@serfab/cadre-host 0.8.1 → 0.10.0

package/dist/donation/grant-store.js

@@ -0,0 +1,135 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import debug from 'debug';
+import { GrantError } from './types.js';
+const log = debug('cadre:host:grant-store');
+const FILE_VERSION = 1;
+/**
+ * Atomic JSON store for `grants.json`. Modelled on `auth/trust-circle-store.ts`:
+ * a single file, written to `<path>.tmp` then renamed, with an in-memory cache
+ * keyed by token.
+ *
+ * Unlike the trust-circle pending rows, grants are **not** self-reaping: a
+ * grant may legitimately outlive many nodes, so expiry is evaluated at
+ * validate time (in `GrantService`) and the admin removes stale grants
+ * explicitly. This store keeps no clock.
+ *
+ * Concurrency assumption: only one cadre-host process owns a given rootDir
+ * (the orchestrator already enforces this). No file-locking primitives.
+ */
+export class GrantStore {
+    constructor(rootDir) {
+        this.cache = null;
+        mkdirSync(rootDir, { recursive: true });
+        this.path = join(rootDir, 'grants.json');
+    }
+    filePath() {
+        return this.path;
+    }
+    /**
+     * Load (with caching). A missing file returns an empty store (fresh
+     * install). A present-but-malformed file throws — silently wiping it would
+     * revoke every grantee at once.
+     */
+    load() {
+        if (this.cache)
+            return this.cache;
+        if (!existsSync(this.path)) {
+            this.cache = emptyFile();
+            return this.cache;
+        }
+        let raw;
+        try {
+            raw = readFileSync(this.path, 'utf8');
+        }
+        catch (err) {
+            throw new GrantError('storage_error', `failed to read grants file at ${this.path}: ${err.message}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            throw new GrantError('storage_error', `grants file at ${this.path} is not valid JSON: ${err.message}`);
+        }
+        if (!isGrantFile(parsed)) {
+            throw new GrantError('storage_error', `grants file at ${this.path} has unexpected shape`);
+        }
+        this.cache = parsed;
+        return this.cache;
+    }
+    /** Persist the current state atomically (write then rename). */
+    save(state) {
+        // NOTE: rewrites the whole grants.json on every mutation. Fine at household
+        // scale (a handful of grantees); if grant counts ever grow large, switch to
+        // an append/compact log or per-token files.
+        mkdirSync(dirname(this.path), { recursive: true });
+        const payload = JSON.stringify({ ...state, version: FILE_VERSION }, null, 2);
+        const tmp = `${this.path}.tmp`;
+        try {
+            writeFileSync(tmp, payload, { encoding: 'utf8' });
+            renameSync(tmp, this.path);
+        }
+        catch (err) {
+            // Surface as storage_error (→ 500) like load(), not a bare Error (→
+            // "internal"); a write failure on issue/revoke should read consistently.
+            throw new GrantError('storage_error', `failed to write grants file at ${this.path}: ${err.message}`);
+        }
+        this.cache = { ...state, version: FILE_VERSION };
+        log('saved grants (%d) to %s', Object.keys(state.grants).length, this.path);
+    }
+    add(grant) {
+        const state = this.load();
+        const { token, ...rest } = grant;
+        state.grants[token] = rest;
+        this.save(state);
+    }
+    get(token) {
+        const state = this.load();
+        const row = state.grants[token];
+        if (!row)
+            return undefined;
+        return { token, ...row };
+    }
+    list() {
+        const state = this.load();
+        return Object.entries(state.grants).map(([token, row]) => ({ token, ...row }));
+    }
+    remove(token) {
+        const state = this.load();
+        if (!(token in state.grants))
+            return false;
+        delete state.grants[token];
+        this.save(state);
+        return true;
+    }
+    /**
+     * Mark a grant revoked at the given ISO instant. Idempotent: an
+     * already-revoked grant keeps its original `revokedAt`. Returns false when
+     * the token is unknown.
+     */
+    markRevoked(token, at) {
+        const state = this.load();
+        const row = state.grants[token];
+        if (!row)
+            return false;
+        if (!row.revokedAt)
+            row.revokedAt = at;
+        this.save(state);
+        return true;
+    }
+}
+function emptyFile() {
+    return { version: FILE_VERSION, grants: {} };
+}
+function isGrantFile(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const obj = v;
+    if (obj.version !== FILE_VERSION)
+        return false;
+    if (!obj.grants || typeof obj.grants !== 'object')
+        return false;
+    return true;
+}
+//# sourceMappingURL=grant-store.js.map

