@serfab/cadre-host 1.13.0 → 1.15.0

package/src/server/server.ts

@@ -124,14 +124,14 @@ export function buildFastify(): FastifyInstance {
  * request with no body (`request.body === undefined`), instead of Fastify's
  * default `400 FST_ERR_CTP_EMPTY_JSON_BODY`.
  *
- * `/grants` is served to other people's clients, and sending the JSON content
- * type on every request, body or not, is a common client habit — the phone app
- * did it, and the refused body-less `DELETE /grants/:id` left the loan and its
- * node running. Every route that reads a body already reads `request.body ?? {}`,
- * so a route that needs a field still answers its own `invalid_request` naming it.
- * A non-empty body goes to Fastify's own parser, so malformed JSON is still a 400
- * and the prototype-poisoning checks are unchanged (`'error'` is Fastify's default
- * for both).
+ * Sending the JSON content type on every request, body or not, is a common
+ * client habit (`POST /api/hosted-nodes` takes no body today, and a body-less
+ * `DELETE` is the norm), and a refused request here is a node left running.
+ * Every route that reads a body already reads `request.body ?? {}`, so a route
+ * that needs a field still answers its own `invalid_request` naming it. A
+ * non-empty body goes to Fastify's own parser, so malformed JSON is still a 400
+ * and the prototype-poisoning checks are unchanged (`'error'` is Fastify's
+ * default for both).
  */
 function acceptEmptyJsonBodies(app: FastifyInstance): void {
   // NOTE: 'error', 'error' mirrors Fastify's defaults for proto/constructor poisoning; if

package/src/server/settings-store.ts

@@ -2,7 +2,7 @@
  * Settings store — read-write facade around `host.config.json` for the
  * /api/settings route.
  *
- * The installer (`6.4.1`) owns the schema (`HostConfigFile` v2). This module
+ * The installer (`6.4.1`) owns the schema (`HostConfigFile` v3). This module
  * just delegates load/persist to that file's helpers; it exists so route
  * handlers can read/write without each one re-resolving `configPath(dataDir)`.
  *
@@ -29,7 +29,7 @@ export class HostSettingsStore {
   // /api/settings answers 500 code "internal" with the read message passed through.
   // Fine while the UI just surfaces the text; if it ever needs to tell "your config
   // file is unreadable" apart from a genuine server bug, give this a typed error.
-  /** Read the current host.config.json. Throws if absent, malformed, or not version 2. */
+  /** Read the current host.config.json. Throws if absent, malformed, or not version 3. */
   read(): HostConfigFile {
     return readHostConfig(this.configPath);
   }

package/src/server/static.ts

@@ -65,7 +65,6 @@ export function registerStaticMount(app: FastifyInstance, opts: StaticMountOptio
     // Don't try to serve API paths as static.
     if (
       request.url.startsWith('/api') ||
-      request.url.startsWith('/auth') ||
       request.url.startsWith('/nat') ||
       request.url.startsWith('/update')
     ) {
@@ -198,7 +197,7 @@ function placeholderHtml(): string {
       <li><span class="endpoint">GET /api/nodes</span></li>
       <li><span class="endpoint">GET /api/settings</span></li>
       <li><span class="endpoint">GET /api/events</span> (Server-Sent Events)</li>
-      <li><span class="endpoint">/auth/*</span>, <span class="endpoint">/nat/*</span>, <span class="endpoint">/update/*</span></li>
+      <li><span class="endpoint">/nat/*</span>, <span class="endpoint">/update/*</span></li>
     </ul>
     <p>See <a href="https://github.com/gotchoices/sereus/blob/master/docs/cadre-host.md">docs/cadre-host.md</a>.</p>
   </body>

package/src/update/index.ts

@@ -305,8 +305,8 @@ export class UpdateService {
 }
 
 /**
- * Typed handler facade — mirrors `createTrustCircleHandlers` /
- * `createNatHandlers`. The local-UI ticket consumes these.
+ * Typed handler facade — same shape as `createNatHandlers`. The local-UI
+ * server consumes these.
  */
 export function createUpdateHandlers(service: UpdateService): UpdateHandlers {
   return {

package/src/update/store.ts

@@ -1,7 +1,7 @@
 /**
  * Atomic JSON store for `<dataDir>/update-state.json`.
  *
- * Mirrors `TrustCircleStore` / `NatStore`: load on demand, write to
+ * Mirrors `NatStore`: load on demand, write to
  * `<path>.tmp` then rename. Single-writer assumption — only one cadre-host
  * process owns a given dataDir.
  */

