@tokenbuddy/tb-admin 1.0.13 → 1.0.15

package/tests/admin.test.ts

@@ -1,10 +1,19 @@
 import { ConfigManager } from "../src/config.js";
 import { buildAdminCli } from "../src/cli.js";
-import { FlyProvider } from "../src/server-cmd.js";
+import { FlyProvider, parseFlyMachineIds, requirePublishedDockerImage } from "../src/server-cmd.js";
+import { startAdminUiServer } from "../src/ui-server.js";
+import { AdminUiState } from "../src/ui-state.js";
+import { UiActions, type UiActionResult } from "../src/ui-actions.js";
+import { adminUiHtml } from "../src/ui-static.js";
+import {
+  BalanceProbeCache,
+  probeUpstreamBalance
+} from "../src/upstream-balance-probe.js";
 import {
   validateRegistryDocument
 } from "../src/bootstrap-registry.js";
 import * as fs from "fs";
+import * as http from "http";
 import * as path from "path";
 
 const TEMP_CONF_PATH = path.resolve(__dirname, "../../data-test/admin-config.json");
@@ -67,6 +76,8 @@ describe("Admin CLI Config Profile Management Tests", () => {
     const sellerConfig = program.commands.find((command) => command.name() === "seller-config");
     const payments = program.commands.find((command) => command.name() === "payments");
     const upstreams = program.commands.find((command) => command.name() === "upstreams");
+    const models = program.commands.find((command) => command.name() === "models");
+    const ui = program.commands.find((command) => command.name() === "ui");
 
     expect(bootstrap).toBeDefined();
     expect(sellers).toBeDefined();
@@ -78,6 +89,11 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(sellerConfig?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
     expect(sellerConfig?.commands.find((command) => command.name() === "validate")?.options.some((option) => option.long === "--file")).toBe(true);
     expect(upstreams).toBeDefined();
+    expect(ui).toBeDefined();
+    expect(ui?.options.find((option) => option.long === "--host")?.defaultValue).toBe("127.0.0.1");
+    expect(ui?.options.find((option) => option.long === "--port")?.defaultValue).toBe(17822);
+    expect(models).toBeDefined();
+    expect(models?.options.some((option) => option.long === "--json")).toBe(true);
     expect(upstreams?.commands.map((command) => command.name()).sort()).toEqual(["get", "refresh", "update"]);
     expect(upstreams?.commands.find((command) => command.name() === "update")?.options.some((option) => option.long === "--upstream-url")).toBe(true);
     expect(upstreams?.commands.find((command) => command.name() === "refresh")?.options.some((option) => option.long === "--auto-models")).toBe(true);
@@ -90,7 +106,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
     ]);
   });
 
-  test("seller Fly deploy commands require explicit image and fly config", () => {
+  test("seller Fly commands separate create config from deploy image updates", () => {
     const program = buildAdminCli(new ConfigManager(TEMP_CONF_PATH));
     const seller = program.commands.find((command) => command.name() === "seller");
     const create = seller?.commands.find((command) => command.name() === "create");
@@ -100,8 +116,9 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(deploy).toBeDefined();
     expect(create?.options.some((option) => option.long === "--fly-config" && option.required)).toBe(true);
     expect(create?.options.some((option) => option.long === "--image" && option.required)).toBe(true);
+    expect(create?.options.some((option) => option.long === "--initial-config")).toBe(true);
     expect(create?.options.some((option) => option.long === "--config")).toBe(false);
-    expect(deploy?.options.some((option) => option.long === "--fly-config" && option.required)).toBe(true);
+    expect(deploy?.options.some((option) => option.long === "--fly-config")).toBe(false);
     expect(deploy?.options.some((option) => option.long === "--image" && option.required)).toBe(true);
     expect(deploy?.options.some((option) => option.long === "--config")).toBe(false);
 
@@ -117,7 +134,50 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(() => provider.deploySeller({
       app: "tbs-test",
       dryRun: true
-    })).toThrow("seller deploy requires --fly-config");
+    })).toThrow("seller deploy requires --image");
+
+    expect(provider.deploySeller({
+      app: "tbs-test",
+      image: "registry.fly.io/tb-seller:1.0.13",
+      dryRun: true
+    })).toContain("Volumes: unchanged");
+  });
+
+  test("seller create checks the published image before creating Fly resources", () => {
+    expect(() => requirePublishedDockerImage("registry.fly.io/tb-seller:missing", () => ({
+      ok: false,
+      error: "not found"
+    }))).toThrow("No Fly app was created");
