@serfab/cadre-host 0.7.1 → 0.9.0

package/dist/update/sign.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Typed signing core for the release-manifest pipeline.
+ *
+ * The offline `.mjs` CLI wrappers (`scripts/sign-manifest.mjs`) stay thin by
+ * delegating manifest construction, field validation, and the sign + self-verify
+ * round-trip to this module — keeping the logic typed and unit-testable instead
+ * of hand-rolled in a script. None of this ships in the running binary's hot
+ * path: it is only reached by the operator's offline signing tool (and tests).
+ */
+import { type KeyObject } from 'node:crypto';
+import type { SignedManifest, UpdateManifest } from './types.js';
+/** Flat input shape the signing CLI collects from flags or a JSON file. */
+export interface ManifestFields {
+    /** Released version (semver). */
+    version: string;
+    /** npm package the release publishes under. */
+    package: string;
+    /** npm dist-tag (e.g. `latest`). */
+    tag: string;
+    /** ISO-8601 publish timestamp (must round-trip exactly). */
+    publishedAt: string;
+    /** Optional human-facing release-notes URL. */
+    releaseNotesUrl?: string;
+    /** Optional minimum previous version that can step directly to this release. */
+    minPreviousVersion?: string;
+}
+/**
+ * Construct a well-formed `UpdateManifest` from flat fields and run the exact
+ * `validateManifestFields` rules `verifyManifest` will later apply — so the
+ * signing tool fails loudly on a bad semver / npm name / non-ISO timestamp
+ * rather than emitting a manifest the verifier would reject as `manifest_invalid`.
+ */
+export declare function buildManifest(fields: ManifestFields): UpdateManifest;
+/**
+ * Derive the raw 32-byte Ed25519 public key (base64) from a private key by
+ * stripping the 12-byte SPKI DER header — the same form `release-key.ts`
+ * embeds and `ed25519FromRaw` consumes.
+ */
+export declare function derivePublicKeyBase64(privateKey: KeyObject): string;
+/**
+ * Sign a manifest and immediately verify the result against the public key
+ * *derived from the same private key*, independent of whatever key the running
+ * environment trusts. Throws if the self-check fails, so the signing tool never
+ * emits an envelope it could not itself verify.
+ */
+export declare function signAndSelfVerify(manifest: UpdateManifest, privateKey: KeyObject): SignedManifest;

package/dist/update/sign.js

@@ -0,0 +1,53 @@
+/**
+ * Typed signing core for the release-manifest pipeline.
+ *
+ * The offline `.mjs` CLI wrappers (`scripts/sign-manifest.mjs`) stay thin by
+ * delegating manifest construction, field validation, and the sign + self-verify
+ * round-trip to this module — keeping the logic typed and unit-testable instead
+ * of hand-rolled in a script. None of this ships in the running binary's hot
+ * path: it is only reached by the operator's offline signing tool (and tests).
+ */
+import { createPublicKey } from 'node:crypto';
+import { signManifest, validateManifestFields, verifyManifest } from './manifest.js';
+/**
+ * Construct a well-formed `UpdateManifest` from flat fields and run the exact
+ * `validateManifestFields` rules `verifyManifest` will later apply — so the
+ * signing tool fails loudly on a bad semver / npm name / non-ISO timestamp
+ * rather than emitting a manifest the verifier would reject as `manifest_invalid`.
+ */
+export function buildManifest(fields) {
+    const manifest = {
+        v: 1,
+        version: fields.version,
+        publishedAt: fields.publishedAt,
+        channels: { npm: { package: fields.package, tag: fields.tag } },
+        ...(fields.releaseNotesUrl !== undefined ? { releaseNotesUrl: fields.releaseNotesUrl } : {}),
+        ...(fields.minPreviousVersion !== undefined ? { minPreviousVersion: fields.minPreviousVersion } : {}),
+    };
+    validateManifestFields(manifest);
+    return manifest;
+}
+/**
+ * Derive the raw 32-byte Ed25519 public key (base64) from a private key by
+ * stripping the 12-byte SPKI DER header — the same form `release-key.ts`
+ * embeds and `ed25519FromRaw` consumes.
+ */
+export function derivePublicKeyBase64(privateKey) {
+    const spki = createPublicKey(privateKey).export({ format: 'der', type: 'spki' });
+    return Buffer.from(spki.subarray(12)).toString('base64');
+}
+/**
+ * Sign a manifest and immediately verify the result against the public key
+ * *derived from the same private key*, independent of whatever key the running
+ * environment trusts. Throws if the self-check fails, so the signing tool never
+ * emits an envelope it could not itself verify.
+ */
+export function signAndSelfVerify(manifest, privateKey) {
+    const signed = signManifest(manifest, privateKey);
+    const publicRawB64 = derivePublicKeyBase64(privateKey);
+    // verifyManifest honors the env override; point it at the derived key only so
+    // the self-check is against this key pair, not the embedded/dev key.
+    verifyManifest(signed, { CADRE_HOST_UPDATE_DEV_KEY: publicRawB64 });
+    return signed;
+}
+//# sourceMappingURL=sign.js.map

