@serfab/cadre-host 1.6.0 → 1.8.0

package/src/orchestrator/node-identity.ts

@@ -6,8 +6,9 @@
  * identity, so a node that generated a fresh libp2p keypair per process would
  * become a stranger to the cadre that admitted it on every restart. It also
  * needs a stable on-disk home for its node-local stores — `cadre-cli start`
- * opens `FileBootstrapPeerStore` / `FileTrustedOwnerStore` only when a protobuf
- * identity key file is configured.
+ * opens `FileBootstrapPeerStore` / `FileTrustedOwnerStore` /
+ * `FileStrandPeerBookStore` in the node's state directory, which defaults to
+ * the directory holding the config file the orchestrator writes into the workdir.
  *
  * So every managed node gets its own `identity.key` inside its workdir, written
  * once and reused thereafter. The workdir is removed when the loan is

package/src/orchestrator/port-allocator.ts

@@ -1,52 +1,11 @@
-import type { NodePorts } from './types.js';
-
-/**
- * Range-based port tracker. Allocations are in-memory; on orchestrator
- * restart the caller rehydrates the used-set from persisted state via
- * `markUsed(port)` before serving new allocations.
- */
-export class PortAllocator {
-  private readonly usedPorts = new Set<number>();
-
-  constructor(
-    private readonly start: number,
-    private readonly end: number,
-  ) {
-    if (!Number.isInteger(start) || !Number.isInteger(end) || start <= 0 || end < start) {
-      throw new Error(`Invalid port range: ${start}..${end}`);
-    }
-  }
-
-  allocate(): number {
-    for (let port = this.start; port <= this.end; port++) {
-      if (!this.usedPorts.has(port)) {
-        this.usedPorts.add(port);
-        return port;
-      }
-    }
-    throw new Error(`No available ports in range ${this.start}..${this.end}`);
-  }
-
-  release(port: number): void {
-    this.usedPorts.delete(port);
-  }
-
-  /**
-   * Used during restart rehydration to reserve ports already in use. A no-op for a
-   * port outside the range, and for a non-integer: a handle persisted by an older
-   * build lacks the ports added since, and `undefined` must not enter the used-set.
-   */
-  markUsed(port: number): void {
-    if (!Number.isInteger(port) || port < this.start || port > this.end) {
-      return;
-    }
-    this.usedPorts.add(port);
-  }
+import {
+  allocatePortSet,
+  releasePortSet,
+  reservePortSet,
+  type PortAllocator,
+} from '@serfab/cadre-provider';
 
-  has(port: number): boolean {
-    return this.usedPorts.has(port);
-  }
-}
+import type { NodePorts } from './types.js';
 
 /**
  * Allocation order for a node's port set. Fixed so that swapping a caller onto
@@ -54,54 +13,20 @@ export class PortAllocator {
  * already handed out — which is also why a key added later goes on the end
  * (`ws` came after the first four).
  */
-const NODE_PORT_KEYS = ['health', 'metrics', 'p2p', 'admin', 'ws'] as const;
+const NODE_PORT_KEYS = ['health', 'metrics', 'p2p', 'admin', 'ws'] as const satisfies readonly (keyof NodePorts)[];
 
 /**
- * Allocate a full NodePorts set atomically — a mid-way failure (an exhausted
- * range) releases everything already taken rather than stranding the ports it
- * got before the throw. `overrides` supply a port instead of allocating one
- * (the owner node's p2p port, which is fixed by NAT config; a re-spawn's
- * previous ports, see {@link reusedNodePorts}).
- *
- * Overrides are reserved FIRST, before any allocation, so an override that
- * happens to sit inside the managed range cannot also be handed out to another
- * key. Reserving is `markUsed`, a documented no-op outside the range — which is
- * the production case for the owner node's libp2p port, and why reserving first
- * leaves every real port assignment unchanged.
- *
- * NOTE: an override is trusted, not checked — `markUsed` does not refuse a port
- * another handle already holds, nor two keys naming the same port. Safe for
- * today's callers: a re-spawn's overrides were released by its own handle drop
- * with no `await` in between, and the owner's `libp2pPort` can only collide if an
- * operator configures it inside the range onto a port a node already holds. If a
- * caller ever passes ports it did not just release, refuse an override that
- * `allocator.has()` or that repeats another key's port.
+ * Allocate a full NodePorts set atomically, in {@link NODE_PORT_KEYS} order.
+ * `overrides` supply a port instead of allocating one (the owner node's p2p
+ * port, which is fixed by NAT config; a re-spawn's previous ports, see
+ * {@link reusedNodePorts}). Overrides are reserved before anything is allocated
+ * and are trusted, not checked — see `allocatePortSet`.
  */
 export function allocateNodePorts(
   allocator: PortAllocator,
   overrides?: Partial<NodePorts>,
 ): NodePorts {
-  const reserved: number[] = [];
-  const ports: Partial<NodePorts> = {};
-  try {
-    for (const key of NODE_PORT_KEYS) {
-      const override = overrides?.[key];
-      if (override === undefined) continue;
-      allocator.markUsed(override);
-      reserved.push(override);
-      ports[key] = override;
-    }
-    for (const key of NODE_PORT_KEYS) {
-      if (ports[key] !== undefined) continue;
-      const port = allocator.allocate();
-      reserved.push(port);
-      ports[key] = port;
-    }
-  } catch (err) {
-    for (const port of reserved) allocator.release(port);
-    throw err;
-  }
-  return ports as NodePorts;
+  return allocatePortSet(allocator, NODE_PORT_KEYS, overrides);
 }
 