+
+    const commands: string[] = [];
+    const provider = new FlyProvider(undefined, {
+      checkFlyctlInstalled: () => true,
+      imageInspector: () => ({ ok: false, error: "not found" }),
+      execSync: (command) => {
+        commands.push(command);
+        return "";
+      }
+    });
+
+    expect(() => provider.createSeller({
+      name: "tbs-test",
+      app: "tbs-test",
+      image: "registry.fly.io/tb-seller:missing",
+      flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+      operatorSecret: "operator-secret"
+    })).toThrow("seller image is not published or is not accessible");
+
+    expect(commands).toEqual([]);
+  });
+
+  test("parseFlyMachineIds reads machine ids and rejects unusable machine lists", () => {
+    expect(parseFlyMachineIds(JSON.stringify([
+      { id: "machine-1" },
+      { id: "machine-2" }
+    ]), "tbs-test")).toEqual(["machine-1", "machine-2"]);
+
+    expect(() => parseFlyMachineIds("{", "tbs-test")).toThrow("invalid JSON");
+    expect(() => parseFlyMachineIds("[]", "tbs-test")).toThrow("has no machines");
   });
 
   test("bootstrap registry validation accepts demo config and rejects unsafe variants", () => {
@@ -139,4 +199,833 @@ describe("Admin CLI Config Profile Management Tests", () => {
     badDefault.defaultSeller = "missing";
     expect(() => validateRegistryDocument(badDefault)).toThrow("defaultSeller `missing`");
   });
+
+  test("tb-admin ui server binds loopback, protects APIs with a session, and serves bootstrap data", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    const started = await startAdminUiServer({
+      host: "127.0.0.1",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async () => ({
+        version: 7,
+        sellers: [{
+          id: "tbs-sin-06",
+          name: "tbs-sin-06",
+          url: "https://seller.example.test",
+          status: "active",
+          region: "sin",
+          supportedProtocols: ["responses"],
+          paymentMethods: ["clawtip"]
+        }]
+      })
+    });
+    try {
+      await expect(fetch(`${started.url.replace(/\?.*/, "")}api/bootstrap`).then((res) => res.status)).resolves.toBe(401);
+      const response = await fetch(`${started.url.replace(/\?.*/, "")}api/bootstrap`, {
+        headers: { "X-TokenBuddy-Ui-Session": started.sessionToken }
+      });
+      await expect(response.json()).resolves.toMatchObject({
+        status: "available",
+        registryVersion: 7,
+        sellerEntries: 1,
+        regions: ["sin"]
+      });
+    } finally {
+      await new Promise<void>((resolve) => started.server.close(() => resolve()));
+    }
+
+    await expect(startAdminUiServer({
+      host: "0.0.0.0",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr
+    })).rejects.toThrow("loopback");
+  });
+
+  test("tb-admin ui create seller returns a progress job", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-token-value" });
+    const calls: string[][] = [];
+    const started = await startAdminUiServer({
+      host: "127.0.0.1",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url) => createSellerFetchJson(url),
+      commandRunner: async (args): Promise<UiActionResult> => {
+        if (isBootstrapSellersValidate(args)) {
+          const filePath = args[args.indexOf("--file") + 1];
+          const doc = JSON.parse(fs.readFileSync(filePath, "utf8")) as { sellers: Array<{ id: string; status?: string }> };
+          expect(doc.sellers.find((seller) => seller.id === "tbs-nrt-07")?.status).toBe("pending");
+        }
+        calls.push(args);
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+    try {
+      const response = await fetch(`${started.url.replace(/\?.*/, "")}api/sellers`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-TokenBuddy-Ui-Session": started.sessionToken
+        },
+        body: JSON.stringify({
+          sellerName: "tbs-nrt-07",
+          app: "tbs-nrt-07",
+          region: "nrt",
+          image: "registry.fly.io/tb-seller:latest",
+          upstreamWebsite: "https://openrouter.ai",
+          upstreamUrl: "https://openrouter.ai/api/v1",
+          upstreamApiKey: "fixture-upstream-key",
+          upstreamBalanceProbeTemplate: "openrouter",
+          upstreamBalanceProbeUrl: "https://openrouter.ai/api/v1/credits",
+          upstreamBalanceProbeRechargeUrl: "https://openrouter.ai/settings/credits",
+          maxConnections: 8,
+          maxQueueDepth: 4,
+          markupRatio: 1.2,
+          discountRatio: 1,
+          paymentMethods: ["clawtip", "mock"],
+          clawtipPayTo: "pay-to-seller",
+          clawtipSm4KeyBase64: "0123456789abcdef012345==",
+          clawtipSkillSlug: "tokenbuddy-seller",