package/src/update/types.ts

@@ -8,7 +8,7 @@
  *   - apply.ts    — invoke `npm install -g` + rollback on failure.
  *   - index.ts    — composes the above (UpdateService).
  *
- * Mirrors the typed-handler pattern used by trust-circle and NAT (handlers
+ * Mirrors the typed-handler pattern used by NAT (handlers
  * throw `UpdateError` whose `.code` the local-UI maps to HTTP status).
  */
 

package/dist/auth/duration.d.ts

@@ -1 +0,0 @@
-export declare function parseDuration(input: string): number;

package/dist/auth/duration.js

@@ -1,32 +0,0 @@
-/**
- * Tiny duration parser for invite TTLs.
- *
- * Accepts a single value+unit token: `30s`, `5m`, `24h`, `7d`, `2w`.
- * Whitespace is allowed around it. Bare numbers are treated as milliseconds.
- *
- * Returns the duration in milliseconds. Throws on unparseable input.
- */
-const UNIT_MULTIPLIERS = {
-    ms: 1,
-    s: 1000,
-    m: 60 * 1000,
-    h: 60 * 60 * 1000,
-    d: 24 * 60 * 60 * 1000,
-    w: 7 * 24 * 60 * 60 * 1000,
-};
-const DURATION_RE = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)?$/;
-export function parseDuration(input) {
-    const trimmed = input.trim();
-    const match = DURATION_RE.exec(trimmed);
-    if (!match) {
-        throw new Error(`Invalid duration: ${JSON.stringify(input)} (expected e.g. "24h", "7d", "30m")`);
-    }
-    const value = parseFloat(match[1]);
-    const unit = match[2] ?? 'ms';
-    const multiplier = UNIT_MULTIPLIERS[unit];
-    if (multiplier === undefined) {
-        throw new Error(`Unknown duration unit: ${unit}`);
-    }
-    return Math.round(value * multiplier);
-}
-//# sourceMappingURL=duration.js.map

package/dist/auth/duration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../src/auth/duration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACtB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC;AAEF,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAE1D,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC;AACxC,CAAC"}

package/dist/auth/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * Trust-circle auth for cadre-host. See ./trust-circle.ts and ./types.ts.
- */
-export { TrustCircleService, createTrustCircleHandlers, DEFAULT_INVITE_TTL_MS } from './trust-circle.js';
-export type { TrustCircleServiceOptions, CadreNodeLike } from './trust-circle.js';
-export { TrustCircleStore } from './trust-circle-store.js';
-export { ensureSelfLabel, SELF_LABEL } from './self-label.js';
-export type { EnsureSelfLabelOptions } from './self-label.js';
-export { parseDuration } from './duration.js';
-export { TrustCircleError, } from './types.js';
-export type { TrustCircleMember, PendingInvite, TrustCircleFile, TrustCircleSnapshot, TrustCircleHandlers, TrustCircleErrorCode, } from './types.js';

package/dist/auth/index.js

@@ -1,9 +0,0 @@
-/**
- * Trust-circle auth for cadre-host. See ./trust-circle.ts and ./types.ts.
- */
-export { TrustCircleService, createTrustCircleHandlers, DEFAULT_INVITE_TTL_MS } from './trust-circle.js';
-export { TrustCircleStore } from './trust-circle-store.js';
-export { ensureSelfLabel, SELF_LABEL } from './self-label.js';
-export { parseDuration } from './duration.js';
-export { TrustCircleError, } from './types.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAEzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/auth/self-label.d.ts

