@serfab/cadre-host 0.8.1 → 0.9.0

package/src/__tests__/{orchestrator-authority.test.ts → orchestrator-owner.test.ts}

@@ -1,10 +1,10 @@
 /**
- * HostProcessOrchestrator authority-node lifecycle tests.
+ * HostProcessOrchestrator owner-node lifecycle tests.
  *
  * Uses the `spawn.entrypoint` hook with a fake CLI that writes its startup
  * token and binds a minimal `/admin/identity` endpoint on the admin port —
  * enough to validate spawn, idempotency, admin-port allocation/persistence,
- * the end-to-end AuthorityNodeClient round-trip, and init() re-attach.
+ * the end-to-end OwnerNodeClient round-trip, and init() re-attach.
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
@@ -12,13 +12,13 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { HostProcessOrchestrator, AUTHORITY_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
+import { HostProcessOrchestrator, OWNER_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
 import { StateStore } from '../orchestrator/state-store.js';
 import { isPidAlive } from '../orchestrator/pid-liveness.js';
 import { decodeDockerId } from '../orchestrator/types.js';
-import { AuthorityNodeClient } from '../authority/authority-node-client.js';
+import { OwnerNodeClient } from '../owner/owner-node-client.js';
 
-const FAKE_AUTHORITY_CLI = `
+const FAKE_OWNER_CLI = `
 import fs from 'node:fs';
 import http from 'node:http';
 
@@ -55,7 +55,7 @@ if (adminPort && token) {
 }
 
 process.on('SIGTERM', () => process.exit(0));
-console.log('fake authority up');
+console.log('fake owner up');
 setInterval(() => {}, 1 << 30);
 `;
 
@@ -65,13 +65,13 @@ const orchestrators: HostProcessOrchestrator[] = [];
 
 beforeEach(() => {
   tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-auth-'));
-  scriptPath = join(tmpRoot, 'fake-authority.mjs');
-  writeFileSync(scriptPath, FAKE_AUTHORITY_CLI, 'utf8');
+  scriptPath = join(tmpRoot, 'fake-owner.mjs');
+  writeFileSync(scriptPath, FAKE_OWNER_CLI, 'utf8');
 });
 
 afterEach(async () => {
   for (const orch of orchestrators) {
-    try { await orch.stopAuthorityNode(); } catch { /* ignore */ }
+    try { await orch.stopOwnerNode(); } catch { /* ignore */ }
     for (const dockerId of listDockerIds(orch)) {
       try { await orch.removeContainer(dockerId); } catch { /* ignore */ }
     }
@@ -113,66 +113,66 @@ function sleep(ms: number): Promise<void> {
 
 const CFG = { identityPath: 'C:/fake/identity.key', partyId: 'install-id-123', libp2pPort: 4555 };
 
-describe('HostProcessOrchestrator.ensureAuthorityNode', () => {
-  it('spawns the authority node, allocates+persists an admin port', async () => {
+describe('HostProcessOrchestrator.ensureOwnerNode', () => {
+  it('spawns the owner node, allocates+persists an admin port', async () => {
     const orch = makeOrchestrator(join(tmpRoot, 'a'));
     await orch.init();
-    const node = await orch.ensureAuthorityNode(CFG);
+    const node = await orch.ensureOwnerNode(CFG);
 
-    expect(node.id).toBe(AUTHORITY_CONTAINER_ID);
-    expect(node.authority).toBe(true);
+    expect(node.id).toBe(OWNER_CONTAINER_ID);
+    expect(node.owner).toBe(true);
     expect(node.ports.admin).toBeGreaterThanOrEqual(18500);
     expect(node.ports.p2p).toBe(4555);
 
-    const endpoint = orch.getAuthorityAdminEndpoint();
+    const endpoint = orch.getOwnerAdminEndpoint();
     expect(endpoint).toBeDefined();
     expect(endpoint!.baseUrl).toBe(`http://127.0.0.1:${node.ports.admin}`);
 
