@serfab/cadre-host 1.13.0 → 1.15.0

package/dist/donation/grant-service.d.ts

@@ -1,80 +0,0 @@
-import type { DonationService } from './donation-service.js';
-import type { GrantStore } from './grant-store.js';
-import type { Grant, GrantAdminHandlers, GrantValidation, GrantValidator } from './types.js';
-/** Default node cap when the admin doesn't specify one. */
-export declare const DEFAULT_MAX_NODES = 1;
-/** Constructor options. */
-export interface GrantServiceOptions {
-    /** Persistent grant store (`grants.json`). */
-    store: GrantStore;
-    /** Clock override for tests. */
-    now?: () => Date;
-}
-/**
- * GrantService — issues, validates, lists, and revokes donation grant tokens.
- *
- * It is the authority for a grant's *identity, expiry, and revocation*, and
- * for the per-grantee *node cap* (`maxNodes`). It is deliberately **not** the
- * authority for how many nodes are currently live under a grant — that tally
- * belongs to the donation service (`2-donation-service`), which persists the
- * grant→node records and can see terminations. `validateForProvision` takes
- * the count as a parameter so the two never drift.
- *
- * All methods are synchronous: issuance/validation/revocation are pure local
- * store operations with no node round-trip (unlike the trust-circle flow,
- * which delegates to the owner node).
- */
-export declare class GrantService implements GrantValidator {
-    private readonly store;
-    private readonly now;
-    constructor(opts: GrantServiceOptions);
-    /**
-     * Issue a new grant. Generates a high-entropy base64url token, persists it,
-     * and returns the whole `Grant` (the CLI/UI prints/QR-encodes the token).
-     */
-    issue(opts: {
-        label: string;
-        maxNodes?: number;
-        ttlMs?: number;
-    }): Grant;
-    /**
-     * Validate a presented bearer token for a non-provisioning op: it must name a
-     * known grant that is neither revoked nor expired. No quota check. Never
-     * throws for a bad token — returns a denial.
-     */
-    validate(token: string): GrantValidation;
-    /**
-     * Validate for a *new* provision request. Runs the identity/expiry/revocation
-     * checks of `validate`, then — only if those pass — consults the
-     * caller-supplied live-node tally against the grant's `maxNodes`.
-     *
-     * Concurrency boundary: this is a pure function of the passed count. Two
-     * provision requests racing at the quota edge (both seeing count = N-1)
-     * would both pass here; serialising them so only one wins is the donation
-     * service's responsibility (`2-donation-service` owns the grant→node lock).
-     */
-    validateForProvision(token: string, liveNodeCount: (token: string) => number): GrantValidation;
-    /**
-     * Revoke a grant by token: mark it revoked (denies future requests).
-     * Idempotent on an already-revoked grant; throws not_found when the token is
-     * unknown.
-     *
-     * This only marks the grant. Tearing down the nodes already donated under it
-     * is `DonationService.terminateGrant`, which the admin handler
-     * ({@link createGrantAdminHandlers}) runs after this unless asked to keep them.
-     */
-    revoke(token: string): void;
-    /** Enumerate all grants (for the CLI / UI). */
-    list(): Grant[];
-}
-/**
- * Wrap a GrantService into the typed handler shape consumed by the loopback
- * management server's `/grants-admin` routes. Errors propagate as GrantError /
- * DonationError; the server maps `.code` → HTTP status.
- *
- * `donations` is where revoke's node teardown, the single-donation terminate and
- * the listing's per-grant node counts come from. Without it there can be no
- * donated nodes, so revoke only marks the grant, every grant lists with no
- * nodes, and `terminateDonation` is left off.
- */
-export declare function createGrantAdminHandlers(service: GrantService, donations?: Pick<DonationService, 'terminate' | 'terminateGrant' | 'list'>): GrantAdminHandlers;

