@serfab/cadre-host 0.7.1 → 0.8.1

package/dist/bin/host.js

@@ -25,6 +25,9 @@ import { UpdateService } from '../update/index.js';
 import { HostProcessOrchestrator } from '../orchestrator/index.js';
 import { TrustCircleService, TrustCircleStore } from '../auth/index.js';
 import { NatService } from '../nat/index.js';
+import { createSecretsStore } from '../nat/secrets/index.js';
+import { resolvePushCredentials, setFcmSecret, setApnsSecret, clearPushSecret, pushStatus, } from '../push/index.js';
+import { AuthorityNodeClient } from '../authority/index.js';
 import { createLocalUiServer, HostSettingsStore } from '../server/index.js';
 import { openBrowser } from '../installer/browser.js';
 const DEFAULT_PORT = Number(process.env.CADRE_HOST_PORT ?? '8765');
@@ -36,7 +39,6 @@ function looksLikePeerId(id) {
 function resolvePort(raw) {
     const n = Number(raw);
     if (!Number.isFinite(n) || n <= 0 || n > 65535) {
-        // eslint-disable-next-line no-console
         console.error(`Invalid --port: ${raw}`);
         process.exit(1);
     }
@@ -76,13 +78,9 @@ program
             system: Boolean(opts.system),
             ...(opts.nodePath ? { nodePath: opts.nodePath } : {}),
         });
-        // eslint-disable-next-line no-console
         console.log(`cadre-host installed.`);
-        // eslint-disable-next-line no-console
         console.log(`  Data dir:     ${result.dataDir}`);
-        // eslint-disable-next-line no-console
         console.log(`  UI:           ${result.uiUrl}`);
-        // eslint-disable-next-line no-console
         console.log(`  Service:      ${result.serviceName}`);
         if (result.enrollmentInvite) {
             printEnrollmentInvite(result.enrollmentInvite);
@@ -90,7 +88,6 @@ program
         process.exit(0);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`install failed: ${err.message}`);
         process.exit(1);
     }
@@ -129,12 +126,10 @@ program
             removeData: Boolean(opts.removeData),
             ...(opts.dataDir ? { dataDir: opts.dataDir } : {}),
         });
-        // eslint-disable-next-line no-console
         console.log('cadre-host uninstalled.');
         process.exit(0);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`uninstall failed: ${err.message}`);
         process.exit(1);
     }
@@ -149,14 +144,11 @@ program
     const installer = new Installer();
     try {
         const status = await installer.status();
-        // eslint-disable-next-line no-console
         console.log(`Service installed: ${status.installed ? 'yes' : 'no'}`);
-        // eslint-disable-next-line no-console
         console.log(`Service running:   ${status.running ? 'yes' : 'no'}`);
         process.exit(0);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`status failed: ${err.message}`);
         process.exit(1);
     }
@@ -176,7 +168,6 @@ program
         const dataDir = opts.dataDir ?? process.env.CADRE_HOST_DATA_DIR ?? defaultDataDir(platform);
         const cfgPath = resolveConfigPath(dataDir);
         if (!existsSync(cfgPath)) {
-            // eslint-disable-next-line no-console
             console.error(`cadre-host start: ${cfgPath} not found. ` +
                 `Run \`cadre-host install\` first (or pass --data-dir to an existing install).`);
             process.exit(1);
@@ -185,12 +176,10 @@ program
         const cfg = readHostConfig(cfgPath);
         const idPath = resolveIdentityPath(cfg.dataDir);
         if (!existsSync(idPath)) {
-            // eslint-disable-next-line no-console
             console.error(`cadre-host start: identity file not found at ${idPath}. Re-run \`cadre-host install\`.`);
             process.exit(1);
             return;
         }
-        // eslint-disable-next-line no-console
         console.log(`cadre-host starting (dataDir=${cfg.dataDir}, uiPort=${cfg.uiPort})`);
         // Update flow: notify-by-default; auto-apply opt-in via host.config.json.