-    // Persisted with admin port + authority flag + authorityConfig.
+    // Persisted with admin port + owner flag + ownerConfig.
     const persisted = new StateStore(join(tmpRoot, 'a')).load();
-    expect(persisted.authorityConfig).toMatchObject({ partyId: 'install-id-123', libp2pPort: 4555 });
-    const ph = persisted.handles.find((h) => h.containerId === AUTHORITY_CONTAINER_ID);
-    expect(ph?.authority).toBe(true);
+    expect(persisted.ownerConfig).toMatchObject({ partyId: 'install-id-123', libp2pPort: 4555 });
+    const ph = persisted.handles.find((h) => h.containerId === OWNER_CONTAINER_ID);
+    expect(ph?.owner).toBe(true);
     expect(typeof ph?.ports.admin).toBe('number');
   });
 
   it('is idempotent — a second call does not spawn a second child', async () => {
     const orch = makeOrchestrator(join(tmpRoot, 'b'));
     await orch.init();
-    const first = await orch.ensureAuthorityNode(CFG);
+    const first = await orch.ensureOwnerNode(CFG);
     await waitFor(() => orch.isRunning(first.dockerId));
 
-    const second = await orch.ensureAuthorityNode(CFG);
+    const second = await orch.ensureOwnerNode(CFG);
     expect(second.dockerId).toBe(first.dockerId);
     expect(orch.listNodes()).toHaveLength(1);
   });
 
-  it('the AuthorityNodeClient reaches the spawned admin channel', async () => {
+  it('the OwnerNodeClient reaches the spawned admin channel', async () => {
     const orch = makeOrchestrator(join(tmpRoot, 'c'));
     await orch.init();
-    const node = await orch.ensureAuthorityNode(CFG);
+    const node = await orch.ensureOwnerNode(CFG);
     await waitFor(() => orch.isRunning(node.dockerId));
 
-    const client = new AuthorityNodeClient(() => orch.getAuthorityAdminEndpoint());
+    const client = new OwnerNodeClient(() => orch.getOwnerAdminEndpoint());
     await waitFor(async () => {
       try { return (await client.getPeerId()) === 'FAKEPEER'; } catch { return false; }
     });
     expect(await client.getPeerId()).toBe('FAKEPEER');
   });
 
-  it('getAuthorityAdminEndpoint() survives an init() re-attach', async () => {
+  it('getOwnerAdminEndpoint() survives an init() re-attach', async () => {
     const rootDir = join(tmpRoot, 'd');
     const a = makeOrchestrator(rootDir);
     await a.init();
-    const node = await a.ensureAuthorityNode(CFG);
+    const node = await a.ensureOwnerNode(CFG);
     await waitFor(() => a.isRunning(node.dockerId));
-    const before = a.getAuthorityAdminEndpoint();
+    const before = a.getOwnerAdminEndpoint();
 
     const b = makeOrchestrator(rootDir);
     await b.init();
-    expect(b.isAuthorityNode(AUTHORITY_CONTAINER_ID)).toBe(true);
-    expect(b.hasAuthorityConfig()).toBe(true);
-    const after = b.getAuthorityAdminEndpoint();
+    expect(b.isOwnerNode(OWNER_CONTAINER_ID)).toBe(true);
+    expect(b.hasOwnerConfig()).toBe(true);
+    const after = b.getOwnerAdminEndpoint();
     expect(after).toEqual(before);
     expect(await b.isRunning(node.dockerId)).toBe(true);
 
@@ -180,14 +180,14 @@ describe('HostProcessOrchestrator.ensureAuthorityNode', () => {
     expect(isPidAlive(pid)).toBe(true);
   });
 
-  it('restartAuthorityNode preserves the workdir and re-spawns', async () => {
+  it('restartOwnerNode preserves the workdir and re-spawns', async () => {
     const orch = makeOrchestrator(join(tmpRoot, 'e'));
     await orch.init();
-    const first = await orch.ensureAuthorityNode(CFG);
+    const first = await orch.ensureOwnerNode(CFG);
     await waitFor(() => orch.isRunning(first.dockerId));
     const { pid: firstPid } = decodeDockerId(first.dockerId);
 
