owner/owner-node-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAIlD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvD,CAAC;CACF;AAaD,MAAM,OAAO,eAAe;IAK1B;;;;OAIG;IACH,YAAY,QAAwB,EAAE,OAA+B,EAAE;QACrE,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,qCAAqC;IAErC,KAAK,CAAC,YAAY,CAChB,KAAc,EACd,WAAoB;QAEpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9D,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,MAAM,EACN,gBAAgB,EAChB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAgD,EAChD,YAA0B;QAE1B,MAAM,IAAI,GAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,MAAmB;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC/C,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,qBAAqB;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,2BAA2B,CAC5B,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC1D,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA6C,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA2B,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,+BAA+B;IAE/B,6EAA6E;IAC7E,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,IAAI,CAAC,OAAO,CAAqB,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAA0B;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,QAAQ,EACR,kBAAkB,kBAAkB,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,uDAAuD;IAEvD;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2D;QACxE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAkB,MAAM,EAAE,kBAAkB,EAAE;YACrE,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IAEtC,+EAA+E;IAC/E,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,oBAAoB;IAEZ,eAAe;QACrB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACnG,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,iCAAiC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,IAAI,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1F,GAAG,CAAC,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAa;QAKvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,MAAuF,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,oCAAoC;QACtC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/server/error-handler.d.ts

@@ -2,7 +2,8 @@
  * Fastify error handler — translates known typed errors to stable HTTP status
  * codes and uniform `{ ok: false, error: { code, message } }` payloads.
  *
- * Codes (cross-referenced with `auth/types.ts`, `nat/types.ts`, `update/types.ts`):
+ * Codes (cross-referenced with `auth/types.ts`, `nat/types.ts`, `strands/types.ts`,
+ * `update/types.ts`):
  *   - TrustCircleError
  *       invalid_label, invalid_token             → 400
  *       not_found, already_redeemed              → 404
@@ -16,12 +17,32 @@
  *       mapping_failed, router_unreachable,
  *       ip_detection_failed, ddns_update_failed  → 500
  *       node_unavailable                         → 503
+ *   - StrandError
+ *       invalid_id                               → 400
+ *       confirmation_required                    → 428
+ *       node_unavailable                         → 503
+ *       internal                                 → 500
  *   - UpdateErrorException
  *       manifest_invalid, no_update_available,
  *       min_previous_version                     → 400
  *       apply_in_progress                        → 409
  *       signature_invalid, unsupported_state_version,
  *       apply_failed, rollback_failed, storage_error → 500
+ *   - GrantError
+ *       invalid_label, invalid_max_nodes,
+ *       invalid_ttl                              → 400
+ *       not_found                                → 404
+ *       storage_error                            → 500
+ *   - DonationError
+ *       invalid_request                          → 400
+ *       unauthorized                             → 401
+ *       forbidden                                → 403
+ *       not_found                                → 404
+ *       invalid_state                            → 409
+ *       quota_exceeded                           → 429
+ *       orchestrator_error, storage_error        → 500
+ *       seed_failed                              → 502
+ *       peer_unavailable                         → 503
  *   - everything else                            → 500 (code "internal")
  */
 import type { FastifyInstance } from 'fastify';

