@serfab/cadre-host 1.13.0 → 1.15.0

package/src/server/routes/bootstrap-node-validation.ts

@@ -1,206 +0,0 @@
-/**
- * Shape validation for the requester-supplied `bootstrapNodes` of `POST /grants`
- * — the requester's control-network addresses the donated node is started with
- * (written into the child's `cadre.json` as `controlNetwork.bootstrapNodes` by
- * `orchestrator/host-process-orchestrator.ts`) and hands to `@libp2p/bootstrap`.
- *
- * Its own module rather than part of `grants.ts`: the per-entry rule is a duplicate
- * of cadre-provider's copy (`packages/cadre-provider/src/server/bootstrap-node-validation.ts`)
- * and must stay identical to it, so it is worth reading, testing and changing on
- * its own, without a routing file around it — the same arrangement cadre-provider
- * uses for its restatement of cadre-core's owner-key rule.
- *
- * ## An empty list is accepted — where this copy differs, on purpose
- *
- * The field may be absent or `[]`; cadre-provider's copy still requires at least one
- * address. A lent node's requester is typically a phone, and a phone has no address
- * to give — its node listens on nothing and can only dial out. Such a requester sends
- * no addresses and dials the node itself, at the WebSocket address
- * `GET /grants/:id/peer` reports. The node starts with no bootstrap peers and waits,
- * and admits that first inbound connection because it holds no authorized members
- * yet (`admitInboundControlConnection` / `authorizeInboundControlStream` in
- * `cadre-core/src/cadre-node.ts`). A provider container has no such requester yet, so
- * there an empty list is still the node-comes-up-alone failure described below
- * (`backlog/feat-provider-drone-reachable-by-phone`).
- *
- * The difference is at the list level only: every entry that IS given must pass the
- * rule below, which is identical in both packages.
- *
- * ## The rule, and why each clause is there
- *
- * An entry is usable exactly when it is a string, parses as a multiaddr, carries
- * a `/p2p/<peerId>` component whose peer id decodes, and says where that peer is.
- * Each clause corresponds to a distinct downstream failure the caller would
- * otherwise never be told about — the value is forwarded verbatim into the spawned
- * child, so every one of these surfaces where the caller cannot see it:
- *
- * - **Not parsable as a multiaddr → the child dies at boot.** `@libp2p/bootstrap`'s
- *   constructor maps `multiaddr()` over the whole list *before* filtering anything,
- *   and `multiaddr()` throws on a string that does not start with `/` (and on a
- *   non-string outright). libp2p construction throws and the node never starts.
- * - **No `/p2p/<peerId>` → the node starts and never joins.** The quiet one.
- *   `/ip4/127.0.0.1/tcp/4001` parses fine, then `@libp2p/bootstrap` filters it out
- *   ("invalid bootstrap multiaddr without peer id", logged inside the child) and
- *   the node comes up with *zero* bootstrap peers: healthy-looking, permanently
- *   alone, never reaching the party it was created for. cadre-core's
- *   `getBootstrapPeerIds` (`packages/cadre-core/src/cadre-node.ts`) skips such an
- *   entry silently for the same reason.
- * - **Malformed peer id → the child dies at boot.** `multiaddr()` does *not*
- *   validate the `/p2p/` value — parsing `/ip4/1.2.3.4/tcp/1/p2p/12D3KooReq` yields
- *   a `p2p` component whose value is the junk string unchanged — but
- *   `@libp2p/bootstrap` then calls `peerIdFromString` on it, unguarded, and it
- *   throws `Incorrect length`. A truncated copy-paste of a 52-character peer id is
- *   the likeliest human typo in this field.
- * - **No location at all → the node starts and never joins.** `/p2p/<peerId>` (and
- *   `/p2p/<relay>/p2p-circuit/p2p/<target>`) parses and names a decodable peer, and
- *   `@libp2p/bootstrap` keeps it — but it says nothing about *where* the peer is, so
- *   libp2p finds no transport for it and the dial fails with no valid addresses.
- *   The node comes up with a bootstrap peer it can never reach, which looks the same
- *   from outside as having none. Only the total absence of a location is rejected:
- *   which transports the child can actually dial is the embedder's choice
- *   (`NetworkConfig.transports`), invisible from here, so a partial address like
- *   `/ip4/1.2.3.4/p2p/<peerId>` is deliberately left to the child.