package/dist/update/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/update/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAmBrF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAsB;IAClD,MAAM,QAAQ,GAAmB;QAC/B,CAAC,EAAE,CAAC;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE;QAC/D,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtG,CAAC;IACF,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAqB;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAwB,EAAE,UAAqB;IAC/E,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACvD,8EAA8E;IAC9E,qEAAqE;IACrE,cAAc,CAAC,MAAM,EAAE,EAAE,yBAAyB,EAAE,YAAY,EAAuB,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serfab/cadre-host",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "type": "module",
   "description": "Self-hosted cadre node manager for basement-PC deployments",
   "main": "dist/index.js",
@@ -38,6 +38,8 @@
     "build:server": "tsc -p tsconfig.build.json",
     "build:ui": "vite build --config ui/vite.config.ts",
     "dev:ui": "vite --config ui/vite.config.ts",
+    "typecheck": "tsc -p tsconfig.typecheck.json --noEmit",
+    "check:svelte": "svelte-check --tsconfig tsconfig.json --workspace ui",
     "test": "vitest run --passWithNoTests",
     "dev:test": "vitest",
     "start": "node dist/bin/host.js"
@@ -59,9 +61,12 @@
   },
   "dependencies": {
     "@achingbrain/nat-port-mapper": "^4.0.0",
-    "@serfab/cadre-cli": "^0.7.1",
-    "@serfab/cadre-core": "^0.7.1",
-    "@serfab/cadre-provider": "^0.7.1",
+    "@libp2p/crypto": "^5.1.13",
+    "@libp2p/interface": "^3.1.0",
+    "@libp2p/peer-id": "^6.0.4",
+    "@serfab/cadre-cli": "^0.9.0",
+    "@serfab/cadre-core": "^0.9.0",
+    "@serfab/cadre-provider": "^0.9.0",
     "commander": "^14.0.2",
     "debug": "^4.4.3",
     "fastify": "^5.7.1",

