@serfab/cadre-host 0.8.1 → 0.9.0

package/dist/donation/donation-store.d.ts

@@ -0,0 +1,42 @@
+import type { Donation, DonationFile } from './types.js';
+/**
+ * Atomic JSON store for `donations.json` — one row per donated node. Modelled on
+ * `grant-store.ts`: a single file written to `<path>.tmp` then renamed, with an
+ * in-memory cache keyed by donation id.
+ *
+ * **Persists `seedToken`.** Unlike the orchestrator handle (whose `toPersisted`
+ * deliberately omits the freshly-minted-per-spawn seed token), this record keeps
+ * it: if the host restarts in the request→seed gap, only the donation row can
+ * reproduce the bearer needed to present the seed to the node. See
+ * `tickets/complete/cadre-provider-seed-endpoint-never-populated.md`.
+ *
+ * Concurrency assumption: only one cadre-host process owns a given rootDir
+ * (the orchestrator already enforces this). No file-locking primitives.
+ */
+export declare class DonationStore {
+    private readonly path;
+    private cache;
+    constructor(rootDir: string);
+    filePath(): string;
+    /**
+     * Load (with caching). A missing file returns an empty store. A
+     * present-but-malformed file throws rather than silently wiping — losing the
+     * records would orphan live child processes (their seed tokens gone).
+     */
+    load(): DonationFile;
+    /** Persist the current state atomically (write then rename). */
+    save(state: DonationFile): void;
+    /** Insert or replace a donation row. */
+    put(donation: Donation): void;
+    get(id: string): Donation | undefined;
+    list(): Donation[];
+    /** All donations authorized by a given grant token. */
+    listByGrant(grantToken: string): Donation[];
+    remove(id: string): boolean;
+    /**
+     * The authoritative live-node tally the grant validator consumes: donations
+     * under `grantToken` in a live status (`provisioning` / `awaiting_seed` /
+     * `seeded`). `error` and `terminated` rows are excluded.
+     */
+    liveNodeCount(grantToken: string): number;
+}

