@celilo/cli 0.24.1 → 0.25.0

package/src/services/network-ensure.test.ts

@@ -0,0 +1,324 @@
+/**
+ * `requires.networks` is ensured before the deploy proceeds
+ * (openspec/changes/networks-are-declared-not-written/specs/network-declaration/spec.md).
+ *
+ * The asker is injected, so these assert the RULES — which questions get asked,
+ * what gets written, what is left alone — without a bus or a responder.
+ */
+
+import { beforeEach, describe, expect, test } from 'bun:test';
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { machines, systemConfig } from '../db/schema';
+import type { ModuleManifest } from '../manifest/schema';
+import { setupTestDatabase } from '../test-utils/database';
+import { type NetworkAsker, ensureRequiredNetworks } from './network-ensure';
+
+function manifestRequiring(...networks: string[]): ModuleManifest {
+  return {
+    celilo_contract: '1.0',
+    id: 'test-module',
+    name: 'Test Module',
+    version: '0.1.0',
+    requires: {
+      capabilities: [],
+      networks: networks.map((name) => ({ name })),
+    },
+    provides: { capabilities: [] },
+    variables: { owns: [], imports: [] },
+  } as unknown as ModuleManifest;
+}
+
+/** Records every question and answers each from `answers`, keyed `<scope>.<key>`. */
+function recordingAsker(answers: Record<string, string>): {
+  ask: NetworkAsker;
+  asked: Array<{ scope: string; key: string; defaultValue?: string }>;
+} {
+  const asked: Array<{ scope: string; key: string; defaultValue?: string }> = [];
+  const ask: NetworkAsker = async (question) => {
+    asked.push({
+      scope: question.scope,
+      key: question.key,
+      defaultValue: question.defaultValue,
+    });
+    const answer = answers[`${question.scope}.${question.key}`];
+    if (answer === undefined) {
+      throw new Error(`test asker has no answer for ${question.scope}.${question.key}`);
+    }
+    return answer;
+  };
+  return { ask, asked };
+}
+
+function readConfig(db: DbClient, key: string): string | undefined {
+  return db.select().from(systemConfig).where(eq(systemConfig.key, key)).get()?.value;
+}
+
+type Iface = { name: string; ipAddress: string; zone: string };
+
+/**
+ * Put a machine in the catalogue, the way `machine add` does.
+ *
+ * `role` is the load-bearing field here: only a router is a gateway. The
+ * recorded `zone` on an interface is deliberately left wrong/unknown in these
+ * fixtures, because that is the real state before a subnet has been declared —
+ * an interface cannot be classified into a zone that does not exist yet.
+ */
+function seedMachine(db: DbClient, role: 'host' | 'router', interfaces: Iface[]): void {
+  db.insert(machines)
+    .values({
+      id: `machine-${role}-${interfaces[0]?.ipAddress ?? 'none'}`,
+      hostname: `${role}-box`,
+      ipAddress: interfaces[0]?.ipAddress ?? '127.0.0.1',
+      sshUser: 'root',
+      sshKeyEncrypted: 'x',
+      zone: 'internal',
+      hardware: { cpu_cores: 1, memory_mb: 512, disk_gb: 10 },
+      role,
+      interfaces,
+    })
+    .run();
+}
+
+function seedRouter(db: DbClient, interfaces: Iface[]): void {
+  seedMachine(db, 'router', interfaces);
+}
+
+function seedHost(db: DbClient, interfaces: Iface[]): void {
+  seedMachine(db, 'host', interfaces);
+}
+
+describe('ensureRequiredNetworks', () => {
+  let db: DbClient;
+
+  beforeEach(async () => {
+    db = await setupTestDatabase();
+  });
+