-    const restarted = await orch.restartAuthorityNode();
+    const restarted = await orch.restartOwnerNode();
     await waitFor(() => orch.isRunning(restarted.dockerId));
 
     // New child (different pid/token), still exactly one node, workdir reused.

package/src/__tests__/orchestrator-pin-keys.test.ts

@@ -0,0 +1,153 @@
+/**
+ * HostProcessOrchestrator pinned-owner-key tests — the load-bearing wiring for
+ * the node-donation flow.
+ *
+ * A donated node joins a FOREIGN cadre and must accept a requester-signed seed,
+ * so the orchestrator threads `request.pinnedOwnerKeys` into the child as the
+ * comma-separated `CADRE_OWNER_KEYS` env var (which `cadre-cli start` turns into
+ * a cold-start pinned-key trust policy). The same signal marks the node as
+ * foreign-party, which suppresses the host's own push credentials (meaningless
+ * to another cadre's app).
+ *
+ * A fake CLI records `CADRE_OWNER_KEYS` from its environment to a file so the
+ * env threading is observable without a real cadre node.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { PushCredentials } from '@serfab/cadre-core';
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+
+// Writes CADRE_OWNER_KEYS (as seen in the child env) next to the startup token,
+// then behaves like a minimal long-lived node.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  try { fs.writeFileSync(path.join(dir, 'owner-keys.txt'), process.env.CADRE_OWNER_KEYS ?? '', 'utf8'); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-SECRET-PEM' };
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-pin-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+});
+
+afterEach(async () => {
+  for (const orch of orchestrators) {
+    for (const n of orch.listNodes()) {
+      try { await orch.removeContainer(n.dockerId); } catch { /* ignore */ }
+    }
+  }
+  orchestrators.length = 0;
+  await sleep(50);
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+function makeOrchestrator(rootDir: string, pushResolver?: () => Promise<PushCredentials | undefined>): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18500, end: 18999 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+    ...(pushResolver ? { pushResolver } : {}),
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+function readChildConfig(rootDir: string, containerId: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(rootDir, containerId, 'cadre.json'), 'utf8')) as Record<string, unknown>;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator pinned owner keys', () => {
+  it('threads pinnedOwnerKeys into the child as comma-separated CADRE_OWNER_KEYS', async () => {
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'donated-1',
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+      pinnedOwnerKeys: ['key-a', 'key-b'],
+    });
+
+    const keys = await waitForFile(join(rootDir, 'donated-1', 'owner-keys.txt'));
+    expect(keys).toBe('key-a,key-b');
+  });
+
+  it('suppresses host push for a foreign-party (pinned-key) node even on storage profile', async () => {
+    const rootDir = join(tmpRoot, 'b');
+    const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM }));
+    await orch.init();
+
+    // Foreign-party donated node: pinned keys present → no host push injected.
+    await orch.createContainer({
+      containerId: 'donated-2',
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+      pinnedOwnerKeys: ['key-a'],
+    });
+    expect(readChildConfig(rootDir, 'donated-2').push).toBeUndefined();
+
+    // Control: a host-own storage node (no pinned keys) DOES get push.
+    await orch.createContainer({
+      containerId: 'own-1',
+      partyId: 'host-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+    });
+    expect(readChildConfig(rootDir, 'own-1').push).toEqual({ fcm: FCM });
+  });
+
+  it('omits CADRE_OWNER_KEYS when no pinned keys are supplied', async () => {
+    const rootDir = join(tmpRoot, 'c');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'own-2',
+      partyId: 'host-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+    });
+
+    const keys = await waitForFile(join(rootDir, 'own-2', 'owner-keys.txt'));
+    expect(keys).toBe(''); // env var absent → child reads empty string
+  });
+});

