@serfab/cadre-host 1.12.0 → 1.14.0

package/src/owner/owner-node-client.ts

@@ -1,259 +0,0 @@
-/**
- * HTTP client for the owner node's loopback admin channel (the 6.6
- * `cadre-node-admin-channel` contract).
- *
- * cadre-host's manager process holds no in-process `CadreNode`; it spawns the
- * admin's owner node as a managed child (see `HostProcessOrchestrator`)
- * and delegates all owner/membership/identity operations to it over this
- * client. The client implements **all three** trimmed `CadreNodeLike`
- * interfaces — the trust-circle one (`auth/trust-circle.ts`), the NAT one
- * (`nat/nat-service.ts`), and the strand one (`strands/strand-service.ts`) —
- * plus `pushInviteAddresses` and `addDrone` (the node-donation requester side).
- *
- * Transport: `Authorization: Bearer <token>` against
- * `http://127.0.0.1:<adminPort>`. Every response uses the cadre-provider
- * envelope `{ ok: true, data }` / `{ ok: false, error: { code, message } }`.
- * A refused connection, a transport error, or any non-2xx response surfaces
- * as {@link OwnerNodeUnavailableError}; the trust-circle / NAT services
- * translate that into a `node_unavailable` domain error so the management API
- * returns a clear 503 rather than a raw 500.
- */
-
-import debug from 'debug';
-import type { CadreInvite, DroneInitResult } from '@serfab/cadre-core';
-
-import type { OwnerAdminEndpoint } from '../orchestrator/index.js';
-import type { CadreNodeLike as TrustCircleCadreNodeLike } from '../auth/trust-circle.js';
-import type { CadreNodeLike as NatCadreNodeLike } from '../nat/nat-service.js';
-import type { CadreNodeLike as StrandCadreNodeLike } from '../strands/strand-service.js';
-import type { StrandListSnapshot, StrandRemovalResult } from '../strands/types.js';
-
-const log = debug('cadre:host:owner-client');
-
-/**
- * Raised when the owner node's admin channel can't be reached or returns
- * a non-success response. Carries the node's stable error `code` when one was
- * present in the envelope (e.g. `not_ready`, `not_authorized`).
- */
-export class OwnerNodeUnavailableError extends Error {
-  /** The admin-channel error code, when the node answered with an envelope. */
-  readonly nodeCode?: string;
-
-  constructor(message: string, nodeCode?: string) {
-    super(message);
-    this.name = 'OwnerNodeUnavailableError';
-    if (nodeCode !== undefined) this.nodeCode = nodeCode;
-  }
-}
-
-/** Endpoint provided directly or via a getter (so it tracks re-spawns). */
-type EndpointSource =
-  | OwnerAdminEndpoint
-  | (() => OwnerAdminEndpoint | undefined)
-  | undefined;
-
-export interface OwnerNodeClientOptions {
-  /** Fetch override for tests. Defaults to the global `fetch`. */
-  fetch?: typeof fetch;
-}
-
-export class OwnerNodeClient
-implements TrustCircleCadreNodeLike, NatCadreNodeLike, StrandCadreNodeLike {
-  private readonly endpointSource: EndpointSource;
-  private readonly fetchImpl: typeof fetch;
-
-  /**
-   * @param endpoint Either a fixed `{ baseUrl, token }` or a getter returning
-   *   the current endpoint (pass `orchestrator.getOwnerAdminEndpoint`
-   *   bound, so a restart's new bearer token is picked up automatically).
