@serfab/cadre-host 1.13.0 → 1.14.0

package/src/installer/config.ts

@@ -1,175 +1,135 @@
-/**
- * `host.config.json` schema + I/O.
- *
- * This file captures the wizard's output. Subsystems (trust-circle, NAT,
- * orchestrator) each own their own files under `<dataDir>/`; this is NOT
- * an umbrella config.
- *
- * Schema version: 2. `version` is a forward guard — a file whose version
- * does not match `CURRENT_VERSION` is rejected on read rather than
- * reinterpreted, so a future incompatible layout fails loudly instead of
- * being silently misread.
- */
-
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-
-export interface UpdatesConfig {
-  /** When true, the daily-check timer auto-applies updates. Default false. */
-  autoApply: boolean;
-  /** Optional override for the manifest URL (env var still wins). */
-  manifestUrl?: string;
-}
-
-/**
- * Whether this host also runs its own personal cadre (the opt-in "founder"
- * persona), on top of the always-on node-donor role.
- *
- * Default (absent or `enabled: false`) is donor-only: `cadre-host start` brings
- * up the donation surface but spawns **no** owner node, so the trust-circle and
- * NAT surfaces stay inactive. Set `enabled: true` (install-time choice) to also
- * spawn the host's own owner node and enable `/auth` + `/nat`. See
- * docs/cadre-host.md § Two roles: donor and founder.
- */
-export interface OwnCadreConfig {
-  /** When true, `start` spawns the host-owned owner node + trust-circle + NAT. */
-  enabled: boolean;
-}
-
-/**
- * Non-secret push (FCM/APNs) settings. The actual private keys (and the FCM
- * service-account / APNs key identifiers) live in the secret store — see
- * `src/push/`. Only these app-config bits, which are safe to keep in plaintext
- * `host.config.json`, are stored here. Absent ⇒ push is not configured.
- */
-export interface PushSettings {
-  /** APNs app-config (the `.p8` private key + key/team ids stay in the secret store). */
-  apns?: {
-    /** App bundle id → APNs `apns-topic` header. */
-    bundleId: string;
-    /** `true` → production APNs host; false/undefined → sandbox (dev/TestFlight). */
-    production?: boolean;
-  };
-  /** Per-(peer,strand) anti-spam cooldown (ms) forwarded into the node's push block. */
-  cooldownMs?: number;
-  /** Per-strand burst-coalescing window (ms) forwarded into the node's push block. */
-  debounceMs?: number;
-}
-
-export interface HostConfigFile {
-  version: 2;
-  /** A stable per-install id; useful for log correlation and the control-network partyId. */
-  installId: string;
-  /** Localhost-only management UI + API listener port. */
-  uiPort: number;
-  /** External cadre libp2p port (NAT will map to this). */
-  libp2pPort: number;
-  /** Self-reference (convenient for service-host ExecStart). */
-  dataDir: string;
-  /** Absolute path to the Ed25519 protobuf identity. */
-  identityPath: string;
-  /** Whether UPnP/NAT-PMP should be attempted at start time. */
-  upnpEnabled: boolean;
-  /** ISO timestamp the wizard wrote this file. */
-  installedAt: string;
-  /** Installer (= package) version that wrote this file. */
-  installerVersion: string;
-  /** Update-flow settings; defaults: { autoApply: false }. */
-  updates: UpdatesConfig;
-  /**
-   * Host-own-cadre (founder persona) opt-in. Optional — absent is treated as
-   * `{ enabled: false }` (donor-only). Written by the installer; read via
-   * `hostOwnsCadre()`. Not editable through /api/settings (install-time only).
-   */
-  ownCadre?: OwnCadreConfig;
-  /**
-   * Non-secret push settings (bundle id, sandbox/prod toggle, cooldown/debounce).
-   * Optional — absent when push is not configured. Private keys never live here;
-   * they are read from the secret store at node-spawn time (`src/push/`).
-   */
-  push?: PushSettings;
-}
-
-/**
- * Whether this host runs its own personal cadre (founder persona). Absent