+  test('a module requiring no network asks nothing', async () => {
+    const { ask, asked } = recordingAsker({});
+    const result = await ensureRequiredNetworks('test-module', manifestRequiring(), db, ask);
+
+    expect(result.success).toBe(true);
+    expect(asked).toEqual([]);
+  });
+
+  test('an undefined required network is asked for and written to system config', async () => {
+    const { ask, asked } = recordingAsker({
+      'network:control-plane-vpn.subnet': '10.9.9.0/24',
+    });
+
+    const result = await ensureRequiredNetworks(
+      'wireguard',
+      manifestRequiring('control-plane-vpn'),
+      db,
+      ask,
+    );
+
+    expect(result.success).toBe(true);
+    expect(asked.map((a) => `${a.scope}.${a.key}`)).toEqual(['network:control-plane-vpn.subnet']);
+    expect(readConfig(db, 'network.control-plane-vpn.subnet')).toBe('10.9.9.0/24');
+  });
+
+  test('a network that is already defined is left alone — no question, no rewrite', async () => {
+    db.insert(systemConfig)
+      .values({ key: 'network.control-plane-vpn.subnet', value: '10.7.7.0/24' })
+      .run();
+
+    const { ask, asked } = recordingAsker({});
+    const result = await ensureRequiredNetworks(
+      'wireguard',
+      manifestRequiring('control-plane-vpn'),
+      db,
+      ask,
+    );
+
+    expect(result.success).toBe(true);
+    expect(asked).toEqual([]);
+    expect(readConfig(db, 'network.control-plane-vpn.subnet')).toBe('10.7.7.0/24');
+  });
+
+  /**
+   * Which attributes a network HAS is celilo's answer, and WHICH ARE QUESTIONS
+   * is a second answer on top of it. The config schema gives dmz a vlan and
+   * gives the control-plane VPN none, so the VPN is never asked a question that
+   * makes no sense for it — and the gateway is never asked of anything, because
+   * celilo can look it up.
+   */
+  test('vlan is asked only for the networks celilo says have one; gateway is never asked', async () => {
+    const { ask, asked } = recordingAsker({
+      'network:dmz.subnet': '10.0.10.0/24',
+      'network:dmz.vlan': '10',
+      'network:control-plane-vpn.subnet': '10.9.9.0/24',
+    });
+
+    const result = await ensureRequiredNetworks(
+      'iptables',
+      manifestRequiring('dmz', 'control-plane-vpn'),
+      db,
+      ask,
+    );
+
+    expect(result.success).toBe(true);
+    expect(asked.map((a) => `${a.scope}.${a.key}`)).toEqual([
+      'network:dmz.subnet',
+      'network:dmz.vlan',
+      'network:control-plane-vpn.subnet',
+    ]);
+    expect(asked.map((a) => a.key)).not.toContain('gateway');
+    expect(readConfig(db, 'network.dmz.vlan')).toBe('10');
+    expect(readConfig(db, 'network.control-plane-vpn.vlan')).toBeUndefined();
+  });
+
+  /**
+   * The failure this test exists for, found on the rig.
+   *
+   * `iptables` requires `internal`, whose subnet the management install had
+   * already recorded and whose vlan nothing ever set. The ensure asked for the
+   * vlan, headlessly, with no responder attached, and the deploy died on
+   * `interview.required.network:internal.vlan` — a question about a network that
+   * had existed since the fleet was built.
+   *
+   * celilo is here to DEFINE a network, not to audit one it already holds. An
+   * existing network was already defined without a tag, deliberately or because
+   * it is untagged; re-opening that every time a new module requires it is not a
+   * question, it is a deploy that stops.
