@serfab/cadre-host 0.8.1 → 0.10.0

package/src/strands/strand-service.ts

@@ -0,0 +1,135 @@
+import debug from 'debug';
+
+import { OwnerNodeUnavailableError } from '../owner/owner-node-client.js';
+
+import type {
+  StrandHandlers,
+  StrandListSnapshot,
+  StrandRemovalResult,
+} from './types.js';
+import { StrandError } from './types.js';
+
+const log = debug('cadre:host:strands');
+
+/**
+ * Minimal slice of the owner node that StrandService uses. Declared here (rather
+ * than reaching into `OwnerNodeClient`) so unit tests can inject a fake without
+ * standing up an admin channel — the third such trimmed interface the client
+ * satisfies, alongside the trust-circle and NAT ones.
+ */
+export interface CadreNodeLike {
+  listStrands(): Promise<StrandListSnapshot>;
+  removeStrand(strandId: string, opts: { confirm: boolean }): Promise<StrandRemovalResult>;
+}
+
+/** Constructor options. */
+export interface StrandServiceOptions {
+  /** The owner node — provides listStrands / removeStrand over the admin channel. */
+  cadreNode: CadreNodeLike;
+}
+
+/**
+ * StrandService — validation and error translation over the owner node's strand
+ * admin routes.
+ *
+ * It owns no state and makes no policy. In particular it does NOT decide whether a
+ * closed strand needs confirmation: it never reads the row, so it could only guess.
+ * The node enforces that rule and answers `confirmation_required`; this layer
+ * forwards the caller's flag verbatim and surfaces the refusal as a distinct code
+ * so the UI can raise the right dialog.
+ */
+export class StrandService {
+  private readonly cadreNode: CadreNodeLike;
+
+  constructor(opts: StrandServiceOptions) {
+    this.cadreNode = opts.cadreNode;
+  }
+
+  /** This party's strands, plus the node's current control-connection count. */
+  async list(): Promise<StrandListSnapshot> {
+    return await this.cadreNode.listStrands().catch((err: unknown) => toDomainError(err));
+  }
+
+  /**
+   * Remove this party's participation in one strand.
+   *
+   * `confirm` is forwarded exactly as given — never defaulted to true, never
+   * re-sent as true after a refusal. A closed strand's row carries this party's
+   * membership key for that network and is stored nowhere else, so an automatic
+   * retry would destroy it on the caller's behalf.
+   */
+  async remove(rawId: string, opts: { confirm: boolean }): Promise<StrandRemovalResult> {
+    const strandId = validateStrandId(rawId);
+    log('remove %s (confirm=%s)', strandId, opts.confirm);
+    return await this.cadreNode
+      .removeStrand(strandId, { confirm: opts.confirm })
+      .catch((err: unknown) => toDomainError(err));
+  }
+}
+
+/**
+ * Trim and reject an id this surface cannot act on. Blank is the only such id.
+ *
+ * A `/` is deliberately NOT refused. `/api/strands/:id` is one path segment, but a
+ * caller that percent-encodes the id reaches this layer with the `/` restored
+ * (Fastify decodes `params`), `OwnerNodeClient` re-encodes it, and the admin channel
+ * splits on the still-encoded `%2F` and decodes it back — so the whole chain carries
+ * it. Refusing here would break the only form that works, while doing nothing about
+ * an UNencoded `/`, which never reaches this handler at all (the router 404s it).
+ */
+function validateStrandId(rawId: string): string {
+  const strandId = typeof rawId === 'string' ? rawId.trim() : '';
+  if (!strandId) {
+    throw new StrandError('invalid_id', 'A strand id is required');
+  }
+  return strandId;
+}
+
+/**
+ * Translate an owner-node failure into the strand error vocabulary.
+ *
+ * `OwnerNodeUnavailableError` is thrown for *every* non-ok admin response, not only
+ * for a node that is down — so read `nodeCode` first and fall back to
+ * `node_unavailable` only when nothing better fits. Reporting a 428 as "your node is
+ * down" would be actively misleading.
+ *
+ * Declared to return `never` so callers can `.catch((err) => toDomainError(err))`.
+ *
+ * NOTE: the trust-circle and NAT services translate the SAME error blanket-style —
+ * every `OwnerNodeUnavailableError` becomes `node_unavailable` — because neither has
+ * a code worth distinguishing yet. If a second surface ever needs a code-aware
+ * mapping, hoist this switch into a shared owner-error translator instead of growing
+ * a third copy.
+ */
+function toDomainError(err: unknown): never {
+  if (!(err instanceof OwnerNodeUnavailableError)) {
+    throw err instanceof Error ? err : new Error(String(err));
+  }
+  switch (err.nodeCode) {
+    case 'confirmation_required':
+      throw new StrandError('confirmation_required', err.message);
+    case 'bad_request':
+      throw new StrandError('invalid_id', err.message);
+    case undefined:
+    case 'not_ready':
+    case 'not_authorized':
+      throw new StrandError('node_unavailable', `Owner node unavailable: ${err.message}`);
+    default:
+      throw new StrandError('internal', err.message);
+  }
+}
+
+/**
+ * Wrap a StrandService into the typed handler shape the local UI server mounts.
+ * Errors propagate as StrandError; `server/error-handler.ts` maps `.code` → status.
+ */
+export function createStrandHandlers(service: StrandService): StrandHandlers {
+  return {
+    async listStrands() {
+      return await service.list();
+    },
+    async removeStrand(strandId, opts) {
+      return await service.remove(strandId, { confirm: opts.confirm === true });
+    },
+  };
+}

