@serfab/cadre-host 1.13.0 → 1.15.0

package/dist/server/routes/provision-request-validation.d.ts

@@ -1,45 +0,0 @@
-/**
- * The whole shape check for `POST /grants` — one call that either yields the
- * typed {@link DonationProvisionRequest} the `DonationService` is handed, or the
- * message the route answers 400 with.
- *
- * **Why a validator rather than a few more `if`s in the route.** Every field in
- * this body is forwarded into a child process the requester cannot see:
- * `partyId`, `bootstrapNodes` and `profile` are written into the child's
- * `cadre.json` (`orchestrator/host-process-orchestrator.ts`) and `ownerKeys`
- * become its cold-start seed-trust anchors. A field the route forgets to check is
- * not a 400 — it is a donated node that dies at boot, or comes up subtly wrong,
- * with a 201 already sent. Routing the body through one function that *constructs*
- * the request object means a field can only reach the spawn path by having been
- * through here; adding a field to `DonationProvisionRequest` without validating it
- * stops compiling rather than silently shipping.
- *
- * **Division of labour with `DonationService.provision`.** The Ed25519 rule for
- * `ownerKeys` stays in the service, where it is applied by cadre-core's own
- * `requireEd25519PublicKeyB64` — the service is also reached by the respawn path,
- * which replays a persisted record rather than an HTTP body, so the crypto rule
- * has to live there to cover both. What this validator owns for `ownerKeys` is the
- * *container* shape (present, non-empty, all strings), which the service's rule
- * assumes: a number reaching it surfaces as an internal `.trim is not a function`
- * rather than as a message naming what is wrong with the request.
- *
- * The multiaddr rule has no such home — it is duplicated in cadre-provider — so it
- * lives in `bootstrap-node-validation.ts` next to the comment saying so.
- */
-import type { DonationProvisionRequest } from '../../donation/donation-service.js';
-/**
- * Validate a `POST /grants` body and build the request `DonationService.provision`
- * is handed.
- *
- * `grantToken` comes from the `Authorization` bearer rather than the body — a
- * requester does not get to name which grant pays for this — so it is a
- * parameter, not a validated field. Whether that grant is live and within quota is
- * `provision`'s call, not this function's.
- *
- * @returns the typed provision request, or the message to answer `invalid_request` with.
- */
-export declare function validateProvisionRequest(body: unknown, grantToken: string): {
-    request: DonationProvisionRequest;
-} | {
-    error: string;
-};