- * `ownCadre` ⇒ donor-only (false). The single source of truth for the
- * founder/donor gate in `bin/host.ts start`.
- */
-export function hostOwnsCadre(cfg: HostConfigFile): boolean {
-  return cfg.ownCadre?.enabled === true;
-}
-
-const CURRENT_VERSION = 2;
-
-export function writeHostConfig(filePath: string, cfg: HostConfigFile): void {
-  if (cfg.version !== CURRENT_VERSION) {
-    throw new Error(`Refusing to write host.config.json with version=${cfg.version} (current: ${CURRENT_VERSION})`);
-  }
-  mkdirSync(dirname(filePath), { recursive: true });
-  writeFileSync(filePath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
-}
-
-/** Apply a partial patch to the persisted config (read-modify-write). */
-export function updateHostConfig(
-  filePath: string,
-  patch: Partial<Omit<HostConfigFile, 'version'>>,
-): HostConfigFile {
-  const current = readHostConfig(filePath);
-  const next: HostConfigFile = {
-    ...current,
-    ...patch,
-    updates: { ...current.updates, ...(patch.updates ?? {}) },
-    version: CURRENT_VERSION,
-  };
-  writeHostConfig(filePath, next);
-  return next;
-}
-
-export function readHostConfig(filePath: string): HostConfigFile {
-  const raw = readFileSync(filePath, 'utf8');
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`Failed to parse host.config.json at ${filePath}: ${(err as Error).message}`, { cause: err });
-  }
-  if (!parsed || typeof parsed !== 'object') {
-    throw new Error(`host.config.json at ${filePath} is not a JSON object`);
-  }
-  const obj = parsed as Record<string, unknown>;
-  if (obj.version !== CURRENT_VERSION) {
-    throw new Error(
-      `host.config.json at ${filePath} has unsupported version=${obj.version} (this build expects ${CURRENT_VERSION})`,
-    );
-  }
-  if (!isHostConfigShape(obj)) {
-    throw new Error(`host.config.json at ${filePath} is missing required fields`);
-  }
-  return obj;
-}
-
-function isHostConfigShape(v: unknown): v is HostConfigFile {
-  if (!v || typeof v !== 'object') return false;
-  const o = v as Record<string, unknown>;
-  if (
-    typeof o.installId !== 'string' ||
-    typeof o.uiPort !== 'number' ||
-    typeof o.libp2pPort !== 'number' ||
-    typeof o.dataDir !== 'string' ||
-    typeof o.identityPath !== 'string' ||
-    typeof o.upnpEnabled !== 'boolean' ||
-    typeof o.installedAt !== 'string' ||
-    typeof o.installerVersion !== 'string'
-  ) {
-    return false;
-  }
-  const updates = o.updates as Record<string, unknown> | undefined;
-  if (!updates || typeof updates !== 'object') return false;
-  if (typeof updates.autoApply !== 'boolean') return false;
-  if (updates.manifestUrl !== undefined && typeof updates.manifestUrl !== 'string') return false;
-  if (o.ownCadre !== undefined) {
-    const own = o.ownCadre as Record<string, unknown>;
-    if (!own || typeof own !== 'object' || typeof own.enabled !== 'boolean') return false;
-  }
-  return true;
-}
+/**
+ * `host.config.json` schema + I/O.
+ *
+ * This file captures the wizard's output. Subsystems (hosted nodes, NAT,
+ * orchestrator) each own their own files under `<dataDir>/`; this is NOT
+ * an umbrella config.
+ *
+ * Schema version: 3. `version` is a forward guard — a file whose version
+ * does not match `CURRENT_VERSION` is rejected on read rather than
+ * reinterpreted, so a future incompatible layout fails loudly instead of
+ * being silently misread.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+export interface UpdatesConfig {
+  /** When true, the daily-check timer auto-applies updates. Default false. */
+  autoApply: boolean;
+  /** Optional override for the manifest URL (env var still wins). */
+  manifestUrl?: string;
+}
+
+/**
+ * Non-secret push (FCM/APNs) settings. The actual private keys (and the FCM
+ * service-account / APNs key identifiers) live in the secret store — see
+ * `src/push/`. Only these app-config bits, which are safe to keep in plaintext
