@serfab/cadre-host 0.7.1 → 0.9.0

package/src/index.ts

@@ -27,14 +27,20 @@ export type {
   ContainerResources,
 } from '@serfab/cadre-provider';
 
-export { HostProcessOrchestrator } from './orchestrator/index.js';
+export { HostProcessOrchestrator, OWNER_CONTAINER_ID } from './orchestrator/index.js';
 export type {
   HostProcessConfig,
   PersistedHandle,
   ManagedNodeInfo,
   NodeStateListener,
+  NodePorts,
+  OwnerAdminEndpoint,
+  OwnerSpawnConfig,
 } from './orchestrator/index.js';
 
+export { OwnerNodeClient, OwnerNodeUnavailableError } from './owner/index.js';
+export type { OwnerNodeClientOptions } from './owner/index.js';
+
 export {
   TrustCircleService,
   TrustCircleStore,
@@ -54,13 +60,46 @@ export type {
   TrustCircleErrorCode,
 } from './auth/index.js';
 
-export { Installer } from './installer/index.js';
+/* ──────────────── donation grant tokens ──────────────── */
+
+export {
+  GrantStore,
+  GrantService,
+  createGrantAdminHandlers,
+  GrantError,
+  DEFAULT_MAX_NODES,
+  DonationStore,
+  DonationService,
+  DonationError,
+} from './donation/index.js';
+export type {
+  Grant,
+  GrantDenyReason,
+  GrantValidation,
+  GrantValidator,
+  GrantFile,
+  GrantAdminHandlers,
+  GrantErrorCode,
+  GrantServiceOptions,
+  Donation,
+  DonationView,
+  DonationStatus,
+  DonationFile,
+  DonationErrorCode,
+  DonationProvisionRequest,
+  DonationSeedResult,
+  DonationPeerInfo,
+  DonationServiceOptions,
+} from './donation/index.js';
+
+export { Installer, readHostConfig, updateHostConfig, writeHostConfig } from './installer/index.js';
 export type {
   InstallOptions,
   InstallResult,
   UninstallOptions,
   InstallerOptions,
   HostConfigFile,
+  PushSettings,
   WizardAnswers,
   WizardDefaults,
   ServiceHost,
@@ -68,6 +107,23 @@ export type {
   ServiceHostStatus,
 } from './installer/index.js';
 
+/* ──────────────── push credentials (FCM/APNs) ──────────────── */
+
+export {
+  resolvePushCredentials,
+  setFcmSecret,
+  setApnsSecret,
+  clearPushSecret,
+  pushAccount,
+  pushStatus,
+} from './push/index.js';
+export type {
+  FcmSecret,
+  ApnsSecret,
+  PushSecretPlatform,
+  PushStatus,
+} from './push/index.js';
+
 export {
   UpdateService,
   createUpdateHandlers,
@@ -78,21 +134,28 @@ export {
   fetchManifest,
   verifyManifest,
   canonicalJson,
-  signManifestForTesting,
+  signManifest,
+  validateManifestFields,
+  buildManifest,
+  derivePublicKeyBase64,
+  signAndSelfVerify,
   compareVersions,
   parseVersion,
   getReleasePublicKey,
   getReleasePublicKeyBase64,
   ed25519FromRaw,
+  isPlaceholderReleaseKey,
 } from './update/index.js';
 export type {
   UpdateServiceOptions,
   UpdateHandlers,
   UpdateState,
+  SignedManifest,
   UpdateApplyResult,
   UpdateSettings,
   UpdateManifest,
   UpdateErrorCode,
+  ManifestFields,
   NpmExecutor,
   ServiceRestarter,
 } from './update/index.js';

package/src/installer/__tests__/config.test.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { readHostConfig, writeHostConfig, type HostConfigFile } from '../config.js';
+import { readHostConfig, writeHostConfig, hostOwnsCadre, type HostConfigFile } from '../config.js';
 
