@serfab/cadre-host 1.13.0 → 1.14.0

package/src/__tests__/orchestrator-ports.test.ts

@@ -1,143 +1,124 @@
-/**
- * The pure port-set logic behind `HostProcessOrchestrator`: the helpers that
- * allocate, hold, release and reuse one node's set of ports, and the listen
- * addresses a child is started with. No child processes — the behaviour these
- * feed is exercised against a stub child in `orchestrator.test.ts`.
- */
-
-import { describe, expect, it } from 'vitest';
-
-import { PortAllocator } from '@serfab/cadre-provider';
-
-import { childListenAddrs } from '../orchestrator/host-process-orchestrator.js';
-import {
-  allocateNodePorts,
-  releaseNodePorts,
-  reserveNodePorts,
-  reusedNodePorts,
-} from '../orchestrator/port-allocator.js';
-import type { NodePorts } from '../orchestrator/types.js';
-
-/**
- * A port set as `state.json` hands it back from a build that predates the `ws` key:
- * the type says every key is present, the data does not.
- */
-function portsWithoutWs(ports: Omit<NodePorts, 'ws'>): NodePorts {
-  return ports as NodePorts;
-}
-
-describe('allocateNodePorts', () => {
-  it('allocates the five ports in a fixed order, the newest key last', () => {
-    const a = new PortAllocator(10000, 10010);
-    expect(allocateNodePorts(a)).toEqual({ health: 10000, metrics: 10001, p2p: 10002, admin: 10003, ws: 10004 });
-  });
-
-  // A partial set left reserved would leak from a bounded range on every failed
-  // provision — the whole reason this helper exists rather than five allocates.
-  it('is all-or-nothing: an exhausted range releases everything it took', () => {
-    const a = new PortAllocator(13000, 13002);
-    expect(() => allocateNodePorts(a)).toThrow(/No available ports/);
-    expect(a.has(13000)).toBe(false);
-    expect(a.has(13001)).toBe(false);
-    expect(a.has(13002)).toBe(false);
-  });
-
-  // Four ports used to be one node's worth. A range sized for that now fails on the
-  // fifth, and must neither hand back a set missing `ws` nor keep the four it took.
-  it('fails cleanly on a range with room for four ports but not five', () => {
-    const a = new PortAllocator(13000, 13003);
-    expect(() => allocateNodePorts(a)).toThrow(/No available ports/);
-    for (let port = 13000; port <= 13003; port++) expect(a.has(port)).toBe(false);
-  });
-
-  // The owner node's p2p port is pinned by the NAT mapping, not allocated.
-  it('honours an override and reserves it', () => {
-    const a = new PortAllocator(10000, 10010);
-    expect(allocateNodePorts(a, { p2p: 10005 })).toEqual({
-      health: 10000,
-      metrics: 10001,
-      p2p: 10005,
-      admin: 10002,
-      ws: 10003,
-    });
-    // Reserved, so no later allocation can hand it out again.
-    expect(a.has(10005)).toBe(true);
-  });
-
-  // An out-of-range override is the production case for the owner node: its
-  // libp2p port is chosen by NAT config, not by the allocator, so reserving it
-  // is a documented no-op rather than an error.
-  it('accepts an override outside the managed range without reserving it', () => {
-    const a = new PortAllocator(10000, 10010);
-    expect(allocateNodePorts(a, { p2p: 40000 })).toMatchObject({ p2p: 40000, health: 10000 });
-    expect(a.has(40000)).toBe(false);
-  });
-
-  // A re-spawn passes its previous set as overrides; every one must come back exactly.
-  it('returns a full set of overrides exactly, allocating nothing', () => {
-    const a = new PortAllocator(10000, 10010);
-    const previous = { health: 10006, metrics: 10007, p2p: 10008, admin: 10009, ws: 10010 };
-    expect(allocateNodePorts(a, previous)).toEqual(previous);
-    expect(a.allocate()).toBe(10000);
-  });
-});
-
-describe('reserveNodePorts / releaseNodePorts', () => {
-  it('hold and then release every key of the set', () => {
-    const a = new PortAllocator(10000, 10010);
-    const ports = { health: 10000, metrics: 10001, p2p: 10002, admin: 10003, ws: 10004 };
-    reserveNodePorts(a, ports);
-    for (const port of Object.values(ports)) expect(a.has(port)).toBe(true);
-    releaseNodePorts(a, ports);
-    for (const port of Object.values(ports)) expect(a.has(port)).toBe(false);
-  });
-
-  // Rehydrating, or dropping, a `state.json` handle written before `ws` existed.