+          clawtipSkillId: "si-tokenbuddy-seller",
+          clawtipDescription: "TokenBuddy Seller",
+          clawtipResourceUrl: "https://tbs-nrt-07.fly.dev",
+          clawtipActivationFeeFen: 1,
+          clawtipMicrosPerFen: 10000,
+          flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+        })
+      });
+      expect(response.status).toBe(202);
+      const created = await response.json() as { jobId: string };
+      expect(created.jobId).toBeTruthy();
+
+      let job: any;
+      for (let attempt = 0; attempt < 20; attempt += 1) {
+        const poll = await fetch(`${started.url.replace(/\?.*/, "")}api/jobs/${created.jobId}`, {
+          headers: { "X-TokenBuddy-Ui-Session": started.sessionToken }
+        });
+        job = await poll.json();
+        if (job.status !== "running") {
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+
+      expect(job.status).toBe("succeeded");
+      expect(job.events.map((event: any) => event.stepId)).toEqual([
+        "check_registry",
+        "validate_config",
+        "create_deployment",
+        "wait_seller",
+        "apply_config",
+        "refresh_models",
+        "publish_registry"
+      ]);
+      expect(job.events.find((event: any) => event.stepId === "validate_config").message).toContain("https://openrouter.ai/api");
+      expect(JSON.stringify(job)).not.toContain("fixture-upstream-key");
+      expect(JSON.stringify(job)).not.toContain("0123456789abcdef012345==");
+      expect(JSON.stringify(job)).not.toContain("operator-token-value");
+      const commandLines = calls.map((args) => args.join(" "));
+      expect(commandLines).toEqual([
+        expect.stringContaining("seller-config validate --file"),
+        expect.stringContaining("seller create tbs-nrt-07"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value status"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value seller-config put --file"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value upstreams refresh --auto-models"),
+        expect.stringContaining("bootstrap sellers validate --file"),
+        expect.stringContaining("bootstrap sellers put --file")
+      ]);
+      expect(commandLines.find((line) => line.includes("seller create tbs-nrt-07"))).toContain("--initial-config");
+    } finally {
+      await new Promise<void>((resolve) => started.server.close(() => resolve()));
+    }
+  });
+
+  test("AdminUiState reads seller list from bootstrap registry and masks seller detail API keys", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setProfile("seller-sin", { url: fixture.baseUrl, token: "seller-token" });
+
+      const state = new AdminUiState({
+        configManager: mgr,
+        profile: "bootstrap",
+        balanceFetch: async (url, init) => {
+          expect(String(url)).toBe("https://openrouter.ai/api/v1/credits");
+          expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-live-key-27f9");
+          return jsonResponse({ data: { total_credits: 50, total_usage: 2.05 } });
+        }
+      });
+      const sellers = await state.sellers();
+      expect(sellers).toHaveLength(1);
+      expect(sellers[0]).toMatchObject({
+        id: "tbs-sin-06",
+        upstreamDomain: "openrouter.ai",
+        capacityUsed: 3,
+        capacityLimit: 8,
+        ttftMs: 321,
+        avgInferenceMs: 640,
+        lastInferenceMs: 700,
+        latencySamples: 2,
+        upstreamStatus: "healthy",
+        upstreamBalance: "USD 47.95",
+        upstreamBalanceSource: "openrouter"
+      });
+
+      const detail = await state.sellerDetail("tbs-sin-06");
+      expect(detail.configuration.upstreamApiKeyMasked).toBe("**** **** **** 27f9");
+      expect(detail.configuration.upstreamBalance).toBe("USD 47.95");
+      expect(detail.configuration.upstreamBalanceSource).toBe("openrouter");
+      expect(detail.configuration.upstreamBalanceProbeTemplate).toBe("openrouter");
+      expect(detail.configuration.upstreamBalanceProbeUrl).toBe("https://openrouter.ai/api/v1/credits");
+      expect(detail.configuration.upstreamBalanceProbeRechargeUrl).toBe("https://openrouter.ai/settings/credits");
+      expect(JSON.stringify(detail)).not.toContain("fixture-live-key");
+      expect(detail.models[0]).toMatchObject({
+        upstreamModel: "openai/gpt-5.4",
+        billingModel: "gpt-5.4"
+      });
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("admin UI seller rows render missing telemetry without unknown data labels", () => {
+    const html = adminUiHtml();
+    expect(html).toContain("class=\"spinner\"");
+    expect(html).toContain("@keyframes spin");
+    expect(html).toContain("role=\"status\" aria-label=\"Loading sellers\"");