+ * `host.config.json`, are stored here. Absent ⇒ push is not configured.
+ */
+export interface PushSettings {
+  /** APNs app-config (the `.p8` private key + key/team ids stay in the secret store). */
+  apns?: {
+    /** App bundle id → APNs `apns-topic` header. */
+    bundleId: string;
+    /** `true` → production APNs host; false/undefined → sandbox (dev/TestFlight). */
+    production?: boolean;
+  };
+  /** Per-(peer,strand) anti-spam cooldown (ms) forwarded into the node's push block. */
+  cooldownMs?: number;
+  /** Per-strand burst-coalescing window (ms) forwarded into the node's push block. */
+  debounceMs?: number;
+}
+
+export interface HostConfigFile {
+  version: 3;
+  /** A stable per-install id, for log correlation. */
+  installId: string;
+  /** Localhost-only management UI + API listener port. */
+  uiPort: number;
+  /** Self-reference (convenient for service-host ExecStart). */
+  dataDir: string;
+  /** Whether UPnP/NAT-PMP should be attempted at start time. */
+  upnpEnabled: boolean;
+  /** ISO timestamp the wizard wrote this file. */
+  installedAt: string;
+  /** Installer (= package) version that wrote this file. */
+  installerVersion: string;
+  /** Update-flow settings; defaults: { autoApply: false }. */
+  updates: UpdatesConfig;
+  /**
+   * Non-secret push settings (bundle id, sandbox/prod toggle, cooldown/debounce).
+   * Optional — absent when push is not configured. Private keys never live here;
+   * they are read from the secret store at node-spawn time (`src/push/`).
+   */
+  push?: PushSettings;
+}
+
+const CURRENT_VERSION = 3;
+
+export function writeHostConfig(filePath: string, cfg: HostConfigFile): void {
+  if (cfg.version !== CURRENT_VERSION) {
+    throw new Error(`Refusing to write host.config.json with version=${cfg.version} (current: ${CURRENT_VERSION})`);
+  }
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+}
+
+/** Apply a partial patch to the persisted config (read-modify-write). */
+export function updateHostConfig(
+  filePath: string,
+  patch: Partial<Omit<HostConfigFile, 'version'>>,
+): HostConfigFile {
+  const current = readHostConfig(filePath);
+  const next: HostConfigFile = {
+    ...current,
+    ...patch,
+    updates: { ...current.updates, ...(patch.updates ?? {}) },
+    version: CURRENT_VERSION,
+  };
+  writeHostConfig(filePath, next);
+  return next;
+}
+
+export function readHostConfig(filePath: string): HostConfigFile {
+  const raw = readFileSync(filePath, 'utf8');
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Failed to parse host.config.json at ${filePath}: ${(err as Error).message}`, { cause: err });
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error(`host.config.json at ${filePath} is not a JSON object`);
+  }
+  const obj = parsed as Record<string, unknown>;
+  if (obj.version !== CURRENT_VERSION) {
+    throw new Error(
+      `host.config.json at ${filePath} has unsupported version=${obj.version} (this build expects ${CURRENT_VERSION})`,
+    );
+  }
+  if (!isHostConfigShape(obj)) {
+    throw new Error(`host.config.json at ${filePath} is missing required fields`);
+  }
+  return obj;
+}
+
+function isHostConfigShape(v: unknown): v is HostConfigFile {
+  if (!v || typeof v !== 'object') return false;
+  const o = v as Record<string, unknown>;
+  if (
+    typeof o.installId !== 'string' ||
+    typeof o.uiPort !== 'number' ||
+    typeof o.dataDir !== 'string' ||
+    typeof o.upnpEnabled !== 'boolean' ||
+    typeof o.installedAt !== 'string' ||
+    typeof o.installerVersion !== 'string'
+  ) {
+    return false;
+  }
+  const updates = o.updates as Record<string, unknown> | undefined;
+  if (!updates || typeof updates !== 'object') return false;
+  if (typeof updates.autoApply !== 'boolean') return false;
+  if (updates.manifestUrl !== undefined && typeof updates.manifestUrl !== 'string') return false;
+  return true;
+}

