@serfab/cadre-host 1.13.0 → 1.15.0

package/dist/ui/assets/index-TtIYSeZO.css

@@ -1 +0,0 @@
-.dot.svelte-1qa2kn2{display:inline-flex;align-items:center;gap:.5rem;font-weight:500}.bulb.svelte-1qa2kn2{display:inline-block;border-radius:999px;flex:0 0 auto;background:var(--color-text-soft);box-shadow:0 0 0 3px #0000000f}.dot-ok.svelte-1qa2kn2 .bulb:where(.svelte-1qa2kn2){background:var(--color-success);box-shadow:0 0 0 3px var(--color-success-bg)}.dot-warn.svelte-1qa2kn2 .bulb:where(.svelte-1qa2kn2){background:var(--color-warn);box-shadow:0 0 0 3px var(--color-warn-bg)}.dot-err.svelte-1qa2kn2 .bulb:where(.svelte-1qa2kn2){background:var(--color-danger);box-shadow:0 0 0 3px var(--color-danger-bg)}.dot-muted.svelte-1qa2kn2 .bulb:where(.svelte-1qa2kn2){background:var(--color-text-soft)}.dot-ok.svelte-1qa2kn2{color:var(--color-success)}.dot-warn.svelte-1qa2kn2{color:var(--color-warn)}.dot-err.svelte-1qa2kn2{color:var(--color-danger)}.row.svelte-lwwmgz{display:inline-flex;gap:.4rem;flex-wrap:wrap}.banner.svelte-15mtls8{display:flex;align-items:center;justify-content:space-between;gap:var(--space-3);padding:var(--space-3) var(--space-4);border-radius:var(--radius);background:var(--color-info-bg);color:var(--color-info);border:1px solid var(--color-info)}.summary.svelte-15mtls8{grid-template-columns:repeat(auto-fit,minmax(15rem,1fr))}.kv.svelte-15mtls8{margin:var(--space-3) 0 0 0;display:grid;grid-template-columns:max-content 1fr;gap:var(--space-1) var(--space-3);font-size:.9rem}.kv.svelte-15mtls8>div:where(.svelte-15mtls8){display:contents}.kv.svelte-15mtls8 dt:where(.svelte-15mtls8){color:var(--color-text-muted)}.kv.svelte-15mtls8 dd:where(.svelte-15mtls8){margin:0}.big.svelte-15mtls8{font-size:1.75rem;font-weight:600;margin:var(--space-2) 0}.big.svelte-15mtls8 .muted:where(.svelte-15mtls8){font-size:.95rem;font-weight:400}.link.svelte-15mtls8{display:inline-block;margin-top:var(--space-2);font-weight:500}.backdrop.svelte-80vbit{position:fixed;inset:0;background:#0f111673;z-index:1000}.dialog.svelte-80vbit{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);background:var(--color-surface);border:1px solid var(--color-border);border-radius:var(--radius-lg);box-shadow:var(--shadow-lg);padding:var(--space-5);min-width:min(24rem,calc(100vw - 2rem));max-width:min(32rem,calc(100vw - 2rem));overflow-wrap:anywhere;z-index:1010}.note.svelte-80vbit{background:var(--color-warn-bg);color:var(--color-warn);border-radius:var(--radius);padding:var(--space-2) var(--space-3);font-size:.9rem}.gate.svelte-80vbit{margin-top:var(--space-3);overflow-wrap:anywhere}.actions.svelte-80vbit{display:flex;justify-content:flex-end;gap:.5rem;margin-top:var(--space-4)}.qr.svelte-1uqetyj{background:#fff;border-radius:var(--radius);padding:.5rem;display:inline-block;line-height:0}.qr.svelte-1uqetyj svg{width:100%;height:100%;display:block}.placeholder.svelte-1uqetyj{background:var(--color-surface-alt)}.qr-wrap.svelte-sddtr9{display:flex;justify-content:center;margin:var(--space-3) 0}.token.svelte-sddtr9{display:flex;flex-direction:column;gap:.5rem}.token.svelte-sddtr9 textarea:where(.svelte-sddtr9){font-family:var(--font-mono);font-size:.78rem;word-break:break-all;resize:vertical}.token.svelte-sddtr9 button:where(.svelte-sddtr9){align-self:flex-end;display:inline-flex;align-items:center;gap:.375rem}.backdrop.svelte-1d46kin{position:fixed;inset:0;background:#0f111673;z-index:1000}.dialog.svelte-1d46kin{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);background:var(--color-surface);border:1px solid var(--color-border);border-radius:var(--radius-lg);box-shadow:var(--shadow-lg);padding:var(--space-5);width:min(28rem,calc(100vw - 2rem));max-height:calc(100vh - 2rem);overflow:auto;z-index:1010}.actions.svelte-1d46kin{display:flex;justify-content:flex-end;gap:.5rem;margin-top:var(--space-4)}.small.svelte-1d46kin{font-size:.85rem}.page-header.svelte-3alf51{display:flex;align-items:flex-end;justify-content:space-between;flex-wrap:wrap;gap:var(--space-3)}.list.svelte-3alf51{list-style:none;padding:0;margin:var(--space-3) 0 0 0;display:flex;flex-direction:column;gap:.5rem}.list.svelte-3alf51 li:where(.svelte-3alf51){display:flex;align-items:center;justify-content:space-between;gap:var(--space-3);padding:var(--space-3);border:1px solid