package/dist/donation/grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/donation/grant-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,UAAU;IAIrB,YAAY,OAAe;QAFnB,UAAK,GAAqB,IAAI,CAAC;QAGrC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,iCAAiC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kBAAkB,IAAI,CAAC,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kBAAkB,IAAI,CAAC,IAAI,uBAAuB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,KAAgB;QACnB,4EAA4E;QAC5E,4EAA4E;QAC5E,4CAA4C;QAC5C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,yEAAyE;YACzE,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kCAAkC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,GAAG,CAAC,KAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,KAAa,EAAE,EAAU;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/donation/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Donation grant-token layer for cadre-host. See ./types.ts, ./grant-store.ts,
+ * and ./grant-service.ts.
+ *
+ * This layer gates *who may ask this host to donate a node*. The lifecycle
+ * service that consumes a validated grant to actually provision a node lands in
+ * the `2-donation-service` ticket, which imports the `GrantValidator` interface
+ * defined here.
+ */
+export { GrantStore } from './grant-store.js';
+export { GrantService, createGrantAdminHandlers, DEFAULT_MAX_NODES, } from './grant-service.js';
+export type { GrantServiceOptions } from './grant-service.js';
+export { GrantError, DonationError } from './types.js';
+export type { Grant, GrantDenyReason, GrantValidation, GrantValidator, GrantFile, GrantAdminHandlers, GrantErrorCode, } from './types.js';
+export { DonationStore } from './donation-store.js';
+export { DonationService, DONATION_AWAITING_SEED_TTL_MS, DONATION_PROVISIONING_TTL_MS, DONATION_REAP_SWEEP_MS, } from './donation-service.js';
+export type { DonationOrchestrator, DonationProvisionRequest, DonationSeedResult, DonationPeerInfo, DonationServiceOptions, RespawnResult, } from './donation-service.js';
+export { DonationSupervisor, DONATION_RESPAWN_BACKOFF_BASE_MS, DONATION_RESPAWN_BACKOFF_MAX_MS, DONATION_RESPAWN_MAX_ATTEMPTS, DONATION_RESPAWN_HEALTHY_MS, DONATION_RESPAWN_SWEEP_MS, } from './donation-supervisor.js';
+export type { DonationSupervisorOptions, SupervisedOrchestrator, } from './donation-supervisor.js';
+export type { Donation, DonationView, DonationStatus, DonationFile, DonationErrorCode, } from './types.js';

package/dist/donation/index.js

@@ -0,0 +1,17 @@
+/**
+ * Donation grant-token layer for cadre-host. See ./types.ts, ./grant-store.ts,
+ * and ./grant-service.ts.
+ *
+ * This layer gates *who may ask this host to donate a node*. The lifecycle
+ * service that consumes a validated grant to actually provision a node lands in
+ * the `2-donation-service` ticket, which imports the `GrantValidator` interface
+ * defined here.
+ */
+export { GrantStore } from './grant-store.js';
+export { GrantService, createGrantAdminHandlers, DEFAULT_MAX_NODES, } from './grant-service.js';
+export { GrantError, DonationError } from './types.js';
+/* ──────────────── donation lifecycle (2-donation-service) ──────────────── */
+export { DonationStore } from './donation-store.js';
+export { DonationService, DONATION_AWAITING_SEED_TTL_MS, DONATION_PROVISIONING_TTL_MS, DONATION_REAP_SWEEP_MS, } from './donation-service.js';
+export { DonationSupervisor, DONATION_RESPAWN_BACKOFF_BASE_MS, DONATION_RESPAWN_BACKOFF_MAX_MS, DONATION_RESPAWN_MAX_ATTEMPTS, DONATION_RESPAWN_HEALTHY_MS, DONATION_RESPAWN_SWEEP_MS, } from './donation-supervisor.js';
+//# sourceMappingURL=index.js.map

package/dist/donation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/donation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWvD,+EAA+E;AAE/E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/donation/types.d.ts