+   */
+  test('an existing network is never re-asked about, vlan included', async () => {
+    db.insert(systemConfig).values({ key: 'network.dmz.subnet', value: '10.0.10.0/24' }).run();
+
+    const { ask, asked } = recordingAsker({});
+    const result = await ensureRequiredNetworks('iptables', manifestRequiring('dmz'), db, ask);
+
+    expect(result.success).toBe(true);
+    expect(asked).toEqual([]);
+    expect(readConfig(db, 'network.dmz.vlan')).toBeUndefined();
+  });
+
+  test('a blank vlan answer writes nothing — untagged is a real answer, not an empty tag', async () => {
+    const { ask } = recordingAsker({
+      'network:dmz.subnet': '10.0.10.0/24',
+      'network:dmz.vlan': '',
+    });
+
+    await ensureRequiredNetworks('iptables', manifestRequiring('dmz'), db, ask);
+
+    expect(readConfig(db, 'network.dmz.subnet')).toBe('10.0.10.0/24');
+    expect(readConfig(db, 'network.dmz.vlan')).toBeUndefined();
+  });
+
+  /**
+   * The gateway is a fact about the fleet, not a decision: it is the address a
+   * router answers on inside the subnet, and `machine add` already catalogued it.
+   * Matched by CONTAINMENT rather than by the interface's recorded zone, because
+   * an interface has no zone until the subnet it sits in has been declared —
+   * which is the very thing that just happened one line earlier.
+   */
+  test('the gateway is observed from a catalogued router leg, never asked', async () => {
+    seedRouter(db, [{ name: 'eth1', ipAddress: '10.0.10.254', zone: 'unknown' }]);
+
+    const { ask, asked } = recordingAsker({
+      'network:dmz.subnet': '10.0.10.0/24',
+      'network:dmz.vlan': '',
+    });
+
+    await ensureRequiredNetworks('iptables', manifestRequiring('dmz'), db, ask);
+
+    expect(asked.map((a) => a.key)).not.toContain('gateway');
+    // Not x.x.x.1 — the address the router actually holds.
+    expect(readConfig(db, 'network.dmz.gateway')).toBe('10.0.10.254');
+  });
+
+  test('a host inside the subnet is not mistaken for the gateway', async () => {
+    seedHost(db, [{ name: 'eth0', ipAddress: '10.0.10.50', zone: 'dmz' }]);
+
+    const { ask } = recordingAsker({
+      'network:dmz.subnet': '10.0.10.0/24',
+      'network:dmz.vlan': '',
+    });
+
+    await ensureRequiredNetworks('iptables', manifestRequiring('dmz'), db, ask);
+
+    // Only a router is a gateway. Guessing from any host in the subnet would
+    // hand every container in that zone a default route to a random peer.
+    expect(readConfig(db, 'network.dmz.gateway')).toBeUndefined();
+  });
+
+  test('no catalogued router leg leaves the gateway unset rather than invented', async () => {
+    const { ask } = recordingAsker({
+      'network:dmz.subnet': '10.0.10.0/24',
+      'network:dmz.vlan': '',
+    });
+
+    await ensureRequiredNetworks('iptables', manifestRequiring('dmz'), db, ask);
+
+    expect(readConfig(db, 'network.dmz.gateway')).toBeUndefined();
+  });
+
+  /**
+   * The offer is a starting point in a question, never a row nobody chose — so
+   * it has to reach the asker and it has to be VISIBLE. A defaultValue with no
+   * matching placeholder is a default the operator cannot see and cannot know
+   * they may accept with Enter.
+   */
+  test('a well-known name is offered a suggested range, visibly', async () => {
+    const asked: Array<{ key: string; defaultValue?: string; placeholder?: string }> = [];
+    const ask: NetworkAsker = async (question) => {
+      asked.push({
+        key: question.key,
+        defaultValue: question.defaultValue,
+        placeholder: question.placeholder,
+      });
+      return question.key === 'subnet' ? '10.44.0.0/24' : '';
+    };
+
+    const result = await ensureRequiredNetworks('iptables', manifestRequiring('dmz'), db, ask);
+
+    expect(result.success).toBe(true);
+    expect(asked[0].key).toBe('subnet');
+    expect(asked[0].defaultValue).toBe('10.0.10.0/24');
+    expect(asked[0].placeholder).toBe(asked[0].defaultValue);
+    // The operator's answer wins over the offer, which is the whole point of
+    // offering rather than defaulting.
