@serfab/cadre-host 0.10.0 → 0.11.0

package/src/installer/service-host/index.ts

@@ -1,21 +1,21 @@
-/**
- * Pick the right service-host impl for the current platform.
- */
-
-import { detectPlatform, type SupportedPlatform } from '../platform.js';
-import { SystemdServiceHost } from './systemd.js';
-import { LaunchdServiceHost } from './launchd.js';
-import { NssmServiceHost } from './nssm.js';
-import type { ServiceHost } from './types.js';
-
-export type { ServiceHost, ServiceHostContext, ServiceHostStatus } from './types.js';
-
-export function createServiceHost(platform: SupportedPlatform = detectPlatform()): ServiceHost {
-  switch (platform) {
-    case 'linux':  return new SystemdServiceHost();
-    case 'darwin': return new LaunchdServiceHost();
-    case 'win32':  return new NssmServiceHost();
-  }
-}
-
-export { SystemdServiceHost, LaunchdServiceHost, NssmServiceHost };
+/**
+ * Pick the right service-host impl for the current platform.
+ */
+
+import { detectPlatform, type SupportedPlatform } from '../platform.js';
+import { SystemdServiceHost } from './systemd.js';
+import { LaunchdServiceHost } from './launchd.js';
+import { NssmServiceHost } from './nssm.js';
+import type { ServiceHost } from './types.js';
+
+export type { ServiceHost, ServiceHostContext, ServiceHostStatus } from './types.js';
+
+export function createServiceHost(platform: SupportedPlatform = detectPlatform()): ServiceHost {
+  switch (platform) {
+    case 'linux':  return new SystemdServiceHost();
+    case 'darwin': return new LaunchdServiceHost();
+    case 'win32':  return new NssmServiceHost();
+  }
+}
+
+export { SystemdServiceHost, LaunchdServiceHost, NssmServiceHost };

package/src/installer/service-host/template.ts

@@ -1,21 +1,21 @@
-/**
- * Tiny `@TOKEN@` substitution. Used to render systemd / launchd unit
- * files. Throws if any tokens are left after substitution to catch
- * typos at install time rather than at service-startup time.
- */
-
-const TOKEN_RE = /@([A-Z][A-Z0-9_]*)@/g;
-
-export function renderTemplate(template: string, tokens: Readonly<Record<string, string>>): string {
-  const rendered = template.replace(TOKEN_RE, (full, key: string) => {
-    if (!Object.prototype.hasOwnProperty.call(tokens, key)) {
-      throw new Error(`renderTemplate: missing value for token ${full}`);
-    }
-    return tokens[key];
-  });
-  const leftover = rendered.match(TOKEN_RE);
-  if (leftover) {
-    throw new Error(`renderTemplate: unresolved tokens: ${leftover.join(', ')}`);
-  }
-  return rendered;
-}
+/**
+ * Tiny `@TOKEN@` substitution. Used to render systemd / launchd unit
+ * files. Throws if any tokens are left after substitution to catch
+ * typos at install time rather than at service-startup time.
+ */
+
+const TOKEN_RE = /@([A-Z][A-Z0-9_]*)@/g;
+
+export function renderTemplate(template: string, tokens: Readonly<Record<string, string>>): string {
+  const rendered = template.replace(TOKEN_RE, (full, key: string) => {
+    if (!Object.prototype.hasOwnProperty.call(tokens, key)) {
+      throw new Error(`renderTemplate: missing value for token ${full}`);
+    }
+    return tokens[key];
+  });
+  const leftover = rendered.match(TOKEN_RE);
+  if (leftover) {
+    throw new Error(`renderTemplate: unresolved tokens: ${leftover.join(', ')}`);
+  }
+  return rendered;
+}

package/src/installer/wizard.ts

@@ -1,103 +1,103 @@
-/**
- * Interactive install wizard.
- *
- * Pure readline — no extra deps. Each prompt is decomposed into a small
- * `Prompt` so the test can drive the wizard with a scripted Iterable of
- * answers. Production code wires the prompts to stdin.
