@celilo/e2e 0.8.0 → 0.9.1

package/README.md

@@ -399,3 +399,29 @@ e2e/
     smoke.test.ts           # Basic connectivity verification
     ...
 ```
+
+## Suite health policy (e2e-confidence)
+
+The suite must never be tolerated as ambient-red — a regression hiding in chronic
+red is how the install-sh DNS-pollution bug survived for weeks. Two rules:
+
+- **No ambient red.** A flaky or failing test is either *fixed* or *quarantined
+  with a tracking issue*, never left standing-red. Quarantine by adding a
+  `cele2e-ci-unsafe` marker comment to the test file (with the issue id); the
+  nightly runs `--ci-safe`, which skips quarantined tests, so it stays green on
+  the supported set. `--complete` / `--all` run everything including quarantined.
+
+- **Randomized-order lane.** Order-dependent bugs (a test polluting shared infra
+  for a *later* test) pass in fixed order and solo. The weekly `cele2e-shuffle`
+  workflow runs `--ci-safe --shuffle` to flush them out. The shuffle is seeded
+  and the seed is logged; replay a failing order exactly with:
+
+  ```bash
+  cele2e run --ci-safe --shuffle --seed=<n>
+  ```
+
+Supporting guards (so a future bug is caught at the cause, not 15 tests later):
+the shared-DNS reset verifies its own postcondition, the namecheap-ddns sim
+refuses overwrites of protected seeded records, the runner names any test that
+leaves shared DNS polluted, and readiness waits attach live-state diagnostics on
+timeout instead of speculating.

package/bin/e2e-bake-management

@@ -1,18 +1,25 @@
 #!/usr/bin/env bun
 /**
- * Bake celilo into the management image by running install.sh against the
- * simulated celilo.computer + npm registry, then `docker commit` the
- * result onto the `celilo-e2e/management:latest` tag.
+ * Bake celilo into the management image, then `docker commit` the result
+ * onto the `celilo-e2e/management:latest` tag. Two modes:
+ *
+ *   (default)     Run install.sh against the simulated celilo.computer +
+ *                 npm registry, installing the monorepo DEV cli exactly the
+ *                 way users do. Exercises install.sh end-to-end.
+ *
+ *   --published   Install the PUBLISHED @celilo/cli from REAL npm in a
+ *                 standalone container on the default docker network. The
+ *                 simulated topology has no route to npmjs.org, so this
+ *                 path deliberately runs outside it. This is what a
+ *                 monorepo-free npm consumer actually gets (ce-fo6).
  *
  * Run as the last step of `cele2e build-infra`. After this:
  *   - celilo-e2e/management:vanilla — bun + unzip + bunfig (no celilo)
- *   - celilo-e2e/management:latest  — vanilla + celilo, provisioned via
- *                                     install.sh exactly the way users do
+ *   - celilo-e2e/management:latest  — vanilla + celilo
  *
- * If install.sh regresses, this step fails build-infra loudly with the
- * script's own output. Tests cannot mask the failure by accident — the
- * default management image they all use literally cannot be produced
- * without install.sh succeeding.
+ * If the install regresses, this step fails build-infra loudly. The CLI is
+ * verified AFTER the source-mount shim is written and with no /celilo mount,
+ * so a broken shim fallback can't ship green (ISS-0124).
  */
 
 import { execSync } from 'node:child_process';
@@ -20,12 +27,6 @@ import { join } from 'node:path';
 import { ensureSharedInfra } from '../src/shared-infra';
 import { network } from '../src/network-builder';
 
-// Absolute paths relative to this script — important because cwd at
-// invocation time can be either the monorepo root (./cele2e wrapper)
-// or the package root (./cele2e build-infra after the wrapper cd's
-// into packages/e2e). Hardcoding a relative path was a real bug
-// (`packages/e2e/packages/e2e/...` doubling when cwd was already the
-// package dir) and showed up as a silent bake failure.
 const PACKAGE_ROOT = join(import.meta.dir, '..');
 const COMPOSE_FILE = join(PACKAGE_ROOT, 'docker-compose.test.yml');
 
@@ -33,42 +34,106 @@ function run(cmd: string): string {
   return execSync(cmd, { stdio: 'pipe', encoding: 'utf-8' });
 }
 
-async function main(): Promise<void> {
+interface ExecResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+type Exec = (cmd: string, timeoutMs?: number) => Promise<ExecResult>;
+
+/**
+ * Write the source-mount dev-loop shim to /usr/local/bin/celilo and verify
+ * the CLI works through it. Shared by both bake modes.