package/dist/server/routes/provision-request-validation.js

@@ -1,97 +0,0 @@
-/**
- * The whole shape check for `POST /grants` — one call that either yields the
- * typed {@link DonationProvisionRequest} the `DonationService` is handed, or the
- * message the route answers 400 with.
- *
- * **Why a validator rather than a few more `if`s in the route.** Every field in
- * this body is forwarded into a child process the requester cannot see:
- * `partyId`, `bootstrapNodes` and `profile` are written into the child's
- * `cadre.json` (`orchestrator/host-process-orchestrator.ts`) and `ownerKeys`
- * become its cold-start seed-trust anchors. A field the route forgets to check is
- * not a 400 — it is a donated node that dies at boot, or comes up subtly wrong,
- * with a 201 already sent. Routing the body through one function that *constructs*
- * the request object means a field can only reach the spawn path by having been
- * through here; adding a field to `DonationProvisionRequest` without validating it
- * stops compiling rather than silently shipping.
- *
- * **Division of labour with `DonationService.provision`.** The Ed25519 rule for
- * `ownerKeys` stays in the service, where it is applied by cadre-core's own
- * `requireEd25519PublicKeyB64` — the service is also reached by the respawn path,
- * which replays a persisted record rather than an HTTP body, so the crypto rule
- * has to live there to cover both. What this validator owns for `ownerKeys` is the
- * *container* shape (present, non-empty, all strings), which the service's rule
- * assumes: a number reaching it surfaces as an internal `.trim is not a function`
- * rather than as a message naming what is wrong with the request.
- *
- * The multiaddr rule has no such home — it is duplicated in cadre-provider — so it
- * lives in `bootstrap-node-validation.ts` next to the comment saying so.
- */
-import { validateBootstrapNodes } from './bootstrap-node-validation.js';
-/** `partyId` becomes `controlNetwork.partyId` in the child's config. */
-function validatePartyId(value) {
-    if (typeof value !== 'string' || value.trim().length === 0) {
-        return { error: 'partyId is required' };
-    }
-    return { partyId: value.trim() };
-}
-/**
- * Container shape only — see the module comment: the per-key Ed25519 rule is
- * `DonationService.provision`'s, so the respawn path gets it too.
- */
-function validateOwnerKeys(value) {
-    if (!Array.isArray(value) || value.length === 0) {
-        return { error: 'ownerKeys is required' };
-    }
-    if (!value.every((key) => typeof key === 'string')) {
-        return { error: 'ownerKeys must be an array of strings' };
-    }
-    return { ownerKeys: value };
-}
-/** Absent means `storage` — see {@link DonationProvisionRequest.profile}. */
-function validateProfile(value) {
-    if (value === undefined)
-        return {};
-    if (value !== 'storage' && value !== 'transaction') {
-        return { error: 'profile must be "storage" or "transaction"' };
-    }
-    return { profile: value };
-}
-/**
- * Validate a `POST /grants` body and build the request `DonationService.provision`
- * is handed.
- *
- * `grantToken` comes from the `Authorization` bearer rather than the body — a
- * requester does not get to name which grant pays for this — so it is a
- * parameter, not a validated field. Whether that grant is live and within quota is
- * `provision`'s call, not this function's.
- *
- * @returns the typed provision request, or the message to answer `invalid_request` with.
- */
-export function validateProvisionRequest(body, grantToken) {
-    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
-        return { error: 'request body must be a JSON object' };
-    }
-    const fields = body;
-    const partyId = validatePartyId(fields.partyId);
-    if ('error' in partyId)
-        return partyId;
-    const bootstrap = validateBootstrapNodes(fields.bootstrapNodes);
-    if ('error' in bootstrap)
-        return bootstrap;
-    const ownerKeys = validateOwnerKeys(fields.ownerKeys);
-    if ('error' in ownerKeys)
-        return ownerKeys;
-    const profile = validateProfile(fields.profile);
-    if ('error' in profile)
-        return profile;
-    return {
-        request: {
-            grantToken,
-            partyId: partyId.partyId,
-            bootstrapNodes: bootstrap.nodes,
-            ownerKeys: ownerKeys.ownerKeys,
-            ...(profile.profile ? { profile: profile.profile } : {}),
-        },
-    };
-}
-//# sourceMappingURL=provision-request-validation.js.map

package/dist/server/routes/provision-request-validation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provision-request-validation.js","sourceRoot":"","sources":["../../../src/server/routes/provision-request-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,wEAAwE;AACxE,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAa,EACb,UAAkB;IAElB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAE/C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAEvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAEvC,OAAO;QACL,OAAO,EAAE;YACP,UAAU;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,SAAS,CAAC,KAAK;YAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;KACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/strands.d.ts

@@ -1,20 +0,0 @@
-/**
- * Strand HTTP routes — thin adapters around `StrandHandlers`
- * (`createStrandHandlers(service)`).
- *
- * Mount path: `/api/strands` — a UI-only surface with no CLI contract to
- * preserve. (The `/auth/*` and `/nat/*` mounts sit outside `/api` only because
- * the existing CLI already targets those URLs.) Envelope form therefore follows
- * the other `/api/*` routes: `{ ok: true, data }`.
- *
- * A removal that actually issued a delete publishes `strands-changed` so other
- * open tabs refresh. A call that found no row publishes nothing — nothing changed.
- */
-import type { FastifyInstance } from 'fastify';
-import type { StrandHandlers } from '../../strands/types.js';
-import type { EventBus } from '../events/bus.js';
-export interface StrandRoutesOptions {
-    handlers: StrandHandlers;
-    events: EventBus;
-}
-export declare function registerStrandRoutes(app: FastifyInstance, opts: StrandRoutesOptions): void;

