@serfab/cadre-host 1.13.0 → 1.15.0

package/src/server/__tests__/grants-route.test.ts

@@ -1,394 +0,0 @@
-/**
- * Grantee-facing `/grants` route tests — the bearer-gated provisioning surface.
- *
- * Uses a fake orchestrator (no real children) so the focus is the HTTP contract:
- * bearer auth, request validation, per-grant ownership isolation, the quota gate,
- * and seedToken redaction. The live-node round-trips (peer/seed) are covered by
- * the cross-package integration scenario.
- */
-
-import type { FastifyInstance } from 'fastify';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import type {
-  Orchestrator,
-  OrchestratorCreateRequest,
-  OrchestratorCreateResult,
-  OrchestratorStats,
-} from '@serfab/cadre-provider';
-
-import { registerErrorHandler } from '../error-handler.js';
-import { registerGrantsRoutes } from '../routes/grants.js';
-import { buildFastify } from '../server.js';
-import { DonationService } from '../../donation/donation-service.js';
-import { DonationStore } from '../../donation/donation-store.js';
-import { GrantService } from '../../donation/grant-service.js';
-import { GrantStore } from '../../donation/grant-store.js';
-
-class FakeOrchestrator implements Orchestrator {
-  stopped: string[] = [];
-  removed: string[] = [];
-  private counter = 0;
-  async createContainer(_request: OrchestratorCreateRequest): Promise<OrchestratorCreateResult> {
-    const n = ++this.counter;
-    return {
-      dockerId: `dock_${n}`,
-      healthEndpoint: `http://127.0.0.1:${9000 + n}/health`,
-      metricsEndpoint: `http://127.0.0.1:${9000 + n}/metrics`,
-      seedEndpoint: `http://127.0.0.1:${9000 + n}/seed`,
-      seedToken: `seed-token-${n}`,
-      p2pPort: 4000 + n,
-    };
-  }
-  async stopContainer(id: string): Promise<void> { this.stopped.push(id); }
-  async removeContainer(id: string): Promise<void> { this.removed.push(id); }
-  async getStats(): Promise<OrchestratorStats> {
-    return { cpuPercent: 0, memoryBytes: 0, networkRxBytes: 0, networkTxBytes: 0 };
-  }
-  async isRunning(): Promise<boolean> { return true; }
-  async getLogs(): Promise<string> { return ''; }
-}
-
-let tmpRoot: string;
-let app: FastifyInstance;
-let grants: GrantService;
-let store: DonationStore;
-let token: string;
-const originalFetch = globalThis.fetch;
-
-/**
- * A well-formed 32-byte base64url owner key. `DonationService.provision`
- * shape-checks the pins, so a placeholder string is a 400 rather than a fixture.
- */
-const OWNER_KEY = Buffer.alloc(32, 7).toString('base64url');
-
-const body = {
-  partyId: 'party-P',
-  bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
-  ownerKeys: [OWNER_KEY],
-};
-
-const bearer = (t: string) => ({ authorization: `Bearer ${t}` });
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-grants-svc-route-'));
-  grants = new GrantService({ store: new GrantStore(join(tmpRoot, 'grants')) });
-  token = grants.issue({ label: 'Alice', maxNodes: 2 }).token;
-  store = new DonationStore(join(tmpRoot, 'donations'));
-  const donations = new DonationService({ orchestrator: new FakeOrchestrator(), grants, store });
-  // The production constructor, so these tests run with the same body parsing.