+ *
+ * The shim (at /usr/local/bin/celilo so plain `docker exec bash -c celilo`
+ * finds it) prefers a mounted /celilo workspace, else falls through to the
+ * real installed CLI at /root/.bun/bin/celilo. Two things must hold, both
+ * bitten in ISS-0124:
+ *
+ *  1. `bun add -g` links the celilo binary at /usr/local/bin/celilo as a
+ *     SYMLINK into the package (bun's global bin dir in this image is
+ *     /usr/local/bin, where bun itself lives). Writing the shim with
+ *     `> /usr/local/bin/celilo` would follow that symlink and clobber the
+ *     package's OWN launcher — turning the fallback into an infinite loop.
+ *     So we `rm -f` the symlink first and write a fresh regular file.
+ *  2. The fallback target /root/.bun/bin/celilo doesn't exist after a
+ *     /usr/local/bin install, so we point a guaranteed symlink at the
+ *     package launcher first. Guarded so an image where bun genuinely
+ *     lives under /root/.bun is left untouched.
+ *
+ * Verify runs AFTER the shim and with NO /celilo mount — i.e. exactly the
+ * shipped path — so a dangling/looping fallback fails the bake instead of
+ * shipping green.
+ */
+async function installShimAndVerify(exec: Exec, label: string): Promise<void> {
+  process.stdout.write('  source-mount shim ...... ');
+  const t0 = Date.now();
+  const shim = [
+    '#!/bin/bash',
+    'if [ -d /celilo/apps/celilo ]; then',
+    '  exec bun run /celilo/apps/celilo/src/cli/index.ts "$@"',
+    'fi',
+    'exec /root/.bun/bin/celilo "$@"',
+  ].join('\n');
+  const shimBase64 = Buffer.from(shim).toString('base64');
+  const shimResult = await exec(
+    'mkdir -p /root/.bun/bin && ' +
+      '{ [ -e /root/.bun/bin/celilo ] || ' +
+      'ln -s /root/.bun/install/global/node_modules/@celilo/cli/bin/celilo /root/.bun/bin/celilo; } && ' +
+      'rm -f /usr/local/bin/celilo && ' +
+      `echo ${shimBase64} | base64 -d > /usr/local/bin/celilo && chmod +x /usr/local/bin/celilo`,
+  );
+  if (shimResult.exitCode !== 0) {
+    throw new Error(`Shim install failed: ${shimResult.stderr}`);
+  }
+  console.log(`✔ ${Math.round((Date.now() - t0) / 1000)}s`);
+
+  process.stdout.write('  verify celilo --version  ');
+  const t1 = Date.now();
+  const verify = await exec('celilo --version 2>&1');
+  if (verify.exitCode !== 0) {
+    console.log(`✗ exit ${verify.exitCode}`);
+    console.error('--- celilo --version output ---');
+    console.error(verify.stdout);
+    console.error(verify.stderr);
+    throw new Error(
+      `celilo --version failed after shim (${label}) — image is broken (dangling shim fallback?)`,
+    );
+  }
+  console.log(`✔ ${Math.round((Date.now() - t1) / 1000)}s  (${verify.stdout.trim()})`);
+}
+
+/**
+ * Default bake: install.sh against the simulated celilo.computer / npm
+ * registry, inside the standard topology.
+ */
+async function bakeViaSim(): Promise<void> {
   console.log('▸ Baking celilo into management:latest via install.sh');
   console.log('');
 
-  // Step 1: shared infra (DNS, Pebble, simulators).
   process.stdout.write('  shared-infra ........... ');
   const t0 = Date.now();
   await ensureSharedInfra();
   console.log(`✔ ${Math.round((Date.now() - t0) / 1000)}s`);
 
-  // Step 2: per-test stack with vanilla management. Default topology so
-  // celilo.computer resolution exercises fw-isp + fw-ext.
   process.stdout.write('  per-test stack ......... ');
   const t1 = Date.now();
-  const net = await network()
-    .topology('default')
-    .managementVariant('vanilla')
-    .start();
+  const net = await network().topology('default').managementVariant('vanilla').start();
   console.log(`✔ ${Math.round((Date.now() - t1) / 1000)}s  (${net.projectName})`);
 
+  const exec: Exec = (cmd, timeoutMs) => net.exec('management', cmd, timeoutMs);
+
   let containerId = '';
   try {
-    // Step 2.5: wait for the management container's Pebble CA fetch to
-    // complete. management-routes.sh kicks off the Pebble runtime-root
-    // download in the background; if install.sh runs before that
-    // finishes, curl fails on TLS and (without pipefail) the
-    // curl-pipe-bash exits 0 silently — install.sh "ran" in 0s and
-    // no celilo gets installed. We poll an actual HTTPS GET to
-    // celilo.computer to confirm the cert chain is verifiable from
-    // inside the container.