- *
- * The peer id is read the way `@libp2p/bootstrap` reads it — the `p2p` components
- * of `getComponents()` — rather than through the deprecated `getPeerId()`, so the
- * two cannot disagree about which part of the address is the peer. Bootstrap uses
- * only the *last* `p2p` component; this checks **every** one, so the relay half of
- * a `…/p2p/<relay>/p2p-circuit/p2p/<target>` address must decode too. An address
- * naming an undecodable relay is not dialable either, and bootstrap's own
- * `P2P.matches` filter accepts any address carrying a `p2p` component, so nothing
- * this accepts is dropped there.
- *
- * Requiring a multiaddr also closes a downstream ambiguity on the *other* side of
- * this rule: cadre-provider joins its list with `,` into `CADRE_BOOTSTRAP_NODES`
- * and cadre-cli's env loader splits it back on `,`, so an entry containing a comma
- * would silently become two addresses there. This host writes JSON rather than an
- * env var and so is not exposed to that, but the two per-entry rules are kept
- * identical — see the note about manual upkeep below.
- *
- * Reachability is deliberately NOT checked: a well-formed address for a peer that
- * happens to be down is indistinguishable here from one that is up, and no
- * boundary check can tell them apart. This validates the *shape* the child must be
- * able to parse, nothing more.
- *
- * Keeping the two per-entry rules in step is **manual** — neither package can see
- * the other's rule, so no test can compare them. What the tests give instead is a
- * tripwire on each side: `../__tests__/bootstrap-node-validation.test.ts` here and
- * `packages/cadre-provider/src/server/__tests__/bootstrap-node-validation.test.ts`
- * there each pin their own copy to the same per-entry accept/reject table (the
- * empty-list row is the one that differs), so changing either rule fails that
- * package's own suite — and the comment above the rule you just changed is what
- * points at the other copy.
- */
-
-import debug from 'debug';
-import { CODE_P2P, CODE_P2P_CIRCUIT, multiaddr, type Multiaddr } from '@multiformats/multiaddr';
-import { peerIdFromString } from '@libp2p/peer-id';
-
-const log = debug('cadre:host:bootstrap-nodes');
-
-/**
- * Longest rejected address echoed back in an error message. Generous compared to
- * the owner-key limit because a legitimate address is long: a plain
- * `/ip4/…/tcp/…/p2p/<52 chars>` runs ~80 characters and a relayed
- * `…/p2p-circuit/p2p/<52 chars>` about 150, so a smaller cap would truncate the
- * very values an operator needs to read back.
- */
-const REJECTED_ADDRESS_ECHO_LIMIT = 192;
-
-/**
- * Render a rejected address for an error message, capped: `bootstrapNodes`
- * arrives from a caller over the network, so an unbounded echo would let one junk
- * string become a megabyte of log line.
- */
-function describeRejectedAddress(value: string): string {
-  return value.length <= REJECTED_ADDRESS_ECHO_LIMIT
-    ? value
-    : `${value.slice(0, REJECTED_ADDRESS_ECHO_LIMIT)}… (${value.length} chars)`;
-}
-
-/** The message of a thrown parse/decode failure, whatever the thrower used. */
-function reasonOf(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-/**
- * Apply the rule above to one entry. Returns the trimmed value, so the create
- * provision request carries exactly what was validated.