 /**
@@ -109,7 +34,7 @@ export function allocateNodePorts(
  * {@link releaseNodePorts}. A key the set lacks is skipped (see `markUsed`).
  */
 export function reserveNodePorts(allocator: PortAllocator, ports: NodePorts): void {
-  for (const key of NODE_PORT_KEYS) allocator.markUsed(ports[key]);
+  reservePortSet(allocator, NODE_PORT_KEYS, ports);
 }
 
 /**
@@ -117,7 +42,7 @@ export function reserveNodePorts(allocator: PortAllocator, ports: NodePorts): vo
  * nothing: deleting a value the used-set never held is a no-op.
  */
 export function releaseNodePorts(allocator: PortAllocator, ports: NodePorts): void {
-  for (const key of NODE_PORT_KEYS) allocator.release(ports[key]);
+  releasePortSet(allocator, NODE_PORT_KEYS, ports);
 }
 
 /**

package/src/server/__tests__/fakes.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared fakes for the local-UI server tests. Holds no tests of its own.
+ */
+
+import type { FounderServices } from '../index.js';
+import type { TrustCircleService } from '../../auth/index.js';
+import type { NatService } from '../../nat/index.js';
+import type { NatStatusSnapshot } from '../../nat/types.js';
+import type { StrandService } from '../../strands/index.js';
+
+export const SAMPLE_CONNECTIVITY: NatStatusSnapshot = {
+  portMode: 'auto-upnp',
+  externalPort: 4001,
+  internalPort: 4001,
+  routerExternalIp: '203.0.113.5',
+  mappingLeaseExpiresAt: null,
+  externalIp: '203.0.113.5',
+  externalIpDetectedAt: null,
+  cgnatDetected: false,
+  directReachability: 'reachable',
+  lastTestedAt: null,
+  ddns: {
+    providerId: null,
+    hostname: null,
+    externallyManaged: false,
+    lastUpdateAt: null,
+    lastUpdateOk: null,
+    lastError: null,
+  },
+};
+
+/**
+ * A founder-role service set whose members answer only the reads the server
+ * makes on its own (status, boot publish): an empty trust circle, the sample
+ * connectivity, no strands. Pass the service a test exercises as an override.
+ */
+export function fakeFounder(overrides: Partial<FounderServices> = {}): FounderServices {
+  return {
+    trustCircle: { list: async () => ({ members: [], pending: [] }) } as unknown as TrustCircleService,
+    nat: { getStatus: () => SAMPLE_CONNECTIVITY } as unknown as NatService,
+    strands: { list: async () => ({ strands: [], controlConnections: 0 }) } as unknown as StrandService,
+    ...overrides,
+  };
+}