+    // Wait for the management container's Pebble CA fetch to complete so
+    // the curl-pipe-bash below can verify TLS to celilo.computer. Without
+    // pipefail an early curl failure returns 0 silently and install.sh
+    // "runs" in 0s installing nothing.
     process.stdout.write('  pebble CA ready .......... ');
     const tCa = Date.now();
     let caReady = false;
     for (let i = 0; i < 30; i++) {
-      const probe = await net.exec(
-        'management',
+      const probe = await exec(
         'curl -fsSL --max-time 3 https://celilo.computer/install.sh -o /dev/null 2>&1',
         5_000,
       );
@@ -86,15 +151,9 @@ async function main(): Promise<void> {
     }
     console.log(`✔ ${Math.round((Date.now() - tCa) / 1000)}s`);
 
-    // Step 3: run install.sh inside the vanilla management container.
-    // install.sh is non-interactive by default (post commit 1d5f2c1) —
-    // no flags needed. `set -o pipefail` is critical: without it, a
-    // curl failure (TLS, network, etc.) returns bash's empty-stdin
-    // exit (0) and we silently "succeed" without installing anything.
     process.stdout.write('  install.sh ............. ');
     const t2 = Date.now();
-    const result = await net.exec(
-      'management',
+    const result = await exec(
       'set -o pipefail; curl -fsSL https://celilo.computer/install.sh | bash 2>&1',
       180_000,
     );
@@ -107,50 +166,9 @@ async function main(): Promise<void> {
     }
     console.log(`✔ ${Math.round((Date.now() - t2) / 1000)}s`);
 
-    // Step 4: verify celilo --version actually works after install. This
-    // is the difference between "we observed install.sh exit 0" and "we
-    // confirmed install.sh produced a working celilo." Using bash -lc so
-    // /root/.bashrc's PATH munging takes effect, mirroring the real-user
-    // experience after install.
-    process.stdout.write('  verify celilo --version  ');
-    const t3 = Date.now();
-    const verify = await net.exec('management', 'bash -lc "celilo --version" 2>&1');
-    if (verify.exitCode !== 0) {
-      console.log(`✗ exit ${verify.exitCode}`);
-      console.error('--- celilo --version output ---');
-      console.error(verify.stdout);
-      console.error(verify.stderr);
-      throw new Error('celilo --version failed after install.sh — install is broken');
-    }
-    console.log(`✔ ${Math.round((Date.now() - t3) / 1000)}s`);
-
-    // Step 5: install the source-mount shim so the dev loop (mount
-    // /celilo into a running test) keeps working — same shim the old
-    // Dockerfile.management baked in. Done at runtime here so install.sh
-    // owns the canonical celilo path; the shim is purely a dev
-    // convenience layered on top. The shim sits at /usr/local/bin/celilo
-    // so non-login shells (i.e. plain `docker exec bash -c "celilo …"`,
-    // which is what `net.celilo()` does) find it on default PATH.
-    process.stdout.write('  source-mount shim ...... ');
-    const t4 = Date.now();
-    const shim = [
-      '#!/bin/bash',
-      'if [ -d /celilo/apps/celilo ]; then',
-      '  exec bun run /celilo/apps/celilo/src/cli/index.ts "$@"',
-      'fi',
-      'exec /root/.bun/bin/celilo "$@"',
-    ].join('\n');
-    const shimBase64 = Buffer.from(shim).toString('base64');
-    const shimResult = await net.exec(
-      'management',
-      `echo ${shimBase64} | base64 -d > /usr/local/bin/celilo && chmod +x /usr/local/bin/celilo`,
-    );
-    if (shimResult.exitCode !== 0) {
-      throw new Error(`Shim install failed: ${shimResult.stderr}`);
-    }
-    console.log(`✔ ${Math.round((Date.now() - t4) / 1000)}s`);
+    // Shim + verify (verify is post-shim, no mount — the shipped path).