package/dist/server/error-handler.js

@@ -2,7 +2,8 @@
  * Fastify error handler — translates known typed errors to stable HTTP status
  * codes and uniform `{ ok: false, error: { code, message } }` payloads.
  *
- * Codes (cross-referenced with `auth/types.ts`, `nat/types.ts`, `update/types.ts`):
+ * Codes (cross-referenced with `auth/types.ts`, `nat/types.ts`, `strands/types.ts`,
+ * `update/types.ts`):
  *   - TrustCircleError
  *       invalid_label, invalid_token             → 400
  *       not_found, already_redeemed              → 404
@@ -16,18 +17,40 @@
  *       mapping_failed, router_unreachable,
  *       ip_detection_failed, ddns_update_failed  → 500
  *       node_unavailable                         → 503
+ *   - StrandError
+ *       invalid_id                               → 400
+ *       confirmation_required                    → 428
+ *       node_unavailable                         → 503
+ *       internal                                 → 500
  *   - UpdateErrorException
  *       manifest_invalid, no_update_available,
  *       min_previous_version                     → 400
  *       apply_in_progress                        → 409
  *       signature_invalid, unsupported_state_version,
  *       apply_failed, rollback_failed, storage_error → 500
+ *   - GrantError
+ *       invalid_label, invalid_max_nodes,
+ *       invalid_ttl                              → 400
+ *       not_found                                → 404
+ *       storage_error                            → 500
+ *   - DonationError
+ *       invalid_request                          → 400
+ *       unauthorized                             → 401
+ *       forbidden                                → 403
+ *       not_found                                → 404
+ *       invalid_state                            → 409
+ *       quota_exceeded                           → 429
+ *       orchestrator_error, storage_error        → 500
+ *       seed_failed                              → 502
+ *       peer_unavailable                         → 503
  *   - everything else                            → 500 (code "internal")
  */
 import debug from 'debug';
 import { TrustCircleError } from '../auth/types.js';
 import { NatError } from '../nat/types.js';
+import { StrandError } from '../strands/types.js';
 import { UpdateErrorException } from '../update/types.js';
+import { GrantError, DonationError } from '../donation/types.js';
 const log = debug('cadre:host:error-handler');
 const TRUST_STATUS = {
     invalid_label: 400,
@@ -50,6 +73,37 @@ const NAT_STATUS = {
     ddns_update_failed: 500,
     node_unavailable: 503,
 };
+/**
+ * 428 (Precondition Required) for `confirmation_required`: the node refused a
+ * closed-strand removal because the caller had not confirmed. It is not a 400
+ * (the request was well-formed) and not a 409 (nothing conflicts) — the caller
+ * must re-send with the precondition satisfied.
+ */
+const STRAND_STATUS = {
+    invalid_id: 400,
+    confirmation_required: 428,
+    node_unavailable: 503,
+    internal: 500,
+};
+const GRANT_STATUS = {
+    invalid_label: 400,
+    invalid_max_nodes: 400,
+    invalid_ttl: 400,
+    not_found: 404,
+    storage_error: 500,
+};
+const DONATION_STATUS = {
+    unauthorized: 401,
+    forbidden: 403,
+    quota_exceeded: 429,
+    invalid_request: 400,
+    not_found: 404,
+    invalid_state: 409,
+    seed_failed: 502,
+    peer_unavailable: 503,
+    orchestrator_error: 500,
+    storage_error: 500,
+};
 const UPDATE_STATUS = {
     manifest_invalid: 400,
     no_update_available: 400,
@@ -83,9 +137,18 @@ function classify(err) {
     if (err instanceof NatError) {
         return { status: NAT_STATUS[err.code] ?? 500, code: err.code, message: err.message };
     }
+    if (err instanceof StrandError) {
+        return { status: STRAND_STATUS[err.code] ?? 500, code: err.code, message: err.message };
+    }
     if (err instanceof UpdateErrorException) {
         return { status: UPDATE_STATUS[err.code] ?? 500, code: err.code, message: err.message };
     }
+    if (err instanceof GrantError) {
+        return { status: GRANT_STATUS[err.code] ?? 500, code: err.code, message: err.message };
+    }
+    if (err instanceof DonationError) {
+        return { status: DONATION_STATUS[err.code] ?? 500, code: err.code, message: err.message };
+    }
     // Fastify body-parsing / validation errors have a statusCode we should honour.
     if (typeof err.statusCode === 'number' && err.statusCode >= 400 && err.statusCode < 600) {
         return {

