@serfab/cadre-host 1.7.0 → 1.9.0

package/src/server/routes/grants-admin.ts

@@ -1,41 +1,74 @@
-/**
- * Donation grant **admin** HTTP routes — thin adapters around
- * `GrantAdminHandlers` (`createGrantAdminHandlers(service)`).
- *
- * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
- * targets. It is **loopback, no bearer**: same-machine admin, matching
- * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
- * Security posture). This is distinct from the grantee-facing `/grants`
- * provisioning surface that carries the bearer gate — that arrives in the
- * `2-donation-service` ticket.
- */
-
-import type { FastifyInstance } from 'fastify';
-
-import type { GrantAdminHandlers } from '../../donation/types.js';
-
-export interface GrantsAdminRoutesOptions {
-  handlers: GrantAdminHandlers;
-}
-
-export function registerGrantsAdminRoutes(app: FastifyInstance, opts: GrantsAdminRoutesOptions): void {
-  const { handlers } = opts;
-
-  app.get('/grants-admin', async () => {
-    return handlers.listGrants();
-  });
-
-  app.post('/grants-admin', async (request) => {
-    const body = (request.body ?? {}) as { label?: unknown; maxNodes?: unknown; ttlMs?: unknown };
-    const label = typeof body.label === 'string' ? body.label : '';
-    const args: { label: string; maxNodes?: number; ttlMs?: number } = { label };
-    if (typeof body.maxNodes === 'number') args.maxNodes = body.maxNodes;
-    if (typeof body.ttlMs === 'number') args.ttlMs = body.ttlMs;
-    return handlers.postGrant(args);
-  });
-
-  app.delete<{ Params: { token: string } }>('/grants-admin/:token', async (request) => {
-    await handlers.deleteGrant(request.params.token);
-    return { ok: true };
-  });
-}
+/**
+ * Donation grant **admin** HTTP routes — thin adapters around
+ * `GrantAdminHandlers` (`createGrantAdminHandlers(service, donations)`).
+ *
+ * Mount path: `/grants-admin` — the admin surface the `cadre-host grant` CLI
+ * targets. It is **loopback, no bearer**: same-machine admin, matching
+ * cadre-host's local-UI "no login" posture (see docs/cadre-host.md §
+ * Security posture). This is distinct from the grantee-facing `/grants`
+ * provisioning surface (`routes/grants.ts`), which carries the bearer gate.
+ *
+ * Clients: the `cadre-host grant` CLI and the local UI's Grants page. The list
+ * reports each grant's live-node count and the donations a revoke would end.
+ *
+ * Revoking a grant also terminates the nodes donated under it unless the
+ * caller passes `?keepNodes=true`; `DELETE /grants-admin/donations/:id` ends a
+ * single donated node. Those are the host's only teardown paths once a grant is
+ * revoked — the grantee's own `DELETE /grants/:id` is refused from then on.
+ *
+ * Each successful mutation publishes a `grants-changed` bus event, so an open
+ * Grants page refreshes when the CLI acts.
+ */
+
+import type { FastifyInstance } from 'fastify';
+
+import type { GrantAdminHandlers } from '../../donation/types.js';
+import type { EventBus } from '../events/bus.js';
+
+export interface GrantsAdminRoutesOptions {
+  handlers: GrantAdminHandlers;
+  events: EventBus;
+}
+
+export function registerGrantsAdminRoutes(app: FastifyInstance, opts: GrantsAdminRoutesOptions): void {
+  const { handlers, events } = opts;
+
+  app.get('/grants-admin', async () => {
+    return handlers.listGrants();
+  });
+
+  app.post('/grants-admin', async (request) => {
+    const body = (request.body ?? {}) as { label?: unknown; maxNodes?: unknown; ttlMs?: unknown };
+    const label = typeof body.label === 'string' ? body.label : '';
+    const args: { label: string; maxNodes?: number; ttlMs?: number } = { label };
+    if (typeof body.maxNodes === 'number') args.maxNodes = body.maxNodes;
+    if (typeof body.ttlMs === 'number') args.ttlMs = body.ttlMs;
+    const result = await handlers.postGrant(args);
+    events.publish({ type: 'grants-changed', kind: 'issued' });
+    return result;
+  });
+
+  app.delete<{ Params: { token: string }; Querystring: { keepNodes?: string } }>(
+    '/grants-admin/:token',
+    async (request) => {
+      const keepNodes = isTrueFlag(request.query.keepNodes);
+      const { terminated } = await handlers.deleteGrant(request.params.token, { keepNodes });
+      events.publish({ type: 'grants-changed', kind: 'revoked' });
+      return { ok: true, terminated };
+    },
+  );
+
+  // Two path segments past `/grants-admin`, so it never collides with `/:token`.
+  const { terminateDonation } = handlers;
+  if (terminateDonation) {
+    app.delete<{ Params: { id: string } }>('/grants-admin/donations/:id', async (request) => {
+      await terminateDonation(request.params.id);
+      events.publish({ type: 'grants-changed', kind: 'terminated' });
+      return { ok: true };
+    });
+  }
+}
+
+function isTrueFlag(value: string | undefined): boolean {
+  return value === 'true' || value === '1';
+}