+    expect(html).toContain("id=\"createStatus\" class=\"status-line hidden\"");
+    expect(html).toContain("id=\"createProgress\"");
+    expect(html).toContain("create-progress");
+    expect(html).toContain("progress-step");
+    expect(html).toContain("progress-log");
+    expect(html).toContain("currentCreateJob");
+    expect(html).toContain("setCreateFormDisabled(true)");
+    expect(html).toContain("setCreateFormDisabled(false)");
+    expect(html).toContain("data-progress-step");
+    expect(html).toContain("aria-expanded");
+    expect(html).toContain("progress-title");
+    expect(html).toContain("Show details");
+    expect(html).toContain("Hide details");
+    expect(html).toContain("/api/jobs/");
+    expect(html).toContain("function uiErrorMessage");
+    expect(html).toContain("Admin UI connection lost. Reopen the latest tb-admin UI URL and reload this page.");
+    expect(html).toContain("Admin UI session expired. Reopen the latest tb-admin UI URL.");
+    expect(html).toContain("renderCreateJob");
+    expect(html).toContain("pollCreateJob");
+    expect(html).toContain("Created and published to bootstrap registry.");
+    expect(html).toContain("upstreamUrl:\"https://openrouter.ai/api/v1\"");
+    expect(html).toContain("loadingSpinner(\"Loading sellers\")");
+    expect(html).toContain("loadingSpinner(\"Loading configuration\")");
+    expect(html).toContain("loadingSpinner(\"Loading models\")");
+    expect(html).toContain("sellerRefreshIntervalMs = 30000");
+    expect(html).toContain("Last updated: never");
+    expect(html).toContain("function scheduleSellerRefresh()");
+    expect(html).toContain("sellerNextRefreshAt = new Date(Date.now() + sellerRefreshIntervalMs)");
+    expect(html).toContain("sellerRefreshTimer = setTimeout(() => loadSellers(), sellerRefreshIntervalMs)");
+    expect(html).toContain("Next refresh: ");
+    expect(html).toContain("s ago");
+    expect(html).toContain("sellerClockTimer = setInterval(() => updateSellerRefreshMeta(sellerRefreshInFlight), 1000)");
+    expect(html).toContain("function renderSellerRows(rows)");
+    expect(html).toContain("sellerLastUpdatedAt = new Date()");
+    expect(html).toContain("readonly-value");
+    expect(html).toContain("--seller-grid");
+    expect(html).toContain("grid-template-columns:var(--seller-grid)");
+    expect(html).toContain("#sellerRows{display:grid;gap:10px;width:100%;min-width:0}");
+    expect(html).toContain("gap:12px;width:100%;min-width:0");
+    expect(html).toContain("detailFieldsHtml");
+    expect(html).toContain("data-original");
+    expect(html).toContain("Latency");
+    expect(html).toContain("avg n/a");
+    expect(html).toContain("Avg infer");
+    expect(html).toContain("Samples");
+    expect(html).toContain("lastInferenceMs");
+    expect(html).toContain("upstreamBalanceSource");
+    expect(html).toContain("upstreamBalanceFetchedAt");
+    expect(html).toContain("upstreamBalanceError");
+    expect(html).toContain("upstreamBalanceProbeTemplate");
+    expect(html).toContain("upstreamBalanceProbeUrl");
+    expect(html).toContain("upstreamBalanceProbeUserId");
+    expect(html).toContain("upstreamBalanceProbeRechargeUrl");
+    expect(html).toContain("paymentMethods");
+    expect(html).toContain("payment-tabs");
+    expect(html).toContain("payment-tab");
+    expect(html).toContain("payment-panel");
+    expect(html).toContain("pill-switch");
+    expect(html).toContain("data-payment-tab");
+    expect(html).toContain("data-payment-panel");
+    expect(html).toContain("data-payment-toggle");
+    expect(html).toContain("enabledPaymentMethods()");
+    expect(html).toContain("setupPaymentTabs()");
+    expect(html).toContain("togglePaymentMethod");
+    expect(html).toContain("selectPaymentTab");
+    expect(html).toContain("updatePaymentPanels");
+    expect(html).toContain("data-enabled");
+    expect(html).toContain("aria-pressed");
+    expect(html).toContain("启用即可使用 mock 支付方式，无需额外参数");
+    expect(html).toContain("required-star");
+    expect(html).toContain("Seller name");
+    expect(html).toContain("tbs-<seller-name>-<random>");
+    expect(html).toContain("Fly app name");
+    expect(html).toContain("Seller image");
+    expect(html).toContain("Fly config file");
+    expect(html).toContain("Balance probe URL (auto from template)");
+    expect(html).toContain("Recharge URL");
+    expect(html).toContain("randomAppSuffix");
+    expect(html).toContain("updateGeneratedCreateFields");
+    expect(html).toContain("appNameFromSellerName");
+    expect(html).toContain("balanceProbeUrlForTemplate");
+    expect(html).toContain("data-generated-summary=\"clawtip\"");
+    expect(html).toContain("clawtipPayTo");
