@tokenbuddy/tb-admin 1.0.14 → 1.0.27

package/tests/admin.test.ts

@@ -1,10 +1,38 @@
 import { ConfigManager } from "../src/config.js";
 import { buildAdminCli } from "../src/cli.js";
-import { FlyProvider, parseFlyMachineIds } from "../src/server-cmd.js";
+import { FlyProvider, parseFlyMachineIds, requirePublishedDockerImage } from "../src/server-cmd.js";
+import { startAdminUiServer } from "../src/ui-server.js";
+import { AdminUiState } from "../src/ui-state.js";
+import { UiActions, type CreateSellerRequest, type UiActionResult } from "../src/ui-actions.js";
+import { adminUiHtml } from "../src/ui-static.js";
+import {
+  formatBalanceAmount,
+  formatCount,
+  formatDiscountRatio,
+  formatDuration,
+  formatMoney,
+  formatPercent,
+  formatPricePair,
+  formatSellerCapacity,
+  formatSellerStatus,
+  formatSellerId,
+  formatSpeed,
+  formatTimeCompact,
+  formatTimeFull,
+  formatTimeLedger,
+  sellerStatusTone,
+  statusTone,
+  UNKNOWN_VALUE
+} from "../src/display-format.js";
+import {
+  BalanceProbeCache,
+  probeUpstreamBalance
+} from "../src/upstream-balance-probe.js";
 import {
   validateRegistryDocument
 } from "../src/bootstrap-registry.js";
 import * as fs from "fs";
+import * as http from "http";
 import * as path from "path";
 
 const TEMP_CONF_PATH = path.resolve(__dirname, "../../data-test/admin-config.json");
@@ -68,17 +96,42 @@ describe("Admin CLI Config Profile Management Tests", () => {
     const payments = program.commands.find((command) => command.name() === "payments");
     const upstreams = program.commands.find((command) => command.name() === "upstreams");
     const models = program.commands.find((command) => command.name() === "models");
+    const ui = program.commands.find((command) => command.name() === "ui");
 
     expect(bootstrap).toBeDefined();
     expect(sellers).toBeDefined();
-    expect(sellers?.commands.map((command) => command.name()).sort()).toEqual(["get", "put", "validate"]);
+    expect(sellers?.commands.map((command) => command.name()).sort()).toEqual([
+      "add",
+      "get",
+      "list",
+      "put",
+      "remove",
+      "status",
+      "update",
+      "validate"
+    ]);
     expect(sellers?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--force")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "add")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "update")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "status")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "remove")?.options.some((option) => option.long === "--expect-version")).toBe(true);
     expect(sellers?.commands.find((command) => command.name() === "validate")?.options.some((option) => option.long === "--file")).toBe(true);
+    const defaultSeller = bootstrap?.commands.find((command) => command.name() === "default-seller");
+    const registry = bootstrap?.commands.find((command) => command.name() === "registry");
+    expect(defaultSeller?.commands.map((command) => command.name()).sort()).toEqual(["set"]);
+    expect(defaultSeller?.commands.find((command) => command.name() === "set")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(registry?.commands.map((command) => command.name()).sort()).toEqual(["diff", "import", "publish", "versions"]);
+    expect(registry?.commands.find((command) => command.name() === "import")?.options.some((option) => option.long === "--dry-run")).toBe(true);
+    expect(registry?.commands.find((command) => command.name() === "import")?.options.some((option) => option.long === "--force")).toBe(true);
     expect(sellerConfig).toBeDefined();
     expect(sellerConfig?.commands.map((command) => command.name()).sort()).toEqual(["get", "put", "validate"]);
     expect(sellerConfig?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
     expect(sellerConfig?.commands.find((command) => command.name() === "validate")?.options.some((option) => option.long === "--file")).toBe(true);
     expect(upstreams).toBeDefined();
+    expect(ui).toBeDefined();
+    expect(ui?.options.find((option) => option.long === "--host")?.defaultValue).toBe("127.0.0.1");
+    expect(ui?.options.find((option) => option.long === "--port")?.defaultValue).toBe(17822);
     expect(models).toBeDefined();
     expect(models?.options.some((option) => option.long === "--json")).toBe(true);
     expect(upstreams?.commands.map((command) => command.name()).sort()).toEqual(["get", "refresh", "update"]);
@@ -103,6 +156,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(deploy).toBeDefined();
     expect(create?.options.some((option) => option.long === "--fly-config" && option.required)).toBe(true);
     expect(create?.options.some((option) => option.long === "--image" && option.required)).toBe(true);
+    expect(create?.options.some((option) => option.long === "--initial-config")).toBe(true);
     expect(create?.options.some((option) => option.long === "--config")).toBe(false);
     expect(deploy?.options.some((option) => option.long === "--fly-config")).toBe(false);
     expect(deploy?.options.some((option) => option.long === "--image" && option.required)).toBe(true);
@@ -129,6 +183,59 @@ describe("Admin CLI Config Profile Management Tests", () => {
     })).toContain("Volumes: unchanged");
   });
 
+  test("seller create checks the published image before creating Fly resources", () => {
+    expect(() => requirePublishedDockerImage("registry.fly.io/tb-seller:missing", () => ({
+      ok: false,
+      error: "not found"
+    }))).toThrow("No Fly app was created");
+
+    const commands: string[] = [];
+    const provider = new FlyProvider(undefined, {
+      checkFlyctlInstalled: () => true,
+      imageInspector: () => ({ ok: false, error: "not found" }),
+      execSync: (command) => {
+        commands.push(command);
+        return "";
+      }
+    });
+
+    expect(() => provider.createSeller({
+      name: "tbs-test",
+      app: "tbs-test",
+      image: "registry.fly.io/tb-seller:missing",
+      flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+      operatorSecret: "operator-secret"
+    })).toThrow("seller image is not published or is not accessible");
+
+    expect(commands).toEqual([]);
+  });
+
+  test("FlyProvider passes configured Fly token to flyctl commands", () => {
+    const envs: Array<string | undefined> = [];
+    const provider = new FlyProvider({ token: "fly-token-value" }, {
+      checkFlyctlInstalled: () => true,
+      imageInspector: () => ({ ok: true }),
+      execSync: (_command, options) => {
+        envs.push(options?.env?.FLY_API_TOKEN);
+        return "";
+      },
+      spawnSync: (_command, _args, options) => {
+        envs.push(options?.env?.FLY_API_TOKEN);
+        return { status: 0, signal: null, stdout: "", stderr: "", pid: 1, output: [] };
+      }
+    });
+
+    provider.createSeller({
+      name: "tbs-test",
+      app: "tbs-test",
+      image: "registry.fly.io/tb-seller:latest",
+      flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+      operatorSecret: "operator-secret"
+    });
+
+    expect(envs).toEqual(["fly-token-value", "fly-token-value", "fly-token-value"]);
+  });
+
   test("parseFlyMachineIds reads machine ids and rejects unusable machine lists", () => {