package/dist/server/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/server/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAA6B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAqB,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAwB,MAAM,oBAAoB,CAAC;AAEhF,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,MAAM,YAAY,GAAyC;IACzD,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,OAAO,EAAE,GAAG;IACZ,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF,MAAM,UAAU,GAAiC;IAC/C,cAAc,EAAE,GAAG;IACnB,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,mBAAmB,EAAE,GAAG;IACxB,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;IACnB,kBAAkB,EAAE,GAAG;IACvB,mBAAmB,EAAE,GAAG;IACxB,kBAAkB,EAAE,GAAG;IACvB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF,MAAM,aAAa,GAAoC;IACrD,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,iBAAiB,EAAE,GAAG;IACtB,yBAAyB,EAAE,GAAG;IAC9B,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,GAAG;IACpB,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,GAAG,CAAC,eAAe,CAAC,CAAC,GAAiB,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,QAAQ,CAAC,GAAiB;IACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QACxF,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB;SACzC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;AACrF,CAAC"}
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/server/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAA6B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAqB,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAwB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAwB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAuB,aAAa,EAA0B,MAAM,sBAAsB,CAAC;AAE9G,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,MAAM,YAAY,GAAyC;IACzD,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,OAAO,EAAE,GAAG;IACZ,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF,MAAM,UAAU,GAAiC;IAC/C,cAAc,EAAE,GAAG;IACnB,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,mBAAmB,EAAE,GAAG;IACxB,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;IACnB,kBAAkB,EAAE,GAAG;IACvB,mBAAmB,EAAE,GAAG;IACxB,kBAAkB,EAAE,GAAG;IACvB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAoC;IACrD,UAAU,EAAE,GAAG;IACf,qBAAqB,EAAE,GAAG;IAC1B,gBAAgB,EAAE,GAAG;IACrB,QAAQ,EAAE,GAAG;CACd,CAAC;AAEF,MAAM,YAAY,GAAmC;IACnD,aAAa,EAAE,GAAG;IAClB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;IAChB,SAAS,EAAE,GAAG;IACd,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,eAAe,GAAsC;IACzD,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,SAAS,EAAE,GAAG;IACd,aAAa,EAAE,GAAG;IAClB,WAAW,EAAE,GAAG;IAChB,gBAAgB,EAAE,GAAG;IACrB,kBAAkB,EAAE,GAAG;IACvB,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,aAAa,GAAoC;IACrD,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,iBAAiB,EAAE,GAAG;IACtB,yBAAyB,EAAE,GAAG;IAC9B,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,GAAG;IACpB,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,GAAG,CAAC,eAAe,CAAC,CAAC,GAAiB,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,QAAQ,CAAC,GAAiB;IACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5F,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QACxF,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB;SACzC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;AACrF,CAAC"}

package/dist/server/events/types.d.ts

@@ -13,6 +13,9 @@ export type LocalUiEvent = {
 } | {
     type: 'trust-circle-changed';
     kind: 'invited' | 'redeemed' | 'revoked';
+} | {
+    type: 'strands-changed';
+    kind: 'removed';
 } | {
     type: 'connectivity-changed';
     portMode: PortForwardMode;

package/dist/server/index.d.ts

@@ -16,7 +16,9 @@ import type { FastifyInstance } from 'fastify';
 import type { HostProcessOrchestrator } from '../orchestrator/index.js';
 import type { TrustCircleService } from '../auth/index.js';
 import type { NatService } from '../nat/index.js';
+import type { StrandService } from '../strands/index.js';
 import type { UpdateService } from '../update/index.js';
+import type { GrantService, DonationService } from '../donation/index.js';
 import { EventBus } from './events/bus.js';
 import { HostSettingsStore } from './settings-store.js';
 export interface LocalUiServerOptions {
@@ -26,10 +28,39 @@ export interface LocalUiServerOptions {
     dataDir: string;
     /** Wired dependencies — all owned by the caller. */
     orchestrator: HostProcessOrchestrator;
-    trustCircle: TrustCircleService;
-    nat: NatService;
+    /**
+     * Trust-circle service — present only when the host runs its own personal
+     * cadre (`ownCadre.enabled`). Absent in donor-only mode, where `/auth/*`
+     * stays unmounted and 404s.
+     */
+    trustCircle?: TrustCircleService;
+    /**
+     * NAT service — present only when the host runs its own personal cadre.
+     * Absent in donor-only mode (loopback-only in v1), where `/nat/*` stays
+     * unmounted and 404s.
+     */
+    nat?: NatService;
+    /**
+     * Strand service — present only when the host runs its own personal cadre.
+     * Absent in donor-only mode, where there is no owner node to ask, so
+     * `/api/strands` stays unmounted and 404s through the static handler.
+     */
+    strands?: StrandService;
     /** Optional — 6.4.2 lands this; nullable while still iterating. */
     update?: UpdateService;
+    /**
+     * Donation grant layer. When present, mounts the loopback admin surface at
+     * `/grants-admin` (issue/list/revoke). Optional so existing callers/tests
+     * that don't exercise donations need not wire it.
+     */
+    grants?: GrantService;
+    /**
+     * Donation lifecycle service. When present (alongside `grants`), mounts the
+     * bearer-gated grantee-facing provisioning surface at `/grants`
+     * (provision / peer / seed / terminate). Optional so callers/tests that don't
+     * exercise the donor path need not wire it.
+     */
+    donations?: DonationService;
     /** Settings I/O facade. Defaults to a new one rooted at `dataDir`. */
     settingsStore?: HostSettingsStore;
     /** Bus instance — pass the same one to subsystems that publish events. */