+    expect(html).toContain("clawtipSm4KeyBase64");
+    expect(html).toContain("clawtipSkillSlug");
+    expect(html).toContain("clawtipSkillId");
+    expect(html).toContain("clawtipDescription");
+    expect(html).toContain("clawtipResourceUrl");
+    expect(html).toContain("clawtipActivationFeeFen");
+    expect(html).toContain("clawtipMicrosPerFen");
+    expect(html).toContain("not reported");
+    expect(html).toContain("aria-label=\"Seller specs\"");
+    expect(html).toContain("<svg viewBox=\"0 0 24 24\"");
+    expect(html).not.toContain(">i</span>");
+    expect(html).not.toContain(">×</button>");
+    expect(html).not.toContain("Loading sellers...");
+    expect(html).not.toContain("Loading seller data...");
+    expect(html).not.toContain("Loading configuration...");
+    expect(html).not.toContain("Loading models...");
+    expect(html).not.toContain("<div id=\"createStatus\" class=\"status-line\">Ready</div>");
+    expect(html).not.toContain("not set");
+    expect(html).not.toContain("tok/s");
+    expect(html).not.toContain(" multiple");
+  });
+
+  test("UiActions validates then puts seller config without shell command strings", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setProfile("seller-sin", { url: fixture.baseUrl, token: "seller-token" });
+      const calls: string[][] = [];
+      const actions = new UiActions({
+        configManager: mgr,
+        profile: "bootstrap",
+        commandRunner: async (args): Promise<UiActionResult> => {
+          calls.push(args);
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const result = await actions.updateSellerConfig("tbs-sin-06", {
+        markupRatio: 1.4,
+        upstreamApiKey: "new-secret"
+      });
+
+      expect(result.ok).toBe(true);
+      expect(calls).toHaveLength(2);
+      expect(calls[0]).toContain("validate");
+      expect(calls[1]).toContain("put");
+      expect(calls.flat()).not.toContain("seller-config validate");
+      expect(calls[0]).toContain("--profile");
+      expect(calls[0]).toContain("seller-sin");
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("probeUpstreamBalance parses OpenRouter balance and caches failed probes", async () => {
+    const cache = new BalanceProbeCache();
+    let calls = 0;
+    const openRouter = await probeUpstreamBalance({
+      upstreamUrl: "https://openrouter.ai/api",
+      upstreamBalanceUrl: "https://openrouter.ai/api/v1/credits",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 1000,
+      cache,
+      fetch: async (url, init) => {
+        calls += 1;
+        expect(String(url)).toBe("https://openrouter.ai/api/v1/credits");
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-key");
+        return jsonResponse({ data: { total_credits: 50, total_usage: 2.05 } });
+      }
+    });
+
+    expect(openRouter).toMatchObject({
+      source: "openrouter",
+      rawAmount: 47.95,
+      amountUsdMicros: 47950000,
+      currency: "USD"
+    });
+    expect(calls).toBe(1);
+
+    const firstFailure = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/api/user/quota",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 2000,
+      cache,
+      fetch: async () => {
+        calls += 1;
+        return jsonResponse({ success: false });
+      }
+    });
+    const cachedFailure = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/api/user/quota",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 3000,
+      cache,
+      fetch: async () => {
+        throw new Error("cache miss");
+      }
+    });
+
+    expect(firstFailure.error?.message).toBe("missing upstreamUserId for newapi upstream");
+    expect(cachedFailure).toBe(firstFailure);
+    expect(calls).toBe(1);
+  });
+
+  test("probeUpstreamBalance sends New-Api-User for generic newapi balances", async () => {
+    const snapshot = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/api/user/quota",
+      upstreamApiKey: "fixture-key",
+      upstreamUserId: "12345"
+    }, {
+      now: () => 4000,
+      fetch: async (url, init) => {
+        expect(String(url)).toBe("https://custom-upstream.example/api/user/quota");
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-key");
+        expect((init?.headers as Record<string, string>)?.["New-Api-User"]).toBe("12345");
+        return jsonResponse({ success: true, data: { quota: 50000000, used_quota: 1250000 } });
+      }
+    });
+
+    expect(snapshot).toMatchObject({
+      source: "newapi_generic",
+      rawAmount: 97.5,
+      amountUsdMicros: 97500000,
+      currency: "USD"
+    });
+  });
+
+  test("probeUpstreamBalance parses generic /v1/usage balances without user id", async () => {
+    const snapshot = await probeUpstreamBalance({