package/src/__tests__/orchestrator-push.test.ts

@@ -13,7 +13,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import type { PushCredentials } from '@serfab/cadre-core';
-import { HostProcessOrchestrator, AUTHORITY_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
+import { HostProcessOrchestrator, OWNER_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
 
 const FAKE_CLI = `
 import fs from 'node:fs';
@@ -42,7 +42,7 @@ beforeEach(() => {
 
 afterEach(async () => {
   for (const orch of orchestrators) {
-    try { await orch.stopAuthorityNode(); } catch { /* ignore */ }
+    try { await orch.stopOwnerNode(); } catch { /* ignore */ }
   }
   orchestrators.length = 0;
   await sleep(50);
@@ -62,7 +62,7 @@ function makeOrchestrator(rootDir: string, pushResolver?: () => Promise<PushCred
   return orch;
 }
 
-function readChildConfig(rootDir: string, containerId = AUTHORITY_CONTAINER_ID): Record<string, unknown> {
+function readChildConfig(rootDir: string, containerId = OWNER_CONTAINER_ID): Record<string, unknown> {
   const raw = readFileSync(join(rootDir, containerId, 'cadre.json'), 'utf8');
   return JSON.parse(raw) as Record<string, unknown>;
 }
@@ -76,7 +76,7 @@ describe('HostProcessOrchestrator push injection', () => {
     const rootDir = join(tmpRoot, 'a');
     const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM, apns: APNS, cooldownMs: 1000 }));
     await orch.init();
-    await orch.ensureAuthorityNode(CFG);
+    await orch.ensureOwnerNode(CFG);
 
     const cfg = readChildConfig(rootDir);
     expect(cfg.push).toEqual({ fcm: FCM, apns: APNS, cooldownMs: 1000 });
@@ -86,7 +86,7 @@ describe('HostProcessOrchestrator push injection', () => {
     const rootDir = join(tmpRoot, 'b');
     const orch = makeOrchestrator(rootDir);
     await orch.init();
-    await orch.ensureAuthorityNode(CFG);
+    await orch.ensureOwnerNode(CFG);
 
     const cfg = readChildConfig(rootDir);
     expect(cfg.push).toBeUndefined();
@@ -96,7 +96,7 @@ describe('HostProcessOrchestrator push injection', () => {
     const rootDir = join(tmpRoot, 'c');
     const orch = makeOrchestrator(rootDir, async () => undefined);
     await orch.init();
-    await orch.ensureAuthorityNode(CFG);
+    await orch.ensureOwnerNode(CFG);
 
     expect(readChildConfig(rootDir).push).toBeUndefined();
   });
@@ -106,8 +106,8 @@ describe('HostProcessOrchestrator push injection', () => {
     const orch = makeOrchestrator(rootDir, async () => { throw new Error('partial creds'); });
     await orch.init();
     // Spawn still succeeds.
-    const node = await orch.ensureAuthorityNode(CFG);
-    expect(node.id).toBe(AUTHORITY_CONTAINER_ID);
+    const node = await orch.ensureOwnerNode(CFG);
+    expect(node.id).toBe(OWNER_CONTAINER_ID);
     expect(readChildConfig(rootDir).push).toBeUndefined();
   });
 
@@ -116,7 +116,7 @@ describe('HostProcessOrchestrator push injection', () => {
     let current: PushCredentials | undefined = { fcm: FCM };
     const orch = makeOrchestrator(rootDir, async () => current);
     await orch.init();
-    await orch.ensureAuthorityNode(CFG);
+    await orch.ensureOwnerNode(CFG);
     expect(readChildConfig(rootDir).push).toEqual({ fcm: FCM });
 
     // state.json must not carry the raw key — only re-resolvable references.
@@ -125,7 +125,7 @@ describe('HostProcessOrchestrator push injection', () => {
 
