@serfab/cadre-host 0.8.1 → 0.9.0

package/dist/server/routes/grants-admin.js

@@ -0,0 +1,32 @@
+/**
+ * Donation grant **admin** HTTP routes — thin adapters around
+ * `GrantAdminHandlers` (`createGrantAdminHandlers(service)`).
+ *
+ * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
+ * targets. It is **loopback, no bearer**: same-machine admin, matching
+ * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
+ * Security posture). This is distinct from the grantee-facing `/grants`
+ * provisioning surface that carries the bearer gate — that arrives in the
+ * `2-donation-service` ticket.
+ */
+export function registerGrantsAdminRoutes(app, opts) {
+    const { handlers } = opts;
+    app.get('/grants-admin', async () => {
+        return handlers.listGrants();
+    });
+    app.post('/grants-admin', async (request) => {
+        const body = (request.body ?? {});
+        const label = typeof body.label === 'string' ? body.label : '';
+        const args = { label };
+        if (typeof body.maxNodes === 'number')
+            args.maxNodes = body.maxNodes;
+        if (typeof body.ttlMs === 'number')
+            args.ttlMs = body.ttlMs;
+        return handlers.postGrant(args);
+    });
+    app.delete('/grants-admin/:token', async (request) => {
+        await handlers.deleteGrant(request.params.token);
+        return { ok: true };
+    });
+}
+//# sourceMappingURL=grants-admin.js.map

package/dist/server/routes/grants-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-admin.js","sourceRoot":"","sources":["../../../src/server/routes/grants-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,UAAU,yBAAyB,CAAC,GAAoB,EAAE,IAA8B;IAC5F,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAClC,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA6D,CAAC;QAC9F,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAyD,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5D,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAgC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClF,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/grants.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Grantee-facing donation routes — the HTTP surface an external cadre authority
+ * (a friend's phone) drives to have this host donate a node into *its* cadre.
+ *
+ * Mount path: `/grants`. Distinct from the loopback-only `/grants-admin` surface
+ * (issue/list/revoke, no bearer): this one is **bearer-gated** — every request
+ * carries `Authorization: Bearer <grant-token>`, and a grantee sees only the
+ * donations its own grant authorized (the single cross-grantee boundary,
+ * analogous to cadre-provider's per-customer ownership check).
+ *
+ * Reachability is out of scope here: in v1 this mounts on the loopback
+ * management server, same as the trust-circle / NAT surfaces. Physically exposing
+ * it to a remote phone is `backlog/feat-cadre-host-wan-grant-reachability`.
+ *
+ * Errors: handlers either send a `{ ok:false, error:{code,message} }` envelope
+ * inline (auth / body validation) or let the `DonationService` throw a
+ * `DonationError`, which `server/error-handler.ts` maps to the matching HTTP
+ * status and the same envelope.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { DonationService } from '../../donation/donation-service.js';
+import type { GrantValidator } from '../../donation/types.js';
+export interface GrantsRoutesOptions {
+    donations: DonationService;
+    /** Validates the presented bearer for non-provisioning ops (provision revalidates internally). */
+    grants: GrantValidator;
+}
+export declare function registerGrantsRoutes(app: FastifyInstance, opts: GrantsRoutesOptions): void;

