@serfab/cadre-host 0.8.1 → 0.9.0

package/dist/auth/trust-circle.d.ts

@@ -41,9 +41,9 @@ export interface CadreNodeLike {
  * membership management.
  *
  * Membership is canonical in the cadre control DB (`CadrePeer` table),
- * reached over the authority node's admin channel; labels and pending tokens
+ * reached over the owner node's admin channel; labels and pending tokens
  * live in the host-local `TrustCircleStore`. When the node is unreachable,
- * authority operations surface `node_unavailable` (→ 503) and `list()`
+ * owner operations surface `node_unavailable` (→ 503) and `list()`
  * degrades to the local labels file.
  */
 export declare class TrustCircleService {
@@ -60,7 +60,7 @@ export declare class TrustCircleService {
     constructor(opts: TrustCircleServiceOptions);
     /**
      * Issue a new invite. Generates a token, persists a pending row, and
-     * delegates to cadre-core to embed the host's authority addresses.
+     * delegates to cadre-core to embed the host's owner addresses.
      */
     issueInvite(opts: {
         label: string;
@@ -85,7 +85,7 @@ export declare class TrustCircleService {
      *
      * Crash-safety tradeoff: if the host crashes between `acceptPhone` success
      * and the durable `removePending`, a retry will dial in fine but the
-     * authority node's `acceptPhone` will reject the second `CadrePeer` insert
+     * owner node's `acceptPhone` will reject the second `CadrePeer` insert
      * with a PK constraint error (cadre-core does not upsert). That surfaces to
      * the redeemer as a non-`node_unavailable` failure; the admin can revoke
      * the lingering pending row. This is a narrower window than the prior
@@ -110,7 +110,7 @@ export declare class TrustCircleService {
     /**
      * UI snapshot. Joins the canonical CadrePeer list (fetched over the admin
      * channel) with local labels; prunes any orphan labels (peer is no longer
-     * authorised). When the authority node is unreachable, degrades to the
+     * authorised). When the owner node is unreachable, degrades to the
      * local labels file so listing keeps working while the node is down.
      */
     list(): Promise<TrustCircleSnapshot>;

package/dist/auth/trust-circle.js

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto';
 import debug from 'debug';
-import { AuthorityNodeUnavailableError } from '../authority/authority-node-client.js';
+import { OwnerNodeUnavailableError } from '../owner/owner-node-client.js';
 import { TrustCircleError } from './types.js';
 const log = debug('cadre:host:trust-circle');
 /** Default invite lifetime: 24 hours. */
@@ -12,9 +12,9 @@ const TOKEN_BYTES = 32;
  * membership management.
  *
  * Membership is canonical in the cadre control DB (`CadrePeer` table),
- * reached over the authority node's admin channel; labels and pending tokens
+ * reached over the owner node's admin channel; labels and pending tokens
  * live in the host-local `TrustCircleStore`. When the node is unreachable,
- * authority operations surface `node_unavailable` (→ 503) and `list()`
+ * owner operations surface `node_unavailable` (→ 503) and `list()`
  * degrades to the local labels file.
  */
 export class TrustCircleService {
@@ -32,7 +32,7 @@ export class TrustCircleService {
     }
     /**
      * Issue a new invite. Generates a token, persists a pending row, and
-     * delegates to cadre-core to embed the host's authority addresses.
+     * delegates to cadre-core to embed the host's owner addresses.