-   */
-  constructor(endpoint: EndpointSource, opts: OwnerNodeClientOptions = {}) {
-    this.endpointSource = endpoint;
-    this.fetchImpl = opts.fetch ?? fetch;
-  }
-
-  // --- trust-circle CadreNodeLike ---
-
-  async createInvite(
-    token?: string,
-    expiresInMs?: number,
-  ): Promise<{ invite: CadreInvite; encodedInvite: string }> {
-    const body: Record<string, unknown> = {};
-    if (token !== undefined) body.token = token;
-    if (expiresInMs !== undefined) body.expiresInMs = expiresInMs;
-    return await this.request<{ invite: CadreInvite; encodedInvite: string }>(
-      'POST',
-      '/admin/invites',
-      body,
-    );
-  }
-
-  async acceptPhone(
-    options: { phonePeerId: string; token?: string },
-    issuedInvite?: CadreInvite,
-  ): Promise<void> {
-    const body: Record<string, unknown> = { phonePeerId: options.phonePeerId };
-    if (options.token !== undefined) body.token = options.token;
-    if (issuedInvite !== undefined) body.issuedInvite = issuedInvite;
-    await this.request('POST', '/admin/accept-phone', body);
-  }
-
-  async removePeer(peerId: string): Promise<void> {
-    await this.request('DELETE', `/admin/members/${encodeURIComponent(peerId)}`);
-  }
-
-  /**
-   * Encode an invite for out-of-band delivery. The admin contract has no
-   * encode route (the mint route already returns `encodedInvite`), so this
-   * mirrors cadre-core's encoding (`base64url(JSON.stringify(invite))`).
-   */
-  encodeInvite(invite: CadreInvite): string {
-    return Buffer.from(JSON.stringify(invite), 'utf8').toString('base64url');
-  }
-
-  async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
-    const data = await this.request<{ members: Array<{ peerId: string; multiaddr: string | null }> }>(
-      'GET',
-      '/admin/members',
-    );
-    return data.members;
-  }
-
-  async isMember(peerId: string): Promise<boolean> {
-    const data = await this.request<{ member: boolean }>(
-      'GET',
-      `/admin/members/${encodeURIComponent(peerId)}`,
-    );
-    return data.member;
-  }
-
-  /** Authorized-membership surface (excludes self) — see {@link listMembers} for the addressable one. */
-  async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
-    const data = await this.request<{ members: Array<{ peerId: string; multiaddr: string | null }> }>(
-      'GET',
-      '/admin/authorized-members',
-    );
-    return data.members;
-  }
-
-  async isAuthorizedMember(peerId: string): Promise<boolean> {
-    const data = await this.request<{ member: boolean }>(
-      'GET',
-      `/admin/authorized-members/${encodeURIComponent(peerId)}`,
-    );
-    return data.member;
-  }
-
-  // --- NAT CadreNodeLike ---
-
-  async getPeerId(): Promise<string> {
-    const data = await this.request<{ peerId: string | null; partyId: string }>('GET', '/admin/identity');
-    return data.peerId ?? '';
-  }
-
-  async getMultiaddrs(): Promise<string[]> {
-    const data = await this.request<{ multiaddrs: string[] }>('GET', '/admin/multiaddrs');
-    return data.multiaddrs;
-  }
-
-  // --- strand CadreNodeLike ---
-
-  /** This party's strands plus the node's current control-connection count. */
-  async listStrands(): Promise<StrandListSnapshot> {
-    return await this.request<StrandListSnapshot>('GET', '/admin/strands');
-  }
-
-  /**
-   * Remove this party's participation in one strand.
-   *
-   * `?confirm=1` is appended **only** when the caller asked for it. The node
-   * refuses an unconfirmed closed-strand removal with `confirmation_required`;
-   * that refusal is surfaced, never retried with the flag added — the row holds
-   * this party's membership key for the strand and nothing else does.
-   */
-  async removeStrand(strandId: string, opts: { confirm: boolean }): Promise<StrandRemovalResult> {
-    const query = opts.confirm ? '?confirm=1' : '';
-    return await this.request<StrandRemovalResult>(
-      'DELETE',
-      `/admin/strands/${encodeURIComponent(strandId)}${query}`,
-    );
-  }
-
-  // --- drone seeding (node-donation requester side) ---
-
-  /**
-   * Mint a seed authorizing a drone — a provider-hosted / donated node — to join
-   * this node's cadre. The node signs the seed with its own authority key; only
-   * the signed, public `encodedSeed` is returned (the private key never leaves
-   * the node). This is the requester ("phone") side of the node-donation flow:
-   * the donor host presents the returned seed to the donated node's `POST /seed`.