package/src/installer/index.ts

@@ -5,8 +5,8 @@
  * `tickets/implement/6.4.1-cadre-host-installer.md`.
  *
  * The class is purposefully thin — heavy lifting lives in the focused
- * subsystem modules (wizard.ts, identity.ts, config.ts,
- * service-host/{systemd,launchd,nssm}.ts, browser.ts).
+ * subsystem modules (wizard.ts, config.ts, service-host/{systemd,launchd,nssm}.ts,
+ * browser.ts).
  */
 
 import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
@@ -17,12 +17,10 @@ import { NatStore } from '../nat/index.js';
 
 import { openBrowser } from './browser.js';
 import { writeHostConfig, type HostConfigFile } from './config.js';
-import { generateIdentity } from './identity.js';
 import {
   configPath,
   defaultHostJs,
   defaultServiceDir,
-  identityPath,
   logsDir,
 } from './paths.js';
 import {
@@ -35,7 +33,6 @@ import {
   runWizard,
   runWizardWith,
   DEFAULT_UI_PORT,
-  DEFAULT_LIBP2P_PORT,
   type WizardAnswers,
   type WizardDefaults,
 } from './wizard.js';
@@ -54,25 +51,18 @@ export interface InstallOptions {
   dataDir?: string;
   /** Override the UI port. */
   uiPort?: number;
-  /** Override the libp2p port. */
-  libp2pPort?: number;
   /** Disable UPnP probing on first run. */
   noUpnp?: boolean;
-  /** Also run the host's own personal cadre here (founder persona). Default false. */
-  ownCadre?: boolean;
   /** Open browser at end (default true; suppressed by --no-browser or non-TTY). */
   openBrowser?: boolean;
-  /** Skip the enrollment-invite step (no QR printed). */
-  noInvite?: boolean;
   /** System-wide install — v1 emits a not-yet-supported error. */
   system?: boolean;
   /** Path to node.exe / node binary used by the service-host unit. */
   nodePath?: string;
   /**
-   * Write the data dir (identity, config, NAT seed) but register no OS service.
+   * Write the data dir (config, NAT seed) but register no OS service.
    * The host is then run by hand with `cadre-host start`. Nothing is listening
-   * after such an install, so the browser-open and enrollment-invite steps are
-   * skipped too.
+   * after such an install, so the browser-open step is skipped too.
    */
   noService?: boolean;
   /** Test-only: stub the service-host registration. */
@@ -88,15 +78,10 @@ export interface InstallResult {
   serviceName?: string;
   /** Path to the rendered config file. */
   configPath: string;
-  /** Generated enrollment invite, unless --no-invite. */
-  enrollmentInvite?: {
-    encodedInvite: string;
-    expiresAt?: string;
-  };
 }
 
 export interface UninstallOptions {
-  /** Also remove the data dir (default false — preserve trust circle + identity). */
+  /** Also remove the data dir (default false — preserve hosted-node records, node identities and NAT state). */
   removeData: boolean;
   /** Skip the confirmation prompt (for scripts). */
   yes: boolean;
@@ -136,40 +121,30 @@ export class Installer {
     mkdirSync(answers.dataDir, { recursive: true });
     mkdirSync(logsDir(answers.dataDir), { recursive: true });
 
-    // 3. Identity + config. Don't overwrite an existing key — re-running
-    //    install on a populated data dir must preserve the host's peer ID.
-    const idPath = identityPath(answers.dataDir);
-    if (existsSync(idPath)) {
-      log('identity already exists at %s — leaving it', idPath);
-    } else {
-      await generateIdentity(idPath);
-    }
-
+    // 3. Config.
     const cfg: HostConfigFile = {
-      version: 2,
+      version: 3,
       installId: randomInstallId(),
       uiPort: answers.uiPort,
-      libp2pPort: answers.libp2pPort,
       dataDir: answers.dataDir,
-      identityPath: idPath,
       upnpEnabled: answers.upnpEnabled,
       installedAt: new Date().toISOString(),
       installerVersion: this.installerVersion,
       updates: { autoApply: false },
-      ownCadre: { enabled: answers.ownCadre },
     };
     const cfgPath = configPath(answers.dataDir);
     writeHostConfig(cfgPath, cfg);
 