package/dist/donation/grant-service.js

@@ -1,210 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import debug from 'debug';
-import { isLiveDonationStatus } from './donation-store.js';
-import { GrantError } from './types.js';
-const log = debug('cadre:host:grant-service');
-/** Token byte length (base64url-encoded; ~43 chars). Matches trust-circle. */
-const TOKEN_BYTES = 32;
-/** Default node cap when the admin doesn't specify one. */
-export const DEFAULT_MAX_NODES = 1;
-/**
- * GrantService — issues, validates, lists, and revokes donation grant tokens.
- *
- * It is the authority for a grant's *identity, expiry, and revocation*, and
- * for the per-grantee *node cap* (`maxNodes`). It is deliberately **not** the
- * authority for how many nodes are currently live under a grant — that tally
- * belongs to the donation service (`2-donation-service`), which persists the
- * grant→node records and can see terminations. `validateForProvision` takes
- * the count as a parameter so the two never drift.
- *
- * All methods are synchronous: issuance/validation/revocation are pure local
- * store operations with no node round-trip (unlike the trust-circle flow,
- * which delegates to the owner node).
- */
-export class GrantService {
-    constructor(opts) {
-        this.store = opts.store;
-        this.now = opts.now ?? (() => new Date());
-    }
-    /**
-     * Issue a new grant. Generates a high-entropy base64url token, persists it,
-     * and returns the whole `Grant` (the CLI/UI prints/QR-encodes the token).
-     */
-    issue(opts) {
-        const label = normaliseLabel(opts.label);
-        const maxNodes = normaliseMaxNodes(opts.maxNodes);
-        const created = this.now();
-        const grant = {
-            token: generateToken(),
-            label,
-            maxNodes,
-            createdAt: created.toISOString(),
-        };
-        if (opts.ttlMs !== undefined) {
-            if (!Number.isFinite(opts.ttlMs) || opts.ttlMs <= 0) {
-                throw new GrantError('invalid_ttl', `Invalid ttlMs: ${opts.ttlMs}`);
-            }
-            grant.expiresAt = new Date(created.getTime() + opts.ttlMs).toISOString();
-        }
-        this.store.add(grant);
-        log('issued grant "%s" (token=%s, maxNodes=%d, expires=%s)', label, grant.token, maxNodes, grant.expiresAt ?? 'never');
-        return grant;
-    }
-    /**
-     * Validate a presented bearer token for a non-provisioning op: it must name a
-     * known grant that is neither revoked nor expired. No quota check. Never
-     * throws for a bad token — returns a denial.
-     */
-    validate(token) {
-        if (!token)
-            return { ok: false, reason: 'unknown_token' };
-        const grant = this.store.get(token);
-        if (!grant)
-            return { ok: false, reason: 'unknown_token' };
-        // Revocation is an explicit admin action; check it before expiry so a
-        // grant that is both revoked and expired reports the stronger signal.
-        if (grant.revokedAt)
-            return { ok: false, grant, reason: 'revoked' };
-        if (grant.expiresAt) {
-            const expiresAt = new Date(grant.expiresAt);
-            if (Number.isFinite(expiresAt.getTime()) && this.now() > expiresAt) {
-                return { ok: false, grant, reason: 'expired' };
-            }
-        }
-        return { ok: true, grant };
-    }
-    /**
-     * Validate for a *new* provision request. Runs the identity/expiry/revocation
-     * checks of `validate`, then — only if those pass — consults the
-     * caller-supplied live-node tally against the grant's `maxNodes`.
-     *
-     * Concurrency boundary: this is a pure function of the passed count. Two
-     * provision requests racing at the quota edge (both seeing count = N-1)
-     * would both pass here; serialising them so only one wins is the donation
-     * service's responsibility (`2-donation-service` owns the grant→node lock).
-     */
-    validateForProvision(token, liveNodeCount) {
-        const base = this.validate(token);
-        if (!base.ok || !base.grant)
-            return base;
-        const live = liveNodeCount(token);
-        if (live >= base.grant.maxNodes) {
-            return { ok: false, grant: base.grant, reason: 'quota_exceeded' };
-        }
-        return { ok: true, grant: base.grant };
-    }
-    /**
-     * Revoke a grant by token: mark it revoked (denies future requests).
-     * Idempotent on an already-revoked grant; throws not_found when the token is
-     * unknown.
-     *
-     * This only marks the grant. Tearing down the nodes already donated under it