@@ -1,36 +0,0 @@
-/**
- * Self-labelling for the trust-circle listing.
- *
- * `TrustCircleService.list()` shows the cadre's *authorized* membership, which
- * deliberately excludes the node's own self-published row — a node's own
- * address record isn't something an owner key vouched for. To keep the owner's
- * own device visible in the listing, cadre-host records a local
- * `self: true` label for it and `list()` splices that row back in.
- *
- * Writing that label is this module's job. Kept out of `bin/host.ts` so it is
- * unit-testable without standing up the CLI.
- */
-import type { TrustCircleStore } from './trust-circle-store.js';
-/** Label written for the owner's own device when none exists yet. */
-export declare const SELF_LABEL = "This device";
-export interface EnsureSelfLabelOptions {
-    /** Local labels store to write into. */
-    store: TrustCircleStore;
-    /** Resolves the owner node's peer ID; '' when the node isn't ready yet. */
-    getPeerId: () => Promise<string>;
-    /** Clock override for tests. */
-    now?: () => Date;
-}
-/**
- * Record the owner node's own peer ID as a `self: true` local label.
- *
- * Idempotent: an existing row for that peer ID is left alone, so an admin's
- * rename survives restarts. Stale `self` rows (a different peer ID — the node
- * identity was replaced) are dropped, since `list()` splices every `self` row
- * in unconditionally and would otherwise show a device that no longer exists.
- *
- * Returns the peer ID that is now labelled, or `undefined` when the node
- * wasn't ready. Throws whatever `getPeerId` throws — callers treat a failure
- * as best-effort (the next start heals it).
- */
-export declare function ensureSelfLabel(opts: EnsureSelfLabelOptions): Promise<string | undefined>;

package/dist/auth/self-label.js

@@ -1,57 +0,0 @@
-/**
- * Self-labelling for the trust-circle listing.
- *
- * `TrustCircleService.list()` shows the cadre's *authorized* membership, which
- * deliberately excludes the node's own self-published row — a node's own
- * address record isn't something an owner key vouched for. To keep the owner's
- * own device visible in the listing, cadre-host records a local
- * `self: true` label for it and `list()` splices that row back in.
- *
- * Writing that label is this module's job. Kept out of `bin/host.ts` so it is
- * unit-testable without standing up the CLI.
- */
-import debug from 'debug';
-const log = debug('cadre:host:trust-circle-self');
-/** Label written for the owner's own device when none exists yet. */
-export const SELF_LABEL = 'This device';
-/**
- * Record the owner node's own peer ID as a `self: true` local label.
- *
- * Idempotent: an existing row for that peer ID is left alone, so an admin's
- * rename survives restarts. Stale `self` rows (a different peer ID — the node
- * identity was replaced) are dropped, since `list()` splices every `self` row
- * in unconditionally and would otherwise show a device that no longer exists.
- *
- * Returns the peer ID that is now labelled, or `undefined` when the node
- * wasn't ready. Throws whatever `getPeerId` throws — callers treat a failure
- * as best-effort (the next start heals it).
- */
-export async function ensureSelfLabel(opts) {
-    const { store, getPeerId } = opts;
-    const now = opts.now ?? (() => new Date());
-    const peerId = await getPeerId();
-    if (!peerId) {
-        log('owner node not ready — no self label written');
-        return undefined;
-    }
-    for (const member of store.listMembers()) {
-        if (member.self && member.peerId !== peerId) {
-            log('dropping stale self label for %s (current identity is %s)', member.peerId, peerId);
-            store.removeMember(member.peerId);
-        }
-    }
-    const existing = store.getMember(peerId);
-    if (!existing) {
-        store.addMember({ peerId, label: SELF_LABEL, addedAt: now().toISOString(), self: true });
-        log('labelled own device %s as "%s"', peerId, SELF_LABEL);
-    }
-    else if (!existing.self) {
-        // Row predates self-labelling (or was written by a redemption). Stamp the
-        // flag, keeping the label: without it `list()` prunes the row, since the
-        // authorized set never contains self.
-        store.addMember({ ...existing, self: true });
-        log('stamped existing label for own device %s as self', peerId);
-    }
-    return peerId;
-}
-//# sourceMappingURL=self-label.js.map

package/dist/auth/self-label.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"self-label.js","sourceRoot":"","sources":["../../src/auth/self-label.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,MAAM,GAAG,GAAG,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAElD,qEAAqE;AACrE,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAWxC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,GAAG,CAAC,2DAA2D,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxF,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,GAAG,CAAC,gCAAgC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,yEAAyE;QACzE,sCAAsC;QACtC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/trust-circle-store.d.ts