         // The local-UI ticket (6.5) wires the handlers into HTTP routes; here we
@@ -223,29 +212,66 @@ program
                 updateHostConfig(cfgPath, { updates: next });
             }
             catch (err) {
-                // eslint-disable-next-line no-console
                 console.error(`failed to persist updated settings to ${cfgPath}: ${err.message}`);
             }
         });
         // Don't block startup on the network round-trip — call and forget.
         void updateService.check();
         updateService.start();
-        // Wire the long-lived HTTP management server. The trust-circle and
-        // NAT services depend on a libp2p `CadreNodeLike`; v1 has no node-
-        // spawning path yet (that's a follow-up ticket), so we inject minimal
-        // stubs that fail loudly if a real call is attempted. The /auth/* and
-        // /nat/* routes are still mounted so the CLI's existing HTTP contract
-        // is intact — operations that genuinely need the libp2p node will
-        // surface a NatError / TrustCircleError, mapped to 500 by the server.
-        const orchestrator = new HostProcessOrchestrator({ rootDir: join(cfg.dataDir, 'orchestrator') });
+        // Wire the long-lived HTTP management server. The manager holds no
+        // in-process cadre node: it spawns the admin's **authority node** as a
+        // managed child and delegates authority/membership/identity operations
+        // to it over the node's loopback admin channel (the 6.6 contract). The
+        // manager never joins the control network (see docs/cadre-host.md
+        // § Control-plane separation).
+        // Push (FCM/APNs) credentials are resolved fresh on every node spawn so a
+        // restart re-reads the secret store (rotated keys) and nothing raw is
+        // persisted in state.json. The non-secret bits (bundle id / sandbox toggle,
+        // cooldown/debounce) are re-read from host.config.json each call too.
+        const pushSecrets = await createSecretsStore(cfg.dataDir);
+        const orchestrator = new HostProcessOrchestrator({
+            rootDir: join(cfg.dataDir, 'orchestrator'),
+            pushResolver: () => resolvePushCredentials(pushSecrets, readHostConfig(cfgPath).push),
+        });
         await orchestrator.init();
+        // Spawn the authority node. Best-effort: a spawn failure leaves the
+        // management API up (trust-circle listing degrades to local labels,
+        // authority ops return 503) rather than taking down the whole process.
+        try {
+            await orchestrator.ensureAuthorityNode({
+                identityPath: idPath,
+                partyId: cfg.installId,
+                libp2pPort: cfg.libp2pPort,
+            });
+            console.log('cadre-host: authority node spawned');
+        }
+        catch (err) {
+            console.error(`authority node spawn failed: ${err.message}`);
+        }
+        // The client reads the admin endpoint lazily so a node restart's fresh
+        // bearer token is picked up automatically.
+        const authority = new AuthorityNodeClient(() => orchestrator.getAuthorityAdminEndpoint());
         const trustCircle = new TrustCircleService({
-            cadreNode: missingCadreNodeStub('trust-circle'),
+            cadreNode: authority,
             store: new TrustCircleStore(cfg.dataDir),
         });
         const natService = new NatService({
             rootDir: cfg.dataDir,
-            cadreNode: missingNatNodeStub(),
+            cadreNode: authority,
+        });
+        // Push NAT-resolved invite addresses to the node on every NAT change.
+        // NatService.start() also fires this once as an initial push, retried
+        // until the freshly spawned authority node accepts it (bounded; the
+        // management API that mints invites comes up only after start() resolves).
+        natService.onAddressesChanged(async (addresses) => {
+            if (addresses.length === 0)
+                return;
+            try {
+                await authority.pushInviteAddresses(addresses);
+            }
+            catch (err) {
+                console.error(`invite-address push failed: ${err.message}`);
+            }
         });
         // Best-effort NAT start. Failures here aren't fatal — the local UI
         // can still serve the trust circle, settings, etc.