+    await installShimAndVerify(exec, 'sim');
 
-    // Step 6: docker commit the baked container onto the :latest tag.
     process.stdout.write('  docker commit .......... ');
     const t5 = Date.now();
     containerId = run(
@@ -163,15 +181,133 @@ async function main(): Promise<void> {
     console.log(`✔ ${Math.round((Date.now() - t5) / 1000)}s`);
   } finally {
     process.stdout.write('  tearing down ........... ');
-    const t5 = Date.now();
+    const tDown = Date.now();
     await net.stop();
-    console.log(`✔ ${Math.round((Date.now() - t5) / 1000)}s`);
+    console.log(`✔ ${Math.round((Date.now() - tDown) / 1000)}s`);
   }
 
   console.log('');
   console.log('✓ celilo-e2e/management:latest baked from install.sh');
 }
 
+/**
+ * Published bake: install the PUBLISHED @celilo/cli from REAL npm in a
+ * standalone vanilla container on the default docker network (real
+ * internet). The simulated topology has no route to npmjs.org, so we run
+ * outside it.
+ */
+async function bakeViaPublished(): Promise<void> {
+  console.log('▸ Baking PUBLISHED @celilo/cli into management:latest from real npm');
+  console.log('');
+
+  const name = 'celilo-bake-published';
+  const dexec: Exec = (cmd) => {
+    try {
+      const stdout = execSync(`docker exec ${name} bash -c ${JSON.stringify(cmd)}`, {
+        stdio: 'pipe',
+        encoding: 'utf-8',
+      });
+      return Promise.resolve({ stdout, stderr: '', exitCode: 0 });
+    } catch (e: unknown) {
+      const err = e as { stdout?: Buffer; stderr?: Buffer; status?: number };
+      return Promise.resolve({
+        stdout: err.stdout?.toString() ?? '',
+        stderr: err.stderr?.toString() ?? '',
+        exitCode: err.status ?? 1,
+      });
+    }
+  };
+
+  // Fresh container every bake — a stale one may have half-applied global state.
+  try {
+    run(`docker rm -f ${name}`);
+  } catch {
+    // no stale container — fine
+  }
+
+  process.stdout.write('  start vanilla container  ');
+  const t0 = Date.now();
+  // Default bridge network → real internet (real npm, real DNS).
+  run(`docker run -d --name ${name} celilo-e2e/management:vanilla sleep infinity`);
+  console.log(`✔ ${Math.round((Date.now() - t0) / 1000)}s`);
+
+  try {
+    // Reset bun global state before installing from real npm:
+    //  - the @celilo scope override (bunfig) pins @celilo to the sim
+    //    registry (npm-registry.lab), unresolvable on the default bridge —
+    //    move it aside so `bun add -g` reaches real npm.
+    //  - a prior monorepo bake leaves bun.lock pinning @celilo tarball URLs
+    //    to the sim registry; every later `bun add -g` then dies with
+    //    FailedToOpenSocket regardless of cache clearing (ce-fo6). Nuke it.
+    process.stdout.write('  reset bun state ........ ');
+    const t1 = Date.now();
+    const reset = await dexec(
+      'mv /root/.bunfig.toml /root/.bunfig.toml.sim 2>/dev/null; ' +
+        'rm -f /root/.bun/install/global/bun.lock; true',
+    );
+    if (reset.exitCode !== 0) {
+      throw new Error(`Failed to reset bun state: ${reset.stderr}`);
+    }
+    console.log(`✔ ${Math.round((Date.now() - t1) / 1000)}s`);
+
+    process.stdout.write('  bun add -g (real npm) .. ');
+    const t2 = Date.now();
+    const add = await dexec(
+      'bun add -g @celilo/cli@latest @celilo/event-bus@latest @celilo/e2e@latest 2>&1',
+    );
+    if (add.exitCode !== 0) {
+      console.log(`✗ exit ${add.exitCode}`);
+      console.error('--- bun add -g output ---');
+      console.error(add.stdout.slice(-3000));
+      console.error(add.stderr.slice(-2000));
+      throw new Error('bun add -g of published @celilo/* from real npm failed');
+    }
+    console.log(`✔ ${Math.round((Date.now() - t2) / 1000)}s`);
+
+    // Shim + verify (verify is post-shim, no mount — the shipped path).
+    await installShimAndVerify(dexec, 'published');
+
+    // Restore the sim @celilo scope override so the committed image is
+    // drop-in compatible with the simulated topology it runs tests in.
+    // ponytail: inert at test runtime (nothing re-fetches @celilo), kept
+    // only for parity with the sim-baked image.