package/service/README.md

@@ -1,86 +1,95 @@
-# Cadre Host Service Units
-
-Host cadre-host as a per-user system service. All three units are configured
-so that **a clean exit (code 0) is final** — `cadre-host uninstall` (or any
-explicit `systemctl stop` / `nssm stop`) leaves the service stopped. Crashes
-still trigger a restart.
-
-| Platform | File | Service host |
-| -------- | ---- | ------------ |
-| Linux    | [`cadre-host.service.tmpl`](./cadre-host.service.tmpl)             | systemd (user) |
-| macOS    | [`com.serfab.cadre-host.plist.tmpl`](./com.serfab.cadre-host.plist.tmpl) | launchd (LaunchAgent) |
-| Windows  | [`install-service.ps1`](./install-service.ps1) / [`uninstall-service.ps1`](./uninstall-service.ps1) | NSSM |
-
-The `.tmpl` files contain `@TOKEN@` placeholders that the installer
-substitutes at install time (`@NODE_PATH@`, `@HOST_JS@`, `@DATA_DIR@`).
-Inspect the rendered files under `~/.config/systemd/user/cadre-host.service`
-or `~/Library/LaunchAgents/com.serfab.cadre-host.plist` after running
-`cadre-host install`.
-
-## Scope (v1)
-
-**Per-user install only.** The systemd unit is installed under the user's
-control (`systemctl --user`), the launchd unit is a `LaunchAgent` (not a
-`LaunchDaemon`), and NSSM runs as the current user.
-
-A `--system` flag is accepted by `cadre-host install` but currently errors
-out — running cadre-host as a dedicated system user requires more work
-around data-dir ownership and capability dropping. Tracked separately.
-
-## Linux (systemd) — manual smoke
-
-```bash
-# Render + install + enable + start in one go:
-cadre-host install --non-interactive --data-dir ~/.local/share/cadre-host
-
-# After install, the unit lives at:
-#   ~/.config/systemd/user/cadre-host.service
-# Inspect status:
-systemctl --user status cadre-host
-journalctl --user -u cadre-host -f
-```
-
-`Restart=on-failure` + `RestartPreventExitStatus=0` make exit 0 final.
-
-The installer also runs `loginctl enable-linger <user>` so the unit survives
-logout / reboot.
-
-## macOS (launchd) — manual smoke
-
-```bash
-cadre-host install --non-interactive --data-dir "$HOME/Library/Application Support/CadreHost"
-
-# After install, the plist lives at:
-#   ~/Library/LaunchAgents/com.serfab.cadre-host.plist
-launchctl print gui/$(id -u)/com.serfab.cadre-host
-tail -f "$HOME/Library/Application Support/CadreHost/logs/out.log"
-```
-
-`KeepAlive.SuccessfulExit = false` plus `KeepAlive.Crashed = true` mean a
-clean exit stays down while a crash is relaunched.
-
-## Windows (NSSM) — manual smoke
-
-Install [NSSM](https://nssm.cc/download) and put `nssm.exe` on PATH first.
-
-```powershell
-cadre-host install --non-interactive --data-dir $env:LocalAppData\CadreHost
-
-# After install, inspect the service:
-nssm.exe status CadreHost
-Get-Service CadreHost
-Get-Content $env:LocalAppData\CadreHost\logs\out.log -Tail 30 -Wait
-```
-
-`AppExit 0 Exit` tells NSSM not to restart on clean exit; other exit codes
-are handled by `AppExit Default Restart` with a 5-second delay and a
-10-second throttle. NSSM is **not** bundled with the npm package; the
-standalone-binary distribution (see `tickets/backlog/cadre-host-standalone-binary.md`)
-will ship it.
-
-## CI gap
-
-Cross-platform CI does **not** invoke `systemctl --user enable`,
-`launchctl bootstrap`, or `nssm install`. The installer's unit-rendering
-logic is covered by unit tests; the actual service-host registration must
-be smoke-tested manually on each platform before tagging a release.
+# Cadre Host Service Units
+
+Host cadre-host as a per-user system service. All three units are configured
+so that **a clean exit (code 0) is final** — `cadre-host uninstall` (or any
+explicit `systemctl stop` / `nssm stop`) leaves the service stopped. Crashes
+still trigger a restart.
+
+| Platform | File | Service host |
+| -------- | ---- | ------------ |
+| Linux    | [`cadre-host.service.tmpl`](./cadre-host.service.tmpl)             | systemd (user) |
+| macOS    | [`com.serfab.cadre-host.plist.tmpl`](./com.serfab.cadre-host.plist.tmpl) | launchd (LaunchAgent) |
+| Windows  | [`install-service.ps1`](./install-service.ps1) / [`uninstall-service.ps1`](./uninstall-service.ps1) | NSSM |
+
+The `.tmpl` files contain `@TOKEN@` placeholders that the installer
+substitutes at install time (`@NODE_PATH@`, `@HOST_JS@`, `@DATA_DIR@`).
+Inspect the rendered files under `~/.config/systemd/user/cadre-host.service`
+or `~/Library/LaunchAgents/com.serfab.cadre-host.plist` after running
+`cadre-host install`.
+
+## Scope (v1)
+
+**Per-user install only.** The systemd unit is installed under the user's
+control (`systemctl --user`), the launchd unit is a `LaunchAgent` (not a
+`LaunchDaemon`), and NSSM runs as the current user.
+
+A `--system` flag is accepted by `cadre-host install` but currently errors
+out — running cadre-host as a dedicated system user requires more work
+around data-dir ownership and capability dropping. Tracked separately.
+
+## Linux (systemd) — manual smoke
+
+```bash
+# Render + install + enable + start in one go:
+cadre-host install --non-interactive --data-dir ~/.local/share/cadre-host
+
+# After install, the unit lives at:
+#   ~/.config/systemd/user/cadre-host.service
+# Inspect status:
+systemctl --user status cadre-host
+journalctl --user -u cadre-host -f
+```
+
+`Restart=on-failure` + `RestartPreventExitStatus=0` make exit 0 final.
+
+The installer attempts `loginctl enable-linger <user>` so the unit survives
+logout / reboot. This is the **one** step in the install that requires root,
+and it is opportunistic: if `loginctl` is missing or you aren't root, the
+installer logs a warning and continues. Without linger the user-systemd
+service runs only while you have an active session (desktop or SSH) and
+stops when you log out. You can enable linger separately, before or after
+`cadre-host install`:
+
+```bash
+sudo loginctl enable-linger "$USER"
+```
+
+## macOS (launchd) — manual smoke
+
+```bash
+cadre-host install --non-interactive --data-dir "$HOME/Library/Application Support/CadreHost"
+
+# After install, the plist lives at:
+#   ~/Library/LaunchAgents/com.serfab.cadre-host.plist
+launchctl print gui/$(id -u)/com.serfab.cadre-host
+tail -f "$HOME/Library/Application Support/CadreHost/logs/out.log"
+```
+
+`KeepAlive.SuccessfulExit = false` plus `KeepAlive.Crashed = true` mean a
+clean exit stays down while a crash is relaunched.
+
+## Windows (NSSM) — manual smoke
+
+Install [NSSM](https://nssm.cc/download) and put `nssm.exe` on PATH first.
+
+```powershell
+cadre-host install --non-interactive --data-dir $env:LocalAppData\CadreHost
+
+# After install, inspect the service:
+nssm.exe status CadreHost
+Get-Service CadreHost
+Get-Content $env:LocalAppData\CadreHost\logs\out.log -Tail 30 -Wait
+```
+
+`AppExit 0 Exit` tells NSSM not to restart on clean exit; other exit codes
+are handled by `AppExit Default Restart` with a 5-second delay and a
+10-second throttle. NSSM is **not** bundled with the npm package; the
+standalone-binary distribution (see `tickets/backlog/cadre-host-standalone-binary.md`)
+will ship it.
+
+## CI gap
+
+Cross-platform CI does **not** invoke `systemctl --user enable`,
+`launchctl bootstrap`, or `nssm install`. The installer's unit-rendering
+logic is covered by unit tests; the actual service-host registration must
+be smoke-tested manually on each platform before tagging a release.