-  app = buildFastify();
-  registerErrorHandler(app);
-  registerGrantsRoutes(app, { donations, grants });
-});
-
-afterEach(async () => {
-  globalThis.fetch = originalFetch;
-  await app.close();
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-});
-
-describe('POST /grants', () => {
-  it('provisions a donated node → 201, awaiting_seed, seedToken redacted', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    expect(res.statusCode).toBe(201);
-    const donation = (res.json() as { data: { donation: Record<string, unknown> } }).data.donation;
-    expect(donation.status).toBe('awaiting_seed');
-    expect(donation.partyId).toBe('party-P');
-    expect(donation.seedToken).toBeUndefined();
-    expect(donation.seedEndpoint).toBeUndefined();
-  });
-
-  it('rejects a missing bearer → 401', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', payload: body });
-    expect(res.statusCode).toBe(401);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('unauthorized');
-  });
-
-  it('rejects an unknown bearer → 401', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer('nope'), payload: body });
-    expect(res.statusCode).toBe(401);
-  });
-
-  it('rejects a missing partyId → 400 invalid_request', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { bootstrapNodes: body.bootstrapNodes, ownerKeys: body.ownerKeys },
-    });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_request');
-  });
-
-  it('rejects empty ownerKeys → 400 invalid_request', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, ownerKeys: [] },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  // A typo'd pin used to be answered 201 and only fail when the spawned child
-  // tried to decode it at boot — by which point the caller had no way to act on it.
-  it('rejects a malformed ownerKeys entry → 400 invalid_request, naming the bad key', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, ownerKeys: [OWNER_KEY, 'this-is-not-a-key'] },
-    });
-    expect(res.statusCode).toBe(400);
-    const error = (res.json() as { error: { code: string; message: string } }).error;
-    expect(error.code).toBe('invalid_request');
-    expect(error.message).toContain('this-is-not-a-key');
-  });
-
-  // Element types are the route's job: the service's shape check assumes strings,
-  // so a number here would come back as an internal `.trim is not a function`.
-  it('rejects a non-string ownerKeys entry → 400 naming the field, not a decoder error', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, ownerKeys: [42] },
-    });
-    expect(res.statusCode).toBe(400);
-    const error = (res.json() as { error: { code: string; message: string } }).error;
-    expect(error.code).toBe('invalid_request');
-    expect(error.message).toBe('ownerKeys must be an array of strings');
-  });
-
-  // The address rule the whole `bootstrap-node-validation.ts` module exists for,
-  // at the route boundary. Its accept/reject table is pinned in
-  // `bootstrap-node-validation.test.ts`; what matters here is that a bad address
-  // is a 400 naming the entry, and that no child was spawned on the way.
-  it('rejects an unusable bootstrapNodes entry → 400 invalid_request, naming the bad address', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, bootstrapNodes: [...body.bootstrapNodes, 'not-an-address'] },
-    });
-    expect(res.statusCode).toBe(400);
-    const error = (res.json() as { error: { code: string; message: string } }).error;
-    expect(error.code).toBe('invalid_request');
-    expect(error.message).toContain('not-an-address');
-  });
-
-  it('provisions nothing for any of the unusable-address shapes', async () => {
-    const bad: unknown[] = [
-      [42],
-      ['not-an-address'],
-      // Parses, but names no peer: the child would start with zero bootstrap
-      // peers and never reach the requester's cadre.
-      ['/ip4/127.0.0.1/tcp/4001'],
-      // Names a peer id that does not decode: the child dies constructing libp2p.
-      ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooReq'],
-      // Names a decodable peer but no place to dial it: bootstrap keeps it, libp2p
-      // finds no transport for it, and the node is alone just the same.
-      ['/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
-      [''],
-    ];
-    for (const bootstrapNodes of bad) {
-      const res = await app.inject({
-        method: 'POST', url: '/grants', headers: bearer(token),
-        payload: { ...body, bootstrapNodes },
-      });
-      expect(res.statusCode, `expected 400 for ${JSON.stringify(bootstrapNodes)}`).toBe(400);
-    }
-
-    const list = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
-    expect((list.json() as { data: { donations: unknown[] } }).data.donations).toHaveLength(0);
-  });
-
-  // A phone has no address to give, so it sends none and dials the lent node itself:
-  // leaving the field out, or sending an empty list, provisions a node with no
-  // bootstrap peers rather than being rejected.