+    expect(readConfig(db, 'network.dmz.subnet')).toBe('10.44.0.0/24');
+  });
+
+  test('nothing is written when the module requires nothing — a deploy seeds no network', async () => {
+    const { ask } = recordingAsker({});
+    await ensureRequiredNetworks('test-module', manifestRequiring(), db, ask);
+
+    const networkRows = db
+      .select()
+      .from(systemConfig)
+      .all()
+      .filter((row) => row.key.startsWith('network.'));
+    expect(networkRows.filter((row) => row.key.endsWith('.subnet'))).toEqual([]);
+  });
+
+  test('requiring a network celilo has never heard of fails with an actionable message', async () => {
+    const { ask } = recordingAsker({});
+    const result = await ensureRequiredNetworks(
+      'test-module',
+      manifestRequiring('not-a-network'),
+      db,
+      ask,
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('not-a-network');
+    expect(result.error).toContain('system_config.json');
+  });
+
+  test('an empty answer fails the deploy rather than writing an empty network', async () => {
+    const ask: NetworkAsker = async () => '   ';
+    const result = await ensureRequiredNetworks(
+      'wireguard',
+      manifestRequiring('control-plane-vpn'),
+      db,
+      ask,
+    );
+
+    expect(result.success).toBe(false);
+    expect(readConfig(db, 'network.control-plane-vpn.subnet')).toBeUndefined();
+  });
+});

package/src/services/network-ensure.ts

@@ -0,0 +1,260 @@
+/**
+ * Ensure every network a module REQUIRES is defined before the deploy proceeds
+ * (openspec/changes/networks-are-declared-not-written/specs/network-declaration/spec.md).
+ *
+ * celilo owns the network namespace. A module names the networks it depends on
+ * under `requires.networks`; it never carries their values. When one of those
+ * networks has no `network.<name>.subnet` in system config, this asks for the
+ * range over the event bus and writes it — celilo asking, celilo writing.
+ *
+ * Two properties matter and both come from WHERE this runs rather than from
+ * anything clever it does:
+ *
+ *   - It runs in the deploy's interview phase, before generation and before any
+ *     hook. So by the time a hook executes, the network is defined — whether the
+ *     consumer reading declared networks captured them eagerly or reads at point
+ *     of use. That is what retires the live-reader mitigation the firewall
+ *     capability carries today (celilo#759).
+ *   - It asks through the generic bus interview, so it is answerable by whatever
+ *     responder is attached — a terminal, `celilo events reply`, an automated
+ *     policy — and behaves identically interactive or headless.
+ *
+ * ── What is asked, and what is merely observed ──
+ *
+ * Not every attribute of a network is a question. The rule is whether celilo can
+ * already SEE the answer:
+ *
+ *   - `subnet` is ASKED. It is an addressing-plan decision that predates every
+ *     module, and nothing in the fleet can be consulted for it. A well-known name
+ *     is offered a suggested range so an operator new to networking is not made to
+ *     invent one — an offer in a question, never a seeded row.
+ *   - `gateway` is OBSERVED, never asked. It is the address a router answers on
+ *     inside that subnet, which celilo already holds: `machine add` catalogues
+ *     every interface of every machine. Asking for it would be asking the operator
+ *     to retype something celilo can look up, which is the same failure this change
+ *     exists to remove, aimed at a different key.
+ *   - `vlan` is ASKED, optional, blank meaning untagged. It is NOT observable —
+ *     a catalogued interface carries `{name, ipAddress, zone}` and no tag — and it
+ *     IS load-bearing: every container-provisioning template reads
+ *     `$system:network.<zone>.vlan` as the Proxmox NIC tag. Leaving it uncollected
+ *     would provision containers untagged onto the wrong VLAN, silently.
+ *
+ * Which attributes a network HAS at all is celilo's answer too, taken from
+ * `schemas/system_config.json`: it declares `gateway`/`vlan` for the routed
+ * segments and omits both for the control-plane VPN, which has neither. So a
+ * module never states which attributes it reads, and asking a nonsense question
+ * is impossible by construction.