+      upstreamUrl: "https://code.shoestravel.xin",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 5000,
+      fetch: async (url, init) => {
+        expect(String(url)).toBe("https://code.shoestravel.xin/v1/usage");
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-key");
+        expect((init?.headers as Record<string, string>)?.["New-Api-User"]).toBeUndefined();
+        return jsonResponse({
+          balance: 37.96221984,
+          isValid: true,
+          remaining: 37.96221984,
+          unit: "USD"
+        });
+      }
+    });
+
+    expect(snapshot).toMatchObject({
+      source: "usage_generic",
+      rawAmount: 37.96221984,
+      amountUsdMicros: 37962220,
+      currency: "USD"
+    });
+  });
+
+  test("probeUpstreamBalance honors explicit balance probe templates", async () => {
+    const newApi = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamApiKey: "fixture-key",
+      upstreamBalanceProbe: {
+        template: "newapi_generic",
+        url: "https://custom-upstream.example/api/user/self",
+        userId: "67890"
+      }
+    }, {
+      now: () => 7000,
+      fetch: async (url, init) => {
+        expect(String(url)).toBe("https://custom-upstream.example/api/user/self");
+        expect((init?.headers as Record<string, string>)?.["New-Api-User"]).toBe("67890");
+        return jsonResponse({ success: true, data: { quota: 1000000, used_quota: 500000 } });
+      }
+    });
+
+    expect(newApi).toMatchObject({
+      source: "newapi_generic",
+      rawAmount: 1,
+      amountUsdMicros: 1000000,
+      currency: "USD"
+    });
+
+    const usage = await probeUpstreamBalance({
+      upstreamUrl: "https://code.shoestravel.xin/v1",
+      upstreamApiKey: "fixture-key",
+      upstreamBalanceProbe: {
+        template: "usage_generic"
+      }
+    }, {
+      now: () => 8000,
+      fetch: async (url) => {
+        expect(String(url)).toBe("https://code.shoestravel.xin/v1/usage");
+        return jsonResponse({ remaining: 37.96221984, unit: "USD", isValid: true });
+      }
+    });
+
+    expect(usage).toMatchObject({
+      source: "usage_generic",
+      rawAmount: 37.96221984,
+      amountUsdMicros: 37962220,
+      currency: "USD"
+    });
+  });
+
+  test("probeUpstreamBalance reports inactive generic /v1/usage keys", async () => {
+    const snapshot = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/v1/usage",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 6000,
+      fetch: async () => jsonResponse({
+        remaining: 12.5,
+        unit: "USD",
+        isValid: false
+      })
+    });
+
+    expect(snapshot).toMatchObject({
+      source: "usage_generic",
+      rawAmount: 12.5,
+      amountUsdMicros: 12500000,
+      currency: "USD",
+      error: {
+        httpStatus: 200,
+        message: "upstream key is not active"
+      }
+    });
+  });
+
+  test("UiActions create validates, creates, then applies initial seller config", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+      const calls: string[][] = [];
+      const actions = new UiActions({
+        configManager: mgr,
+        configPath: TEMP_CONF_PATH,
+        profile: "bootstrap",
+        fetchJson: async (url) => createSellerFetchJson(url),
+        commandRunner: async (args): Promise<UiActionResult> => {
+          if (isBootstrapSellersValidate(args)) {
+            const filePath = args[args.indexOf("--file") + 1];
+            const doc = JSON.parse(fs.readFileSync(filePath, "utf8")) as { sellers: Array<{ id: string; status?: string }> };
+            expect(doc.sellers.find((seller) => seller.id === "tbs-nrt-07")?.status).toBe("pending");
+          }
+          calls.push(args);
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const response = await actions.createSeller({
+        sellerName: "tbs-nrt-07",
+        app: "tbs-nrt-07",
+        region: "nrt",
+        image: "registry.fly.io/tb-seller:latest",
+        upstreamWebsite: "https://openrouter.ai",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "fixture-upstream-key",
+        upstreamBalanceProbeTemplate: "usage_generic",
+        upstreamBalanceProbeUrl: "https://code.shoestravel.xin/v1/usage",
+        upstreamBalanceProbeRechargeUrl: "https://code.shoestravel.xin/topup",
+        maxConnections: 8,
+        maxQueueDepth: 4,
+        markupRatio: 1.2,
+        discountRatio: 1,
+        paymentMethods: ["clawtip", "mock"],
+        clawtipPayTo: "pay-to-seller",
+        clawtipSm4KeyBase64: "0123456789abcdef012345==",
+        clawtipSkillSlug: "tokenbuddy-seller",
+        clawtipSkillId: "si-tokenbuddy-seller",
+        clawtipDescription: "TokenBuddy Seller",