-  it('provisions with bootstrapNodes absent or empty → 201, recording an empty list', async () => {
-    const { bootstrapNodes: _bootstrapNodes, ...withoutBootstrap } = body;
-    for (const payload of [withoutBootstrap, { ...body, bootstrapNodes: [] }]) {
-      const res = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload });
-      expect(res.statusCode, `expected 201 for ${JSON.stringify(payload)}`).toBe(201);
-      const donation = (res.json() as { data: { donation: { id: string; bootstrapNodes?: string[] } } }).data.donation;
-      expect(donation.bootstrapNodes).toEqual([]);
-      expect(store.get(donation.id)?.bootstrapNodes).toEqual([]);
-    }
-  });
-
-  it('rejects a non-string partyId → 400, rather than stringifying it into the child config', async () => {
-    for (const partyId of [42, { id: 'party-P' }, '   ']) {
-      const res = await app.inject({
-        method: 'POST', url: '/grants', headers: bearer(token),
-        payload: { ...body, partyId },
-      });
-      expect(res.statusCode, `expected 400 for partyId ${JSON.stringify(partyId)}`).toBe(400);
-      expect((res.json() as { error: { message: string } }).error.message).toBe('partyId is required');
-    }
-  });
-
-  it('rejects an unknown profile → 400', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: bearer(token),
-      payload: { ...body, profile: 'archive' },
-    });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { message: string } }).error.message)
-      .toBe('profile must be "storage" or "transaction"');
-  });
-
-  it('enforces the grant quota → 429 quota_exceeded once maxNodes is reached', async () => {
-    const g = grants.issue({ label: 'Bob', maxNodes: 1 }).token;
-    const first = await app.inject({ method: 'POST', url: '/grants', headers: bearer(g), payload: body });
-    expect(first.statusCode).toBe(201);
-    const second = await app.inject({ method: 'POST', url: '/grants', headers: bearer(g), payload: body });
-    expect(second.statusCode).toBe(429);
-    expect((second.json() as { error: { code: string } }).error.code).toBe('quota_exceeded');
-  });
-});
-
-describe('GET /grants auth', () => {
-  it('rejects an unknown bearer → 401 unauthorized (code matches the status)', async () => {
-    const res = await app.inject({ method: 'GET', url: '/grants', headers: bearer('nope') });
-    expect(res.statusCode).toBe(401);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('unauthorized');
-  });
-});
-
-describe('GET /grants (ownership isolation)', () => {
-  it('lists only the donations the presented grant authorized', async () => {
-    const other = grants.issue({ label: 'Carol' }).token;
-    await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    await app.inject({ method: 'POST', url: '/grants', headers: bearer(other), payload: body });
-
-    const mine = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
-    const donations = (mine.json() as { data: { donations: Array<{ grantToken: string }> } }).data.donations;
-    expect(donations).toHaveLength(1);
-    expect(donations[0].grantToken).toBe(token);
-  });
-
-  it('a foreign grant cannot read another grant’s donation → 404', async () => {
-    const other = grants.issue({ label: 'Carol' }).token;
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    const mine = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
-    expect(mine.statusCode).toBe(200);
-
-    const foreign = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(other) });
-    expect(foreign.statusCode).toBe(404);
-  });
-});
-
-describe('PUT /grants/:id/seed validation', () => {
-  it('rejects a missing seed body → 400 invalid_request', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-    const res = await app.inject({ method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: {} });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_request');
-  });
-
-  it('answers 409 invalid_state when the loan ends while the seed is in flight', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    // The borrower's DELETE lands inside the seed window: the node accepts the
-    // seed, but by the time it answers the loan is over. The ending wins, so the
-    // route must NOT report a 200 that implies a live, freshly seeded node.
-    globalThis.fetch = (async () => {
-      await app.inject({ method: 'DELETE', url: `/grants/${id}`, headers: bearer(token) });
-      return { ok: true, json: async () => ({ success: true, peersAdded: 2 }) } as unknown as Response;
-    }) as typeof globalThis.fetch;
-
-    const res = await app.inject({
-      method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: { seed: 'encoded-seed' },
-    });
-
-    expect(res.statusCode).toBe(409);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_state');
-    const after = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
-    expect((after.json() as { data: { donation: { status: string } } }).data.donation.status)
-      .toBe('terminated');
-  });
-
-  it('answers 404 not_found when the record vanishes while the seed is in flight', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    // The row is gone by the time the node answers — the other half of the
-    // abandon mapping, which has no status to report.