-   */
-  async addDrone(options: { dronePeerId: string; droneMultiaddrs: string[] }): Promise<DroneInitResult> {
-    return await this.request<DroneInitResult>('POST', '/admin/add-drone', {
-      dronePeerId: options.dronePeerId,
-      droneMultiaddrs: options.droneMultiaddrs,
-    });
-  }
-
-  // --- push-model invite addresses ---
-
-  /** Push the NAT-resolved addresses the node should embed in future invites. */
-  async pushInviteAddresses(addresses: string[]): Promise<void> {
-    await this.request('PUT', '/admin/invite-addresses', { addresses });
-  }
-
-  // --- internals ---
-
-  private resolveEndpoint(): OwnerAdminEndpoint {
-    const ep = typeof this.endpointSource === 'function' ? this.endpointSource() : this.endpointSource;
-    if (!ep) {
-      throw new OwnerNodeUnavailableError('Owner node admin endpoint is not available');
-    }
-    return ep;
-  }
-
-  private async request<T>(method: string, path: string, body?: unknown): Promise<T> {
-    const ep = this.resolveEndpoint();
-    const headers: Record<string, string> = { authorization: `Bearer ${ep.token}` };
-    const init: RequestInit = { method, headers };
-    if (body !== undefined) {
-      headers['content-type'] = 'application/json';
-      init.body = JSON.stringify(body);
-    }
-
-    let res: Response;
-    try {
-      res = await this.fetchImpl(`${ep.baseUrl}${path}`, init);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      log('admin %s %s transport error: %s', method, path, message);
-      throw new OwnerNodeUnavailableError(`Owner node unreachable: ${message}`);
-    }
-
-    const envelope = await this.parseEnvelope(res);
-    if (!res.ok || !envelope.ok) {
-      const code = envelope.error?.code;
-      const message = envelope.error?.message ?? `admin ${method} ${path} → HTTP ${res.status}`;
-      log('admin %s %s failed: [%s] %s', method, path, code ?? res.status, message);
-      throw new OwnerNodeUnavailableError(message, code);
-    }
-    return envelope.data as T;
-  }
-
-  private async parseEnvelope(res: Response): Promise<{
-    ok?: boolean;
-    data?: unknown;
-    error?: { code?: string; message?: string };
-  }> {
-    try {
-      const parsed = await res.json();
-      if (parsed && typeof parsed === 'object') {
-        return parsed as { ok?: boolean; data?: unknown; error?: { code?: string; message?: string } };
-      }
-    } catch {
-      // Non-JSON body — fall through to an empty envelope; status drives the
-      // ok/non-ok decision in the caller.
-    }
-    return {};
-  }
-}

package/src/server/__tests__/bootstrap-node-validation.test.ts

@@ -1,138 +0,0 @@
-/**
- * The host's `bootstrapNodes` rule — the requester addresses a donated node is
- * started with — exercised directly.
- *
- * This is one half of a **manual tripwire**: cadre-provider carries an identical
- * copy of this rule's per-entry half
- * (`packages/cadre-provider/src/server/bootstrap-node-validation.ts`) and the
- * per-entry rows below are the same rows
- * `packages/cadre-provider/src/server/__tests__/bootstrap-node-validation.test.ts`
- * pins that copy to. The empty-list row differs on purpose: this host accepts an
- * empty list (a phone requester dials its lent node instead), the provider still
- * requires one. Neither suite can observe the other package — nothing here
- * imports cadre-provider's server module — so this does not detect a change made
- * over there; what it does is fail if *this* copy is changed, which is how an
- * editor is landed on the comment pointing at the other one.
- *
- * The route contract (`POST /grants` → 400, nothing provisioned) lives in
- * `grants-route.test.ts`, next to the rest of that route's HTTP behaviour.
- */
-
-import { describe, it, expect } from 'vitest';
-
-import { validateBootstrapNodes } from '../routes/bootstrap-node-validation.js';
-
-/**
- * A real, decodable peer id. Placeholder strings like `12D3KooReq` look right and
- * are not: `peerIdFromString` throws `Incorrect length` on them, which is exactly
- * the typo this rule exists to catch.
