@serfab/cadre-host 0.7.1 → 0.9.0

package/src/orchestrator/types.ts

@@ -3,6 +3,7 @@
  */
 
 import type { ChildProcess } from 'node:child_process';
+import type { PushCredentials } from '@serfab/cadre-core';
 
 /** User-facing configuration for `HostProcessOrchestrator`. */
 export interface HostProcessConfig {
@@ -23,6 +24,31 @@ export interface HostProcessConfig {
    * spawns `node <entrypoint> ...` instead of resolving `@serfab/cadre-cli`.
    */
   spawn?: { entrypoint?: string };
+  /**
+   * Resolver for the platform push credentials (FCM/APNs) to inject into a
+   * spawned strand-participating node's `cadre.json` (`config.push`). Called
+   * fresh on EVERY spawn/re-spawn so the secret store stays the source of truth
+   * and no raw private key is ever persisted in `state.json`. Returns `undefined`
+   * when no push credentials are configured (the default — push is opt-in). The
+   * resolver itself is responsible for rejecting a partial credential set.
+   */
+  pushResolver?: PushCredentialsResolver;
+}
+
+/**
+ * Resolves the push credentials to inject into a node being spawned. Re-invoked
+ * per spawn so a restart re-reads the secret store rather than replaying stale
+ * (or persisted) material. See {@link HostProcessConfig.pushResolver}.
+ */
+export type PushCredentialsResolver = () => Promise<PushCredentials | undefined>;
+
+/** Per-child allocated ports. `admin` carries the loopback admin channel (6.6). */
+export interface NodePorts {
+  health: number;
+  metrics: number;
+  p2p: number;
+  /** Loopback admin-channel port. Bound only by the owner node. */
+  admin: number;
 }
 
 /** In-memory record per managed child. */
@@ -32,10 +58,12 @@ export interface Handle {
   pid: number;
   startupToken: string;
   workdir: string;
-  ports: { health: number; metrics: number; p2p: number };
+  ports: NodePorts;
   spawnedAt: string;
   partyId: string;
   profile: 'storage' | 'transaction';
+  /** True for the admin's owner node (binds the admin channel). */
+  owner?: boolean;
   /** Live ChildProcess reference; absent after re-attach via init(). */
   child?: ChildProcess;
   /** Marked false when init() finds the PID dead or token mismatched. */
@@ -54,7 +82,25 @@ export interface ManagedNodeInfo {
   status: 'running' | 'stopped';
   spawnedAt: string;
   workdir: string;
-  ports: { health: number; metrics: number; p2p: number };
+  ports: NodePorts;
+  /** True for the admin's owner node. */
+  owner?: boolean;
+}
+
+/**
+ * Persisted spawn parameters for the admin's owner node. Stored alongside
+ * the handles so an orchestrator restart can re-spawn the owner node from
+ * `/api/nodes/:id/{start,restart}` without the caller re-supplying them.
+ */
+export interface OwnerSpawnConfig {
+  /** Absolute path to the host's libp2p protobuf identity (`identity.key`). */
+  identityPath: string;
+  /** Control-network partyId (the host's installId). */
+  partyId: string;
+  /** External libp2p port — mapped to the child's listen address. */
+  libp2pPort: number;
+  /** Node profile. Defaults to `storage` (the household node holds strands). */
+  profile?: 'storage' | 'transaction';
 }
 