package/src/strands/types.ts

@@ -0,0 +1,102 @@
+/**
+ * Strand-management types for cadre-host.
+ *
+ * A *strand* is a shared data network this party participates in. Membership is
+ * canonical in the cadre control network's `Strand` table, reached over the owner
+ * node's loopback admin channel (`GET /admin/strands`,
+ * `DELETE /admin/strands/:id?confirm=1`).
+ *
+ * Unlike the trust circle — which layers host-local labels and pending invites on
+ * top of the node's state — this layer holds **no host-local state at all**. There
+ * is no `strands.json`. It exists for id validation, for translating the admin
+ * channel's error codes into a stable vocabulary the management API can map to HTTP
+ * statuses, and for nothing else. Keep it small.
+ */
+
+/** One strand this party belongs to, as projected by the admin channel. */
+export interface StrandSummary {
+  /** The `Strand` row id — what a removal takes. */
+  id: string;
+  /** `'o'` = open, `'c'` = closed (the row carries this party's membership key). */
+  type: 'o' | 'c';
+  /** Whether the owner node currently has a running instance for the id. */
+  running: boolean;
+  /**
+   * The instance's status when running, else `null`. Deliberately `string` rather
+   * than cadre-core's `StrandStatus`: this is a wire projection the manager only
+   * forwards, and widening it keeps cadre-host from tracking a cadre-core union it
+   * never inspects.
+   */
+  status: string | null;
+}
+
+/** The result of listing this party's strands. */
+export interface StrandListSnapshot {
+  strands: StrandSummary[];
+  /**
+   * Open control-network connections on the owner node; 0 ⇒ writes commit
+   * local-only. A snapshot at read time, not a subscription — treat it as advisory.
+   */
+  controlConnections: number;
+}
+
+/** The result of removing this party's participation in one strand. */
+export interface StrandRemovalResult {
+  /** The trimmed id the call was about. */
+  strandId: string;
+  /** Whether a row existed before the write. */
+  published: boolean;
+  /** The found row's type; `null` when no row was found. */
+  type: 'o' | 'c' | null;
+  /**
+   * Whether THIS call issued the delete — not that the row was observed to vanish.
+   * The node's read and write are not atomic, so a concurrent removal landing in
+   * between makes this a no-op that still reports `true`.
+   */
+  removed: boolean;
+  /**
+   * The node saw 0 control connections at the end of the call. Sampled on EVERY
+   * call, including one that found no row and wrote nothing — read it as "this
+   * machine currently sees no siblings", and only as "your delete may not have
+   * travelled" when `removed` is also true.
+   */
+  alone: boolean;
+}
+
+/** Error codes thrown by StrandService. */
+export type StrandErrorCode =
+  /** The id was blank or whitespace-only, here or at the node. */
+  | 'invalid_id'
+  /** The node refused a closed-strand removal that carried no confirmation. */
+  | 'confirmation_required'
+  /** The owner node's admin channel is unreachable / not ready. */
+  | 'node_unavailable'
+  /** The node answered with a code this layer has no better word for. */
+  | 'internal';
+
+/** Typed error carrying a stable `code` for HTTP mapping. */
+export class StrandError extends Error {
+  readonly code: StrandErrorCode;
+
+  constructor(code: StrandErrorCode, message: string) {
+    super(message);
+    this.name = 'StrandError';
+    this.code = code;
+  }
+}
+
+/**
+ * Typed handlers exposed to the local UI server for Fastify wiring.
+ *
+ * Handlers either return typed results or throw a `StrandError` whose `.code`
+ * `server/error-handler.ts` maps to an HTTP status:
+ *
+ *   - `invalid_id`            → 400
+ *   - `confirmation_required` → 428
+ *   - `node_unavailable`      → 503
+ *   - `internal`              → 500
+ */
+export interface StrandHandlers {
+  listStrands(): Promise<StrandListSnapshot>;
+  removeStrand(strandId: string, opts: { confirm: boolean }): Promise<StrandRemovalResult>;
+}

package/src/update/__tests__/release-key.test.ts

@@ -12,9 +12,14 @@ function freshPublicRawB64(): string {
 describe('isPlaceholderReleaseKey', () => {
   afterEach(() => { delete process.env.CADRE_HOST_UPDATE_DEV_KEY; });
 