-  it('skip a key the set lacks', () => {
-    const a = new PortAllocator(10000, 10010);
-    const ports = portsWithoutWs({ health: 10000, metrics: 10001, p2p: 10002, admin: 10003 });
-    reserveNodePorts(a, ports);
-    expect(a.has(undefined as unknown as number)).toBe(false);
-    expect(a.allocate()).toBe(10004);
-    releaseNodePorts(a, ports);
-    expect(a.has(10000)).toBe(false);
-    expect(a.has(10004)).toBe(true);
-  });
-});
-
-describe('reusedNodePorts', () => {
-  const previous = { health: 10005, metrics: 10006, p2p: 10007, admin: 10008, ws: 10009 };
-
-  it("returns the dropped handle's whole port set", () => {
-    expect(reusedNodePorts([{ ports: previous }])).toEqual(previous);
-  });
-
-  it('returns nothing when nothing was dropped, so every port is allocated fresh', () => {
-    expect(reusedNodePorts([])).toEqual({});
-  });
-
-  // A handle persisted before `ws` existed: its other ports come back, `ws` is new.
-  it('omits a key the dropped handle lacks', () => {
-    const legacy = portsWithoutWs({ health: 10005, metrics: 10006, p2p: 10007, admin: 10008 });
-    const reused = reusedNodePorts([{ ports: legacy }]);
-    expect(reused).toEqual({ health: 10005, metrics: 10006, p2p: 10007, admin: 10008 });
-    expect('ws' in reused).toBe(false);
-
-    const a = new PortAllocator(10000, 10010);
-    expect(allocateNodePorts(a, reused)).toEqual({ health: 10005, metrics: 10006, p2p: 10007, admin: 10008, ws: 10000 });
-  });
-
-  it('takes the last handle when a state holding duplicates dropped several', () => {
-    const older = { health: 10000, metrics: 10001, p2p: 10002, admin: 10003, ws: 10004 };
-    expect(reusedNodePorts([{ ports: older }, { ports: previous }])).toEqual(previous);
-  });
-});
-
-describe('childListenAddrs', () => {
-  it('names a TCP listener on the p2p port and a WebSocket listener on the ws port, on every interface', () => {
-    expect(childListenAddrs({ p2p: 10002, ws: 10004 })).toEqual([
-      '/ip4/0.0.0.0/tcp/10002',
-      '/ip4/0.0.0.0/tcp/10004/ws',
-    ]);
-  });
-});
+/**
+ * The pure port-set logic behind `HostProcessOrchestrator`: the helpers that
+ * allocate, hold, release and reuse one node's set of ports, and the listen
+ * addresses a child is started with. No child processes — the behaviour these
+ * feed is exercised against a stub child in `orchestrator.test.ts`.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { PortAllocator } from '@serfab/cadre-provider';
+
+import { childListenAddrs } from '../orchestrator/host-process-orchestrator.js';
+import {
+  allocateNodePorts,
+  releaseNodePorts,
+  reserveNodePorts,
+  reusedNodePorts,
+} from '../orchestrator/port-allocator.js';
+import type { NodePorts } from '../orchestrator/types.js';
+
+/**
+ * A port set as `state.json` hands it back from a build that predates the `ws` key:
+ * the type says every key is present, the data does not.
+ */
+function portsWithoutWs(ports: Omit<NodePorts, 'ws'>): NodePorts {
+  return ports as NodePorts;
+}
+
+describe('allocateNodePorts', () => {
+  it('allocates the four ports in a fixed order', () => {
+    const a = new PortAllocator(10000, 10010);
+    expect(allocateNodePorts(a)).toEqual({ health: 10000, metrics: 10001, p2p: 10002, ws: 10003 });
+  });
+
+  // A partial set left reserved would leak from a bounded range on every failed
+  // provision — the whole reason this helper exists rather than four allocates.
+  it('is all-or-nothing: an exhausted range releases everything it took', () => {
+    const a = new PortAllocator(13000, 13002);
+    expect(() => allocateNodePorts(a)).toThrow(/No available ports/);
+    expect(a.has(13000)).toBe(false);
+    expect(a.has(13001)).toBe(false);
+    expect(a.has(13002)).toBe(false);
+  });
+
+  it('honours an override and reserves it', () => {
+    const a = new PortAllocator(10000, 10010);
+    expect(allocateNodePorts(a, { p2p: 10005 })).toEqual({
+      health: 10000,
+      metrics: 10001,
+      p2p: 10005,
+      ws: 10002,
+    });
+    // Reserved, so no later allocation can hand it out again.
+    expect(a.has(10005)).toBe(true);
+  });
+
+  // A re-spawn passes its previous set as overrides; every one must come back exactly.