package/src/__tests__/cli-invite.smoke.test.ts

@@ -13,11 +13,16 @@ import { createServer, type IncomingMessage, type Server, type ServerResponse }
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const binPath = resolve(here, '../../dist/bin/host.js');
 
+// These smoke tests cold-start the built CLI as a child process (Node boot +,
+// for some, an HTTP server). That comfortably exceeds vitest's 5s default under
+// heavy parallel load, so give the subprocess generous headroom.
+vi.setConfig({ testTimeout: 30000 });
+
 interface StubServer {
   server: Server;
   port: number;

package/src/__tests__/cli-nat.smoke.test.ts

@@ -15,11 +15,16 @@ import { createServer, type IncomingMessage, type Server, type ServerResponse }
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const binPath = resolve(here, '../../dist/bin/host.js');
 
+// These smoke tests cold-start the built CLI as a child process (Node boot +,
+// for some, an HTTP server). That comfortably exceeds vitest's 5s default under
+// heavy parallel load, so give the subprocess generous headroom.
+vi.setConfig({ testTimeout: 30000 });
+
 interface StubServer {
   server: Server;
   port: number;

package/src/__tests__/cli.smoke.test.ts

@@ -7,11 +7,16 @@ import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const binPath = resolve(here, '../../dist/bin/host.js');
 