 describe('host.config.json round-trip', () => {
   let tmp: string;
@@ -83,4 +83,30 @@ describe('host.config.json round-trip', () => {
     const path = join(tmp, 'host.config.json');
     expect(() => writeHostConfig(path, { ...makeCfg(), version: 3 as never })).toThrow(/version=3/);
   });
+
+  it('round-trips ownCadre and hostOwnsCadre reflects it', () => {
+    const path = join(tmp, 'host.config.json');
+    const cfg = makeCfg({ ownCadre: { enabled: true } });
+    writeHostConfig(path, cfg);
+    const read = readHostConfig(path);
+    expect(read.ownCadre).toEqual({ enabled: true });
+    expect(hostOwnsCadre(read)).toBe(true);
+  });
+
+  it('treats an absent ownCadre as donor-only (hostOwnsCadre false)', () => {
+    // A pre-ownCadre v2 config (field absent) must read back cleanly and be
+    // donor-only — no migration, field stays absent.
+    const path = join(tmp, 'host.config.json');
+    const cfg = makeCfg();
+    writeHostConfig(path, cfg);
+    const read = readHostConfig(path);
+    expect(read.ownCadre).toBeUndefined();
+    expect(hostOwnsCadre(read)).toBe(false);
+  });
+
+  it('rejects a malformed ownCadre shape', () => {
+    const path = join(tmp, 'host.config.json');
+    writeFileSync(path, JSON.stringify({ ...makeCfg(), ownCadre: { enabled: 'yes' } }));
+    expect(() => readHostConfig(path)).toThrow(/missing required fields/);
+  });
 });

package/src/installer/__tests__/installer.smoke.test.ts

@@ -108,6 +108,100 @@ describe('Installer smoke', () => {
     expect(fake.installCalls).toHaveLength(0);
   });
 
+  it('passes CLI overrides to the wizard as suggested defaults', async () => {
+    // Regression: the interactive wizard previously showed the platform
+    // default (`~/.local/share/cadre-host`) in the prompt even when the
+    // caller passed `--data-dir <path>`. Whatever the user typed was then
+    // silently discarded because the CLI flag won post-hoc. The fix: CLI
+    // overrides become the wizard's suggested defaults, and the wizard's
+    // returned answers stand on their own.
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    let seenDefaults: { dataDir: string; uiPort: number; libp2pPort: number; upnpEnabled: boolean; ownCadre: boolean } | undefined;
+    await installer.install({
+      nonInteractive: false,
+      dataDir: tmp,
+      uiPort: 19997,
+      libp2pPort: 14003,
+      noUpnp: true,
+      openBrowser: false,
+      noInvite: true,
+      serviceHost: fake,
+      wizard: async (defaults) => {
+        seenDefaults = { ...defaults };
+        // Simulate the user pressing Enter at every prompt.
+        return {
+          dataDir: defaults.dataDir,
+          uiPort: defaults.uiPort,
+          libp2pPort: defaults.libp2pPort,
+          upnpEnabled: defaults.upnpEnabled,
+          configureDdns: false,
+          ownCadre: defaults.ownCadre,
+        };
+      },
+    });
+
+    expect(seenDefaults).toEqual({
+      dataDir: tmp,
+      uiPort: 19997,
+      libp2pPort: 14003,
+      upnpEnabled: false,
+      ownCadre: false,
+    });
+    expect(fake.installCalls).toHaveLength(1);
+    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
+  });
+
+  it('honors wizard-typed input when no CLI override is passed', async () => {
+    // Mirror of the previous test: with no `--data-dir`, the wizard's
+    // returned value is what the installer uses.
+    const fake = new FakeServiceHost();
+    const installer = new Installer({ platform: 'linux' });
+    await installer.install({
+      nonInteractive: false,
+      openBrowser: false,
+      noInvite: true,
+      serviceHost: fake,
+      wizard: async () => ({
+        dataDir: tmp,
+        uiPort: 19996,
+        libp2pPort: 14004,
+        upnpEnabled: true,
+        configureDdns: false,
+        ownCadre: false,
+      }),
+    });
+    expect(fake.installCalls).toHaveLength(1);
+    expect(fake.installCalls[0]!.dataDir).toBe(tmp);
+  });
+
+  it('writes ownCadre.enabled=false by default and true when opted in', async () => {
+    const { readHostConfig } = await import('../config.js');
+
+    // Default (donor-only): --own-cadre absent → ownCadre.enabled false.
+    const fakeA = new FakeServiceHost();
+    const installerA = new Installer({ platform: 'linux' });
+    await installerA.install({
+      nonInteractive: true, dataDir: tmp, openBrowser: false, noInvite: true, serviceHost: fakeA,
+    });
+    const donorCfg = readHostConfig(join(tmp, 'host.config.json'));
+    expect(donorCfg.ownCadre).toEqual({ enabled: false });
+
+    // Opt-in: ownCadre:true (the --own-cadre flag) → ownCadre.enabled true.
+    const tmp2 = mkdtempSync(join(tmpdir(), 'cadre-host-installer-owncadre-'));
+    try {
+      const fakeB = new FakeServiceHost();
+      const installerB = new Installer({ platform: 'linux' });
+      await installerB.install({
+        nonInteractive: true, dataDir: tmp2, ownCadre: true, openBrowser: false, noInvite: true, serviceHost: fakeB,
+      });
+      const founderCfg = readHostConfig(join(tmp2, 'host.config.json'));
+      expect(founderCfg.ownCadre).toEqual({ enabled: true });
+    } finally {
+      rmSync(tmp2, { recursive: true, force: true });
+    }
+  });
+
   it('re-running install preserves the existing identity', async () => {
     const fake = new FakeServiceHost();
     const installer = new Installer({ platform: 'linux' });