     expect(parseFlyMachineIds(JSON.stringify([
       { id: "machine-1" },
@@ -158,4 +265,1299 @@ describe("Admin CLI Config Profile Management Tests", () => {
     badDefault.defaultSeller = "missing";
     expect(() => validateRegistryDocument(badDefault)).toThrow("defaultSeller `missing`");
   });
+
+  test("tb-admin ui server binds loopback, rejects cross-origin APIs, and serves bootstrap data", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    const started = await startAdminUiServer({
+      host: "127.0.0.1",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async () => ({
+        version: 7,
+        sellers: [{
+          id: "tbs-sin-06",
+          name: "tbs-sin-06",
+          url: "https://seller.example.test",
+          status: "active",
+          region: "sin",
+          supportedProtocols: ["responses"],
+          paymentMethods: ["clawtip"]
+        }]
+      })
+    });
+    try {
+      expect(started.url).not.toContain("session=");
+      const blocked = await fetch(`${started.url}api/bootstrap`, {
+        headers: { Origin: "http://malicious.example" }
+      });
+      expect(blocked.status).toBe(403);
+      await expect(blocked.json()).resolves.toMatchObject({ error: "invalid UI origin" });
+
+      const response = await fetch(`${started.url}api/bootstrap`);
+      await expect(response.json()).resolves.toMatchObject({
+        status: "available",
+        registryVersion: 7,
+        sellerEntries: 1,
+        regions: ["sin"]
+      });
+    } finally {
+      await new Promise<void>((resolve) => started.server.close(() => resolve()));
+    }
+
+    await expect(startAdminUiServer({
+      host: "0.0.0.0",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr
+    })).rejects.toThrow("loopback");
+  });
+
+  test("tb-admin ui create seller returns a progress job", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-token-value" });
+    const calls: string[][] = [];
+    const started = await startAdminUiServer({
+      host: "127.0.0.1",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url) => createSellerFetchJson(url),
+      commandRunner: async (args): Promise<UiActionResult> => {
+        if (isBootstrapSellersAdd(args)) {
+          const filePath = args[args.indexOf("--file") + 1];
+          const entry = JSON.parse(fs.readFileSync(filePath, "utf8")) as { id: string; status?: string };
+          expect(entry).toMatchObject({ id: "tbs-nrt-07", status: "active" });
+        }
+        calls.push(args);
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+    try {
+      const response = await fetch(`${started.url}api/sellers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          sellerName: "tbs-nrt-07",
+          app: "tbs-nrt-07",
+          region: "nrt",
+          image: "registry.fly.io/tb-seller:latest",
+          upstreamWebsite: "https://openrouter.ai",
+          upstreamUrl: "https://openrouter.ai/api/v1",
+          upstreamApiKey: "fixture-upstream-key",
+          upstreamBalanceProbeTemplate: "openrouter",
+          upstreamBalanceProbeUrl: "https://openrouter.ai/api/v1/credits",
+          upstreamBalanceProbeRechargeUrl: "https://openrouter.ai/settings/credits",
+          maxConnections: 8,
+          maxQueueDepth: 4,
+          markupRatio: 1.2,
+          discountRatio: 1,
+          paymentMethods: ["clawtip", "mock"],
+          clawtipPayTo: "pay-to-seller",
+          clawtipSm4KeyBase64: "0123456789abcdef012345==",
+          clawtipSkillSlug: "tokenbuddy-seller",
+          clawtipSkillId: "si-tokenbuddy-seller",
+          clawtipDescription: "TokenBuddy Seller",
+          clawtipResourceUrl: "https://tbs-nrt-07.fly.dev",
+          clawtipActivationFeeFen: 1,
+          clawtipMicrosPerFen: 10000,
+          flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+        })
+      });
+      expect(response.status).toBe(202);
+      const created = await response.json() as { jobId: string };
+      expect(created.jobId).toBeTruthy();
+
+      let job: any;
+      for (let attempt = 0; attempt < 20; attempt += 1) {
+        const poll = await fetch(`${started.url}api/jobs/${created.jobId}`);
+        job = await poll.json();
+        if (job.status !== "running") {
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+
+      expect(job.status).toBe("succeeded");
+      expect(job.events.map((event: any) => event.stepId)).toEqual([
+        "check_registry",
+        "validate_config",
+        "create_deployment",
+        "wait_seller",
+        "apply_config",
+        "refresh_models",
+        "publish_registry"
+      ]);
+      expect(job.events.find((event: any) => event.stepId === "validate_config").message).toContain("https://openrouter.ai/api");
+      expect(JSON.stringify(job)).not.toContain("fixture-upstream-key");
+      expect(JSON.stringify(job)).not.toContain("0123456789abcdef012345==");
+      expect(JSON.stringify(job)).not.toContain("operator-token-value");
+      const commandLines = calls.map((args) => args.join(" "));
+      expect(commandLines).toEqual([
+        expect.stringContaining("seller-config validate --file"),
+        expect.stringContaining("seller create tbs-nrt-07"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value status"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value seller-config put --file"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value upstreams refresh --auto-models"),
+        expect.stringContaining("bootstrap sellers add --file"),
+      ]);
+      expect(commandLines[5]).toContain("--expect-version 7");
+      expect(commandLines.find((line) => line.includes("seller create tbs-nrt-07"))).toContain("--initial-config");
+    } finally {
+      await new Promise<void>((resolve) => started.server.close(() => resolve()));
+    }
+  });
+
+  test("AdminUiState reads seller list from bootstrap registry and masks seller detail API keys", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setProfile("seller-sin", { url: fixture.baseUrl, token: "seller-token" });
+
+      const state = new AdminUiState({
+        configManager: mgr,
+        profile: "bootstrap",
+        balanceFetch: async (url, init) => {
+          expect(String(url)).toBe("https://openrouter.ai/api/v1/credits");
+          expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-live-key-27f9");
+          return jsonResponse({ data: { total_credits: 50, total_usage: 2.05 } });
+        }
+      });
+      const sellers = await state.sellers();
+      expect(sellers).toHaveLength(1);
+      expect(sellers[0]).toMatchObject({
+        id: "tbs-sin-06",
+        upstreamDomain: "openrouter.ai",
+        capacityUsed: 3,
+        capacityLimit: 8,
+        ttftMs: 321,
+        avgInferenceMs: 640,
+        lastInferenceMs: 700,
+        latencySamples: 2,
+        upstreamStatus: "healthy",
+        upstreamBalanceUsdMicros: 47_950_000,
+        upstreamBalanceCurrency: "USD",
+        upstreamBalanceSource: "openrouter"
+      });
+
+      const detail = await state.sellerDetail("tbs-sin-06");
+      expect(detail.configuration.upstreamApiKeyMasked).toBe("**** **** **** 27f9");