- */
-const PEER = '12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp';
-const GOOD = `/ip4/127.0.0.1/tcp/4001/p2p/${PEER}`;
-/** A second, distinct dialable address, for "which entry was bad" assertions. */
-const GOOD_2 = `/dns4/bootstrap.example/tcp/443/wss/p2p/${PEER}`;
-
-describe('validateBootstrapNodes (the host copy of the address rule)', () => {
-  function errorOf(value: unknown): string {
-    const result = validateBootstrapNodes(value);
-    if (!('error' in result)) throw new Error(`expected a rejection, got ${JSON.stringify(result)}`);
-    return result.error;
-  }
-
-  it('accepts a dialable address and returns it trimmed', () => {
-    expect(validateBootstrapNodes([`  ${GOOD}\n`])).toEqual({ nodes: [GOOD] });
-  });
-
-  it('accepts several dialable addresses across transports', () => {
-    expect(validateBootstrapNodes([GOOD, GOOD_2])).toEqual({ nodes: [GOOD, GOOD_2] });
-  });
-
-  it('accepts a relayed address whose relay and target peer ids both decode', () => {
-    const relayed = `/ip4/1.2.3.4/tcp/4001/p2p/${PEER}/p2p-circuit/p2p/${PEER}`;
-    expect(validateBootstrapNodes([relayed])).toEqual({ nodes: [relayed] });
-  });
-
-  // The one row that differs from cadre-provider's table: a requester with no address
-  // of its own (a phone) sends none and dials the lent node itself.
-  it('treats an absent field and an empty list alike: no addresses, nothing rejected', () => {
-    expect(validateBootstrapNodes(undefined)).toEqual({ nodes: [] });
-    expect(validateBootstrapNodes([])).toEqual({ nodes: [] });
-  });
-
-  it('rejects a non-array, and an array with a non-string element', () => {
-    expect(errorOf(GOOD)).toBe('bootstrapNodes must be an array of strings');
-    expect(errorOf(null)).toBe('bootstrapNodes must be an array of strings');
-    expect(errorOf([42])).toBe('bootstrapNodes must be an array of strings');
-    expect(errorOf([GOOD, { addr: GOOD }])).toBe('bootstrapNodes must be an array of strings');
-  });
-
-  it('rejects an empty or whitespace-only entry with the blank-value message', () => {
-    for (const blank of ['', '   ', '\t\n']) {
-      expect(errorOf([blank])).toMatch(/must not be empty or whitespace-only/);
-    }
-  });
-
-  // Case 1: `@libp2p/bootstrap` maps `multiaddr()` over the list before filtering,
-  // so this one throws during libp2p construction and the child never starts.
-  it('rejects a string that is not a multiaddr, naming it', () => {
-    for (const bad of ['not-an-address', '42', 'bootstrap.example:4001']) {
-      const message = errorOf([bad]);
-      expect(message).toMatch(/must be multiaddrs/);
-      expect(message).toContain(bad);
-    }
-  });
-
-  // Case 2: the quiet one — parses, then gets filtered out inside the child and
-  // the node comes up healthy-looking with zero bootstrap peers.
-  it('rejects a valid multiaddr with no /p2p/ component, naming it', () => {
-    const message = errorOf(['/ip4/127.0.0.1/tcp/4001']);
-    expect(message).toMatch(/must include a \/p2p\/<peerId> component/);
-    expect(message).toContain('/ip4/127.0.0.1/tcp/4001');
-  });
-
-  // Case 3: `multiaddr()` does not validate the /p2p/ value; `peerIdFromString`
-  // does, and throws inside the child's libp2p construction.
-  it('rejects a /p2p/ component whose peer id does not decode, naming the entry and the id', () => {
-    const bad = '/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq';
-    const message = errorOf([bad]);
-    expect(message).toMatch(/must carry a decodable peer id/);
-    expect(message).toContain(bad);
-    expect(message).toContain('12D3KooReq');
-  });
-
-  it('rejects a relayed address whose relay peer id does not decode', () => {
-    expect(errorOf([`/ip4/1.2.3.4/tcp/4001/p2p/12D3KooReq/p2p-circuit/p2p/${PEER}`]))
-      .toMatch(/must carry a decodable peer id/);
-  });
-
-  // Case 4: parses, names a decodable peer, and survives `@libp2p/bootstrap`'s
-  // filter — but names no place, so libp2p finds no transport and the dial fails
-  // with no valid addresses. Same visible outcome as case 2.
