@serfab/cadre-host 1.13.0 → 1.14.0

package/dist/auth/trust-circle.js

@@ -1,307 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import debug from 'debug';
-import { OwnerNodeUnavailableError } from '../owner/owner-node-client.js';
-import { TrustCircleError } from './types.js';
-const log = debug('cadre:host:trust-circle');
-/** Default invite lifetime: 24 hours. */
-export const DEFAULT_INVITE_TTL_MS = 24 * 60 * 60 * 1000;
-/** Token byte length (base64url-encoded; ~43 chars). */
-const TOKEN_BYTES = 32;
-/**
- * TrustCircleService — orchestrates invite issuance, redemption, and
- * membership management.
- *
- * Membership is canonical in the cadre control DB (`CadrePeer` table),
- * reached over the owner node's admin channel; labels and pending tokens
- * live in the host-local `TrustCircleStore`. When the node is unreachable,
- * owner operations surface `node_unavailable` (→ 503) and `list()`
- * degrades to the local labels file.
- */
-export class TrustCircleService {
-    constructor(opts) {
-        /**
-         * In-flight redemption claims (by token). Serialises concurrent redeems
-         * for the same token without burning the durable pending row before
-         * `acceptPhone` succeeds. Intra-process only — the orchestrator enforces
-         * single-process ownership of a given rootDir, so no file lock is needed.
-         */
-        this.inFlightRedemptions = new Set();
-        this.cadreNode = opts.cadreNode;
-        this.store = opts.store;
-        this.now = opts.now ?? (() => new Date());
-    }
-    /**
-     * Issue a new invite. Generates a token, persists a pending row, and
-     * delegates to cadre-core to embed the host's owner addresses.
-     */
-    async issueInvite(opts) {
-        const label = normaliseLabel(opts.label);
-        const ttlMs = opts.ttlMs ?? DEFAULT_INVITE_TTL_MS;
-        if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
-            throw new TrustCircleError('invalid_token', `Invalid ttlMs: ${ttlMs}`);
-        }
-        const token = generateToken();
-        const created = this.now();
-        const expiresAt = new Date(created.getTime() + ttlMs);
-        const { invite, encodedInvite } = await this.cadreNode
-            .createInvite(token, ttlMs)
-            .catch((err) => this.toDomainError(err));
-        const pending = {
-            token,
-            label,
-            createdAt: created.toISOString(),
-            expiresAt: expiresAt.toISOString(),
-        };
-        this.store.addPending(pending);
-        log('issued invite for "%s" (token=%s, expires=%s)', label, token, expiresAt.toISOString());
-        return { encodedInvite, invite, token, expiresAt };
-    }
-    /**
-     * Redeem an invite for an incoming peer ID. On success:
-     *   - cadre-core authorizes the peer (inserts CadrePeer row).
-     *   - The pending row is consumed (one-time enforcement).
-     *   - A labelled member row is written locally.
-     *
-     * Ordering: the synchronous *claim* against `inFlightRedemptions` serialises
-     * concurrent redeems for the same token (second concurrent caller rejects
-     * synchronously before its first await). The durable `removePending` only
-     * runs *after* `acceptPhone` succeeds — so a transient `node_unavailable`
-     * leaves the token re-redeemable rather than permanently burning it.
-     *
-     * Crash-safety tradeoff: if the host crashes between `acceptPhone` success
-     * and the durable `removePending`, a retry will dial in fine but the
-     * owner node's `acceptPhone` will reject the second `CadrePeer` insert
-     * with a PK constraint error (cadre-core does not upsert). That surfaces to
-     * the redeemer as a non-`node_unavailable` failure; the admin can revoke
-     * the lingering pending row. This is a narrower window than the prior
-     * behaviour, where *any* transient node outage burned the token.
-     */
-    async redeemInvite(opts) {
-        const { token, peerId } = opts;
-        if (!token || !peerId) {
-            throw new TrustCircleError('invalid_token', 'token and peerId are required');
-        }
-        const pending = this.store.getPending(token);
-        if (!pending) {
-            throw new TrustCircleError('already_redeemed', 'Invite not found or already redeemed');
-        }
-        if (pending.expiresAt) {
-            const expiresAt = new Date(pending.expiresAt);
-            if (Number.isFinite(expiresAt.getTime()) && this.now() > expiresAt) {
-                // Expiry is permanent — reap the pending row durably.
-                this.store.removePending(token);
-                throw new TrustCircleError('expired', 'Invite has expired');
-            }
-        }
-        // Synchronous in-memory claim. Closes the race between two concurrent
-        // redemption requests for the same token — the loser sees the token in
-        // the set and rejects synchronously before its first `await`.