var(--color-border);border-radius:var(--radius);background:var(--color-surface-alt)}.member-main.svelte-3alf51{display:flex;flex-direction:column;gap:.125rem;min-width:0}.member-label.svelte-3alf51{font-weight:500}.small.svelte-3alf51{font-size:.85rem}.grid.two.svelte-hh3bto{grid-template-columns:repeat(auto-fit,minmax(20rem,1fr))}.kv.svelte-hh3bto{margin:var(--space-3) 0;display:grid;grid-template-columns:max-content 1fr;gap:var(--space-1) var(--space-3);font-size:.9rem}.kv.svelte-hh3bto>div:where(.svelte-hh3bto){display:contents}.kv.svelte-hh3bto dt:where(.svelte-hh3bto){color:var(--color-text-muted)}.kv.svelte-hh3bto dd:where(.svelte-hh3bto){margin:0}.row.inline.svelte-hh3bto{gap:.5rem}.row.inline.svelte-hh3bto input[type=checkbox]:where(.svelte-hh3bto){width:auto}.warning.svelte-hh3bto{background:var(--color-warn-bg);border-color:var(--color-warn)}.warning.svelte-hh3bto ul:where(.svelte-hh3bto){margin:0;padding-left:1.25rem}.actions.svelte-hh3bto{display:flex;justify-content:flex-end;gap:.5rem}.small.svelte-hh3bto{font-size:.85rem}table.svelte-7tcksg{width:100%;border-collapse:collapse;font-size:.92rem}th.svelte-7tcksg,td.svelte-7tcksg{padding:.5rem .75rem;text-align:left;border-bottom:1px solid var(--color-border)}th.svelte-7tcksg{font-weight:600;font-size:.78rem;text-transform:uppercase;letter-spacing:.05em;color:var(--color-text-muted);border-bottom-color:var(--color-border-strong)}tr.svelte-7tcksg:last-child td:where(.svelte-7tcksg){border-bottom:none}.log-card.svelte-15ufwrh{display:flex;flex-direction:column;gap:var(--space-3)}.header.svelte-15ufwrh{display:flex;align-items:center;justify-content:space-between;gap:var(--space-3)}.logs.svelte-15ufwrh{max-height:24rem;font-size:.78rem;line-height:1.45;white-space:pre}.small.svelte-15ufwrh{font-size:.85rem}button.svelte-15ufwrh{display:inline-flex;align-items:center;gap:.375rem}.back.svelte-1eq4g96{font-size:.92rem}.page-header.svelte-1eq4g96{display:flex;align-items:flex-start;justify-content:space-between;flex-wrap:wrap;gap:var(--space-3)}.kv.svelte-1eq4g96{margin:var(--space-3) 0;display:grid;grid-template-columns:max-content 1fr;gap:var(--space-1) var(--space-3);font-size:.92rem}.kv.svelte-1eq4g96>div:where(.svelte-1eq4g96){display:contents}.kv.svelte-1eq4g96 dt:where(.svelte-1eq4g96){color:var(--color-text-muted)}.kv.svelte-1eq4g96 dd:where(.svelte-1eq4g96){margin:0}.actions.svelte-1eq4g96{display:flex;gap:.5rem;flex-wrap:wrap}.row.inline.svelte-1cl3wo6{gap:.5rem}.row.inline.svelte-1cl3wo6 input[type=checkbox]:where(.svelte-1cl3wo6){width:auto}.banner.svelte-1cl3wo6{display:flex;align-items:center;justify-content:space-between;gap:var(--space-3);padding:var(--space-3);border-radius:var(--radius);background:var(--color-info-bg);color:var(--color-info);border:1px solid var(--color-info);flex-wrap:wrap}.kv.svelte-1cl3wo6{margin:var(--space-3) 0;display:grid;grid-template-columns:max-content 1fr;gap:var(--space-1) var(--space-3);font-size:.92rem}.kv.svelte-1cl3wo6>div:where(.svelte-1cl3wo6){display:contents}.kv.svelte-1cl3wo6 dt:where(.svelte-1cl3wo6){color:var(--color-text-muted)}.kv.svelte-1cl3wo6 dd:where(.svelte-1cl3wo6){margin:0}.copy-row.svelte-1cl3wo6{display:flex;align-items:center;gap:.375rem}.actions.svelte-1cl3wo6{display:flex;justify-content:flex-end}.small.svelte-1cl3wo6{font-size:.85rem}.error.svelte-1cl3wo6{color:var(--color-danger)}.list.svelte-ngb3vw{list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:.5rem}.list.svelte-ngb3vw li:where(.svelte-ngb3vw){display:flex;align-items:center;justify-content:space-between;gap:var(--space-3);padding:var(--space-3);border:1px solid var(--color-border);border-radius:var(--radius);background:var(--color-surface-alt)}.strand-main.svelte-ngb3vw{display:flex;flex-direction:column;gap:.25rem;min-width:0}.strand-id.svelte-ngb3vw{overflow-wrap:anywhere;user-select:text}.error.svelte-ngb3vw{color:var(--color-danger)}.meta.svelte-ngb3vw{gap:.5rem}.small.svelte-ngb3vw{font-size:.85rem}.warning.svelte-ngb3vw{background:var(--color-warn-bg);border-color:var(--color-warn)}.warning.svelte-ngb3vw code:where(.svelte-ngb3vw){overflow-wrap:anywhere}.actions.svelte-ngb3vw{display:flex;justify-content:flex-end;gap:.5rem}.backdrop.svelte-1gylbi3{position:fixed;inset:0;background:#0f111673;z-index:1000}.dialog.svelte-1gylbi3{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);background:var(--color-surface);border:1px solid var(--color-border);border-radius:var(--radius-lg);box-shadow:var(--shadow-lg);padding:var(--space-5);width:min(28rem,calc(100vw - 2rem));max-height:calc(100vh - 2rem);overflow:auto;overflow-wrap:anywhere;z-index:1010}.actions.svelte-1gylbi3{display:flex;justify-content:flex-end;gap:.5rem;margin-top:var(--space-4)}.small.svelte-1gylbi3{font-size:.85rem}.page-header.svelte-1jncsno{display:flex;align-items:flex-end;justify-content:space-between;flex-wrap:wrap;gap:var(--space-3)}.list.svelte-1jncsno{list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:.5rem}.list.svelte-1jncsno>li:where(.svelte-1jncsno){display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:var(--space-3);padding:var(--space-3);border:1px solid var(--color-border);border-radius:var(--radius);background:var(--color-surface-alt)}.grant-main.svelte-1jncsno{display:flex;flex-direction:column;gap:.25rem;min-width:0;overflow-wrap:anywhere}.grant-label.svelte-1jncsno{font-weight:500}.meta.svelte-1jncsno{gap:.5rem}.donations.svelte-1jncsno{list-style:none;padding:0;margin:.25rem 0 0;display:flex;flex-direction:column;gap:.125rem}.donations.svelte-1jncsno li:where(.svelte-1jncsno){display:flex;flex-wrap:wrap;gap:.5rem}.actions.svelte-1jncsno{display:flex;gap:.5rem}.keep.svelte-1jncsno{display:flex;align-items:center;gap:.5rem;margin-top:var(--space-3);font-size:.9rem;font-weight:400;color:var(--color-text)}.error.svelte-1jncsno{color:var(--color-danger)}.small.svelte-1jncsno{font-size:.85rem}.toast-stack.svelte-g7yjw8{position:fixed;right:1rem;bottom:1rem;display:flex;flex-direction:column;gap:.5rem;max-width:min(30rem,calc(100vw - 2rem));z-index:1100}.toast.svelte-g7yjw8{background:var(--color-surface);color:var(--color-text);border:1px solid var(--color-border-strong);border-radius:var(--radius);padding:.625rem .75rem;display:flex;align-items:center;gap:.5rem;box-shadow:var(--shadow);font-size:.92rem}.toast-error.svelte-g7yjw8{border-color:var(--color-danger);background:var(--color-danger-bg);color:var(--color-danger)}.toast-success.svelte-g7yjw8{border-color:var(--color-success);background:var(--color-success-bg);color:var(--color-success)}.text.svelte-g7yjw8{flex:1 1 auto}button.svelte-g7yjw8{font-size:1.1rem;line-height:1;padding:.125rem .5rem;color:currentColor}.topbar.svelte-1r8vfx3{position:sticky;top:0;z-index:10;display:flex;align-items:center;justify-content:space-between;gap:var(--space-4);padding:var(--space-3) var(--space-5);background:var(--color-surface);border-bottom:1px solid var(--color-border);backdrop-filter:saturate(180%) blur(8px)}.brand.svelte-1r8vfx3{display:flex;align-items:center;gap:.6rem;font-weight:600}.logo.svelte-1r8vfx3{color:var(--color-accent);font-size:1.1rem}nav.svelte-1r8vfx3{display:flex;gap:.125rem}nav.svelte-1r8vfx3 a:where(.svelte-1r8vfx3){font-size:.92rem;color:var(--color-text-muted);padding:.375rem .75rem;border-radius:var(--radius);text-decoration:none}nav.svelte-1r8vfx3 a:where(.svelte-1r8vfx3):hover{background:var(--color-surface-alt);color:var(--color-text)}nav.svelte-1r8vfx3 a.active:where(.svelte-1r8vfx3){color:var(--color-accent-on);background:var(--color-accent)}main.svelte-1r8vfx3{flex:1 1 auto;width:min(64rem,100%);margin:0 auto;padding:var(--space-5)}@media(max-width:640px){.topbar.svelte-1r8vfx3{flex-direction:column;align-items:flex-start;gap:var(--space-2);padding:var(--space-2) var(--space-3)}nav.svelte-1r8vfx3{width:100%;overflow-x:auto}main.svelte-1r8vfx3{padding:var(--space-3)}}:root{color-scheme:light dark;--font-sans: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;--font-mono: ui-monospace, "SF Mono", "Cascadia Code", "Roboto Mono", Menlo, monospace;--radius-sm: .25rem;--radius: .5rem;--radius-lg: .75rem;--space-1: .25rem;--space-2: .5rem;--space-3: .75rem;--space-4: 1rem;--space-5: 1.5rem;--space-6: 2rem;--space-7: 3rem;--color-bg: #f7f8fa;--color-surface: #ffffff;--color-surface-alt: #f0f2f6;--color-border: #d9dde3;--color-border-strong: #b8bec7;--color-text: #1d1f24;--color-text-muted: #5b626d;--color-text-soft: #8a8f99;--color-accent: #1d4ed8;--color-accent-strong: #1e3a8a;--color-accent-on: #ffffff;--color-accent-soft: #e0e7ff;--color-success: #15803d;--color-success-bg: #dcfce7;--color-warn: #b45309;--color-warn-bg: #fef3c7;--color-danger: #b91c1c;--color-danger-bg: #fee2e2;--color-info: #1d4ed8;--color-info-bg: #dbeafe;--shadow-sm: 0 1px 2px rgba(15, 23, 42, .05);--shadow: 0 4px 12px rgba(15, 23, 42, .08);--shadow-lg: 0 12px 32px rgba(15, 23, 