+    await dexec('mv /root/.bunfig.toml.sim /root/.bunfig.toml 2>/dev/null; true');
+
+    process.stdout.write('  docker commit .......... ');
+    const t3 = Date.now();
+    // The vanilla container was started with `sleep infinity`; docker commit
+    // persists the running Cmd, so override it back to the management image's
+    // real entrypoint (Dockerfile.management: CMD ["/startup.sh"], no
+    // ENTRYPOINT). Without this the baked image never runs /startup.sh ->
+    // ssh-keys volume stays empty -> fw-main crashloops (ce-um6).
+    run(
+      `docker commit --change 'CMD ["/startup.sh"]' ${name} celilo-e2e/management:latest`,
+    );
+    console.log(`✔ ${Math.round((Date.now() - t3) / 1000)}s`);
+  } finally {
+    process.stdout.write('  removing container ..... ');
+    const t4 = Date.now();
+    try {
+      run(`docker rm -f ${name}`);
+    } catch {
+      // best-effort
+    }
+    console.log(`✔ ${Math.round((Date.now() - t4) / 1000)}s`);
+  }
+
+  console.log('');
+  console.log('✓ celilo-e2e/management:latest baked from PUBLISHED @celilo/cli');
+}
+
+async function main(): Promise<void> {
+  const published = process.argv.includes('--published');
+  if (published) {
+    await bakeViaPublished();
+  } else {
+    await bakeViaSim();
+  }
+}
+
 main().catch((err) => {
   console.error('');
   console.error(err);

package/docker/Dockerfile.management

@@ -19,6 +19,12 @@ COPY config/apt/99retries.conf /etc/apt/apt.conf.d/99retries.conf
 
 RUN apt-get update && apt-get install -y \
     openssh-client \
+    # openssh-server: the celilo-bootstrap deb Depends on it (remote-API server).
+    # Pre-caching it here keeps the bootstrap-apt foreground `apt install` fast
+    # (no download over the bumped Squid path) and mirrors reality — a real
+    # management box already runs sshd. The deb still owns the celilo-api account
+    # + forced-command authorized_keys; this only pre-stages the package.
+    openssh-server \
     ansible \
     iproute2 \
     iputils-ping \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,8 +37,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/cli-display": "^0.1.9",
-    "@celilo/event-bus": "^0.1.7",
+    "@celilo/cli-display": "workspace:^",
+    "@celilo/event-bus": "workspace:^",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },

package/scripts/pack-celilo-packages.ts

@@ -32,6 +32,7 @@
 import { execSync } from 'node:child_process';
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { ensureRegistryServerBundle } from '../src/registry-bundle';
 
 const REPO_ROOT = join(import.meta.dir, '..', '..', '..');
 
@@ -187,6 +188,15 @@ function main(): void {
   rmSync(destination, { recursive: true, force: true });
   mkdirSync(destination, { recursive: true });
 
+  // @celilo/e2e's `files[]` ships `registry-server/`, but that directory is a
+  // .gitignored build artifact — absent in a fresh checkout, so `bun pm pack`
+  // would silently pack an e2e tarball WITHOUT it. A monorepo-free consumer's
+  // `cele2e build-infra` then dies in buildDockerImages (ensureRegistryServerBundle:
+  // "published without its registry-server bundle"). Regenerate it from the
+  // sibling packages/registry-server before packing, exactly as buildDockerImages
+  // does in-monorepo. (This is why npm-consumer-smoke was red — ce-3rs.)
+  ensureRegistryServerBundle(join(REPO_ROOT, 'packages', 'e2e'));
+
   console.log(`Packing @celilo/* packages → ${destination}`);
   console.log('');
 

package/simulators/namecheap-ddns/zone-updater.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from 'bun:test';
+import { isProtectedRecord, updateZone } from './zone-updater';
+
+describe('namecheap-ddns protected records (e2e-confidence #257)', () => {
+  test('celilo.computer apex + www are protected', () => {
+    expect(isProtectedRecord('celilo.computer', '@')).toBe(true);
+    expect(isProtectedRecord('celilo.computer', '')).toBe(true);
+    expect(isProtectedRecord('celilo.computer', 'celilo.computer')).toBe(true);
+    expect(isProtectedRecord('celilo.computer', 'www')).toBe(true);
+  });
+
+  test('customer DDNS hosts are NOT protected', () => {
+    // subdomains of the reserved domain are fine — only the seeded sim records
+    // are protected
+    expect(isProtectedRecord('celilo.computer', 'app')).toBe(false);
+    expect(isProtectedRecord('celilo.computer', 'dns-int.infra')).toBe(false);
+    // other domains are entirely customer-managed
+    expect(isProtectedRecord('iamtheinternet.org', '@')).toBe(false);
+    expect(isProtectedRecord('example.net', 'www')).toBe(false);
+  });
+
+  test('updateZone refuses a protected record before touching the filesystem', () => {
+    // The guard runs before any readFileSync, so this throws the protection
+    // error (not an ENOENT) even with no /config present — proving a DDNS apex
+    // clobber of the website-sim can never reach the zone file.