package/src/server/routes/nodes.ts

@@ -6,29 +6,38 @@
  * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
  * handlers don't re-publish.
  *
- * start/restart are real for the admin's owner node (re-spawned from the
- * persisted `OwnerSpawnConfig`). Generic node lifecycle is owned by the
- * grantee-facing donation surface (`/grants`) — this route no longer spawns
- * generic nodes; start/restart of a known non-owner node points the caller
- * there. Stop works for any running node.
+ * start/stop/restart are real for the admin's owner node only (start/restart
+ * re-spawn it from the persisted `OwnerSpawnConfig`). Every other node this
+ * route can see is a donated node, whose lifecycle belongs to the donation
+ * surface — this route no longer spawns generic nodes, and a stop here would
+ * be undone at once by the donation supervisor's respawn. So all three verbs
+ * answer a known non-owner node with 501, pointing at the donation teardown.
+ *
+ * Owner start/restart are founder-only: a donor-only host that once ran as a
+ * founder still holds the owner handle and saved config (so re-enabling
+ * `ownCadre` can resume it), but spawning it here would bring the owner node
+ * back without its trust circle, NAT or strand services — so those answer 409.
  */
 
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
 
-import type { FastifyInstance } from 'fastify';
+import type { FastifyInstance, FastifyReply } from 'fastify';
 
 import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
 import { defaultLogPath } from '../../orchestrator/log-rotator.js';
 
+import type { HostRole } from './status.js';
+
 const DEFAULT_LOG_LINES = 200;
 const MAX_LOG_LINES = 2000;
 
 export interface NodesRoutesOptions {
   orchestrator: HostProcessOrchestrator;
+  role: HostRole;
 }
 
 export function registerNodesRoutes(app: FastifyInstance, opts: NodesRoutesOptions): void {
-  const { orchestrator } = opts;
+  const { orchestrator, role } = opts;
 
   app.get('/api/nodes', async () => {
     return { ok: true, data: { nodes: orchestrator.listNodes() } };
@@ -36,12 +45,7 @@ export function registerNodesRoutes(app: FastifyInstance, opts: NodesRoutesOptio
 
   app.get<{ Params: { id: string } }>('/api/nodes/:id', async (request, reply) => {
     const node = orchestrator.getNode(request.params.id);
-    if (!node) {
-      return reply.code(404).send({
-        ok: false,
-        error: { code: 'not_found', message: `Unknown node: ${request.params.id}` },
-      });
-    }
+    if (!node) return notFound(reply, request.params.id);
     let stats = null;
     try {
       stats = await orchestrator.getStats(node.dockerId);
@@ -55,12 +59,7 @@ export function registerNodesRoutes(app: FastifyInstance, opts: NodesRoutesOptio
     '/api/nodes/:id/logs',
     async (request, reply) => {
       const node = orchestrator.getNode(request.params.id);
-      if (!node) {
-        return reply.code(404).send({
-          ok: false,
-          error: { code: 'not_found', message: `Unknown node: ${request.params.id}` },
-        });
-      }
+      if (!node) return notFound(reply, request.params.id);
       const requested = Number(request.query.lines ?? DEFAULT_LOG_LINES);
       const tail = Number.isFinite(requested)
         ? Math.max(1, Math.min(MAX_LOG_LINES, Math.floor(requested)))
@@ -70,72 +69,91 @@ export function registerNodesRoutes(app: FastifyInstance, opts: NodesRoutesOptio
     },
   );
 