      */
     async issueInvite(opts) {
         const label = normaliseLabel(opts.label);
@@ -70,7 +70,7 @@ export class TrustCircleService {
      *
      * Crash-safety tradeoff: if the host crashes between `acceptPhone` success
      * and the durable `removePending`, a retry will dial in fine but the
-     * authority node's `acceptPhone` will reject the second `CadrePeer` insert
+     * owner node's `acceptPhone` will reject the second `CadrePeer` insert
      * with a PK constraint error (cadre-core does not upsert). That surfaces to
      * the redeemer as a non-`node_unavailable` failure; the admin can revoke
      * the lingering pending row. This is a narrower window than the prior
@@ -106,7 +106,7 @@ export class TrustCircleService {
             // matches by construction) and re-checks expiration.
             const reconstructed = {
                 partyId: '',
-                authorityAddrs: [],
+                ownerAddrs: [],
                 token: pending.token,
                 createdAt: new Date(pending.createdAt).getTime(),
                 ...(pending.expiresAt ? { expiresAt: new Date(pending.expiresAt).getTime() } : {}),
@@ -172,7 +172,7 @@ export class TrustCircleService {
     /**
      * UI snapshot. Joins the canonical CadrePeer list (fetched over the admin
      * channel) with local labels; prunes any orphan labels (peer is no longer
-     * authorised). When the authority node is unreachable, degrades to the
+     * authorised). When the owner node is unreachable, degrades to the
      * local labels file so listing keeps working while the node is down.
      */
     async list() {
@@ -189,7 +189,7 @@ export class TrustCircleService {
             controlMembers = await this.cadreNode.listMembers();
         }
         catch (err) {
-            if (!(err instanceof AuthorityNodeUnavailableError))
+            if (!(err instanceof OwnerNodeUnavailableError))
                 throw err;
             controlMembers = null;
         }
@@ -232,8 +232,8 @@ export class TrustCircleService {
      * `never` so callers can `.catch(err => this.toDomainError(err))`.
      */
     toDomainError(err) {
-        if (err instanceof AuthorityNodeUnavailableError) {
-            throw new TrustCircleError('node_unavailable', `Authority node unavailable: ${err.message}`);
+        if (err instanceof OwnerNodeUnavailableError) {
+            throw new TrustCircleError('node_unavailable', `Owner node unavailable: ${err.message}`);
         }
         throw err instanceof Error ? err : new Error(String(err));
     }

package/dist/auth/trust-circle.js.map

@@ -1 +1 @@
-{"version":3,"file":"trust-circle.js","sourceRoot":"","sources":["../../src/auth/trust-circle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAStF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,GAAG,EAAE,CAAC;AA4BvB;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAY7B,YAAY,IAA+B;QAR3C;;;;;WAKG;QACc,wBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAGvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAuC;QAMvD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;QAEtD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS;aACnD,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;aAC1B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAkB;YAC7B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE/B,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,YAAY,CAAC,IAAuC;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBACnE,sDAAsD;gBACtD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,uEAAuE;YACvE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,aAAa,GAAgB;gBACjC,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAChD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;YAEF,MAAM,IAAI,CAAC,SAAS;iBACjB,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,CAAC;iBAC1D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YAE3C,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAEhC,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,MAAM,MAAM,GAAsB;gBAChC,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAE7B,GAAG,CAAC,gDAAgD,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAEpF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,0EAA0E;QAC1E,qEAAqE;QACrE,qBAAqB;QACrB,IAAI,cAAgD,CAAC;QACrD,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,6BAA6B,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC/D,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;gBACxC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM;oBACN,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM;oBAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE;oBAC7B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,eAAe;YACf,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEzC,+BAA+B;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,GAAY;QAChC,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;YACjD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA2B;IACnE,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,mEAAmE;IACnE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"trust-circle.js","sourceRoot":"","sources":["../../src/auth/trust-circle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAS1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,GAAG,EAAE,CAAC;AA4BvB;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAY7B,YAAY,IAA+B;QAR3C;;;;;WAKG;QACc,wBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAGvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAuC;QAMvD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