@serfab/cadre-host 1.13.0 → 1.14.0

package/dist/donation/types.d.ts

@@ -1,224 +0,0 @@
-/**
- * Donation grant-token types for cadre-host.
- *
- * A **grant token** is a high-entropy base64url secret the host admin issues,
- * out-of-band (QR / copy-paste), to one *grantee* — a friend or family member
- * whose cadre authority (their phone) may then ask this host to spawn donated
- * nodes. The grantee presents the token as `Authorization: Bearer <grant-token>`
- * on every donation request (the grantee-facing surface lands in the
- * `2-donation-service` ticket).
- *
- * This module owns the grant's identity, expiry, and per-grantee quota. The
- * *live-node tally* it checks the quota against is owned by the donation
- * service, not by the grant layer — see `GrantValidator.validateForProvision`.
- *
- * **Grant ≠ trust-circle membership.** A trust-circle invite (`auth/`)
- * authorises a device to join *the host's own* cadre. A donation grant
- * authorises an external cadre authority to ask the host to spawn a node that
- * joins *the grantee's* cadre. The two token flows are deliberately separate
- * modules; this one reuses the *shape* of the trust-circle store (atomic
- * write-then-rename JSON, token-keyed rows) but with grant — not invite —
- * semantics: a grant is long-lived and reusable up to a quota, never
- * one-time-redeemed.
- */
-/** A grant the host admin issued to one grantee (friend/family). */
-export interface Grant {
-    /** base64url secret; also the bearer credential. The store key. */
-    token: string;
-    /** Human label chosen by the admin, e.g. "Alice's cadre". Display-only. */
-    label: string;
-    /** Max concurrently-live donated nodes this grant may hold. */
-    maxNodes: number;
-    /** ISO timestamp when the grant was issued. */
-    createdAt: string;
-    /** ISO expiry; absent = no expiry. */
-    expiresAt?: string;
-    /** Set when the admin revokes; a revoked grant validates as denied. */
-    revokedAt?: string;
-}
-/** One grant as the admin list reports it: the grant plus what is running under it. */
-export interface GrantListing extends Grant {
-    /** Donations counting against `maxNodes` (provisioning / awaiting_seed / seeded). */
-    liveNodes: number;
-    /** Every donation under this grant that is not `terminated` — what revoke would tear down. */
-    donations: Array<{
-        id: string;
-        status: DonationStatus;
-    }>;
-}
-/** Why a presented grant token was denied. */
-export type GrantDenyReason = 'unknown_token' | 'expired' | 'revoked' | 'quota_exceeded';
-/** Result of validating a presented bearer token. */
-export interface GrantValidation {
-    ok: boolean;
-    /** The matched grant, when the token names one (present even on some denials). */
-    grant?: Grant;
-    /** Set when `ok` is false. */
-    reason?: GrantDenyReason;
-}
-/**
- * The slice `2-donation-service` depends on. Keeps that ticket decoupled from
- * the store implementation: it holds a `GrantValidator`, not a `GrantStore`.
- *
- * Both methods are pure functions of the store state (and, for provision, the
- * caller-supplied count) — they never throw for a bad token, they return a
- * denial. Issuance/revocation (which mutate) live on `GrantService`.
- */
-export interface GrantValidator {
-    /**
-     * Validate a presented bearer token for a *new* provision request.
-     *
-     * `liveNodeCount(token)` is supplied by the donation service — the grant
-     * layer owns identity/expiry/revocation; the donation service owns the
-     * authoritative live-node tally (it holds the grant→node records). The count
-     * is only consulted once identity/expiry/revocation have passed, so an
-     * unknown or dead token never invokes it.
-     */
-    validateForProvision(token: string, liveNodeCount: (token: string) => number): GrantValidation;
-    /**
-     * Validate for a non-provisioning op (peer/seed/terminate): identity + not
-     * expired/revoked. No quota check.
-     */
-    validate(token: string): GrantValidation;
-}
-/** On-disk shape of `grants.json`. */
-export interface GrantFile {
-    version: 1;
-    /** keyed by token. */
-    grants: Record<string, Omit<Grant, 'token'>>;
-}
-/**
- * Typed handlers exposed to the loopback management server for the **admin**
- * grant surface (`/grants-admin`). Distinct from the grantee-facing `/grants`
- * provisioning surface: the admin surface is loopback, no bearer — same-machine
- * admin, matching cadre-host's local-UI "no login" posture.
- *
- * Handlers throw a `GrantError` (or, for donation teardown, a `DonationError`)
- * whose `.code` the server maps to an HTTP status (see `server/error-handler.ts`).
- */
-export interface GrantAdminHandlers {
-    postGrant(body: {
-        label: string;
-        maxNodes?: number;
-        ttlMs?: number;
-    }): Promise<{
-        grant: Grant;
-    }>;
-    listGrants(): Promise<{
-        grants: GrantListing[];
-    }>;
-    /**
-     * Revoke a grant and, unless `keepNodes`, terminate every donated node under
-     * it. Resolves with the ids of the donations terminated.
-     */
-    deleteGrant(token: string, opts: {
-        keepNodes: boolean;
-    }): Promise<{
-        terminated: string[];
-    }>;