@@ -1,26 +0,0 @@
-import type { PendingInvite, TrustCircleFile, TrustCircleMember } from './types.js';
-/**
- * Atomic JSON store for trust-circle.json. Mirrors the pattern in
- * `orchestrator/state-store.ts`: write to `<path>.tmp`, then rename.
- *
- * Concurrency assumption: only one cadre-host process owns a given rootDir
- * (the orchestrator already enforces this). No file-locking primitives.
- */
-export declare class TrustCircleStore {
-    private readonly path;
-    private cache;
-    constructor(rootDir: string);
-    filePath(): string;
-    /** Load (with caching). A missing file returns an empty store. */
-    load(): TrustCircleFile;
-    /** Persist the current state atomically (write then rename). */
-    save(state: TrustCircleFile): void;
-    addMember(member: TrustCircleMember): void;
-    removeMember(peerId: string): boolean;
-    getMember(peerId: string): TrustCircleMember | undefined;
-    listMembers(): TrustCircleMember[];
-    addPending(invite: PendingInvite): void;
-    removePending(token: string): boolean;
-    getPending(token: string): PendingInvite | undefined;
-    listPending(): PendingInvite[];
-}

package/dist/auth/trust-circle-store.js

@@ -1,129 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import debug from 'debug';
-import { TrustCircleError } from './types.js';
-const log = debug('cadre:host:trust-circle-store');
-const FILE_VERSION = 1;
-/**
- * Atomic JSON store for trust-circle.json. Mirrors the pattern in
- * `orchestrator/state-store.ts`: write to `<path>.tmp`, then rename.
- *
- * Concurrency assumption: only one cadre-host process owns a given rootDir
- * (the orchestrator already enforces this). No file-locking primitives.
- */
-export class TrustCircleStore {
-    constructor(rootDir) {
-        this.cache = null;
-        mkdirSync(rootDir, { recursive: true });
-        this.path = join(rootDir, 'trust-circle.json');
-    }
-    filePath() {
-        return this.path;
-    }
-    /** Load (with caching). A missing file returns an empty store. */
-    load() {
-        if (this.cache)
-            return this.cache;
-        if (!existsSync(this.path)) {
-            this.cache = emptyFile();
-            return this.cache;
-        }
-        let raw;
-        try {
-            raw = readFileSync(this.path, 'utf8');
-        }
-        catch (err) {
-            throw new TrustCircleError('storage_error', `failed to read trust-circle file at ${this.path}: ${err.message}`);
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(raw);
-        }
-        catch (err) {
-            throw new TrustCircleError('storage_error', `trust-circle file at ${this.path} is not valid JSON: ${err.message}`);
-        }
-        if (!isTrustCircleFile(parsed)) {
-            throw new TrustCircleError('storage_error', `trust-circle file at ${this.path} has unexpected shape`);
-        }
-        this.cache = parsed;
-        return this.cache;
-    }
-    /** Persist the current state atomically (write then rename). */
-    save(state) {
-        mkdirSync(dirname(this.path), { recursive: true });
-        const payload = JSON.stringify({ ...state, version: FILE_VERSION }, null, 2);
-        const tmp = `${this.path}.tmp`;
-        writeFileSync(tmp, payload, { encoding: 'utf8' });
-        renameSync(tmp, this.path);
-        this.cache = { ...state, version: FILE_VERSION };
-        log('saved trust-circle (%d members, %d pending) to %s', Object.keys(state.members).length, Object.keys(state.pendingInvites).length, this.path);
-    }
-    // --- Member ops ---
-    addMember(member) {
-        const state = this.load();
-        const { peerId, ...rest } = member;
-        state.members[peerId] = rest;
-        this.save(state);
-    }
-    removeMember(peerId) {
-        const state = this.load();
-        if (!(peerId in state.members))
-            return false;
-        delete state.members[peerId];
-        this.save(state);
-        return true;
-    }
-    getMember(peerId) {
-        const state = this.load();
-        const row = state.members[peerId];
-        if (!row)
-            return undefined;
-        return { peerId, ...row };
-    }
-    listMembers() {
-        const state = this.load();
-        return Object.entries(state.members).map(([peerId, row]) => ({ peerId, ...row }));
-    }
-    // --- Pending invite ops ---
-    addPending(invite) {
-        const state = this.load();
-        const { token, ...rest } = invite;
-        state.pendingInvites[token] = rest;
-        this.save(state);
-    }
-    removePending(token) {
-        const state = this.load();
-        if (!(token in state.pendingInvites))
-            return false;
-        delete state.pendingInvites[token];
-        this.save(state);
-        return true;
-    }
-    getPending(token) {
-        const state = this.load();
-        const row = state.pendingInvites[token];
-        if (!row)
-            return undefined;
-        return { token, ...row };
-    }
-    listPending() {
-        const state = this.load();
-        return Object.entries(state.pendingInvites).map(([token, row]) => ({ token, ...row }));
-    }
-}
-function emptyFile() {
-    return { version: FILE_VERSION, members: {}, pendingInvites: {} };
-}
-function isTrustCircleFile(v) {
-    if (!v || typeof v !== 'object')
-        return false;
-    const obj = v;
-    if (obj.version !== FILE_VERSION)
-        return false;
-    if (!obj.members || typeof obj.members !== 'object')
-        return false;
-    if (!obj.pendingInvites || typeof obj.pendingInvites !== 'object')
-        return false;
-    return true;
-}
-//# sourceMappingURL=trust-circle-store.js.map