;QAEtD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS;aACnD,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;aAC1B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAkB;YAC7B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE/B,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,YAAY,CAAC,IAAuC;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBACnE,sDAAsD;gBACtD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,uEAAuE;YACvE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,aAAa,GAAgB;gBACjC,OAAO,EAAE,EAAE;gBACX,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAChD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;YAEF,MAAM,IAAI,CAAC,SAAS;iBACjB,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,CAAC;iBAC1D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YAE3C,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAEhC,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,MAAM,MAAM,GAAsB;gBAChC,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAE7B,GAAG,CAAC,gDAAgD,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAEpF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,0EAA0E;QAC1E,qEAAqE;QACrE,qBAAqB;QACrB,IAAI,cAAgD,CAAC;QACrD,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,yBAAyB,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC3D,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;gBACxC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM;oBACN,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM;oBAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE;oBAC7B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,eAAe;YACf,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEzC,+BAA+B;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,GAAY;QAChC,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA2B;IACnE,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,mEAAmE;IACnE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth/types.d.ts

@@ -57,7 +57,7 @@ export interface TrustCircleSnapshot {
  *   - `not_found`   → 404 (unknown token / unknown peer)
  *   - `expired`     → 410 (invite past expiresAt)
  *   - `already_redeemed` → 409 (token was used and is gone)
- *   - `node_unavailable` → 503 (authority node admin channel down/not ready)
+ *   - `node_unavailable` → 503 (owner node admin channel down/not ready)
  *   - default       → 500
  */
 export interface TrustCircleHandlers {
@@ -75,7 +75,7 @@ export interface TrustCircleHandlers {
 }
 /** Error codes thrown by TrustCircleService. */
 export type TrustCircleErrorCode = 'not_found' | 'expired' | 'already_redeemed' | 'invalid_label' | 'invalid_token' | 'storage_error'
-/** The authority node's admin channel is unreachable / not ready. */
+/** The owner node's admin channel is unreachable / not ready. */
  | 'node_unavailable';
 /** Typed error carrying a stable `code` for HTTP mapping. */
 export declare class TrustCircleError extends Error {

package/dist/bin/host.js

@@ -17,17 +17,18 @@ import { dirname, join, resolve } from 'node:path';
 import { Command } from 'commander';
 import { parseDuration } from '../auth/duration.js';
 import { Installer } from '../installer/index.js';
-import { readHostConfig, updateHostConfig } from '../installer/config.js';
+import { readHostConfig, updateHostConfig, hostOwnsCadre } from '../installer/config.js';
 import { configPath as resolveConfigPath, defaultDataDir, defaultHostJs, defaultServiceDir, identityPath as resolveIdentityPath, } from '../installer/paths.js';
 import { detectPlatform } from '../installer/platform.js';
 import { createServiceHost } from '../installer/service-host/index.js';
 import { UpdateService } from '../update/index.js';
 import { HostProcessOrchestrator } from '../orchestrator/index.js';
 import { TrustCircleService, TrustCircleStore } from '../auth/index.js';
+import { GrantService, GrantStore, DonationService, DonationStore, DONATION_AWAITING_SEED_TTL_MS, DONATION_REAP_SWEEP_MS, } from '../donation/index.js';
 import { NatService } from '../nat/index.js';
 import { createSecretsStore } from '../nat/secrets/index.js';
 import { resolvePushCredentials, setFcmSecret, setApnsSecret, clearPushSecret, pushStatus, } from '../push/index.js';
-import { AuthorityNodeClient } from '../authority/index.js';
+import { OwnerNodeClient } from '../owner/index.js';
 import { createLocalUiServer, HostSettingsStore } from '../server/index.js';
 import { openBrowser } from '../installer/browser.js';
 const DEFAULT_PORT = Number(process.env.CADRE_HOST_PORT ?? '8765');
@@ -62,6 +63,7 @@ program
     .option('--no-upnp', 'Disable UPnP/NAT-PMP probing on first run')
     .option('--no-browser', 'Do not open a browser after install')
     .option('--no-invite', 'Skip generating the first enrollment invite')
+    .option('--own-cadre', 'Also run the host\'s own personal cadre here (founder persona; default: donor-only)')
     .option('--system', 'System-wide install (not yet supported in v1)')
     .option('--node-path <path>', 'Override the node binary embedded in the service unit')
     .action(async (opts) => {
@@ -75,6 +77,7 @@ program
             noUpnp: opts.upnp === false,
             openBrowser: opts.browser !== false,
             noInvite: opts.invite === false,
+            ownCadre: opts.ownCadre === true,
             system: Boolean(opts.system),
             ...(opts.nodePath ? { nodePath: opts.nodePath } : {}),
         });
@@ -218,11 +221,14 @@ program
         // Don't block startup on the network round-trip — call and forget.