+// These smoke tests cold-start the built CLI as a child process (Node boot +,
+// for some, an HTTP server). That comfortably exceeds vitest's 5s default under
+// heavy parallel load, so give the subprocess generous headroom.
+vi.setConfig({ testTimeout: 30000 });
+
 describe('cadre-host CLI smoke test', () => {
   it('prints help with all subcommands', () => {
     if (!existsSync(binPath)) {

package/src/__tests__/host-owner.smoke.test.ts

@@ -0,0 +1,123 @@
+/**
+ * Server-level smoke: the /auth/* HTTP contract over the owner-node
+ * channel adapter. Validates the two behaviours the realignment must
+ * preserve:
+ *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
+ *   2. With the node refusing connections, GET /auth/trust-circle still lists
+ *      local labels, and POST /auth/invites returns 503 (not a raw 500).
+ *
+ * The owner node is represented by a stub HTTP server matching the 6.6
+ * admin contract (the spawn path itself is covered by
+ * orchestrator-owner.test.ts).
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import Fastify from 'fastify';
+import http from 'node:http';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
+import { OwnerNodeClient } from '../owner/index.js';
+import { registerErrorHandler } from '../server/error-handler.js';
+import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
+import { EventBus } from '../server/events/bus.js';
+
+const TOKEN = 'tok';
+
+let tmpRoot: string;
+beforeEach(() => { tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-smoke-')); });
+afterEach(() => { try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ } });
+
+function buildApp(service: TrustCircleService) {
+  const app = Fastify();
+  registerErrorHandler(app);
+  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(service), events: new EventBus() });
+  return app;
+}
+
+describe('host /auth delegation — node up', () => {
+  let server: http.Server;
+  let baseUrl: string;
+
+  beforeEach(async () => {
+    server = http.createServer((req, res) => {
+      const chunks: Buffer[] = [];
+      req.on('data', (c) => chunks.push(c as Buffer));
+      req.on('end', () => {
+        if (req.headers['authorization'] !== `Bearer ${TOKEN}`) {
+          res.writeHead(401); res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'x' } })); return;
+        }
+        if (req.url === '/admin/invites' && req.method === 'POST') {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
+          return;
+        }
+        if (req.url === '/admin/members' && req.method === 'GET') {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, data: { members: [] } }));
+          return;
+        }
+        res.writeHead(400); res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    const a = server.address();
+    baseUrl = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
+  });
+
+  afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
+
+  it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
+    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
+    const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
+    const app = buildApp(service);
+    try {
+      const res = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Mom' } });
+      expect(res.statusCode).toBe(200);
+      const body = res.json() as { encodedInvite: string };
+      expect(body.encodedInvite).toBe('ENC');
+    } finally {
+      await app.close();
+    }
+  });
+});
+
+describe('host /auth delegation — node refusing connections', () => {
+  let closedBaseUrl: string;
+
+  beforeEach(async () => {
+    const tmp = http.createServer();
+    const port = await new Promise<number>((resolve) => {
+      tmp.listen(0, '127.0.0.1', () => {
+        const a = tmp.address();
+        resolve(typeof a === 'object' && a ? a.port : 0);
+      });
+    });
+    await new Promise<void>((resolve) => tmp.close(() => resolve()));
+    closedBaseUrl = `http://127.0.0.1:${port}`;
+  });
+
+  it('GET /auth/trust-circle lists local labels and POST /auth/invites returns 503', async () => {
+    const store = new TrustCircleStore(tmpRoot);
+    store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
+
+    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
+    const service = new TrustCircleService({ cadreNode: client, store });
+    const app = buildApp(service);
+    try {
+      const list = await app.inject({ method: 'GET', url: '/auth/trust-circle' });
+      expect(list.statusCode).toBe(200);
+      const snap = list.json() as { members: Array<{ peerId: string; label: string }> };
+      expect(snap.members.some((m) => m.peerId === '12D3KooWLocal' && m.label === 'My laptop')).toBe(true);
+
+      const invite = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Dad' } });
+      expect(invite.statusCode).toBe(503);
+      const body = invite.json() as { error: { code: string } };
+      expect(body.error.code).toBe('node_unavailable');
+    } finally {
+      await app.close();
+    }
+  });
+});