package/src/server/__tests__/grants-admin-route.test.ts

@@ -1,73 +1,171 @@
-import Fastify from 'fastify';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { registerErrorHandler } from '../error-handler.js';
-import { registerGrantsAdminRoutes } from '../routes/grants-admin.js';
-import { GrantService, GrantStore, createGrantAdminHandlers } from '../../donation/index.js';
-import type { Grant } from '../../donation/index.js';
-
-let tmpRoot: string;
-let app: ReturnType<typeof Fastify>;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-grants-route-'));
-  const service = new GrantService({ store: new GrantStore(tmpRoot) });
-  app = Fastify();
-  registerErrorHandler(app);
-  registerGrantsAdminRoutes(app, { handlers: createGrantAdminHandlers(service) });
-});
-
-afterEach(async () => {
-  await app.close();
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-});
-
-describe('/grants-admin routes', () => {
-  it('POST issues a grant, GET lists it, DELETE revokes it', async () => {
-    const post = await app.inject({
-      method: 'POST',
-      url: '/grants-admin',
-      payload: { label: "Alice's cadre", maxNodes: 2 },
-    });
-    expect(post.statusCode).toBe(200);
-    const created = (post.json() as { grant: Grant }).grant;
-    expect(created.token).toBeTruthy();
-    expect(created.maxNodes).toBe(2);
-
-    const list = await app.inject({ method: 'GET', url: '/grants-admin' });
-    expect(list.statusCode).toBe(200);
-    expect((list.json() as { grants: Grant[] }).grants.map(g => g.token)).toContain(created.token);
-
-    const del = await app.inject({
-      method: 'DELETE',
-      url: `/grants-admin/${encodeURIComponent(created.token)}`,
-    });
-    expect(del.statusCode).toBe(200);
-
-    // Revoked → still listed, now carries revokedAt.
-    const after = await app.inject({ method: 'GET', url: '/grants-admin' });
-    const row = (after.json() as { grants: Grant[] }).grants.find(g => g.token === created.token);
-    expect(row?.revokedAt).toBeTruthy();
-  });
-
-  it('POST with an empty label → 400 invalid_label', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants-admin', payload: { label: '  ' } });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_label');
-  });
-
-  it('POST with a bad maxNodes → 400 invalid_max_nodes', async () => {
-    const res = await app.inject({ method: 'POST', url: '/grants-admin', payload: { label: 'X', maxNodes: 0 } });
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_max_nodes');
-  });
-
-  it('DELETE of an unknown token → 404 not_found', async () => {
-    const res = await app.inject({ method: 'DELETE', url: '/grants-admin/nope' });
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
-  });
-});
+import Fastify from 'fastify';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { registerErrorHandler } from '../error-handler.js';
+import { EventBus } from '../events/bus.js';
+import { registerGrantsAdminRoutes } from '../routes/grants-admin.js';
+import {
+  DonationService,
+  DonationStore,
+  GrantService,
+  GrantStore,
+  createGrantAdminHandlers,
+} from '../../donation/index.js';
+import type { DonationView, Grant, GrantListing } from '../../donation/index.js';
+import { FakeOrchestrator } from '../../donation/__tests__/fake-orchestrator.js';
+
+/** A well-formed 32-byte base64url owner key, which `provision` requires. */
+const OWNER_KEY = Buffer.alloc(32, 7).toString('base64url');
+
+let tmpRoot: string;
+let app: ReturnType<typeof Fastify>;
+let grants: GrantService;
+let donations: DonationService;
+let donationStore: DonationStore;
+let orch: FakeOrchestrator;
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-grants-route-'));
+  grants = new GrantService({ store: new GrantStore(tmpRoot) });
+  orch = new FakeOrchestrator();
+  donationStore = new DonationStore(tmpRoot);
+  donations = new DonationService({ orchestrator: orch, grants, store: donationStore });
+  app = Fastify();
+  registerErrorHandler(app);
+  registerGrantsAdminRoutes(app, { handlers: createGrantAdminHandlers(grants, donations), events: new EventBus() });
+});
+
+afterEach(async () => {
+  await app.close();
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+describe('/grants-admin routes', () => {
+  it('POST issues a grant, GET lists it, DELETE revokes it', async () => {
+    const post = await app.inject({
+      method: 'POST',
+      url: '/grants-admin',
+      payload: { label: "Alice's cadre", maxNodes: 2 },
+    });
+    expect(post.statusCode).toBe(200);
+    const created = (post.json() as { grant: Grant }).grant;
+    expect(created.token).toBeTruthy();
+    expect(created.maxNodes).toBe(2);
+
+    const list = await app.inject({ method: 'GET', url: '/grants-admin' });
+    expect(list.statusCode).toBe(200);
+    expect((list.json() as { grants: Grant[] }).grants.map(g => g.token)).toContain(created.token);