+  // start / stop / restart: real for the admin's owner node (started from the
+  // persisted OwnerSpawnConfig). Donated-node lifecycle belongs to the donation
+  // surface — those ids return a clear not_implemented that points there;
+  // unknown ids 404.
   app.post<{ Params: { id: string } }>('/api/nodes/:id/stop', async (request, reply) => {
-    const dockerId = orchestrator.resolveDockerId(request.params.id);
-    if (!dockerId) {
-      return reply.code(404).send({
-        ok: false,
-        error: { code: 'not_found', message: `Unknown node: ${request.params.id}` },
-      });
+    const { id } = request.params;
+    if (!orchestrator.isOwnerNode(id)) {
+      return ownerOnlyFallback(reply, orchestrator, id, 'stop');
     }
+    const dockerId = orchestrator.resolveDockerId(id);
+    if (!dockerId) return notFound(reply, id);
     await orchestrator.stopContainer(dockerId);
     // The orchestrator emits its own onStateChange — createLocalUiServer
     // forwards that to the bus. Don't double-publish here.
     return { ok: true };
   });
 
-  // start / restart: real for the admin's owner node (spawned from the
-  // persisted OwnerSpawnConfig). Generic node lifecycle now belongs to the
-  // donation surface (/grants) — those ids return a clear not_implemented that
-  // points there; unknown ids 404.
   app.post<{ Params: { id: string } }>('/api/nodes/:id/start', async (request, reply) => {
     const { id } = request.params;
     if (orchestrator.isOwnerNode(id)) {
+      if (role === 'donor') return ownCadreDisabled(reply, 'start');
       if (!orchestrator.hasOwnerConfig()) {
         return notImplemented(reply, `start ${id}: owner node has no saved spawn config.`);
       }
       const node = await orchestrator.ensureOwnerNode();
       return { ok: true, data: { node } };
     }
-    return startRestartFallback(reply, orchestrator, id, 'start');
+    return ownerOnlyFallback(reply, orchestrator, id, 'start');
   });
 
   app.post<{ Params: { id: string } }>('/api/nodes/:id/restart', async (request, reply) => {
     const { id } = request.params;
     if (orchestrator.isOwnerNode(id)) {
+      if (role === 'donor') return ownCadreDisabled(reply, 'restart');
       if (!orchestrator.hasOwnerConfig()) {
         return notImplemented(reply, `restart ${id}: owner node has no saved spawn config.`);
       }
       const node = await orchestrator.restartOwnerNode();
       return { ok: true, data: { node } };
     }
-    return startRestartFallback(reply, orchestrator, id, 'restart');
+    return ownerOnlyFallback(reply, orchestrator, id, 'restart');
   });
 }
 
-/** 404 for unknown ids; 501 not_implemented for known non-owner nodes. */
-function startRestartFallback(
-  reply: import('fastify').FastifyReply,
+/**
+ * 404 for unknown ids; 501 not_implemented for known non-owner nodes — all of
+ * them donated. A donated node's containerId is its donation id, so the
+ * message names `node.id` rather than the route param, which may be the
+ * opaque dockerId — only the donation id is what the terminate command takes.
+ */
+function ownerOnlyFallback(
+  reply: FastifyReply,
   orchestrator: HostProcessOrchestrator,
   id: string,
-  verb: string,
+  verb: 'start' | 'stop' | 'restart',
 ) {
-  if (!orchestrator.getNode(id)) {
-    return reply.code(404).send({
-      ok: false,
-      error: { code: 'not_found', message: `Unknown node: ${id}` },
-    });
-  }
+  const node = orchestrator.getNode(id);
+  if (!node) return notFound(reply, id);
   return notImplemented(
     reply,
-    `${verb} ${id}: only the owner node is start/restart-able here; generic donated-node lifecycle is owned by the donation surface — use POST /grants to provision and DELETE /grants/:id to terminate.`,
+    `${verb} ${id}: only the owner node can be started, stopped or restarted here; a donated node's lifecycle is owned by the donation surface — end it with 'cadre-host grant terminate ${node.id}' (DELETE /grants-admin/donations/${node.id}).`,
   );
 }
 
-function notImplemented(reply: import('fastify').FastifyReply, message: string) {
+function notFound(reply: FastifyReply, id: string) {
+  return reply.code(404).send({
+    ok: false,
+    error: { code: 'not_found', message: `Unknown node: ${id}` },
+  });
+}
+
+function notImplemented(reply: FastifyReply, message: string) {
   return reply.code(501).send({ ok: false, error: { code: 'not_implemented', message } });
 }
 