-    globalThis.fetch = (async () => {
-      store.remove(id);
-      return { ok: true, json: async () => ({ success: true, peersAdded: 2 }) } as unknown as Response;
-    }) as typeof globalThis.fetch;
-
-    const res = await app.inject({
-      method: 'PUT', url: `/grants/${id}/seed`, headers: bearer(token), payload: { seed: 'encoded-seed' },
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
-  });
-});
-
-describe('DELETE /grants/:id', () => {
-  it('terminates a donation and drops it from the live tally', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    const del = await app.inject({ method: 'DELETE', url: `/grants/${id}`, headers: bearer(token) });
-    expect(del.statusCode).toBe(200);
-
-    const one = await app.inject({ method: 'GET', url: `/grants/${id}`, headers: bearer(token) });
-    expect((one.json() as { data: { donation: { status: string } } }).data.donation.status).toBe('terminated');
-  });
-
-  // The phone app sent `content-type: application/json` on its body-less DELETE, and
-  // Fastify's default parser answered 400 FST_ERR_CTP_EMPTY_JSON_BODY — so the loan,
-  // and the host's node, kept running.
-  it('ends the loan when the DELETE declares JSON but sends no body', async () => {
-    const created = await app.inject({ method: 'POST', url: '/grants', headers: bearer(token), payload: body });
-    const id = (created.json() as { data: { donation: { id: string } } }).data.donation.id;
-
-    const del = await app.inject({
-      method: 'DELETE', url: `/grants/${id}`,
-      headers: { ...bearer(token), 'content-type': 'application/json' },
-    });
-    expect(del.statusCode).toBe(200);
-    expect(store.get(id)?.status).toBe('terminated');
-  });
-});
-
-describe('JSON body parsing (buildFastify)', () => {
-  const json = (t: string) => ({ ...bearer(t), 'content-type': 'application/json' });
-
-  it('treats a declared-JSON empty body as no body, so the route answers its own 400', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', headers: json(token) });
-    expect(res.statusCode).toBe(400);
-    const error = (res.json() as { error: { code: string; message: string } }).error;
-    expect(error.code).toBe('invalid_request');
-    expect(error.message).toBe('partyId is required');
-  });
-
-  it('still rejects a non-empty malformed body → 400 FST_ERR_CTP_INVALID_JSON_BODY', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants', headers: json(token), payload: '{"partyId":' });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('FST_ERR_CTP_INVALID_JSON_BODY');
-  });
-
-  it('still refuses a prototype-poisoning body, as Fastify\'s own parser does', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants', headers: json(token),
-      payload: '{"partyId":"party-P","__proto__":{"polluted":true}}',
-    });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('FST_ERR_CTP_INVALID_JSON_BODY');
-    const list = await app.inject({ method: 'GET', url: '/grants', headers: bearer(token) });
-    expect((list.json() as { data: { donations: unknown[] } }).data.donations).toHaveLength(0);
-  });
-
-  it('parses a well-formed body with a charset parameter on the content type', async () => {
-    const res = await app.inject({
-      method: 'POST', url: '/grants',
-      headers: { ...bearer(token), 'content-type': 'application/json; charset=utf-8' },
-      payload: JSON.stringify(body),
-    });
-    expect(res.statusCode).toBe(201);
-  });
-});

package/src/server/__tests__/strands-route.test.ts

@@ -1,234 +0,0 @@
-/**
- * `/api/strands` route tests — a real Fastify built by `createLocalUiServer`
- * (so the error handler, the mount gate, and the static not-found fallback are
- * all the production ones) over a fake StrandService.
- *
- * What the service does is covered by `strands/__tests__/strand-service.test.ts`;
- * this file is about the HTTP contract: envelope shape, status mapping, the
- * `confirm` query param, and exactly-once bus publication.