 /**

package/src/owner/__tests__/owner-node-client.test.ts

@@ -0,0 +1,194 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import http from 'node:http';
+
+import { OwnerNodeClient, OwnerNodeUnavailableError } from '../owner-node-client.js';
+import type { OwnerAdminEndpoint } from '../../orchestrator/index.js';
+
+/**
+ * Stub HTTP server matching the 6.6 admin contract. Records the last request
+ * so tests can assert method/path/headers/body, and lets each test choose the
+ * response.
+ */
+interface Recorded {
+  method: string;
+  path: string;
+  auth: string | undefined;
+  body: string;
+}
+
+const TOKEN = 'secret-bearer-token';
+
+let server: http.Server;
+let baseUrl: string;
+let last: Recorded | null;
+let responder: (req: Recorded) => { status: number; payload: unknown };
+
+beforeEach(async () => {
+  last = null;
+  responder = () => ({ status: 200, payload: { ok: true, data: { ok: true } } });
+  server = http.createServer((req, res) => {
+    const chunks: Buffer[] = [];
+    req.on('data', (c) => chunks.push(c as Buffer));
+    req.on('end', () => {
+      const rec: Recorded = {
+        method: req.method ?? 'GET',
+        path: req.url ?? '/',
+        auth: req.headers['authorization'] as string | undefined,
+        body: Buffer.concat(chunks).toString('utf8'),
+      };
+      last = rec;
+      const { status, payload } = responder(rec);
+      res.writeHead(status, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(payload));
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+  const addr = server.address();
+  const port = typeof addr === 'object' && addr ? addr.port : 0;
+  baseUrl = `http://127.0.0.1:${port}`;
+});
+
+afterEach(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+function makeClient(): OwnerNodeClient {
+  const endpoint: OwnerAdminEndpoint = { baseUrl, token: TOKEN };
+  return new OwnerNodeClient(endpoint);
+}
+
+describe('OwnerNodeClient', () => {
+  it('createInvite POSTs /admin/invites with bearer + body and unwraps data', async () => {
+    responder = () => ({
+      status: 200,
+      payload: { ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'enc' } },
+    });
+    const client = makeClient();
+    const result = await client.createInvite('t', 60_000);
+
+    expect(result.encodedInvite).toBe('enc');
+    expect(last?.method).toBe('POST');
+    expect(last?.path).toBe('/admin/invites');
+    expect(last?.auth).toBe(`Bearer ${TOKEN}`);
+    expect(JSON.parse(last!.body)).toEqual({ token: 't', expiresInMs: 60_000 });
+  });
+
+  it('acceptPhone POSTs /admin/accept-phone', async () => {
+    const client = makeClient();
+    await client.acceptPhone({ phonePeerId: '12D3KooWX', token: 't' }, { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 });
+    expect(last?.method).toBe('POST');
+    expect(last?.path).toBe('/admin/accept-phone');
+    const body = JSON.parse(last!.body);
+    expect(body.phonePeerId).toBe('12D3KooWX');
+    expect(body.issuedInvite.token).toBe('t');
+  });
+
+  it('removePeer DELETEs /admin/members/:peerId (url-encoded)', async () => {
+    const client = makeClient();
+    await client.removePeer('12D3KooWMember');
+    expect(last?.method).toBe('DELETE');
+    expect(last?.path).toBe('/admin/members/12D3KooWMember');
+  });
+
+  it('listMembers GETs /admin/members and returns the array', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { members: [{ peerId: 'a', multiaddr: '/ip4/1.2.3.4/tcp/1' }] } } });
+    const client = makeClient();
+    const members = await client.listMembers();
+    expect(last?.method).toBe('GET');
+    expect(last?.path).toBe('/admin/members');
+    expect(members).toEqual([{ peerId: 'a', multiaddr: '/ip4/1.2.3.4/tcp/1' }]);
+  });
+
+  it('isMember GETs /admin/members/:peerId and returns the boolean', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { member: true } } });
+    const client = makeClient();
+    expect(await client.isMember('peer-1')).toBe(true);
+    expect(last?.path).toBe('/admin/members/peer-1');
+  });
+
+  it('listAuthorizedMembers GETs /admin/authorized-members and returns the array', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { members: [{ peerId: 'b', multiaddr: null }] } } });