+      expect(detail.configuration.upstreamBalance).toBe("USD 47.95");
+      expect(detail.configuration.upstreamBalanceSource).toBe("openrouter");
+      expect(detail.configuration.upstreamBalanceProbeTemplate).toBe("openrouter");
+      expect(detail.configuration.upstreamBalanceProbeUrl).toBe("https://openrouter.ai/api/v1/credits");
+      expect(detail.configuration.upstreamBalanceProbeRechargeUrl).toBe("https://openrouter.ai/settings/credits");
+      expect(JSON.stringify(detail)).not.toContain("fixture-live-key");
+      expect(detail.models[0]).toMatchObject({
+        upstreamModel: "openai/gpt-5.4",
+        billingModel: "gpt-5.4"
+      });
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("AdminUiState uses Fly provider operator secret for registry sellers without local profiles", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const state = new AdminUiState({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url, init) => {
+        const pathName = new URL(url).pathname;
+        if (pathName === "/registry/sellers") {
+          return {
+            version: 9,
+            sellers: [{
+              id: "tbs-openrouter-ai-qecae",
+              name: "tbs-openrouter-ai-qecae",
+              app: "tbs-openrouter-ai-qecae",
+              url: "https://tbs-openrouter-ai-qecae.fly.dev",
+              status: "active",
+              region: "sin",
+              modelsCount: 2,
+              supportedProtocols: ["chat_completions"],
+              paymentMethods: ["clawtip"]
+            }]
+          };
+        }
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer operator-secret");
+        if (pathName === "/operator/status") {
+          return { status: "healthy", upstream: { status: "healthy" }, capacity: { activeConnections: 1, maxConnections: 8 } };
+        }
+        if (pathName === "/operator/admin/service") {
+          return { sellerId: "node-seller-core", modelsCount: 2, capacity: { maxConnections: 8, maxQueueDepth: 4 } };
+        }
+        if (pathName === "/operator/admin/upstreams") {
+          return {
+            upstreams: [{
+              upstreamUrl: "https://openrouter.ai/api",
+              upstreamApiKey: "****abcd",
+              models: [{ id: "openai/gpt-5.4" }, { id: "anthropic/claude-opus-4.7" }]
+            }]
+          };
+        }
+        if (pathName === "/operator/admin/config") {
+          return {
+            config: {
+              upstreamUrl: "https://openrouter.ai/api",
+              upstreamApiKey: "live-secret-abcd",
+              upstreamBalanceProbe: { template: "none" },
+              markupRatio: 1.2,
+              discountRatio: 1,
+              maxConnections: 8,
+              maxQueueDepth: 4
+            }
+          };
+        }
+        throw new Error(`unexpected fetch url ${url}`);
+      }
+    });
+
+    const sellers = await state.sellers();
+    expect(sellers[0]).toMatchObject({
+      id: "tbs-openrouter-ai-qecae",
+      name: "tbs-openrouter-ai-qecae",
+      nodeStatus: "active",
+      upstreamDomain: "openrouter.ai",
+      profile: "tbs-openrouter-ai-qecae",
+      modelsCount: 2
+    });
+
+    const detail = await state.sellerDetail("tbs-openrouter-ai-qecae");
+    expect(detail.configuration.upstreamUrl).toBe("https://openrouter.ai/api");
+    expect(detail.configuration.upstreamApiKeyMasked).toBe("**** **** **** abcd");
+    expect(detail.models.map((model) => model.upstreamModel)).toEqual(["openai/gpt-5.4", "anthropic/claude-opus-4.7"]);
+  });
+
+  test("UiActions updates new registry seller config without a local profile", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const calls: string[][] = [];
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url, init) => {
+        const pathName = new URL(url).pathname;
+        if (pathName === "/registry/sellers") {
+          return {
+            version: 10,
+            sellers: [{
+              id: "tbs-openrouter-ai-qecae",
+              name: "tbs-openrouter-ai-qecae",
+              app: "tbs-openrouter-ai-qecae",
+              url: "https://tbs-openrouter-ai-qecae.fly.dev",
+              status: "active",
+              supportedProtocols: ["chat_completions"],
+              paymentMethods: ["clawtip"]
+            }]
+          };
+        }
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer operator-secret");
+        if (pathName === "/operator/admin/config") {
+          return {
+            config: {
+              upstreamUrl: "https://openrouter.ai/api",
+              upstreamApiKey: "live-secret-abcd",
+              maxConnections: 8,
+              maxQueueDepth: 4
+            }
+          };
+        }
+        throw new Error(`unexpected fetch url ${url}`);
+      },
+      commandRunner: async (args): Promise<UiActionResult> => {
+        calls.push(args);
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+    const result = await actions.updateSellerConfig("tbs-openrouter-ai-qecae", { maxConnections: 12 });
+
+    expect(result.ok).toBe(true);
+    expect(calls.map((args) => args.join(" "))).toEqual([
+      expect.stringContaining("--url https://tbs-openrouter-ai-qecae.fly.dev --token operator-secret seller-config validate --file"),
+      expect.stringContaining("--url https://tbs-openrouter-ai-qecae.fly.dev --token operator-secret seller-config put --file")
+    ]);
+  });
+
+  test("admin UI seller rows render missing telemetry without unknown data labels", () => {
+    const html = adminUiHtml();
+    expect(html).toContain("class=\"spinner\"");
+    expect(html).toContain("@keyframes spin");
+    expect(html).toContain("role=\"status\" aria-label=\"Loading sellers\"");
+    expect(html).toContain("id=\"createStatus\" class=\"status-line hidden\"");
+    expect(html).toContain("id=\"createProgress\"");
+    expect(html).toContain("create-progress");
+    expect(html).toContain("progress-step");
+    expect(html).toContain("progress-log");
+    expect(html).toContain("currentCreateJob");
+    expect(html).toContain("setCreateFormDisabled(true)");
+    expect(html).toContain("setCreateFormDisabled(false)");
+    expect(html).toContain("Retry create");
+    expect(html).toContain("data-progress-step");
+    expect(html).toContain("aria-expanded");
+    expect(html).toContain("progress-title");
+    expect(html).toContain("Show details");
+    expect(html).toContain("Hide details");
+    expect(html).toContain("/api/jobs/");
+    expect(html).toContain("function uiErrorMessage");
+    expect(html).toContain("Admin UI connection lost. Restart tb-admin ui and reload this page.");
+    expect(html).toContain("Admin profile authentication failed. Check the configured operator token.");
+    expect(html).toContain("renderCreateJob");
+    expect(html).toContain("pollCreateJob");
+    expect(html).toContain("Created and added to bootstrap registry.");
+    expect(html).toContain("upstreamUrl:\"https://openrouter.ai/api/v1\"");
+    expect(html).toContain("loadingSpinner(\"Loading sellers\")");
+    expect(html).toContain("loadingSpinner(\"Loading configuration\")");
+    expect(html).toContain("loadingSpinner(\"Loading models\")");