+function ownCadreDisabled(reply: FastifyReply, verb: 'start' | 'restart') {
+  return reply.code(409).send({
+    ok: false,
+    error: {
+      code: 'own_cadre_disabled',
+      message: `${verb} owner: this host's own cadre is turned off (donor-only mode). Set ownCadre.enabled in host.config.json and restart cadre-host to run it again.`,
+    },
+  });
+}
+
 /**
  * Read the last `n` lines from a log file by walking the tail in chunks.
  * Returns [] for a missing file.

package/src/server/routes/status.ts

@@ -20,8 +20,15 @@ import type { UpdateService } from '../../update/index.js';
 
 const PROCESS_STARTED_AT = process.hrtime.bigint();
 
+/**
+ * Which role the running process is in: `'founder'` also runs the host's own
+ * cadre (`ownCadre.enabled` at start), `'donor'` only donates nodes.
+ */
+export type HostRole = 'founder' | 'donor';
+
 export interface StatusRouteOptions {
   orchestrator: HostProcessOrchestrator;
+  role: HostRole;
   /** Present only when the host runs its own personal cadre (`ownCadre.enabled`). */
   trustCircle?: TrustCircleService;
   /** Present only when the host runs its own personal cadre (`ownCadre.enabled`). */
@@ -31,11 +38,18 @@ export interface StatusRouteOptions {
 
 export interface StatusResponse {
   service: { name: 'cadre-host'; version: string; uptimeSeconds: number };
+  /**
+   * Decided at start from `ownCadre.enabled` — the running process, not the file
+   * on disk, which may have been edited since without a restart.
+   */
+  role: HostRole;
   nodes: Array<{
     id: string;
     partyId: string;
     status: ManagedNodeInfo['status'];
     profile: ManagedNodeInfo['profile'];
+    /** Present (true) only on the host's own owner node; every other node is donated. */
+    owner?: true;
   }>;
   /** Omitted in donor-only mode (no host-own trust circle). */
   trustCircle?: { members: number; pending: number };
@@ -53,6 +67,7 @@ export function registerStatusRoute(app: FastifyInstance, opts: StatusRouteOptio
       partyId: n.partyId,
       status: n.status,
       profile: n.profile,
+      ...(n.owner ? { owner: true as const } : {}),
     }));
 
     const response: StatusResponse = {
@@ -61,6 +76,7 @@ export function registerStatusRoute(app: FastifyInstance, opts: StatusRouteOptio
         version,
         uptimeSeconds: secondsSince(PROCESS_STARTED_AT),
       },
+      role: opts.role,
       nodes,
     };
 