+    const client = makeClient();
+    const members = await client.listAuthorizedMembers();
+    expect(last?.method).toBe('GET');
+    expect(last?.path).toBe('/admin/authorized-members');
+    expect(members).toEqual([{ peerId: 'b', multiaddr: null }]);
+  });
+
+  it('isAuthorizedMember GETs /admin/authorized-members/:peerId and returns the boolean', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { member: false } } });
+    const client = makeClient();
+    expect(await client.isAuthorizedMember('peer-2')).toBe(false);
+    expect(last?.path).toBe('/admin/authorized-members/peer-2');
+  });
+
+  it('getPeerId GETs /admin/identity', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { peerId: '12D3KooWHost', partyId: 'party' } } });
+    const client = makeClient();
+    expect(await client.getPeerId()).toBe('12D3KooWHost');
+    expect(last?.path).toBe('/admin/identity');
+  });
+
+  it('getMultiaddrs GETs /admin/multiaddrs', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { multiaddrs: ['/ip4/0.0.0.0/tcp/4001'] } } });
+    const client = makeClient();
+    expect(await client.getMultiaddrs()).toEqual(['/ip4/0.0.0.0/tcp/4001']);
+    expect(last?.path).toBe('/admin/multiaddrs');
+  });
+
+  it('pushInviteAddresses PUTs /admin/invite-addresses', async () => {
+    const client = makeClient();
+    await client.pushInviteAddresses(['/dns4/h/tcp/1/p2p/x']);
+    expect(last?.method).toBe('PUT');
+    expect(last?.path).toBe('/admin/invite-addresses');
+    expect(JSON.parse(last!.body)).toEqual({ addresses: ['/dns4/h/tcp/1/p2p/x'] });
+  });
+
+  it('addDrone POSTs /admin/add-drone with body and unwraps the seed result', async () => {
+    responder = () => ({ status: 200, payload: { ok: true, data: { seed: { partyId: 'p', peers: [] }, encodedSeed: 'enc-seed' } } });
+    const client = makeClient();
+    const result = await client.addDrone({ dronePeerId: '12D3KooWDrone', droneMultiaddrs: ['/ip4/10.0.0.9/tcp/4001'] });
+
+    expect(result.encodedSeed).toBe('enc-seed');
+    expect(last?.method).toBe('POST');
+    expect(last?.path).toBe('/admin/add-drone');
+    expect(last?.auth).toBe(`Bearer ${TOKEN}`);
+    expect(JSON.parse(last!.body)).toEqual({ dronePeerId: '12D3KooWDrone', droneMultiaddrs: ['/ip4/10.0.0.9/tcp/4001'] });
+  });
+
+  it('encodeInvite mirrors cadre-core base64url(JSON)', () => {
+    const client = makeClient();
+    const invite = { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 };
+    const encoded = client.encodeInvite(invite);
+    const decoded = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+    expect(decoded).toEqual(invite);
+  });
+
+  it('maps a non-2xx response to OwnerNodeUnavailableError carrying the code', async () => {
+    responder = () => ({ status: 503, payload: { ok: false, error: { code: 'not_ready', message: 'node booting' } } });
+    const client = makeClient();
+    await expect(client.getPeerId()).rejects.toBeInstanceOf(OwnerNodeUnavailableError);
+    await expect(client.getPeerId()).rejects.toMatchObject({ nodeCode: 'not_ready' });
+  });
+
+  it('maps a refused connection to OwnerNodeUnavailableError', async () => {
+    // Bind a throwaway server to claim a port, then close it so the address
+    // is guaranteed refused.
+    const tmp = http.createServer();
+    const closedPort = await new Promise<number>((resolve) => {
+      tmp.listen(0, '127.0.0.1', () => {
+        const a = tmp.address();
+        resolve(typeof a === 'object' && a ? a.port : 0);
+      });
+    });
+    await new Promise<void>((resolve) => tmp.close(() => resolve()));
+
+    const client = new OwnerNodeClient({ baseUrl: `http://127.0.0.1:${closedPort}`, token: TOKEN });
+    await expect(client.getPeerId()).rejects.toBeInstanceOf(OwnerNodeUnavailableError);
+  });
+
+  it('throws OwnerNodeUnavailableError when the endpoint is undefined', async () => {
+    const client = new OwnerNodeClient(() => undefined);
+    await expect(client.getPeerId()).rejects.toBeInstanceOf(OwnerNodeUnavailableError);
+  });
+});