- */
-
-import { createInterface, type Interface as ReadlineInterface } from 'node:readline';
-
-import { defaultDataDir } from './paths.js';
-import type { SupportedPlatform } from './platform.js';
-
-export interface WizardDefaults {
-  dataDir: string;
-  uiPort: number;
-  libp2pPort: number;
-  upnpEnabled: boolean;
-  /** Also run the host's own personal cadre here (founder persona). Default false. */
-  ownCadre: boolean;
-}
-
-export interface WizardAnswers {
-  dataDir: string;
-  uiPort: number;
-  libp2pPort: number;
-  upnpEnabled: boolean;
-  configureDdns: boolean;
-  /** Also run the host's own personal cadre here (founder persona). */
-  ownCadre: boolean;
-}
-
-export const DEFAULT_UI_PORT = 8765;
-export const DEFAULT_LIBP2P_PORT = 4001;
-
-export function defaultsForPlatform(platform: SupportedPlatform): WizardDefaults {
-  return {
-    dataDir: defaultDataDir(platform),
-    uiPort: DEFAULT_UI_PORT,
-    libp2pPort: DEFAULT_LIBP2P_PORT,
-    upnpEnabled: true,
-    ownCadre: false,
-  };
-}
-
-/**
- * Drive the wizard with a function that returns the next user answer for
- * a prompt. Used both by the readline-backed `runWizard` and by tests.
- */
-export async function runWizardWith(
-  defaults: WizardDefaults,
-  ask: (label: string, fallback: string) => Promise<string>,
-): Promise<WizardAnswers> {
-  const dataDir = (await ask('Data directory', defaults.dataDir)).trim() || defaults.dataDir;
-  const uiPort = parsePort(await ask('UI port (localhost only)', String(defaults.uiPort)), defaults.uiPort);
-  const libp2pPort = parsePort(await ask('Cadre libp2p port', String(defaults.libp2pPort)), defaults.libp2pPort);
-  const upnpEnabled = parseBool(
-    await ask('Attempt UPnP port mapping on this network? [Y/n]', defaults.upnpEnabled ? 'Y' : 'n'),
-    defaults.upnpEnabled,
-  );
-  const configureDdns = parseBool(await ask('Configure DDNS now? [y/N]', 'N'), false);
-  // Founder persona (opt-in). Most installs just donate nodes to friends and
-  // answer no — a no leaves cadre-host donor-only (no owner node, no /auth+/nat).
-  const ownCadre = parseBool(
-    await ask('Also run your own personal cadre on this machine? (most people just donating nodes to friends say no) [y/N]', defaults.ownCadre ? 'Y' : 'N'),
-    defaults.ownCadre,
-  );
-  return { dataDir, uiPort, libp2pPort, upnpEnabled, configureDdns, ownCadre };
-}
-
-/** Production entrypoint — drives the wizard over stdin/stdout. */
-export async function runWizard(defaults: WizardDefaults): Promise<WizardAnswers> {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    return await runWizardWith(defaults, async (label, fallback) => prompt(rl, label, fallback));
-  } finally {
-    rl.close();
-  }
-}
-
-function prompt(rl: ReadlineInterface, label: string, fallback: string): Promise<string> {
-  return new Promise<string>((resolve) => {
-    rl.question(`${label} [${fallback}]: `, (answer) => resolve(answer));
-  });
-}
-
-function parsePort(input: string, fallback: number): number {
-  const trimmed = input.trim();
-  if (!trimmed) return fallback;
-  const n = Number(trimmed);
-  if (!Number.isInteger(n) || n <= 0 || n > 65535) {
-    throw new Error(`Invalid port: ${input}`);
-  }
-  return n;
-}
-
-function parseBool(input: string, fallback: boolean): boolean {
-  const trimmed = input.trim().toLowerCase();
-  if (!trimmed) return fallback;
-  if (['y', 'yes', 'true', '1'].includes(trimmed)) return true;
-  if (['n', 'no', 'false', '0'].includes(trimmed)) return false;
-  throw new Error(`Invalid yes/no answer: ${input}`);
-}
+/**
+ * Interactive install wizard.
+ *
+ * Pure readline — no extra deps. Each prompt is decomposed into a small
+ * `Prompt` so the test can drive the wizard with a scripted Iterable of
+ * answers. Production code wires the prompts to stdin.