@@ -0,0 +1,201 @@
+/**
+ * Donation grant-token types for cadre-host.
+ *
+ * A **grant token** is a high-entropy base64url secret the host admin issues,
+ * out-of-band (QR / copy-paste), to one *grantee* — a friend or family member
+ * whose cadre authority (their phone) may then ask this host to spawn donated
+ * nodes. The grantee presents the token as `Authorization: Bearer <grant-token>`
+ * on every donation request (the grantee-facing surface lands in the
+ * `2-donation-service` ticket).
+ *
+ * This module owns the grant's identity, expiry, and per-grantee quota. The
+ * *live-node tally* it checks the quota against is owned by the donation
+ * service, not by the grant layer — see `GrantValidator.validateForProvision`.
+ *
+ * **Grant ≠ trust-circle membership.** A trust-circle invite (`auth/`)
+ * authorises a device to join *the host's own* cadre. A donation grant
+ * authorises an external cadre authority to ask the host to spawn a node that
+ * joins *the grantee's* cadre. The two token flows are deliberately separate
+ * modules; this one reuses the *shape* of the trust-circle store (atomic
+ * write-then-rename JSON, token-keyed rows) but with grant — not invite —
+ * semantics: a grant is long-lived and reusable up to a quota, never
+ * one-time-redeemed.
+ */
+/** A grant the host admin issued to one grantee (friend/family). */
+export interface Grant {
+    /** base64url secret; also the bearer credential. The store key. */
+    token: string;
+    /** Human label chosen by the admin, e.g. "Alice's cadre". Display-only. */
+    label: string;
+    /** Max concurrently-live donated nodes this grant may hold. */
+    maxNodes: number;
+    /** ISO timestamp when the grant was issued. */
+    createdAt: string;
+    /** ISO expiry; absent = no expiry. */
+    expiresAt?: string;
+    /** Set when the admin revokes; a revoked grant validates as denied. */
+    revokedAt?: string;
+}
+/** Why a presented grant token was denied. */
+export type GrantDenyReason = 'unknown_token' | 'expired' | 'revoked' | 'quota_exceeded';
+/** Result of validating a presented bearer token. */
+export interface GrantValidation {
+    ok: boolean;
+    /** The matched grant, when the token names one (present even on some denials). */
+    grant?: Grant;
+    /** Set when `ok` is false. */
+    reason?: GrantDenyReason;
+}
+/**
+ * The slice `2-donation-service` depends on. Keeps that ticket decoupled from
+ * the store implementation: it holds a `GrantValidator`, not a `GrantStore`.
+ *
+ * Both methods are pure functions of the store state (and, for provision, the
+ * caller-supplied count) — they never throw for a bad token, they return a
+ * denial. Issuance/revocation (which mutate) live on `GrantService`.
+ */
+export interface GrantValidator {
+    /**
+     * Validate a presented bearer token for a *new* provision request.
+     *
+     * `liveNodeCount(token)` is supplied by the donation service — the grant
+     * layer owns identity/expiry/revocation; the donation service owns the
+     * authoritative live-node tally (it holds the grant→node records). The count
+     * is only consulted once identity/expiry/revocation have passed, so an
+     * unknown or dead token never invokes it.
+     */
+    validateForProvision(token: string, liveNodeCount: (token: string) => number): GrantValidation;
+    /**
+     * Validate for a non-provisioning op (peer/seed/terminate): identity + not
+     * expired/revoked. No quota check.
+     */
+    validate(token: string): GrantValidation;
+}
+/** On-disk shape of `grants.json`. */
+export interface GrantFile {
+    version: 1;
+    /** keyed by token. */
+    grants: Record<string, Omit<Grant, 'token'>>;
+}
+/**
+ * Typed handlers exposed to the loopback management server for the **admin**
+ * grant surface (`/grants-admin`). Distinct from the grantee-facing `/grants`
+ * provisioning surface (`2-donation-service`): the admin surface is loopback,
+ * no bearer — same-machine admin, matching cadre-host's local-UI "no login"
+ * posture.
+ *
+ * Handlers throw a `GrantError` whose `.code` the server maps to an HTTP
+ * status (see `server/error-handler.ts`).
+ */
+export interface GrantAdminHandlers {
+    postGrant(body: {
+        label: string;
+        maxNodes?: number;
+        ttlMs?: number;
+    }): Promise<{
+        grant: Grant;
+    }>;
+    listGrants(): Promise<{
+        grants: Grant[];
+    }>;
+    deleteGrant(token: string): Promise<void>;
+}
+/**
+ * Lifecycle of one donated node:
+ *   provisioning  → the child process is being spawned.
+ *   awaiting_seed → spawned + reachable; waiting for the requester to present
+ *                   its phone-signed seed (`PUT /grants/:id/seed`).