-    // 4. Seed nat.json with the chosen libp2p port + UPnP flag so the
-    //    NatService picks them up on first start.
-    seedNatSettings(answers.dataDir, answers.libp2pPort, answers.upnpEnabled);
+    // 4. Seed nat.json with the UPnP flag so the NatService picks it up on
+    //    first start. Ports are not seeded: the service maps every hosted
+    //    node's ports from the orchestrator's allocations.
+    seedNatSettings(answers.dataDir, answers.upnpEnabled);
 
     const uiUrl = `http://127.0.0.1:${answers.uiPort}/`;
 
     // 5. Service-host registration.
     if (opts.noService) {
-      log('--no-service: skipping service registration, browser open and enrollment invite');
+      log('--no-service: skipping service registration and browser open');
       return { dataDir: answers.dataDir, uiUrl, configPath: cfgPath };
     }
     const serviceHost = opts.serviceHost ?? createServiceHost(this.platform);
@@ -187,21 +162,11 @@ export class Installer {
       openBrowser(uiUrl);
     }
 
-    // 7. Enrollment invite (best-effort — the listener may not be up yet).
-    let invite: InstallResult['enrollmentInvite'];
-    if (!opts.noInvite && !opts.nonInteractive) {
-      invite = await fetchEnrollmentInvite(answers.uiPort).catch((err) => {
-        log('enrollment-invite fetch failed: %s', (err as Error).message);
-        return undefined;
-      });
-    }
-
     return {
       dataDir: answers.dataDir,
       uiUrl,
       serviceName: serviceHost.name,
       configPath: cfgPath,
-      ...(invite ? { enrollmentInvite: invite } : {}),
     };
   }
 
@@ -241,10 +206,8 @@ export class Installer {
     return {
       dataDir: opts.dataDir ?? defaults.dataDir,
       uiPort: opts.uiPort ?? defaults.uiPort,
-      libp2pPort: opts.libp2pPort ?? defaults.libp2pPort,
       upnpEnabled: opts.noUpnp ? false : defaults.upnpEnabled,
       configureDdns: false,
-      ownCadre: opts.ownCadre ?? defaults.ownCadre,
     };
   }
 
@@ -261,25 +224,19 @@ export class Installer {
     const defaults: WizardDefaults = {
       dataDir: opts.dataDir ?? platformDefaults.dataDir,
       uiPort: opts.uiPort ?? platformDefaults.uiPort,
-      libp2pPort: opts.libp2pPort ?? platformDefaults.libp2pPort,
       upnpEnabled: opts.noUpnp ? false : platformDefaults.upnpEnabled,
-      ownCadre: opts.ownCadre ?? platformDefaults.ownCadre,
     };
     const wizard = opts.wizard ?? runWizard;
     return await wizard(defaults);
   }
 }
 
-export { runWizardWith, defaultsForPlatform, DEFAULT_UI_PORT, DEFAULT_LIBP2P_PORT };
+export { runWizardWith, defaultsForPlatform, DEFAULT_UI_PORT };
 
-function seedNatSettings(dataDir: string, libp2pPort: number, upnpEnabled: boolean): void {
+function seedNatSettings(dataDir: string, upnpEnabled: boolean): void {
   const store = new NatStore(dataDir);
   // `update()` merges + persists.
-  store.update({
-    externalPort: libp2pPort,
-    internalPort: libp2pPort,
-    upnpEnabled,
-  });
+  store.update({ upnpEnabled });
 }
 
 function randomInstallId(): string {
@@ -298,30 +255,5 @@ function readPackageVersion(): string {
   }
 }
 
-async function fetchEnrollmentInvite(uiPort: number): Promise<InstallResult['enrollmentInvite']> {
-  const url = `http://127.0.0.1:${uiPort}/auth/invites`;
-  // Node 18+'s fetch has no default timeout. Bound it so a slow / hung
-  // local-UI listener can't wedge `cadre-host install` indefinitely.
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 5000);
-  try {
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ label: 'Install — first device', ttlMs: 24 * 60 * 60 * 1000 }),
-      signal: controller.signal,
-    });
-    if (!response.ok) return undefined;
-    const body = await response.json() as { encodedInvite?: string; expiresAt?: string };
-    if (!body.encodedInvite) return undefined;
-    return {
-      encodedInvite: body.encodedInvite,
-      ...(body.expiresAt ? { expiresAt: body.expiresAt } : {}),
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 // Exposed for tests that drive the wizard with a custom prompt fn.
 export { runWizard };