+ */
+
+import { createInterface, type Interface as ReadlineInterface } from 'node:readline';
+
+import { defaultDataDir } from './paths.js';
+import type { SupportedPlatform } from './platform.js';
+
+export interface WizardDefaults {
+  dataDir: string;
+  uiPort: number;
+  libp2pPort: number;
+  upnpEnabled: boolean;
+  /** Also run the host's own personal cadre here (founder persona). Default false. */
+  ownCadre: boolean;
+}
+
+export interface WizardAnswers {
+  dataDir: string;
+  uiPort: number;
+  libp2pPort: number;
+  upnpEnabled: boolean;
+  configureDdns: boolean;
+  /** Also run the host's own personal cadre here (founder persona). */
+  ownCadre: boolean;
+}
+
+export const DEFAULT_UI_PORT = 8765;
+export const DEFAULT_LIBP2P_PORT = 4001;
+
+export function defaultsForPlatform(platform: SupportedPlatform): WizardDefaults {
+  return {
+    dataDir: defaultDataDir(platform),
+    uiPort: DEFAULT_UI_PORT,
+    libp2pPort: DEFAULT_LIBP2P_PORT,
+    upnpEnabled: true,
+    ownCadre: false,
+  };
+}
+
+/**
+ * Drive the wizard with a function that returns the next user answer for
+ * a prompt. Used both by the readline-backed `runWizard` and by tests.
+ */
+export async function runWizardWith(
+  defaults: WizardDefaults,
+  ask: (label: string, fallback: string) => Promise<string>,
+): Promise<WizardAnswers> {
+  const dataDir = (await ask('Data directory', defaults.dataDir)).trim() || defaults.dataDir;
+  const uiPort = parsePort(await ask('UI port (localhost only)', String(defaults.uiPort)), defaults.uiPort);
+  const libp2pPort = parsePort(await ask('Cadre libp2p port', String(defaults.libp2pPort)), defaults.libp2pPort);
+  const upnpEnabled = parseBool(
+    await ask('Attempt UPnP port mapping on this network? [Y/n]', defaults.upnpEnabled ? 'Y' : 'n'),
+    defaults.upnpEnabled,
+  );
+  const configureDdns = parseBool(await ask('Configure DDNS now? [y/N]', 'N'), false);
+  // Founder persona (opt-in). Most installs just donate nodes to friends and
+  // answer no — a no leaves cadre-host donor-only (no owner node, no /auth+/nat).
+  const ownCadre = parseBool(
+    await ask('Also run your own personal cadre on this machine? (most people just donating nodes to friends say no) [y/N]', defaults.ownCadre ? 'Y' : 'N'),
+    defaults.ownCadre,
+  );
+  return { dataDir, uiPort, libp2pPort, upnpEnabled, configureDdns, ownCadre };
+}
+
+/** Production entrypoint — drives the wizard over stdin/stdout. */
+export async function runWizard(defaults: WizardDefaults): Promise<WizardAnswers> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await runWizardWith(defaults, async (label, fallback) => prompt(rl, label, fallback));
+  } finally {
+    rl.close();
+  }
+}
+
+function prompt(rl: ReadlineInterface, label: string, fallback: string): Promise<string> {
+  return new Promise<string>((resolve) => {
+    rl.question(`${label} [${fallback}]: `, (answer) => resolve(answer));
+  });
+}
+
+function parsePort(input: string, fallback: number): number {
+  const trimmed = input.trim();
+  if (!trimmed) return fallback;
+  const n = Number(trimmed);
+  if (!Number.isInteger(n) || n <= 0 || n > 65535) {
+    throw new Error(`Invalid port: ${input}`);
+  }
+  return n;
+}
+
+function parseBool(input: string, fallback: boolean): boolean {
+  const trimmed = input.trim().toLowerCase();
+  if (!trimmed) return fallback;
+  if (['y', 'yes', 'true', '1'].includes(trimmed)) return true;
+  if (['n', 'no', 'false', '0'].includes(trimmed)) return false;
+  throw new Error(`Invalid yes/no answer: ${input}`);
+}

package/src/nat/__tests__/address-resolver.test.ts

@@ -1,82 +1,82 @@
-import { describe, expect, it } from 'vitest';
-
-import { buildInviteAddresses } from '../address-resolver.js';
-
-const PEER = '12D3KooWHost';
-
-describe('buildInviteAddresses', () => {
-  it('returns dns4 when reachable and a DDNS hostname is configured', () => {