package/src/owner/index.ts

@@ -0,0 +1,12 @@
+/**
+ * Owner-node delegation surface for cadre-host.
+ *
+ * The manager process spawns the admin's owner cadre node (via
+ * `HostProcessOrchestrator`) and delegates owner/membership/identity
+ * operations to it over the loopback admin channel using
+ * {@link OwnerNodeClient}. See `docs/cadre-host.md` § Control-plane
+ * separation.
+ */
+
+export { OwnerNodeClient, OwnerNodeUnavailableError } from './owner-node-client.js';
+export type { OwnerNodeClientOptions } from './owner-node-client.js';

package/src/owner/owner-node-client.ts

@@ -0,0 +1,233 @@
+/**
+ * HTTP client for the owner node's loopback admin channel (the 6.6
+ * `cadre-node-admin-channel` contract).
+ *
+ * cadre-host's manager process holds no in-process `CadreNode`; it spawns the
+ * admin's owner node as a managed child (see `HostProcessOrchestrator`)
+ * and delegates all owner/membership/identity operations to it over this
+ * client. The client implements **both** trimmed `CadreNodeLike` interfaces —
+ * the trust-circle one (`auth/trust-circle.ts`) and the NAT one
+ * (`nat/nat-service.ts`) — plus `pushInviteAddresses` and `addDrone` (the
+ * node-donation requester side).
+ *
+ * Transport: `Authorization: Bearer <token>` against
+ * `http://127.0.0.1:<adminPort>`. Every response uses the cadre-provider
+ * envelope `{ ok: true, data }` / `{ ok: false, error: { code, message } }`.
+ * A refused connection, a transport error, or any non-2xx response surfaces
+ * as {@link OwnerNodeUnavailableError}; the trust-circle / NAT services
+ * translate that into a `node_unavailable` domain error so the management API
+ * returns a clear 503 rather than a raw 500.
+ */
+
+import debug from 'debug';
+import type { CadreInvite, DroneInitResult } from '@serfab/cadre-core';
+
+import type { OwnerAdminEndpoint } from '../orchestrator/index.js';
+import type { CadreNodeLike as TrustCircleCadreNodeLike } from '../auth/trust-circle.js';
+import type { CadreNodeLike as NatCadreNodeLike } from '../nat/nat-service.js';
+
+const log = debug('cadre:host:owner-client');
+
+/**
+ * Raised when the owner node's admin channel can't be reached or returns
+ * a non-success response. Carries the node's stable error `code` when one was
+ * present in the envelope (e.g. `not_ready`, `not_authorized`).
+ */
+export class OwnerNodeUnavailableError extends Error {
+  /** The admin-channel error code, when the node answered with an envelope. */
+  readonly nodeCode?: string;
+
+  constructor(message: string, nodeCode?: string) {
+    super(message);
+    this.name = 'OwnerNodeUnavailableError';
+    if (nodeCode !== undefined) this.nodeCode = nodeCode;
+  }
+}
+
+/** Endpoint provided directly or via a getter (so it tracks re-spawns). */
+type EndpointSource =
+  | OwnerAdminEndpoint
+  | (() => OwnerAdminEndpoint | undefined)
+  | undefined;
+
+export interface OwnerNodeClientOptions {
+  /** Fetch override for tests. Defaults to the global `fetch`. */
+  fetch?: typeof fetch;
+}
+
+export class OwnerNodeClient implements TrustCircleCadreNodeLike, NatCadreNodeLike {
+  private readonly endpointSource: EndpointSource;
+  private readonly fetchImpl: typeof fetch;
+
+  /**
+   * @param endpoint Either a fixed `{ baseUrl, token }` or a getter returning
+   *   the current endpoint (pass `orchestrator.getOwnerAdminEndpoint`
+   *   bound, so a restart's new bearer token is picked up automatically).
+   */
+  constructor(endpoint: EndpointSource, opts: OwnerNodeClientOptions = {}) {
+    this.endpointSource = endpoint;
+    this.fetchImpl = opts.fetch ?? fetch;
+  }
+
+  // --- trust-circle CadreNodeLike ---
+
+  async createInvite(
+    token?: string,
+    expiresInMs?: number,
+  ): Promise<{ invite: CadreInvite; encodedInvite: string }> {
+    const body: Record<string, unknown> = {};
+    if (token !== undefined) body.token = token;
+    if (expiresInMs !== undefined) body.expiresInMs = expiresInMs;
+    return await this.request<{ invite: CadreInvite; encodedInvite: string }>(
+      'POST',
+      '/admin/invites',
+      body,
+    );
+  }
+
+  async acceptPhone(
+    options: { phonePeerId: string; token?: string },
+    issuedInvite?: CadreInvite,
+  ): Promise<void> {
+    const body: Record<string, unknown> = { phonePeerId: options.phonePeerId };
+    if (options.token !== undefined) body.token = options.token;
+    if (issuedInvite !== undefined) body.issuedInvite = issuedInvite;
+    await this.request('POST', '/admin/accept-phone', body);
+  }
+
+  async removePeer(peerId: string): Promise<void> {
+    await this.request('DELETE', `/admin/members/${encodeURIComponent(peerId)}`);
+  }
+
+  /**
+   * Encode an invite for out-of-band delivery. The admin contract has no