         void updateService.check();
         updateService.start();
-        // Wire the long-lived HTTP management server. The manager holds no
-        // in-process cadre node: it spawns the admin's **authority node** as a
-        // managed child and delegates authority/membership/identity operations
-        // to it over the node's loopback admin channel (the 6.6 contract). The
-        // manager never joins the control network (see docs/cadre-host.md
+        // Wire the long-lived HTTP management server. cadre-host's primary role
+        // is **node donor**: it spawns generic cadre nodes for *other people's*
+        // cadres on request (the donation grant layer below) and never needs an
+        // owner node of its own for that. Running the host's **own** personal
+        // cadre here — the "founder" persona — is opt-in via `ownCadre.enabled`
+        // (see docs/cadre-host.md § Two roles: donor and founder). Only when it
+        // is enabled do we spawn the owner node and bring up trust-circle + NAT.
+        // The manager never joins the control network (docs/cadre-host.md
         // § Control-plane separation).
         // Push (FCM/APNs) credentials are resolved fresh on every node spawn so a
         // restart re-reads the secret store (rotated keys) and nothing raw is
@@ -234,61 +240,112 @@ program
             pushResolver: () => resolvePushCredentials(pushSecrets, readHostConfig(cfgPath).push),
         });
         await orchestrator.init();
-        // Spawn the authority node. Best-effort: a spawn failure leaves the
-        // management API up (trust-circle listing degrades to local labels,
-        // authority ops return 503) rather than taking down the whole process.
-        try {
-            await orchestrator.ensureAuthorityNode({
-                identityPath: idPath,
-                partyId: cfg.installId,
-                libp2pPort: cfg.libp2pPort,
-            });
-            console.log('cadre-host: authority node spawned');
-        }
-        catch (err) {
-            console.error(`authority node spawn failed: ${err.message}`);
-        }
-        // The client reads the admin endpoint lazily so a node restart's fresh
-        // bearer token is picked up automatically.
-        const authority = new AuthorityNodeClient(() => orchestrator.getAuthorityAdminEndpoint());
-        const trustCircle = new TrustCircleService({
-            cadreNode: authority,
-            store: new TrustCircleStore(cfg.dataDir),
-        });
-        const natService = new NatService({
-            rootDir: cfg.dataDir,
-            cadreNode: authority,
+        // Donation grant layer — the always-on donor surface. Local-only:
+        // issue/validate/revoke are pure store ops (no node round-trip), so it
+        // needs no owner-node handle. The loopback `/grants-admin` surface is
+        // mounted by createLocalUiServer regardless of the founder persona.
+        const grantService = new GrantService({ store: new GrantStore(cfg.dataDir) });
+        // Donation lifecycle service — consumes a validated grant to actually
+        // spawn a donated node into the requester's cadre. Drives the
+        // grantee-facing `/grants` surface (mounted by createLocalUiServer below).
+        const donationService = new DonationService({
+            orchestrator,
+            grants: grantService,
+            store: new DonationStore(cfg.dataDir),
         });
-        // Push NAT-resolved invite addresses to the node on every NAT change.
-        // NatService.start() also fires this once as an initial push, retried
-        // until the freshly spawned authority node accepts it (bounded; the
-        // management API that mints invites comes up only after start() resolves).
-        natService.onAddressesChanged(async (addresses) => {
-            if (addresses.length === 0)
-                return;
+        // Reap orphaned donations: a requester that provisioned a node but never
+        // presented a seed leaves an `awaiting_seed` child holding host ports.