+ *   seeded        → the seed was applied; the node has joined the requester's cadre.
+ *   error         → provisioning failed (orchestrator resources reclaimed).
+ *   terminated    → stopped + removed (kept in the store for audit).
+ *
+ * A donation is "live" (counts against a grant's `maxNodes` quota) while it is
+ * `provisioning`, `awaiting_seed`, or `seeded` — see `DonationStore.liveNodeCount`.
+ */
+export type DonationStatus = 'provisioning' | 'awaiting_seed' | 'seeded' | 'error' | 'terminated';
+/**
+ * One donated node, tracked host-side and persisted to `donations.json`.
+ *
+ * The host contributes capacity only: `partyId` is the REQUESTER's cadre (a
+ * foreign party), and `seedToken` gates the node's own `POST /seed` — it is
+ * minted host-side, persisted here (so a host restart in the request→seed gap
+ * can still present the seed), and NEVER returned to the grantee.
+ *
+ * The record also carries every input the original spawn consumed
+ * (`partyId` + `profile` + `bootstrapNodes` + `ownerKeys`), so a crashed node can
+ * be re-spawned from the record alone — see `DonationService.respawn`. Records
+ * written before those two fields existed have neither; such a record is NOT
+ * respawnable and is skipped (never crashes a sweep).
+ */
+export interface Donation {
+    /** "grn_<nanoid>" — also the donated node's orchestrator containerId. */
+    id: string;
+    /** The grant token that authorized this donation (the quota key). */
+    grantToken: string;
+    /** The REQUESTER's cadre (a foreign party this host merely hosts a node for). */
+    partyId: string;
+    /**
+     * Requester control-network bootstrap multiaddrs — replayed on respawn.
+     * Absent on records written before respawn support; those are not respawnable.
+     */
+    bootstrapNodes?: string[];
+    /**
+     * Requester owner public key(s), base64url — replayed as the node's pinned
+     * seed-trust anchors (`CADRE_OWNER_KEYS`) on respawn. Absent on records written
+     * before respawn support; those are not respawnable.
+     */
+    ownerKeys?: string[];
+    /**
+     * Respawn bookkeeping, owned by the supervisor's backoff. Absent until the
+     * first respawn attempt. Not secret — it rides along in `DonationView` so the
+     * borrower's `GET /grants/:id` shows the counters for free.
+     */
+    respawn?: {
+        attempts: number;
+        lastAttemptAt: string;
+    };
+    /** Node profile. Defaults to `storage` so the node participates and is dialable. */
+    profile: 'storage' | 'transaction';
+    status: DonationStatus;
+    /** Orchestrator handle (opaque `pid:token`), set once the child is spawned. */
+    dockerId?: string;
+    /**
+     * Reserved: a donation's live peer identity is read fresh from the node's
+     * `/status` on each `getPeer` call and is NOT persisted here — this field is
+     * currently never written. Kept for a future cache if `/status` fan-out ever
+     * shows up as hot.
+     */
+    peerId?: string;
+    /** The node's loopback `POST /seed` URL. Host-internal — stripped from the wire view. */
+    seedEndpoint?: string;
+    /** Host↔node bearer gating `POST /seed`. Persisted; NEVER leaves the host. */
+    seedToken?: string;
+    createdAt: string;
+    updatedAt: string;
+    /** Failure detail when `status === 'error'`. */
+    error?: string;
+}
+/**
+ * Redacted wire shape returned to the grantee: the host-only secrets
+ * (`seedToken`) and host-internal loopback URL (`seedEndpoint`) are stripped.
+ */
+export type DonationView = Omit<Donation, 'seedToken' | 'seedEndpoint'>;
+/** On-disk shape of `donations.json`. Keyed by donation id. */
+export interface DonationFile {
+    version: 1;
+    donations: Record<string, Omit<Donation, 'id'>>;
+}
+/** Error codes thrown by the donation service / grantee-facing routes. */
+export type DonationErrorCode = 'unauthorized' | 'forbidden' | 'quota_exceeded' | 'invalid_request' | 'not_found' | 'invalid_state' | 'seed_failed' | 'peer_unavailable' | 'orchestrator_error' | 'storage_error';
+/** Typed donation error carrying a stable `code` for HTTP mapping. */
+export declare class DonationError extends Error {
+    readonly code: DonationErrorCode;
+    constructor(code: DonationErrorCode, message: string);
+}
+/** Error codes thrown by GrantStore / GrantService. */
+export type GrantErrorCode = 'not_found' | 'invalid_label' | 'invalid_max_nodes' | 'invalid_ttl' | 'storage_error';
+/** Typed error carrying a stable `code` for HTTP mapping. */
+export declare class GrantError extends Error {
+    readonly code: GrantErrorCode;
+    constructor(code: GrantErrorCode, message: string);
+}