-    const addrs = buildInviteAddresses({
-      peerId: PEER,
-      externalPort: 4001,
-      ddnsHostname: 'foo.duckdns.org',
-      externalIp: '1.2.3.4',
-      reachable: true,
-      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
-    });
-    expect(addrs).toEqual([`/dns4/foo.duckdns.org/tcp/4001/p2p/${PEER}`]);
-  });
-
-  it('falls back to ip4 when reachable but no DDNS hostname', () => {
-    const addrs = buildInviteAddresses({
-      peerId: PEER,
-      externalPort: 4001,
-      ddnsHostname: null,
-      externalIp: '203.0.113.5',
-      reachable: true,
-      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
-    });
-    expect(addrs).toEqual([`/ip4/203.0.113.5/tcp/4001/p2p/${PEER}`]);
-  });
-
-  it('falls back to libp2p addrs when not reachable', () => {
-    const addrs = buildInviteAddresses({
-      peerId: PEER,
-      externalPort: 4001,
-      ddnsHostname: 'foo.duckdns.org',
-      externalIp: '1.2.3.4',
-      reachable: false,
-      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001', '/p2p-circuit'],
-    });
-    expect(addrs.length).toBeGreaterThan(0);
-    expect(addrs.some((a) => a.startsWith('/dns4/'))).toBe(false);
-    expect(addrs.some((a) => a.startsWith('/ip4/'))).toBe(true);
-  });
-
-  it('appends peer suffix to libp2p addrs that lack one', () => {
-    const addrs = buildInviteAddresses({
-      peerId: PEER,
-      externalPort: 4001,
-      ddnsHostname: null,
-      externalIp: null,
-      reachable: false,
-      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
-    });
-    expect(addrs).toEqual([`/ip4/192.168.1.10/tcp/4001/p2p/${PEER}`]);
-  });
-
-  it('preserves libp2p addrs that already have a /p2p/ suffix', () => {
-    const existing = `/ip4/192.168.1.10/tcp/4001/p2p/${PEER}`;
-    const addrs = buildInviteAddresses({
-      peerId: PEER,
-      externalPort: 4001,
-      ddnsHostname: null,
-      externalIp: null,
-      reachable: false,
-      libp2pAddrs: [existing],
-    });
-    expect(addrs).toEqual([existing]);
-  });
-
-  it('does not emit /ip4/ for IPv6 external IP — falls back instead', () => {
-    const addrs = buildInviteAddresses({
-      peerId: PEER,
-      externalPort: 4001,
-      ddnsHostname: null,
-      externalIp: '2001:db8::1',
-      reachable: true,
-      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
-    });
-    expect(addrs.some((a) => a.startsWith('/ip4/192.168.1.10'))).toBe(true);
-  });
-});
+import { describe, expect, it } from 'vitest';
+
+import { buildInviteAddresses } from '../address-resolver.js';
+
+const PEER = '12D3KooWHost';
+
+describe('buildInviteAddresses', () => {
+  it('returns dns4 when reachable and a DDNS hostname is configured', () => {
+    const addrs = buildInviteAddresses({
+      peerId: PEER,
+      externalPort: 4001,
+      ddnsHostname: 'foo.duckdns.org',
+      externalIp: '1.2.3.4',
+      reachable: true,
+      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
+    });
+    expect(addrs).toEqual([`/dns4/foo.duckdns.org/tcp/4001/p2p/${PEER}`]);
+  });
+
+  it('falls back to ip4 when reachable but no DDNS hostname', () => {
+    const addrs = buildInviteAddresses({
+      peerId: PEER,
+      externalPort: 4001,
+      ddnsHostname: null,
+      externalIp: '203.0.113.5',
+      reachable: true,
+      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
+    });
+    expect(addrs).toEqual([`/ip4/203.0.113.5/tcp/4001/p2p/${PEER}`]);
+  });
+
+  it('falls back to libp2p addrs when not reachable', () => {
+    const addrs = buildInviteAddresses({
+      peerId: PEER,
+      externalPort: 4001,
+      ddnsHostname: 'foo.duckdns.org',
+      externalIp: '1.2.3.4',
+      reachable: false,
+      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001', '/p2p-circuit'],
+    });
+    expect(addrs.length).toBeGreaterThan(0);