package/src/installer/__tests__/wizard.test.ts

@@ -7,6 +7,7 @@ const defaults: WizardDefaults = {
   uiPort: 8765,
   libp2pPort: 4001,
   upnpEnabled: true,
+  ownCadre: false,
 };
 
 function scripted(answers: ReadonlyArray<string>): (label: string, fallback: string) => Promise<string> {
@@ -19,13 +20,14 @@ function scripted(answers: ReadonlyArray<string>): (label: string, fallback: str
 
 describe('runWizardWith', () => {
   it('returns the defaults when every answer is blank', async () => {
-    const out = await runWizardWith(defaults, scripted(['', '', '', '', '']));
+    const out = await runWizardWith(defaults, scripted(['', '', '', '', '', '']));
     expect(out).toEqual({
       dataDir: '/data/cadre-host',
       uiPort: 8765,
       libp2pPort: 4001,
       upnpEnabled: true,
       configureDdns: false,
+      ownCadre: false,
     });
   });
 
@@ -36,6 +38,7 @@ describe('runWizardWith', () => {
       '5000',
       'n',
       'y',
+      'y',
     ]));
     expect(out).toEqual({
       dataDir: '/srv/host',
@@ -43,6 +46,7 @@ describe('runWizardWith', () => {
       libp2pPort: 5000,
       upnpEnabled: false,
       configureDdns: true,
+      ownCadre: true,
     });
   });
 

package/src/installer/browser.ts

@@ -1,42 +1,40 @@
-/**
- * Best-effort URL opener. Never throws — if the platform launcher isn't
- * available (headless box, missing xdg-utils, etc.) we just log the URL.
- *
- * Implemented inline rather than pulling in the `open` npm dep so the
- * installer keeps its dependency tree small.
- */
-
-import { spawn } from 'node:child_process';
-
-export interface OpenBrowserResult {
-  attempted: boolean;
-  spawned: boolean;
-  /** Set when the spawn attempt errored synchronously. */
-  error?: string;
-}
-
-export function openBrowser(url: string, platform: NodeJS.Platform = process.platform): OpenBrowserResult {
-  try {
-    if (platform === 'darwin') {
-      const child = spawn('open', [url], { detached: true, stdio: 'ignore' });
-      child.unref();
-      return { attempted: true, spawned: true };
-    }
-    if (platform === 'win32') {
-      // rundll32 is the most portable way to invoke the registered handler
-      // without going through cmd.exe (which would require escaping URLs).
-      const child = spawn('rundll32', ['url.dll,FileProtocolHandler', url], {
-        detached: true,
-        stdio: 'ignore',
-      });
-      child.unref();
-      return { attempted: true, spawned: true };
-    }
-    // linux + everything else POSIX-ish
-    const child = spawn('xdg-open', [url], { detached: true, stdio: 'ignore' });
-    child.unref();
-    return { attempted: true, spawned: true };
-  } catch (err) {
-    return { attempted: true, spawned: false, error: (err as Error).message };
-  }
-}
+/**
+ * Best-effort URL opener. Never throws — if the platform launcher isn't
+ * available (headless box, missing xdg-utils, etc.) we just log the URL.
+ *
+ * Implemented inline rather than pulling in the `open` npm dep so the
+ * installer keeps its dependency tree small.
+ */
+
+import { spawn } from 'node:child_process';
+
+export interface OpenBrowserResult {
+  attempted: boolean;
+  spawned: boolean;
+  /** Set when the spawn attempt errored synchronously. */
+  error?: string;
+}
+
+export function openBrowser(url: string, platform: NodeJS.Platform = process.platform): OpenBrowserResult {
+  if (platform === 'darwin') return spawnOpener('open', [url]);
+  if (platform === 'win32') return spawnOpener('rundll32', ['url.dll,FileProtocolHandler', url]);
+  // linux + everything else POSIX-ish
+  return spawnOpener('xdg-open', [url]);
+}
+
+function spawnOpener(cmd: string, args: string[]): OpenBrowserResult {
+  try {
+    const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+    // The launcher's absence (ENOENT on a headless box without xdg-utils,
+    // etc.) is reported asynchronously via the child's `error` event, not
+    // by `spawn()` throwing. Without a listener, Node escalates to an
+    // unhandled-error crash and kills the install. Swallow it: this is a
+    // best-effort convenience, the install / UI commands have already
+    // printed the URL.
+    child.on('error', () => { /* best-effort */ });
+    child.unref();
+    return { attempted: true, spawned: true };
+  } catch (err) {
+    return { attempted: true, spawned: false, error: (err as Error).message };
+  }
+}