+    expect(html).toContain("sellerRefreshIntervalMs = 30000");
+    expect(html).toContain("function scheduleSellerRefresh()");
+    expect(html).toContain("sellerNextRefreshAt = new Date(Date.now() + sellerRefreshIntervalMs)");
+    expect(html).toContain("sellerRefreshTimer = setTimeout(() => loadSellers(), sellerRefreshIntervalMs)");
+    expect(html).toContain("Next refresh: ");
+    expect(html).not.toContain("sellerLastUpdated");
+    expect(html).not.toContain("Last updated:");
+    expect(html).not.toContain("s ago");
+    expect(html).toContain("sellerClockTimer = setInterval(() => updateSellerRefreshMeta(sellerRefreshInFlight), 1000)");
+    expect(html).toContain("function renderSellerRows(rows)");
+    expect(html).toContain("sellerRefreshLoaded = true");
+    expect(html).toContain("readonly-value");
+    expect(html).toContain("--seller-grid");
+    expect(html).toContain("grid-template-columns:var(--seller-grid)");
+    expect(html).toContain("#sellerRows{display:grid;gap:10px;width:100%;min-width:0}");
+    expect(html).toContain("gap:12px;width:100%;min-width:0");
+    expect(html).toContain("detailFieldsHtml");
+    expect(html).toContain("data-original");
+    // Design-spec header labels (TTFT not Latency, Disc not Discount)
+    expect(html).toContain(">TTFT</span>");
+    expect(html).toContain(">Disc</span>");
+    expect(html).not.toContain(">Latency</span>");
+    // Spec-compliant token formats
+    expect(html).toContain("tok/s");
+    expect(html).toContain("AVG speed");
+    expect(html).toContain("Samples");
+    // Spec-compliant unknown-value char (em dash) lives in formatter
+    expect(html).toContain("UNKNOWN_VALUE");
+    expect(html).toContain("formatDuration");
+    expect(html).toContain("formatSellerStatus");
+    expect(html).toContain("formatDiscountRatio");
+    expect(html).toContain("formatBalanceAmount");
+    // No glassmorphism per spec
+    expect(html).not.toContain("backdrop-filter");
+    // Detail field references
+    expect(html).toContain("avgTokensPerSecond");
+    expect(html).toContain("lastTokensPerSecond");
+    expect(html).toContain("lastInferenceMs");
+    expect(html).toContain("upstreamBalanceSource");
+    expect(html).toContain("upstreamBalanceFetchedAt");
+    expect(html).toContain("upstreamBalanceError");
+    expect(html).toContain("upstreamBalanceProbeTemplate");
+    expect(html).toContain("upstreamBalanceProbeUrl");
+    expect(html).toContain("upstreamBalanceProbeUserId");
+    expect(html).toContain("upstreamBalanceProbeRechargeUrl");
+    // Payment tabs
+    expect(html).toContain("paymentMethods");
+    expect(html).toContain("payment-tabs");
+    expect(html).toContain("payment-tab");
+    expect(html).toContain("payment-panel");
+    expect(html).toContain("pill-switch");
+    expect(html).toContain("data-payment-tab");
+    expect(html).toContain("data-payment-panel");
+    expect(html).toContain("data-payment-toggle");
+    expect(html).toContain("enabledPaymentMethods()");
+    expect(html).toContain("setupPaymentTabs()");
+    expect(html).toContain("togglePaymentMethod");
+    expect(html).toContain("selectPaymentTab");
+    expect(html).toContain("updatePaymentPanels");
+    expect(html).toContain("data-enabled");
+    expect(html).toContain("aria-pressed");
+    expect(html).toContain("启用即可使用 mock 支付方式，无需额外参数");
+    expect(html).toContain("required-star");
+    expect(html).toContain("Seller name");
+    expect(html).toContain("tbs-<seller-name>-<random>");
+    expect(html).toContain("Fly app name");
+    expect(html).toContain("Seller image");
+    expect(html).toContain("Fly config file");
+    expect(html).toContain("Balance probe URL (auto from template)");
+    expect(html).toContain("Recharge URL");
+    expect(html).toContain("randomAppSuffix");
+    expect(html).toContain("updateGeneratedCreateFields");
+    expect(html).toContain("appNameFromSellerName");
+    expect(html).toContain("balanceProbeUrlForTemplate");
+    expect(html).toContain("data-generated-summary=\"clawtip\"");
+    expect(html).toContain("clawtipPayTo");
+    expect(html).toContain("clawtipSm4KeyBase64");
+    expect(html).toContain("clawtipSkillSlug");
+    expect(html).toContain("clawtipSkillId");
+    expect(html).toContain("clawtipDescription");
+    expect(html).toContain("clawtipResourceUrl");
+    expect(html).toContain("clawtipActivationFeeFen");
+    expect(html).toContain("clawtipMicrosPerFen");
+    // Spec uses — (em dash) for unknown, not "not reported" or "n/a"
+    expect(html).not.toContain("not reported");
+    expect(html).not.toContain("\"n/a\"");
+    expect(html).toContain("aria-label=\"Seller specs\"");
+    expect(html).toContain("<svg viewBox=\"0 0 24 24\"");
+    expect(html).not.toContain(">i</span>");
+    expect(html).not.toContain(">×</button>");
+    expect(html).not.toContain("Loading sellers...");
+    expect(html).not.toContain("Loading seller data...");
+    expect(html).not.toContain("Loading configuration...");
+    expect(html).not.toContain("Loading models...");
+    expect(html).not.toContain("<div id=\"createStatus\" class=\"status-line\">Ready</div>");
+    expect(html).not.toContain("not set");
+    expect(html).not.toContain(" multiple");
+  });
+
+  test("UiActions validates then puts seller config without shell command strings", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setProfile("seller-sin", { url: fixture.baseUrl, token: "seller-token" });
+      const calls: string[][] = [];
+      const actions = new UiActions({
+        configManager: mgr,
+        profile: "bootstrap",
+        commandRunner: async (args): Promise<UiActionResult> => {
+          calls.push(args);
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const result = await actions.updateSellerConfig("tbs-sin-06", {
+        markupRatio: 1.4,
+        upstreamApiKey: "new-secret"
+      });
+
+      expect(result.ok).toBe(true);
+      expect(calls).toHaveLength(2);
+      expect(calls[0]).toContain("validate");
+      expect(calls[1]).toContain("put");
+      expect(calls.flat()).not.toContain("seller-config validate");
+      expect(calls[0]).toContain("--profile");
+      expect(calls[0]).toContain("seller-sin");
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("probeUpstreamBalance parses OpenRouter balance and caches failed probes", async () => {
+    const cache = new BalanceProbeCache();
+    let calls = 0;
+    const openRouter = await probeUpstreamBalance({
+      upstreamUrl: "https://openrouter.ai/api",
+      upstreamBalanceUrl: "https://openrouter.ai/api/v1/credits",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 1000,
+      cache,
+      fetch: async (url, init) => {
+        calls += 1;
+        expect(String(url)).toBe("https://openrouter.ai/api/v1/credits");
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-key");
+        return jsonResponse({ data: { total_credits: 50, total_usage: 2.05 } });
+      }
+    });
+
+    expect(openRouter).toMatchObject({
+      source: "openrouter",
+      rawAmount: 47.95,
+      amountUsdMicros: 47950000,
+      currency: "USD"
+    });
+    expect(calls).toBe(1);