+  it('returns a full set of overrides exactly, allocating nothing', () => {
+    const a = new PortAllocator(10000, 10010);
+    const previous = { health: 10006, metrics: 10007, p2p: 10008, ws: 10009 };
+    expect(allocateNodePorts(a, previous)).toEqual(previous);
+    expect(a.allocate()).toBe(10000);
+  });
+});
+
+describe('reserveNodePorts / releaseNodePorts', () => {
+  it('hold and then release every key of the set', () => {
+    const a = new PortAllocator(10000, 10010);
+    const ports = { health: 10000, metrics: 10001, p2p: 10002, ws: 10003 };
+    reserveNodePorts(a, ports);
+    for (const port of Object.values(ports)) expect(a.has(port)).toBe(true);
+    releaseNodePorts(a, ports);
+    for (const port of Object.values(ports)) expect(a.has(port)).toBe(false);
+  });
+
+  // Rehydrating, or dropping, a `state.json` handle written before `ws` existed.
+  it('skip a key the set lacks', () => {
+    const a = new PortAllocator(10000, 10010);
+    const ports = portsWithoutWs({ health: 10000, metrics: 10001, p2p: 10002 });
+    reserveNodePorts(a, ports);
+    expect(a.has(undefined as unknown as number)).toBe(false);
+    expect(a.allocate()).toBe(10003);
+    releaseNodePorts(a, ports);
+    expect(a.has(10000)).toBe(false);
+    expect(a.has(10003)).toBe(true);
+  });
+});
+
+describe('reusedNodePorts', () => {
+  const previous = { health: 10005, metrics: 10006, p2p: 10007, ws: 10008 };
+
+  it("returns the dropped handle's whole port set", () => {
+    expect(reusedNodePorts([{ ports: previous }])).toEqual(previous);
+  });
+
+  it('returns nothing when nothing was dropped, so every port is allocated fresh', () => {
+    expect(reusedNodePorts([])).toEqual({});
+  });
+
+  // A handle persisted before `ws` existed: its other ports come back, `ws` is new.
+  it('omits a key the dropped handle lacks', () => {
+    const legacy = portsWithoutWs({ health: 10005, metrics: 10006, p2p: 10007 });
+    const reused = reusedNodePorts([{ ports: legacy }]);
+    expect(reused).toEqual({ health: 10005, metrics: 10006, p2p: 10007 });
+    expect('ws' in reused).toBe(false);
+
+    const a = new PortAllocator(10000, 10010);
+    expect(allocateNodePorts(a, reused)).toEqual({ health: 10005, metrics: 10006, p2p: 10007, ws: 10000 });
+  });
+
+  it('takes the last handle when a state holding duplicates dropped several', () => {
+    const older = { health: 10000, metrics: 10001, p2p: 10002, ws: 10003 };
+    expect(reusedNodePorts([{ ports: older }, { ports: previous }])).toEqual(previous);
+  });
+});
+
+describe('childListenAddrs', () => {
+  it('names a TCP listener on the p2p port and a WebSocket listener on the ws port, on every interface', () => {
+    expect(childListenAddrs({ p2p: 10002, ws: 10004 })).toEqual([
+      '/ip4/0.0.0.0/tcp/10002',
+      '/ip4/0.0.0.0/tcp/10004/ws',
+    ]);
+  });
+});

package/src/__tests__/orchestrator-push.test.ts

@@ -1,146 +1,138 @@
-/**
- * HostProcessOrchestrator push-credential injection tests.