package/src/installer/config.ts

@@ -21,6 +21,41 @@ export interface UpdatesConfig {
   manifestUrl?: string;
 }
 
+/**
+ * Whether this host also runs its own personal cadre (the opt-in "founder"
+ * persona), on top of the always-on node-donor role.
+ *
+ * Default (absent or `enabled: false`) is donor-only: `cadre-host start` brings
+ * up the donation surface but spawns **no** owner node, so the trust-circle and
+ * NAT surfaces stay inactive. Set `enabled: true` (install-time choice) to also
+ * spawn the host's own owner node and enable `/auth` + `/nat`. See
+ * docs/cadre-host.md § Two roles: donor and founder.
+ */
+export interface OwnCadreConfig {
+  /** When true, `start` spawns the host-owned owner node + trust-circle + NAT. */
+  enabled: boolean;
+}
+
+/**
+ * Non-secret push (FCM/APNs) settings. The actual private keys (and the FCM
+ * service-account / APNs key identifiers) live in the secret store — see
+ * `src/push/`. Only these app-config bits, which are safe to keep in plaintext
+ * `host.config.json`, are stored here. Absent ⇒ push is not configured.
+ */
+export interface PushSettings {
+  /** APNs app-config (the `.p8` private key + key/team ids stay in the secret store). */
+  apns?: {
+    /** App bundle id → APNs `apns-topic` header. */
+    bundleId: string;
+    /** `true` → production APNs host; false/undefined → sandbox (dev/TestFlight). */
+    production?: boolean;
+  };
+  /** Per-(peer,strand) anti-spam cooldown (ms) forwarded into the node's push block. */
+  cooldownMs?: number;
+  /** Per-strand burst-coalescing window (ms) forwarded into the node's push block. */
+  debounceMs?: number;
+}
+
 export interface HostConfigFile {
   version: 2;
   /** A stable per-install id; useful for log correlation and the control-network partyId. */
@@ -41,6 +76,27 @@ export interface HostConfigFile {
   installerVersion: string;
   /** Update-flow settings; defaults: { autoApply: false }. */
   updates: UpdatesConfig;
+  /**
+   * Host-own-cadre (founder persona) opt-in. Optional — absent is treated as
+   * `{ enabled: false }` (donor-only). Written by the installer; read via
+   * `hostOwnsCadre()`. Not editable through /api/settings (install-time only).
+   */
+  ownCadre?: OwnCadreConfig;
+  /**
+   * Non-secret push settings (bundle id, sandbox/prod toggle, cooldown/debounce).
+   * Optional — absent when push is not configured. Private keys never live here;
+   * they are read from the secret store at node-spawn time (`src/push/`).
+   */
+  push?: PushSettings;
+}
+
+/**
+ * Whether this host runs its own personal cadre (founder persona). Absent
+ * `ownCadre` ⇒ donor-only (false). The single source of truth for the
+ * founder/donor gate in `bin/host.ts start`.
+ */
+export function hostOwnsCadre(cfg: HostConfigFile): boolean {
+  return cfg.ownCadre?.enabled === true;
 }
 