+
+    const del = await app.inject({
+      method: 'DELETE',
+      url: `/grants-admin/${encodeURIComponent(created.token)}`,
+    });
+    expect(del.statusCode).toBe(200);
+
+    // Revoked → still listed, now carries revokedAt.
+    const after = await app.inject({ method: 'GET', url: '/grants-admin' });
+    const row = (after.json() as { grants: Grant[] }).grants.find(g => g.token === created.token);
+    expect(row?.revokedAt).toBeTruthy();
+  });
+
+  it('POST with an empty label → 400 invalid_label', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants-admin', payload: { label: '  ' } });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_label');
+  });
+
+  it('POST with a bad maxNodes → 400 invalid_max_nodes', async () => {
+    const res = await app.inject({ method: 'POST', url: '/grants-admin', payload: { label: 'X', maxNodes: 0 } });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('invalid_max_nodes');
+  });
+
+  it('DELETE of an unknown token → 404 not_found', async () => {
+    const res = await app.inject({ method: 'DELETE', url: '/grants-admin/nope' });
+    expect(res.statusCode).toBe(404);
+    expect((res.json() as { error: { code: string } }).error.code).toBe('not_found');
+  });
+});
+
+function provisionUnder(token: string): Promise<DonationView> {
+  return donations.provision({ grantToken: token, partyId: 'party-P', bootstrapNodes: [], ownerKeys: [OWNER_KEY] });
+}
+
+describe('/grants-admin listing', () => {
+  it("GET reports each grant's live nodes and the donations a revoke would end", async () => {
+    const a = grants.issue({ label: 'A', maxNodes: 3 });
+    const b = grants.issue({ label: 'B' });
+    const seeded = await provisionUnder(a.token);
+    const failed = await provisionUnder(a.token);
+    const ended = await provisionUnder(a.token);
+    const other = await provisionUnder(b.token);
+    donationStore.put({ ...donationStore.get(seeded.id)!, status: 'seeded' });
+    donationStore.put({ ...donationStore.get(failed.id)!, status: 'error', error: 'respawn gave up' });
+    await donations.terminate(ended.id);
+
+    const res = await app.inject({ method: 'GET', url: '/grants-admin' });
+
+    const listed = (res.json() as { grants: GrantListing[] }).grants;
+    const rowA = listed.find(g => g.token === a.token);
+    const rowB = listed.find(g => g.token === b.token);
+    // `error` is not live, but a revoke still tears it down; `terminated` is neither.
+    expect(rowA?.liveNodes).toBe(1);
+    expect(rowA?.donations).toEqual(expect.arrayContaining([
+      { id: seeded.id, status: 'seeded' },
+      { id: failed.id, status: 'error' },
+    ]));
+    expect(rowA?.donations).toHaveLength(2);
+    expect(rowB?.liveNodes).toBe(1);
+    expect(rowB?.donations).toEqual([{ id: other.id, status: 'awaiting_seed' }]);
+  });
+});
+
+describe('/grants-admin donated-node teardown', () => {
+  it('DELETE /grants-admin/:token terminates the nodes donated under the grant', async () => {
+    const { token } = grants.issue({ label: 'Alice' });
+    const donation = await provisionUnder(token);
+
+    const res = await app.inject({ method: 'DELETE', url: `/grants-admin/${encodeURIComponent(token)}` });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, terminated: [donation.id] });
+    expect(donations.get(donation.id)?.status).toBe('terminated');
+    expect(orch.removed).toEqual(['dock_1']);
+  });
+
+  it('?keepNodes=true revokes the grant but leaves its nodes running', async () => {
+    const { token } = grants.issue({ label: 'Alice' });
+    const donation = await provisionUnder(token);
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/grants-admin/${encodeURIComponent(token)}?keepNodes=true`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, terminated: [] });
+    expect(grants.validate(token).reason).toBe('revoked');
+    expect(donations.get(donation.id)?.status).toBe('awaiting_seed');
+    expect(orch.stopped).toEqual([]);
+  });
+
+  it('DELETE /grants-admin/donations/:id ends one node under a revoked grant; an unknown id 404s', async () => {
+    const { token } = grants.issue({ label: 'Alice', maxNodes: 2 });
+    const kept = await provisionUnder(token);
+    const ended = await provisionUnder(token);
+    grants.revoke(token);
+
+    const res = await app.inject({ method: 'DELETE', url: `/grants-admin/donations/${ended.id}` });
+
+    expect(res.statusCode).toBe(200);
+    expect(donations.get(ended.id)?.status).toBe('terminated');
+    expect(donations.get(kept.id)?.status).toBe('awaiting_seed');
+
+    const unknown = await app.inject({ method: 'DELETE', url: '/grants-admin/donations/grn_nope' });
+    expect(unknown.statusCode).toBe(404);
+    expect((unknown.json() as { error: { code: string } }).error.code).toBe('not_found');
+  });
+});