package/dist/auth/trust-circle-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-circle-store.js","sourceRoot":"","sources":["../../src/auth/trust-circle-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,GAAG,GAAG,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAEnD,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IAI3B,YAAY,OAAe;QAFnB,UAAK,GAA2B,IAAI,CAAC;QAG3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,kEAAkE;IAClE,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,uCAAuC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,wBAAwB,IAAI,CAAC,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,wBAAwB,IAAI,CAAC,IAAI,uBAAuB,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,KAAsB;QACzB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,mDAAmD,EACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,EACxC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,qBAAqB;IAErB,SAAS,CAAC,MAAyB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,MAAc;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,WAAW;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,6BAA6B;IAE7B,UAAU,CAAC,MAAqB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAClC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,WAAW;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/trust-circle.d.ts

@@ -1,156 +0,0 @@
-import type { CadreInvite } from '@serfab/cadre-core';
-import type { TrustCircleStore } from './trust-circle-store.js';
-import type { TrustCircleHandlers, TrustCircleSnapshot } from './types.js';
-/** Default invite lifetime: 24 hours. */
-export declare const DEFAULT_INVITE_TTL_MS: number;
-/** Constructor options. */
-export interface TrustCircleServiceOptions {
-    /** The host's cadre node — provides createInvite / acceptPhone / removePeer. */
-    cadreNode: CadreNodeLike;
-    /** Local labels + pending-invites store. */
-    store: TrustCircleStore;
-    /** Clock override for tests. */
-    now?: () => Date;
-}
-/**
- * Minimal slice of CadreNode that the service uses. Defined as an interface
- * (rather than reaching into CadreNode directly) so unit tests can inject
- * a mock without standing up a real libp2p node.
- */
-export interface CadreNodeLike {
-    createInvite(token?: string, expiresIn?: number): Promise<{
-        invite: CadreInvite;
-        encodedInvite: string;
-    }>;
-    acceptPhone(options: {
-        phonePeerId: string;
-        token?: string;
-    }, issuedInvite?: CadreInvite): Promise<void>;
-    removePeer(peerId: string): Promise<void>;
-    encodeInvite(invite: CadreInvite): string;
-    /**
-     * Enumerate the cadre's *addressable* peers (over the admin channel) —
-     * anyone with an address record, including devices no owner vouched for.
-     * Used only for {@link removeMember}, where "the row exists" is the point.
-     */
-    listMembers(): Promise<Array<{
-        peerId: string;
-        multiaddr: string | null;
-    }>>;
-    /** Probe whether a peer is *addressable* (over the admin channel). See {@link listMembers}. */
-    isMember(peerId: string): Promise<boolean>;
-    /**
-     * Enumerate the cadre's *authorized* membership (over the admin channel) —
-     * devices an owner key vouched for. Excludes the node's own self-published
-     * row. This is the real membership test the trust-circle listing shows.
-     */
-    listAuthorizedMembers(): Promise<Array<{
-        peerId: string;
-        multiaddr: string | null;
-    }>>;
-    /** Probe whether a peer is *authorized*. See {@link listAuthorizedMembers}. */
-    isAuthorizedMember(peerId: string): Promise<boolean>;
-}
-/**
- * TrustCircleService — orchestrates invite issuance, redemption, and
- * membership management.
- *
- * Membership is canonical in the cadre control DB (`CadrePeer` table),
- * reached over the owner node's admin channel; labels and pending tokens
- * live in the host-local `TrustCircleStore`. When the node is unreachable,
- * owner operations surface `node_unavailable` (→ 503) and `list()`
- * degrades to the local labels file.
- */
-export declare class TrustCircleService {
-    private readonly cadreNode;
-    private readonly store;
-    private readonly now;
-    /**
-     * In-flight redemption claims (by token). Serialises concurrent redeems