+        // Sweep once at startup (for records recovered from disk by
+        // orchestrator.init()), then periodically.
+        const reapStale = () => {
+            void donationService
+                .reapStaleAwaitingSeed(DONATION_AWAITING_SEED_TTL_MS)
+                .catch((err) => console.error(`donation reap failed: ${err.message}`));
+        };
+        reapStale();
+        const reapTimer = setInterval(reapStale, DONATION_REAP_SWEEP_MS);
+        reapTimer.unref();
+        // Founder stack (opt-in). Absent `ownCadre.enabled`, cadre-host is a pure
+        // donor: no owner node, and the /auth + /nat surfaces stay unmounted
+        // (they 404). Per-donated-node WAN reachability is deferred to
+        // backlog/feat-cadre-host-wan-grant-reachability, so v1 donor mode is
+        // loopback-only — nothing for NatService to map without an owner node.
+        let trustCircle;
+        let natService;
+        if (hostOwnsCadre(cfg)) {
+            // Spawn the owner node. Best-effort: a spawn failure leaves the
+            // management API up (trust-circle listing degrades to local labels,
+            // owner ops return 503) rather than taking down the whole process.
             try {
-                await authority.pushInviteAddresses(addresses);
+                await orchestrator.ensureOwnerNode({
+                    identityPath: idPath,
+                    partyId: cfg.installId,
+                    libp2pPort: cfg.libp2pPort,
+                });
+                console.log('cadre-host: owner node spawned (host-own-cadre enabled)');
             }
             catch (err) {
-                console.error(`invite-address push failed: ${err.message}`);
+                console.error(`owner node spawn failed: ${err.message}`);
+            }
+            // The client reads the admin endpoint lazily so a node restart's fresh
+            // bearer token is picked up automatically.
+            const owner = new OwnerNodeClient(() => orchestrator.getOwnerAdminEndpoint());
+            trustCircle = new TrustCircleService({
+                cadreNode: owner,
+                store: new TrustCircleStore(cfg.dataDir),
+            });
+            natService = new NatService({
+                rootDir: cfg.dataDir,
+                cadreNode: owner,
+            });
+            // Push NAT-resolved invite addresses to the node on every NAT change.
+            // NatService.start() also fires this once as an initial push, retried
+            // until the freshly spawned owner node accepts it (bounded; the
+            // management API that mints invites comes up only after start() resolves).
+            natService.onAddressesChanged(async (addresses) => {
+                if (addresses.length === 0)
+                    return;
+                try {
+                    await owner.pushInviteAddresses(addresses);
+                }
+                catch (err) {
+                    console.error(`invite-address push failed: ${err.message}`);
+                }
+            });
+            // Best-effort NAT start. Failures here aren't fatal — the local UI
+            // can still serve the trust circle, settings, etc.
+            try {
+                await natService.start();
+            }
+            catch (err) {
+                console.error(`NAT start failed: ${err.message}`);
             }
-        });
-        // Best-effort NAT start. Failures here aren't fatal — the local UI
-        // can still serve the trust circle, settings, etc.
-        try {
-            await natService.start();
         }
-        catch (err) {
-            console.error(`NAT start failed: ${err.message}`);
+        else {
+            // Donor-only. If ownCadre was toggled off after a prior founder run,
+            // orchestrator.init() re-attaches the still-running owner child (it would
+            // otherwise linger in listNodes with no trustCircle/nat wired, serving
+            // the host's own cadre despite being disabled). Reap it now so a disabled
+            // own-cadre is actually stopped — its workdir + control-DB persist on
+            // disk, so toggling ownCadre back on re-spawns it from saved config.