-    /**
-     * Terminate one donated node by id, whatever state its grant is in. Absent
-     * when no donation service is wired — there are then no donated nodes to end.
-     */
-    terminateDonation?(id: string): Promise<void>;
-}
-/**
- * Lifecycle of one donated node:
- *   provisioning  → the child process is being spawned.
- *   awaiting_seed → spawned + reachable; waiting for the requester to present
- *                   its phone-signed seed (`PUT /grants/:id/seed`).
- *   seeded        → the seed was applied; the node has joined the requester's cadre.
- *   error         → provisioning failed (orchestrator resources reclaimed).
- *   terminated    → stopped + removed (kept in the store for audit).
- *
- * A donation is "live" (counts against a grant's `maxNodes` quota) while it is
- * `provisioning`, `awaiting_seed`, or `seeded` — see `DonationStore.liveNodeCount`.
- */
-export type DonationStatus = 'provisioning' | 'awaiting_seed' | 'seeded' | 'error' | 'terminated';
-/**
- * One donated node, tracked host-side and persisted to `donations.json`.
- *
- * The host contributes capacity only: `partyId` is the REQUESTER's cadre (a
- * foreign party), and `seedToken` gates the node's own `POST /seed` — it is
- * minted host-side, persisted here (so a host restart in the request→seed gap
- * can still present the seed), and NEVER returned to the grantee.
- *
- * The record also carries every input the original spawn consumed
- * (`partyId` + `profile` + `bootstrapNodes` + `ownerKeys`), so a crashed node can
- * be re-spawned from the record alone — see `DonationService.respawn`. Records
- * written before those two fields existed have neither; such a record is NOT
- * respawnable and is skipped (never crashes a sweep).
- */
-export interface Donation {
-    /** "grn_<nanoid>" — also the donated node's orchestrator containerId. */
-    id: string;
-    /** The grant token that authorized this donation (the quota key). */
-    grantToken: string;
-    /** The REQUESTER's cadre (a foreign party this host merely hosts a node for). */
-    partyId: string;
-    /**
-     * Requester control-network bootstrap multiaddrs — replayed on respawn. Empty when
-     * the requester dials the node itself (see `DonationProvisionRequest.bootstrapNodes`).
-     * Absent on records written before respawn support; those are not respawnable.
-     */
-    bootstrapNodes?: string[];
-    /**
-     * Requester owner public key(s), base64url — replayed as the node's pinned
-     * seed-trust anchors (`CADRE_OWNER_KEYS`) on respawn. Absent on records written
-     * before respawn support; those are not respawnable.
-     */
-    ownerKeys?: string[];
-    /**
-     * Respawn bookkeeping, owned by the supervisor's backoff. Absent until the
-     * first respawn attempt. Not secret — it rides along in `DonationView` so the
-     * borrower's `GET /grants/:id` shows the counters for free.
-     */
-    respawn?: {
-        attempts: number;
-        lastAttemptAt: string;
-    };
-    /** Node profile. Defaults to `storage` so the node participates and is dialable. */
-    profile: 'storage' | 'transaction';
-    status: DonationStatus;
-    /** Orchestrator handle (opaque `pid:token`), set once the child is spawned. */
-    dockerId?: string;
-    /**
-     * Reserved: a donation's live peer identity is read fresh from the node's
-     * `/status` on each `getPeer` call and is NOT persisted here — this field is
-     * currently never written. Kept for a future cache if `/status` fan-out ever
-     * shows up as hot.
-     */
-    peerId?: string;
-    /** The node's loopback `POST /seed` URL. Host-internal — stripped from the wire view. */
-    seedEndpoint?: string;
-    /** Host↔node bearer gating `POST /seed`. Persisted; NEVER leaves the host. */
-    seedToken?: string;
-    createdAt: string;
-    updatedAt: string;
-    /** Failure detail when `status === 'error'`. */
-    error?: string;
-}
-/**
- * Redacted wire shape returned to the grantee: the host-only secrets
- * (`seedToken`) and host-internal loopback URL (`seedEndpoint`) are stripped.
- */
-export type DonationView = Omit<Donation, 'seedToken' | 'seedEndpoint'>;
-/** On-disk shape of `donations.json`. Keyed by donation id. */
-export interface DonationFile {
-    version: 1;
-    donations: Record<string, Omit<Donation, 'id'>>;
-}
-/** Error codes thrown by the donation service / grantee-facing routes. */
-export type DonationErrorCode = 'unauthorized' | 'forbidden' | 'quota_exceeded' | 'invalid_request' | 'not_found' | 'invalid_state' | 'seed_failed' | 'peer_unavailable' | 'orchestrator_error' | 'storage_error';
-/** Typed donation error carrying a stable `code` for HTTP mapping. */
-export declare class DonationError extends Error {
-    readonly code: DonationErrorCode;
-    constructor(code: DonationErrorCode, message: string);
-}
-/** Error codes thrown by GrantStore / GrantService. */
-export type GrantErrorCode = 'not_found' | 'invalid_label' | 'invalid_max_nodes' | 'invalid_ttl' | 'storage_error';
-/** Typed error carrying a stable `code` for HTTP mapping. */
-export declare class GrantError extends Error {
-    readonly code: GrantErrorCode;
-    constructor(code: GrantErrorCode, message: string);
-}