package/dist/donation/__tests__/fake-orchestrator.d.ts

@@ -1,103 +0,0 @@
-/**
- * Shared fake orchestrator for the donation unit tests — no real child
- * processes. Records every create / stop / remove, hands out deterministic
- * unique spawn results, and tracks per-`dockerId` liveness so a test can crash
- * one node and let the supervisor observe exactly that one as down.
- *
- * This file holds no tests of its own; its contract is pinned by the sibling
- * `fake-orchestrator.test.ts`, which exists so a future agent cannot make a
- * failing donation test go green by relaxing the fake.
- */
-import type { Orchestrator, OrchestratorCreateRequest, OrchestratorCreateResult, OrchestratorStats } from '@serfab/cadre-provider';
-import type { ManagedNodeInfo, NodeStateListener } from '../../orchestrator/types.js';
-/**
- * Mirrors the parts of `HostProcessOrchestrator`'s handle lifecycle the donation
- * code depends on:
- *
- * - a **successful** `createContainer` drops every prior handle for the same
- *   `containerId` (the real `dropStaleHandle`), so an old `dockerId` stops
- *   resolving the moment its container re-spawns;
- * - a **failed** `createContainer` leaves those handles exactly as it found them
- *   (the real `restoreDroppedHandles`);
- * - `stopContainer` / `removeContainer` throw `Container not found: <dockerId>`
- *   for a handle this orchestrator no longer knows (the real `requireHandle`);
- * - `reclaimWorkdir` refuses a containerId that still resolves to a live
- *   handle (the real guard — that directory belongs to `removeContainer`).
- *
- * Consequently `stopped` / `removed` mean **"handles this orchestrator actually
- * acted on"**, not "calls attempted" — a stop aimed at a dropped handle is
- * rejected and never appears. `onStop` still fires for those rejected calls, so
- * a test can observe the attempt separately from its outcome.
- */
-export declare class FakeOrchestrator implements Orchestrator {
-    createCalls: OrchestratorCreateRequest[];
-    stopped: string[];
-    removed: string[];
-    /**
-     * Container ids whose workdir this orchestrator actually removed. Same
-     * "acted on, not attempted" rule as `stopped` / `removed`: a refused reclaim
-     * leaves no entry.
-     */
-    reclaimedWorkdirs: string[];
-    failCreate: boolean;
-    createDelayMs: number;
-    /**
-     * Observation hook — lets a test inspect the world as the stop happens. Fires
-     * even when the handle is unknown and the stop is then rejected.
-     */
-    onStop?: (dockerId: string) => void;
-    /**
-     * Observation hook — fires before the spawn resolves or fails, modelling the
-     * real class's *pre-drop* `await` window (`ensureNodeIdentity`, `resolvePush`).
-     * Work driven from here sees the previous handle still alive. Contrast
-     * {@link onSpawned}.
-     */
-    onCreate?: (request: OrchestratorCreateRequest) => void;
-    /**
-     * Observation hook — fires once the drop has landed and the new child is
-     * registered, immediately before `createContainer` resolves. Models the
-     * microtask gap between the real `createContainer` returning and its caller's
-     * `await` resuming: the real drop → launch → return runs synchronously, so
-     * this is the earliest point other code can observe the post-drop world.
-     * Contrast {@link onCreate}.
-     */
-    onSpawned?: (dockerId: string) => void;
-    /** Observation hook — fires before the liveness answer is computed. */
-    onIsRunning?: (dockerId: string) => void;
-    private readonly children;
-    private readonly listeners;
-    private counter;
-    createContainer(request: OrchestratorCreateRequest): Promise<OrchestratorCreateResult>;
-    stopContainer(dockerId: string): Promise<void>;
-    removeContainer(dockerId: string): Promise<void>;
-    /**
-     * NOTE: this and {@link getLogs} take an unknown `dockerId` where the real
-     * class throws (`requireHandle`). No donation path calls either, so the gap is
-     * unobservable — route them through `requireChild` if one starts to.
-     */
-    getStats(): Promise<OrchestratorStats>;
-    /** Unknown handles read as not running, matching the real orchestrator. */
-    isRunning(dockerId: string): Promise<boolean>;
-    /** Resolve a spawn's friendly containerId back to its dockerId. */
-    resolveDockerId(containerId: string): string | undefined;
-    /**
-     * Remove the workdir of a container no handle owns, mirroring the real
-     * `reclaimWorkdir`. Refuses (returns `false`, records nothing) while a child
-     * for that containerId still resolves — that directory belongs to
-     * `removeContainer`, which stops the child first.
-     *
-     * There is no directory here to check for existence, so a first reclaim of an
-     * unresolvable id always reports `true`; the real class returns `false` when
-     * the path is already gone. Nothing in the donation layer branches on the
-     * return value, so the gap is unobservable — model it if one starts to.
-     */
-    reclaimWorkdir(containerId: string): boolean;
-    getLogs(): Promise<string>;
-    onStateChange(listener: NodeStateListener): () => void;
-    /** Kill a child out from under the host — the crash the supervisor exists for. */
-    crash(dockerId: string): void;
-    /** Emit an arbitrary state change (e.g. the owner node stopping). */
-    emit(info: ManagedNodeInfo): void;
-    /** Mirrors `HostProcessOrchestrator.requireHandle` — unknown handles throw. */
-    private requireChild;
-}