package/dist/donation/donation-store.js

@@ -0,0 +1,141 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import debug from 'debug';
+import { DonationError } from './types.js';
+const log = debug('cadre:host:donation-store');
+const FILE_VERSION = 1;
+/**
+ * Statuses that count a donation as "live" against a grant's `maxNodes` quota.
+ * `error` and `terminated` donations are kept for audit but do NOT count.
+ */
+const LIVE_STATUSES = new Set([
+    'provisioning',
+    'awaiting_seed',
+    'seeded',
+]);
+/**
+ * Atomic JSON store for `donations.json` — one row per donated node. Modelled on
+ * `grant-store.ts`: a single file written to `<path>.tmp` then renamed, with an
+ * in-memory cache keyed by donation id.
+ *
+ * **Persists `seedToken`.** Unlike the orchestrator handle (whose `toPersisted`
+ * deliberately omits the freshly-minted-per-spawn seed token), this record keeps
+ * it: if the host restarts in the request→seed gap, only the donation row can
+ * reproduce the bearer needed to present the seed to the node. See
+ * `tickets/complete/cadre-provider-seed-endpoint-never-populated.md`.
+ *
+ * Concurrency assumption: only one cadre-host process owns a given rootDir
+ * (the orchestrator already enforces this). No file-locking primitives.
+ */
+export class DonationStore {
+    constructor(rootDir) {
+        this.cache = null;
+        mkdirSync(rootDir, { recursive: true });
+        this.path = join(rootDir, 'donations.json');
+    }
+    filePath() {
+        return this.path;
+    }
+    /**
+     * Load (with caching). A missing file returns an empty store. A
+     * present-but-malformed file throws rather than silently wiping — losing the
+     * records would orphan live child processes (their seed tokens gone).
+     */
+    load() {
+        if (this.cache)
+            return this.cache;
+        if (!existsSync(this.path)) {
+            this.cache = emptyFile();
+            return this.cache;
+        }
+        let raw;
+        try {
+            raw = readFileSync(this.path, 'utf8');
+        }
+        catch (err) {
+            throw new DonationError('storage_error', `failed to read donations file at ${this.path}: ${err.message}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            throw new DonationError('storage_error', `donations file at ${this.path} is not valid JSON: ${err.message}`);
+        }
+        if (!isDonationFile(parsed)) {
+            throw new DonationError('storage_error', `donations file at ${this.path} has unexpected shape`);
+        }
+        this.cache = parsed;
+        return this.cache;
+    }
+    /** Persist the current state atomically (write then rename). */
+    save(state) {
+        // NOTE: rewrites the whole donations.json on every mutation. Fine at
+        // household scale (a handful of donated nodes); if counts ever grow large,
+        // switch to an append/compact log or per-id files.
+        mkdirSync(dirname(this.path), { recursive: true });
+        const payload = JSON.stringify({ ...state, version: FILE_VERSION }, null, 2);
+        const tmp = `${this.path}.tmp`;
+        try {
+            writeFileSync(tmp, payload, { encoding: 'utf8' });
+            renameSync(tmp, this.path);
+        }
+        catch (err) {
+            throw new DonationError('storage_error', `failed to write donations file at ${this.path}: ${err.message}`);
+        }
+        this.cache = { ...state, version: FILE_VERSION };
+        log('saved donations (%d) to %s', Object.keys(state.donations).length, this.path);
+    }
+    /** Insert or replace a donation row. */
+    put(donation) {
+        const state = this.load();
+        const { id, ...rest } = donation;
+        state.donations[id] = rest;
+        this.save(state);
+    }
+    get(id) {
+        const state = this.load();
+        const row = state.donations[id];
+        if (!row)
+            return undefined;
+        return { id, ...row };
+    }
+    list() {
+        const state = this.load();
+        return Object.entries(state.donations).map(([id, row]) => ({ id, ...row }));
+    }
+    /** All donations authorized by a given grant token. */
+    listByGrant(grantToken) {
+        return this.list().filter((d) => d.grantToken === grantToken);
+    }
+    remove(id) {
+        const state = this.load();
+        if (!(id in state.donations))
+            return false;
+        delete state.donations[id];
+        this.save(state);
+        return true;
+    }
+    /**
+     * The authoritative live-node tally the grant validator consumes: donations
+     * under `grantToken` in a live status (`provisioning` / `awaiting_seed` /
+     * `seeded`). `error` and `terminated` rows are excluded.
+     */
+    liveNodeCount(grantToken) {
+        return this.list().filter((d) => d.grantToken === grantToken && LIVE_STATUSES.has(d.status)).length;
+    }
+}
+function emptyFile() {
+    return { version: FILE_VERSION, donations: {} };
+}
+function isDonationFile(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const obj = v;
+    if (obj.version !== FILE_VERSION)
+        return false;
+    if (!obj.donations || typeof obj.donations !== 'object')
+        return false;
+    return true;
+}
+//# sourceMappingURL=donation-store.js.map

package/dist/donation/donation-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"donation-store.js","sourceRoot":"","sources":["../../src/donation/donation-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAE/C,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAiB;IACzE,cAAc;IACd,eAAe;IACf,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,aAAa;IAIxB,YAAY,OAAe;QAFnB,UAAK,GAAwB,IAAI,CAAC;QAGxC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9C,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,oCAAoC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,qBAAqB,IAAI,CAAC,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,qBAAqB,IAAI,CAAC,IAAI,uBAAuB,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,KAAmB;QACtB,qEAAqE;QACrE,2EAA2E;QAC3E,mDAAmD;QACnD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,qCAAqC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,wCAAwC;IACxC,GAAG,CAAC,QAAkB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,uDAAuD;IACvD,WAAW,CAAC,UAAkB;QAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAkB;QAC9B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAClE,CAAC,MAAM,CAAC;IACX,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/donation/grant-service.d.ts