-  it('is true for the default all-zeros placeholder (no override)', () => {
+  it('is true for an explicit all-zeros placeholder key', () => {
+    const allZeros = Buffer.alloc(32).toString('base64');
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: allZeros })).toBe(true);
+  });
+
+  it('is false for the shipped embedded default (real key, no override)', () => {
     delete process.env.CADRE_HOST_UPDATE_DEV_KEY;
-    expect(isPlaceholderReleaseKey()).toBe(true);
+    expect(isPlaceholderReleaseKey()).toBe(false);
   });
 
   it('is false when a real key overrides via CADRE_HOST_UPDATE_DEV_KEY', () => {
@@ -24,6 +29,14 @@ describe('isPlaceholderReleaseKey', () => {
 
   it('honors an explicit env argument over process.env', () => {
     expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: freshPublicRawB64() })).toBe(false);
-    expect(isPlaceholderReleaseKey({})).toBe(true);
+    // no override in the explicit arg -> falls through to the real embedded default
+    expect(isPlaceholderReleaseKey({})).toBe(false);
+  });
+
+  it('is false for a key that does not decode to 32 bytes', () => {
+    // Not the all-zeros placeholder even though it is a degenerate key: the
+    // 32-byte length gate short-circuits before the all-zeros check.
+    const shortZeros = Buffer.alloc(16).toString('base64');
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: shortZeros })).toBe(false);
   });
 });

package/src/update/release-key.ts

@@ -12,11 +12,13 @@ import type { KeyObject } from 'node:crypto';
 import { createPublicKey } from 'node:crypto';
 
 /**
- * Raw 32-byte Ed25519 public key, base64-encoded. The all-zeros value below is
- * the placeholder that ships in source until the release operator embeds a real
- * key (`isPlaceholderReleaseKey` reports it; the publish guard refuses to ship
- * it). Mismatch with the real signer surfaces as `signature_invalid`, which the
- * UI treats as "update available but unverifiable" rather than auto-applying.
+ * Raw 32-byte Ed25519 public key, base64-encoded. This is the real production
+ * public key embedded by the release operator (see the "Release signing"
+ * runbook in `docs/cadre-host.md`). Before a real key was embedded the source
+ * shipped an all-zeros placeholder; `isPlaceholderReleaseKey` still detects that
+ * state and the publish guard refuses to ship it. Mismatch with the real signer
+ * surfaces as `signature_invalid`, which the UI treats as "update available but
+ * unverifiable" rather than auto-applying.
  */
 const PROD_KEY_BASE64 = 'XyRVnOY9DVgU6xdMgJIguOsc9B2L1o2KoU9626Nk+OE=';
 
@@ -41,7 +43,7 @@ export function getReleasePublicKey(env: NodeJS.ProcessEnv = process.env): KeyOb
  * ships in source until the release operator embeds a real public key.
  *
  * Consumers:
- *  - the publish guard (`scripts/publish-package.js`) refuses to ship a build
+ *  - the publish guard (`scripts/publish-package.mjs`) refuses to ship a build
  *    whose embedded key is still the placeholder, so a real release can never
  *    silently ship the dead key;
  *  - `UpdateService.check()` logs a diagnostic breadcrumb so a misbuilt binary