+
+    const firstFailure = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/api/user/quota",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 2000,
+      cache,
+      fetch: async () => {
+        calls += 1;
+        return jsonResponse({ success: false });
+      }
+    });
+    const cachedFailure = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/api/user/quota",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 3000,
+      cache,
+      fetch: async () => {
+        throw new Error("cache miss");
+      }
+    });
+
+    expect(firstFailure.error?.message).toBe("missing upstreamUserId for newapi upstream");
+    expect(cachedFailure).toBe(firstFailure);
+    expect(calls).toBe(1);
+  });
+
+  test("probeUpstreamBalance sends New-Api-User for generic newapi balances", async () => {
+    const snapshot = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/api/user/quota",
+      upstreamApiKey: "fixture-key",
+      upstreamUserId: "12345"
+    }, {
+      now: () => 4000,
+      fetch: async (url, init) => {
+        expect(String(url)).toBe("https://custom-upstream.example/api/user/quota");
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-key");
+        expect((init?.headers as Record<string, string>)?.["New-Api-User"]).toBe("12345");
+        return jsonResponse({ success: true, data: { quota: 50000000, used_quota: 1250000 } });
+      }
+    });
+
+    expect(snapshot).toMatchObject({
+      source: "newapi_generic",
+      rawAmount: 97.5,
+      amountUsdMicros: 97500000,
+      currency: "USD"
+    });
+  });
+
+  test("probeUpstreamBalance parses generic /v1/usage balances without user id", async () => {
+    const snapshot = await probeUpstreamBalance({
+      upstreamUrl: "https://code.shoestravel.xin",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 5000,
+      fetch: async (url, init) => {
+        expect(String(url)).toBe("https://code.shoestravel.xin/v1/usage");
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-key");
+        expect((init?.headers as Record<string, string>)?.["New-Api-User"]).toBeUndefined();
+        return jsonResponse({
+          balance: 37.96221984,
+          isValid: true,
+          remaining: 37.96221984,
+          unit: "USD"
+        });
+      }
+    });
+
+    expect(snapshot).toMatchObject({
+      source: "usage_generic",
+      rawAmount: 37.96221984,
+      amountUsdMicros: 37962220,
+      currency: "USD"
+    });
+  });
+
+  test("probeUpstreamBalance honors explicit balance probe templates", async () => {
+    const newApi = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamApiKey: "fixture-key",
+      upstreamBalanceProbe: {
+        template: "newapi_generic",
+        url: "https://custom-upstream.example/api/user/self",
+        userId: "67890"
+      }
+    }, {
+      now: () => 7000,
+      fetch: async (url, init) => {
+        expect(String(url)).toBe("https://custom-upstream.example/api/user/self");
+        expect((init?.headers as Record<string, string>)?.["New-Api-User"]).toBe("67890");
+        return jsonResponse({ success: true, data: { quota: 1000000, used_quota: 500000 } });
+      }
+    });
+
+    expect(newApi).toMatchObject({
+      source: "newapi_generic",
+      rawAmount: 1,
+      amountUsdMicros: 1000000,
+      currency: "USD"
+    });
+
+    const usage = await probeUpstreamBalance({
+      upstreamUrl: "https://code.shoestravel.xin/v1",
+      upstreamApiKey: "fixture-key",
+      upstreamBalanceProbe: {
+        template: "usage_generic"
+      }
+    }, {
+      now: () => 8000,
+      fetch: async (url) => {
+        expect(String(url)).toBe("https://code.shoestravel.xin/v1/usage");
+        return jsonResponse({ remaining: 37.96221984, unit: "USD", isValid: true });
+      }
+    });
+
+    expect(usage).toMatchObject({
+      source: "usage_generic",
+      rawAmount: 37.96221984,
+      amountUsdMicros: 37962220,
+      currency: "USD"
+    });
+  });
+
+  test("probeUpstreamBalance reports inactive generic /v1/usage keys", async () => {
+    const snapshot = await probeUpstreamBalance({
+      upstreamUrl: "https://custom-upstream.example/v1",
+      upstreamBalanceUrl: "https://custom-upstream.example/v1/usage",
+      upstreamApiKey: "fixture-key"
+    }, {
+      now: () => 6000,
+      fetch: async () => jsonResponse({
+        remaining: 12.5,
+        unit: "USD",
+        isValid: false
+      })
+    });
+
+    expect(snapshot).toMatchObject({
+      source: "usage_generic",
+      rawAmount: 12.5,
+      amountUsdMicros: 12500000,
+      currency: "USD",
+      error: {
+        httpStatus: 200,
+        message: "upstream key is not active"
+      }
+    });
+  });
+
+  test("UiActions create validates, creates, then applies initial seller config", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+      const calls: string[][] = [];
+      const actions = new UiActions({
+        configManager: mgr,
+        configPath: TEMP_CONF_PATH,
+        profile: "bootstrap",
+        fetchJson: async (url) => createSellerFetchJson(url),
+        commandRunner: async (args): Promise<UiActionResult> => {
+          if (isBootstrapSellersAdd(args)) {
+            const filePath = args[args.indexOf("--file") + 1];
+            const entry = JSON.parse(fs.readFileSync(filePath, "utf8")) as { id: string; status?: string };
+            expect(entry).toMatchObject({ id: "tbs-nrt-07", status: "active" });
+          }
+          calls.push(args);
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const response = await actions.createSeller({
+        sellerName: "tbs-nrt-07",
+        app: "tbs-nrt-07",
+        region: "nrt",
+        image: "registry.fly.io/tb-seller:latest",
+        upstreamWebsite: "https://openrouter.ai",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "fixture-upstream-key",
+        upstreamBalanceProbeTemplate: "usage_generic",
+        upstreamBalanceProbeUrl: "https://code.shoestravel.xin/v1/usage",
+        upstreamBalanceProbeRechargeUrl: "https://code.shoestravel.xin/topup",
+        maxConnections: 8,
+        maxQueueDepth: 4,
+        markupRatio: 1.2,
+        discountRatio: 1,
+        paymentMethods: ["clawtip", "mock"],
+        clawtipPayTo: "pay-to-seller",
+        clawtipSm4KeyBase64: "0123456789abcdef012345==",
+        clawtipSkillSlug: "tokenbuddy-seller",
+        clawtipSkillId: "si-tokenbuddy-seller",
+        clawtipDescription: "TokenBuddy Seller",
+        clawtipResourceUrl: "https://tbs-nrt-07.fly.dev",
+        clawtipActivationFeeFen: 1,
+        clawtipMicrosPerFen: 10000,
+        flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+      });
+
+      expect(response.result.ok).toBe(true);
+      expect(response.configPut?.ok).toBe(true);
+      expect(response.modelsRefresh?.ok).toBe(true);
+      expect(response.registryPublish?.ok).toBe(true);
+      expect(response.publishRegistry).toBe("completed");
+      expect(response.configPreview.upstreamUrl).toBe("https://openrouter.ai/api");
+      expect(response.configPreview.sellerId).toBe("tbs-nrt-07");
+      expect(response.configPreview.manifestVersion).toBe("manifest.v1");