- */
-function validateBootstrapNode(value: string): { node: string } | { error: string } {
-  const trimmed = value.trim();
-  if (trimmed.length === 0) {
-    return { error: 'bootstrapNodes entries must not be empty or whitespace-only' };
-  }
-
-  let address: Multiaddr;
-  try {
-    address = multiaddr(trimmed);
-  } catch (error) {
-    log('rejecting bootstrapNodes entry: %s', reasonOf(error));
-    return {
-      error: `bootstrapNodes entries must be multiaddrs (could not parse "${describeRejectedAddress(trimmed)}": ${reasonOf(error)})`,
-    };
-  }
-
-  const components = address.getComponents();
-  const peerIds = components.filter(component => component.code === CODE_P2P);
-  if (peerIds.length === 0) {
-    return {
-      error: `bootstrapNodes entries must include a /p2p/<peerId> component ("${describeRejectedAddress(trimmed)}" names no peer, so the node would drop it and start with no bootstrap peers)`,
-    };
-  }
-
-  if (!components.some(component => component.code !== CODE_P2P && component.code !== CODE_P2P_CIRCUIT)) {
-    return {
-      error: `bootstrapNodes entries must name where to reach the peer ("${describeRejectedAddress(trimmed)}" names only peer ids, so no transport can dial it and the node would start with no reachable bootstrap peers)`,
-    };
-  }
-
-  for (const { value } of peerIds) {
-    try {
-      peerIdFromString(value ?? '');
-    } catch (error) {
-      log('rejecting bootstrapNodes peer id: %s', reasonOf(error));
-      return {
-        error: `bootstrapNodes entries must carry a decodable peer id ("${describeRejectedAddress(trimmed)}" names peer "${describeRejectedAddress(value ?? '')}", which does not decode: ${reasonOf(error)})`,
-      };
-    }
-  }
-
-  return { node: trimmed };
-}
-
-/**
- * Validate the optional `bootstrapNodes` field of a provision request: absent, or an
- * array of dialable control-network addresses (see {@link validateBootstrapNode}).
- * Absent and `[]` alike mean the requester dials the node itself — see "An empty list
- * is accepted" in the module comment.
- *
- * Provisioning is the last point at which the requester can still fix a typo, so
- * the shape is checked here: without it a bad address is answered 201 and then
- * produces a donated node that either dies at boot or comes up permanently alone
- * — the requester learning about it, if ever, from donation status rather than
- * from a 400 naming the bad address.
- *
- * Every rejection names the offending entry: with several addresses in one
- * request the message is the only thing that says WHICH one.
- *
- * @returns the trimmed addresses (`[]` when none were given), so the provision request carries exactly what was validated.
- */
-export function validateBootstrapNodes(value: unknown): { nodes: string[] } | { error: string } {
-  if (value === undefined) {
-    return { nodes: [] };
-  }
-  if (!Array.isArray(value) || !value.every((entry): entry is string => typeof entry === 'string')) {
-    return { error: 'bootstrapNodes must be an array of strings' };
-  }
-
-  const nodes: string[] = [];
-  for (const entry of value) {
-    const checked = validateBootstrapNode(entry);
-    if ('error' in checked) return checked;
-    nodes.push(checked.node);
-  }
-  return { nodes };
-}

package/src/server/routes/grants-admin.ts

@@ -1,74 +0,0 @@
-/**
- * Donation grant **admin** HTTP routes — thin adapters around
- * `GrantAdminHandlers` (`createGrantAdminHandlers(service, donations)`).
- *
- * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
- * targets. It is **loopback, no bearer**: same-machine admin, matching
- * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
- * Security posture). This is distinct from the grantee-facing `/grants`
- * provisioning surface (`routes/grants.ts`), which carries the bearer gate.
- *
- * Clients: the `cadre-host grant` CLI and the local UI's Grants page. The list
- * reports each grant's live-node count and the donations a revoke would end.
- *
- * Revoking a grant also terminates the nodes donated under it unless the
- * caller passes `?keepNodes=true`; `DELETE /grants-admin/donations/:id` ends a
- * single donated node. Those are the host's only teardown paths once a grant is
- * revoked — the grantee's own `DELETE /grants/:id` is refused from then on.
- *
- * Each successful mutation publishes a `grants-changed` bus event, so an open
- * Grants page refreshes when the CLI acts.