-        if (this.inFlightRedemptions.has(token)) {
-            throw new TrustCircleError('already_redeemed', 'Invite not found or already redeemed');
-        }
-        this.inFlightRedemptions.add(token);
-        try {
-            // Reconstruct the CadreInvite that was originally issued. cadre-core's
-            // acceptPhone validates `issuedInvite.token === options.token` (already
-            // matches by construction) and re-checks expiration.
-            const reconstructed = {
-                partyId: '',
-                ownerAddrs: [],
-                token: pending.token,
-                createdAt: new Date(pending.createdAt).getTime(),
-                ...(pending.expiresAt ? { expiresAt: new Date(pending.expiresAt).getTime() } : {}),
-            };
-            await this.cadreNode
-                .acceptPhone({ phonePeerId: peerId, token }, reconstructed)
-                .catch((err) => this.toDomainError(err));
-            // acceptPhone succeeded → durably consume the pending row. If we crash
-            // between here and the next line, the token stays pending (re-redeem
-            // would fail at acceptPhone with a duplicate-CadrePeer error, not
-            // node_unavailable, and the admin can revoke).
-            this.store.removePending(token);
-            // If the member write fails the peer is still authorized in CadrePeer —
-            // the next call to list() will pick it up unlabeled, which is the
-            // documented graceful degradation.
-            const member = {
-                peerId,
-                label: pending.label,
-                addedAt: this.now().toISOString(),
-            };
-            this.store.addMember(member);
-            log('redeemed invite for "%s" (peerId=%s, token=%s)', pending.label, peerId, token);
-            return { peerId, label: pending.label };
-        }
-        finally {
-            this.inFlightRedemptions.delete(token);
-        }
-    }
-    /** Revoke a pending invite by token. No-op if not found. */
-    async revokePending(token) {
-        if (!this.store.removePending(token)) {
-            throw new TrustCircleError('not_found', `Unknown pending invite: ${token}`);
-        }
-        log('revoked pending invite (token=%s)', token);
-    }
-    /**
-     * Remove an authorised member. Deletes the CadrePeer row and the local
-     * label. Throws not_found when the peer is in neither place.
-     *
-     * NOTE: no special case for the host's own peer ID — the local UI hides the
-     * Remove button on the `self` row, but `DELETE /auth/members/<ownPeerId>`
-     * (or `cadre-host trust revoke <ownPeerId>`) will delete the node's own
-     * `CadrePeer` row. cadre-core re-registers self on node start, so a restart
-     * heals it. If that stops being true, or the removal path grows a
-     * non-loopback caller, guard `self` rows here.
-     */
-    async removeMember(peerId) {
-        const inLocal = this.store.getMember(peerId);
-        const inControl = await this.isMember(peerId);
-        if (!inLocal && !inControl) {
-            throw new TrustCircleError('not_found', `Unknown member: ${peerId}`);
-        }
-        if (inControl) {
-            await this.cadreNode.removePeer(peerId).catch((err) => this.toDomainError(err));
-        }
-        if (inLocal) {
-            this.store.removeMember(peerId);
-        }
-        log('removed member peerId=%s', peerId);
-    }
-    /** Whether the peer is present in the cadre's CadrePeer table. */
-    async isMember(peerId) {
-        try {
-            return await this.cadreNode.isMember(peerId);
-        }
-        catch (err) {
-            this.toDomainError(err);
-        }
-    }
-    /**
-     * UI snapshot. Joins the *authorized* membership (fetched over the admin
-     * channel) with local labels; prunes any orphan labels (peer is no longer
-     * authorised). Addressable-but-unauthorized peers — devices that merely
-     * published an address record without an owner voucher — are deliberately
-     * excluded; this is the listing an operator uses to decide who belongs.
-     * The node's own self-published row is spliced back in from the local
-     * label, since the authorized set excludes self by design. When the owner
-     * node is unreachable, degrades to the local labels file so listing keeps
-     * working while the node is down.
-     */
-    async list() {
-        const labels = new Map();
-        for (const m of this.store.listMembers()) {
-            labels.set(m.peerId, { label: m.label, addedAt: m.addedAt, ...(m.self ? { self: true } : {}) });
-        }
-        const members = [];
-        // Consult the control DB over the admin channel. A node-unavailable error
-        // is non-fatal — fall back to the local labels rather than 503-ing a
-        // read-only listing.
-        let authorizedMembers;
-        try {
-            authorizedMembers = await this.cadreNode.listAuthorizedMembers();
-        }
-        catch (err) {
-            if (!(err instanceof OwnerNodeUnavailableError))
-                throw err;
-            authorizedMembers = null;
-        }
-        if (authorizedMembers) {
-            const seenPeerIds = new Set();
-            for (const { peerId } of authorizedMembers) {
-                seenPeerIds.add(peerId);
-                const label = labels.get(peerId);
-                members.push({
-                    peerId,
-                    label: label?.label ?? peerId,
-                    addedAt: label?.addedAt ?? '',
-                    ...(label?.self ? { self: true } : {}),
-                });
-            }
-            // The authorized set excludes the node's own self-published row —
-            // splice it back in from the local label rather than dropping it.