+   * encode route (the mint route already returns `encodedInvite`), so this
+   * mirrors cadre-core's encoding (`base64url(JSON.stringify(invite))`).
+   */
+  encodeInvite(invite: CadreInvite): string {
+    return Buffer.from(JSON.stringify(invite), 'utf8').toString('base64url');
+  }
+
+  async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    const data = await this.request<{ members: Array<{ peerId: string; multiaddr: string | null }> }>(
+      'GET',
+      '/admin/members',
+    );
+    return data.members;
+  }
+
+  async isMember(peerId: string): Promise<boolean> {
+    const data = await this.request<{ member: boolean }>(
+      'GET',
+      `/admin/members/${encodeURIComponent(peerId)}`,
+    );
+    return data.member;
+  }
+
+  /** Authorized-membership surface (excludes self) — see {@link listMembers} for the addressable one. */
+  async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    const data = await this.request<{ members: Array<{ peerId: string; multiaddr: string | null }> }>(
+      'GET',
+      '/admin/authorized-members',
+    );
+    return data.members;
+  }
+
+  async isAuthorizedMember(peerId: string): Promise<boolean> {
+    const data = await this.request<{ member: boolean }>(
+      'GET',
+      `/admin/authorized-members/${encodeURIComponent(peerId)}`,
+    );
+    return data.member;
+  }
+
+  // --- NAT CadreNodeLike ---
+
+  async getPeerId(): Promise<string> {
+    const data = await this.request<{ peerId: string | null; partyId: string }>('GET', '/admin/identity');
+    return data.peerId ?? '';
+  }
+
+  async getMultiaddrs(): Promise<string[]> {
+    const data = await this.request<{ multiaddrs: string[] }>('GET', '/admin/multiaddrs');
+    return data.multiaddrs;
+  }
+
+  // --- drone seeding (node-donation requester side) ---
+
+  /**
+   * Mint a seed authorizing a drone — a provider-hosted / donated node — to join
+   * this node's cadre. The node signs the seed with its own authority key; only
+   * the signed, public `encodedSeed` is returned (the private key never leaves
+   * the node). This is the requester ("phone") side of the node-donation flow:
+   * the donor host presents the returned seed to the donated node's `POST /seed`.
+   */
+  async addDrone(options: { dronePeerId: string; droneMultiaddrs: string[] }): Promise<DroneInitResult> {
+    return await this.request<DroneInitResult>('POST', '/admin/add-drone', {
+      dronePeerId: options.dronePeerId,
+      droneMultiaddrs: options.droneMultiaddrs,
+    });
+  }
+
+  // --- push-model invite addresses ---
+
+  /** Push the NAT-resolved addresses the node should embed in future invites. */
+  async pushInviteAddresses(addresses: string[]): Promise<void> {
+    await this.request('PUT', '/admin/invite-addresses', { addresses });
+  }
+
+  // --- internals ---
+
+  private resolveEndpoint(): OwnerAdminEndpoint {
+    const ep = typeof this.endpointSource === 'function' ? this.endpointSource() : this.endpointSource;
+    if (!ep) {
+      throw new OwnerNodeUnavailableError('Owner node admin endpoint is not available');
+    }
+    return ep;
+  }
+
+  private async request<T>(method: string, path: string, body?: unknown): Promise<T> {
+    const ep = this.resolveEndpoint();
+    const headers: Record<string, string> = { authorization: `Bearer ${ep.token}` };
+    const init: RequestInit = { method, headers };
+    if (body !== undefined) {
+      headers['content-type'] = 'application/json';
+      init.body = JSON.stringify(body);
+    }
+
+    let res: Response;
+    try {
+      res = await this.fetchImpl(`${ep.baseUrl}${path}`, init);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log('admin %s %s transport error: %s', method, path, message);
+      throw new OwnerNodeUnavailableError(`Owner node unreachable: ${message}`);
+    }
+
+    const envelope = await this.parseEnvelope(res);
+    if (!res.ok || !envelope.ok) {
+      const code = envelope.error?.code;
+      const message = envelope.error?.message ?? `admin ${method} ${path} → HTTP ${res.status}`;
+      log('admin %s %s failed: [%s] %s', method, path, code ?? res.status, message);
+      throw new OwnerNodeUnavailableError(message, code);
+    }
+    return envelope.data as T;
+  }
+
+  private async parseEnvelope(res: Response): Promise<{
+    ok?: boolean;
+    data?: unknown;
+    error?: { code?: string; message?: string };
+  }> {
+    try {
+      const parsed = await res.json();
+      if (parsed && typeof parsed === 'object') {
+        return parsed as { ok?: boolean; data?: unknown; error?: { code?: string; message?: string } };
+      }
+    } catch {
+      // Non-JSON body — fall through to an empty envelope; status drives the
+      // ok/non-ok decision in the caller.
+    }
+    return {};
+  }
+}