- */
-
-import type { FastifyInstance } from 'fastify';
-
-import type { GrantAdminHandlers } from '../../donation/types.js';
-import type { EventBus } from '../events/bus.js';
-
-export interface GrantsAdminRoutesOptions {
-  handlers: GrantAdminHandlers;
-  events: EventBus;
-}
-
-export function registerGrantsAdminRoutes(app: FastifyInstance, opts: GrantsAdminRoutesOptions): void {
-  const { handlers, events } = opts;
-
-  app.get('/grants-admin', async () => {
-    return handlers.listGrants();
-  });
-
-  app.post('/grants-admin', async (request) => {
-    const body = (request.body ?? {}) as { label?: unknown; maxNodes?: unknown; ttlMs?: unknown };
-    const label = typeof body.label === 'string' ? body.label : '';
-    const args: { label: string; maxNodes?: number; ttlMs?: number } = { label };
-    if (typeof body.maxNodes === 'number') args.maxNodes = body.maxNodes;
-    if (typeof body.ttlMs === 'number') args.ttlMs = body.ttlMs;
-    const result = await handlers.postGrant(args);
-    events.publish({ type: 'grants-changed', kind: 'issued' });
-    return result;
-  });
-
-  app.delete<{ Params: { token: string }; Querystring: { keepNodes?: string } }>(
-    '/grants-admin/:token',
-    async (request) => {
-      const keepNodes = isTrueFlag(request.query.keepNodes);
-      const { terminated } = await handlers.deleteGrant(request.params.token, { keepNodes });
-      events.publish({ type: 'grants-changed', kind: 'revoked' });
-      return { ok: true, terminated };
-    },
-  );
-
-  // Two path segments past `/grants-admin`, so it never collides with `/:token`.
-  const { terminateDonation } = handlers;
-  if (terminateDonation) {
-    app.delete<{ Params: { id: string } }>('/grants-admin/donations/:id', async (request) => {
-      await terminateDonation(request.params.id);
-      events.publish({ type: 'grants-changed', kind: 'terminated' });
-      return { ok: true };
-    });
-  }
-}
-
-function isTrueFlag(value: string | undefined): boolean {
-  return value === 'true' || value === '1';
-}

package/src/server/routes/grants.ts

@@ -1,193 +0,0 @@
-/**
- * Grantee-facing donation routes — the HTTP surface an external cadre authority
- * (a friend's phone) drives to have this host donate a node into *its* cadre.
- *
- * Mount path: `/grants`. Distinct from the loopback-only `/grants-admin` surface
- * (issue/list/revoke, no bearer): this one is **bearer-gated** — every request
- * carries `Authorization: Bearer <grant-token>`, and a grantee sees only the
- * donations its own grant authorized (the single cross-grantee boundary,
- * analogous to cadre-provider's per-customer ownership check).
- *
- * Reachability is out of scope here: in v1 this mounts on the loopback
- * management server, same as the trust-circle / NAT surfaces. Physically exposing
- * it to a remote phone is `backlog/feat-cadre-host-wan-grant-reachability`.
- *
- * Errors: handlers either send a `{ ok:false, error:{code,message} }` envelope
- * inline (auth / body validation) or let the `DonationService` throw a
- * `DonationError`, which `server/error-handler.ts` maps to the matching HTTP
- * status and the same envelope.
- */
-
-import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
-
-import type { DonationService } from '../../donation/donation-service.js';
-import type { DonationView, GrantValidator } from '../../donation/types.js';
-import { validateProvisionRequest } from './provision-request-validation.js';
-
-export interface GrantsRoutesOptions {
-  donations: DonationService;
-  /** Validates the presented bearer for non-provisioning ops (provision revalidates internally). */
-  grants: GrantValidator;
-}
-
-/** Uniform error envelope (matches `error-handler.ts` and the provider API). */
-function errorResponse(reply: FastifyReply, code: string, message: string, status: number) {
-  return reply.status(status).send({ ok: false, error: { code, message } });
-}
-
-/** Pull the `Bearer <token>` value out of the Authorization header, or undefined. */
-function parseBearer(header: string | undefined): string | undefined {
-  if (!header) return undefined;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  return match ? match[1].trim() : undefined;
-}
-
-/** Map a grant denial reason to an HTTP status for the bearer gate. */
-function denyStatus(reason: string | undefined): number {
-  if (reason === 'expired' || reason === 'revoked') return 403;
-  return 401; // unknown_token / missing
-}
-
-/**
- * Authenticate the grant bearer for a non-provisioning op (identity + not
- * expired/revoked; no quota). Returns the token, or null after sending the
- * failure response. Provision does its own quota-aware validation inside
- * `DonationService.provision`.