+    expect(addrs.some((a) => a.startsWith('/dns4/'))).toBe(false);
+    expect(addrs.some((a) => a.startsWith('/ip4/'))).toBe(true);
+  });
+
+  it('appends peer suffix to libp2p addrs that lack one', () => {
+    const addrs = buildInviteAddresses({
+      peerId: PEER,
+      externalPort: 4001,
+      ddnsHostname: null,
+      externalIp: null,
+      reachable: false,
+      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
+    });
+    expect(addrs).toEqual([`/ip4/192.168.1.10/tcp/4001/p2p/${PEER}`]);
+  });
+
+  it('preserves libp2p addrs that already have a /p2p/ suffix', () => {
+    const existing = `/ip4/192.168.1.10/tcp/4001/p2p/${PEER}`;
+    const addrs = buildInviteAddresses({
+      peerId: PEER,
+      externalPort: 4001,
+      ddnsHostname: null,
+      externalIp: null,
+      reachable: false,
+      libp2pAddrs: [existing],
+    });
+    expect(addrs).toEqual([existing]);
+  });
+
+  it('does not emit /ip4/ for IPv6 external IP — falls back instead', () => {
+    const addrs = buildInviteAddresses({
+      peerId: PEER,
+      externalPort: 4001,
+      ddnsHostname: null,
+      externalIp: '2001:db8::1',
+      reachable: true,
+      libp2pAddrs: ['/ip4/192.168.1.10/tcp/4001'],
+    });
+    expect(addrs.some((a) => a.startsWith('/ip4/192.168.1.10'))).toBe(true);
+  });
+});

package/src/nat/__tests__/ddns-duckdns.test.ts

@@ -1,83 +1,83 @@
-import { describe, expect, it } from 'vitest';
-
-import { duckDnsProvider } from '../ddns/duckdns.js';
-import { NatError } from '../types.js';
-
-function makeFetch(responses: Array<{ ok: boolean; status?: number; body: string }>): {
-  fetch: typeof fetch;
-  calls: string[];
-} {
-  const calls: string[] = [];
-  let i = 0;
-  const fetchImpl = (async (input: RequestInfo | URL) => {
-    calls.push(String(input));
-    const r = responses[i++] ?? { ok: false, body: '' };
-    return {
-      ok: r.ok,
-      status: r.status ?? (r.ok ? 200 : 500),
-      statusText: r.ok ? 'OK' : 'Server Error',
-      async text() { return r.body; },
-    } as unknown as Response;
-  }) as typeof fetch;
-  return { fetch: fetchImpl, calls };
-}
-
-describe('duckDnsProvider', () => {
-  it('exposes metadata', () => {
-    expect(duckDnsProvider.id).toBe('duckdns');
-    expect(duckDnsProvider.displayName).toBe('DuckDNS');
-    expect(duckDnsProvider.configFields).toHaveLength(1);
-    expect(duckDnsProvider.configFields[0]).toMatchObject({ key: 'token', secret: true });
-  });
-
-  it('OK response → resolves', async () => {
-    const f = makeFetch([{ ok: true, body: 'OK' }]);
-    await expect(
-      duckDnsProvider.update({ token: 'T' }, 'foo.duckdns.org', '1.2.3.4', { fetch: f.fetch }),
-    ).resolves.toBeUndefined();
-    expect(f.calls[0]).toContain('domains=foo');
-    expect(f.calls[0]).toContain('token=T');
-    expect(f.calls[0]).toContain('ip=1.2.3.4');
-  });
-
-  it('KO response → throws ddns_update_failed', async () => {
-    const f = makeFetch([{ ok: true, body: 'KO' }]);
-    await expect(
-      duckDnsProvider.update({ token: 'T' }, 'foo', '1.2.3.4', { fetch: f.fetch }),
-    ).rejects.toMatchObject({ code: 'ddns_update_failed' });
-  });
-
-  it('HTTP error → throws ddns_update_failed', async () => {
-    const f = makeFetch([{ ok: false, status: 503, body: '' }]);
-    await expect(
-      duckDnsProvider.update({ token: 'T' }, 'foo', '1.2.3.4', { fetch: f.fetch }),
-    ).rejects.toMatchObject({ code: 'ddns_update_failed' });
-  });
-
-  it('strips trailing .duckdns.org from hostname', async () => {
-    const f = makeFetch([{ ok: true, body: 'OK' }]);
-    await duckDnsProvider.update({ token: 'T' }, 'MyHost.DuckDNS.ORG', '1.2.3.4', { fetch: f.fetch });
-    expect(f.calls[0]).toContain('domains=myhost');
-  });
-
-  it('missing token → ddns_credentials_missing', async () => {
-    const f = makeFetch([]);
-    await expect(