package/dist/donation/types.js

@@ -1,40 +0,0 @@
-/**
- * Donation grant-token types for cadre-host.
- *
- * A **grant token** is a high-entropy base64url secret the host admin issues,
- * out-of-band (QR / copy-paste), to one *grantee* — a friend or family member
- * whose cadre authority (their phone) may then ask this host to spawn donated
- * nodes. The grantee presents the token as `Authorization: Bearer <grant-token>`
- * on every donation request (the grantee-facing surface lands in the
- * `2-donation-service` ticket).
- *
- * This module owns the grant's identity, expiry, and per-grantee quota. The
- * *live-node tally* it checks the quota against is owned by the donation
- * service, not by the grant layer — see `GrantValidator.validateForProvision`.
- *
- * **Grant ≠ trust-circle membership.** A trust-circle invite (`auth/`)
- * authorises a device to join *the host's own* cadre. A donation grant
- * authorises an external cadre authority to ask the host to spawn a node that
- * joins *the grantee's* cadre. The two token flows are deliberately separate
- * modules; this one reuses the *shape* of the trust-circle store (atomic
- * write-then-rename JSON, token-keyed rows) but with grant — not invite —
- * semantics: a grant is long-lived and reusable up to a quota, never
- * one-time-redeemed.
- */
-/** Typed donation error carrying a stable `code` for HTTP mapping. */
-export class DonationError extends Error {
-    constructor(code, message) {
-        super(message);
-        this.name = 'DonationError';
-        this.code = code;
-    }
-}
-/** Typed error carrying a stable `code` for HTTP mapping. */
-export class GrantError extends Error {
-    constructor(code, message) {
-        super(message);
-        this.name = 'GrantError';
-        this.code = code;
-    }
-}
-//# sourceMappingURL=types.js.map