- */
-function authenticate(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  grants: GrantValidator,
-): string | null {
-  const token = parseBearer(request.headers.authorization);
-  if (!token) {
-    errorResponse(reply, 'unauthorized', 'Missing bearer grant token', 401);
-    return null;
-  }
-  const validation = grants.validate(token);
-  if (!validation.ok) {
-    const status = denyStatus(validation.reason);
-    // Keep the envelope code aligned with the status (and with the POST path,
-    // which surfaces an unknown token as `unauthorized`): 401 → unauthorized,
-    // 403 → forbidden. A 401 labelled `forbidden` is self-contradictory.
-    const code = status === 403 ? 'forbidden' : 'unauthorized';
-    errorResponse(reply, code, `Grant is ${validation.reason ?? 'invalid'}`, status);
-    return null;
-  }
-  return token;
-}
-
-/**
- * Resolve a donation the presented grant owns. Returns the redacted view, or
- * null after sending a 404 — an unknown id and one owned by a *different* grant
- * are deliberately indistinguishable (a grantee never learns another grantee's
- * donations exist).
- */
-function requireOwned(
-  donations: DonationService,
-  id: string,
-  token: string,
-  reply: FastifyReply,
-): DonationView | null {
-  const donation = donations.get(id);
-  if (!donation || donation.grantToken !== token) {
-    errorResponse(reply, 'not_found', `No such donation: ${id}`, 404);
-    return null;
-  }
-  return donation;
-}
-
-export function registerGrantsRoutes(app: FastifyInstance, opts: GrantsRoutesOptions): void {
-  const { donations, grants } = opts;
-
-  // POST /grants — provision a donated node. The bearer's identity/expiry/
-  // revocation AND quota are validated inside provision(), which throws a
-  // DonationError (unauthorized / forbidden / quota_exceeded) the error handler
-  // maps. We only parse the bearer and validate the request body here.
-  app.post('/grants', async (request, reply) => {
-    const token = parseBearer(request.headers.authorization);
-    if (!token) {
-      return errorResponse(reply, 'unauthorized', 'Missing bearer grant token', 401);
-    }
-
-    // One validator owns the whole body — see `provision-request-validation.ts`
-    // for why no per-field check lives here. Nothing is provisioned on a
-    // rejection: this runs before the service is touched.
-    const validated = validateProvisionRequest(request.body ?? {}, token);
-    if ('error' in validated) {
-      return errorResponse(reply, 'invalid_request', validated.error, 400);
-    }
-
-    const donation = await donations.provision(validated.request);
-    return reply.status(201).send({ ok: true, data: { donation } });
-  });
-
-  // GET /grants — list only the donations this grant authorized.
-  app.get('/grants', async (request, reply) => {
-    const token = authenticate(request, reply, grants);
-    if (!token) return reply;
-    return reply.send({ ok: true, data: { donations: donations.list(token) } });
-  });
-
-  // GET /grants/:id — one donation (redacted), owned by this grant.
-  app.get<{ Params: { id: string } }>('/grants/:id', async (request, reply) => {
-    const token = authenticate(request, reply, grants);
-    if (!token) return reply;
-    const donation = requireOwned(donations, request.params.id, token, reply);
-    if (!donation) return reply;
-    return reply.send({ ok: true, data: { donation } });
-  });
-
-  // GET /grants/:id/peer — live { peerId, multiaddrs } for the requester's addDrone.
-  app.get<{ Params: { id: string } }>('/grants/:id/peer', async (request, reply) => {
-    const token = authenticate(request, reply, grants);
-    if (!token) return reply;
-    if (!requireOwned(donations, request.params.id, token, reply)) return reply;
-    const peer = await donations.getPeer(request.params.id);
-    return reply.send({ ok: true, data: peer });
-  });
-
-  // PUT /grants/:id/seed — apply the requester's phone-signed seed.
-  app.put<{ Params: { id: string } }>('/grants/:id/seed', async (request, reply) => {
-    const token = authenticate(request, reply, grants);
-    if (!token) return reply;
-    if (!requireOwned(donations, request.params.id, token, reply)) return reply;
-
-    const body = (request.body ?? {}) as { seed?: unknown };
-    if (typeof body.seed !== 'string' || body.seed.length === 0) {
-      return errorResponse(reply, 'invalid_request', 'seed is required', 400);
-    }
-    const result = await donations.applySeed(request.params.id, body.seed);
-    // NOTE: exhaustive over today's three outcomes, and nothing forces it to stay
-    // that way — an unhandled fourth would fall out of the handler as `undefined`
-    // and hang the request rather than fail to compile. If `DonationSeedResult`
-    // ever grows a variant, add a `default:` that 500s here.