- */
-
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-
-import { createLocalUiServer } from '../index.js';
-import type { LocalUiEvent } from '../events/types.js';
-import { fakeFounder } from './fakes.js';
-import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
-import type { StrandService } from '../../strands/index.js';
-import { StrandError } from '../../strands/index.js';
-import type { StrandListSnapshot, StrandRemovalResult } from '../../strands/index.js';
-
-function fakeOrchestrator(): HostProcessOrchestrator {
-  return {
-    listNodes: () => [],
-    getNode: () => undefined,
-    resolveDockerId: () => undefined,
-    onStateChange: () => () => undefined,
-  } as unknown as HostProcessOrchestrator;
-}
-
-const SNAPSHOT: StrandListSnapshot = {
-  strands: [
-    { id: 'open-one', type: 'o', running: true, status: 'active' },
-    { id: 'closed-one', type: 'c', running: false, status: null },
-  ],
-  controlConnections: 3,
-};
-
-interface FakeStrands {
-  service: StrandService;
-  /** Every (id, confirm) the route forwarded. */
-  calls: Array<{ strandId: string; confirm: boolean }>;
-  /** Set to make `list` and `remove` throw. */
-  failWith?: unknown;
-  /** Set to make `remove` report a strand that was never published. */
-  absent?: boolean;
-}
-
-function fakeStrandService(): FakeStrands {
-  const state: FakeStrands = {
-    calls: [],
-    service: undefined as unknown as StrandService,
-  };
-  state.service = {
-    async list(): Promise<StrandListSnapshot> {
-      if (state.failWith) throw state.failWith;
-      return SNAPSHOT;
-    },
-    async remove(strandId: string, opts: { confirm: boolean }): Promise<StrandRemovalResult> {
-      state.calls.push({ strandId, confirm: opts.confirm });
-      if (state.failWith) throw state.failWith;
-      return state.absent
-        ? { strandId, published: false, type: null, removed: false, alone: false }
-        : { strandId, published: true, type: 'o', removed: true, alone: false };
-    },
-  } as unknown as StrandService;
-  return state;
-}
-
-let dataDir: string;
-let server: ReturnType<typeof createLocalUiServer>;
-let strands: FakeStrands;
-let events: LocalUiEvent[];
-
-function buildServer(opts: { withStrands: boolean }): void {
-  server = createLocalUiServer({
-    uiPort: 8765,
-    dataDir,
-    orchestrator: fakeOrchestrator(),
-    ...(opts.withStrands ? { founder: fakeFounder({ strands: strands.service }) } : {}),
-    forcePort: 0,
-  });
-  events = [];
-  server.events.subscribe((e) => events.push(e));
-}
-
-beforeEach(() => {
-  dataDir = mkdtempSync(join(tmpdir(), 'cadre-host-strands-route-'));
-  strands = fakeStrandService();
-  buildServer({ withStrands: true });
-});
-
-afterEach(async () => {
-  await server.app.close();
-  rmSync(dataDir, { recursive: true, force: true });
-});
-
-describe('GET /api/strands', () => {
-  it('returns the snapshot in the /api/* envelope', async () => {
-    const res = await server.app.inject({ method: 'GET', url: '/api/strands' });
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { ok: boolean; data: StrandListSnapshot };
-    expect(body.ok).toBe(true);
-    expect(body.data.strands).toHaveLength(2);
-    expect(body.data.strands[0]?.id).toBe('open-one');
-    expect(body.data.controlConnections).toBe(3);
-  });
-
-  it('maps a service failure through the same error handler as the DELETE arm', async () => {
-    strands.failWith = new StrandError('node_unavailable', 'Owner node unavailable: refused');
-    const res = await server.app.inject({ method: 'GET', url: '/api/strands' });
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('node_unavailable');
-  });
-});
-
-describe('DELETE /api/strands/:id', () => {
-  it('removes a published strand → 200 and exactly one strands-changed event', async () => {
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/open-one' });
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { ok: boolean; data: StrandRemovalResult };
-    expect(body.ok).toBe(true);
-    expect(body.data).toMatchObject({ strandId: 'open-one', published: true, removed: true });
-    expect(events).toEqual([{ type: 'strands-changed', kind: 'removed' }]);
-  });
-
-  it('an absent strand → 200, published: false, and NO event', async () => {
-    strands.absent = true;
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/never-published' });
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { data: StrandRemovalResult };
-    expect(body.data.published).toBe(false);
-    expect(body.data.removed).toBe(false);
-    expect(events).toEqual([]);
-  });
-
-  it('forwards confirm=1 as true and its absence as false', async () => {
-    await server.app.inject({ method: 'DELETE', url: '/api/strands/a' });
-    await server.app.inject({ method: 'DELETE', url: '/api/strands/b?confirm=1' });
-    await server.app.inject({ method: 'DELETE', url: '/api/strands/c?confirm=true' });
-    expect(strands.calls).toEqual([
-      { strandId: 'a', confirm: false },
-      { strandId: 'b', confirm: true },
-      { strandId: 'c', confirm: true },
-    ]);
-  });
-
-  it('treats a guessy confirm value as NOT confirmed', async () => {
-    // `yes`/`on`/empty are refused deliberately — a typo must not destroy a
-    // closed strand's membership key.