@@ -253,7 +279,6 @@ program
             await natService.start();
         }
         catch (err) {
-            // eslint-disable-next-line no-console
             console.error(`NAT start failed: ${err.message}`);
         }
         const settingsStore = new HostSettingsStore({ dataDir: cfg.dataDir });
@@ -268,10 +293,8 @@ program
         });
         const { url, port } = await server.start();
         if (port !== cfg.uiPort) {
-            // eslint-disable-next-line no-console
             console.log(`(configured port ${cfg.uiPort} was in use — bound on ${port} instead)`);
         }
-        // eslint-disable-next-line no-console
         console.log(`cadre-host local UI: ${url}`);
         await waitForTermination();
         try {
@@ -282,13 +305,15 @@ program
             await natService.stop();
         }
         catch { /* ignore */ }
+        try {
+            await orchestrator.stopAuthorityNode();
+        }
+        catch { /* ignore */ }
         updateService.stop();
-        // eslint-disable-next-line no-console
         console.log('cadre-host stopped.');
         process.exit(0);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`start failed: ${err.message}`);
         process.exit(1);
     }
@@ -307,30 +332,25 @@ program
         const dataDir = opts.dataDir ?? process.env.CADRE_HOST_DATA_DIR ?? defaultDataDir(platform);
         const cfgPath = resolveConfigPath(dataDir);
         if (!existsSync(cfgPath)) {
-            // eslint-disable-next-line no-console
             console.error(`cadre-host ui: ${cfgPath} not found. Run \`cadre-host install\` first.`);
             process.exit(1);
             return;
         }
         const cfg = readHostConfig(cfgPath);
         const url = `http://127.0.0.1:${cfg.uiPort}`;
-        // eslint-disable-next-line no-console
         console.log(url);
         if (opts.browser !== false) {
             const res = openBrowser(url);
             if (res.spawned) {
-                // eslint-disable-next-line no-console
                 console.log('(Opening in your default browser...)');
             }
             else if (res.error) {
-                // eslint-disable-next-line no-console
                 console.error(`(unable to launch browser: ${res.error})`);
             }
         }
         process.exit(0);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`ui failed: ${err.message}`);
         process.exit(1);
     }
@@ -355,28 +375,6 @@ function readPackageVersionForStart() {
         return '0.0.0-unknown';
     }
 }
-/**
- * Returns a `CadreNodeLike` for TrustCircleService that fails loudly on any
- * libp2p call. cadre-host v1 doesn't yet spawn the host's own cadre node —
- * that ticket is separate. The trust-circle HTTP endpoints still load the
- * local labels/pending file (listing works), but issuing/redeeming an invite
- * requires a real node and surfaces a 500.
- */
-function missingCadreNodeStub(name) {
-    return {
-        async createInvite() { throw new Error(`${name}: cadre-host v1 has no inline cadre node — cannot issue invite`); },
-        async acceptPhone() { throw new Error(`${name}: cadre-host v1 has no inline cadre node — cannot redeem`); },
-        async removePeer() { throw new Error(`${name}: cadre-host v1 has no inline cadre node — cannot remove peer`); },
-        encodeInvite() { throw new Error(`${name}: cadre-host v1 has no inline cadre node — cannot encode invite`); },
-        getControlDatabase() { return null; },
-    };
-}
-function missingNatNodeStub() {
-    return {
-        getPeerId() { return ''; },
-        getMultiaddrs() { return []; },
-    };
-}
 function waitForTermination() {
     return new Promise((resolveTerm) => {
         const done = () => resolveTerm();
@@ -398,23 +396,18 @@ async function confirmDestructive(message) {
 const requireForQr = createRequire(import.meta.url);
 function printEnrollmentInvite(invite) {
     // Best-effort QR render — fall back to the bare token if the lib chokes.