-     * is `DonationService.terminateGrant`, which the admin handler
-     * ({@link createGrantAdminHandlers}) runs after this unless asked to keep them.
-     */
-    revoke(token) {
-        if (!this.store.markRevoked(token, this.now().toISOString())) {
-            throw new GrantError('not_found', `Unknown grant: ${token}`);
-        }
-        log('revoked grant (token=%s)', token);
-    }
-    /** Enumerate all grants (for the CLI / UI). */
-    list() {
-        return this.store.list();
-    }
-}
-/**
- * Wrap a GrantService into the typed handler shape consumed by the loopback
- * management server's `/grants-admin` routes. Errors propagate as GrantError /
- * DonationError; the server maps `.code` → HTTP status.
- *
- * `donations` is where revoke's node teardown, the single-donation terminate and
- * the listing's per-grant node counts come from. Without it there can be no
- * donated nodes, so revoke only marks the grant, every grant lists with no
- * nodes, and `terminateDonation` is left off.
- */
-export function createGrantAdminHandlers(service, donations) {
-    const handlers = {
-        async postGrant(body) {
-            if (!body || typeof body.label !== 'string') {
-                throw new GrantError('invalid_label', 'label is required');
-            }
-            const grant = service.issue({
-                label: body.label,
-                ...(body.maxNodes !== undefined ? { maxNodes: body.maxNodes } : {}),
-                ...(body.ttlMs !== undefined ? { ttlMs: body.ttlMs } : {}),
-            });
-            return { grant };
-        },
-        async listGrants() {
-            const byGrant = groupByGrant(donations?.list() ?? []);
-            return { grants: service.list().map((grant) => toListing(grant, byGrant.get(grant.token) ?? [])) };
-        },
-        async deleteGrant(token, { keepNodes }) {
-            // Revoke first: it throws not_found for an unknown token before any
-            // teardown, and a provision racing this call is then refused as revoked.
-            service.revoke(token);
-            // NOTE: the teardown runs inside the HTTP request, one stop + reclaim per
-            // node in series. Fine for a handful of nodes per grant; if grants ever
-            // carry many, answer after the revoke and tear down in the background.
-            if (keepNodes || !donations)
-                return { terminated: [] };
-            return { terminated: await donations.terminateGrant(token) };
-        },
-    };
-    if (donations) {
-        handlers.terminateDonation = (id) => donations.terminate(id);
-    }
-    return handlers;
-}
-/** One read of the donation store, bucketed by grant token. */
-function groupByGrant(donations) {
-    const byGrant = new Map();
-    for (const donation of donations) {
-        const bucket = byGrant.get(donation.grantToken);
-        if (bucket)
-            bucket.push(donation);
-        else
-            byGrant.set(donation.grantToken, [donation]);
-    }
-    return byGrant;
-}
-/**
- * `liveNodes` uses the quota's own rule; `donations` is the set a revoke tears
- * down (every record not yet `terminated`, `error` included), so the admin can be
- * told the real count before confirming.
- */
-function toListing(grant, donations) {
-    const unterminated = donations.filter((d) => d.status !== 'terminated');
-    return {
-        ...grant,
-        liveNodes: unterminated.filter((d) => isLiveDonationStatus(d.status)).length,
-        donations: unterminated.map(({ id, status }) => ({ id, status })),
-    };
-}
-function generateToken() {
-    // base64url so it survives in URLs, QR codes, and shell arguments.
-    return randomBytes(TOKEN_BYTES).toString('base64url');
-}
-function normaliseLabel(label) {
-    if (typeof label !== 'string') {
-        throw new GrantError('invalid_label', 'label must be a string');
-    }
-    const trimmed = label.trim();
-    if (trimmed.length === 0) {
-        throw new GrantError('invalid_label', 'label must not be empty');
-    }
-    if (trimmed.length > 200) {
-        throw new GrantError('invalid_label', 'label must be 200 characters or fewer');
-    }
-    return trimmed;
-}
-function normaliseMaxNodes(maxNodes) {
-    if (maxNodes === undefined)
-        return DEFAULT_MAX_NODES;
-    if (typeof maxNodes !== 'number' || !Number.isInteger(maxNodes) || maxNodes < 1) {
-        throw new GrantError('invalid_max_nodes', `maxNodes must be a positive integer (got ${JSON.stringify(maxNodes)})`);
-    }
-    return maxNodes;
-}
-//# sourceMappingURL=grant-service.js.map