package/src/push/__tests__/push.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect } from 'vitest';
+
+import type { SecretsStore } from '../../nat/secrets/index.js';
+import type { PushSettings } from '../../installer/config.js';
+import {
+  resolvePushCredentials,
+  setFcmSecret,
+  setApnsSecret,
+  clearPushSecret,
+  pushAccount,
+  pushStatus,
+} from '../index.js';
+
+/** In-memory SecretsStore for tests. */
+function fakeStore(): SecretsStore {
+  const map = new Map<string, string>();
+  return {
+    async set(account, value) { map.set(account, value); },
+    async get(account) { return map.get(account) ?? null; },
+    async delete(account) { return map.delete(account); },
+    async list() { return [...map.keys()]; },
+  };
+}
+
+const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-PEM' };
+const APNS = { keyId: 'KID', teamId: 'TEAM', privateKey: 'P8-PEM' };
+
+describe('resolvePushCredentials', () => {
+  it('returns undefined when no platform is configured (opt-in default)', async () => {
+    const store = fakeStore();
+    expect(await resolvePushCredentials(store, undefined)).toBeUndefined();
+  });
+
+  it('resolves an FCM-only bundle from the secret store', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    const push = await resolvePushCredentials(store, undefined);
+    expect(push).toEqual({ fcm: FCM });
+  });
+
+  it('merges the APNs secret with non-secret bundleId/production from settings', async () => {
+    const store = fakeStore();
+    await setApnsSecret(store, APNS);
+    const settings: PushSettings = { apns: { bundleId: 'com.example.app', production: true }, cooldownMs: 1000, debounceMs: 50 };
+    const push = await resolvePushCredentials(store, settings);
+    expect(push).toEqual({
+      apns: { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'P8-PEM', production: true },
+      cooldownMs: 1000,
+      debounceMs: 50,
+    });
+  });
+
+  it('combines both platforms when both secrets are present', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    await setApnsSecret(store, APNS);
+    const push = await resolvePushCredentials(store, { apns: { bundleId: 'com.example.app' } });
+    expect(push?.fcm).toEqual(FCM);
+    expect(push?.apns?.bundleId).toBe('com.example.app');
+  });
+
+  it('throws on a partial APNs config (secret present but bundleId unset)', async () => {
+    const store = fakeStore();
+    await setApnsSecret(store, APNS);
+    // No settings.apns.bundleId → bundleId resolves to '' → validation rejects.
+    await expect(resolvePushCredentials(store, undefined)).rejects.toThrow(/push\.apns\.bundleId/);
+  });
+
+  it('keeps the FCM private key out of the secret-store account name', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    const accounts = await store.list();
+    expect(accounts).toContain(pushAccount('fcm'));
+    expect(accounts.join()).not.toContain('FCM-PEM');
+  });
+});
+
+describe('clearPushSecret / pushStatus', () => {
+  it('reports configured platforms and clears them', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    await setApnsSecret(store, APNS);
+    expect(await pushStatus(store)).toEqual({ fcm: true, apns: true });
+
+    expect(await clearPushSecret(store, 'fcm')).toBe(true);
+    expect(await pushStatus(store)).toEqual({ fcm: false, apns: true });
+
+    expect(await clearPushSecret(store, 'fcm')).toBe(false);
+  });
+});