-    // eslint-disable-next-line no-console
     console.log('\nEnroll your first device with this invite:');
     try {
         const qr = requireForQr('qrcode-terminal');
         qr.generate(invite.encodedInvite, { small: true }, (rendered) => {
-            // eslint-disable-next-line no-console
             console.log(rendered);
         });
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`(qrcode-terminal unavailable: ${err.message})`);
     }
-    // eslint-disable-next-line no-console
     console.log(`  ${invite.encodedInvite}`);
     if (invite.expiresAt) {
-        // eslint-disable-next-line no-console
         console.log(`  (expires ${invite.expiresAt})`);
     }
 }
@@ -431,7 +424,6 @@ program
         ttlMs = parseDuration(opts.ttl);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`Invalid --ttl: ${err.message}`);
         process.exit(1);
         return;
@@ -447,7 +439,6 @@ program
         });
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`Failed to reach cadre-host at ${url}: ${err.message}\n` +
             `Hint: is cadre-host running? Try \`cadre-host start\`.`);
         process.exit(2);
@@ -455,22 +446,18 @@ program
     }
     if (!response.ok) {
         const text = await response.text().catch(() => '');
-        // eslint-disable-next-line no-console
         console.error(`cadre-host returned ${response.status}: ${text || response.statusText}`);
         process.exit(1);
         return;
     }
     const body = await response.json();
     if (!body.encodedInvite) {
-        // eslint-disable-next-line no-console
         console.error('cadre-host returned malformed response (missing encodedInvite)');
         process.exit(1);
         return;
     }
-    // eslint-disable-next-line no-console
     console.log(body.encodedInvite);
     if (body.expiresAt) {
-        // eslint-disable-next-line no-console
         console.error(`(expires at ${body.expiresAt})`);
     }
     process.exit(0);
@@ -490,41 +477,33 @@ trust
         response = await fetch(url);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`Failed to reach cadre-host at ${url}: ${err.message}`);
         process.exit(2);
         return;
     }
     if (!response.ok) {
-        // eslint-disable-next-line no-console
         console.error(`cadre-host returned ${response.status}: ${response.statusText}`);
         process.exit(1);
         return;
     }
     const body = await response.json();
-    // eslint-disable-next-line no-console
     console.log('Members:');
     if (body.members.length === 0) {
-        // eslint-disable-next-line no-console
         console.log('  (none)');
     }
     else {
         for (const m of body.members) {
             const self = m.self ? ' [self]' : '';
-            // eslint-disable-next-line no-console
             console.log(`  ${m.peerId}  ${m.label}${self}`);
         }
     }
-    // eslint-disable-next-line no-console
     console.log('\nPending invites:');
     if (body.pending.length === 0) {
-        // eslint-disable-next-line no-console
         console.log('  (none)');
     }
     else {
         for (const p of body.pending) {
             const expires = p.expiresAt ? ` (expires ${p.expiresAt})` : '';
-            // eslint-disable-next-line no-console
             console.log(`  ${p.token}  ${p.label}${expires}`);
         }
     }
@@ -550,19 +529,16 @@ trust
         response = await fetch(`${base}${path}`, { method: 'DELETE' });
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`Failed to reach cadre-host at ${base}: ${err.message}`);
         process.exit(2);
         return;
     }
     if (!response.ok) {
         const text = await response.text().catch(() => '');
-        // eslint-disable-next-line no-console
         console.error(`cadre-host returned ${response.status}: ${text || response.statusText}`);
         process.exit(1);
         return;
     }
-    // eslint-disable-next-line no-console
     console.log(`revoked ${kind}: ${id}`);
     process.exit(0);
 });
@@ -582,7 +558,6 @@ nat
     const url = `http://${opts.host}:${resolvePort(opts.port)}/nat/status`;
     const body = await getJson(url);
     if (opts.json) {
-        // eslint-disable-next-line no-console
         console.log(JSON.stringify(body, null, 2));