42, .16)}@media(prefers-color-scheme:dark){:root{--color-bg: #0f1116;--color-surface: #181b22;--color-surface-alt: #20242d;--color-border: #2c313c;--color-border-strong: #3b424f;--color-text: #e8eaf0;--color-text-muted: #a4abb8;--color-text-soft: #777e8b;--color-accent: #93c5fd;--color-accent-strong: #bfdbfe;--color-accent-on: #0f1116;--color-accent-soft: #1e293b;--color-success: #4ade80;--color-success-bg: #14532d;--color-warn: #fbbf24;--color-warn-bg: #78350f;--color-danger: #f87171;--color-danger-bg: #7f1d1d;--color-info: #93c5fd;--color-info-bg: #1e3a8a;--shadow-sm: 0 1px 2px rgba(0, 0, 0, .4);--shadow: 0 4px 12px rgba(0, 0, 0, .45);--shadow-lg: 0 12px 32px rgba(0, 0, 0, .6)}}*,*:before,*:after{box-sizing:border-box}html,body{margin:0;padding:0;background:var(--color-bg);color:var(--color-text);font-family:var(--font-sans);font-size:15px;line-height:1.5;-webkit-font-smoothing:antialiased;min-height:100vh}#app{min-height:100vh;display:flex;flex-direction:column}h1,h2,h3,h4,h5,h6{margin:0 0 var(--space-2) 0;font-weight:600;line-height:1.25;letter-spacing:-.01em}h1{font-size:1.5rem}h2{font-size:1.25rem}h3{font-size:1.05rem}p{margin:0 0 var(--space-3) 0}a{color:var(--color-accent);text-decoration:none}a:hover{text-decoration:underline}button{font:inherit;cursor:pointer;border:1px solid var(--color-border-strong);background:var(--color-surface);color:var(--color-text);padding:var(--space-2) var(--space-3);border-radius:var(--radius);transition:background-color .12s ease,border-color .12s ease}button:hover:not(:disabled){background:var(--color-surface-alt);border-color:var(--color-text-muted)}button:focus-visible,a:focus-visible,input:focus-visible,select:focus-visible,textarea:focus-visible{outline:2px solid var(--color-accent);outline-offset:2px}button:disabled{opacity:.55;cursor:not-allowed}button.primary{background:var(--color-accent);border-color:var(--color-accent);color:var(--color-accent-on)}button.primary:hover:not(:disabled){background:var(--color-accent-strong);border-color:var(--color-accent-strong)}button.danger{background:var(--color-danger);border-color:var(--color-danger);color:#fff}button.ghost{background:transparent;border-color:transparent;color:var(--color-text-muted);padding:var(--space-1) var(--space-2)}button.ghost:hover:not(:disabled){color:var(--color-text);background:var(--color-surface-alt)}input[type=text],input[type=url],input[type=number],input[type=password],select,textarea{font:inherit;color:var(--color-text);background:var(--color-surface);border:1px solid var(--color-border-strong);border-radius:var(--radius);padding:var(--space-2) var(--space-3);width:100%}label{display:block;font-size:.85rem;color:var(--color-text-muted);font-weight:500;margin-bottom:var(--space-1)}code,pre{font-family:var(--font-mono);font-size:.85rem}pre{background:var(--color-surface-alt);padding:var(--space-3);border-radius:var(--radius);overflow:auto;margin:0}hr{border:none;border-top:1px solid var(--color-border);margin:var(--space-5) 0}.card{background:var(--color-surface);border:1px solid var(--color-border);border-radius:var(--radius-lg);padding:var(--space-5);box-shadow:var(--shadow-sm)}.muted{color:var(--color-text-muted)}.row{display:flex;gap:var(--space-3);align-items:center;flex-wrap:wrap}.stack{display:flex;flex-direction:column;gap:var(--space-3)}.grid{display:grid;gap:var(--space-4)}.badge{display:inline-flex;align-items:center;gap:var(--space-1);font-size:.78rem;font-weight:600;letter-spacing:.02em;text-transform:uppercase;padding:.125rem .5rem;border-radius:999px;background:var(--color-surface-alt);color:var(--color-text-muted)}.badge.ok{background:var(--color-success-bg);color:var(--color-success)}.badge.warn{background:var(--color-warn-bg);color:var(--color-warn)}.badge.err{background:var(--color-danger-bg);color:var(--color-danger)}.badge.info{background:var(--color-info-bg);color:var(--color-info)}.visually-hidden{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}

package/src/__tests__/cli-invite.smoke.test.ts

@@ -1,192 +0,0 @@
-/**
- * CLI smoke test for the `invite` subcommand. Spawns a stub HTTP server
- * playing the role of cadre-host's management API and asserts the CLI:
- *   - POSTs the expected body to /auth/invites
- *   - Prints the encodedInvite on stdout
- *   - Exits 0 on success / non-zero on connect failure
- *
- * Relies on `yarn build` having produced dist/bin/host.js.