package/dist/donation/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/donation/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAiNH,sEAAsE;AACtE,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGtC,YAAY,IAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAUD,6DAA6D;AAC7D,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGnC,YAAY,IAAoB,EAAE,OAAe;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/installer/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/installer/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AASvD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC/C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/B,kDAAkD;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7E,CAAC"}

package/dist/owner/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * Owner-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's owner cadre node (via
- * `HostProcessOrchestrator`) and delegates owner/membership/identity
- * operations to it over the loopback admin channel using
- * {@link OwnerNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-export { OwnerNodeClient, OwnerNodeUnavailableError } from './owner-node-client.js';
-export type { OwnerNodeClientOptions } from './owner-node-client.js';

package/dist/owner/index.js

@@ -1,11 +0,0 @@
-/**
- * Owner-node delegation surface for cadre-host.
- *
- * The manager process spawns the admin's owner cadre node (via
- * `HostProcessOrchestrator`) and delegates owner/membership/identity
- * operations to it over the loopback admin channel using
- * {@link OwnerNodeClient}. See `docs/cadre-host.md` § Control-plane
- * separation.
- */
-export { OwnerNodeClient, OwnerNodeUnavailableError } from './owner-node-client.js';
-//# sourceMappingURL=index.js.map

package/dist/owner/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/owner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/owner/owner-node-client.d.ts