package/dist/server/index.js

@@ -14,7 +14,9 @@
  */
 import { createTrustCircleHandlers } from '../auth/index.js';
 import { createNatHandlers } from '../nat/index.js';
+import { createStrandHandlers } from '../strands/index.js';
 import { createUpdateHandlers } from '../update/index.js';
+import { createGrantAdminHandlers } from '../donation/index.js';
 import { EventBus } from './events/bus.js';
 import { registerSseRoute } from './events/sse-route.js';
 import { registerErrorHandler } from './error-handler.js';
@@ -23,10 +25,13 @@ import { registerStaticMount } from './static.js';
 import { buildFastify, startListening, stopListening } from './server.js';
 import { registerNatRoutes } from './routes/nat.js';
 import { registerTrustCircleRoutes } from './routes/trust-circle.js';
+import { registerStrandRoutes } from './routes/strands.js';
 import { registerUpdateRoutes } from './routes/update.js';
 import { registerStatusRoute } from './routes/status.js';
 import { registerNodesRoutes } from './routes/nodes.js';
 import { registerSettingsRoutes } from './routes/settings.js';
+import { registerGrantsAdminRoutes } from './routes/grants-admin.js';
+import { registerGrantsRoutes } from './routes/grants.js';
 import { HostSettingsStore } from './settings-store.js';
 /** How often to poll UpdateService.getState() looking for new versions. */
 const UPDATE_OBSERVER_INTERVAL_MS = 60000;
@@ -44,17 +49,36 @@ export function createLocalUiServer(opts) {
     });
     registerStatusRoute(app, {
         orchestrator: opts.orchestrator,
-        trustCircle: opts.trustCircle,
-        nat: opts.nat,
+        ...(opts.trustCircle ? { trustCircle: opts.trustCircle } : {}),
+        ...(opts.nat ? { nat: opts.nat } : {}),
         ...(opts.update ? { update: opts.update } : {}),
     });
     registerNodesRoutes(app, { orchestrator: opts.orchestrator });
-    registerSettingsRoutes(app, { settingsStore, nat: opts.nat, ...(opts.update ? { update: opts.update } : {}) });
-    registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(opts.trustCircle), events });
-    registerNatRoutes(app, { handlers: createNatHandlers(opts.nat), events });
+    registerSettingsRoutes(app, { settingsStore, ...(opts.nat ? { nat: opts.nat } : {}), ...(opts.update ? { update: opts.update } : {}) });
+    // Trust-circle + NAT + strand surfaces exist only when the host runs its own
+    // personal cadre. In donor-only mode they're left unmounted, so `/auth/*`,
+    // `/nat/*` and `/api/strands` fall through to the static not-found handler and
+    // 404 (see static.ts).
+    if (opts.trustCircle) {
+        registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(opts.trustCircle), events });
+    }
+    if (opts.nat) {
+        registerNatRoutes(app, { handlers: createNatHandlers(opts.nat), events });
+    }
+    if (opts.strands) {
+        registerStrandRoutes(app, { handlers: createStrandHandlers(opts.strands), events });
+    }
     if (opts.update) {
         registerUpdateRoutes(app, { handlers: createUpdateHandlers(opts.update), events });
     }
+    if (opts.grants) {
+        registerGrantsAdminRoutes(app, { handlers: createGrantAdminHandlers(opts.grants) });
+        // Grantee-facing provisioning surface needs both the donation service and a
+        // grant validator (the GrantService doubles as the validator).
+        if (opts.donations) {
+            registerGrantsRoutes(app, { donations: opts.donations, grants: opts.grants });
+        }
+    }
     // Static mount registers as the not-found handler — declared last so the
     // API paths above win.
     registerStaticMount(app, { ...(opts.staticRoot !== undefined ? { rootDir: opts.staticRoot } : {}) });
@@ -85,17 +109,20 @@ export function createLocalUiServer(opts) {
                 });
             }));
             // One-shot connectivity publish — the SPA will get a sane initial
-            // signal even if no settings have changed yet this session.
-            try {
-                const snap = opts.nat.getStatus();
-                events.publish({
-                    type: 'connectivity-changed',
-                    portMode: snap.portMode,
-                    directReachability: snap.directReachability,
-                });
-            }
-            catch {
-                // NatService.start may not have completed; harmless to skip.
+            // signal even if no settings have changed yet this session. Skipped in
+            // donor-only mode, where there is no NatService.
+            if (opts.nat) {
+                try {
+                    const snap = opts.nat.getStatus();
+                    events.publish({
+                        type: 'connectivity-changed',
+                        portMode: snap.portMode,
+                        directReachability: snap.directReachability,
+                    });
+                }
+                catch {
+                    // NatService.start may not have completed; harmless to skip.
+                }
             }
             // Update observer: poll UpdateService.getState() every 60 s and emit
             // `update-available` when `available.version` changes. Cheap, avoids