     // Rotate the resolver's answer, then restart — the new spawn must pick it up.
     current = { apns: APNS };
-    await orch.restartAuthorityNode();
+    await orch.restartOwnerNode();
     const cfg2 = readChildConfig(rootDir);
     expect(cfg2.push).toEqual({ apns: APNS });
     expect((cfg2.push as PushCredentials).fcm).toBeUndefined();

package/src/auth/__tests__/trust-circle-integration.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { generateKeyPair } from '@libp2p/crypto/keys';
 import { peerIdFromPrivateKey } from '@libp2p/peer-id';
-import { CadreNode, authorityKeyFromLibp2p } from '@serfab/cadre-core';
+import { CadreNode, ed25519KeyPairFromLibp2p } from '@serfab/cadre-core';
 
 import { TrustCircleService } from '../trust-circle.js';
 import { TrustCircleStore } from '../trust-circle-store.js';
@@ -29,19 +29,19 @@ describe('TrustCircleService — real CadreNode integration', () => {
   let host: CadreNode;
   let store: TrustCircleStore;
   let service: TrustCircleService;
-  let hostAuthorityPrivateKey: string;
-  let hostAuthorityPublicKey: string;
+  let hostOwnerPrivateKey: string;
+  let hostOwnerPublicKey: string;
 
   beforeEach(async () => {
     tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-int-'));
 
-    // Own-authority host: the node's libp2p identity key IS its authority key
-    // (the cadre-cli `--authority` shape), so registerSelf can authority-sign the
+    // Own-owner host: the node's libp2p identity key IS its owner key
+    // (the cadre-cli `--owner` shape), so registerSelf can owner-sign the
     // INSERT of its own CadrePeer row.
     const hostKey = await generateKeyPair('Ed25519');
-    const authority = authorityKeyFromLibp2p(hostKey);
-    hostAuthorityPrivateKey = authority.privateKeyB64;
-    hostAuthorityPublicKey = authority.publicKeyB64;
+    const owner = ed25519KeyPairFromLibp2p(hostKey);
+    hostOwnerPrivateKey = owner.privateKeyB64;
+    hostOwnerPublicKey = owner.publicKeyB64;
 
     const baseId = Math.random().toString(36).slice(2);
 
@@ -55,11 +55,11 @@ describe('TrustCircleService — real CadreNode integration', () => {
 
     const db = host.getControlDatabase();
     expect(db).not.toBeNull();
-    await db!.insertAuthorityKey(hostAuthorityPublicKey);
+    await db!.insertOwnerKey(hostOwnerPublicKey);
 
-    host.initializeSeedBootstrap(hostAuthorityPrivateKey);
+    host.initializeSeedBootstrap(hostOwnerPrivateKey);
 
-    // The authority writes its own CadrePeer row up-front (the implement ticket's
+    // The owner writes its own CadrePeer row up-front (the implement ticket's
     // CLI change). After this the host's own peerId is a member, so it shows up
     // alongside any redeemed peers in the trust-circle listing.
     await host.registerSelf();

package/src/auth/__tests__/trust-circle.test.ts

@@ -9,10 +9,10 @@ import { TrustCircleService, createTrustCircleHandlers } from '../trust-circle.j
 import { TrustCircleStore } from '../trust-circle-store.js';
 import { TrustCircleError } from '../types.js';
 import type { CadreNodeLike } from '../trust-circle.js';
-import { AuthorityNodeUnavailableError } from '../../authority/authority-node-client.js';
+import { OwnerNodeUnavailableError } from '../../owner/owner-node-client.js';
 
 /**
- * Minimal in-memory mock of the authority-node channel adapter. Records calls
+ * Minimal in-memory mock of the owner-node channel adapter. Records calls
  * so assertions can verify the auth + redemption flow without standing up a
  * real libp2p control network or admin channel.
  */
@@ -24,14 +24,14 @@ class MockCadreNode implements CadreNodeLike {
 