@@ -1,110 +0,0 @@
-/**
- * HTTP client for the owner node's loopback admin channel (the 6.6
- * `cadre-node-admin-channel` contract).
- *
- * cadre-host's manager process holds no in-process `CadreNode`; it spawns the
- * admin's owner node as a managed child (see `HostProcessOrchestrator`)
- * and delegates all owner/membership/identity operations to it over this
- * client. The client implements **all three** trimmed `CadreNodeLike`
- * interfaces — the trust-circle one (`auth/trust-circle.ts`), the NAT one
- * (`nat/nat-service.ts`), and the strand one (`strands/strand-service.ts`) —
- * plus `pushInviteAddresses` and `addDrone` (the node-donation requester side).
- *
- * Transport: `Authorization: Bearer <token>` against
- * `http://127.0.0.1:<adminPort>`. Every response uses the cadre-provider
- * envelope `{ ok: true, data }` / `{ ok: false, error: { code, message } }`.
- * A refused connection, a transport error, or any non-2xx response surfaces
- * as {@link OwnerNodeUnavailableError}; the trust-circle / NAT services
- * translate that into a `node_unavailable` domain error so the management API
- * returns a clear 503 rather than a raw 500.
- */
-import type { CadreInvite, DroneInitResult } from '@serfab/cadre-core';
-import type { OwnerAdminEndpoint } from '../orchestrator/index.js';
-import type { CadreNodeLike as TrustCircleCadreNodeLike } from '../auth/trust-circle.js';
-import type { CadreNodeLike as NatCadreNodeLike } from '../nat/nat-service.js';
-import type { CadreNodeLike as StrandCadreNodeLike } from '../strands/strand-service.js';
-import type { StrandListSnapshot, StrandRemovalResult } from '../strands/types.js';
-/**
- * Raised when the owner node's admin channel can't be reached or returns
- * a non-success response. Carries the node's stable error `code` when one was
- * present in the envelope (e.g. `not_ready`, `not_authorized`).
- */
-export declare class OwnerNodeUnavailableError extends Error {
-    /** The admin-channel error code, when the node answered with an envelope. */
-    readonly nodeCode?: string;
-    constructor(message: string, nodeCode?: string);
-}
-/** Endpoint provided directly or via a getter (so it tracks re-spawns). */
-type EndpointSource = OwnerAdminEndpoint | (() => OwnerAdminEndpoint | undefined) | undefined;
-export interface OwnerNodeClientOptions {
-    /** Fetch override for tests. Defaults to the global `fetch`. */
-    fetch?: typeof fetch;
-}
-export declare class OwnerNodeClient implements TrustCircleCadreNodeLike, NatCadreNodeLike, StrandCadreNodeLike {
-    private readonly endpointSource;
-    private readonly fetchImpl;
-    /**
-     * @param endpoint Either a fixed `{ baseUrl, token }` or a getter returning
-     *   the current endpoint (pass `orchestrator.getOwnerAdminEndpoint`
-     *   bound, so a restart's new bearer token is picked up automatically).
-     */
-    constructor(endpoint: EndpointSource, opts?: OwnerNodeClientOptions);
-    createInvite(token?: string, expiresInMs?: number): Promise<{
-        invite: CadreInvite;
-        encodedInvite: string;
-    }>;
-    acceptPhone(options: {
-        phonePeerId: string;
-        token?: string;
-    }, issuedInvite?: CadreInvite): Promise<void>;
-    removePeer(peerId: string): Promise<void>;
-    /**
-     * Encode an invite for out-of-band delivery. The admin contract has no
-     * encode route (the mint route already returns `encodedInvite`), so this
-     * mirrors cadre-core's encoding (`base64url(JSON.stringify(invite))`).
-     */
-    encodeInvite(invite: CadreInvite): string;
-    listMembers(): Promise<Array<{
-        peerId: string;
-        multiaddr: string | null;
-    }>>;
-    isMember(peerId: string): Promise<boolean>;
-    /** Authorized-membership surface (excludes self) — see {@link listMembers} for the addressable one. */
-    listAuthorizedMembers(): Promise<Array<{
-        peerId: string;
-        multiaddr: string | null;
-    }>>;
-    isAuthorizedMember(peerId: string): Promise<boolean>;
-    getPeerId(): Promise<string>;
-    getMultiaddrs(): Promise<string[]>;
-    /** This party's strands plus the node's current control-connection count. */
-    listStrands(): Promise<StrandListSnapshot>;
-    /**
-     * Remove this party's participation in one strand.
-     *
-     * `?confirm=1` is appended **only** when the caller asked for it. The node
-     * refuses an unconfirmed closed-strand removal with `confirmation_required`;
-     * that refusal is surfaced, never retried with the flag added — the row holds
-     * this party's membership key for the strand and nothing else does.
-     */
-    removeStrand(strandId: string, opts: {
-        confirm: boolean;
-    }): Promise<StrandRemovalResult>;
-    /**
-     * Mint a seed authorizing a drone — a provider-hosted / donated node — to join
-     * this node's cadre. The node signs the seed with its own authority key; only
-     * the signed, public `encodedSeed` is returned (the private key never leaves
-     * the node). This is the requester ("phone") side of the node-donation flow:
-     * the donor host presents the returned seed to the donated node's `POST /seed`.
-     */
-    addDrone(options: {
-        dronePeerId: string;
-        droneMultiaddrs: string[];
-    }): Promise<DroneInitResult>;
-    /** Push the NAT-resolved addresses the node should embed in future invites. */
-    pushInviteAddresses(addresses: string[]): Promise<void>;
-    private resolveEndpoint;
-    private request;
-    private parseEnvelope;
-}
-export {};