- */
-
-import { spawn } from 'node:child_process';
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
-import { existsSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, resolve } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-const here = dirname(fileURLToPath(import.meta.url));
-const binPath = resolve(here, '../../dist/bin/host.js');
-
-// These smoke tests cold-start the built CLI as a child process (Node boot +,
-// for some, an HTTP server). That comfortably exceeds vitest's 5s default under
-// heavy parallel load, so give the subprocess generous headroom.
-vi.setConfig({ testTimeout: 30000 });
-
-interface StubServer {
-  server: Server;
-  port: number;
-  requests: Array<{ method: string; url: string; body: string }>;
-  setResponse(handler: (req: IncomingMessage, res: ServerResponse) => void): void;
-}
-
-async function startStub(): Promise<StubServer> {
-  const requests: StubServer['requests'] = [];
-  let handler: (req: IncomingMessage, res: ServerResponse) => void = (_req, res) => {
-    res.statusCode = 200;
-    res.setHeader('content-type', 'application/json');
-    res.end(JSON.stringify({
-      encodedInvite: 'fake-encoded-invite',
-      token: 'fake-token',
-      expiresAt: new Date(Date.now() + 60_000).toISOString(),
-    }));
-  };
-
-  const server = createServer((req, res) => {
-    const chunks: Buffer[] = [];
-    req.on('data', (chunk: Buffer) => chunks.push(chunk));
-    req.on('end', () => {
-      requests.push({ method: req.method ?? '', url: req.url ?? '', body: Buffer.concat(chunks).toString('utf8') });
-      handler(req, res);
-    });
-  });
-
-  await new Promise<void>((resolveStart) => server.listen(0, '127.0.0.1', () => resolveStart()));
-  const addr = server.address();
-  const port = typeof addr === 'object' && addr ? addr.port : 0;
-  return {
-    server,
-    port,
-    requests,
-    setResponse: (h) => { handler = h; },
-  };
-}
-
-function runCli(args: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
-  return new Promise((resolveRun) => {
-    const child = spawn(process.execPath, [binPath, ...args], { stdio: ['ignore', 'pipe', 'pipe'] });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', (chunk: Buffer) => { stdout += chunk.toString('utf8'); });
-    child.stderr.on('data', (chunk: Buffer) => { stderr += chunk.toString('utf8'); });
-    child.on('close', (code) => resolveRun({ code: code ?? -1, stdout, stderr }));
-  });
-}
-
-let stub: StubServer;
-
-beforeEach(async () => {
-  if (!existsSync(binPath)) {
-    throw new Error(`cadre-host bin not built at ${binPath}; run \`yarn build\` first`);
-  }
-  stub = await startStub();
-});
-
-afterEach(async () => {
-  await new Promise<void>((resolveClose) => stub.server.close(() => resolveClose()));
-});
-
-describe('cadre-host invite CLI', () => {
-  it('POSTs to /auth/invites with label + ttlMs and prints encoded invite', async () => {
-    const result = await runCli(['invite', "Mom's phone", '--ttl', '12h', '--port', String(stub.port)]);
-
-    expect(result.code).toBe(0);
-    expect(result.stdout.trim()).toBe('fake-encoded-invite');
-    expect(stub.requests).toHaveLength(1);
-    expect(stub.requests[0]!.method).toBe('POST');
-    expect(stub.requests[0]!.url).toBe('/auth/invites');
-    const body = JSON.parse(stub.requests[0]!.body);
-    expect(body.label).toBe("Mom's phone");
-    expect(body.ttlMs).toBe(12 * 60 * 60 * 1000);
-  });
-
-  it('exits non-zero when cadre-host returns an error', async () => {
-    stub.setResponse((_req, res) => {
-      res.statusCode = 500;
-      res.end('boom');
-    });
-    const result = await runCli(['invite', 'Test', '--port', String(stub.port)]);
-    expect(result.code).not.toBe(0);
-    expect(result.stderr).toContain('500');
-  });
-
-  it('exits 2 (no service) when cadre-host is not reachable', async () => {
-    // Use a port the stub server occupied; close it first so connections fail.