package/dist/server/routes/grants.js

@@ -0,0 +1,163 @@
+/**
+ * Grantee-facing donation routes — the HTTP surface an external cadre authority
+ * (a friend's phone) drives to have this host donate a node into *its* cadre.
+ *
+ * Mount path: `/grants`. Distinct from the loopback-only `/grants-admin` surface
+ * (issue/list/revoke, no bearer): this one is **bearer-gated** — every request
+ * carries `Authorization: Bearer <grant-token>`, and a grantee sees only the
+ * donations its own grant authorized (the single cross-grantee boundary,
+ * analogous to cadre-provider's per-customer ownership check).
+ *
+ * Reachability is out of scope here: in v1 this mounts on the loopback
+ * management server, same as the trust-circle / NAT surfaces. Physically exposing
+ * it to a remote phone is `backlog/feat-cadre-host-wan-grant-reachability`.
+ *
+ * Errors: handlers either send a `{ ok:false, error:{code,message} }` envelope
+ * inline (auth / body validation) or let the `DonationService` throw a
+ * `DonationError`, which `server/error-handler.ts` maps to the matching HTTP
+ * status and the same envelope.
+ */
+/** Uniform error envelope (matches `error-handler.ts` and the provider API). */
+function errorResponse(reply, code, message, status) {
+    return reply.status(status).send({ ok: false, error: { code, message } });
+}
+/** Pull the `Bearer <token>` value out of the Authorization header, or undefined. */
+function parseBearer(header) {
+    if (!header)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : undefined;
+}
+/** Map a grant denial reason to an HTTP status for the bearer gate. */
+function denyStatus(reason) {
+    if (reason === 'expired' || reason === 'revoked')
+        return 403;
+    return 401; // unknown_token / missing
+}
+/**
+ * Authenticate the grant bearer for a non-provisioning op (identity + not
+ * expired/revoked; no quota). Returns the token, or null after sending the
+ * failure response. Provision does its own quota-aware validation inside
+ * `DonationService.provision`.
+ */
+function authenticate(request, reply, grants) {
+    const token = parseBearer(request.headers.authorization);
+    if (!token) {
+        errorResponse(reply, 'unauthorized', 'Missing bearer grant token', 401);
+        return null;
+    }
+    const validation = grants.validate(token);
+    if (!validation.ok) {
+        const status = denyStatus(validation.reason);
+        // Keep the envelope code aligned with the status (and with the POST path,
+        // which surfaces an unknown token as `unauthorized`): 401 → unauthorized,
+        // 403 → forbidden. A 401 labelled `forbidden` is self-contradictory.
+        const code = status === 403 ? 'forbidden' : 'unauthorized';
+        errorResponse(reply, code, `Grant is ${validation.reason ?? 'invalid'}`, status);
+        return null;
+    }
+    return token;
+}
+/**
+ * Resolve a donation the presented grant owns. Returns the redacted view, or
+ * null after sending a 404 — an unknown id and one owned by a *different* grant
+ * are deliberately indistinguishable (a grantee never learns another grantee's
+ * donations exist).
+ */
+function requireOwned(donations, id, token, reply) {
+    const donation = donations.get(id);
+    if (!donation || donation.grantToken !== token) {
+        errorResponse(reply, 'not_found', `No such donation: ${id}`, 404);
+        return null;
+    }
+    return donation;
+}
+export function registerGrantsRoutes(app, opts) {
+    const { donations, grants } = opts;
+    // POST /grants — provision a donated node. The bearer's identity/expiry/
+    // revocation AND quota are validated inside provision(), which throws a
+    // DonationError (unauthorized / forbidden / quota_exceeded) the error handler
+    // maps. We only parse the bearer and validate the request body here.
+    app.post('/grants', async (request, reply) => {
+        const token = parseBearer(request.headers.authorization);
+        if (!token) {
+            return errorResponse(reply, 'unauthorized', 'Missing bearer grant token', 401);
+        }
+        const body = (request.body ?? {});
+        if (typeof body.partyId !== 'string' || body.partyId.length === 0) {
+            return errorResponse(reply, 'invalid_request', 'partyId is required', 400);
+        }
+        if (!Array.isArray(body.bootstrapNodes) || body.bootstrapNodes.length === 0) {
+            return errorResponse(reply, 'invalid_request', 'bootstrapNodes is required', 400);
+        }
+        if (!Array.isArray(body.ownerKeys) || body.ownerKeys.length === 0) {
+            return errorResponse(reply, 'invalid_request', 'ownerKeys is required', 400);
+        }
+        if (body.profile !== undefined && body.profile !== 'storage' && body.profile !== 'transaction') {
+            return errorResponse(reply, 'invalid_request', 'profile must be "storage" or "transaction"', 400);
+        }
+        const donation = await donations.provision({
+            grantToken: token,
+            partyId: body.partyId,
+            bootstrapNodes: body.bootstrapNodes,
+            ownerKeys: body.ownerKeys,
+            ...(body.profile ? { profile: body.profile } : {}),
+        });
+        return reply.status(201).send({ ok: true, data: { donation } });
+    });
+    // GET /grants — list only the donations this grant authorized.
+    app.get('/grants', async (request, reply) => {
+        const token = authenticate(request, reply, grants);
+        if (!token)
+            return reply;
+        return reply.send({ ok: true, data: { donations: donations.list(token) } });
+    });
+    // GET /grants/:id — one donation (redacted), owned by this grant.
+    app.get('/grants/:id', async (request, reply) => {
+        const token = authenticate(request, reply, grants);
+        if (!token)
+            return reply;
+        const donation = requireOwned(donations, request.params.id, token, reply);
+        if (!donation)
+            return reply;
+        return reply.send({ ok: true, data: { donation } });
+    });
+    // GET /grants/:id/peer — live { peerId, multiaddrs } for the requester's addDrone.
+    app.get('/grants/:id/peer', async (request, reply) => {
+        const token = authenticate(request, reply, grants);
+        if (!token)
+            return reply;
+        if (!requireOwned(donations, request.params.id, token, reply))
+            return reply;
+        const peer = await donations.getPeer(request.params.id);
+        return reply.send({ ok: true, data: peer });
+    });
+    // PUT /grants/:id/seed — apply the requester's phone-signed seed.
+    app.put('/grants/:id/seed', async (request, reply) => {
+        const token = authenticate(request, reply, grants);
+        if (!token)
+            return reply;
+        if (!requireOwned(donations, request.params.id, token, reply))
+            return reply;
+        const body = (request.body ?? {});
+        if (typeof body.seed !== 'string' || body.seed.length === 0) {
+            return errorResponse(reply, 'invalid_request', 'seed is required', 400);
+        }
+        const result = await donations.applySeed(request.params.id, body.seed);
+        if (!result.success) {
+            return errorResponse(reply, 'seed_failed', result.error ?? 'Node rejected the seed', 502);
+        }
+        return reply.send({ ok: true, data: { peersAdded: result.peersAdded ?? 0 } });
+    });
+    // DELETE /grants/:id — terminate the donated node.
+    app.delete('/grants/:id', async (request, reply) => {
+        const token = authenticate(request, reply, grants);
+        if (!token)
+            return reply;
+        if (!requireOwned(donations, request.params.id, token, reply))
+            return reply;
+        await donations.terminate(request.params.id);
+        return reply.send({ ok: true });
+    });
+}
+//# sourceMappingURL=grants.js.map