package/dist/donation/types.js

@@ -0,0 +1,40 @@
+/**
+ * Donation grant-token types for cadre-host.
+ *
+ * A **grant token** is a high-entropy base64url secret the host admin issues,
+ * out-of-band (QR / copy-paste), to one *grantee* — a friend or family member
+ * whose cadre authority (their phone) may then ask this host to spawn donated
+ * nodes. The grantee presents the token as `Authorization: Bearer <grant-token>`
+ * on every donation request (the grantee-facing surface lands in the
+ * `2-donation-service` ticket).
+ *
+ * This module owns the grant's identity, expiry, and per-grantee quota. The
+ * *live-node tally* it checks the quota against is owned by the donation
+ * service, not by the grant layer — see `GrantValidator.validateForProvision`.
+ *
+ * **Grant ≠ trust-circle membership.** A trust-circle invite (`auth/`)
+ * authorises a device to join *the host's own* cadre. A donation grant
+ * authorises an external cadre authority to ask the host to spawn a node that
+ * joins *the grantee's* cadre. The two token flows are deliberately separate
+ * modules; this one reuses the *shape* of the trust-circle store (atomic
+ * write-then-rename JSON, token-keyed rows) but with grant — not invite —
+ * semantics: a grant is long-lived and reusable up to a quota, never
+ * one-time-redeemed.
+ */
+/** Typed donation error carrying a stable `code` for HTTP mapping. */
+export class DonationError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'DonationError';
+        this.code = code;
+    }
+}
+/** Typed error carrying a stable `code` for HTTP mapping. */
+export class GrantError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'GrantError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/donation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/donation/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgMH,sEAAsE;AACtE,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGtC,YAAY,IAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAUD,6DAA6D;AAC7D,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGnC,YAAY,IAAoB,EAAE,OAAe;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/index.d.ts