-    const port = stub.port;
-    await new Promise<void>((resolveClose) => stub.server.close(() => resolveClose()));
-    const result = await runCli(['invite', 'Test', '--port', String(port)]);
-    expect(result.code).toBe(2);
-    expect(result.stderr).toMatch(/cadre-host start|Failed to reach/);
-  });
-
-  it('rejects invalid --ttl', async () => {
-    const result = await runCli(['invite', 'Test', '--ttl', 'eternity', '--port', String(stub.port)]);
-    expect(result.code).toBe(1);
-    expect(result.stderr).toMatch(/Invalid --ttl/);
-  });
-});
-
-describe('cadre-host trust list CLI', () => {
-  it('renders members and pending invites', async () => {
-    stub.setResponse((_req, res) => {
-      res.statusCode = 200;
-      res.setHeader('content-type', 'application/json');
-      res.end(JSON.stringify({
-        members: [
-          { peerId: '12D3KooWAlice', label: 'Alice', addedAt: 't1' },
-          { peerId: '12D3KooWHost', label: 'Host', addedAt: 't2', self: true },
-        ],
-        pending: [
-          { token: 'tok1', label: 'Mom', createdAt: 't3', expiresAt: 't4' },
-        ],
-      }));
-    });
-
-    const result = await runCli(['trust', 'list', '--port', String(stub.port)]);
-    expect(result.code).toBe(0);
-    expect(result.stdout).toContain('12D3KooWAlice');
-    expect(result.stdout).toContain('Alice');
-    expect(result.stdout).toContain('[self]');
-    expect(result.stdout).toContain('tok1');
-    expect(result.stdout).toContain('Mom');
-  });
-});
-
-describe('cadre-host trust revoke CLI', () => {
-  it('DELETEs /auth/invites/<token> by default', async () => {
-    stub.setResponse((_req, res) => {
-      res.statusCode = 204;
-      res.end();
-    });
-    const result = await runCli(['trust', 'revoke', 'some-token', '--port', String(stub.port)]);
-    expect(result.code).toBe(0);
-    expect(stub.requests[0]!.method).toBe('DELETE');
-    expect(stub.requests[0]!.url).toBe('/auth/invites/some-token');
-  });
-
-  it('DELETEs /auth/members/<peerId> when id looks like a peerId', async () => {
-    stub.setResponse((_req, res) => {
-      res.statusCode = 204;
-      res.end();
-    });
-    const result = await runCli(['trust', 'revoke', '12D3KooWAlice', '--port', String(stub.port)]);
-    expect(result.code).toBe(0);
-    expect(stub.requests[0]!.url).toBe('/auth/members/12D3KooWAlice');
-  });
-
-  it('treats secp256k1 peer IDs (16Uiu2HAm…) as members', async () => {
-    stub.setResponse((_req, res) => {
-      res.statusCode = 204;
-      res.end();
-    });
-    const result = await runCli(['trust', 'revoke', '16Uiu2HAmExample', '--port', String(stub.port)]);
-    expect(result.code).toBe(0);
-    expect(stub.requests[0]!.url).toBe('/auth/members/16Uiu2HAmExample');
-  });
-
-  it('rejects invalid --port', async () => {
-    const result = await runCli(['trust', 'revoke', 'some-token', '--port', 'garbage']);
-    expect(result.code).toBe(1);
-    expect(result.stderr).toMatch(/Invalid --port/);
-  });
-});

package/src/__tests__/host-owner.smoke.test.ts

@@ -1,123 +0,0 @@
-/**
- * Server-level smoke: the /auth/* HTTP contract over the owner-node
- * channel adapter. Validates the two behaviours the realignment must
- * preserve:
- *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
- *   2. With the node refusing connections, GET /auth/trust-circle still lists
- *      local labels, and POST /auth/invites returns 503 (not a raw 500).
- *
- * The owner node is represented by a stub HTTP server matching the 6.6
- * admin contract (the spawn path itself is covered by
- * orchestrator-owner.test.ts).
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import Fastify from 'fastify';
-import http from 'node:http';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
-import { OwnerNodeClient } from '../owner/index.js';
-import { registerErrorHandler } from '../server/error-handler.js';
-import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
-import { EventBus } from '../server/events/bus.js';
-
-const TOKEN = 'tok';
-
-let tmpRoot: string;
-beforeEach(() => { tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-smoke-')); });
-afterEach(() => { try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ } });
-
-function buildApp(service: TrustCircleService) {
-  const app = Fastify();
-  registerErrorHandler(app);
-  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(service), events: new EventBus() });
-  return app;
-}
-
-describe('host /auth delegation — node up', () => {
-  let server: http.Server;
-  let baseUrl: string;
-
-  beforeEach(async () => {
-    server = http.createServer((req, res) => {
-      const chunks: Buffer[] = [];
-      req.on('data', (c) => chunks.push(c as Buffer));
-      req.on('end', () => {
-        if (req.headers['authorization'] !== `Bearer ${TOKEN}`) {
-          res.writeHead(401); res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'x' } })); return;
-        }
-        if (req.url === '/admin/invites' && req.method === 'POST') {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
-          return;
-        }
-        if (req.url === '/admin/members' && req.method === 'GET') {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { members: [] } }));
-          return;
-        }
-        res.writeHead(400); res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
-      });
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
-    const a = server.address();
-    baseUrl = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
-  });
-
-  afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
-
-  it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
-    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
-    const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
-    const app = buildApp(service);
-    try {
-      const res = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Mom' } });
-      expect(res.statusCode).toBe(200);
-      const body = res.json() as { encodedInvite: string };
-      expect(body.encodedInvite).toBe('ENC');
-    } finally {
-      await app.close();
-    }
-  });
-});
-
-describe('host /auth delegation — node refusing connections', () => {
-  let closedBaseUrl: string;
-
-  beforeEach(async () => {
-    const tmp = http.createServer();
-    const port = await new Promise<number>((resolve) => {
-      tmp.listen(0, '127.0.0.1', () => {
-        const a = tmp.address();
-        resolve(typeof a === 'object' && a ? a.port : 0);
-      });
-    });
-    await new Promise<void>((resolve) => tmp.close(() => resolve()));
-    closedBaseUrl = `http://127.0.0.1:${port}`;
-  });
-
-  it('GET /auth/trust-circle lists local labels and POST /auth/invites returns 503', async () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
-
-    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
-    const service = new TrustCircleService({ cadreNode: client, store });
-    const app = buildApp(service);
-    try {
-      const list = await app.inject({ method: 'GET', url: '/auth/trust-circle' });
-      expect(list.statusCode).toBe(200);
-      const snap = list.json() as { members: Array<{ peerId: string; label: string }> };
-      expect(snap.members.some((m) => m.peerId === '12D3KooWLocal' && m.label === 'My laptop')).toBe(true);
-
-      const invite = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Dad' } });
-      expect(invite.statusCode).toBe(503);
-      const body = invite.json() as { error: { code: string } };
-      expect(body.error.code).toBe('node_unavailable');
-    } finally {
-      await app.close();
-    }
-  });
-});

package/src/__tests__/orchestrator-owner.test.ts

@@ -1,234 +0,0 @@
-/**
- * HostProcessOrchestrator owner-node lifecycle tests.