+    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(/reserved e2e infrastructure/);
+    expect(() => updateZone('celilo.computer', 'www', '100.64.0.1')).toThrow(
+      /reserved e2e infrastructure/,
+    );
+  });
+});

package/simulators/namecheap-ddns/zone-updater.ts

@@ -3,14 +3,40 @@ import { readFileSync, writeFileSync } from 'node:fs';
 
 const ZONE_DIR = '/config';
 
+/**
+ * Records that are reserved e2e infrastructure and must NEVER be mutated by a
+ * customer DDNS update — the website-sim's seeded names. A DDNS update with a
+ * NAT'd source IP once clobbered celilo.computer's apex off the website-sim
+ * (100.64.0.58 -> the fw-ext gateway 100.64.0.1), silently breaking install-sh
+ * for the rest of the suite. Also a real-operator footgun: a misbehaving DDNS
+ * client must not be able to overwrite a domain's apex/website record.
+ * (e2e-confidence #257.)
+ */
+const PROTECTED_RECORDS: Record<string, ReadonlySet<string>> = {
+  'celilo.computer': new Set(['@', '', 'celilo.computer', 'www']),
+};
+
+/** True if (domain, host) names a protected (seeded sim) record. */
+export function isProtectedRecord(domain: string, host: string): boolean {
+  return PROTECTED_RECORDS[domain]?.has(host) ?? false;
+}
+
 /**
  * Update an A record in a Knot zone file and reload.
  *
  * If the host already has an A record, it's replaced.
  * If not, a new one is appended before the end of the file.
  * The SOA serial is incremented on every update.
+ *
+ * Refuses to touch protected reserved-infrastructure records (PROTECTED_RECORDS).
  */
 export function updateZone(domain: string, host: string, ip: string): void {
+  if (isProtectedRecord(domain, host)) {
+    throw new Error(
+      `Refusing DDNS update to "${host}.${domain}": it is reserved e2e infrastructure ` +
+        `(the website-sim), not a DDNS-managed host (e2e-confidence #257).`,
+    );
+  }
   const zoneFile = `${ZONE_DIR}/${domain}.zone`;
   let content = readFileSync(zoneFile, 'utf-8');
 

package/src/cli/build.test.ts

@@ -0,0 +1,47 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { stageNetappsFromRegistry } from './build';
+
+let dir: string;
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'netapps-'));
+  process.env.CELILO_REGISTRY_URL = 'https://example.test/registry/';
+});
+
+afterEach(() => {
+  globalThis.fetch = realFetch;
+  rmSync(dir, { recursive: true, force: true });
+  process.env.CELILO_REGISTRY_URL = undefined;
+});
+
+test('fetches each module latest version to <name>.netapp via the download endpoint', async () => {
+  const seen: string[] = [];
+  // @ts-expect-error — minimal fetch stub for the two shapes we call.
+  globalThis.fetch = async (url: string) => {
+    seen.push(url);
+    if (url.includes('/api/v1/modules?')) {
+      return new Response(
+        JSON.stringify({
+          modules: [
+            { name: 'caddy', max_version: '1.2.3' },
+            { name: 'namecheap', max_version: '0.4.0' },
+          ],
+        }),
+      );
+    }
+    return new Response(new Uint8Array([1, 2, 3]));
+  };
+
+  await stageNetappsFromRegistry(dir);
+
+  expect(readdirSync(dir).sort()).toEqual(['caddy.netapp', 'namecheap.netapp']);
+  expect(existsSync(join(dir, 'caddy.netapp'))).toBe(true);
+  expect([...readFileSync(join(dir, 'caddy.netapp'))]).toEqual([1, 2, 3]);
+  // Trailing slash stripped; download hits the module's max_version.
+  expect(seen).toContain('https://example.test/registry/api/v1/modules/caddy/1.2.3/download');
+  expect(seen).toContain('https://example.test/registry/api/v1/modules/namecheap/0.4.0/download');
+});