@serfab/cadre-host 0.8.1 → 0.9.0

package/src/server/routes/status.ts

@@ -22,8 +22,10 @@ const PROCESS_STARTED_AT = process.hrtime.bigint();
 
 export interface StatusRouteOptions {
   orchestrator: HostProcessOrchestrator;
-  trustCircle: TrustCircleService;
-  nat: NatService;
+  /** Present only when the host runs its own personal cadre (`ownCadre.enabled`). */
+  trustCircle?: TrustCircleService;
+  /** Present only when the host runs its own personal cadre (`ownCadre.enabled`). */
+  nat?: NatService;
   update?: UpdateService;
 }
 
@@ -35,8 +37,10 @@ export interface StatusResponse {
     status: ManagedNodeInfo['status'];
     profile: ManagedNodeInfo['profile'];
   }>;
-  trustCircle: { members: number; pending: number };
-  connectivity: NatStatusSnapshot;
+  /** Omitted in donor-only mode (no host-own trust circle). */
+  trustCircle?: { members: number; pending: number };
+  /** Omitted in donor-only mode (no NAT service). */
+  connectivity?: NatStatusSnapshot;
   update?: { available?: string; lastChecked?: string };
 }
 
@@ -50,8 +54,6 @@ export function registerStatusRoute(app: FastifyInstance, opts: StatusRouteOptio
       status: n.status,
       profile: n.profile,
     }));
-    const tc = await opts.trustCircle.list();
-    const connectivity = opts.nat.getStatus();
 
     const response: StatusResponse = {
       service: {
@@ -60,10 +62,18 @@ export function registerStatusRoute(app: FastifyInstance, opts: StatusRouteOptio
         uptimeSeconds: secondsSince(PROCESS_STARTED_AT),
       },
       nodes,
-      trustCircle: { members: tc.members.length, pending: tc.pending.length },
-      connectivity,
     };
 
+    // Trust-circle + connectivity exist only when the host runs its own
+    // personal cadre; donor-only mode omits both.
+    if (opts.trustCircle) {
+      const tc = await opts.trustCircle.list();
+      response.trustCircle = { members: tc.members.length, pending: tc.pending.length };
+    }
+    if (opts.nat) {
+      response.connectivity = opts.nat.getStatus();
+    }
+
     if (opts.update) {
       const state = await opts.update.getState();
       const update: { available?: string; lastChecked?: string } = {};

package/src/update/__tests__/release-key.test.ts

@@ -12,9 +12,14 @@ function freshPublicRawB64(): string {
 describe('isPlaceholderReleaseKey', () => {
   afterEach(() => { delete process.env.CADRE_HOST_UPDATE_DEV_KEY; });
 
-  it('is true for the default all-zeros placeholder (no override)', () => {
+  it('is true for an explicit all-zeros placeholder key', () => {
+    const allZeros = Buffer.alloc(32).toString('base64');
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: allZeros })).toBe(true);
+  });
+
+  it('is false for the shipped embedded default (real key, no override)', () => {
     delete process.env.CADRE_HOST_UPDATE_DEV_KEY;
-    expect(isPlaceholderReleaseKey()).toBe(true);
+    expect(isPlaceholderReleaseKey()).toBe(false);
   });
 
   it('is false when a real key overrides via CADRE_HOST_UPDATE_DEV_KEY', () => {
@@ -24,6 +29,14 @@ describe('isPlaceholderReleaseKey', () => {
 
   it('honors an explicit env argument over process.env', () => {
     expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: freshPublicRawB64() })).toBe(false);
-    expect(isPlaceholderReleaseKey({})).toBe(true);
+    // no override in the explicit arg -> falls through to the real embedded default
+    expect(isPlaceholderReleaseKey({})).toBe(false);
+  });
+
+  it('is false for a key that does not decode to 32 bytes', () => {
+    // Not the all-zeros placeholder even though it is a degenerate key: the
+    // 32-byte length gate short-circuits before the all-zeros check.
+    const shortZeros = Buffer.alloc(16).toString('base64');
+    expect(isPlaceholderReleaseKey({ CADRE_HOST_UPDATE_DEV_KEY: shortZeros })).toBe(false);
   });
 });

package/src/update/release-key.ts

@@ -12,11 +12,13 @@ import type { KeyObject } from 'node:crypto';
 import { createPublicKey } from 'node:crypto';
 
 /**
- * Raw 32-byte Ed25519 public key, base64-encoded. The all-zeros value below is
- * the placeholder that ships in source until the release operator embeds a real
- * key (`isPlaceholderReleaseKey` reports it; the publish guard refuses to ship
- * it). Mismatch with the real signer surfaces as `signature_invalid`, which the
- * UI treats as "update available but unverifiable" rather than auto-applying.
+ * Raw 32-byte Ed25519 public key, base64-encoded. This is the real production
+ * public key embedded by the release operator (see the "Release signing"
+ * runbook in `docs/cadre-host.md`). Before a real key was embedded the source
+ * shipped an all-zeros placeholder; `isPlaceholderReleaseKey` still detects that
+ * state and the publish guard refuses to ship it. Mismatch with the real signer
+ * surfaces as `signature_invalid`, which the UI treats as "update available but
+ * unverifiable" rather than auto-applying.
  */
 const PROD_KEY_BASE64 = 'XyRVnOY9DVgU6xdMgJIguOsc9B2L1o2KoU9626Nk+OE=';
 

package/dist/authority/authority-node-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority-node-client.js","sourceRoot":"","sources":["../../src/authority/authority-node-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAItD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvD,CAAC;CACF;AAaD,MAAM,OAAO,mBAAmB;IAI9B;;;;OAIG;IACH,YAAY,QAAwB,EAAE,OAAmC,EAAE;QACzE,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,qCAAqC;IAErC,KAAK,CAAC,YAAY,CAChB,KAAc,EACd,WAAoB;QAEpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9D,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,MAAM,EACN,gBAAgB,EAChB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAgD,EAChD,YAA0B;QAE1B,MAAM,IAAI,GAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,MAAmB;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC/C,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA6C,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA2B,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,sCAAsC;IAEtC,+EAA+E;IAC/E,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,oBAAoB;IAEZ,eAAe;QACrB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACnG,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,6BAA6B,CAAC,gDAAgD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,iCAAiC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,6BAA6B,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,IAAI,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1F,GAAG,CAAC,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAa;QAKvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,MAAuF,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,oCAAoC;QACtC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/authority/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * Authority-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's authority cadre node (via
- * `HostProcessOrchestrator`) and delegates authority/membership/identity
- * operations to it over the loopback admin channel using
- * {@link AuthorityNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority-node-client.js';
-export type { AuthorityNodeClientOptions } from './authority-node-client.js';

package/dist/authority/index.js

@@ -1,11 +0,0 @@
-/**
- * Authority-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's authority cadre node (via
- * `HostProcessOrchestrator`) and delegates authority/membership/identity
- * operations to it over the loopback admin channel using
- * {@link AuthorityNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority-node-client.js';
-//# sourceMappingURL=index.js.map

package/dist/authority/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authority/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC"}

package/src/authority/index.ts

@@ -1,12 +0,0 @@
-/**
- * Authority-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's authority cadre node (via
- * `HostProcessOrchestrator`) and delegates authority/membership/identity
- * operations to it over the loopback admin channel using
- * {@link AuthorityNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-
-export { AuthorityNodeClient, AuthorityNodeUnavailableError } from './authority-node-client.js';
-export type { AuthorityNodeClientOptions } from './authority-node-client.js';