@@ -18,12 +18,16 @@
  *   - cadre-host-local-ui
  */
 export type { Orchestrator, OrchestratorCreateRequest, OrchestratorCreateResult, OrchestratorStats, ContainerStatus, ContainerResources, } from '@serfab/cadre-provider';
-export { HostProcessOrchestrator, AUTHORITY_CONTAINER_ID } from './orchestrator/index.js';
-export type { HostProcessConfig, PersistedHandle, ManagedNodeInfo, NodeStateListener, NodePorts, AuthorityAdminEndpoint, AuthoritySpawnConfig, } from './orchestrator/index.js';
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority/index.js';
-export type { AuthorityNodeClientOptions } from './authority/index.js';
-export { TrustCircleService, TrustCircleStore, TrustCircleError, createTrustCircleHandlers, parseDuration, DEFAULT_INVITE_TTL_MS, } from './auth/index.js';
+export { HostProcessOrchestrator, OWNER_CONTAINER_ID } from './orchestrator/index.js';
+export type { HostProcessConfig, PersistedHandle, ManagedNodeInfo, NodeStateListener, NodePorts, OwnerAdminEndpoint, OwnerSpawnConfig, } from './orchestrator/index.js';
+export { OwnerNodeClient, OwnerNodeUnavailableError } from './owner/index.js';
+export type { OwnerNodeClientOptions } from './owner/index.js';
+export { TrustCircleService, TrustCircleStore, TrustCircleError, createTrustCircleHandlers, parseDuration, ensureSelfLabel, DEFAULT_INVITE_TTL_MS, } from './auth/index.js';
 export type { TrustCircleServiceOptions, CadreNodeLike, TrustCircleMember, PendingInvite, TrustCircleFile, TrustCircleSnapshot, TrustCircleHandlers, TrustCircleErrorCode, } from './auth/index.js';
+export { StrandService, StrandError, createStrandHandlers } from './strands/index.js';
+export type { StrandServiceOptions, CadreNodeLike as StrandCadreNodeLike, StrandSummary, StrandListSnapshot, StrandRemovalResult, StrandHandlers, StrandErrorCode, } from './strands/index.js';
+export { GrantStore, GrantService, createGrantAdminHandlers, GrantError, DEFAULT_MAX_NODES, DonationStore, DonationService, DonationError, } from './donation/index.js';
+export type { Grant, GrantDenyReason, GrantValidation, GrantValidator, GrantFile, GrantAdminHandlers, GrantErrorCode, GrantServiceOptions, Donation, DonationView, DonationStatus, DonationFile, DonationErrorCode, DonationProvisionRequest, DonationSeedResult, DonationPeerInfo, DonationServiceOptions, } from './donation/index.js';
 export { Installer, readHostConfig, updateHostConfig, writeHostConfig } from './installer/index.js';
 export type { InstallOptions, InstallResult, UninstallOptions, InstallerOptions, HostConfigFile, PushSettings, WizardAnswers, WizardDefaults, ServiceHost, ServiceHostContext, ServiceHostStatus, } from './installer/index.js';
 export { resolvePushCredentials, setFcmSecret, setApnsSecret, clearPushSecret, pushAccount, pushStatus, } from './push/index.js';

package/dist/index.js

@@ -17,9 +17,13 @@
  *   - cadre-host-installer
  *   - cadre-host-local-ui
  */
-export { HostProcessOrchestrator, AUTHORITY_CONTAINER_ID } from './orchestrator/index.js';
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority/index.js';
-export { TrustCircleService, TrustCircleStore, TrustCircleError, createTrustCircleHandlers, parseDuration, DEFAULT_INVITE_TTL_MS, } from './auth/index.js';
+export { HostProcessOrchestrator, OWNER_CONTAINER_ID } from './orchestrator/index.js';
+export { OwnerNodeClient, OwnerNodeUnavailableError } from './owner/index.js';
+export { TrustCircleService, TrustCircleStore, TrustCircleError, createTrustCircleHandlers, parseDuration, ensureSelfLabel, DEFAULT_INVITE_TTL_MS, } from './auth/index.js';
+/* ──────────────── strand management ──────────────── */
+export { StrandService, StrandError, createStrandHandlers } from './strands/index.js';
+/* ──────────────── donation grant tokens ──────────────── */
+export { GrantStore, GrantService, createGrantAdminHandlers, GrantError, DEFAULT_MAX_NODES, DonationStore, DonationService, DonationError, } from './donation/index.js';
 export { Installer, readHostConfig, updateHostConfig, writeHostConfig } from './installer/index.js';
 /* ──────────────── push credentials (FCM/APNs) ──────────────── */
 export { resolvePushCredentials, setFcmSecret, setApnsSecret, clearPushSecret, pushAccount, pushStatus, } from './push/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAW1F,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAG1F,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAYzB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAepG,mEAAmE;AAEnE,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,GACd,MAAM,gBAAgB,CAAC;AA+BxB,+DAA+D;AAE/D,OAAO,EACL,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,GAClB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAWtF,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG9E,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,eAAe,EACf,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAYzB,yDAAyD;AAEzD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAWtF,6DAA6D;AAE7D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,wBAAwB,EACxB,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,qBAAqB,CAAC;AAqB7B,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAepG,mEAAmE;AAEnE,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,GACd,MAAM,gBAAgB,CAAC;AA+BxB,+DAA+D;AAE/D,OAAO,EACL,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,GAClB,MAAM,mBAAmB,CAAC"}