@@ -0,0 +1,71 @@
+import type { GrantStore } from './grant-store.js';
+import type { Grant, GrantAdminHandlers, GrantValidation, GrantValidator } from './types.js';
+/** Default node cap when the admin doesn't specify one. */
+export declare const DEFAULT_MAX_NODES = 1;
+/** Constructor options. */
+export interface GrantServiceOptions {
+    /** Persistent grant store (`grants.json`). */
+    store: GrantStore;
+    /** Clock override for tests. */
+    now?: () => Date;
+}
+/**
+ * GrantService — issues, validates, lists, and revokes donation grant tokens.
+ *
+ * It is the authority for a grant's *identity, expiry, and revocation*, and
+ * for the per-grantee *node cap* (`maxNodes`). It is deliberately **not** the
+ * authority for how many nodes are currently live under a grant — that tally
+ * belongs to the donation service (`2-donation-service`), which persists the
+ * grant→node records and can see terminations. `validateForProvision` takes
+ * the count as a parameter so the two never drift.
+ *
+ * All methods are synchronous: issuance/validation/revocation are pure local
+ * store operations with no node round-trip (unlike the trust-circle flow,
+ * which delegates to the owner node).
+ */
+export declare class GrantService implements GrantValidator {
+    private readonly store;
+    private readonly now;
+    constructor(opts: GrantServiceOptions);
+    /**
+     * Issue a new grant. Generates a high-entropy base64url token, persists it,
+     * and returns the whole `Grant` (the CLI/UI prints/QR-encodes the token).
+     */
+    issue(opts: {
+        label: string;
+        maxNodes?: number;
+        ttlMs?: number;
+    }): Grant;
+    /**
+     * Validate a presented bearer token for a non-provisioning op: it must name a
+     * known grant that is neither revoked nor expired. No quota check. Never
+     * throws for a bad token — returns a denial.
+     */
+    validate(token: string): GrantValidation;
+    /**
+     * Validate for a *new* provision request. Runs the identity/expiry/revocation
+     * checks of `validate`, then — only if those pass — consults the
+     * caller-supplied live-node tally against the grant's `maxNodes`.
+     *
+     * Concurrency boundary: this is a pure function of the passed count. Two
+     * provision requests racing at the quota edge (both seeing count = N-1)
+     * would both pass here; serialising them so only one wins is the donation
+     * service's responsibility (`2-donation-service` owns the grant→node lock).
+     */
+    validateForProvision(token: string, liveNodeCount: (token: string) => number): GrantValidation;
+    /**
+     * Revoke a grant by token: mark it revoked (denies future requests). Existing
+     * live nodes are **not** torn down here — that is a separate admin action via
+     * the donation service's terminate (`2-donation-service`). Throws not_found
+     * when the token is unknown.
+     */
+    revoke(token: string): void;
+    /** Enumerate all grants (for the CLI / UI). */
+    list(): Grant[];
+}
+/**
+ * Wrap a GrantService into the typed handler shape consumed by the loopback
+ * management server's `/grants-admin` routes. Errors propagate as GrantError;
+ * the server maps `.code` → HTTP status.
+ */
+export declare function createGrantAdminHandlers(service: GrantService): GrantAdminHandlers;