- *
- * Verifies the orchestrator writes `config.push` into the spawned node's
- * cadre.json when the pushResolver yields credentials, omits it otherwise,
- * re-resolves on every (re-)spawn, and never persists a raw private key in
- * state.json. Uses a fake CLI entrypoint that just writes its startup token.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, mkdirSync, rmSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import type { PushCredentials } from '@serfab/cadre-core';
-import { HostProcessOrchestrator, OWNER_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
-import { removeAllNodes } from './orchestrator-teardown.js';
-
-const FAKE_CLI = `
-import fs from 'node:fs';
-const args = process.argv.slice(2);
-const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
-const tokenPath = get('--startup-token-file');
-const token = process.env.CADRE_STARTUP_TOKEN ?? '';
-if (tokenPath && token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
-process.on('SIGTERM', () => process.exit(0));
-setInterval(() => {}, 1 << 30);
-`;
-
-const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-SECRET-PEM' };
-const APNS = { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'APNS-SECRET-P8', production: false };
-const CFG = { identityPath: 'C:/fake/identity.key', partyId: 'install-id-123', libp2pPort: 4655 };
-
-let tmpRoot: string;
-let scriptPath: string;
-const orchestrators: HostProcessOrchestrator[] = [];
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-push-'));
-  scriptPath = join(tmpRoot, 'fake-cli.mjs');
-  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
-});
-
-afterEach(async () => {
-  try {
-    await removeAllNodes(orchestrators);
-  } finally {
-    await sleep(50);
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  }
-});
-
-function makeOrchestrator(rootDir: string, pushResolver?: () => Promise<PushCredentials | undefined>): HostProcessOrchestrator {
-  mkdirSync(rootDir, { recursive: true });
-  const orch = new HostProcessOrchestrator({
-    rootDir,
-    portRange: { start: 18000, end: 18499 },
-    stopTimeoutMs: 1500,
-    spawn: { entrypoint: scriptPath },
-    ...(pushResolver ? { pushResolver } : {}),
-  });
-  orchestrators.push(orch);
-  return orch;
-}
-
-function readChildConfig(rootDir: string, containerId = OWNER_CONTAINER_ID): Record<string, unknown> {
-  const raw = readFileSync(join(rootDir, containerId, 'cadre.json'), 'utf8');
-  return JSON.parse(raw) as Record<string, unknown>;
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((res) => setTimeout(res, ms));
-}
-
-describe('HostProcessOrchestrator push injection', () => {
-  it('writes config.push into cadre.json when the resolver yields credentials', async () => {
-    const rootDir = join(tmpRoot, 'a');
-    const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM, apns: APNS, cooldownMs: 1000 }));
-    await orch.init();
-    await orch.ensureOwnerNode(CFG);
-
-    const cfg = readChildConfig(rootDir);
-    expect(cfg.push).toEqual({ fcm: FCM, apns: APNS, cooldownMs: 1000 });
-  });
-
-  it('omits config.push when no resolver is configured', async () => {
-    const rootDir = join(tmpRoot, 'b');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-    await orch.ensureOwnerNode(CFG);
-
-    const cfg = readChildConfig(rootDir);
-    expect(cfg.push).toBeUndefined();
-  });
-
-  it('omits config.push when the resolver returns undefined (push opt-in)', async () => {
-    const rootDir = join(tmpRoot, 'c');
-    const orch = makeOrchestrator(rootDir, async () => undefined);
-    await orch.init();
-    await orch.ensureOwnerNode(CFG);
-
-    expect(readChildConfig(rootDir).push).toBeUndefined();
-  });
-
-  it('degrades to no push (does not fail the spawn) when the resolver throws', async () => {
-    const rootDir = join(tmpRoot, 'd');
-    const orch = makeOrchestrator(rootDir, async () => { throw new Error('partial creds'); });
-    await orch.init();
-    // Spawn still succeeds.
-    const node = await orch.ensureOwnerNode(CFG);
-    expect(node.id).toBe(OWNER_CONTAINER_ID);
-    expect(readChildConfig(rootDir).push).toBeUndefined();
-  });
-
-  it('re-resolves on re-spawn and never persists a raw private key in state.json', async () => {
-    const rootDir = join(tmpRoot, 'e');
-    let current: PushCredentials | undefined = { fcm: FCM };
-    const orch = makeOrchestrator(rootDir, async () => current);
-    await orch.init();
-    await orch.ensureOwnerNode(CFG);
-    expect(readChildConfig(rootDir).push).toEqual({ fcm: FCM });
-
-    // state.json must not carry the raw key — only re-resolvable references.
-    const stateRaw = readFileSync(join(rootDir, 'state.json'), 'utf8');
-    expect(stateRaw).not.toContain('FCM-SECRET-PEM');
-
-    // Rotate the resolver's answer, then restart — the new spawn must pick it up.
-    current = { apns: APNS };
-    await orch.restartOwnerNode();
-    const cfg2 = readChildConfig(rootDir);
-    expect(cfg2.push).toEqual({ apns: APNS });
-    expect((cfg2.push as PushCredentials).fcm).toBeUndefined();
-  });
-
-  it('injects push for a storage-profile managed node but not a transaction node', async () => {
-    const rootDir = join(tmpRoot, 'f');
-    const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM }));
-    await orch.init();
-
-    await orch.createContainer({ containerId: 'storage-1', partyId: 'p', bootstrapNodes: [], profile: 'storage' });
-    expect(readChildConfig(rootDir, 'storage-1').push).toEqual({ fcm: FCM });
-
-    await orch.createContainer({ containerId: 'txn-1', partyId: 'p', bootstrapNodes: [], profile: 'transaction' });
-    expect(readChildConfig(rootDir, 'txn-1').push).toBeUndefined();
-  });
-});
+/**
+ * HostProcessOrchestrator push-credential injection tests.