+ */
+
+import { subnetContains } from '@celilo/capabilities';
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { machines, moduleConfigs, systemConfig } from '../db/schema';
+import { type ModuleManifest, getRequiredNetworkNames } from '../manifest/schema';
+import { askText } from './bus-interview';
+import { loadSchema } from './system-init';
+
+export interface NetworkEnsureResult {
+  success: boolean;
+  error?: string;
+  /** What this call defined, as `<key> = <value>` lines for the deploy log. */
+  applied: string[];
+}
+
+/** The one piece of I/O here, injectable so the rules are testable without a bus. */
+export type NetworkAsker = (question: {
+  scope: string;
+  key: string;
+  message: string;
+  description: string;
+  defaultValue?: string;
+  placeholder?: string;
+  required: boolean;
+  pattern?: string;
+}) => Promise<string>;
+
+/**
+ * The module's own config, flat, for resolving a `from:` requirement.
+ *
+ * Reads `value_json` in preference to `value`: an array config value is stored
+ * as JSON, and reading the scalar column would yield the string form, which
+ * `getRequiredNetworkNames` would then have to guess at.
+ */
+function loadModuleConfigValues(db: DbClient, moduleId: string): Record<string, unknown> {
+  const values: Record<string, unknown> = {};
+  for (const row of db
+    .select()
+    .from(moduleConfigs)
+    .where(eq(moduleConfigs.moduleId, moduleId))
+    .all()) {
+    values[row.key] = row.valueJson ?? row.value;
+  }
+  return values;
+}
+
+function readSystemConfigValue(db: DbClient, key: string): string | undefined {
+  const row = db.select().from(systemConfig).where(eq(systemConfig.key, key)).get();
+  return row?.value && row.value.length > 0 ? row.value : undefined;
+}
+
+function writeSystemConfigValue(db: DbClient, key: string, value: string): void {
+  db.insert(systemConfig)
+    .values({ key, value })
+    .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+    .run();
+}
+
+/**
+ * The address a router answers on inside `subnet`, from the machine catalogue.
+ *
+ * Matched by CONTAINMENT rather than by an interface's recorded zone, because on
+ * a fleet that is still being described those are not the same thing: an
+ * interface is classified into a zone by comparing it against declared subnets,
+ * so before the subnet exists the interface has no zone. Containment answers the
+ * moment the operator supplies the range, which is exactly when this runs.
+ *
+ * `role: 'router'` is what distinguishes the gateway from any other host that
+ * happens to sit in the subnet.
+ */
+export function observeGateway(db: DbClient, subnet: string): string | undefined {
+  for (const machine of db.select().from(machines).all()) {
+    if (machine.role !== 'router') continue;
+    for (const iface of machine.interfaces) {
+      if (iface.ipAddress && subnetContains(subnet, iface.ipAddress)) {
+        return iface.ipAddress;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Ensure each of `manifest.requires.networks` is defined: a subnet, a vlan tag
+ * where one applies, and a gateway wherever celilo can see one.
+ */
+export async function ensureRequiredNetworks(
+  moduleId: string,
+  manifest: ModuleManifest,
+  db: DbClient,
+  ask: NetworkAsker = askText,
+): Promise<NetworkEnsureResult> {
+  // A `from:` requirement resolves against the module's OWN config, so the
+  // module's values have to be loaded before its required set is even knowable.
+  const names = getRequiredNetworkNames(manifest, loadModuleConfigValues(db, moduleId));
+  if (names.length === 0) return { success: true, applied: [] };
+
+  const schema = loadSchema();
+  const applied: string[] = [];
+
+  for (const name of names) {
+    const subnetKey = `network.${name}.subnet`;
+    const subnetProperty = schema.properties[subnetKey];
+    if (!subnetProperty) {
+      return {
+        success: false,
+        applied,
+        error: [
+          `Module "${moduleId}" requires a network called "${name}", which celilo does not know`,
+          `about: there is no "${subnetKey}" in celilo's system-config schema. Networks are`,
+          "celilo's to define, so a new one is added to schemas/system_config.json — a module",
+          'cannot introduce one.',
+        ].join(' '),
+      };
+    }
+
+    // 1. The subnet — asked, because nothing in the fleet can be consulted for it.