-            for (const [peerId, row] of labels) {
-                if (row.self && !seenPeerIds.has(peerId)) {
-                    seenPeerIds.add(peerId);
-                    members.push({ peerId, ...row });
-                }
-            }
-            // Prune labels for peers that are neither authorized nor self. Only
-            // when we successfully consulted the node — otherwise a transient
-            // outage would wipe labels.
-            for (const peerId of labels.keys()) {
-                if (!seenPeerIds.has(peerId)) {
-                    this.store.removeMember(peerId);
-                }
-            }
-        }
-        else {
-            // Node down: return labels as-is (degradation; no pruning).
-            for (const [peerId, row] of labels) {
-                members.push({ peerId, ...row });
-            }
-        }
-        const pending = this.store.listPending();
-        // Sort for stable UI ordering.
-        members.sort((a, b) => a.peerId.localeCompare(b.peerId));
-        pending.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-        return { members, pending };
-    }
-    /**
-     * Translate an admin-channel transport failure into a `node_unavailable`
-     * TrustCircleError (→ 503). Re-throws anything else unchanged. Returns
-     * `never` so callers can `.catch(err => this.toDomainError(err))`.
-     */
-    toDomainError(err) {
-        if (err instanceof OwnerNodeUnavailableError) {
-            throw new TrustCircleError('node_unavailable', `Owner node unavailable: ${err.message}`);
-        }
-        throw err instanceof Error ? err : new Error(String(err));
-    }
-}
-/**
- * Wrap a TrustCircleService into the typed handler shape consumed by
- * `cadre-host-local-ui`. Errors propagate as TrustCircleError; the UI ticket
- * maps `.code` → HTTP status.
- */
-export function createTrustCircleHandlers(service) {
-    return {
-        async postInvite(body) {
-            if (!body || typeof body.label !== 'string') {
-                throw new TrustCircleError('invalid_label', 'label is required');
-            }
-            const result = await service.issueInvite({ label: body.label, ttlMs: body.ttlMs });
-            return {
-                encodedInvite: result.encodedInvite,
-                token: result.token,
-                ...(result.expiresAt ? { expiresAt: result.expiresAt.toISOString() } : {}),
-            };
-        },
-        async deleteInvite(token) {
-            await service.revokePending(token);
-        },
-        async deleteMember(peerId) {
-            await service.removeMember(peerId);
-        },
-        async listTrustCircle() {
-            return await service.list();
-        },
-    };
-}
-function generateToken() {
-    // base64url so it survives in URLs, QR codes, and shell arguments.
-    return randomBytes(TOKEN_BYTES).toString('base64url');
-}
-function normaliseLabel(label) {
-    if (typeof label !== 'string') {
-        throw new TrustCircleError('invalid_label', 'label must be a string');
-    }
-    const trimmed = label.trim();
-    if (trimmed.length === 0) {
-        throw new TrustCircleError('invalid_label', 'label must not be empty');
-    }
-    if (trimmed.length > 200) {
-        throw new TrustCircleError('invalid_label', 'label must be 200 characters or fewer');
-    }
-    return trimmed;
-}
-//# sourceMappingURL=trust-circle.js.map

package/dist/auth/trust-circle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-circle.js","sourceRoot":"","sources":["../../src/auth/trust-circle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAS1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,GAAG,EAAE,CAAC;AAwCvB;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAY7B,YAAY,IAA+B;QAR3C;;;;;WAKG;QACc,wBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAGvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAuC;QAMvD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;QAEtD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS;aACnD,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;aAC1B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAkB;YAC7B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE/B,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,YAAY,CAAC,IAAuC;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBACnE,sDAAsD;gBACtD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,uEAAuE;YACvE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,aAAa,GAAgB;gBACjC,OAAO,EAAE,EAAE;gBACX,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAChD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;YAEF,MAAM,IAAI,CAAC,SAAS;iBACjB,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,CAAC;iBAC1D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YAE3C,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAEhC,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,MAAM,MAAM,GAAsB;gBAChC,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAE7B,GAAG,CAAC,gDAAgD,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAEpF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,0EAA0E;QAC1E,qEAAqE;QACrE,qBAAqB;QACrB,IAAI,iBAAmD,CAAC;QACxD,IAAI,CAAC;YACH,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,yBAAyB,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC3D,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBAC3C,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM;oBACN,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,MAAM;oBAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE;oBAC7B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACxB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,kEAAkE;YAClE,4BAA4B;YAC5B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEzC,+BAA+B;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,GAAY;QAChC,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA2B;IACnE,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO;gBACL,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,mEAAmE;IACnE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth/types.d.ts

@@ -1,84 +0,0 @@
-/**
- * Trust-circle types for cadre-host.