package/dist/donation/__tests__/fake-orchestrator.js

@@ -1,180 +0,0 @@
-/**
- * Shared fake orchestrator for the donation unit tests — no real child
- * processes. Records every create / stop / remove, hands out deterministic
- * unique spawn results, and tracks per-`dockerId` liveness so a test can crash
- * one node and let the supervisor observe exactly that one as down.
- *
- * This file holds no tests of its own; its contract is pinned by the sibling
- * `fake-orchestrator.test.ts`, which exists so a future agent cannot make a
- * failing donation test go green by relaxing the fake.
- */
-function sleep(ms) {
-    return new Promise((res) => setTimeout(res, ms));
-}
-/**
- * Mirrors the parts of `HostProcessOrchestrator`'s handle lifecycle the donation
- * code depends on:
- *
- * - a **successful** `createContainer` drops every prior handle for the same
- *   `containerId` (the real `dropStaleHandle`), so an old `dockerId` stops
- *   resolving the moment its container re-spawns;
- * - a **failed** `createContainer` leaves those handles exactly as it found them
- *   (the real `restoreDroppedHandles`);
- * - `stopContainer` / `removeContainer` throw `Container not found: <dockerId>`
- *   for a handle this orchestrator no longer knows (the real `requireHandle`);
- * - `reclaimWorkdir` refuses a containerId that still resolves to a live
- *   handle (the real guard — that directory belongs to `removeContainer`).
- *
- * Consequently `stopped` / `removed` mean **"handles this orchestrator actually
- * acted on"**, not "calls attempted" — a stop aimed at a dropped handle is
- * rejected and never appears. `onStop` still fires for those rejected calls, so
- * a test can observe the attempt separately from its outcome.
- */
-export class FakeOrchestrator {
-    constructor() {
-        this.createCalls = [];
-        this.stopped = [];
-        this.removed = [];
-        /**
-         * Container ids whose workdir this orchestrator actually removed. Same
-         * "acted on, not attempted" rule as `stopped` / `removed`: a refused reclaim
-         * leaves no entry.
-         */
-        this.reclaimedWorkdirs = [];
-        this.failCreate = false;
-        this.createDelayMs = 0;
-        this.children = new Map();
-        this.listeners = new Set();
-        this.counter = 0;
-    }
-    async createContainer(request) {
-        this.createCalls.push(request);
-        this.onCreate?.(request);
-        if (this.createDelayMs)
-            await sleep(this.createDelayMs);
-        if (this.failCreate)
-            throw new Error('spawn boom');
-        // Drop the prior handles for this container, mirroring `dropStaleHandle`.
-        // Success-only, and placed here on purpose: the real drop happens after the
-        // spawn's every `await` and cannot fail afterwards, and a create that throws
-        // puts the handles back (`restoreDroppedHandles`) — so a failed create must
-        // leave them untouched. `DonationSupervisor`'s give-up test depends on that.
-        for (const [id, child] of this.children) {
-            if (child.containerId === request.containerId)
-                this.children.delete(id);
-        }
-        const n = ++this.counter;
-        const dockerId = `dock_${n}`;
-        this.children.set(dockerId, {
-            containerId: request.containerId,
-            partyId: request.partyId,
-            profile: request.profile,
-            running: true,
-        });
-        this.onSpawned?.(dockerId);
-        return {
-            dockerId,
-            healthEndpoint: `http://127.0.0.1:${9000 + n}/health`,
-            metricsEndpoint: `http://127.0.0.1:${9000 + n}/metrics`,
-            seedEndpoint: `http://127.0.0.1:${9000 + n}/seed`,
-            seedToken: `seed-token-${n}`,
-            p2pPort: 4000 + n,
-        };
-    }
-    async stopContainer(dockerId) {
-        // Before the check: a test may want to observe that a stop was *attempted*
-        // even when this orchestrator rejects it.
-        this.onStop?.(dockerId);
-        const child = this.requireChild(dockerId);
-        this.stopped.push(dockerId);
-        child.running = false;
-    }
-    async removeContainer(dockerId) {
-        // NOTE: the real `removeContainer` stops a still-live child first; this one
-        // only deletes, so a remove aimed at a running child records no `stopped`
-        // entry and emits no state change. Every donation caller stops before it
-        // reclaims, so nothing sees the difference today — if one stops doing that,
-        // stop the child here too.
-        this.requireChild(dockerId);
-        this.removed.push(dockerId);
-        this.children.delete(dockerId);
-    }
-    /**
-     * NOTE: this and {@link getLogs} take an unknown `dockerId` where the real
-     * class throws (`requireHandle`). No donation path calls either, so the gap is
-     * unobservable — route them through `requireChild` if one starts to.
-     */
-    async getStats() {
-        return { cpuPercent: 0, memoryBytes: 0, networkRxBytes: 0, networkTxBytes: 0 };
-    }
-    /** Unknown handles read as not running, matching the real orchestrator. */
-    async isRunning(dockerId) {
-        this.onIsRunning?.(dockerId);
-        return this.children.get(dockerId)?.running ?? false;
-    }
-    /** Resolve a spawn's friendly containerId back to its dockerId. */
-    resolveDockerId(containerId) {
-        for (const [dockerId, child] of this.children) {
-            if (child.containerId === containerId)
-                return dockerId;
-        }
-        return undefined;
-    }
-    /**
-     * Remove the workdir of a container no handle owns, mirroring the real
-     * `reclaimWorkdir`. Refuses (returns `false`, records nothing) while a child
-     * for that containerId still resolves — that directory belongs to
-     * `removeContainer`, which stops the child first.
-     *
-     * There is no directory here to check for existence, so a first reclaim of an
-     * unresolvable id always reports `true`; the real class returns `false` when
-     * the path is already gone. Nothing in the donation layer branches on the
-     * return value, so the gap is unobservable — model it if one starts to.
-     */
-    reclaimWorkdir(containerId) {
-        if (this.resolveDockerId(containerId))
-            return false;
-        this.reclaimedWorkdirs.push(containerId);
-        return true;
-    }
-    async getLogs() {
-        return '';
-    }
-    onStateChange(listener) {
-        this.listeners.add(listener);
-        return () => { this.listeners.delete(listener); };
-    }
-    /** Kill a child out from under the host — the crash the supervisor exists for. */
-    crash(dockerId) {
-        const child = this.children.get(dockerId);
-        if (!child?.running)
-            return;
-        child.running = false;
-        this.emit(toNodeInfo(dockerId, child));
-    }
-    /** Emit an arbitrary state change (e.g. the owner node stopping). */
-    emit(info) {
-        for (const listener of this.listeners)
-            listener(info);
-    }
-    /** Mirrors `HostProcessOrchestrator.requireHandle` — unknown handles throw. */
-    requireChild(dockerId) {
-        const child = this.children.get(dockerId);
-        if (!child)
-            throw new Error(`Container not found: ${dockerId}`);
-        return child;
-    }
-}
-function toNodeInfo(dockerId, child) {
-    return {
-        id: child.containerId,
-        dockerId,
-        partyId: child.partyId,
-        profile: child.profile,
-        status: child.running ? 'running' : 'stopped',
-        spawnedAt: new Date(0).toISOString(),
-        workdir: `/fake/${child.containerId}`,
-        ports: { health: 0, metrics: 0, p2p: 0, admin: 0, ws: 0 },
-    };
-}
-//# sourceMappingURL=fake-orchestrator.js.map