-    switch (result.outcome) {
-      case 'rejected':
-        return errorResponse(reply, 'seed_failed', result.error ?? 'Node rejected the seed', 502);
-      // The loan ended while the seed was in flight. The ending won, so the
-      // caller is told the record it seeded is no longer seedable (409) — or is
-      // gone entirely (404) — rather than a 200 that implies a live node.
-      case 'abandoned':
-        return result.status
-          ? errorResponse(
-              reply,
-              'invalid_state',
-              `Donation ${request.params.id} ended (${result.status}) while the seed was in flight`,
-              409,
-            )
-          : errorResponse(reply, 'not_found', `No such donation: ${request.params.id}`, 404);
-      case 'seeded':
-        return reply.send({ ok: true, data: { peersAdded: result.peersAdded } });
-    }
-  });
-
-  // DELETE /grants/:id — terminate the donated node.
-  app.delete<{ Params: { id: string } }>('/grants/:id', async (request, reply) => {
-    const token = authenticate(request, reply, grants);
-    if (!token) return reply;
-    if (!requireOwned(donations, request.params.id, token, reply)) return reply;
-    await donations.terminate(request.params.id);
-    return reply.send({ ok: true });
-  });
-}

package/src/server/routes/provision-request-validation.ts

@@ -1,105 +0,0 @@
-/**
- * The whole shape check for `POST /grants` — one call that either yields the
- * typed {@link DonationProvisionRequest} the `DonationService` is handed, or the
- * message the route answers 400 with.
- *
- * **Why a validator rather than a few more `if`s in the route.** Every field in
- * this body is forwarded into a child process the requester cannot see:
- * `partyId`, `bootstrapNodes` and `profile` are written into the child's
- * `cadre.json` (`orchestrator/host-process-orchestrator.ts`) and `ownerKeys`
- * become its cold-start seed-trust anchors. A field the route forgets to check is
- * not a 400 — it is a donated node that dies at boot, or comes up subtly wrong,
- * with a 201 already sent. Routing the body through one function that *constructs*
- * the request object means a field can only reach the spawn path by having been
- * through here; adding a field to `DonationProvisionRequest` without validating it
- * stops compiling rather than silently shipping.
- *
- * **Division of labour with `DonationService.provision`.** The Ed25519 rule for
- * `ownerKeys` stays in the service, where it is applied by cadre-core's own
- * `requireEd25519PublicKeyB64` — the service is also reached by the respawn path,
- * which replays a persisted record rather than an HTTP body, so the crypto rule
- * has to live there to cover both. What this validator owns for `ownerKeys` is the
- * *container* shape (present, non-empty, all strings), which the service's rule
- * assumes: a number reaching it surfaces as an internal `.trim is not a function`
- * rather than as a message naming what is wrong with the request.
- *
- * The multiaddr rule has no such home — it is duplicated in cadre-provider — so it
- * lives in `bootstrap-node-validation.ts` next to the comment saying so.
- */
-
-import type { DonationProvisionRequest } from '../../donation/donation-service.js';
-import { validateBootstrapNodes } from './bootstrap-node-validation.js';
-
-/** `partyId` becomes `controlNetwork.partyId` in the child's config. */
-function validatePartyId(value: unknown): { partyId: string } | { error: string } {
-  if (typeof value !== 'string' || value.trim().length === 0) {
-    return { error: 'partyId is required' };
-  }
-  return { partyId: value.trim() };
-}
-
-/**
- * Container shape only — see the module comment: the per-key Ed25519 rule is
- * `DonationService.provision`'s, so the respawn path gets it too.