 const CURRENT_VERSION = 2;
@@ -75,7 +131,7 @@ export function readHostConfig(filePath: string): HostConfigFile {
   try {
     parsed = JSON.parse(raw);
   } catch (err) {
-    throw new Error(`Failed to parse host.config.json at ${filePath}: ${(err as Error).message}`);
+    throw new Error(`Failed to parse host.config.json at ${filePath}: ${(err as Error).message}`, { cause: err });
   }
   if (!parsed || typeof parsed !== 'object') {
     throw new Error(`host.config.json at ${filePath} is not a JSON object`);
@@ -149,5 +205,9 @@ function isHostConfigShape(v: unknown): v is HostConfigFile {
   if (!updates || typeof updates !== 'object') return false;
   if (typeof updates.autoApply !== 'boolean') return false;
   if (updates.manifestUrl !== undefined && typeof updates.manifestUrl !== 'string') return false;
+  if (o.ownCadre !== undefined) {
+    const own = o.ownCadre as Record<string, unknown>;
+    if (!own || typeof own !== 'object' || typeof own.enabled !== 'boolean') return false;
+  }
   return true;
 }

package/src/installer/index.ts

@@ -11,7 +11,6 @@
 
 import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
-import { join } from 'node:path';
 import debug from 'debug';
 
 import { NatStore } from '../nat/index.js';
@@ -38,9 +37,11 @@ import {
   DEFAULT_UI_PORT,
   DEFAULT_LIBP2P_PORT,
   type WizardAnswers,
+  type WizardDefaults,
 } from './wizard.js';
 
-export type { HostConfigFile } from './config.js';
+export type { HostConfigFile, PushSettings } from './config.js';
+export { readHostConfig, updateHostConfig, writeHostConfig } from './config.js';
 export type { WizardAnswers, WizardDefaults } from './wizard.js';
 export type { ServiceHost, ServiceHostContext, ServiceHostStatus } from './service-host/index.js';
 
@@ -57,6 +58,8 @@ export interface InstallOptions {
   libp2pPort?: number;
   /** Disable UPnP probing on first run. */
   noUpnp?: boolean;
+  /** Also run the host's own personal cadre here (founder persona). Default false. */
+  ownCadre?: boolean;
   /** Open browser at end (default true; suppressed by --no-browser or non-TTY). */
   openBrowser?: boolean;
   /** Skip the enrollment-invite step (no QR printed). */
@@ -67,6 +70,8 @@ export interface InstallOptions {
   nodePath?: string;
   /** Test-only: stub the service-host registration. */
   serviceHost?: ServiceHost;
+  /** Test-only: stub the interactive wizard. Production callers leave unset. */
+  wizard?: (defaults: WizardDefaults) => Promise<WizardAnswers>;
 }
 
 export interface InstallResult {
@@ -143,6 +148,7 @@ export class Installer {
       installedAt: new Date().toISOString(),
       installerVersion: this.installerVersion,
       updates: { autoApply: false },
+      ownCadre: { enabled: answers.ownCadre },
     };
     const cfgPath = configPath(answers.dataDir);
     writeHostConfig(cfgPath, cfg);
@@ -225,6 +231,7 @@ export class Installer {
       libp2pPort: opts.libp2pPort ?? defaults.libp2pPort,
       upnpEnabled: opts.noUpnp ? false : defaults.upnpEnabled,
       configureDdns: false,
+      ownCadre: opts.ownCadre ?? defaults.ownCadre,
     };
   }
 