-    await server.app.inject({ method: 'DELETE', url: '/api/strands/a?confirm=yes' });
-    await server.app.inject({ method: 'DELETE', url: '/api/strands/b?confirm=' });
-    expect(strands.calls).toEqual([
-      { strandId: 'a', confirm: false },
-      { strandId: 'b', confirm: false },
-    ]);
-  });
-
-  it('ignores query params other than confirm rather than proxying them', async () => {
-    await server.app.inject({ method: 'DELETE', url: '/api/strands/a?force=1&confirm=1' });
-    expect(strands.calls).toEqual([{ strandId: 'a', confirm: true }]);
-  });
-
-  // The route is one path segment, so an id holding a `/` has to arrive
-  // percent-encoded. Fastify decodes `params`, so the service sees the literal id
-  // and forwards it — nothing in this chain needs to refuse such an id.
-  it('carries a percent-encoded "/" through to the service as a literal', async () => {
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/ns%2Fstrand' });
-    expect(res.statusCode).toBe(200);
-    expect(strands.calls).toEqual([{ strandId: 'ns/strand', confirm: false }]);
-  });
-
-  it('404s an UNencoded "/" at the router, before any handler runs', async () => {
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/ns/strand' });
-    expect(res.statusCode).toBe(404);
-    expect(strands.calls).toEqual([]);
-  });
-});
-
-describe('DELETE /api/strands/:id — error mapping', () => {
-  it('confirmation_required → 428 with the node message intact', async () => {
-    const message = 'Refusing to remove closed strand closed-one without confirmation: …';
-    strands.failWith = new StrandError('confirmation_required', message);
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/closed-one' });
-    expect(res.statusCode).toBe(428);
-    const body = res.json() as { ok: boolean; error: { code: string; message: string } };
-    expect(body.ok).toBe(false);
-    expect(body.error.code).toBe('confirmation_required');
-    expect(body.error.message).toBe(message);
-    expect(events).toEqual([]);
-  });
-
-  it('node_unavailable → 503', async () => {
-    strands.failWith = new StrandError('node_unavailable', 'Owner node unavailable: refused');
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/open-one' });
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('node_unavailable');
-  });
-
-  it('invalid_id → 400', async () => {
-    strands.failWith = new StrandError('invalid_id', 'A strand id is required');
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/%20' });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_id');
-  });
-
-  it('internal → 500', async () => {
-    strands.failWith = new StrandError('internal', 'node said something new');
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/open-one' });
-    expect(res.statusCode).toBe(500);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('internal');
-  });
-});
-
-describe('donor-only mode (no founder services)', () => {
-  beforeEach(async () => {
-    await server.app.close();
-    buildServer({ withStrands: false });
-  });
-
-  it('404s GET /api/strands through the static not-found handler', async () => {
-    const res = await server.app.inject({ method: 'GET', url: '/api/strands' });
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
-  });
-
-  it('404s DELETE /api/strands/:id', async () => {
-    const res = await server.app.inject({ method: 'DELETE', url: '/api/strands/open-one' });
-    expect(res.statusCode).toBe(404);
-  });
-});