package/dist/donation/grant-service.js

@@ -0,0 +1,163 @@
+import { randomBytes } from 'node:crypto';
+import debug from 'debug';
+import { GrantError } from './types.js';
+const log = debug('cadre:host:grant-service');
+/** Token byte length (base64url-encoded; ~43 chars). Matches trust-circle. */
+const TOKEN_BYTES = 32;
+/** Default node cap when the admin doesn't specify one. */
+export const DEFAULT_MAX_NODES = 1;
+/**
+ * GrantService — issues, validates, lists, and revokes donation grant tokens.
+ *
+ * It is the authority for a grant's *identity, expiry, and revocation*, and
+ * for the per-grantee *node cap* (`maxNodes`). It is deliberately **not** the
+ * authority for how many nodes are currently live under a grant — that tally
+ * belongs to the donation service (`2-donation-service`), which persists the
+ * grant→node records and can see terminations. `validateForProvision` takes
+ * the count as a parameter so the two never drift.
+ *
+ * All methods are synchronous: issuance/validation/revocation are pure local
+ * store operations with no node round-trip (unlike the trust-circle flow,
+ * which delegates to the owner node).
+ */
+export class GrantService {
+    constructor(opts) {
+        this.store = opts.store;
+        this.now = opts.now ?? (() => new Date());
+    }
+    /**
+     * Issue a new grant. Generates a high-entropy base64url token, persists it,
+     * and returns the whole `Grant` (the CLI/UI prints/QR-encodes the token).
+     */
+    issue(opts) {
+        const label = normaliseLabel(opts.label);
+        const maxNodes = normaliseMaxNodes(opts.maxNodes);
+        const created = this.now();
+        const grant = {
+            token: generateToken(),
+            label,
+            maxNodes,
+            createdAt: created.toISOString(),
+        };
+        if (opts.ttlMs !== undefined) {
+            if (!Number.isFinite(opts.ttlMs) || opts.ttlMs <= 0) {
+                throw new GrantError('invalid_ttl', `Invalid ttlMs: ${opts.ttlMs}`);
+            }
+            grant.expiresAt = new Date(created.getTime() + opts.ttlMs).toISOString();
+        }
+        this.store.add(grant);
+        log('issued grant "%s" (token=%s, maxNodes=%d, expires=%s)', label, grant.token, maxNodes, grant.expiresAt ?? 'never');
+        return grant;
+    }
+    /**
+     * Validate a presented bearer token for a non-provisioning op: it must name a
+     * known grant that is neither revoked nor expired. No quota check. Never
+     * throws for a bad token — returns a denial.
+     */
+    validate(token) {
+        if (!token)
+            return { ok: false, reason: 'unknown_token' };
+        const grant = this.store.get(token);
+        if (!grant)
+            return { ok: false, reason: 'unknown_token' };
+        // Revocation is an explicit admin action; check it before expiry so a
+        // grant that is both revoked and expired reports the stronger signal.
+        if (grant.revokedAt)
+            return { ok: false, grant, reason: 'revoked' };
+        if (grant.expiresAt) {
+            const expiresAt = new Date(grant.expiresAt);
+            if (Number.isFinite(expiresAt.getTime()) && this.now() > expiresAt) {
+                return { ok: false, grant, reason: 'expired' };
+            }
+        }
+        return { ok: true, grant };
+    }
+    /**
+     * Validate for a *new* provision request. Runs the identity/expiry/revocation
+     * checks of `validate`, then — only if those pass — consults the
+     * caller-supplied live-node tally against the grant's `maxNodes`.
+     *
+     * Concurrency boundary: this is a pure function of the passed count. Two
+     * provision requests racing at the quota edge (both seeing count = N-1)
+     * would both pass here; serialising them so only one wins is the donation
+     * service's responsibility (`2-donation-service` owns the grant→node lock).
+     */
+    validateForProvision(token, liveNodeCount) {
+        const base = this.validate(token);
+        if (!base.ok || !base.grant)
+            return base;
+        const live = liveNodeCount(token);
+        if (live >= base.grant.maxNodes) {
+            return { ok: false, grant: base.grant, reason: 'quota_exceeded' };
+        }
+        return { ok: true, grant: base.grant };
+    }
+    /**
+     * Revoke a grant by token: mark it revoked (denies future requests). Existing
+     * live nodes are **not** torn down here — that is a separate admin action via
+     * the donation service's terminate (`2-donation-service`). Throws not_found
+     * when the token is unknown.
+     */
+    revoke(token) {
+        if (!this.store.markRevoked(token, this.now().toISOString())) {
+            throw new GrantError('not_found', `Unknown grant: ${token}`);
+        }
+        log('revoked grant (token=%s)', token);
+    }
+    /** Enumerate all grants (for the CLI / UI). */
+    list() {
+        return this.store.list();
+    }
+}
+/**
+ * Wrap a GrantService into the typed handler shape consumed by the loopback
+ * management server's `/grants-admin` routes. Errors propagate as GrantError;
+ * the server maps `.code` → HTTP status.
+ */
+export function createGrantAdminHandlers(service) {
+    return {
+        async postGrant(body) {
+            if (!body || typeof body.label !== 'string') {
+                throw new GrantError('invalid_label', 'label is required');
+            }
+            const grant = service.issue({
+                label: body.label,
+                ...(body.maxNodes !== undefined ? { maxNodes: body.maxNodes } : {}),
+                ...(body.ttlMs !== undefined ? { ttlMs: body.ttlMs } : {}),
+            });
+            return { grant };
+        },
+        async listGrants() {
+            return { grants: service.list() };
+        },
+        async deleteGrant(token) {
+            service.revoke(token);
+        },
+    };
+}
+function generateToken() {
+    // base64url so it survives in URLs, QR codes, and shell arguments.
+    return randomBytes(TOKEN_BYTES).toString('base64url');
+}
+function normaliseLabel(label) {
+    if (typeof label !== 'string') {
+        throw new GrantError('invalid_label', 'label must be a string');
+    }
+    const trimmed = label.trim();
+    if (trimmed.length === 0) {
+        throw new GrantError('invalid_label', 'label must not be empty');
+    }
+    if (trimmed.length > 200) {
+        throw new GrantError('invalid_label', 'label must be 200 characters or fewer');
+    }
+    return trimmed;
+}
+function normaliseMaxNodes(maxNodes) {
+    if (maxNodes === undefined)
+        return DEFAULT_MAX_NODES;
+    if (typeof maxNodes !== 'number' || !Number.isInteger(maxNodes) || maxNodes < 1) {
+        throw new GrantError('invalid_max_nodes', `maxNodes must be a positive integer (got ${JSON.stringify(maxNodes)})`);
+    }
+    return maxNodes;
+}
+//# sourceMappingURL=grant-service.js.map