package/dist/server/routes/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/server/routes/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAaH,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAmB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAc;IACvF,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,MAA0B;IAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,0BAA0B;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAuB,EACvB,KAAmB,EACnB,MAAsB;IAEtB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3D,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,UAAU,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,SAA0B,EAC1B,EAAU,EACV,KAAa,EACb,KAAmB;IAEnB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC/C,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAyB;IAClF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEnC,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,qEAAqE;IACrE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAsC,CAAC;QACvE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YAC/F,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC;YACzC,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5E,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,GAAG,CAAC,MAAM,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/nodes.d.ts

@@ -6,10 +6,11 @@
  * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
  * handlers don't re-publish.
  *
- * start/restart are real for the admin's authority node (re-spawned from the
- * persisted `AuthoritySpawnConfig`). Generic per-member node spawn from saved
- * config is out of scope and returns `not_implemented`. Stop works for any
- * running node.
+ * start/restart are real for the admin's owner node (re-spawned from the
+ * persisted `OwnerSpawnConfig`). Generic node lifecycle is owned by the
+ * grantee-facing donation surface (`/grants`) — this route no longer spawns
+ * generic nodes; start/restart of a known non-owner node points the caller
+ * there. Stop works for any running node.
  */
 import type { FastifyInstance } from 'fastify';
 import type { HostProcessOrchestrator } from '../../orchestrator/index.js';