- */
-function validateOwnerKeys(value: unknown): { ownerKeys: string[] } | { error: string } {
-  if (!Array.isArray(value) || value.length === 0) {
-    return { error: 'ownerKeys is required' };
-  }
-  if (!value.every((key): key is string => typeof key === 'string')) {
-    return { error: 'ownerKeys must be an array of strings' };
-  }
-  return { ownerKeys: value };
-}
-
-/** Absent means `storage` — see {@link DonationProvisionRequest.profile}. */
-function validateProfile(value: unknown): { profile?: DonationProvisionRequest['profile'] } | { error: string } {
-  if (value === undefined) return {};
-  if (value !== 'storage' && value !== 'transaction') {
-    return { error: 'profile must be "storage" or "transaction"' };
-  }
-  return { profile: value };
-}
-
-/**
- * Validate a `POST /grants` body and build the request `DonationService.provision`
- * is handed.
- *
- * `grantToken` comes from the `Authorization` bearer rather than the body — a
- * requester does not get to name which grant pays for this — so it is a
- * parameter, not a validated field. Whether that grant is live and within quota is
- * `provision`'s call, not this function's.
- *
- * @returns the typed provision request, or the message to answer `invalid_request` with.
- */
-export function validateProvisionRequest(
-  body: unknown,
-  grantToken: string,
-): { request: DonationProvisionRequest } | { error: string } {
-  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
-    return { error: 'request body must be a JSON object' };
-  }
-  const fields = body as Record<string, unknown>;
-
-  const partyId = validatePartyId(fields.partyId);
-  if ('error' in partyId) return partyId;
-
-  const bootstrap = validateBootstrapNodes(fields.bootstrapNodes);
-  if ('error' in bootstrap) return bootstrap;
-
-  const ownerKeys = validateOwnerKeys(fields.ownerKeys);
-  if ('error' in ownerKeys) return ownerKeys;
-
-  const profile = validateProfile(fields.profile);
-  if ('error' in profile) return profile;
-
-  return {
-    request: {
-      grantToken,
-      partyId: partyId.partyId,
-      bootstrapNodes: bootstrap.nodes,
-      ownerKeys: ownerKeys.ownerKeys,
-      ...(profile.profile ? { profile: profile.profile } : {}),
-    },
-  };
-}

package/src/server/routes/strands.ts

@@ -1,54 +0,0 @@
-/**
- * Strand HTTP routes — thin adapters around `StrandHandlers`
- * (`createStrandHandlers(service)`).
- *
- * Mount path: `/api/strands` — a UI-only surface with no CLI contract to
- * preserve. (The `/auth/*` and `/nat/*` mounts sit outside `/api` only because
- * the existing CLI already targets those URLs.) Envelope form therefore follows
- * the other `/api/*` routes: `{ ok: true, data }`.
- *
- * A removal that actually issued a delete publishes `strands-changed` so other
- * open tabs refresh. A call that found no row publishes nothing — nothing changed.
- */
-
-import type { FastifyInstance } from 'fastify';
-
-import type { StrandHandlers } from '../../strands/types.js';
-import type { EventBus } from '../events/bus.js';
-
-export interface StrandRoutesOptions {
-  handlers: StrandHandlers;
-  events: EventBus;
-}
-
-/**
- * The only accepted `confirm` values — the same strict pair the admin channel
- * accepts. Not a general truthiness parser: `yes`, `on` and an empty value all
- * count as NOT confirmed, because a guessy parser here would turn a typo into a
- * destroyed membership key.
- *
- * NOTE: deliberately duplicated from cadre-cli's `admin-server.ts` rather than
- * imported — cadre-host depends on cadre-cli for its bin path only, never its
- * source. Keep the two in step by hand; do not DRY them into an import.
- */
-const CONFIRM_VALUES = new Set(['1', 'true']);
-
-export function registerStrandRoutes(app: FastifyInstance, opts: StrandRoutesOptions): void {
-  const { handlers, events } = opts;
-
-  app.get('/api/strands', async () => {
-    return { ok: true, data: await handlers.listStrands() };
-  });
-
-  app.delete<{ Params: { id: string }; Querystring: { confirm?: string } }>(
-    '/api/strands/:id',
-    async (request) => {
-      const confirm = typeof request.query.confirm === 'string' && CONFIRM_VALUES.has(request.query.confirm);
-      const result = await handlers.removeStrand(request.params.id, { confirm });
-      if (result.removed) {
-        events.publish({ type: 'strands-changed', kind: 'removed' });
-      }
-      return { ok: true, data: result };
-    },
-  );
-}