+            try {
+                await orchestrator.stopOwnerNode();
+            }
+            catch (err) {
+                console.error(`owner node reap failed: ${err.message}`);
+            }
+            console.log('cadre-host: node-donor mode (host-own-cadre disabled — no owner node; /auth + /nat inactive)');
         }
         const settingsStore = new HostSettingsStore({ dataDir: cfg.dataDir });
         const server = createLocalUiServer({
             uiPort: cfg.uiPort,
             dataDir: cfg.dataDir,
             orchestrator,
-            trustCircle,
-            nat: natService,
+            ...(trustCircle ? { trustCircle } : {}),
+            ...(natService ? { nat: natService } : {}),
             update: updateService,
+            grants: grantService,
+            donations: donationService,
             settingsStore,
         });
         const { url, port } = await server.start();
@@ -297,16 +354,17 @@ program
         }
         console.log(`cadre-host local UI: ${url}`);
         await waitForTermination();
+        clearInterval(reapTimer);
         try {
             await server.stop();
         }
         catch { /* ignore */ }
         try {
-            await natService.stop();
+            await natService?.stop();
         }
         catch { /* ignore */ }
         try {
-            await orchestrator.stopAuthorityNode();
+            await orchestrator.stopOwnerNode();
         }
         catch { /* ignore */ }
         updateService.stop();
@@ -411,6 +469,22 @@ function printEnrollmentInvite(invite) {
         console.log(`  (expires ${invite.expiresAt})`);
     }
 }
+function printGrantToken(token, withQr) {
+    if (withQr) {
+        // Best-effort QR render — fall back to the bare token if the lib chokes.
+        try {
+            const qr = requireForQr('qrcode-terminal');
+            qr.generate(token, { small: true }, (rendered) => {
+                console.error(rendered);
+            });
+        }
+        catch (err) {
+            console.error(`(qrcode-terminal unavailable: ${err.message})`);
+        }
+    }
+    // The token goes to stdout alone so it can be piped/copied; metadata to stderr.
+    console.log(token);
+}
 program
     .command('invite')
     .description('Generate an invite to add a member to the trust circle')
@@ -543,6 +617,133 @@ trust
     process.exit(0);
 });
 // ============================================================================
+// grant subcommands — donation grant tokens (who may ask this host for a node)
+// ============================================================================
+//
+// A grant token lets one grantee (friend/family) present a Bearer credential to
+// ask this host to donate cadre nodes, up to a per-grantee cap. These commands
+// are thin HTTP clients of the loopback `/grants-admin` admin surface — no
+// bearer (same-machine admin), same posture as `invite` / `trust`. The
+// grantee-facing provisioning surface lands in the donation-service ticket.
+const grant = program
+    .command('grant')
+    .description('Manage donation grant tokens (who may ask this host to donate a node)');
+grant
+    .command('issue')
+    .description('Issue a grant token for one grantee (prints the token + QR)')
+    .argument('<label>', 'Display label for the grantee (e.g. "Alice\'s cadre")')
+    .option('--max-nodes <n>', 'Max concurrently-live donated nodes this grant may hold', parseIntArg)
+    .option('--ttl <duration>', 'Grant lifetime (e.g. 30d, 12h); omit for no expiry')
+    .option('--no-qr', 'Print only the token, no QR code')
+    .option('--port <port>', 'cadre-host management API port', String(DEFAULT_PORT))
+    .option('--host <host>', 'cadre-host management API host', '127.0.0.1')
+    .action(async (label, opts) => {
+    const payload = { label };
+    if (typeof opts.maxNodes === 'number')
+        payload.maxNodes = opts.maxNodes;
+    if (opts.ttl) {
+        try {
+            payload.ttlMs = parseDuration(opts.ttl);
+        }
+        catch (err) {
+            console.error(`Invalid --ttl: ${err.message}`);
+            process.exit(1);
+            return;
+        }
+    }
+    const url = `http://${opts.host}:${resolvePort(opts.port)}/grants-admin`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch (err) {