+      expect(response.configPreview.upstreamBalanceProbe).toEqual({
+        template: "usage_generic",
+        url: "https://code.shoestravel.xin/v1/usage",
+        userId: undefined,
+        rechargeUrl: "https://code.shoestravel.xin/topup"
+      });
+      expect(response.configPreview.upstreamBalanceUrl).toBe("https://code.shoestravel.xin/v1/usage");
+      expect(response.configPreview.upstreamRechargeUrl).toBe("https://code.shoestravel.xin/topup");
+      expect(response.configPreview.allowMock).toBe(true);
+      expect(response.configPreview.clawtip).toEqual({
+        payTo: "pay-to-seller",
+        sm4KeyBase64: "********",
+        skillSlug: "tokenbuddy-seller",
+        skillId: "si-tokenbuddy-seller",
+        description: "TokenBuddy Seller",
+        resourceUrl: "https://tbs-nrt-07.fly.dev",
+        activationFeeFen: 1,
+        microsPerFen: 10000
+      });
+      const commandLines = calls.map((args) => args.join(" "));
+      expect(commandLines).toEqual([
+        expect.stringContaining("seller-config validate --file"),
+        expect.stringContaining("seller create tbs-nrt-07"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret status"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret seller-config put --file"),
+        expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret upstreams refresh --auto-models"),
+          expect.stringContaining("bootstrap sellers add --file")
+      ]);
+      expect(commandLines[5]).toContain("--expect-version 7");
+      expect(commandLines.find((line) => line.includes("seller create tbs-nrt-07"))).toContain("--initial-config");
+      expect(mgr.getProfile("tbs-nrt-07")).toEqual({
+        url: "https://tbs-nrt-07.fly.dev",
+        token: "operator-secret"
+      });
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("UiActions create retries transient upstream model refresh failures", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+      const registry = await createSellerFetchJson(`${fixture.baseUrl}/registry/sellers`);
+      let refreshAttempts = 0;
+      const calls: string[][] = [];
+      const actions = new UiActions({
+        configManager: mgr,
+        url: fixture.baseUrl,
+        fetchJson: async (url) => {
+          const pathName = new URL(url).pathname;
+          if (pathName === "/registry/sellers") {
+            return registry;
+          }
+          return createSellerFetchJson(url);
+        },
+        commandRunner: async (args): Promise<UiActionResult> => {
+          calls.push(args);
+          if (args.includes("upstreams") && args.includes("refresh")) {
+            refreshAttempts += 1;
+            if (refreshAttempts < 3) {
+              return { ok: false, stdout: "", stderr: "Error: Connection failed: fetch failed", command: ["node", "tb-admin", ...args] };
+            }
+          }
+          if (args.includes("bootstrap") && args.includes("sellers") && args.includes("add")) {
+            const filePath = args[args.indexOf("--file") + 1];
+            const doc = JSON.parse(fs.readFileSync(filePath, "utf8"));
+            expect(doc).toMatchObject({ id: "tbs-nrt-07" });
+            expect(doc.models).toHaveLength(2);
+          }
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const response = await actions.createSeller({
+        sellerName: "tbs-nrt-07",
+        app: "tbs-nrt-07",
+        region: "nrt",
+        image: "registry.fly.io/tb-seller:latest",
+        upstreamWebsite: "https://openrouter.ai",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "fixture-upstream-key",
+        upstreamBalanceProbeTemplate: "none",
+        maxConnections: 8,
+        maxQueueDepth: 4,
+        markupRatio: 1.2,
+        discountRatio: 1,
+        paymentMethods: ["mock"],
+        flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+      });
+
+      expect(response.modelsRefresh?.ok).toBe(true);
+      expect(response.registryPublish?.ok).toBe(true);
+      expect(refreshAttempts).toBe(3);
+      expect(calls.filter((args) => args.includes("upstreams") && args.includes("refresh"))).toHaveLength(3);
+    } finally {
+      await fixture.close();
+    }
+  }, 30000);
+
+  test("UiActions create publishes registry from wrapped upstream metadata", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    let published: any;
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url) => createSellerFetchJson(url, "wrappedArray"),
+      commandRunner: async (args): Promise<UiActionResult> => {
+        if (args.includes("bootstrap") && args.includes("sellers") && args.includes("add")) {
+          const filePath = args[args.indexOf("--file") + 1];
+          published = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        }
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+      const response = await actions.createSeller(createSellerRequestFixture({
+        sellerName: "openrouter-ai",
+        app: "tbs-openrouter-ai-qecae"
+      }));
+
+      expect(response.registryPublish?.ok).toBe(true);
+      expect(published).toMatchObject({
+        id: "tbs-openrouter-ai-qecae",
+        name: "tbs-openrouter-ai-qecae",
+        app: "tbs-openrouter-ai-qecae",
+        status: "active",
+        models: ["openai/gpt-5.4", "openai/gpt-5.4-mini"],
+        supportedProtocols: ["chat_completions"]
+      });
+      expect(mgr.getProfile("tbs-openrouter-ai-qecae")).toEqual({
+        url: "https://tbs-openrouter-ai-qecae.fly.dev",
+        token: "operator-secret"
+      });
+  });
+
+  test("UiActions create falls back to public manifest models for registry publish", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    let published: any;
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url) => createSellerFetchJson(url, "manifest"),
+      commandRunner: async (args): Promise<UiActionResult> => {
+        if (args.includes("bootstrap") && args.includes("sellers") && args.includes("add")) {
+          const filePath = args[args.indexOf("--file") + 1];
+          published = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        }
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+    const response = await actions.createSeller(createSellerRequestFixture({
+      sellerName: "openrouter-ai",
+      app: "tbs-openrouter-ai-qecae"
+    }));
+
+    expect(response.registryPublish?.ok).toBe(true);
+    expect(published).toMatchObject({
+      id: "tbs-openrouter-ai-qecae",
+      name: "tbs-openrouter-ai-qecae",
+      app: "tbs-openrouter-ai-qecae",
+      status: "active",
+      models: ["anthropic/claude-opus-4.7"],
+      supportedProtocols: ["chat_completions"]
+    });
+    expect(mgr.getProfile("tbs-openrouter-ai-qecae")).toEqual({
+      url: "https://tbs-openrouter-ai-qecae.fly.dev",
+      token: "operator-secret"
+    });
+  });
+
+  test("UiActions create supports mock-only payment without ClawTip parameters", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setProfile("bootstrap", { url: fixture.baseUrl, token: "bootstrap-token" });
+      mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+      const actions = new UiActions({
+        configManager: mgr,
+        profile: "bootstrap",