+        clawtipResourceUrl: "https://tbs-nrt-07.fly.dev",
+        clawtipActivationFeeFen: 1,
+        clawtipMicrosPerFen: 10000,
+        flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+      });
+
+      expect(response.result.ok).toBe(true);
+      expect(response.configPut?.ok).toBe(true);
+      expect(response.modelsRefresh?.ok).toBe(true);
+      expect(response.registryPublish?.ok).toBe(true);
+      expect(response.publishRegistry).toBe("completed");
+      expect(response.configPreview.upstreamUrl).toBe("https://openrouter.ai/api");
+      expect(response.configPreview.upstreamBalanceProbe).toEqual({
+        template: "usage_generic",
+        url: "https://code.shoestravel.xin/v1/usage",
+        userId: undefined,
+        rechargeUrl: "https://code.shoestravel.xin/topup"
+      });
+      expect(response.configPreview.upstreamBalanceUrl).toBe("https://code.shoestravel.xin/v1/usage");
+      expect(response.configPreview.upstreamRechargeUrl).toBe("https://code.shoestravel.xin/topup");
+      expect(response.configPreview.allowMock).toBe(true);
+      expect(response.configPreview.clawtip).toEqual({
+        payTo: "pay-to-seller",
+        sm4KeyBase64: "********",
+        skillSlug: "tokenbuddy-seller",
+        skillId: "si-tokenbuddy-seller",
+        description: "TokenBuddy Seller",
+        resourceUrl: "https://tbs-nrt-07.fly.dev",
+        activationFeeFen: 1,
+        microsPerFen: 10000
+      });
+      const commandLines = calls.map((args) => args.join(" "));
+      expect(commandLines).toEqual([
+        expect.stringContaining("seller-config validate --file"),
+        expect.stringContaining("seller create tbs-nrt-07"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret status"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret seller-config put --file"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret upstreams refresh --auto-models"),
+        expect.stringContaining("bootstrap sellers validate --file"),
+        expect.stringContaining("bootstrap sellers put --file")
+      ]);
+      expect(commandLines.find((line) => line.includes("seller create tbs-nrt-07"))).toContain("--initial-config");
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("UiActions create supports mock-only payment without ClawTip parameters", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+      const actions = new UiActions({
+        configManager: mgr,
+        profile: "bootstrap",
+        commandRunner: async (args): Promise<UiActionResult> => {
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const response = await actions.createSeller({
+        sellerName: "tbs-nrt-08",
+        app: "tbs-nrt-08",
+        region: "nrt",
+        image: "registry.fly.io/tb-seller:latest",
+        upstreamWebsite: "https://openrouter.ai",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "fixture-upstream-key",
+        upstreamBalanceProbeTemplate: "none",
+        maxConnections: 8,
+        maxQueueDepth: 4,
+        markupRatio: 1.2,
+        discountRatio: 1,
+        paymentMethods: ["mock"],
+        flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+        dryRun: true
+      });
+
+      expect(response.result.ok).toBe(true);
+      expect(response.readiness).toBeUndefined();
+      expect(response.configPut).toBeUndefined();
+      expect(response.configPreview.allowMock).toBe(true);
+      expect(response.configPreview.clawtip).toBeUndefined();
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("UiActions create requires ClawTip parameters for ClawTip payment", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    const actions = new UiActions({
+      configManager: mgr,
+      profile: "bootstrap",
+      commandRunner: async (): Promise<UiActionResult> => {
+        throw new Error("create should fail before running commands");
+      }
+    });
+
+    await expect(actions.createSeller({
+      sellerName: "tbs-nrt-09",
+      app: "tbs-nrt-09",
+      region: "nrt",
+      image: "registry.fly.io/tb-seller:latest",
+      upstreamWebsite: "https://openrouter.ai",
+      upstreamUrl: "https://openrouter.ai/api/v1",
+      upstreamApiKey: "fixture-upstream-key",
+      upstreamBalanceProbeTemplate: "none",
+      maxConnections: 8,
+      maxQueueDepth: 4,
+      markupRatio: 1.2,
+      discountRatio: 1,
+      paymentMethods: ["clawtip"],
+      flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+    })).rejects.toThrow("clawtipPayTo is required");
+  });
+
+  test("UiActions subprocess runner uses the tb-admin bin entrypoint", async () => {
+    const previousArgv = process.argv[1];
+    process.argv[1] = path.resolve(__dirname, "../dist/src/index.js");