+    //
+    // Whether this network already EXISTED is the fact everything below turns
+    // on: celilo is here to define a network, not to audit one it already holds.
+    let subnet = readSystemConfigValue(db, subnetKey);
+    const defining = subnet === undefined;
+    if (defining) {
+      const answer = (
+        await ask({
+          scope: `network:${name}`,
+          key: 'subnet',
+          message: `Subnet CIDR for the "${name}" network:`,
+          description: [
+            `${moduleId} requires the "${name}" network, and celilo has no subnet for it.`,
+            "This becomes celilo's definition of the network — every module that needs it reads",
+            'this one value.',
+          ].join(' '),
+          defaultValue: subnetProperty.suggested,
+          // A defaultValue MUST have a matching placeholder, or the operator
+          // cannot see what pressing Enter would accept.
+          placeholder: subnetProperty.suggested,
+          required: true,
+          pattern: subnetProperty.pattern,
+        })
+      ).trim();
+
+      if (answer.length === 0) {
+        return {
+          success: false,
+          applied,
+          error: `No subnet supplied for the "${name}" network; ${moduleId} cannot deploy without it.`,
+        };
+      }
+      writeSystemConfigValue(db, subnetKey, answer);
+      applied.push(`${subnetKey} = ${answer}`);
+      subnet = answer;
+    }
+
+    // 2. The VLAN tag — asked, because it cannot be observed: a catalogued
+    //    interface carries no tag. Optional: an untagged segment genuinely has
+    //    none, and a blank answer writes nothing rather than writing "".
+    //
+    //    ONLY when celilo is defining the network. An existing network was
+    //    already defined without a tag — deliberately, or because it is
+    //    untagged — and re-opening that question every time a new module
+    //    requires it is not a question, it is a deploy that stops. Which is
+    //    exactly what happened: `iptables` requires `internal`, whose subnet the
+    //    management install had already recorded and whose vlan nothing ever
+    //    set, so a headless deploy died on `interview.required.network:internal.vlan`
+    //    with no responder to answer it. Absent means untagged; if that is wrong,
+    //    `celilo system config set network.<name>.vlan <tag>` says so once.
+    const vlanKey = `network.${name}.vlan`;
+    if (
+      defining &&
+      schema.properties[vlanKey] &&
+      readSystemConfigValue(db, vlanKey) === undefined
+    ) {
+      const answer = (
+        await ask({
+          scope: `network:${name}`,
+          key: 'vlan',
+          message: `VLAN tag for the "${name}" network (blank if untagged):`,
+          description: [
+            'Container provisioning reads this as the NIC tag, so a tagged fleet that leaves it',
+            'unset puts containers on the wrong VLAN without saying so. Leave it blank if this',
+            'segment is untagged.',
+          ].join(' '),
+          required: false,
+        })
+      ).trim();
+      if (answer.length > 0) {
+        writeSystemConfigValue(db, vlanKey, answer);
+        applied.push(`${vlanKey} = ${answer}`);
+      }
+    }
+
+    // 3. The gateway — OBSERVED. celilo catalogues every machine's interfaces at
+    //    `machine add`, so the router's address inside this subnet is a fact it
+    //    already holds. Absent means no router leg is catalogued there yet, which
+    //    a later `machine add` or firewall deploy resolves; it is not a question.