-     * for the same token without burning the durable pending row before
-     * `acceptPhone` succeeds. Intra-process only — the orchestrator enforces
-     * single-process ownership of a given rootDir, so no file lock is needed.
-     */
-    private readonly inFlightRedemptions;
-    constructor(opts: TrustCircleServiceOptions);
-    /**
-     * Issue a new invite. Generates a token, persists a pending row, and
-     * delegates to cadre-core to embed the host's owner addresses.
-     */
-    issueInvite(opts: {
-        label: string;
-        ttlMs?: number;
-    }): Promise<{
-        encodedInvite: string;
-        invite: CadreInvite;
-        token: string;
-        expiresAt?: Date;
-    }>;
-    /**
-     * Redeem an invite for an incoming peer ID. On success:
-     *   - cadre-core authorizes the peer (inserts CadrePeer row).
-     *   - The pending row is consumed (one-time enforcement).
-     *   - A labelled member row is written locally.
-     *
-     * Ordering: the synchronous *claim* against `inFlightRedemptions` serialises
-     * concurrent redeems for the same token (second concurrent caller rejects
-     * synchronously before its first await). The durable `removePending` only
-     * runs *after* `acceptPhone` succeeds — so a transient `node_unavailable`
-     * leaves the token re-redeemable rather than permanently burning it.
-     *
-     * Crash-safety tradeoff: if the host crashes between `acceptPhone` success
-     * and the durable `removePending`, a retry will dial in fine but the
-     * owner node's `acceptPhone` will reject the second `CadrePeer` insert
-     * with a PK constraint error (cadre-core does not upsert). That surfaces to
-     * the redeemer as a non-`node_unavailable` failure; the admin can revoke
-     * the lingering pending row. This is a narrower window than the prior
-     * behaviour, where *any* transient node outage burned the token.
-     */
-    redeemInvite(opts: {
-        token: string;
-        peerId: string;
-    }): Promise<{
-        peerId: string;
-        label: string;
-    }>;
-    /** Revoke a pending invite by token. No-op if not found. */
-    revokePending(token: string): Promise<void>;
-    /**
-     * Remove an authorised member. Deletes the CadrePeer row and the local
-     * label. Throws not_found when the peer is in neither place.
-     *
-     * NOTE: no special case for the host's own peer ID — the local UI hides the
-     * Remove button on the `self` row, but `DELETE /auth/members/<ownPeerId>`
-     * (or `cadre-host trust revoke <ownPeerId>`) will delete the node's own
-     * `CadrePeer` row. cadre-core re-registers self on node start, so a restart
-     * heals it. If that stops being true, or the removal path grows a
-     * non-loopback caller, guard `self` rows here.
-     */
-    removeMember(peerId: string): Promise<void>;
-    /** Whether the peer is present in the cadre's CadrePeer table. */
-    isMember(peerId: string): Promise<boolean>;
-    /**
-     * UI snapshot. Joins the *authorized* membership (fetched over the admin
-     * channel) with local labels; prunes any orphan labels (peer is no longer
-     * authorised). Addressable-but-unauthorized peers — devices that merely
-     * published an address record without an owner voucher — are deliberately
-     * excluded; this is the listing an operator uses to decide who belongs.
-     * The node's own self-published row is spliced back in from the local
-     * label, since the authorized set excludes self by design. When the owner
-     * node is unreachable, degrades to the local labels file so listing keeps
-     * working while the node is down.
-     */
-    list(): Promise<TrustCircleSnapshot>;
-    /**
-     * Translate an admin-channel transport failure into a `node_unavailable`
-     * TrustCircleError (→ 503). Re-throws anything else unchanged. Returns
-     * `never` so callers can `.catch(err => this.toDomainError(err))`.
-     */
-    private toDomainError;
-}
-/**
- * Wrap a TrustCircleService into the typed handler shape consumed by
- * `cadre-host-local-ui`. Errors propagate as TrustCircleError; the UI ticket
- * maps `.code` → HTTP status.
- */
-export declare function createTrustCircleHandlers(service: TrustCircleService): TrustCircleHandlers;