     }
     else {
@@ -600,7 +575,6 @@ nat
     const url = `http://${opts.host}:${resolvePort(opts.port)}/nat/test`;
     const body = await postJson(url, {});
     if (opts.json) {
-        // eslint-disable-next-line no-console
         console.log(JSON.stringify(body, null, 2));
     }
     else {
@@ -645,7 +619,6 @@ ddns
     .option('--host <host>', 'cadre-host management API host', '127.0.0.1')
     .action(async (provider, opts) => {
     if (!opts.hostname) {
-        // eslint-disable-next-line no-console
         console.error('--hostname is required');
         process.exit(1);
         return;
@@ -655,7 +628,6 @@ ddns
         config.token = opts.token;
     if (!config.token) {
         if (!process.stdin.isTTY) {
-            // eslint-disable-next-line no-console
             console.error('Missing --token for provider "' + provider + '" and stdin is not a TTY. ' +
                 'Re-run with --token <secret>.');
             process.exit(1);
@@ -665,7 +637,6 @@ ddns
             config.token = await readSecretLine('DDNS token: ');
         }
         catch (err) {
-            // eslint-disable-next-line no-console
             console.error('Failed to read token: ' + err.message);
             process.exit(1);
             return;
@@ -699,6 +670,160 @@ ddns
     printNatStatus(body);
     process.exit(0);
 });
+// ============================================================================
+// push subcommands — provision FCM/APNs credentials for strand-wake delivery
+// ============================================================================
+//
+// These operate directly on the data dir's secret store + host.config.json (they
+// do NOT go through the running management API). Private keys land in the OS
+// keychain (keytar) or the 0600 file-store fallback; the non-secret bits (APNs
+// bundle id / sandbox toggle, cooldown/debounce) land in host.config.json. New
+// credentials take effect on the next authority-node (re)spawn — run
+// `cadre-host` restart (or restart the service) to apply them immediately.
+const push = program
+    .command('push')
+    .description('Configure FCM/APNs push credentials for mobile strand-wake delivery');
+push
+    .command('fcm')
+    .description('Store Firebase Cloud Messaging (Android) service-account credentials')
+    .requiredOption('--project-id <id>', 'GCP / Firebase project id')
+    .requiredOption('--client-email <email>', 'Service-account email')
+    .option('--private-key-file <path>', 'Path to the service-account private key (PEM)')
+    .option('--private-key <pem>', 'Inline PEM private key (prefer --private-key-file)')
+    .option('--data-dir <path>', 'Override the data directory (env: CADRE_HOST_DATA_DIR)')
+    .action(async (opts) => {
+    const { dataDir } = resolveHostPaths(opts.dataDir);
+    const privateKey = readPrivateKeyArg(opts.privateKeyFile, opts.privateKey, 'FCM');
+    const secrets = await createSecretsStore(dataDir);
+    await setFcmSecret(secrets, {
+        projectId: opts.projectId,
+        clientEmail: opts.clientEmail,
+        privateKey,
+    });
+    console.log('✓ FCM credentials stored. Restart cadre-host to apply on the authority node.');
+    process.exit(0);
+});
+push
+    .command('apns')
+    .description('Store Apple Push Notification service (iOS) auth-key credentials')
+    .requiredOption('--key-id <id>', 'APNs key id (the .p8 key identifier)')
+    .requiredOption('--team-id <id>', 'Apple developer team id')
+    .requiredOption('--bundle-id <id>', 'App bundle id (becomes the apns-topic)')
+    .option('--private-key-file <path>', 'Path to the .p8 auth key (PEM)')
+    .option('--private-key <pem>', 'Inline .p8 PEM key (prefer --private-key-file)')
+    .option('--production', 'Target the production APNs host (default: sandbox)')
+    .option('--data-dir <path>', 'Override the data directory (env: CADRE_HOST_DATA_DIR)')
+    .action(async (opts) => {
+    const { dataDir, cfgPath } = resolveHostPaths(opts.dataDir);
+    const privateKey = readPrivateKeyArg(opts.privateKeyFile, opts.privateKey, 'APNs');
+    const secrets = await createSecretsStore(dataDir);
+    // Secret bits → secret store; non-secret app-config → host.config.json.