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA0CxD,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,KAAM,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAE7F,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,qEAAqE;IAErE,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,uEAAuE;IACvE,iDAAiD;IACjD,gBAAgB,CAAC,GAAG,EAAE;QACpB,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,mBAAmB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAE/G,yBAAyB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,iBAAiB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,oBAAoB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,yEAAyE;IACzE,uBAAuB;IACvB,mBAAmB,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAErG,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,CAAC,KAAK;YACT,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,oEAAoE;YACpE,gEAAgE;YAChE,6DAA6D;YAC7D,mBAAmB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACxC,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,KAAK,GAAG,OAAO,CAAC;YAEhB,0DAA0D;YAC1D,QAAQ,CAAC,IAAI,CACX,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE;gBACvC,MAAM,CAAC,OAAO,CAAC;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAC1D,CAAC,CAAC;YACL,CAAC,CAAC,CACH,CAAC;YAEF,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,OAAO,CAAC;oBACb,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,WAA+B,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;oBACrC,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;wBACtC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;wBAClC,IAAI,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;4BACxE,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;4BAChC,MAAM,CAAC,OAAO,CAAC;gCACb,IAAI,EAAE,kBAAkB;gCACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gCAC1B,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACrF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC,CAAC;gBACF,+EAA+E;gBAC/E,KAAK,IAAI,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;gBAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;oBACjD,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC9C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5C,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBAAC,EAAE,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAuExD,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,KAAM,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAE7F,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,qEAAqE;IAErE,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,uEAAuE;IACvE,iDAAiD;IACjD,gBAAgB,CAAC,GAAG,EAAE;QACpB,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,mBAAmB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9D,sBAAsB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAExI,6EAA6E;IAC7E,2EAA2E;IAC3E,+EAA+E;IAC/E,uBAAuB;IACvB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,yBAAyB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,oBAAoB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,oBAAoB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,yBAAyB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,oBAAoB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,uBAAuB;IACvB,mBAAmB,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAErG,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,CAAC,KAAK;YACT,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,oEAAoE;YACpE,gEAAgE;YAChE,6DAA6D;YAC7D,mBAAmB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACxC,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,KAAK,GAAG,OAAO,CAAC;YAEhB,0DAA0D;YAC1D,QAAQ,CAAC,IAAI,CACX,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE;gBACvC,MAAM,CAAC,OAAO,CAAC;oBACb,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAC1D,CAAC,CAAC;YACL,CAAC,CAAC,CACH,CAAC;YAEF,kEAAkE;YAClE,uEAAuE;YACvE,iDAAiD;YACjD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBAClC,MAAM,CAAC,OAAO,CAAC;wBACb,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;qBAC5C,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;gBAC/D,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,WAA+B,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;oBACrC,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;wBACtC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;wBAClC,IAAI,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;4BACxE,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;4BAChC,MAAM,CAAC,OAAO,CAAC;gCACb,IAAI,EAAE,kBAAkB;gCACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gCAC1B,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACrF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC,CAAC;gBACF,+EAA+E;gBAC/E,KAAK,IAAI,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;gBAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;oBACjD,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC9C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5C,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBAAC,EAAE,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/server/routes/grants-admin.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Donation grant **admin** HTTP routes — thin adapters around
+ * `GrantAdminHandlers` (`createGrantAdminHandlers(service)`).
+ *
+ * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
+ * targets. It is **loopback, no bearer**: same-machine admin, matching
+ * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
+ * Security posture). This is distinct from the grantee-facing `/grants`
+ * provisioning surface that carries the bearer gate — that arrives in the
+ * `2-donation-service` ticket.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { GrantAdminHandlers } from '../../donation/types.js';
+export interface GrantsAdminRoutesOptions {
+    handlers: GrantAdminHandlers;
+}
+export declare function registerGrantsAdminRoutes(app: FastifyInstance, opts: GrantsAdminRoutesOptions): void;