-      duckDnsProvider.update({}, 'foo', '1.2.3.4', { fetch: f.fetch }),
-    ).rejects.toMatchObject({ code: 'ddns_credentials_missing' });
-  });
-
-  it('empty hostname → invalid_config', async () => {
-    const f = makeFetch([]);
-    await expect(
-      duckDnsProvider.update({ token: 'T' }, '   ', '1.2.3.4', { fetch: f.fetch }),
-    ).rejects.toBeInstanceOf(NatError);
-  });
-
-  it('network error → ddns_update_failed', async () => {
-    const f = (async () => { throw new Error('ENETUNREACH'); }) as typeof fetch;
-    await expect(
-      duckDnsProvider.update({ token: 'T' }, 'foo', '1.2.3.4', { fetch: f }),
-    ).rejects.toMatchObject({ code: 'ddns_update_failed' });
-  });
-});
+import { describe, expect, it } from 'vitest';
+
+import { duckDnsProvider } from '../ddns/duckdns.js';
+import { NatError } from '../types.js';
+
+function makeFetch(responses: Array<{ ok: boolean; status?: number; body: string }>): {
+  fetch: typeof fetch;
+  calls: string[];
+} {
+  const calls: string[] = [];
+  let i = 0;
+  const fetchImpl = (async (input: RequestInfo | URL) => {
+    calls.push(String(input));
+    const r = responses[i++] ?? { ok: false, body: '' };
+    return {
+      ok: r.ok,
+      status: r.status ?? (r.ok ? 200 : 500),
+      statusText: r.ok ? 'OK' : 'Server Error',
+      async text() { return r.body; },
+    } as unknown as Response;
+  }) as typeof fetch;
+  return { fetch: fetchImpl, calls };
+}
+
+describe('duckDnsProvider', () => {
+  it('exposes metadata', () => {
+    expect(duckDnsProvider.id).toBe('duckdns');
+    expect(duckDnsProvider.displayName).toBe('DuckDNS');
+    expect(duckDnsProvider.configFields).toHaveLength(1);
+    expect(duckDnsProvider.configFields[0]).toMatchObject({ key: 'token', secret: true });
+  });
+
+  it('OK response → resolves', async () => {
+    const f = makeFetch([{ ok: true, body: 'OK' }]);
+    await expect(
+      duckDnsProvider.update({ token: 'T' }, 'foo.duckdns.org', '1.2.3.4', { fetch: f.fetch }),
+    ).resolves.toBeUndefined();
+    expect(f.calls[0]).toContain('domains=foo');
+    expect(f.calls[0]).toContain('token=T');
+    expect(f.calls[0]).toContain('ip=1.2.3.4');
+  });
+
+  it('KO response → throws ddns_update_failed', async () => {
+    const f = makeFetch([{ ok: true, body: 'KO' }]);
+    await expect(
+      duckDnsProvider.update({ token: 'T' }, 'foo', '1.2.3.4', { fetch: f.fetch }),
+    ).rejects.toMatchObject({ code: 'ddns_update_failed' });
+  });
+
+  it('HTTP error → throws ddns_update_failed', async () => {
+    const f = makeFetch([{ ok: false, status: 503, body: '' }]);
+    await expect(
+      duckDnsProvider.update({ token: 'T' }, 'foo', '1.2.3.4', { fetch: f.fetch }),
+    ).rejects.toMatchObject({ code: 'ddns_update_failed' });
+  });
+
+  it('strips trailing .duckdns.org from hostname', async () => {
+    const f = makeFetch([{ ok: true, body: 'OK' }]);
+    await duckDnsProvider.update({ token: 'T' }, 'MyHost.DuckDNS.ORG', '1.2.3.4', { fetch: f.fetch });
+    expect(f.calls[0]).toContain('domains=myhost');
+  });
+
+  it('missing token → ddns_credentials_missing', async () => {
+    const f = makeFetch([]);
+    await expect(
+      duckDnsProvider.update({}, 'foo', '1.2.3.4', { fetch: f.fetch }),
+    ).rejects.toMatchObject({ code: 'ddns_credentials_missing' });
+  });
+
+  it('empty hostname → invalid_config', async () => {
+    const f = makeFetch([]);
+    await expect(
+      duckDnsProvider.update({ token: 'T' }, '   ', '1.2.3.4', { fetch: f.fetch }),
+    ).rejects.toBeInstanceOf(NatError);
+  });
+
+  it('network error → ddns_update_failed', async () => {
+    const f = (async () => { throw new Error('ENETUNREACH'); }) as typeof fetch;
+    await expect(
+      duckDnsProvider.update({ token: 'T' }, 'foo', '1.2.3.4', { fetch: f }),
+    ).rejects.toMatchObject({ code: 'ddns_update_failed' });
+  });
+});