- *
- * Uses the `spawn.entrypoint` hook with a fake CLI that writes its startup
- * token and binds a minimal `/admin/identity` endpoint on the admin port —
- * enough to validate spawn, idempotency, admin-port allocation/persistence,
- * the end-to-end OwnerNodeClient round-trip, and init() re-attach.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { HostProcessOrchestrator, OWNER_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
-import { StateStore } from '../orchestrator/state-store.js';
-import { isPidAlive } from '../orchestrator/pid-liveness.js';
-import { decodeDockerId } from '../orchestrator/types.js';
-import { OwnerNodeClient } from '../owner/owner-node-client.js';
-import { removeAllNodes } from './orchestrator-teardown.js';
-
-const FAKE_OWNER_CLI = `
-import fs from 'node:fs';
-import http from 'node:http';
-
-const args = process.argv.slice(2);
-const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
-
-const tokenPath = get('--startup-token-file');
-const adminPort = get('--admin-port');
-const token = process.env.CADRE_STARTUP_TOKEN ?? '';
-
-if (tokenPath && token) {
-  try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (err) { console.error('token write failed', err); }
-}
-
-if (adminPort && token) {
-  const server = http.createServer((req, res) => {
-    const auth = req.headers['authorization'];
-    if (auth !== 'Bearer ' + token) {
-      res.writeHead(401, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'bad token' } }));
-      return;
-    }
-    if (req.url === '/admin/identity' && req.method === 'GET') {
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ ok: true, data: { peerId: 'FAKEPEER', partyId: 'fake-party' } }));
-      return;
-    }
-    res.writeHead(400, { 'content-type': 'application/json' });
-    res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
-  });
-  server.listen(parseInt(adminPort, 10), '127.0.0.1', () => {
-    console.log('admin listening on ' + adminPort);
-  });
-}
-
-process.on('SIGTERM', () => process.exit(0));
-console.log('fake owner up');
-setInterval(() => {}, 1 << 30);
-`;
-
-let tmpRoot: string;
-let scriptPath: string;
-const orchestrators: HostProcessOrchestrator[] = [];
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-auth-'));
-  scriptPath = join(tmpRoot, 'fake-owner.mjs');
-  writeFileSync(scriptPath, FAKE_OWNER_CLI, 'utf8');
-});
-
-afterEach(async () => {
-  try {
-    await removeAllNodes(orchestrators);
-  } finally {
-    await sleep(50);
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  }
-});
-
-function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
-  mkdirSync(rootDir, { recursive: true });
-  const orch = new HostProcessOrchestrator({
-    rootDir,
-    portRange: { start: 18500, end: 18999 },
-    stopTimeoutMs: 1500,
-    spawn: { entrypoint: scriptPath },
-  });
-  orchestrators.push(orch);
-  return orch;
-}
-
-async function waitFor(predicate: () => boolean | Promise<boolean>, timeoutMs = 4000, intervalMs = 50): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (await predicate()) return;
-    await sleep(intervalMs);
-  }
-  throw new Error('waitFor: timed out');
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((res) => setTimeout(res, ms));
-}
-
-const CFG = { identityPath: 'C:/fake/identity.key', partyId: 'install-id-123', libp2pPort: 4555 };
-
-describe('HostProcessOrchestrator.ensureOwnerNode', () => {
-  it('spawns the owner node, allocates+persists an admin port', async () => {
-    const orch = makeOrchestrator(join(tmpRoot, 'a'));
-    await orch.init();
-    const node = await orch.ensureOwnerNode(CFG);
-
-    expect(node.id).toBe(OWNER_CONTAINER_ID);
-    expect(node.owner).toBe(true);
-    expect(node.ports.admin).toBeGreaterThanOrEqual(18500);
-    expect(node.ports.p2p).toBe(4555);
-
-    const endpoint = orch.getOwnerAdminEndpoint();
-    expect(endpoint).toBeDefined();
-    expect(endpoint!.baseUrl).toBe(`http://127.0.0.1:${node.ports.admin}`);
-
-    // Persisted with admin port + owner flag + ownerConfig.