package/dist/server/routes/strands.js

@@ -1,38 +0,0 @@
-/**
- * Strand HTTP routes — thin adapters around `StrandHandlers`
- * (`createStrandHandlers(service)`).
- *
- * Mount path: `/api/strands` — a UI-only surface with no CLI contract to
- * preserve. (The `/auth/*` and `/nat/*` mounts sit outside `/api` only because
- * the existing CLI already targets those URLs.) Envelope form therefore follows
- * the other `/api/*` routes: `{ ok: true, data }`.
- *
- * A removal that actually issued a delete publishes `strands-changed` so other
- * open tabs refresh. A call that found no row publishes nothing — nothing changed.
- */
-/**
- * The only accepted `confirm` values — the same strict pair the admin channel
- * accepts. Not a general truthiness parser: `yes`, `on` and an empty value all
- * count as NOT confirmed, because a guessy parser here would turn a typo into a
- * destroyed membership key.
- *
- * NOTE: deliberately duplicated from cadre-cli's `admin-server.ts` rather than
- * imported — cadre-host depends on cadre-cli for its bin path only, never its
- * source. Keep the two in step by hand; do not DRY them into an import.
- */
-const CONFIRM_VALUES = new Set(['1', 'true']);
-export function registerStrandRoutes(app, opts) {
-    const { handlers, events } = opts;
-    app.get('/api/strands', async () => {
-        return { ok: true, data: await handlers.listStrands() };
-    });
-    app.delete('/api/strands/:id', async (request) => {
-        const confirm = typeof request.query.confirm === 'string' && CONFIRM_VALUES.has(request.query.confirm);
-        const result = await handlers.removeStrand(request.params.id, { confirm });
-        if (result.removed) {
-            events.publish({ type: 'strands-changed', kind: 'removed' });
-        }
-        return { ok: true, data: result };
-    });
-}
-//# sourceMappingURL=strands.js.map

package/dist/server/routes/strands.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"strands.js","sourceRoot":"","sources":["../../../src/server/routes/strands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9C,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,IAAyB;IAClF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAElC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CACR,kBAAkB,EAClB,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/server/routes/trust-circle.d.ts

@@ -1,17 +0,0 @@
-/**
- * Trust-circle HTTP routes — thin adapters around `TrustCircleHandlers`
- * (`createTrustCircleHandlers(service)`). Side-effects (invite issued,
- * pending revoked, member removed) emit a `trust-circle-changed` bus
- * event so the SPA can refresh without polling.
- *
- * Mount path: `/auth/*` — the existing CLI (cadre-host invite / trust)
- * already targets these URLs; do not change them.
- */
-import type { FastifyInstance } from 'fastify';
-import type { TrustCircleHandlers } from '../../auth/types.js';
-import type { EventBus } from '../events/bus.js';
-export interface TrustCircleRoutesOptions {
-    handlers: TrustCircleHandlers;
-    events: EventBus;
-}
-export declare function registerTrustCircleRoutes(app: FastifyInstance, opts: TrustCircleRoutesOptions): void;

package/dist/server/routes/trust-circle.js

@@ -1,35 +0,0 @@
-/**
- * Trust-circle HTTP routes — thin adapters around `TrustCircleHandlers`
- * (`createTrustCircleHandlers(service)`). Side-effects (invite issued,
- * pending revoked, member removed) emit a `trust-circle-changed` bus
- * event so the SPA can refresh without polling.
- *
- * Mount path: `/auth/*` — the existing CLI (cadre-host invite / trust)
- * already targets these URLs; do not change them.
- */
-export function registerTrustCircleRoutes(app, opts) {
-    const { handlers, events } = opts;
-    app.get('/auth/trust-circle', async () => {
-        return handlers.listTrustCircle();
-    });
-    app.post('/auth/invites', async (request) => {
-        const body = (request.body ?? {});
-        const label = typeof body.label === 'string' ? body.label : '';
-        const ttlMs = typeof body.ttlMs === 'number' ? body.ttlMs : undefined;
-        const args = ttlMs !== undefined ? { label, ttlMs } : { label };
-        const result = await handlers.postInvite(args);
-        events.publish({ type: 'trust-circle-changed', kind: 'invited' });
-        return result;
-    });
-    app.delete('/auth/invites/:token', async (request) => {
-        await handlers.deleteInvite(request.params.token);
-        events.publish({ type: 'trust-circle-changed', kind: 'revoked' });
-        return { ok: true };
-    });
-    app.delete('/auth/members/:peerId', async (request) => {
-        await handlers.deleteMember(request.params.peerId);
-        events.publish({ type: 'trust-circle-changed', kind: 'revoked' });
-        return { ok: true };
-    });
-}
-//# sourceMappingURL=trust-circle.js.map

package/dist/server/routes/trust-circle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-circle.js","sourceRoot":"","sources":["../../../src/server/routes/trust-circle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,MAAM,UAAU,yBAAyB,CAAC,GAAoB,EAAE,IAA8B;IAC5F,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAElC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QACvC,OAAO,QAAQ,CAAC,eAAe,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAgC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClF,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAiC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/strands/index.d.ts