+    await setApnsSecret(secrets, { keyId: opts.keyId, teamId: opts.teamId, privateKey });
+    const current = readHostConfig(cfgPath);
+    updateHostConfig(cfgPath, {
+        push: {
+            ...current.push,
+            apns: { bundleId: opts.bundleId, production: opts.production === true },
+        },
+    });
+    console.log(`✓ APNs credentials stored (${opts.production ? 'production' : 'sandbox'}). ` +
+        `Restart cadre-host to apply on the authority node.`);
+    process.exit(0);
+});
+push
+    .command('options')
+    .description('Set non-secret push tuning (anti-spam cooldown / burst-coalesce window)')
+    .option('--cooldown-ms <ms>', 'Per-(peer,strand) minimum gap between wakes', parseIntArg)
+    .option('--debounce-ms <ms>', 'Per-strand burst-coalescing window', parseIntArg)
+    .option('--data-dir <path>', 'Override the data directory (env: CADRE_HOST_DATA_DIR)')
+    .action((opts) => {
+    const { cfgPath } = resolveHostPaths(opts.dataDir);
+    const current = readHostConfig(cfgPath);
+    const nextPush = { ...current.push };
+    if (typeof opts.cooldownMs === 'number')
+        nextPush.cooldownMs = opts.cooldownMs;
+    if (typeof opts.debounceMs === 'number')
+        nextPush.debounceMs = opts.debounceMs;
+    updateHostConfig(cfgPath, { push: nextPush });
+    console.log('✓ Push options updated.');
+    process.exit(0);
+});
+push
+    .command('clear')
+    .description('Remove stored push credentials')
+    .argument('<target>', 'Which to clear: "fcm", "apns", or "all"')
+    .option('--data-dir <path>', 'Override the data directory (env: CADRE_HOST_DATA_DIR)')
+    .action(async (target, opts) => {
+    if (!['fcm', 'apns', 'all'].includes(target)) {
+        console.error(`push clear: target must be one of fcm | apns | all (got "${target}")`);
+        process.exit(1);
+        return;
+    }
+    const { dataDir, cfgPath } = resolveHostPaths(opts.dataDir);
+    const secrets = await createSecretsStore(dataDir);
+    if (target === 'fcm' || target === 'all')
+        await clearPushSecret(secrets, 'fcm');
+    if (target === 'apns' || target === 'all') {
+        await clearPushSecret(secrets, 'apns');
+        const current = readHostConfig(cfgPath);
+        if (current.push?.apns) {
+            const { apns: _drop, ...rest } = current.push;
+            updateHostConfig(cfgPath, { push: rest });
+        }
+    }
+    console.log(`✓ Cleared push credentials: ${target}. Restart cadre-host to apply.`);
+    process.exit(0);
+});
+push
+    .command('status')
+    .description('Show which push platforms are configured (no secret material)')
+    .option('--data-dir <path>', 'Override the data directory (env: CADRE_HOST_DATA_DIR)')
+    .action(async (opts) => {
+    const { dataDir, cfgPath } = resolveHostPaths(opts.dataDir);
+    const secrets = await createSecretsStore(dataDir);
+    const status = await pushStatus(secrets);
+    const cfg = readHostConfig(cfgPath);
+    console.log('Push credentials:');
+    console.log(`  FCM:  ${status.fcm ? 'configured' : 'not configured'}`);
+    const prod = cfg.push?.apns?.production ? 'production' : 'sandbox';
+    const bundle = cfg.push?.apns?.bundleId ? ` bundle=${cfg.push.apns.bundleId} (${prod})` : '';
+    console.log(`  APNs: ${status.apns ? `configured${bundle}` : 'not configured'}`);
+    if (cfg.push?.cooldownMs !== undefined)
+        console.log(`  cooldownMs: ${cfg.push.cooldownMs}`);
+    if (cfg.push?.debounceMs !== undefined)
+        console.log(`  debounceMs: ${cfg.push.debounceMs}`);
+    process.exit(0);
+});
+/** Resolve the data dir + config path for a direct-on-disk push subcommand. */
+function resolveHostPaths(dataDirOpt) {
+    const platform = detectPlatform();
+    const dataDir = dataDirOpt ?? process.env.CADRE_HOST_DATA_DIR ?? defaultDataDir(platform);
+    const cfgPath = resolveConfigPath(dataDir);
+    if (!existsSync(cfgPath)) {
+        console.error(`${cfgPath} not found. Run \`cadre-host install\` first (or pass --data-dir).`);
+        process.exit(1);
+    }
+    // Resolve the real data dir from the persisted config (handles default-dir installs).