+        commandRunner: async (args): Promise<UiActionResult> => {
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const response = await actions.createSeller({
+        sellerName: "tbs-nrt-08",
+        app: "tbs-nrt-08",
+        region: "nrt",
+        image: "registry.fly.io/tb-seller:latest",
+        upstreamWebsite: "https://openrouter.ai",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "fixture-upstream-key",
+        upstreamBalanceProbeTemplate: "none",
+        maxConnections: 8,
+        maxQueueDepth: 4,
+        markupRatio: 1.2,
+        discountRatio: 1,
+        paymentMethods: ["mock"],
+        flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+        dryRun: true
+      });
+
+      expect(response.result.ok).toBe(true);
+      expect(response.readiness).toBeUndefined();
+      expect(response.configPut).toBeUndefined();
+      expect(response.configPreview.allowMock).toBe(true);
+      expect(response.configPreview.clawtip).toBeUndefined();
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("UiActions create requires ClawTip parameters for ClawTip payment", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    const actions = new UiActions({
+      configManager: mgr,
+      profile: "bootstrap",
+      commandRunner: async (): Promise<UiActionResult> => {
+        throw new Error("create should fail before running commands");
+      }
+    });
+
+    await expect(actions.createSeller({
+      sellerName: "tbs-nrt-09",
+      app: "tbs-nrt-09",
+      region: "nrt",
+      image: "registry.fly.io/tb-seller:latest",
+      upstreamWebsite: "https://openrouter.ai",
+      upstreamUrl: "https://openrouter.ai/api/v1",
+      upstreamApiKey: "fixture-upstream-key",
+      upstreamBalanceProbeTemplate: "none",
+      maxConnections: 8,
+      maxQueueDepth: 4,
+      markupRatio: 1.2,
+      discountRatio: 1,
+      paymentMethods: ["clawtip"],
+      flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+    })).rejects.toThrow("clawtipPayTo is required");
+  });
+
+  test("UiActions subprocess runner uses the tb-admin bin entrypoint", async () => {
+    const previousArgv = process.argv[1];
+    process.argv[1] = path.resolve(process.env.HOME || "/tmp", "packages/admin-cli/bin/tb-admin.js");
+    const { runTbAdmin } = await import("../src/ui-actions.js");
+    try {
+      const result = await runTbAdmin(["--help"], 30000);
+      expect(result.ok).toBe(true);
+      expect(result.command[1]).toMatch(/packages\/admin-cli\/bin\/tb-admin\.js$/);
+      expect(fs.existsSync(result.command[1])).toBe(true);
+      expect(result.stdout).toContain("Remote admin CLI");
+    } finally {
+      process.argv[1] = previousArgv;
+    }
+  });
+});
+
+describe("Admin CLI Display Format Spec Compliance", () => {
+  test("formatDuration uses ms under 1s and 2-decimal seconds above 1s", () => {
+    expect(formatDuration(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatDuration(0)).toBe("0ms");
+    expect(formatDuration(272)).toBe("272ms");
+    expect(formatDuration(999)).toBe("999ms");
+    expect(formatDuration(1000)).toBe("1.00s");
+    expect(formatDuration(3542)).toBe("3.54s");
+    expect(formatDuration(11540)).toBe("11.54s");
+  });
+
+  test("formatMoney uses 4 decimals by default and 6 for tiny ledger amounts", () => {
+    expect(formatMoney(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatMoney(0)).toBe("$0.0000");
+    expect(formatMoney(138600)).toBe("$0.1386");
+    expect(formatMoney(2_772_200)).toBe("$2.7722");
+    expect(formatMoney(138600, { ledger: true })).toBe("$0.1386");
+    expect(formatMoney(5782, { ledger: true })).toBe("$0.005782");
+  });
+
+  test("formatDiscountRatio converts ratio to percentage per the design spec", () => {
+    expect(formatDiscountRatio(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatDiscountRatio(0.5)).toBe("50%");
+    expect(formatDiscountRatio(0.01)).toBe("99%");
+    expect(formatDiscountRatio(0.99)).toBe("1%");
+    expect(formatDiscountRatio(1)).toBe("0%");
+    expect(formatDiscountRatio(0)).toBe("100%");
+  });
+
+  test("formatPercent rounds to whole percent", () => {
+    expect(formatPercent(0.123)).toBe("12%");
+    expect(formatPercent(0.987)).toBe("99%");
+    expect(formatPercent(undefined)).toBe(UNKNOWN_VALUE);
+  });
+
+  test("formatPricePair renders $/1M with 4 decimals per spec", () => {
+    expect(formatPricePair(undefined, undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatPricePair(2_500_000, 3_000_000)).toBe("$2.5000 / $3.0000");
+  });
+
+  test("formatCount uses en-US grouping", () => {
+    expect(formatCount(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatCount(7_529)).toBe("7,529");
+    expect(formatCount(218_700)).toBe("218,700");
+  });
+
+  test("formatTimeCompact emits HH:mm for today and MM/DD HH:mm otherwise", () => {
+    const now = new Date();
+    const todayIso = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 14, 51).toISOString();
+    const yesterdayIso = new Date(now.getFullYear(), now.getMonth(), now.getDate() - 1, 9, 5).toISOString();
+    expect(formatTimeCompact(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatTimeCompact(todayIso)).toBe("14:51");
+    expect(formatTimeCompact(yesterdayIso)).toMatch(/^\d{2}\/\d{2} 09:05$/);
+  });
+
+  test("formatTimeFull uses YYYY-MM-DD HH:mm:ss for detail panels", () => {
+    expect(formatTimeFull(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatTimeFull("2026-06-07T00:25:51.000Z")).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
+  });
+
+  test("formatTimeLedger uses YYYY/MM/DD HH:mm:ss for audit tables", () => {
+    expect(formatTimeLedger(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatTimeLedger("2026-06-07T00:25:51.000Z")).toMatch(/^\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2}$/);
+  });
+
+  test("formatSellerId trims long tbs ids to 10 chars", () => {
+    expect(formatSellerId(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatSellerId("tbs-825edb")).toBe("tbs-825edb");
+    expect(formatSellerId("tbs-openrouter-ai-k7p9x")).toBe("tbs-openro");
+  });
+
+  test("formatSpeed renders to one decimal with tok/s suffix", () => {
+    expect(formatSpeed(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatSpeed(0)).toBe("0.0 tok/s");
+    expect(formatSpeed(11.54)).toBe("11.5 tok/s");
+  });
+
+  test("formatSellerCapacity renders used / limit with en-US grouping", () => {
+    expect(formatSellerCapacity(undefined, undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatSellerCapacity(8, 16)).toBe("8 / 16");
+    expect(formatSellerCapacity(undefined, 16)).toBe(`${UNKNOWN_VALUE} / 16`);
+    expect(formatSellerCapacity(8, undefined)).toBe(`8 / ${UNKNOWN_VALUE}`);
+  });
+
+  test("formatBalanceAmount uses 0 decimals for >=100 and 2 decimals otherwise", () => {
+    expect(formatBalanceAmount(undefined, "USD")).toBe(UNKNOWN_VALUE);
+    expect(formatBalanceAmount(47_950_000, "USD")).toBe("USD 47.95");
+    expect(formatBalanceAmount(479_500_000, "USD")).toBe("USD 480");
+    expect(formatBalanceAmount(50_000_000, "EUR")).toBe("EUR 50.00");
+  });
+
+  test("formatSellerStatus maps all internal node statuses to the 7 canonical labels", () => {