-    const persisted = new StateStore(join(tmpRoot, 'a')).load();
-    expect(persisted.ownerConfig).toMatchObject({ partyId: 'install-id-123', libp2pPort: 4555 });
-    const ph = persisted.handles.find((h) => h.containerId === OWNER_CONTAINER_ID);
-    expect(ph?.owner).toBe(true);
-    expect(typeof ph?.ports.admin).toBe('number');
-  });
-
-  it('is idempotent — a second call does not spawn a second child', async () => {
-    const orch = makeOrchestrator(join(tmpRoot, 'b'));
-    await orch.init();
-    const first = await orch.ensureOwnerNode(CFG);
-    await waitFor(() => orch.isRunning(first.dockerId));
-
-    const second = await orch.ensureOwnerNode(CFG);
-    expect(second.dockerId).toBe(first.dockerId);
-    expect(orch.listNodes()).toHaveLength(1);
-  });
-
-  it('the OwnerNodeClient reaches the spawned admin channel', async () => {
-    const orch = makeOrchestrator(join(tmpRoot, 'c'));
-    await orch.init();
-    const node = await orch.ensureOwnerNode(CFG);
-    await waitFor(() => orch.isRunning(node.dockerId));
-
-    const client = new OwnerNodeClient(() => orch.getOwnerAdminEndpoint());
-    await waitFor(async () => {
-      try { return (await client.getPeerId()) === 'FAKEPEER'; } catch { return false; }
-    });
-    expect(await client.getPeerId()).toBe('FAKEPEER');
-  });
-
-  it('getOwnerAdminEndpoint() survives an init() re-attach', async () => {
-    const rootDir = join(tmpRoot, 'd');
-    const a = makeOrchestrator(rootDir);
-    await a.init();
-    const node = await a.ensureOwnerNode(CFG);
-    // Not `a.isRunning`: that answers from the ChildProcess at once, but `b`
-    // below can only recognise the node once it has written its startup token.
-    await waitFor(() => existsSync(join(rootDir, OWNER_CONTAINER_ID, '.startup-token')));
-    const before = a.getOwnerAdminEndpoint();
-
-    const b = makeOrchestrator(rootDir);
-    await b.init();
-    expect(b.isOwnerNode(OWNER_CONTAINER_ID)).toBe(true);
-    expect(b.hasOwnerConfig()).toBe(true);
-    const after = b.getOwnerAdminEndpoint();
-    expect(after).toEqual(before);
-    expect(await b.isRunning(node.dockerId)).toBe(true);
-
-    const { pid } = decodeDockerId(node.dockerId);
-    expect(isPidAlive(pid)).toBe(true);
-  });
-
-  // The owner's own guard arm: its admin channel binds on loopback, so the probe
-  // must check 127.0.0.1 too — the fake owner binds nothing else.
-  it('refuses to re-spawn over a re-attached owner whose admin port is still bound', async () => {
-    const rootDir = join(tmpRoot, 'g');
-    const a = makeOrchestrator(rootDir);
-    await a.init();
-    const node = await a.ensureOwnerNode(CFG);
-    const tokenPath = join(rootDir, OWNER_CONTAINER_ID, '.startup-token');
-    await waitFor(async () => (await a.getLogs(node.dockerId)).includes('admin listening'));
-
-    // Unverified as far as `b` can tell: live pid, token not (yet) matching.
-    writeFileSync(tokenPath, 'not-yet', 'utf8');
-    const b = makeOrchestrator(rootDir);
-    await b.init();
-    expect(await b.isRunning(node.dockerId)).toBe(false);
-
-    await expect(b.ensureOwnerNode(CFG)).rejects.toThrow(
-      new RegExp(`owner may still be running: port ${node.ports.admin} on 127\\.0\\.0\\.1 is unavailable`),
-    );
-    expect(b.listNodes().map((n) => n.dockerId)).toEqual([node.dockerId]);
-    expect(isPidAlive(decodeDockerId(node.dockerId).pid)).toBe(true);
-  });
-
-  it('restartOwnerNode preserves the workdir and re-spawns', async () => {
-    const orch = makeOrchestrator(join(tmpRoot, 'e'));
-    await orch.init();
-    const first = await orch.ensureOwnerNode(CFG);
-    await waitFor(() => orch.isRunning(first.dockerId));
-    const { pid: firstPid } = decodeDockerId(first.dockerId);
-
-    const restarted = await orch.restartOwnerNode();
-    await waitFor(() => orch.isRunning(restarted.dockerId));
-
-    // New child (different pid/token), still exactly one node, workdir reused.
-    expect(restarted.dockerId).not.toBe(first.dockerId);
-    expect(orch.listNodes()).toHaveLength(1);
-    await waitFor(() => !isPidAlive(firstPid));
-  });
-
-  // Like a lent node, the owner node comes back on its previous ports even when lower
-  // ones are free. Only its TCP port differs: the configured libp2pPort wins over the
-  // previous handle's, because the NAT mapping points at the configured one.
-  it('re-spawns on its previous ports, taking p2p from the current config', async () => {
-    const orch = makeOrchestrator(join(tmpRoot, 'f'));
-    await orch.init();
-    const lower = await orch.createContainer({ containerId: 'c0', partyId: 'party-c0', bootstrapNodes: [], profile: 'transaction' });
-    const first = await orch.ensureOwnerNode(CFG);
-    await waitFor(() => orch.isRunning(first.dockerId));
-
-    await orch.removeContainer(lower.dockerId);
-    await orch.stopOwnerNode();
-    const respawned = await orch.ensureOwnerNode({ ...CFG, libp2pPort: 4556 });
-
-    expect(respawned.dockerId).not.toBe(first.dockerId);
-    expect(respawned.ports).toEqual({ ...first.ports, p2p: 4556 });
-  });
-});