package/dist/installer/config.d.ts

@@ -16,6 +16,20 @@ export interface UpdatesConfig {
     /** Optional override for the manifest URL (env var still wins). */
     manifestUrl?: string;
 }
+/**
+ * Whether this host also runs its own personal cadre (the opt-in "founder"
+ * persona), on top of the always-on node-donor role.
+ *
+ * Default (absent or `enabled: false`) is donor-only: `cadre-host start` brings
+ * up the donation surface but spawns **no** owner node, so the trust-circle and
+ * NAT surfaces stay inactive. Set `enabled: true` (install-time choice) to also
+ * spawn the host's own owner node and enable `/auth` + `/nat`. See
+ * docs/cadre-host.md § Two roles: donor and founder.
+ */
+export interface OwnCadreConfig {
+    /** When true, `start` spawns the host-owned owner node + trust-circle + NAT. */
+    enabled: boolean;
+}
 /**
  * Non-secret push (FCM/APNs) settings. The actual private keys (and the FCM
  * service-account / APNs key identifiers) live in the secret store — see
@@ -55,6 +69,12 @@ export interface HostConfigFile {
     installerVersion: string;
     /** Update-flow settings; defaults: { autoApply: false }. */
     updates: UpdatesConfig;
+    /**
+     * Host-own-cadre (founder persona) opt-in. Optional — absent is treated as
+     * `{ enabled: false }` (donor-only). Written by the installer; read via
+     * `hostOwnsCadre()`. Not editable through /api/settings (install-time only).
+     */
+    ownCadre?: OwnCadreConfig;
     /**
      * Non-secret push settings (bundle id, sandbox/prod toggle, cooldown/debounce).
      * Optional — absent when push is not configured. Private keys never live here;
@@ -62,6 +82,12 @@ export interface HostConfigFile {
      */
     push?: PushSettings;
 }
+/**
+ * Whether this host runs its own personal cadre (founder persona). Absent
+ * `ownCadre` ⇒ donor-only (false). The single source of truth for the
+ * founder/donor gate in `bin/host.ts start`.
+ */
+export declare function hostOwnsCadre(cfg: HostConfigFile): boolean;
 export declare function writeHostConfig(filePath: string, cfg: HostConfigFile): void;
 /** Apply a partial patch to the persisted config (read-modify-write). */
 export declare function updateHostConfig(filePath: string, patch: Partial<Omit<HostConfigFile, 'version'>>): HostConfigFile;

package/dist/installer/config.js

@@ -12,6 +12,14 @@
  */
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+/**
+ * Whether this host runs its own personal cadre (founder persona). Absent
+ * `ownCadre` ⇒ donor-only (false). The single source of truth for the
+ * founder/donor gate in `bin/host.ts start`.
+ */
+export function hostOwnsCadre(cfg) {
+    return cfg.ownCadre?.enabled === true;
+}
 const CURRENT_VERSION = 2;
 export function writeHostConfig(filePath, cfg) {
     if (cfg.version !== CURRENT_VERSION) {
@@ -108,6 +116,11 @@ function isHostConfigShape(v) {
         return false;
     if (updates.manifestUrl !== undefined && typeof updates.manifestUrl !== 'string')
         return false;
+    if (o.ownCadre !== undefined) {
+        const own = o.ownCadre;
+        if (!own || typeof own !== 'object' || typeof own.enabled !== 'boolean')
+            return false;
+    }
     return true;
 }
 //# sourceMappingURL=config.js.map