package/dist/donation/grant-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-service.js","sourceRoot":"","sources":["../../src/donation/grant-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,8EAA8E;AAC9E,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAUnC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAY;IAIvB,YAAY,IAAyB;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAA0D;QAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAU;YACnB,KAAK,EAAE,aAAa,EAAE;YACtB,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;SACjC,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,GAAG,CAAC,uDAAuD,EACzD,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE1D,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEpE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAClB,KAAa,EACb,aAAwC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,+CAA+C;IAC/C,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAqB;IAC5D,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,mEAAmE;IACnE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB;IAC1C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/donation/grant-store.d.ts

@@ -0,0 +1,38 @@
+import type { Grant, GrantFile } from './types.js';
+/**
+ * Atomic JSON store for `grants.json`. Modelled on `auth/trust-circle-store.ts`:
+ * a single file, written to `<path>.tmp` then renamed, with an in-memory cache
+ * keyed by token.
+ *
+ * Unlike the trust-circle pending rows, grants are **not** self-reaping: a
+ * grant may legitimately outlive many nodes, so expiry is evaluated at
+ * validate time (in `GrantService`) and the admin removes stale grants
+ * explicitly. This store keeps no clock.
+ *
+ * Concurrency assumption: only one cadre-host process owns a given rootDir
+ * (the orchestrator already enforces this). No file-locking primitives.
+ */
+export declare class GrantStore {
+    private readonly path;
+    private cache;
+    constructor(rootDir: string);
+    filePath(): string;
+    /**
+     * Load (with caching). A missing file returns an empty store (fresh
+     * install). A present-but-malformed file throws — silently wiping it would
+     * revoke every grantee at once.
+     */
+    load(): GrantFile;
+    /** Persist the current state atomically (write then rename). */
+    save(state: GrantFile): void;
+    add(grant: Grant): void;
+    get(token: string): Grant | undefined;
+    list(): Grant[];
+    remove(token: string): boolean;
+    /**
+     * Mark a grant revoked at the given ISO instant. Idempotent: an
+     * already-revoked grant keeps its original `revokedAt`. Returns false when
+     * the token is unknown.
+     */
+    markRevoked(token: string, at: string): boolean;
+}