-  it('rejects an address that names only peer ids, with no location to dial', () => {
-    for (const bad of [`/p2p/${PEER}`, `/p2p/${PEER}/p2p-circuit/p2p/${PEER}`]) {
-      const message = errorOf([bad]);
-      expect(message).toMatch(/must name where to reach the peer/);
-      expect(message).toContain(bad);
-    }
-  });
-
-  // A partial address is deliberately still accepted: which transports the child
-  // can dial is the embedder's choice, so only the total absence of a location is
-  // a boundary error.
-  it('accepts an address with a location but no transport, leaving that to the child', () => {
-    const partial = `/ip4/1.2.3.4/p2p/${PEER}`;
-    expect(validateBootstrapNodes([partial])).toEqual({ nodes: [partial] });
-  });
-
-  it('names the offending entry when only one address in a batch is bad', () => {
-    const message = errorOf([GOOD, '/ip4/10.0.0.9/tcp/4001', GOOD_2]);
-    expect(message).toContain('/ip4/10.0.0.9/tcp/4001');
-  });
-
-  // A requester must not be able to turn one junk string into a megabyte of log line.
-  it('caps the echoed value for an over-long rejected address', () => {
-    const message = errorOf([`/ip4/1.2.3.4/tcp/${'9'.repeat(5000)}`]);
-    expect(message).toContain('chars)');
-    expect(message.length).toBeLessThan(400);
-  });
-});

package/src/server/__tests__/grants-admin-route.test.ts

@@ -1,171 +0,0 @@
-import Fastify from 'fastify';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { registerErrorHandler } from '../error-handler.js';
-import { EventBus } from '../events/bus.js';
-import { registerGrantsAdminRoutes } from '../routes/grants-admin.js';
-import {
-  DonationService,
-  DonationStore,
-  GrantService,
-  GrantStore,
-  createGrantAdminHandlers,
-} from '../../donation/index.js';
-import type { DonationView, Grant, GrantListing } from '../../donation/index.js';
-import { FakeOrchestrator } from '../../donation/__tests__/fake-orchestrator.js';
-
-/** A well-formed 32-byte base64url owner key, which `provision` requires. */
-const OWNER_KEY = Buffer.alloc(32, 7).toString('base64url');
-
-let tmpRoot: string;
-let app: ReturnType<typeof Fastify>;
-let grants: GrantService;
-let donations: DonationService;
-let donationStore: DonationStore;
-let orch: FakeOrchestrator;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-grants-route-'));
-  grants = new GrantService({ store: new GrantStore(tmpRoot) });
-  orch = new FakeOrchestrator();
-  donationStore = new DonationStore(tmpRoot);
-  donations = new DonationService({ orchestrator: orch, grants, store: donationStore });
-  app = Fastify();
-  registerErrorHandler(app);
-  registerGrantsAdminRoutes(app, { handlers: createGrantAdminHandlers(grants, donations), events: new EventBus() });
-});
-
-afterEach(async () => {
-  await app.close();
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-});
-
-describe('/grants-admin routes', () => {
-  it('POST issues a grant, GET lists it, DELETE revokes it', async () => {
-    const post = await app.inject({
-      method: 'POST',
-      url: '/grants-admin',
-      payload: { label: "Alice's cadre", maxNodes: 2 },
-    });
-    expect(post.statusCode).toBe(200);
-    const created = (post.json() as { grant: Grant }).grant;
-    expect(created.token).toBeTruthy();
-    expect(created.maxNodes).toBe(2);
-
-    const list = await app.inject({ method: 'GET', url: '/grants-admin' });
-    expect(list.statusCode).toBe(200);
-    expect((list.json() as { grants: Grant[] }).grants.map(g => g.token)).toContain(created.token);
-
-    const del = await app.inject({
-      method: 'DELETE',
-      url: `/grants-admin/${encodeURIComponent(created.token)}`,
-    });
-    expect(del.statusCode).toBe(200);
-
-    // Revoked → still listed, now carries revokedAt.