package/dist/authority/authority-node-client.d.ts

@@ -1,77 +0,0 @@
-/**
- * HTTP client for the authority node's loopback admin channel (the 6.6
- * `cadre-node-admin-channel` contract).
- *
- * cadre-host's manager process holds no in-process `CadreNode`; it spawns the
- * admin's authority node as a managed child (see `HostProcessOrchestrator`)
- * and delegates all authority/membership/identity operations to it over this
- * client. The client implements **both** trimmed `CadreNodeLike` interfaces —
- * the trust-circle one (`auth/trust-circle.ts`) and the NAT one
- * (`nat/nat-service.ts`) — plus `pushInviteAddresses`.
- *
- * Transport: `Authorization: Bearer <token>` against
- * `http://127.0.0.1:<adminPort>`. Every response uses the cadre-provider
- * envelope `{ ok: true, data }` / `{ ok: false, error: { code, message } }`.
- * A refused connection, a transport error, or any non-2xx response surfaces
- * as {@link AuthorityNodeUnavailableError}; the trust-circle / NAT services
- * translate that into a `node_unavailable` domain error so the management API
- * returns a clear 503 rather than a raw 500.
- */
-import type { CadreInvite } from '@serfab/cadre-core';
-import type { AuthorityAdminEndpoint } from '../orchestrator/index.js';
-import type { CadreNodeLike as TrustCircleCadreNodeLike } from '../auth/trust-circle.js';
-import type { CadreNodeLike as NatCadreNodeLike } from '../nat/nat-service.js';
-/**
- * Raised when the authority node's admin channel can't be reached or returns
- * a non-success response. Carries the node's stable error `code` when one was
- * present in the envelope (e.g. `not_ready`, `not_authorized`).
- */
-export declare class AuthorityNodeUnavailableError extends Error {
-    /** The admin-channel error code, when the node answered with an envelope. */
-    readonly nodeCode?: string;
-    constructor(message: string, nodeCode?: string);
-}
-/** Endpoint provided directly or via a getter (so it tracks re-spawns). */
-type EndpointSource = AuthorityAdminEndpoint | (() => AuthorityAdminEndpoint | undefined) | undefined;
-export interface AuthorityNodeClientOptions {
-    /** Fetch override for tests. Defaults to the global `fetch`. */
-    fetch?: typeof fetch;
-}
-export declare class AuthorityNodeClient implements TrustCircleCadreNodeLike, NatCadreNodeLike {
-    private readonly endpointSource;
-    private readonly fetchImpl;
-    /**
-     * @param endpoint Either a fixed `{ baseUrl, token }` or a getter returning
-     *   the current endpoint (pass `orchestrator.getAuthorityAdminEndpoint`
-     *   bound, so a restart's new bearer token is picked up automatically).
-     */
-    constructor(endpoint: EndpointSource, opts?: AuthorityNodeClientOptions);
-    createInvite(token?: string, expiresInMs?: number): Promise<{
-        invite: CadreInvite;
-        encodedInvite: string;
-    }>;
-    acceptPhone(options: {
-        phonePeerId: string;
-        token?: string;
-    }, issuedInvite?: CadreInvite): Promise<void>;
-    removePeer(peerId: string): Promise<void>;
-    /**
-     * Encode an invite for out-of-band delivery. The admin contract has no
-     * encode route (the mint route already returns `encodedInvite`), so this
-     * mirrors cadre-core's encoding (`base64url(JSON.stringify(invite))`).
-     */
-    encodeInvite(invite: CadreInvite): string;
-    listMembers(): Promise<Array<{
-        peerId: string;
-        multiaddr: string | null;
-    }>>;
-    isMember(peerId: string): Promise<boolean>;
-    getPeerId(): Promise<string>;
-    getMultiaddrs(): Promise<string[]>;
-    /** Push the NAT-resolved addresses the node should embed in future invites. */
-    pushInviteAddresses(addresses: string[]): Promise<void>;
-    private resolveEndpoint;
-    private request;
-    private parseEnvelope;
-}
-export {};

package/dist/authority/authority-node-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority-node-client.js","sourceRoot":"","sources":["../../src/authority/authority-node-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAItD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvD,CAAC;CACF;AAaD,MAAM,OAAO,mBAAmB;IAI9B;;;;OAIG;IACH,YAAY,QAAwB,EAAE,OAAmC,EAAE;QACzE,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,qCAAqC;IAErC,KAAK,CAAC,YAAY,CAChB,KAAc,EACd,WAAoB;QAEpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9D,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,MAAM,EACN,gBAAgB,EAChB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAgD,EAChD,YAA0B;QAE1B,MAAM,IAAI,GAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,MAAmB;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC/C,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA6C,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA2B,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,sCAAsC;IAEtC,+EAA+E;IAC/E,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,oBAAoB;IAEZ,eAAe;QACrB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACnG,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,6BAA6B,CAAC,gDAAgD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,iCAAiC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,6BAA6B,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,IAAI,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1F,GAAG,CAAC,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAa;QAKvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,MAAuF,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,oCAAoC;QACtC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/authority/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * Authority-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's authority cadre node (via
- * `HostProcessOrchestrator`) and delegates authority/membership/identity
- * operations to it over the loopback admin channel using
- * {@link AuthorityNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority-node-client.js';
-export type { AuthorityNodeClientOptions } from './authority-node-client.js';

package/dist/authority/index.js

@@ -1,11 +0,0 @@
-/**
- * Authority-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's authority cadre node (via
- * `HostProcessOrchestrator`) and delegates authority/membership/identity
- * operations to it over the loopback admin channel using
- * {@link AuthorityNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority-node-client.js';
-//# sourceMappingURL=index.js.map

package/dist/authority/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authority/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC"}