package/dist/donation/grant-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant-service.js","sourceRoot":"","sources":["../../src/donation/grant-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAU3D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,8EAA8E;AAC9E,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAUnC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAY;IAIvB,YAAY,IAAyB;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAA0D;QAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAU;YACnB,KAAK,EAAE,aAAa,EAAE;YACtB,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;SACjC,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,GAAG,CAAC,uDAAuD,EACzD,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE1D,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEpE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAClB,KAAa,EACb,aAAwC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,+CAA+C;IAC/C,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAqB,EACrB,SAA0E;IAE1E,MAAM,QAAQ,GAAuB;QACnC,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACrG,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE;YACpC,oEAAoE;YACpE,yEAAyE;YACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,CAAC;KACF,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,CAAC,iBAAiB,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,SAAS,YAAY,CAAC,SAAyB;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAY,EAAE,SAAyB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC5E,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,mEAAmE;IACnE,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB;IAC1C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/donation/grant-store.d.ts

@@ -1,38 +0,0 @@
-import type { Grant, GrantFile } from './types.js';
-/**
- * Atomic JSON store for `grants.json`. Modelled on `auth/trust-circle-store.ts`:
- * a single file, written to `<path>.tmp` then renamed, with an in-memory cache
- * keyed by token.
- *
- * Unlike the trust-circle pending rows, grants are **not** self-reaping: a
- * grant may legitimately outlive many nodes, so expiry is evaluated at
- * validate time (in `GrantService`) and the admin removes stale grants
- * explicitly. This store keeps no clock.
- *
- * Concurrency assumption: only one cadre-host process owns a given rootDir
- * (the orchestrator already enforces this). No file-locking primitives.
- */
-export declare class GrantStore {
-    private readonly path;
-    private cache;
-    constructor(rootDir: string);
-    filePath(): string;
-    /**
-     * Load (with caching). A missing file returns an empty store (fresh
-     * install). A present-but-malformed file throws — silently wiping it would
-     * revoke every grantee at once.
-     */
-    load(): GrantFile;
-    /** Persist the current state atomically (write then rename). */
-    save(state: GrantFile): void;
-    add(grant: Grant): void;
-    get(token: string): Grant | undefined;
-    list(): Grant[];
-    remove(token: string): boolean;
-    /**
-     * Mark a grant revoked at the given ISO instant. Idempotent: an
-     * already-revoked grant keeps its original `revokedAt`. Returns false when
-     * the token is unknown.
-     */
-    markRevoked(token: string, at: string): boolean;
-}