package/dist/server/routes/nodes.js

@@ -6,10 +6,11 @@
  * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
  * handlers don't re-publish.
  *
- * start/restart are real for the admin's authority node (re-spawned from the
- * persisted `AuthoritySpawnConfig`). Generic per-member node spawn from saved
- * config is out of scope and returns `not_implemented`. Stop works for any
- * running node.
+ * start/restart are real for the admin's owner node (re-spawned from the
+ * persisted `OwnerSpawnConfig`). Generic node lifecycle is owned by the
+ * grantee-facing donation surface (`/grants`) — this route no longer spawns
+ * generic nodes; start/restart of a known non-owner node points the caller
+ * there. Stop works for any running node.
  */
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
 import { defaultLogPath } from '../../orchestrator/log-rotator.js';
@@ -65,34 +66,34 @@ export function registerNodesRoutes(app, opts) {
         // forwards that to the bus. Don't double-publish here.
         return { ok: true };
     });
-    // start / restart: real for the admin's authority node (spawned from the
-    // persisted AuthoritySpawnConfig). Generic per-member node spawn from saved
-    // config is out of scope — those ids return a clear not_implemented; unknown
-    // ids 404.
+    // start / restart: real for the admin's owner node (spawned from the
+    // persisted OwnerSpawnConfig). Generic node lifecycle now belongs to the
+    // donation surface (/grants) — those ids return a clear not_implemented that
+    // points there; unknown ids 404.
     app.post('/api/nodes/:id/start', async (request, reply) => {
         const { id } = request.params;
-        if (orchestrator.isAuthorityNode(id)) {
-            if (!orchestrator.hasAuthorityConfig()) {
-                return notImplemented(reply, `start ${id}: authority node has no saved spawn config.`);
+        if (orchestrator.isOwnerNode(id)) {
+            if (!orchestrator.hasOwnerConfig()) {
+                return notImplemented(reply, `start ${id}: owner node has no saved spawn config.`);
             }
-            const node = await orchestrator.ensureAuthorityNode();
+            const node = await orchestrator.ensureOwnerNode();
             return { ok: true, data: { node } };
         }
         return startRestartFallback(reply, orchestrator, id, 'start');
     });
     app.post('/api/nodes/:id/restart', async (request, reply) => {
         const { id } = request.params;
-        if (orchestrator.isAuthorityNode(id)) {
-            if (!orchestrator.hasAuthorityConfig()) {
-                return notImplemented(reply, `restart ${id}: authority node has no saved spawn config.`);
+        if (orchestrator.isOwnerNode(id)) {
+            if (!orchestrator.hasOwnerConfig()) {
+                return notImplemented(reply, `restart ${id}: owner node has no saved spawn config.`);
             }
-            const node = await orchestrator.restartAuthorityNode();
+            const node = await orchestrator.restartOwnerNode();
             return { ok: true, data: { node } };
         }
         return startRestartFallback(reply, orchestrator, id, 'restart');
     });
 }
-/** 404 for unknown ids; 501 not_implemented for known non-authority nodes. */
+/** 404 for unknown ids; 501 not_implemented for known non-owner nodes. */
 function startRestartFallback(reply, orchestrator, id, verb) {
     if (!orchestrator.getNode(id)) {
         return reply.code(404).send({
@@ -100,7 +101,7 @@ function startRestartFallback(reply, orchestrator, id, verb) {
             error: { code: 'not_found', message: `Unknown node: ${id}` },
         });
     }
-    return notImplemented(reply, `${verb} ${id}: only the authority node is start/restart-able; generic node spawn is out of scope.`);
+    return notImplemented(reply, `${verb} ${id}: only the owner node is start/restart-able here; generic donated-node lifecycle is owned by the donation surface — use POST /grants to provision and DELETE /grants/:id to terminate.`);
 }
 function notImplemented(reply, message) {
     return reply.code(501).send({ ok: false, error: { code: 'not_implemented', message } });

package/dist/server/routes/nodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../../src/server/routes/nodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK9E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAM3B,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAA6B,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAA6B,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,WAAW;IACX,GAAG,CAAC,IAAI,CAA6B,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBACvC,OAAO,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAA6B,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBACvC,OAAO,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,6CAA6C,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,oBAAoB,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB,CAC3B,KAAqC,EACrC,YAAqC,EACrC,EAAU,EACV,IAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CACnB,KAAK,EACL,GAAG,IAAI,IAAI,EAAE,sFAAsF,CACpG,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAqC,EAAE,OAAe;IAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,CAAS;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,IAAI,OAAO,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,YAAY,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../../src/server/routes/nodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK9E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAM3B,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAA6B,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAA6B,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,iCAAiC;IACjC,GAAG,CAAC,IAAI,CAA6B,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;gBACnC,OAAO,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,yCAAyC,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAA6B,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;gBACnC,OAAO,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,yCAAyC,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,gBAAgB,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAC3B,KAAqC,EACrC,YAAqC,EACrC,EAAU,EACV,IAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CACnB,KAAK,EACL,GAAG,IAAI,IAAI,EAAE,wLAAwL,CACtM,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAqC,EAAE,OAAe;IAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,CAAS;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,IAAI,OAAO,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,YAAY,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/server/routes/settings.d.ts