+        console.error(`Failed to reach cadre-host at ${url}: ${err.message}\n` +
+            `Hint: is cadre-host running? Try \`cadre-host start\`.`);
+        process.exit(2);
+        return;
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        console.error(`cadre-host returned ${response.status}: ${text || response.statusText}`);
+        process.exit(1);
+        return;
+    }
+    const body = await response.json();
+    const issued = body.grant;
+    if (!issued?.token) {
+        console.error('cadre-host returned malformed response (missing grant token)');
+        process.exit(1);
+        return;
+    }
+    printGrantToken(issued.token, opts.qr !== false);
+    console.error(`(maxNodes ${issued.maxNodes ?? '?'}${issued.expiresAt ? `, expires ${issued.expiresAt}` : ', no expiry'})`);
+    process.exit(0);
+});
+grant
+    .command('list')
+    .description('List issued grant tokens')
+    .option('--port <port>', 'cadre-host management API port', String(DEFAULT_PORT))
+    .option('--host <host>', 'cadre-host management API host', '127.0.0.1')
+    .action(async (opts) => {
+    const url = `http://${opts.host}:${resolvePort(opts.port)}/grants-admin`;
+    let response;
+    try {
+        response = await fetch(url);
+    }
+    catch (err) {
+        console.error(`Failed to reach cadre-host at ${url}: ${err.message}`);
+        process.exit(2);
+        return;
+    }
+    if (!response.ok) {
+        console.error(`cadre-host returned ${response.status}: ${response.statusText}`);
+        process.exit(1);
+        return;
+    }
+    const body = await response.json();
+    console.log('Grants:');
+    if (body.grants.length === 0) {
+        console.log('  (none)');
+    }
+    else {
+        for (const g of body.grants) {
+            const state = g.revokedAt ? ' [revoked]' : (g.expiresAt ? ` (expires ${g.expiresAt})` : '');
+            console.log(`  ${g.token}  ${g.label}  max=${g.maxNodes}${state}`);
+        }
+    }
+    process.exit(0);
+});
+grant
+    .command('revoke')
+    .description('Revoke a grant token (blocks future requests; live nodes are not torn down)')
+    .argument('<token>', 'Grant token to revoke')
+    .option('--port <port>', 'cadre-host management API port', String(DEFAULT_PORT))
+    .option('--host <host>', 'cadre-host management API host', '127.0.0.1')
+    .action(async (token, opts) => {
+    const base = `http://${opts.host}:${resolvePort(opts.port)}`;
+    let response;
+    try {
+        response = await fetch(`${base}/grants-admin/${encodeURIComponent(token)}`, { method: 'DELETE' });
+    }
+    catch (err) {
+        console.error(`Failed to reach cadre-host at ${base}: ${err.message}`);
+        process.exit(2);
+        return;
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        console.error(`cadre-host returned ${response.status}: ${text || response.statusText}`);
+        process.exit(1);
+        return;
+    }
+    console.log(`revoked grant: ${token}`);
+    process.exit(0);
+});
+// ============================================================================
 // nat subcommands
 // ============================================================================
 const nat = program
@@ -678,7 +879,7 @@ ddns
 // do NOT go through the running management API). Private keys land in the OS
 // keychain (keytar) or the 0600 file-store fallback; the non-secret bits (APNs
 // bundle id / sandbox toggle, cooldown/debounce) land in host.config.json. New
-// credentials take effect on the next authority-node (re)spawn — run
+// credentials take effect on the next owner-node (re)spawn — run
 // `cadre-host` restart (or restart the service) to apply them immediately.
 const push = program
     .command('push')
@@ -700,7 +901,7 @@ push
         clientEmail: opts.clientEmail,
         privateKey,
     });
-    console.log('✓ FCM credentials stored. Restart cadre-host to apply on the authority node.');
+    console.log('✓ FCM credentials stored. Restart cadre-host to apply on the owner node.');
     process.exit(0);
 });
 push
@@ -727,7 +928,7 @@ push
         },
     });
     console.log(`✓ APNs credentials stored (${opts.production ? 'production' : 'sandbox'}). ` +
-        `Restart cadre-host to apply on the authority node.`);
+        `Restart cadre-host to apply on the owner node.`);
     process.exit(0);
 });
 push