package/dist/server/routes/grants-admin.js

@@ -0,0 +1,32 @@
+/**
+ * Donation grant **admin** HTTP routes — thin adapters around
+ * `GrantAdminHandlers` (`createGrantAdminHandlers(service)`).
+ *
+ * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
+ * targets. It is **loopback, no bearer**: same-machine admin, matching
+ * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
+ * Security posture). This is distinct from the grantee-facing `/grants`
+ * provisioning surface that carries the bearer gate — that arrives in the
+ * `2-donation-service` ticket.
+ */
+export function registerGrantsAdminRoutes(app, opts) {
+    const { handlers } = opts;
+    app.get('/grants-admin', async () => {
+        return handlers.listGrants();
+    });
+    app.post('/grants-admin', async (request) => {
+        const body = (request.body ?? {});
+        const label = typeof body.label === 'string' ? body.label : '';
+        const args = { label };
+        if (typeof body.maxNodes === 'number')
+            args.maxNodes = body.maxNodes;
+        if (typeof body.ttlMs === 'number')
+            args.ttlMs = body.ttlMs;
+        return handlers.postGrant(args);
+    });
+    app.delete('/grants-admin/:token', async (request) => {
+        await handlers.deleteGrant(request.params.token);
+        return { ok: true };
+    });
+}
+//# sourceMappingURL=grants-admin.js.map

package/dist/server/routes/grants-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-admin.js","sourceRoot":"","sources":["../../../src/server/routes/grants-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,UAAU,yBAAyB,CAAC,GAAoB,EAAE,IAA8B;IAC5F,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAClC,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA6D,CAAC;QAC9F,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAyD,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5D,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAgC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClF,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/grants.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Grantee-facing donation routes — the HTTP surface an external cadre authority
+ * (a friend's phone) drives to have this host donate a node into *its* cadre.
+ *
+ * Mount path: `/grants`. Distinct from the loopback-only `/grants-admin` surface
+ * (issue/list/revoke, no bearer): this one is **bearer-gated** — every request
+ * carries `Authorization: Bearer <grant-token>`, and a grantee sees only the
+ * donations its own grant authorized (the single cross-grantee boundary,
+ * analogous to cadre-provider's per-customer ownership check).
+ *
+ * Reachability is out of scope here: in v1 this mounts on the loopback
+ * management server, same as the trust-circle / NAT surfaces. Physically exposing
+ * it to a remote phone is `backlog/feat-cadre-host-wan-grant-reachability`.
+ *
+ * Errors: handlers either send a `{ ok:false, error:{code,message} }` envelope
+ * inline (auth / body validation) or let the `DonationService` throw a
+ * `DonationError`, which `server/error-handler.ts` maps to the matching HTTP
+ * status and the same envelope.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DonationService } from '../../donation/donation-service.js';
+import type { GrantValidator } from '../../donation/types.js';
+export interface GrantsRoutesOptions {
+    donations: DonationService;
+    /** Validates the presented bearer for non-provisioning ops (provision revalidates internally). */
+    grants: GrantValidator;
+}
+export declare function registerGrantsRoutes(app: FastifyInstance, opts: GrantsRoutesOptions): void;