+    const gatewayKey = `network.${name}.gateway`;
+    if (
+      subnet &&
+      schema.properties[gatewayKey] &&
+      readSystemConfigValue(db, gatewayKey) === undefined
+    ) {
+      const observed = observeGateway(db, subnet);
+      if (observed) {
+        writeSystemConfigValue(db, gatewayKey, observed);
+        applied.push(`${gatewayKey} = ${observed} (observed from the machine catalogue)`);
+      }
+    }
+  }
+
+  return { success: true, applied };
+}

package/src/services/system-init.ts

@@ -15,7 +15,7 @@ import { systemConfig } from '../db/schema';
 /**
  * System configuration schema interface
  */
-interface SystemConfigSchema {
+export interface SystemConfigSchema {
   properties: Record<
     string,
     {
@@ -26,6 +26,17 @@ interface SystemConfigSchema {
       minimum?: number;
       maximum?: number;
       format?: string;
+      /**
+       * A starting offer for an interview, deliberately NOT a `default`.
+       *
+       * `getDefaultConfiguration()` seeds every `default:` it finds at `system
+       * init`, and network addressing is specifically not seeded
+       * (openspec/specs/progressive-zone-disclosure/spec.md). A separate field
+       * is structurally incapable of becoming a row nobody chose: it is only
+       * ever read to pre-fill a question the operator still has to answer
+       * ([[services/network-ensure.ts]]).
+       */
+      suggested?: string;
     }
   >;
 }
@@ -33,7 +44,7 @@ interface SystemConfigSchema {
 /**
  * Load system config schema from JSON file
  */
-function loadSchema(): SystemConfigSchema {
+export function loadSchema(): SystemConfigSchema {
   // Try common locations (relative to this file's directory and cwd)
   const thisDir = dirname(new URL(import.meta.url).pathname);
   const candidates = [
@@ -80,7 +91,7 @@ export function getDefaultConfiguration(): Record<string, string | number> {
  * @param subnet - CIDR notation (e.g., "10.0.10.0/24")
  * @returns Gateway IP (e.g., "10.0.10.1")
  */
-function computeGateway(subnet: string): string {
+export function computeGateway(subnet: string): string {
   const [network, _bits] = subnet.split('/');
   const octets = network.split('.').map(Number);
 

package/src/test-utils/bus-responder.ts

@@ -42,6 +42,7 @@ import { type DbClient, createDbClient } from '../db/client';
 import type {
   ConfigRequiredPayload,
   EnsureRequiredPayload,
+  InterviewRequiredPayload,
   SecretRequiredPayload,
 } from '../services/bus-interview';
 import {
@@ -79,6 +80,8 @@ export interface BusResponderFixture {
   seenSecretPayloads(): SecretRequiredPayload[];
   /** Snapshot of every ensure.required payload the responder saw. */
   seenEnsurePayloads(): EnsureRequiredPayload[];
+  /** Snapshot of every generic interview.required payload the responder saw. */
+  seenInterviewPayloads(): InterviewRequiredPayload[];
   /** Stop watching and close the bus + db connections. */
   close(): void;
 }
@@ -102,7 +105,16 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
   const handle: ProgrammaticResponderHandle = startProgrammaticResponder({
     busDbPath: opts.busDbPath,
     db,
-    values: { config: opts.config, secrets: opts.secrets, ensures: opts.ensures },
+    // Every family the fixture's options type accepts must be forwarded, or a
+    // test supplies an answer that silently never arrives and the deploy hangs
+    // on a question nobody is listening for.
+    values: {
+      config: opts.config,
+      secrets: opts.secrets,
+      ensures: opts.ensures,
+      interview: opts.interview,
+      aspects: opts.aspects,
+    },
     onMissing: 'throw',
     emittedBy: 'test-bus-responder',
   });
@@ -114,6 +126,7 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
     seenConfigPayloads: () => handle.seenConfigPayloads(),
     seenSecretPayloads: () => handle.seenSecretPayloads(),
     seenEnsurePayloads: () => handle.seenEnsurePayloads(),
+    seenInterviewPayloads: () => handle.seenInterviewPayloads(),
     close: () => {
       handle.close();
       db.$client.close();