+    const { runTbAdmin } = await import("../src/ui-actions.js");
+    try {
+      const result = await runTbAdmin(["--help"], 30000);
+      expect(result.ok).toBe(true);
+      expect(result.command[1]).toMatch(/packages\/admin-cli\/bin\/tb-admin\.js$/);
+      expect(result.stdout).toContain("Remote admin CLI");
+    } finally {
+      process.argv[1] = previousArgv;
+    }
+  });
 });
+
+async function startFixtureAdminServer(): Promise<{ baseUrl: string; close: () => Promise<void> }> {
+  const server = http.createServer((req, res) => {
+    const pathName = new URL(req.url || "/", "http://127.0.0.1").pathname;
+    if (pathName === "/registry/sellers") {
+      sendJson(res, {
+        version: 7,
+        updatedAt: "2026-06-05T00:00:00.000Z",
+        defaultSeller: "tbs-sin-06",
+        sellers: [{
+          id: "tbs-sin-06",
+          name: "tbs-sin-06",
+          profile: "seller-sin",
+          app: "tbs-sin-06",
+          url: "https://seller.example.test",
+          status: "active",
+          region: "sin",
+          modelsCount: 1,
+          sampleModels: ["openai/gpt-5.4"],
+          supportedProtocols: ["responses"],
+          paymentMethods: ["clawtip"]
+        }]
+      });
+      return;
+    }
+    if (pathName === "/operator/status") {
+      sendJson(res, {
+        status: "healthy",
+        capacity: { activeConnections: 3, maxConnections: 8, queueDepth: 0, maxQueueDepth: 4 },
+        upstream: { status: "healthy" },
+        latency: { ttftMs: 321, avgInferenceMs: 640, lastInferenceMs: 700, sampleCount: 2 }
+      });
+      return;
+    }
+    if (pathName === "/operator/admin/service") {
+      sendJson(res, {
+        sellerId: "tbs-sin-06",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        modelsCount: 1,
+        capacity: { activeConnections: 3, maxConnections: 8, queueDepth: 0, maxQueueDepth: 4 }
+      });
+      return;
+    }
+    if (pathName === "/operator/admin/upstreams") {
+      sendJson(res, {
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "****27f9",
+        markupRatio: 1.2,
+        discountRatio: 1,
+        modelAliases: { "openai/gpt-5.4": "gpt-5.4" },
+        models: [{
+          id: "openai/gpt-5.4",
+          inputPriceMicrosPer1m: 1000000,
+          outputPriceMicrosPer1m: 3000000
+        }]
+      });
+      return;
+    }
+    if (pathName === "/operator/admin/config") {
+      sendJson(res, {
+        config: {
+          upstreamUrl: "https://openrouter.ai/api/v1",
+          upstreamApiKey: "fixture-live-key-27f9",
+          upstreamBalanceUrl: "https://openrouter.ai/api/v1/credits",
+          upstreamRechargeUrl: "https://openrouter.ai/settings/credits",
+          upstreamBalanceProbe: {
+            template: "openrouter",
+            url: "https://openrouter.ai/api/v1/credits",
+            rechargeUrl: "https://openrouter.ai/settings/credits"
+          },
+          markupRatio: 1.2,
+          discountRatio: 1,
+          maxConnections: 8,
+          maxQueueDepth: 4,
+          modelAliases: { "openai/gpt-5.4": "gpt-5.4" },
+          models: [{ id: "openai/gpt-5.4" }]
+        }
+      });
+      return;
+    }
+    res.statusCode = 404;
+    res.end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", () => resolve()));
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    throw new Error("fixture server did not bind a TCP port");
+  }
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}`,
+    close: () => new Promise<void>((resolve) => server.close(() => resolve()))
+  };
+}
+
+function sendJson(res: http.ServerResponse, body: unknown): void {
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+
+async function createSellerFetchJson(url: string): Promise<unknown> {
+  const pathName = new URL(url).pathname;
+  if (pathName === "/registry/sellers") {
+    return {
+      version: 7,
+      sellers: []
+    };
+  }
+  if (pathName === "/operator/admin/upstreams") {
+    return {
+      upstreamUrl: "https://openrouter.ai/api",
+      models: [
+        { id: "openai/gpt-5.4" },
+        { id: "openai/gpt-5.4-mini" }
+      ],
+      supportedProtocols: ["chat_completions"]
+    };
+  }
+  if (pathName === "/operator/admin/service") {
+    return {
+      sellerId: "tbs-nrt-07",
+      modelsCount: 2,
+      supportedProtocols: ["chat_completions"]
+    };
+  }
+  throw new Error(`unexpected fetch url ${url}`);
+}
+
+function isBootstrapSellersValidate(args: string[]): boolean {
+  const validateIndex = args.indexOf("validate");
+  return validateIndex >= 2 && args[validateIndex - 2] === "bootstrap" && args[validateIndex - 1] === "sellers";
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}