@@ -20,7 +20,12 @@ import type { UpdateService } from '../../update/index.js';
 import type { HostSettingsStore } from '../settings-store.js';
 export interface SettingsRoutesOptions {
     settingsStore: HostSettingsStore;
-    nat: NatService;
+    /**
+     * Present only when the host runs its own personal cadre. In donor-only mode
+     * an `upnpEnabled` write still persists to host.config.json but has no running
+     * NatService to propagate into.
+     */
+    nat?: NatService;
     update?: UpdateService;
 }
 export declare function registerSettingsRoutes(app: FastifyInstance, opts: SettingsRoutesOptions): void;

package/dist/server/routes/settings.js

@@ -14,7 +14,7 @@
  * GET returns the full `HostConfigFile` (the SPA wants the full shape so it
  * can render a read-only view of the rejected keys).
  */
-const FORBIDDEN_KEYS = new Set(['uiPort', 'libp2pPort', 'dataDir', 'identityPath', 'installId', 'installedAt', 'installerVersion', 'version']);
+const FORBIDDEN_KEYS = new Set(['uiPort', 'libp2pPort', 'dataDir', 'identityPath', 'installId', 'installedAt', 'installerVersion', 'version', 'ownCadre']);
 const WRITABLE_TOP_KEYS = new Set(['upnpEnabled', 'updates']);
 const WRITABLE_UPDATES_KEYS = new Set(['autoApply', 'manifestUrl']);
 export function registerSettingsRoutes(app, opts) {
@@ -39,7 +39,10 @@ export function registerSettingsRoutes(app, opts) {
             // takes effect immediately. NatService persists into nat.json — that's
             // independent of host.config.json's `upnpEnabled` (which the installer
             // uses on first run to seed nat.json). Update both for consistency.
-            await nat.putSettings({ upnpEnabled: body.upnpEnabled });
+            // In donor-only mode there is no NatService — the write still persists.
+            if (nat) {
+                await nat.putSettings({ upnpEnabled: body.upnpEnabled });
+            }
         }
         if ('updates' in body) {
             const updates = body.updates;

package/dist/server/routes/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/server/routes/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvJ,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AACtE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAQ5E,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,IAA2B;IACtF,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE5C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAgE,EAAE,CAAC;QAE9E,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAsB,CAAC;YAChD,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAsB,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwD,CAAC;YAC9E,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,WAAW,IAAI,OAAO;gBAAE,WAAW,CAAC,SAAS,GAAG,OAAO,CAAC,SAAoB,CAAC;YACjF,IAAI,aAAa,IAAI,OAAO;gBAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAqB,CAAC;YACtF,KAAK,CAAC,OAAO,GAAG,WAAW,CAAC;YAC5B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAkD,EAAE,CAAC;gBACpE,IAAI,WAAW,IAAI,OAAO;oBAAE,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,SAAoB,CAAC;gBAC/E,IAAI,aAAa,IAAI,OAAO;oBAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAqB,CAAC;gBACpF,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAA6B;IAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,qFAAqF,EAAE,CAAC;QACzH,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,GAAG,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,aAAa,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAkC,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,EAAE,4BAA4B,GAAG,GAAG,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QAC5D,CAAC;QACD,IACE,aAAa,IAAI,OAAO;YACxB,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/server/routes/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAEnK,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AACtE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAa5E,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,IAA2B;IACtF,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE5C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAgE,EAAE,CAAC;QAE9E,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAsB,CAAC;YAChD,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAsB,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwD,CAAC;YAC9E,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,WAAW,IAAI,OAAO;gBAAE,WAAW,CAAC,SAAS,GAAG,OAAO,CAAC,SAAoB,CAAC;YACjF,IAAI,aAAa,IAAI,OAAO;gBAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAqB,CAAC;YACtF,KAAK,CAAC,OAAO,GAAG,WAAW,CAAC;YAC5B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAkD,EAAE,CAAC;gBACpE,IAAI,WAAW,IAAI,OAAO;oBAAE,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,SAAoB,CAAC;gBAC/E,IAAI,aAAa,IAAI,OAAO;oBAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAqB,CAAC;gBACpF,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAA6B;IAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,qFAAqF,EAAE,CAAC;QACzH,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,GAAG,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,aAAa,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAkC,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,EAAE,4BAA4B,GAAG,GAAG,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QAC5D,CAAC;QACD,IACE,aAAa,IAAI,OAAO;YACxB,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/server/routes/status.d.ts