+    const cfg = readHostConfig(cfgPath);
+    return { dataDir: cfg.dataDir, cfgPath };
+}
+/** Read a private key from a file or inline flag; exit with a clear error if neither. */
+function readPrivateKeyArg(file, inline, label) {
+    if (file) {
+        try {
+            return readFileSync(file, 'utf8');
+        }
+        catch (err) {
+            console.error(`Failed to read ${label} private key file ${file}: ${err.message}`);
+            process.exit(1);
+        }
+    }
+    if (inline)
+        return inline;
+    console.error(`${label}: supply --private-key-file <path> (or --private-key <pem>).`);
+    process.exit(1);
+    throw new Error('unreachable');
+}
 async function getJson(url) {
     return await callJson(url, 'GET');
 }
@@ -719,7 +844,6 @@ async function callJson(url, method, body) {
         response = await fetch(url, init);
     }
     catch (err) {
-        // eslint-disable-next-line no-console
         console.error(`Failed to reach cadre-host at ${url}: ${err.message}\n` +
             `Hint: is cadre-host running? Try \`cadre-host start\`.`);
         process.exit(2);
@@ -727,7 +851,6 @@ async function callJson(url, method, body) {
     }
     if (!response.ok) {
         const text = await response.text().catch(() => '');
-        // eslint-disable-next-line no-console
         console.error(`cadre-host returned ${response.status}: ${text || response.statusText}`);
         process.exit(1);
         throw new Error('non-ok');
@@ -737,36 +860,26 @@ async function callJson(url, method, body) {
     return await response.json();
 }
 function printNatStatus(s) {
-    // eslint-disable-next-line no-console
     console.log(`Port mapping: ${s.portMode ?? '?'} (external ${s.externalPort ?? '?'} → internal ${s.internalPort ?? '?'})`);
     if (s.routerExternalIp) {
-        // eslint-disable-next-line no-console
         console.log(`Router IP:    ${s.routerExternalIp}`);
     }
-    // eslint-disable-next-line no-console
     console.log(`External IP:  ${s.externalIp ?? '(unknown)'}${s.cgnatDetected ? '  [CGNAT detected]' : ''}`);
-    // eslint-disable-next-line no-console
     console.log(`Reachability: ${s.directReachability ?? 'unknown'}${s.lastTestedAt ? `  (tested ${s.lastTestedAt})` : ''}`);
     if (s.mappingLeaseExpiresAt) {
-        // eslint-disable-next-line no-console
         console.log(`Lease expires: ${s.mappingLeaseExpiresAt}`);
     }
     const ddns = s.ddns ?? {};
     if (ddns.providerId || ddns.hostname) {
-        // eslint-disable-next-line no-console
         console.log(`\nDDNS:`);
-        // eslint-disable-next-line no-console
         console.log(`  Provider:   ${ddns.providerId ?? '(none)'}${ddns.externallyManaged ? '  [externally managed]' : ''}`);
-        // eslint-disable-next-line no-console
         console.log(`  Hostname:   ${ddns.hostname ?? '(unset)'}`);
         if (ddns.lastUpdateAt) {
             const ok = ddns.lastUpdateOk ? 'OK' : 'FAIL';
-            // eslint-disable-next-line no-console
             console.log(`  Last update: ${ok} at ${ddns.lastUpdateAt}${ddns.lastError ? `  — ${ddns.lastError}` : ''}`);
         }
     }
     else {
-        // eslint-disable-next-line no-console
         console.log('\nDDNS: not configured');
     }
 }
@@ -822,5 +935,5 @@ function readSecretLine(prompt) {
         stdin.on('data', onData);
     });
 }
-program.parseAsync();
+void program.parseAsync();
 //# sourceMappingURL=host.js.map