package/dist/donation/grant-store.js

@@ -0,0 +1,135 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import debug from 'debug';
+import { GrantError } from './types.js';
+const log = debug('cadre:host:grant-store');
+const FILE_VERSION = 1;
+/**
+ * Atomic JSON store for `grants.json`. Modelled on `auth/trust-circle-store.ts`:
+ * a single file, written to `<path>.tmp` then renamed, with an in-memory cache
+ * keyed by token.
+ *
+ * Unlike the trust-circle pending rows, grants are **not** self-reaping: a
+ * grant may legitimately outlive many nodes, so expiry is evaluated at
+ * validate time (in `GrantService`) and the admin removes stale grants
+ * explicitly. This store keeps no clock.
+ *
+ * Concurrency assumption: only one cadre-host process owns a given rootDir
+ * (the orchestrator already enforces this). No file-locking primitives.
+ */
+export class GrantStore {
+    constructor(rootDir) {
+        this.cache = null;
+        mkdirSync(rootDir, { recursive: true });
+        this.path = join(rootDir, 'grants.json');
+    }
+    filePath() {
+        return this.path;
+    }
+    /**
+     * Load (with caching). A missing file returns an empty store (fresh
+     * install). A present-but-malformed file throws — silently wiping it would
+     * revoke every grantee at once.
+     */
+    load() {
+        if (this.cache)
+            return this.cache;
+        if (!existsSync(this.path)) {
+            this.cache = emptyFile();
+            return this.cache;
+        }
+        let raw;
+        try {
+            raw = readFileSync(this.path, 'utf8');
+        }
+        catch (err) {
+            throw new GrantError('storage_error', `failed to read grants file at ${this.path}: ${err.message}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            throw new GrantError('storage_error', `grants file at ${this.path} is not valid JSON: ${err.message}`);
+        }
+        if (!isGrantFile(parsed)) {
+            throw new GrantError('storage_error', `grants file at ${this.path} has unexpected shape`);
+        }
+        this.cache = parsed;
+        return this.cache;
+    }
+    /** Persist the current state atomically (write then rename). */
+    save(state) {
+        // NOTE: rewrites the whole grants.json on every mutation. Fine at household
+        // scale (a handful of grantees); if grant counts ever grow large, switch to
+        // an append/compact log or per-token files.
+        mkdirSync(dirname(this.path), { recursive: true });
+        const payload = JSON.stringify({ ...state, version: FILE_VERSION }, null, 2);
+        const tmp = `${this.path}.tmp`;
+        try {
+            writeFileSync(tmp, payload, { encoding: 'utf8' });
+            renameSync(tmp, this.path);
+        }
+        catch (err) {
+            // Surface as storage_error (→ 500) like load(), not a bare Error (→
+            // "internal"); a write failure on issue/revoke should read consistently.
+            throw new GrantError('storage_error', `failed to write grants file at ${this.path}: ${err.message}`);
+        }
+        this.cache = { ...state, version: FILE_VERSION };
+        log('saved grants (%d) to %s', Object.keys(state.grants).length, this.path);
+    }
+    add(grant) {
+        const state = this.load();
+        const { token, ...rest } = grant;
+        state.grants[token] = rest;
+        this.save(state);
+    }
+    get(token) {
+        const state = this.load();
+        const row = state.grants[token];
+        if (!row)
+            return undefined;
+        return { token, ...row };
+    }
+    list() {
+        const state = this.load();
+        return Object.entries(state.grants).map(([token, row]) => ({ token, ...row }));
+    }
+    remove(token) {
+        const state = this.load();
+        if (!(token in state.grants))
+            return false;
+        delete state.grants[token];
+        this.save(state);
+        return true;
+    }
+    /**
+     * Mark a grant revoked at the given ISO instant. Idempotent: an
+     * already-revoked grant keeps its original `revokedAt`. Returns false when
+     * the token is unknown.
+     */
+    markRevoked(token, at) {
+        const state = this.load();
+        const row = state.grants[token];
+        if (!row)
+            return false;
+        if (!row.revokedAt)
+            row.revokedAt = at;
+        this.save(state);
+        return true;
+    }
+}
+function emptyFile() {
+    return { version: FILE_VERSION, grants: {} };
+}
+function isGrantFile(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const obj = v;
+    if (obj.version !== FILE_VERSION)
+        return false;
+    if (!obj.grants || typeof obj.grants !== 'object')
+        return false;
+    return true;
+}
+//# sourceMappingURL=grant-store.js.map