package/dist/owner/owner-node-client.js

@@ -1,184 +0,0 @@
-/**
- * HTTP client for the owner node's loopback admin channel (the 6.6
- * `cadre-node-admin-channel` contract).
- *
- * cadre-host's manager process holds no in-process `CadreNode`; it spawns the
- * admin's owner node as a managed child (see `HostProcessOrchestrator`)
- * and delegates all owner/membership/identity operations to it over this
- * client. The client implements **all three** trimmed `CadreNodeLike`
- * interfaces — the trust-circle one (`auth/trust-circle.ts`), the NAT one
- * (`nat/nat-service.ts`), and the strand one (`strands/strand-service.ts`) —
- * plus `pushInviteAddresses` and `addDrone` (the node-donation requester side).
- *
- * Transport: `Authorization: Bearer <token>` against
- * `http://127.0.0.1:<adminPort>`. Every response uses the cadre-provider
- * envelope `{ ok: true, data }` / `{ ok: false, error: { code, message } }`.
- * A refused connection, a transport error, or any non-2xx response surfaces
- * as {@link OwnerNodeUnavailableError}; the trust-circle / NAT services
- * translate that into a `node_unavailable` domain error so the management API
- * returns a clear 503 rather than a raw 500.
- */
-import debug from 'debug';
-const log = debug('cadre:host:owner-client');
-/**
- * Raised when the owner node's admin channel can't be reached or returns
- * a non-success response. Carries the node's stable error `code` when one was
- * present in the envelope (e.g. `not_ready`, `not_authorized`).
- */
-export class OwnerNodeUnavailableError extends Error {
-    constructor(message, nodeCode) {
-        super(message);
-        this.name = 'OwnerNodeUnavailableError';
-        if (nodeCode !== undefined)
-            this.nodeCode = nodeCode;
-    }
-}
-export class OwnerNodeClient {
-    /**
-     * @param endpoint Either a fixed `{ baseUrl, token }` or a getter returning
-     *   the current endpoint (pass `orchestrator.getOwnerAdminEndpoint`
-     *   bound, so a restart's new bearer token is picked up automatically).
-     */
-    constructor(endpoint, opts = {}) {
-        this.endpointSource = endpoint;
-        this.fetchImpl = opts.fetch ?? fetch;
-    }
-    // --- trust-circle CadreNodeLike ---
-    async createInvite(token, expiresInMs) {
-        const body = {};
-        if (token !== undefined)
-            body.token = token;
-        if (expiresInMs !== undefined)
-            body.expiresInMs = expiresInMs;
-        return await this.request('POST', '/admin/invites', body);
-    }
-    async acceptPhone(options, issuedInvite) {
-        const body = { phonePeerId: options.phonePeerId };
-        if (options.token !== undefined)
-            body.token = options.token;
-        if (issuedInvite !== undefined)
-            body.issuedInvite = issuedInvite;
-        await this.request('POST', '/admin/accept-phone', body);
-    }
-    async removePeer(peerId) {
-        await this.request('DELETE', `/admin/members/${encodeURIComponent(peerId)}`);
-    }
-    /**
-     * Encode an invite for out-of-band delivery. The admin contract has no
-     * encode route (the mint route already returns `encodedInvite`), so this
-     * mirrors cadre-core's encoding (`base64url(JSON.stringify(invite))`).
-     */
-    encodeInvite(invite) {
-        return Buffer.from(JSON.stringify(invite), 'utf8').toString('base64url');
-    }
-    async listMembers() {
-        const data = await this.request('GET', '/admin/members');
-        return data.members;
-    }
-    async isMember(peerId) {
-        const data = await this.request('GET', `/admin/members/${encodeURIComponent(peerId)}`);
-        return data.member;
-    }
-    /** Authorized-membership surface (excludes self) — see {@link listMembers} for the addressable one. */
-    async listAuthorizedMembers() {
-        const data = await this.request('GET', '/admin/authorized-members');
-        return data.members;
-    }
-    async isAuthorizedMember(peerId) {
-        const data = await this.request('GET', `/admin/authorized-members/${encodeURIComponent(peerId)}`);
-        return data.member;
-    }
-    // --- NAT CadreNodeLike ---
-    async getPeerId() {
-        const data = await this.request('GET', '/admin/identity');
-        return data.peerId ?? '';
-    }
-    async getMultiaddrs() {
-        const data = await this.request('GET', '/admin/multiaddrs');
-        return data.multiaddrs;
-    }
-    // --- strand CadreNodeLike ---
-    /** This party's strands plus the node's current control-connection count. */
-    async listStrands() {
-        return await this.request('GET', '/admin/strands');
-    }
-    /**
-     * Remove this party's participation in one strand.
-     *
-     * `?confirm=1` is appended **only** when the caller asked for it. The node
-     * refuses an unconfirmed closed-strand removal with `confirmation_required`;
-     * that refusal is surfaced, never retried with the flag added — the row holds
-     * this party's membership key for the strand and nothing else does.
-     */
-    async removeStrand(strandId, opts) {
-        const query = opts.confirm ? '?confirm=1' : '';
-        return await this.request('DELETE', `/admin/strands/${encodeURIComponent(strandId)}${query}`);
-    }
-    // --- drone seeding (node-donation requester side) ---
-    /**
-     * Mint a seed authorizing a drone — a provider-hosted / donated node — to join
-     * this node's cadre. The node signs the seed with its own authority key; only
-     * the signed, public `encodedSeed` is returned (the private key never leaves
-     * the node). This is the requester ("phone") side of the node-donation flow:
-     * the donor host presents the returned seed to the donated node's `POST /seed`.
-     */
-    async addDrone(options) {
-        return await this.request('POST', '/admin/add-drone', {
-            dronePeerId: options.dronePeerId,
-            droneMultiaddrs: options.droneMultiaddrs,
-        });
-    }
-    // --- push-model invite addresses ---
-    /** Push the NAT-resolved addresses the node should embed in future invites. */
-    async pushInviteAddresses(addresses) {
-        await this.request('PUT', '/admin/invite-addresses', { addresses });
-    }
-    // --- internals ---
-    resolveEndpoint() {
-        const ep = typeof this.endpointSource === 'function' ? this.endpointSource() : this.endpointSource;
-        if (!ep) {
-            throw new OwnerNodeUnavailableError('Owner node admin endpoint is not available');
-        }
-        return ep;
-    }
-    async request(method, path, body) {
-        const ep = this.resolveEndpoint();
-        const headers = { authorization: `Bearer ${ep.token}` };
-        const init = { method, headers };
-        if (body !== undefined) {
-            headers['content-type'] = 'application/json';
-            init.body = JSON.stringify(body);
-        }
-        let res;
-        try {
-            res = await this.fetchImpl(`${ep.baseUrl}${path}`, init);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            log('admin %s %s transport error: %s', method, path, message);
-            throw new OwnerNodeUnavailableError(`Owner node unreachable: ${message}`);
-        }
-        const envelope = await this.parseEnvelope(res);
-        if (!res.ok || !envelope.ok) {
-            const code = envelope.error?.code;
-            const message = envelope.error?.message ?? `admin ${method} ${path} → HTTP ${res.status}`;
-            log('admin %s %s failed: [%s] %s', method, path, code ?? res.status, message);
-            throw new OwnerNodeUnavailableError(message, code);
-        }
-        return envelope.data;
-    }
-    async parseEnvelope(res) {
-        try {
-            const parsed = await res.json();
-            if (parsed && typeof parsed === 'object') {
-                return parsed;
-            }
-        }
-        catch {
-            // Non-JSON body — fall through to an empty envelope; status drives the
-            // ok/non-ok decision in the caller.
-        }
-        return {};
-    }
-}
-//# sourceMappingURL=owner-node-client.js.map