- *
- * The trust circle is the set of devices (peers) authorised to participate
- * in the host's cadre. Membership is stored canonically in the cadre control
- * network's `CadrePeer` table (via cadre-core). This module layers two pieces
- * of *host-local* state on top:
- *
- *   - **Labels**: human-readable names ("Mom's phone") assigned by the host
- *     admin. Display-only; loss just shows the bare peer ID.
- *   - **Pending invites**: tokens that have been issued but not yet redeemed.
- *     Operational state — lives on the issuing node, doesn't replicate.
- *
- * Both live in `<rootDir>/trust-circle.json`, written atomically.
- */
-/** An authorised member of the trust circle (matches a `CadrePeer` row). */
-export interface TrustCircleMember {
-    /** libp2p peer ID. */
-    peerId: string;
-    /** Display label assigned by the host admin. */
-    label: string;
-    /** ISO timestamp when the peer was added. */
-    addedAt: string;
-    /** True if this row represents the host's own cadre node (self-enrolment). */
-    self?: boolean;
-}
-/** An invite that has been issued but not yet redeemed. */
-export interface PendingInvite {
-    /** Random token (base64url) used to match the redemption. */
-    token: string;
-    /** Display label that will be assigned to the redeemer on success. */
-    label: string;
-    /** ISO timestamp when the invite was issued. */
-    createdAt: string;
-    /** Optional ISO expiration timestamp. */
-    expiresAt?: string;
-}
-/** On-disk shape of `trust-circle.json`. */
-export interface TrustCircleFile {
-    version: 1;
-    /** keyed by peer ID. */
-    members: Record<string, Omit<TrustCircleMember, 'peerId'>>;
-    /** keyed by token. */
-    pendingInvites: Record<string, Omit<PendingInvite, 'token'>>;
-}
-/** Snapshot returned to the management UI. */
-export interface TrustCircleSnapshot {
-    members: TrustCircleMember[];
-    pending: PendingInvite[];
-}
-/**
- * Typed HTTP handlers exposed to `cadre-host-local-ui` for Fastify wiring.
- *
- * Handlers take typed objects and either return typed results or throw a
- * `TrustCircleError` whose `.code` the UI ticket maps to an HTTP status:
- *
- *   - `not_found`   → 404 (unknown token / unknown peer)
- *   - `expired`     → 410 (invite past expiresAt)
- *   - `already_redeemed` → 409 (token was used and is gone)
- *   - `node_unavailable` → 503 (owner node admin channel down/not ready)
- *   - default       → 500
- */
-export interface TrustCircleHandlers {
-    postInvite(body: {
-        label: string;
-        ttlMs?: number;
-    }): Promise<{
-        encodedInvite: string;
-        token: string;
-        expiresAt?: string;
-    }>;
-    deleteInvite(token: string): Promise<void>;
-    deleteMember(peerId: string): Promise<void>;
-    listTrustCircle(): Promise<TrustCircleSnapshot>;
-}
-/** Error codes thrown by TrustCircleService. */
-export type TrustCircleErrorCode = 'not_found' | 'expired' | 'already_redeemed' | 'invalid_label' | 'invalid_token' | 'storage_error'
-/** The owner node's admin channel is unreachable / not ready. */
- | 'node_unavailable';
-/** Typed error carrying a stable `code` for HTTP mapping. */
-export declare class TrustCircleError extends Error {
-    readonly code: TrustCircleErrorCode;
-    constructor(code: TrustCircleErrorCode, message: string);
-}

package/dist/auth/types.js

@@ -1,24 +0,0 @@
-/**
- * Trust-circle types for cadre-host.
- *
- * The trust circle is the set of devices (peers) authorised to participate
- * in the host's cadre. Membership is stored canonically in the cadre control
- * network's `CadrePeer` table (via cadre-core). This module layers two pieces
- * of *host-local* state on top:
- *
- *   - **Labels**: human-readable names ("Mom's phone") assigned by the host
- *     admin. Display-only; loss just shows the bare peer ID.
- *   - **Pending invites**: tokens that have been issued but not yet redeemed.
- *     Operational state — lives on the issuing node, doesn't replicate.
- *
- * Both live in `<rootDir>/trust-circle.json`, written atomically.
- */
-/** Typed error carrying a stable `code` for HTTP mapping. */
-export class TrustCircleError extends Error {
-    constructor(code, message) {
-        super(message);
-        this.name = 'TrustCircleError';
-        this.code = code;
-    }
-}
-//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2EH,6DAA6D;AAC7D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAGzC,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}