+ *
+ * Verifies the orchestrator writes `config.push` into the spawned node's
+ * cadre.json when the pushResolver yields credentials, omits it otherwise,
+ * re-resolves on every (re-)spawn, and never persists a raw private key in
+ * state.json. Uses a fake CLI entrypoint that just writes its startup token.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, mkdirSync, rmSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { PushCredentials } from '@serfab/cadre-core';
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+import { removeAllNodes } from './orchestrator-teardown.js';
+
+const FAKE_CLI = `
+import fs from 'node:fs';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath && token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-SECRET-PEM' };
+const APNS = { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'APNS-SECRET-P8', production: false };
+/** A storage node — the one profile whose spawn carries push. */
+const NODE = { containerId: 'n1', partyId: 'p', bootstrapNodes: [], profile: 'storage' as const };
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-push-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+});
+
+afterEach(async () => {
+  try {
+    await removeAllNodes(orchestrators);
+  } finally {
+    await sleep(50);
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  }
+});
+
+function makeOrchestrator(rootDir: string, pushResolver?: () => Promise<PushCredentials | undefined>): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18000, end: 18499 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+    ...(pushResolver ? { pushResolver } : {}),
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+function readChildConfig(rootDir: string, containerId = NODE.containerId): Record<string, unknown> {
+  const raw = readFileSync(join(rootDir, containerId, 'cadre.json'), 'utf8');
+  return JSON.parse(raw) as Record<string, unknown>;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator push injection', () => {
+  it('omits config.push when no resolver is configured', async () => {
+    const rootDir = join(tmpRoot, 'b');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+    await orch.createContainer(NODE);
+
+    const cfg = readChildConfig(rootDir);
+    expect(cfg.push).toBeUndefined();
+  });
+
+  it('omits config.push when the resolver returns undefined (push opt-in)', async () => {
+    const rootDir = join(tmpRoot, 'c');
+    const orch = makeOrchestrator(rootDir, async () => undefined);
+    await orch.init();
+    await orch.createContainer(NODE);
+
+    expect(readChildConfig(rootDir).push).toBeUndefined();
+  });
+
+  it('degrades to no push (does not fail the spawn) when the resolver throws', async () => {
+    const rootDir = join(tmpRoot, 'd');
+    const orch = makeOrchestrator(rootDir, async () => { throw new Error('partial creds'); });
+    await orch.init();
+    // Spawn still succeeds.
+    const created = await orch.createContainer(NODE);
+    expect(orch.getNode(created.dockerId)?.status).toBe('running');
+    expect(readChildConfig(rootDir).push).toBeUndefined();
+  });
+
+  it('re-resolves on re-spawn and never persists a raw private key in state.json', async () => {
+    const rootDir = join(tmpRoot, 'e');
+    let current: PushCredentials | undefined = { fcm: FCM };
+    const orch = makeOrchestrator(rootDir, async () => current);
+    await orch.init();
+    const first = await orch.createContainer(NODE);
+    expect(readChildConfig(rootDir).push).toEqual({ fcm: FCM });
+
+    // state.json must not carry the raw key — only re-resolvable references.
+    const stateRaw = readFileSync(join(rootDir, 'state.json'), 'utf8');
+    expect(stateRaw).not.toContain('FCM-SECRET-PEM');
+
+    // Rotate the resolver's answer, then re-spawn — the new spawn must pick it up.
+    current = { apns: APNS };
+    await orch.stopContainer(first.dockerId);
+    await orch.createContainer(NODE);
+    const cfg2 = readChildConfig(rootDir);
+    expect(cfg2.push).toEqual({ apns: APNS });
+    expect((cfg2.push as PushCredentials).fcm).toBeUndefined();
+  });
+
+  it('injects push for a storage-profile managed node but not a transaction node', async () => {
+    const rootDir = join(tmpRoot, 'f');
+    const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM, apns: APNS, cooldownMs: 1000 }));
+    await orch.init();
+
+    await orch.createContainer({ containerId: 'storage-1', partyId: 'p', bootstrapNodes: [], profile: 'storage' });
+    expect(readChildConfig(rootDir, 'storage-1').push).toEqual({ fcm: FCM, apns: APNS, cooldownMs: 1000 });
+
+    await orch.createContainer({ containerId: 'txn-1', partyId: 'p', bootstrapNodes: [], profile: 'transaction' });
+    expect(readChildConfig(rootDir, 'txn-1').push).toBeUndefined();
+  });
+});