package/dist/owner/owner-node-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"owner-node-client.js","sourceRoot":"","sources":["../../src/owner/owner-node-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAIlD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvD,CAAC;CACF;AAaD,MAAM,OAAO,eAAe;IAK1B;;;;OAIG;IACH,YAAY,QAAwB,EAAE,OAA+B,EAAE;QACrE,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,qCAAqC;IAErC,KAAK,CAAC,YAAY,CAChB,KAAc,EACd,WAAoB;QAEpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9D,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,MAAM,EACN,gBAAgB,EAChB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAgD,EAChD,YAA0B;QAE1B,MAAM,IAAI,GAA4B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5D,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,MAAmB;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC/C,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,qBAAqB;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,2BAA2B,CAC5B,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC1D,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA6C,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA2B,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,+BAA+B;IAE/B,6EAA6E;IAC7E,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,IAAI,CAAC,OAAO,CAAqB,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAA0B;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,IAAI,CAAC,OAAO,CACvB,QAAQ,EACR,kBAAkB,kBAAkB,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,uDAAuD;IAEvD;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2D;QACxE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAkB,MAAM,EAAE,kBAAkB,EAAE;YACrE,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IAEtC,+EAA+E;IAC/E,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,oBAAoB;IAEZ,eAAe;QACrB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACnG,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,iCAAiC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,IAAI,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1F,GAAG,CAAC,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,IAAI,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAa;QAKvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,MAAuF,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,oCAAoC;QACtC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}