package/dist/donation/grant-store.js

@@ -1,135 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import debug from 'debug';
-import { GrantError } from './types.js';
-const log = debug('cadre:host:grant-store');
-const FILE_VERSION = 1;
-/**
- * Atomic JSON store for `grants.json`. Modelled on `auth/trust-circle-store.ts`:
- * a single file, written to `<path>.tmp` then renamed, with an in-memory cache
- * keyed by token.
- *
- * Unlike the trust-circle pending rows, grants are **not** self-reaping: a
- * grant may legitimately outlive many nodes, so expiry is evaluated at
- * validate time (in `GrantService`) and the admin removes stale grants
- * explicitly. This store keeps no clock.
- *
- * Concurrency assumption: only one cadre-host process owns a given rootDir
- * (the orchestrator already enforces this). No file-locking primitives.
- */
-export class GrantStore {
-    constructor(rootDir) {
-        this.cache = null;
-        mkdirSync(rootDir, { recursive: true });
-        this.path = join(rootDir, 'grants.json');
-    }
-    filePath() {
-        return this.path;
-    }
-    /**
-     * Load (with caching). A missing file returns an empty store (fresh
-     * install). A present-but-malformed file throws — silently wiping it would
-     * revoke every grantee at once.
-     */
-    load() {
-        if (this.cache)
-            return this.cache;
-        if (!existsSync(this.path)) {
-            this.cache = emptyFile();
-            return this.cache;
-        }
-        let raw;
-        try {
-            raw = readFileSync(this.path, 'utf8');
-        }
-        catch (err) {
-            throw new GrantError('storage_error', `failed to read grants file at ${this.path}: ${err.message}`);
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(raw);
-        }
-        catch (err) {
-            throw new GrantError('storage_error', `grants file at ${this.path} is not valid JSON: ${err.message}`);
-        }
-        if (!isGrantFile(parsed)) {
-            throw new GrantError('storage_error', `grants file at ${this.path} has unexpected shape`);
-        }
-        this.cache = parsed;
-        return this.cache;
-    }
-    /** Persist the current state atomically (write then rename). */
-    save(state) {
-        // NOTE: rewrites the whole grants.json on every mutation. Fine at household
-        // scale (a handful of grantees); if grant counts ever grow large, switch to
-        // an append/compact log or per-token files.
-        mkdirSync(dirname(this.path), { recursive: true });
-        const payload = JSON.stringify({ ...state, version: FILE_VERSION }, null, 2);
-        const tmp = `${this.path}.tmp`;
-        try {
-            writeFileSync(tmp, payload, { encoding: 'utf8' });
-            renameSync(tmp, this.path);
-        }
-        catch (err) {
-            // Surface as storage_error (→ 500) like load(), not a bare Error (→
-            // "internal"); a write failure on issue/revoke should read consistently.
-            throw new GrantError('storage_error', `failed to write grants file at ${this.path}: ${err.message}`);
-        }
-        this.cache = { ...state, version: FILE_VERSION };
-        log('saved grants (%d) to %s', Object.keys(state.grants).length, this.path);
-    }
-    add(grant) {
-        const state = this.load();
-        const { token, ...rest } = grant;
-        state.grants[token] = rest;
-        this.save(state);
-    }
-    get(token) {
-        const state = this.load();
-        const row = state.grants[token];
-        if (!row)
-            return undefined;
-        return { token, ...row };
-    }
-    list() {
-        const state = this.load();
-        return Object.entries(state.grants).map(([token, row]) => ({ token, ...row }));
-    }
-    remove(token) {
-        const state = this.load();
-        if (!(token in state.grants))
-            return false;
-        delete state.grants[token];
-        this.save(state);
-        return true;
-    }
-    /**
-     * Mark a grant revoked at the given ISO instant. Idempotent: an
-     * already-revoked grant keeps its original `revokedAt`. Returns false when
-     * the token is unknown.
-     */
-    markRevoked(token, at) {
-        const state = this.load();
-        const row = state.grants[token];
-        if (!row)
-            return false;
-        if (!row.revokedAt)
-            row.revokedAt = at;
-        this.save(state);
-        return true;
-    }
-}
-function emptyFile() {
-    return { version: FILE_VERSION, grants: {} };
-}
-function isGrantFile(v) {
-    if (!v || typeof v !== 'object')
-        return false;
-    const obj = v;
-    if (obj.version !== FILE_VERSION)
-        return false;
-    if (!obj.grants || typeof obj.grants !== 'object')
-        return false;
-    return true;
-}
-//# sourceMappingURL=grant-store.js.map