   /** Toggle to make acceptPhone reject. */
   acceptShouldThrow: Error | null = null;
-  /** When false, membership calls throw AuthorityNodeUnavailableError. */
+  /** When false, membership calls throw OwnerNodeUnavailableError. */
   nodeAvailable = true;
 
   async createInvite(token?: string, expiresIn?: number) {
     this.issuedInvites.push({ token, expiresIn });
     const invite: CadreInvite = {
       partyId: 'party-test',
-      authorityAddrs: ['/ip4/127.0.0.1/tcp/4001'],
+      ownerAddrs: ['/ip4/127.0.0.1/tcp/4001'],
       token,
       createdAt: Date.now(),
       ...(expiresIn ? { expiresAt: Date.now() + expiresIn } : {}),
@@ -55,12 +55,12 @@ class MockCadreNode implements CadreNodeLike {
   }
 
   async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
-    if (!this.nodeAvailable) throw new AuthorityNodeUnavailableError('node down');
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
     return [...this.authorizedPeers].map((peerId) => ({ peerId, multiaddr: null }));
   }
 
   async isMember(peerId: string): Promise<boolean> {
-    if (!this.nodeAvailable) throw new AuthorityNodeUnavailableError('node down');
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
     return this.authorizedPeers.has(peerId);
   }
 }
@@ -201,7 +201,7 @@ describe('TrustCircleService.redeemInvite', () => {
 
   it('preserves the pending token when acceptPhone fails with node_unavailable', async () => {
     const { token } = await service.issueInvite({ label: 'Transient' });
-    cadreNode.acceptShouldThrow = new AuthorityNodeUnavailableError('node down');
+    cadreNode.acceptShouldThrow = new OwnerNodeUnavailableError('node down');
 
     await expect(service.redeemInvite({ token, peerId: 'pTrans' }))
       .rejects.toMatchObject({ code: 'node_unavailable' });
@@ -225,7 +225,7 @@ describe('TrustCircleService.redeemInvite', () => {
     // first redeem hits node_unavailable. The second redeem should still
     // bounce synchronously while the gate is held.
     let release!: () => void;
-    const gate = new Promise<void>((_, reject) => { release = () => reject(new AuthorityNodeUnavailableError('node down')); });
+    const gate = new Promise<void>((_, reject) => { release = () => reject(new OwnerNodeUnavailableError('node down')); });
     cadreNode.acceptPhone = async () => {
       await gate;
     };
@@ -349,7 +349,7 @@ describe('TrustCircleService.list', () => {
     expect(store.getMember('orphan')).toBeUndefined();
   });
 
-  it('falls back to local labels when the authority node is unavailable', async () => {
+  it('falls back to local labels when the owner node is unavailable', async () => {
     store.addMember({ peerId: 'pZ', label: 'Zoe', addedAt: 't' });
     cadreNode.nodeAvailable = false;
 
@@ -361,7 +361,7 @@ describe('TrustCircleService.list', () => {
 
   it('issueInvite surfaces node_unavailable when the channel is down', async () => {
     const downNode = new MockCadreNode();
-    downNode.createInvite = async () => { throw new AuthorityNodeUnavailableError('refused'); };
+    downNode.createInvite = async () => { throw new OwnerNodeUnavailableError('refused'); };
     const svc = new TrustCircleService({ cadreNode: downNode, store });
     await expect(svc.issueInvite({ label: 'Nina' }))
       .rejects.toMatchObject({ code: 'node_unavailable' });

package/src/auth/trust-circle.ts

@@ -3,7 +3,7 @@ import debug from 'debug';
 
 import type { CadreInvite } from '@serfab/cadre-core';
 
-import { AuthorityNodeUnavailableError } from '../authority/authority-node-client.js';
+import { OwnerNodeUnavailableError } from '../owner/owner-node-client.js';
 
 import type { TrustCircleStore } from './trust-circle-store.js';
 import type {
@@ -53,9 +53,9 @@ export interface CadreNodeLike {
  * membership management.
  *
  * Membership is canonical in the cadre control DB (`CadrePeer` table),
- * reached over the authority node's admin channel; labels and pending tokens
+ * reached over the owner node's admin channel; labels and pending tokens
  * live in the host-local `TrustCircleStore`. When the node is unreachable,
- * authority operations surface `node_unavailable` (→ 503) and `list()`
+ * owner operations surface `node_unavailable` (→ 503) and `list()`
  * degrades to the local labels file.
  */
 export class TrustCircleService {
@@ -78,7 +78,7 @@ export class TrustCircleService {
 