-    const after = await app.inject({ method: 'GET', url: '/grants-admin' });
-    const row = (after.json() as { grants: Grant[] }).grants.find(g => g.token === created.token);
-    expect(row?.revokedAt).toBeTruthy();
-  });
-
-  it('POST with an empty label → 400 invalid_label', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants-admin', payload: { label: '  ' } });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_label');
-  });
-
-  it('POST with a bad maxNodes → 400 invalid_max_nodes', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants-admin', payload: { label: 'X', maxNodes: 0 } });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_max_nodes');
-  });
-
-  it('DELETE of an unknown token → 404 not_found', async () => {
-    const res = await app.inject({ method: 'DELETE', url: '/grants-admin/nope' });
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
-  });
-});
-
-function provisionUnder(token: string): Promise<DonationView> {
-  return donations.provision({ grantToken: token, partyId: 'party-P', bootstrapNodes: [], ownerKeys: [OWNER_KEY] });
-}
-
-describe('/grants-admin listing', () => {
-  it("GET reports each grant's live nodes and the donations a revoke would end", async () => {
-    const a = grants.issue({ label: 'A', maxNodes: 3 });
-    const b = grants.issue({ label: 'B' });
-    const seeded = await provisionUnder(a.token);
-    const failed = await provisionUnder(a.token);
-    const ended = await provisionUnder(a.token);
-    const other = await provisionUnder(b.token);
-    donationStore.put({ ...donationStore.get(seeded.id)!, status: 'seeded' });
-    donationStore.put({ ...donationStore.get(failed.id)!, status: 'error', error: 'respawn gave up' });
-    await donations.terminate(ended.id);
-
-    const res = await app.inject({ method: 'GET', url: '/grants-admin' });
-
-    const listed = (res.json() as { grants: GrantListing[] }).grants;
-    const rowA = listed.find(g => g.token === a.token);
-    const rowB = listed.find(g => g.token === b.token);
-    // `error` is not live, but a revoke still tears it down; `terminated` is neither.
-    expect(rowA?.liveNodes).toBe(1);
-    expect(rowA?.donations).toEqual(expect.arrayContaining([
-      { id: seeded.id, status: 'seeded' },
-      { id: failed.id, status: 'error' },
-    ]));
-    expect(rowA?.donations).toHaveLength(2);
-    expect(rowB?.liveNodes).toBe(1);
-    expect(rowB?.donations).toEqual([{ id: other.id, status: 'awaiting_seed' }]);
-  });
-});
-
-describe('/grants-admin donated-node teardown', () => {
-  it('DELETE /grants-admin/:token terminates the nodes donated under the grant', async () => {
-    const { token } = grants.issue({ label: 'Alice' });
-    const donation = await provisionUnder(token);
-
-    const res = await app.inject({ method: 'DELETE', url: `/grants-admin/${encodeURIComponent(token)}` });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, terminated: [donation.id] });
-    expect(donations.get(donation.id)?.status).toBe('terminated');
-    expect(orch.removed).toEqual(['dock_1']);
-  });
-
-  it('?keepNodes=true revokes the grant but leaves its nodes running', async () => {
-    const { token } = grants.issue({ label: 'Alice' });
-    const donation = await provisionUnder(token);
-
-    const res = await app.inject({
-      method: 'DELETE',
-      url: `/grants-admin/${encodeURIComponent(token)}?keepNodes=true`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, terminated: [] });
-    expect(grants.validate(token).reason).toBe('revoked');
-    expect(donations.get(donation.id)?.status).toBe('awaiting_seed');
-    expect(orch.stopped).toEqual([]);
-  });
-
-  it('DELETE /grants-admin/donations/:id ends one node under a revoked grant; an unknown id 404s', async () => {
-    const { token } = grants.issue({ label: 'Alice', maxNodes: 2 });
-    const kept = await provisionUnder(token);
-    const ended = await provisionUnder(token);
-    grants.revoke(token);
-
-    const res = await app.inject({ method: 'DELETE', url: `/grants-admin/donations/${ended.id}` });
-
-    expect(res.statusCode).toBe(200);
-    expect(donations.get(ended.id)?.status).toBe('terminated');
-    expect(donations.get(kept.id)?.status).toBe('awaiting_seed');
-
-    const unknown = await app.inject({ method: 'DELETE', url: '/grants-admin/donations/grn_nope' });
-    expect(unknown.statusCode).toBe(404);
-    expect((unknown.json() as { error: { code: string } }).error.code).toBe('not_found');
-  });
-});