package/dist/donation/__tests__/fake-orchestrator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fake-orchestrator.js","sourceRoot":"","sources":["../../../src/donation/__tests__/fake-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAUD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACE,gBAAW,GAAgC,EAAE,CAAC;QAC9C,YAAO,GAAa,EAAE,CAAC;QACvB,YAAO,GAAa,EAAE,CAAC;QACvB;;;;WAIG;QACH,sBAAiB,GAAa,EAAE,CAAC;QACjC,eAAU,GAAG,KAAK,CAAC;QACnB,kBAAa,GAAG,CAAC,CAAC;QAyBD,aAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;QACxC,cAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;QAClD,YAAO,GAAG,CAAC,CAAC;IA0HtB,CAAC;IAxHC,KAAK,CAAC,eAAe,CAAC,OAAkC;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,cAAc,EAAE,oBAAoB,IAAI,GAAG,CAAC,SAAS;YACrD,eAAe,EAAE,oBAAoB,IAAI,GAAG,CAAC,UAAU;YACvD,YAAY,EAAE,oBAAoB,IAAI,GAAG,CAAC,OAAO;YACjD,SAAS,EAAE,cAAc,CAAC,EAAE;YAC5B,OAAO,EAAE,IAAI,GAAG,CAAC;SAClB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,2EAA2E;QAC3E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,2BAA2B;QAC3B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,KAAK,CAAC;IACvD,CAAC;IAED,mEAAmE;IACnE,eAAe,CAAC,WAAmB;QACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,QAAQ,CAAC;QACzD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,cAAc,CAAC,WAAmB;QAChC,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,aAAa,CAAC,QAA2B;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,QAAgB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO;QAC5B,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC,IAAqB;QACxB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,+EAA+E;IACvE,YAAY,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,KAAgB;IACpD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,WAAW;QACrB,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,SAAS,KAAK,CAAC,WAAW,EAAE;QACrC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;KAC1D,CAAC;AACJ,CAAC"}