@@ -232,17 +239,21 @@ export class Installer {
     if (opts.nonInteractive) {
       return this.resolveAnswersFromOptions(opts);
     }
-    const defaults = defaultsForPlatform(this.platform);
-    const answers = await runWizard(defaults);
-    // CLI flags still take precedence over wizard input — useful when the
-    // user passes `--ui-port 9000` but accepts defaults at the prompts.
-    return {
-      dataDir: opts.dataDir ?? answers.dataDir,
-      uiPort: opts.uiPort ?? answers.uiPort,
-      libp2pPort: opts.libp2pPort ?? answers.libp2pPort,
-      upnpEnabled: opts.noUpnp ? false : answers.upnpEnabled,
-      configureDdns: answers.configureDdns,
+    // CLI flags overlay the platform defaults so the wizard's `[...]` hint
+    // shows the user's chosen value. Pressing Enter accepts it; typing a new
+    // value also works (and now actually has an effect — the previous
+    // implementation showed the platform default in the prompt and silently
+    // discarded user input because the CLI flag won post-hoc).
+    const platformDefaults = defaultsForPlatform(this.platform);
+    const defaults: WizardDefaults = {
+      dataDir: opts.dataDir ?? platformDefaults.dataDir,
+      uiPort: opts.uiPort ?? platformDefaults.uiPort,
+      libp2pPort: opts.libp2pPort ?? platformDefaults.libp2pPort,
+      upnpEnabled: opts.noUpnp ? false : platformDefaults.upnpEnabled,
+      ownCadre: opts.ownCadre ?? platformDefaults.ownCadre,
     };
+    const wizard = opts.wizard ?? runWizard;
+    return await wizard(defaults);
   }
 }
 

package/src/installer/service-host/launchd.ts

@@ -85,6 +85,6 @@ function run(cmd: string, args: string[]): void {
   try {
     execFileSync(cmd, args, { stdio: 'inherit' });
   } catch (err) {
-    throw new Error(`${cmd} ${args.join(' ')} failed: ${(err as Error).message}`);
+    throw new Error(`${cmd} ${args.join(' ')} failed: ${(err as Error).message}`, { cause: err });
   }
 }

package/src/installer/service-host/systemd.ts

@@ -83,6 +83,6 @@ function run(cmd: string, args: string[]): void {
   try {
     execFileSync(cmd, args, { stdio: 'inherit' });
   } catch (err) {
-    throw new Error(`${cmd} ${args.join(' ')} failed: ${(err as Error).message}`);
+    throw new Error(`${cmd} ${args.join(' ')} failed: ${(err as Error).message}`, { cause: err });
   }
 }

package/src/installer/wizard.ts

@@ -16,6 +16,8 @@ export interface WizardDefaults {
   uiPort: number;
   libp2pPort: number;
   upnpEnabled: boolean;
+  /** Also run the host's own personal cadre here (founder persona). Default false. */
+  ownCadre: boolean;
 }
 
 export interface WizardAnswers {
@@ -24,6 +26,8 @@ export interface WizardAnswers {
   libp2pPort: number;
   upnpEnabled: boolean;
   configureDdns: boolean;
+  /** Also run the host's own personal cadre here (founder persona). */
+  ownCadre: boolean;
 }
 
 export const DEFAULT_UI_PORT = 8765;
@@ -35,6 +39,7 @@ export function defaultsForPlatform(platform: SupportedPlatform): WizardDefaults
     uiPort: DEFAULT_UI_PORT,
     libp2pPort: DEFAULT_LIBP2P_PORT,
     upnpEnabled: true,
+    ownCadre: false,
   };
 }
 
@@ -54,7 +59,13 @@ export async function runWizardWith(
     defaults.upnpEnabled,
   );
   const configureDdns = parseBool(await ask('Configure DDNS now? [y/N]', 'N'), false);
-  return { dataDir, uiPort, libp2pPort, upnpEnabled, configureDdns };
+  // Founder persona (opt-in). Most installs just donate nodes to friends and
+  // answer no — a no leaves cadre-host donor-only (no owner node, no /auth+/nat).
+  const ownCadre = parseBool(
+    await ask('Also run your own personal cadre on this machine? (most people just donating nodes to friends say no) [y/N]', defaults.ownCadre ? 'Y' : 'N'),
+    defaults.ownCadre,
+  );
+  return { dataDir, uiPort, libp2pPort, upnpEnabled, configureDdns, ownCadre };
 }
 
 /** Production entrypoint — drives the wizard over stdin/stdout. */

package/src/nat/__tests__/ddns-updater.test.ts

@@ -67,7 +67,7 @@ describe('DdnsUpdater', () => {
   it('no-op when externallyManaged', async () => {
     const provider = makeProvider();
     const secrets = makeSecrets({ [ddnsAccount('duckdns', 'token')]: 'T' });
-    let ip: string | null = '1.2.3.4';
+    const ip: string | null = '1.2.3.4';
     const u = new DdnsUpdater({
       settings: { ...baseSettings, externallyManaged: true },
       secrets,