package/src/server/__tests__/nodes-route.test.ts

@@ -90,27 +90,15 @@ const SAMPLE_NODE: ManagedNodeInfo = {
 
 describe('/api/nodes routes', () => {
   let app: ReturnType<typeof Fastify>;
-  let bus: EventBus;
   let orchestrator: FakeOrchestrator;
   let workdir: string;
 
   beforeEach(async () => {
     workdir = mkdtempSync(join(tmpdir(), 'cadre-host-nodes-'));
-    bus = new EventBus();
     app = Fastify();
     registerErrorHandler(app);
     orchestrator = fakeOrchestrator([{ ...SAMPLE_NODE, workdir }]);
-    registerNodesRoutes(app, { orchestrator });
-    // Mirror what createLocalUiServer.start() does — forward orchestrator
-    // state changes onto the bus. The route itself doesn't publish; the
-    // listener is the single publication point.
-    orchestrator.onStateChange((info) => {
-      bus.publish({
-        type: 'node-state-changed',
-        nodeId: info.id,
-        status: info.status === 'running' ? 'running' : 'stopped',
-      });
-    });
+    registerNodesRoutes(app, { orchestrator, role: 'founder' });
   });
 
   afterEach(async () => {
@@ -158,17 +146,15 @@ describe('/api/nodes routes', () => {
     expect(body.data.lines).toEqual([]);
   });
 
-  it('POST /api/nodes/:id/stop calls orchestrator and publishes exactly one event via the listener', async () => {
-    const events: unknown[] = [];
-    bus.subscribe((e) => events.push(e));
+  it('POST /api/nodes/:id/stop on a non-owner (donated) node returns 501 and stops nothing', async () => {
+    // The donation supervisor would respawn it at once — the stop must not look
+    // like it worked.
     const res = await app.inject({ method: 'POST', url: '/api/nodes/alice/stop' });
-    expect(res.statusCode).toBe(200);
-    expect(orchestrator.__stoppedDockerIds).toContain(SAMPLE_NODE.dockerId);
-    // Exactly one event — the orchestrator listener publishes; the route
-    // does not re-publish (regression guard).
-    expect(events).toEqual([
-      { type: 'node-state-changed', nodeId: 'alice', status: 'stopped' },
-    ]);
+    expect(res.statusCode).toBe(501);
+    const body = res.json() as { error: { code: string; message: string } };
+    expect(body.error.code).toBe('not_implemented');
+    expect(body.error.message).toContain('cadre-host grant terminate alice');
+    expect(orchestrator.__stoppedDockerIds).toEqual([]);
   });
 
   it('POST /api/nodes/:id/start on a non-owner node returns 501 not_implemented', async () => {
@@ -211,11 +197,35 @@ describe('/api/nodes — owner node start/restart', () => {
     app = Fastify();
     registerErrorHandler(app);
     orchestrator = fakeOrchestrator([OWNER_NODE], { ownerId: 'owner', hasOwnerConfig: true });
-    registerNodesRoutes(app, { orchestrator });
+    registerNodesRoutes(app, { orchestrator, role: 'founder' });
   });
 
   afterEach(async () => { await app.close(); });
 