package/dist/donation/grant-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/donation/grant-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE5C,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,UAAU;IAIrB,YAAY,OAAe;QAFnB,UAAK,GAAqB,IAAI,CAAC;QAGrC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,iCAAiC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kBAAkB,IAAI,CAAC,IAAI,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kBAAkB,IAAI,CAAC,IAAI,uBAAuB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,KAAgB;QACnB,4EAA4E;QAC5E,4EAA4E;QAC5E,4CAA4C;QAC5C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,yEAAyE;YACzE,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,kCAAkC,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,GAAG,CAAC,KAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,KAAa,EAAE,EAAU;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/donation/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Donation grant-token layer for cadre-host. See ./types.ts, ./grant-store.ts,
- * and ./grant-service.ts.
- *
- * This layer gates *who may ask this host to donate a node*. The lifecycle
- * service that consumes a validated grant to actually provision a node lands in
- * the `2-donation-service` ticket, which imports the `GrantValidator` interface
- * defined here.
- */
-export { GrantStore } from './grant-store.js';
-export { GrantService, createGrantAdminHandlers, DEFAULT_MAX_NODES, } from './grant-service.js';
-export type { GrantServiceOptions } from './grant-service.js';
-export { GrantError, DonationError } from './types.js';
-export type { Grant, GrantListing, GrantDenyReason, GrantValidation, GrantValidator, GrantFile, GrantAdminHandlers, GrantErrorCode, } from './types.js';
-export { DonationStore, isLiveDonationStatus } from './donation-store.js';
-export { DonationService, DONATION_AWAITING_SEED_TTL_MS, DONATION_PROVISIONING_TTL_MS, DONATION_REAP_SWEEP_MS, } from './donation-service.js';
-export type { DonationOrchestrator, DonationProvisionRequest, DonationSeedResult, DonationPeerInfo, DonationServiceOptions, RespawnResult, } from './donation-service.js';
-export { DonationSupervisor, DONATION_RESPAWN_BACKOFF_BASE_MS, DONATION_RESPAWN_BACKOFF_MAX_MS, DONATION_RESPAWN_MAX_ATTEMPTS, DONATION_RESPAWN_HEALTHY_MS, DONATION_RESPAWN_SWEEP_MS, } from './donation-supervisor.js';
-export type { DonationSupervisorOptions, SupervisedOrchestrator, } from './donation-supervisor.js';
-export type { Donation, DonationView, DonationStatus, DonationFile, DonationErrorCode, } from './types.js';

package/dist/donation/index.js

@@ -1,17 +0,0 @@
-/**
- * Donation grant-token layer for cadre-host. See ./types.ts, ./grant-store.ts,
- * and ./grant-service.ts.
- *
- * This layer gates *who may ask this host to donate a node*. The lifecycle
- * service that consumes a validated grant to actually provision a node lands in
- * the `2-donation-service` ticket, which imports the `GrantValidator` interface
- * defined here.
- */
-export { GrantStore } from './grant-store.js';
-export { GrantService, createGrantAdminHandlers, DEFAULT_MAX_NODES, } from './grant-service.js';
-export { GrantError, DonationError } from './types.js';
-/* ──────────────── donation lifecycle (2-donation-service) ──────────────── */
-export { DonationStore, isLiveDonationStatus } from './donation-store.js';
-export { DonationService, DONATION_AWAITING_SEED_TTL_MS, DONATION_PROVISIONING_TTL_MS, DONATION_REAP_SWEEP_MS, } from './donation-service.js';
-export { DonationSupervisor, DONATION_RESPAWN_BACKOFF_BASE_MS, DONATION_RESPAWN_BACKOFF_MAX_MS, DONATION_RESPAWN_MAX_ATTEMPTS, DONATION_RESPAWN_HEALTHY_MS, DONATION_RESPAWN_SWEEP_MS, } from './donation-supervisor.js';
-//# sourceMappingURL=index.js.map

package/dist/donation/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/donation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYvD,+EAA+E;AAE/E,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}