   /**
    * Issue a new invite. Generates a token, persists a pending row, and
-   * delegates to cadre-core to embed the host's authority addresses.
+   * delegates to cadre-core to embed the host's owner addresses.
    */
   async issueInvite(opts: { label: string; ttlMs?: number }): Promise<{
     encodedInvite: string;
@@ -127,7 +127,7 @@ export class TrustCircleService {
    *
    * Crash-safety tradeoff: if the host crashes between `acceptPhone` success
    * and the durable `removePending`, a retry will dial in fine but the
-   * authority node's `acceptPhone` will reject the second `CadrePeer` insert
+   * owner node's `acceptPhone` will reject the second `CadrePeer` insert
    * with a PK constraint error (cadre-core does not upsert). That surfaces to
    * the redeemer as a non-`node_unavailable` failure; the admin can revoke
    * the lingering pending row. This is a narrower window than the prior
@@ -167,7 +167,7 @@ export class TrustCircleService {
       // matches by construction) and re-checks expiration.
       const reconstructed: CadreInvite = {
         partyId: '',
-        authorityAddrs: [],
+        ownerAddrs: [],
         token: pending.token,
         createdAt: new Date(pending.createdAt).getTime(),
         ...(pending.expiresAt ? { expiresAt: new Date(pending.expiresAt).getTime() } : {}),
@@ -242,7 +242,7 @@ export class TrustCircleService {
   /**
    * UI snapshot. Joins the canonical CadrePeer list (fetched over the admin
    * channel) with local labels; prunes any orphan labels (peer is no longer
-   * authorised). When the authority node is unreachable, degrades to the
+   * authorised). When the owner node is unreachable, degrades to the
    * local labels file so listing keeps working while the node is down.
    */
   async list(): Promise<TrustCircleSnapshot> {
@@ -260,7 +260,7 @@ export class TrustCircleService {
     try {
       controlMembers = await this.cadreNode.listMembers();
     } catch (err) {
-      if (!(err instanceof AuthorityNodeUnavailableError)) throw err;
+      if (!(err instanceof OwnerNodeUnavailableError)) throw err;
       controlMembers = null;
     }
 
@@ -306,8 +306,8 @@ export class TrustCircleService {
    * `never` so callers can `.catch(err => this.toDomainError(err))`.
    */
   private toDomainError(err: unknown): never {
-    if (err instanceof AuthorityNodeUnavailableError) {
-      throw new TrustCircleError('node_unavailable', `Authority node unavailable: ${err.message}`);
+    if (err instanceof OwnerNodeUnavailableError) {
+      throw new TrustCircleError('node_unavailable', `Owner node unavailable: ${err.message}`);
     }
     throw err instanceof Error ? err : new Error(String(err));
   }

package/src/auth/types.ts

@@ -62,7 +62,7 @@ export interface TrustCircleSnapshot {
  *   - `not_found`   → 404 (unknown token / unknown peer)
  *   - `expired`     → 410 (invite past expiresAt)
  *   - `already_redeemed` → 409 (token was used and is gone)
- *   - `node_unavailable` → 503 (authority node admin channel down/not ready)
+ *   - `node_unavailable` → 503 (owner node admin channel down/not ready)
  *   - default       → 500
  */
 export interface TrustCircleHandlers {
@@ -84,7 +84,7 @@ export type TrustCircleErrorCode =
   | 'invalid_label'
   | 'invalid_token'
   | 'storage_error'
-  /** The authority node's admin channel is unreachable / not ready. */
+  /** The owner node's admin channel is unreachable / not ready. */
   | 'node_unavailable';
 
 /** Typed error carrying a stable `code` for HTTP mapping. */