+  it('stop calls the orchestrator and publishes exactly one event via the listener', async () => {
+    // Mirror what createLocalUiServer.start() does — the orchestrator listener is
+    // the single publication point.
+    const bus = new EventBus();
+    orchestrator.onStateChange((info) => {
+      bus.publish({
+        type: 'node-state-changed',
+        nodeId: info.id,
+        status: info.status === 'running' ? 'running' : 'stopped',
+      });
+    });
+    const events: unknown[] = [];
+    bus.subscribe((e) => events.push(e));
+
+    const res = await app.inject({ method: 'POST', url: '/api/nodes/owner/stop' });
+
+    expect(res.statusCode).toBe(200);
+    expect(orchestrator.__stoppedDockerIds).toEqual([OWNER_NODE.dockerId]);
+    // Exactly one event — the route does not re-publish (regression guard).
+    expect(events).toEqual([
+      { type: 'node-state-changed', nodeId: 'owner', status: 'stopped' },
+    ]);
+  });
+
   it('start ensures the owner node', async () => {
     const res = await app.inject({ method: 'POST', url: '/api/nodes/owner/start' });
     expect(res.statusCode).toBe(200);
@@ -232,11 +242,25 @@ describe('/api/nodes — owner node start/restart', () => {
     const app2 = Fastify();
     registerErrorHandler(app2);
     const orch2 = fakeOrchestrator([OWNER_NODE], { ownerId: 'owner', hasOwnerConfig: false });
-    registerNodesRoutes(app2, { orchestrator: orch2 });
+    registerNodesRoutes(app2, { orchestrator: orch2, role: 'founder' });
     const res = await app2.inject({ method: 'POST', url: '/api/nodes/owner/start' });
     expect(res.statusCode).toBe(501);
     await app2.close();
   });
+  it('start and restart answer 409 own_cadre_disabled on a donor-only host that kept a saved owner config', async () => {
+    const donorApp = Fastify();
+    registerErrorHandler(donorApp);
+    const donorOrch = fakeOrchestrator([OWNER_NODE], { ownerId: 'owner', hasOwnerConfig: true });
+    registerNodesRoutes(donorApp, { orchestrator: donorOrch, role: 'donor' });
+    for (const verb of ['start', 'restart']) {
+      const res = await donorApp.inject({ method: 'POST', url: `/api/nodes/owner/${verb}` });
+      expect(res.statusCode).toBe(409);
+      expect(res.json().error.code).toBe('own_cadre_disabled');
+    }
+    expect(donorOrch.__ensured).toBe(0);
+    expect(donorOrch.__restarted).toBe(0);
+    await donorApp.close();
+  });
 });
 
 describe('tailLogFile', () => {

package/src/server/__tests__/publishers.test.ts

@@ -14,44 +14,12 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { createLocalUiServer } from '../index.js';
 import { EventBus } from '../events/bus.js';
 import type { LocalUiEvent } from '../events/types.js';
+import { fakeFounder } from './fakes.js';
 import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
 import type { ManagedNodeInfo, NodeStateListener } from '../../orchestrator/types.js';
-import type { TrustCircleService } from '../../auth/index.js';
-import type { NatService } from '../../nat/index.js';
-import type { NatStatusSnapshot } from '../../nat/types.js';
 import type { UpdateService } from '../../update/index.js';
 import type { UpdateState } from '../../update/types.js';
 
-const CONNECTIVITY: NatStatusSnapshot = {
-  portMode: 'auto-upnp',
-  externalPort: 4001,
-  internalPort: 4001,
-  routerExternalIp: '203.0.113.1',
-  mappingLeaseExpiresAt: null,
-  externalIp: '203.0.113.1',
-  externalIpDetectedAt: null,
-  cgnatDetected: false,
-  directReachability: 'reachable',
-  lastTestedAt: null,
-  ddns: {
-    providerId: null,
-    hostname: null,
-    externallyManaged: false,
-    lastUpdateAt: null,
-    lastUpdateOk: null,
-    lastError: null,
-  },
-};
-
-function fakeTrust(): TrustCircleService {
-  return {
-    list: async () => ({ members: [], pending: [] }),
-  } as unknown as TrustCircleService;
-}
-function fakeNat(): NatService {
-  return { getStatus: () => CONNECTIVITY, putSettings: async () => CONNECTIVITY } as unknown as NatService;
-}
-
 interface ManualOrchestrator extends HostProcessOrchestrator {
   __emit: (info: ManagedNodeInfo) => void;
 }
@@ -117,8 +85,7 @@ describe('publisher wiring', () => {
       uiPort: 8765,
       dataDir,
       orchestrator,
-      trustCircle: fakeTrust(),
-      nat: fakeNat(),
+      founder: fakeFounder(),
       events: bus,
       forcePort: 0,
     });
@@ -146,8 +113,7 @@ describe('publisher wiring', () => {
       uiPort: 8765,
       dataDir,
       orchestrator,
-      trustCircle: fakeTrust(),
-      nat: fakeNat(),
+      founder: fakeFounder(),
       events: bus,
       forcePort: 0,
     });
@@ -168,8 +134,7 @@ describe('publisher wiring', () => {
       uiPort: 8765,
       dataDir,
       orchestrator,
-      trustCircle: fakeTrust(),
-      nat: fakeNat(),
+      founder: fakeFounder(),
       events: bus,
       update: update as unknown as UpdateService,
       forcePort: 0,
@@ -194,8 +159,7 @@ describe('publisher wiring', () => {
       uiPort: 8765,
       dataDir,
       orchestrator,
-      trustCircle: fakeTrust(),
-      nat: fakeNat(),
+      founder: fakeFounder(),
       events: bus,
       update: update as unknown as UpdateService,
       forcePort: 0,