@@ -1,7 +0,0 @@
-/**
- * Strand management for cadre-host. See ./strand-service.ts and ./types.ts.
- */
-export { StrandService, createStrandHandlers } from './strand-service.js';
-export type { StrandServiceOptions, CadreNodeLike } from './strand-service.js';
-export { StrandError } from './types.js';
-export type { StrandSummary, StrandListSnapshot, StrandRemovalResult, StrandHandlers, StrandErrorCode, } from './types.js';

package/dist/strands/index.js

@@ -1,6 +0,0 @@
-/**
- * Strand management for cadre-host. See ./strand-service.ts and ./types.ts.
- */
-export { StrandService, createStrandHandlers } from './strand-service.js';
-export { StrandError } from './types.js';
-//# sourceMappingURL=index.js.map

package/dist/strands/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/strands/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/strands/strand-service.d.ts

@@ -1,50 +0,0 @@
-import type { StrandHandlers, StrandListSnapshot, StrandRemovalResult } from './types.js';
-/**
- * Minimal slice of the owner node that StrandService uses. Declared here (rather
- * than reaching into `OwnerNodeClient`) so unit tests can inject a fake without
- * standing up an admin channel — the third such trimmed interface the client
- * satisfies, alongside the trust-circle and NAT ones.
- */
-export interface CadreNodeLike {
-    listStrands(): Promise<StrandListSnapshot>;
-    removeStrand(strandId: string, opts: {
-        confirm: boolean;
-    }): Promise<StrandRemovalResult>;
-}
-/** Constructor options. */
-export interface StrandServiceOptions {
-    /** The owner node — provides listStrands / removeStrand over the admin channel. */
-    cadreNode: CadreNodeLike;
-}
-/**
- * StrandService — validation and error translation over the owner node's strand
- * admin routes.
- *
- * It owns no state and makes no policy. In particular it does NOT decide whether a
- * closed strand needs confirmation: it never reads the row, so it could only guess.
- * The node enforces that rule and answers `confirmation_required`; this layer
- * forwards the caller's flag verbatim and surfaces the refusal as a distinct code
- * so the UI can raise the right dialog.
- */
-export declare class StrandService {
-    private readonly cadreNode;
-    constructor(opts: StrandServiceOptions);
-    /** This party's strands, plus the node's current control-connection count. */
-    list(): Promise<StrandListSnapshot>;
-    /**
-     * Remove this party's participation in one strand.
-     *
-     * `confirm` is forwarded exactly as given — never defaulted to true, never
-     * re-sent as true after a refusal. A closed strand's row carries this party's
-     * membership key for that network and is stored nowhere else, so an automatic
-     * retry would destroy it on the caller's behalf.
-     */
-    remove(rawId: string, opts: {
-        confirm: boolean;
-    }): Promise<StrandRemovalResult>;
-}
-/**
- * Wrap a StrandService into the typed handler shape the local UI server mounts.
- * Errors propagate as StrandError; `server/error-handler.ts` maps `.code` → status.
- */
-export declare function createStrandHandlers(service: StrandService): StrandHandlers;