package/dist/donation/grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/donation/grant-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,UAAU;IAIrB,YAAY,OAAe;QAFnB,UAAK,GAAqB,IAAI,CAAC;QAGrC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,iCAAiC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kBAAkB,IAAI,CAAC,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kBAAkB,IAAI,CAAC,IAAI,uBAAuB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,KAAgB;QACnB,4EAA4E;QAC5E,4EAA4E;QAC5E,4CAA4C;QAC5C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,yEAAyE;YACzE,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kCAAkC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,GAAG,CAAC,KAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,KAAa,EAAE,EAAU;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/donation/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Donation grant-token layer for cadre-host. See ./types.ts, ./grant-store.ts,
+ * and ./grant-service.ts.
+ *
+ * This layer gates *who may ask this host to donate a node*. The lifecycle
+ * service that consumes a validated grant to actually provision a node lands in
+ * the `2-donation-service` ticket, which imports the `GrantValidator` interface
+ * defined here.
+ */
+export { GrantStore } from './grant-store.js';
+export { GrantService, createGrantAdminHandlers, DEFAULT_MAX_NODES, } from './grant-service.js';
+export type { GrantServiceOptions } from './grant-service.js';
+export { GrantError, DonationError } from './types.js';
+export type { Grant, GrantDenyReason, GrantValidation, GrantValidator, GrantFile, GrantAdminHandlers, GrantErrorCode, } from './types.js';
+export { DonationStore } from './donation-store.js';
+export { DonationService, DONATION_AWAITING_SEED_TTL_MS, DONATION_REAP_SWEEP_MS, } from './donation-service.js';
+export type { DonationProvisionRequest, DonationSeedResult, DonationPeerInfo, DonationServiceOptions, } from './donation-service.js';
+export type { Donation, DonationView, DonationStatus, DonationFile, DonationErrorCode, } from './types.js';

package/dist/donation/index.js

@@ -0,0 +1,16 @@
+/**
+ * Donation grant-token layer for cadre-host. See ./types.ts, ./grant-store.ts,
+ * and ./grant-service.ts.
+ *
+ * This layer gates *who may ask this host to donate a node*. The lifecycle
+ * service that consumes a validated grant to actually provision a node lands in
+ * the `2-donation-service` ticket, which imports the `GrantValidator` interface
+ * defined here.
+ */
+export { GrantStore } from './grant-store.js';
+export { GrantService, createGrantAdminHandlers, DEFAULT_MAX_NODES, } from './grant-service.js';
+export { GrantError, DonationError } from './types.js';
+/* ──────────────── donation lifecycle (2-donation-service) ──────────────── */
+export { DonationStore } from './donation-store.js';
+export { DonationService, DONATION_AWAITING_SEED_TTL_MS, DONATION_REAP_SWEEP_MS, } from './donation-service.js';
+//# sourceMappingURL=index.js.map

package/dist/donation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/donation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWvD,+EAA+E;AAE/E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC"}