@@ -13,8 +13,10 @@ import type { NatStatusSnapshot } from '../../nat/types.js';
 import type { UpdateService } from '../../update/index.js';
 export interface StatusRouteOptions {
     orchestrator: HostProcessOrchestrator;
-    trustCircle: TrustCircleService;
-    nat: NatService;
+    /** Present only when the host runs its own personal cadre (`ownCadre.enabled`). */
+    trustCircle?: TrustCircleService;
+    /** Present only when the host runs its own personal cadre (`ownCadre.enabled`). */
+    nat?: NatService;
     update?: UpdateService;
 }
 export interface StatusResponse {
@@ -29,11 +31,13 @@ export interface StatusResponse {
         status: ManagedNodeInfo['status'];
         profile: ManagedNodeInfo['profile'];
     }>;
-    trustCircle: {
+    /** Omitted in donor-only mode (no host-own trust circle). */
+    trustCircle?: {
         members: number;
         pending: number;
     };
-    connectivity: NatStatusSnapshot;
+    /** Omitted in donor-only mode (no NAT service). */
+    connectivity?: NatStatusSnapshot;
     update?: {
         available?: string;
         lastChecked?: string;

package/dist/server/routes/status.js

@@ -17,8 +17,6 @@ export function registerStatusRoute(app, opts) {
             status: n.status,
             profile: n.profile,
         }));
-        const tc = await opts.trustCircle.list();
-        const connectivity = opts.nat.getStatus();
         const response = {
             service: {
                 name: 'cadre-host',
@@ -26,9 +24,16 @@ export function registerStatusRoute(app, opts) {
                 uptimeSeconds: secondsSince(PROCESS_STARTED_AT),
             },
             nodes,
-            trustCircle: { members: tc.members.length, pending: tc.pending.length },
-            connectivity,
         };
+        // Trust-circle + connectivity exist only when the host runs its own
+        // personal cadre; donor-only mode omits both.
+        if (opts.trustCircle) {
+            const tc = await opts.trustCircle.list();
+            response.trustCircle = { members: tc.members.length, pending: tc.pending.length };
+        }
+        if (opts.nat) {
+            response.connectivity = opts.nat.getStatus();
+        }
         if (opts.update) {
             const state = await opts.update.getState();
             const update = {};

package/dist/server/routes/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/server/routes/status.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AAsBnD,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAErC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,IAA6B,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC,CAAC;QACJ,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAE1C,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE;gBACP,IAAI,EAAE,YAAY;gBAClB,OAAO;gBACP,aAAa,EAAE,YAAY,CAAC,kBAAkB,CAAC;aAChD;YACD,KAAK;YACL,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;YACvE,YAAY;SACb,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAiD,EAAE,CAAC;YAChE,IAAI,KAAK,CAAC,SAAS,EAAE,OAAO;gBAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;YACzE,IAAI,KAAK,CAAC,WAAW;gBAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAC9D,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9B,OAAO,MAAM,CAAC,SAAS,GAAG,WAAc,CAAC,CAAC;AAC5C,CAAC;AAED,IAAI,aAAa,GAAkB,IAAI,CAAC;AACxC,SAAS,kBAAkB;IACzB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,CAAC;QACH,wDAAwD;QACxD,iEAAiE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG;YACjB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;YAC/C,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;SAC1C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;gBAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;oBAC/B,OAAO,aAAa,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,aAAa,GAAG,eAAe,CAAC;IAChC,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/server/routes/status.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AA0BnD,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAErC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,IAA6B,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAmB;YAC/B,OAAO,EAAE;gBACP,IAAI,EAAE,YAAY;gBAClB,OAAO;gBACP,aAAa,EAAE,YAAY,CAAC,kBAAkB,CAAC;aAChD;YACD,KAAK;SACN,CAAC;QAEF,oEAAoE;QACpE,8CAA8C;QAC9C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACzC,QAAQ,CAAC,WAAW,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAiD,EAAE,CAAC;YAChE,IAAI,KAAK,CAAC,SAAS,EAAE,OAAO;gBAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC;YACzE,IAAI,KAAK,CAAC,WAAW;gBAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAC9D,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9B,OAAO,MAAM,CAAC,SAAS,GAAG,WAAc,CAAC,CAAC;AAC5C,CAAC;AAED,IAAI,aAAa,GAAkB,IAAI,CAAC;AACxC,SAAS,kBAAkB;IACzB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,CAAC;QACH,wDAAwD;QACxD,iEAAiE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG;YACjB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;YAC/C,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;SAC1C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;gBAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;oBAC/B,OAAO,aAAa,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,aAAa,GAAG,eAAe,CAAC;IAChC,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/update/release-key.js