package/dist/strands/strand-service.js

@@ -1,103 +0,0 @@
-import debug from 'debug';
-import { OwnerNodeUnavailableError } from '../owner/owner-node-client.js';
-import { StrandError } from './types.js';
-const log = debug('cadre:host:strands');
-/**
- * StrandService — validation and error translation over the owner node's strand
- * admin routes.
- *
- * It owns no state and makes no policy. In particular it does NOT decide whether a
- * closed strand needs confirmation: it never reads the row, so it could only guess.
- * The node enforces that rule and answers `confirmation_required`; this layer
- * forwards the caller's flag verbatim and surfaces the refusal as a distinct code
- * so the UI can raise the right dialog.
- */
-export class StrandService {
-    constructor(opts) {
-        this.cadreNode = opts.cadreNode;
-    }
-    /** This party's strands, plus the node's current control-connection count. */
-    async list() {
-        return await this.cadreNode.listStrands().catch((err) => toDomainError(err));
-    }
-    /**
-     * Remove this party's participation in one strand.
-     *
-     * `confirm` is forwarded exactly as given — never defaulted to true, never
-     * re-sent as true after a refusal. A closed strand's row carries this party's
-     * membership key for that network and is stored nowhere else, so an automatic
-     * retry would destroy it on the caller's behalf.
-     */
-    async remove(rawId, opts) {
-        const strandId = validateStrandId(rawId);
-        log('remove %s (confirm=%s)', strandId, opts.confirm);
-        return await this.cadreNode
-            .removeStrand(strandId, { confirm: opts.confirm })
-            .catch((err) => toDomainError(err));
-    }
-}
-/**
- * Trim and reject an id this surface cannot act on. Blank is the only such id.
- *
- * A `/` is deliberately NOT refused. `/api/strands/:id` is one path segment, but a
- * caller that percent-encodes the id reaches this layer with the `/` restored
- * (Fastify decodes `params`), `OwnerNodeClient` re-encodes it, and the admin channel
- * splits on the still-encoded `%2F` and decodes it back — so the whole chain carries
- * it. Refusing here would break the only form that works, while doing nothing about
- * an UNencoded `/`, which never reaches this handler at all (the router 404s it).
- */
-function validateStrandId(rawId) {
-    const strandId = typeof rawId === 'string' ? rawId.trim() : '';
-    if (!strandId) {
-        throw new StrandError('invalid_id', 'A strand id is required');
-    }
-    return strandId;
-}
-/**
- * Translate an owner-node failure into the strand error vocabulary.
- *
- * `OwnerNodeUnavailableError` is thrown for *every* non-ok admin response, not only
- * for a node that is down — so read `nodeCode` first and fall back to
- * `node_unavailable` only when nothing better fits. Reporting a 428 as "your node is
- * down" would be actively misleading.
- *
- * Declared to return `never` so callers can `.catch((err) => toDomainError(err))`.
- *
- * NOTE: the trust-circle and NAT services translate the SAME error blanket-style —
- * every `OwnerNodeUnavailableError` becomes `node_unavailable` — because neither has
- * a code worth distinguishing yet. If a second surface ever needs a code-aware
- * mapping, hoist this switch into a shared owner-error translator instead of growing
- * a third copy.
- */
-function toDomainError(err) {
-    if (!(err instanceof OwnerNodeUnavailableError)) {
-        throw err instanceof Error ? err : new Error(String(err));
-    }
-    switch (err.nodeCode) {
-        case 'confirmation_required':
-            throw new StrandError('confirmation_required', err.message);
-        case 'bad_request':
-            throw new StrandError('invalid_id', err.message);
-        case undefined:
-        case 'not_ready':
-        case 'not_authorized':
-            throw new StrandError('node_unavailable', `Owner node unavailable: ${err.message}`);
-        default:
-            throw new StrandError('internal', err.message);
-    }
-}
-/**
- * Wrap a StrandService into the typed handler shape the local UI server mounts.
- * Errors propagate as StrandError; `server/error-handler.ts` maps `.code` → status.
- */
-export function createStrandHandlers(service) {
-    return {
-        async listStrands() {
-            return await service.list();
-        },
-        async removeStrand(strandId, opts) {
-            return await service.remove(strandId, { confirm: opts.confirm === true });
-        },
-    };
-}
-//# sourceMappingURL=strand-service.js.map

package/dist/strands/strand-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"strand-service.js","sourceRoot":"","sources":["../../src/strands/strand-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAO1E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,GAAG,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAmBxC;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAa;IAGxB,YAAY,IAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAA0B;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,wBAAwB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,MAAM,IAAI,CAAC,SAAS;aACxB,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;aACjD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,CAAC,CAAC,GAAG,YAAY,yBAAyB,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,QAAQ,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,uBAAuB;YAC1B,MAAM,IAAI,WAAW,CAAC,uBAAuB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9D,KAAK,aAAa;YAChB,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,gBAAgB;YACnB,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF;YACE,MAAM,IAAI,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO;QACL,KAAK,CAAC,WAAW;YACf,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI;YAC/B,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/strands/types.d.ts