package/dist/installer/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/installer/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyDpC,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,GAAmB;IACnE,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,OAAO,cAAc,eAAe,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,KAA+C;IAE/C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAmB;QAC3B,GAAG,OAAO;QACV,GAAG,KAAK;QACR,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACzD,OAAO,EAAE,CAAC;KACX,CAAC;IACF,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACtB,uEAAuE;QACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,4BAA4B,GAAG,CAAC,OAAO,wBAAwB,eAAe,GAAG,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,6BAA6B,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,GAA4B,EAAE,QAAgB;IAC/D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,gCAAgC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,MAAM,EAAE,GAAG,CAAC,MAAgB;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,OAAO,EAAE,GAAG,CAAC,OAAiB;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAsB;QACxC,WAAW,EAAE,GAAG,CAAC,WAAsB;QACvC,WAAW,EAAE,GAAG,CAAC,WAAqB;QACtC,gBAAgB,EAAE,GAAG,CAAC,gBAA0B;QAChD,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAA0B;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IACE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/installer/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8EpC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAmB;IAC/C,OAAO,GAAG,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,GAAmB;IACnE,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,OAAO,cAAc,eAAe,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,KAA+C;IAE/C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAmB;QAC3B,GAAG,OAAO;QACV,GAAG,KAAK;QACR,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACzD,OAAO,EAAE,CAAC;KACX,CAAC;IACF,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACtB,uEAAuE;QACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,4BAA4B,GAAG,CAAC,OAAO,wBAAwB,eAAe,GAAG,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,6BAA6B,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,GAA4B,EAAE,QAAgB;IAC/D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,gCAAgC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,MAAM,EAAE,GAAG,CAAC,MAAgB;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,OAAO,EAAE,GAAG,CAAC,OAAiB;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAsB;QACxC,WAAW,EAAE,GAAG,CAAC,WAAsB;QACvC,WAAW,EAAE,GAAG,CAAC,WAAqB;QACtC,gBAAgB,EAAE,GAAG,CAAC,gBAA0B;QAChD,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAA0B;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IACE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/F,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAmC,CAAC;QAClD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/installer/index.d.ts

@@ -26,6 +26,8 @@ export interface InstallOptions {
     libp2pPort?: number;
     /** Disable UPnP probing on first run. */
     noUpnp?: boolean;
+    /** Also run the host's own personal cadre here (founder persona). Default false. */
+    ownCadre?: boolean;
     /** Open browser at end (default true; suppressed by --no-browser or non-TTY). */
     openBrowser?: boolean;
     /** Skip the enrollment-invite step (no QR printed). */

package/dist/installer/index.js

@@ -56,6 +56,7 @@ export class Installer {
             installedAt: new Date().toISOString(),
             installerVersion: this.installerVersion,
             updates: { autoApply: false },
+            ownCadre: { enabled: answers.ownCadre },
         };
         const cfgPath = configPath(answers.dataDir);
         writeHostConfig(cfgPath, cfg);
@@ -129,6 +130,7 @@ export class Installer {
             libp2pPort: opts.libp2pPort ?? defaults.libp2pPort,
             upnpEnabled: opts.noUpnp ? false : defaults.upnpEnabled,
             configureDdns: false,
+            ownCadre: opts.ownCadre ?? defaults.ownCadre,
         };
     }
     async resolveAnswers(opts) {
@@ -146,6 +148,7 @@ export class Installer {
             uiPort: opts.uiPort ?? platformDefaults.uiPort,
             libp2pPort: opts.libp2pPort ?? platformDefaults.libp2pPort,
             upnpEnabled: opts.noUpnp ? false : platformDefaults.upnpEnabled,
+            ownCadre: opts.ownCadre ?? platformDefaults.ownCadre,
         };
         const wizard = opts.wizard ?? runWizard;
         return await wizard(defaults);