@@ -9,11 +9,13 @@
  */
 import { createPublicKey } from 'node:crypto';
 /**
- * Raw 32-byte Ed25519 public key, base64-encoded. The all-zeros value below is
- * the placeholder that ships in source until the release operator embeds a real
- * key (`isPlaceholderReleaseKey` reports it; the publish guard refuses to ship
- * it). Mismatch with the real signer surfaces as `signature_invalid`, which the
- * UI treats as "update available but unverifiable" rather than auto-applying.
+ * Raw 32-byte Ed25519 public key, base64-encoded. This is the real production
+ * public key embedded by the release operator (see the "Release signing"
+ * runbook in `docs/cadre-host.md`). Before a real key was embedded the source
+ * shipped an all-zeros placeholder; `isPlaceholderReleaseKey` still detects that
+ * state and the publish guard refuses to ship it. Mismatch with the real signer
+ * surfaces as `signature_invalid`, which the UI treats as "update available but
+ * unverifiable" rather than auto-applying.
  */
 const PROD_KEY_BASE64 = 'XyRVnOY9DVgU6xdMgJIguOsc9B2L1o2KoU9626Nk+OE=';
 /**

package/dist/update/release-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-key.js","sourceRoot":"","sources":["../../src/update/release-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"release-key.js","sourceRoot":"","sources":["../../src/update/release-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serfab/cadre-host",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "description": "Self-hosted cadre node manager for basement-PC deployments",
   "main": "dist/index.js",
@@ -64,9 +64,9 @@
     "@libp2p/crypto": "^5.1.13",
     "@libp2p/interface": "^3.1.0",
     "@libp2p/peer-id": "^6.0.4",
-    "@serfab/cadre-cli": "^0.8.1",
-    "@serfab/cadre-core": "^0.8.1",
-    "@serfab/cadre-provider": "^0.8.1",
+    "@serfab/cadre-cli": "^0.9.0",
+    "@serfab/cadre-core": "^0.9.0",
+    "@serfab/cadre-provider": "^0.9.0",
     "commander": "^14.0.2",
     "debug": "^4.4.3",
     "fastify": "^5.7.1",

package/src/__tests__/{host-authority.smoke.test.ts → host-owner.smoke.test.ts}

@@ -1,14 +1,14 @@
 /**
- * Server-level smoke: the /auth/* HTTP contract over the authority-node
+ * Server-level smoke: the /auth/* HTTP contract over the owner-node
  * channel adapter. Validates the two behaviours the realignment must
  * preserve:
  *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
  *   2. With the node refusing connections, GET /auth/trust-circle still lists
  *      local labels, and POST /auth/invites returns 503 (not a raw 500).
  *
- * The authority node is represented by a stub HTTP server matching the 6.6
+ * The owner node is represented by a stub HTTP server matching the 6.6
  * admin contract (the spawn path itself is covered by
- * orchestrator-authority.test.ts).
+ * orchestrator-owner.test.ts).
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
@@ -19,7 +19,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
-import { AuthorityNodeClient } from '../authority/index.js';
+import { OwnerNodeClient } from '../owner/index.js';
 import { registerErrorHandler } from '../server/error-handler.js';
 import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
 import { EventBus } from '../server/events/bus.js';
@@ -51,7 +51,7 @@ describe('host /auth delegation — node up', () => {
         }
         if (req.url === '/admin/invites' && req.method === 'POST') {
           res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', authorityAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
+          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
           return;
         }
         if (req.url === '/admin/members' && req.method === 'GET') {
@@ -70,7 +70,7 @@ describe('host /auth delegation — node up', () => {
   afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
 
   it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
-    const client = new AuthorityNodeClient({ baseUrl, token: TOKEN });
+    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
     const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
     const app = buildApp(service);
     try {
@@ -103,7 +103,7 @@ describe('host /auth delegation — node refusing connections', () => {
     const store = new TrustCircleStore(tmpRoot);
     store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
 
-    const client = new AuthorityNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
+    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
     const service = new TrustCircleService({ cadreNode: client, store });
     const app = buildApp(service);
     try {