@@ -1,93 +0,0 @@
-/**
- * Strand-management types for cadre-host.
- *
- * A *strand* is a shared data network this party participates in. Membership is
- * canonical in the cadre control network's `Strand` table, reached over the owner
- * node's loopback admin channel (`GET /admin/strands`,
- * `DELETE /admin/strands/:id?confirm=1`).
- *
- * Unlike the trust circle — which layers host-local labels and pending invites on
- * top of the node's state — this layer holds **no host-local state at all**. There
- * is no `strands.json`. It exists for id validation, for translating the admin
- * channel's error codes into a stable vocabulary the management API can map to HTTP
- * statuses, and for nothing else. Keep it small.
- */
-/** One strand this party belongs to, as projected by the admin channel. */
-export interface StrandSummary {
-    /** The `Strand` row id — what a removal takes. */
-    id: string;
-    /** `'o'` = open, `'c'` = closed (the row carries this party's membership key). */
-    type: 'o' | 'c';
-    /** Whether the owner node currently has a running instance for the id. */
-    running: boolean;
-    /**
-     * The instance's status when running, else `null`. Deliberately `string` rather
-     * than cadre-core's `StrandStatus`: this is a wire projection the manager only
-     * forwards, and widening it keeps cadre-host from tracking a cadre-core union it
-     * never inspects.
-     */
-    status: string | null;
-}
-/** The result of listing this party's strands. */
-export interface StrandListSnapshot {
-    strands: StrandSummary[];
-    /**
-     * Open control-network connections on the owner node; 0 ⇒ writes commit
-     * local-only. A snapshot at read time, not a subscription — treat it as advisory.
-     */
-    controlConnections: number;
-}
-/** The result of removing this party's participation in one strand. */
-export interface StrandRemovalResult {
-    /** The trimmed id the call was about. */
-    strandId: string;
-    /** Whether a row existed before the write. */
-    published: boolean;
-    /** The found row's type; `null` when no row was found. */
-    type: 'o' | 'c' | null;
-    /**
-     * Whether THIS call issued the delete — not that the row was observed to vanish.
-     * The node's read and write are not atomic, so a concurrent removal landing in
-     * between makes this a no-op that still reports `true`.
-     */
-    removed: boolean;
-    /**
-     * The node saw 0 control connections at the end of the call. Sampled on EVERY
-     * call, including one that found no row and wrote nothing — read it as "this
-     * machine currently sees no siblings", and only as "your delete may not have
-     * travelled" when `removed` is also true.
-     */
-    alone: boolean;
-}
-/** Error codes thrown by StrandService. */
-export type StrandErrorCode = 
-/** The id was blank or whitespace-only, here or at the node. */
-'invalid_id'
-/** The node refused a closed-strand removal that carried no confirmation. */
- | 'confirmation_required'
-/** The owner node's admin channel is unreachable / not ready. */
- | 'node_unavailable'
-/** The node answered with a code this layer has no better word for. */
- | 'internal';
-/** Typed error carrying a stable `code` for HTTP mapping. */
-export declare class StrandError extends Error {
-    readonly code: StrandErrorCode;
-    constructor(code: StrandErrorCode, message: string);
-}
-/**
- * Typed handlers exposed to the local UI server for Fastify wiring.
- *
- * Handlers either return typed results or throw a `StrandError` whose `.code`
- * `server/error-handler.ts` maps to an HTTP status:
- *
- *   - `invalid_id`            → 400
- *   - `confirmation_required` → 428
- *   - `node_unavailable`      → 503
- *   - `internal`              → 500
- */
-export interface StrandHandlers {
-    listStrands(): Promise<StrandListSnapshot>;
-    removeStrand(strandId: string, opts: {
-        confirm: boolean;
-    }): Promise<StrandRemovalResult>;
-}

package/dist/strands/types.js

@@ -1,23 +0,0 @@
-/**
- * Strand-management types for cadre-host.
- *
- * A *strand* is a shared data network this party participates in. Membership is
- * canonical in the cadre control network's `Strand` table, reached over the owner
- * node's loopback admin channel (`GET /admin/strands`,
- * `DELETE /admin/strands/:id?confirm=1`).
- *
- * Unlike the trust circle — which layers host-local labels and pending invites on
- * top of the node's state — this layer holds **no host-local state at all**. There
- * is no `strands.json`. It exists for id validation, for translating the admin
- * channel's error codes into a stable vocabulary the management API can map to HTTP
- * statuses, and for nothing else. Keep it small.
- */
-/** Typed error carrying a stable `code` for HTTP mapping. */
-export class StrandError extends Error {
-    constructor(code, message) {
-        super(message);
-        this.name = 'StrandError';
-        this.code = code;
-    }
-}
-//# sourceMappingURL=types.js.map

package/dist/strands/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/strands/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA+DH,6DAA6D;AAC7D,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGpC,YAAY,IAAqB,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}