+    const canonical = new Set(["ok", "online", "configured", "pending", "degraded", "error", "unknown"]);
+    for (const value of ["active", "healthy", "online", "configured", "pending", "draining", "degraded", "busy_capacity", "offline", "unhealthy", "error", "auth_unknown", "unknown", undefined, "weird-state"]) {
+      expect(canonical.has(formatSellerStatus(value))).toBe(true);
+    }
+    expect(formatSellerStatus("active")).toBe("ok");
+    expect(formatSellerStatus("draining")).toBe("degraded");
+    expect(formatSellerStatus("busy_capacity")).toBe("degraded");
+    expect(formatSellerStatus("offline")).toBe("error");
+    expect(formatSellerStatus("auth_unknown")).toBe("unknown");
+  });
+
+  test("statusTone / sellerStatusTone keep green/amber/red/blue/gray buckets stable", () => {
+    expect(statusTone("ok")).toBe("green");
+    expect(statusTone("online")).toBe("green");
+    expect(statusTone("configured")).toBe("green");
+    expect(statusTone("pending")).toBe("amber");
+    expect(statusTone("degraded")).toBe("amber");
+    expect(statusTone("error")).toBe("red");
+    expect(statusTone("offline")).toBe("red");
+    expect(statusTone("unknown")).toBe("gray");
+    expect(statusTone("running")).toBe("blue");
+    expect(sellerStatusTone("active")).toBe("green");
+    expect(sellerStatusTone("draining")).toBe("amber");
+    expect(sellerStatusTone("busy_capacity")).toBe("amber");
+    expect(sellerStatusTone("offline")).toBe("red");
+    expect(sellerStatusTone("auth_unknown")).toBe("gray");
+  });
 });
+
+async function startFixtureAdminServer(): Promise<{ baseUrl: string; close: () => Promise<void> }> {
+  const server = http.createServer((req, res) => {
+    const pathName = new URL(req.url || "/", "http://127.0.0.1").pathname;
+    if (pathName === "/registry/sellers") {
+      sendJson(res, {
+        version: 7,
+        updatedAt: "2026-06-05T00:00:00.000Z",
+        defaultSeller: "tbs-sin-06",
+        sellers: [{
+          id: "tbs-sin-06",
+          name: "tbs-sin-06",
+          profile: "seller-sin",
+          app: "tbs-sin-06",
+          url: "https://seller.example.test",
+          status: "active",
+          region: "sin",
+          modelsCount: 1,
+          sampleModels: ["openai/gpt-5.4"],
+          supportedProtocols: ["responses"],
+          paymentMethods: ["clawtip"]
+        }]
+      });
+      return;
+    }
+    if (pathName === "/operator/status") {
+      sendJson(res, {
+        status: "healthy",
+        capacity: { activeConnections: 3, maxConnections: 8, queueDepth: 0, maxQueueDepth: 4 },
+        upstream: { status: "healthy" },
+        latency: { ttftMs: 321, avgInferenceMs: 640, lastInferenceMs: 700, sampleCount: 2 }
+      });
+      return;
+    }
+    if (pathName === "/operator/admin/service") {
+      sendJson(res, {
+        sellerId: "tbs-sin-06",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        modelsCount: 1,
+        capacity: { activeConnections: 3, maxConnections: 8, queueDepth: 0, maxQueueDepth: 4 }
+      });
+      return;
+    }
+    if (pathName === "/operator/admin/upstreams") {
+      sendJson(res, {
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "****27f9",
+        markupRatio: 1.2,
+        discountRatio: 1,
+        modelAliases: { "openai/gpt-5.4": "gpt-5.4" },
+        models: [{
+          id: "openai/gpt-5.4",
+          inputPriceMicrosPer1m: 1000000,
+          outputPriceMicrosPer1m: 3000000
+        }]
+      });
+      return;
+    }
+    if (pathName === "/operator/admin/config") {
+      sendJson(res, {
+        config: {
+          upstreamUrl: "https://openrouter.ai/api/v1",
+          upstreamApiKey: "fixture-live-key-27f9",
+          upstreamBalanceUrl: "https://openrouter.ai/api/v1/credits",
+          upstreamRechargeUrl: "https://openrouter.ai/settings/credits",
+          upstreamBalanceProbe: {
+            template: "openrouter",
+            url: "https://openrouter.ai/api/v1/credits",
+            rechargeUrl: "https://openrouter.ai/settings/credits"
+          },
+          markupRatio: 1.2,
+          discountRatio: 1,
+          maxConnections: 8,
+          maxQueueDepth: 4,
+          modelAliases: { "openai/gpt-5.4": "gpt-5.4" },
+          models: [{ id: "openai/gpt-5.4" }]
+        }
+      });
+      return;
+    }
+    res.statusCode = 404;
+    res.end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", () => resolve()));
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    throw new Error("fixture server did not bind a TCP port");
+  }
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}`,
+    close: () => new Promise<void>((resolve) => server.close(() => resolve()))
+  };
+}
+
+function sendJson(res: http.ServerResponse, body: unknown): void {
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+
+function createSellerRequestFixture(overrides: Partial<CreateSellerRequest> = {}): CreateSellerRequest {
+  return {
+    sellerName: "tbs-nrt-07",
+    app: "tbs-nrt-07",
+    region: "nrt",
+    image: "registry.fly.io/tb-seller:latest",
+    upstreamWebsite: "https://openrouter.ai",
+    upstreamUrl: "https://openrouter.ai/api/v1",
+    upstreamApiKey: "fixture-upstream-key",
+    upstreamBalanceProbeTemplate: "none",
+    maxConnections: 8,
+    maxQueueDepth: 4,
+    markupRatio: 1.2,
+    discountRatio: 1,
+    paymentMethods: ["mock"],
+    flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+    ...overrides
+  };
+}
+
+async function createSellerFetchJson(url: string, mode: "default" | "wrapped" | "wrappedArray" | "manifest" = "default"): Promise<unknown> {
+  const pathName = new URL(url).pathname;
+  if (pathName === "/registry/sellers") {
+    return {
+      version: 7,
+      sellers: []
+    };
+  }
+  if (pathName === "/operator/admin/upstreams") {
+    if (mode === "wrapped") {
+      return {
+        upstreams: {
+          upstreamUrl: "https://openrouter.ai/api",
+          models: [
+            { id: "openai/gpt-5.4" },
+            { id: "openai/gpt-5.4-mini" }
+          ],
+          supportedProtocols: ["chat_completions"]
+        }
+      };
+    }
+    if (mode === "wrappedArray") {
+      return {
+        upstreams: [{
+          upstreamUrl: "https://openrouter.ai/api",
+          models: [
+            { id: "openai/gpt-5.4" },
+            { id: "openai/gpt-5.4-mini" }
+          ],
+          supportedProtocols: ["chat_completions"]
+        }]
+      };
+    }
+    if (mode === "manifest") {
+      return {
+        upstreams: {
+          upstreamUrl: "https://openrouter.ai/api",
+          modelsCount: 1
+        }
+      };
+    }
+    return {
+      upstreamUrl: "https://openrouter.ai/api",
+      models: [
+        { id: "openai/gpt-5.4" },
+        { id: "openai/gpt-5.4-mini" }
+      ],
+      supportedProtocols: ["chat_completions"]
+    };
+  }
+  if (pathName === "/operator/admin/service") {
+    return {
+      sellerId: "tbs-nrt-07",
+      modelsCount: 2,
+      supportedProtocols: ["chat_completions"]
+    };
+  }
+  if (pathName === "/manifest" && mode === "manifest") {
+    return {
+      sellerId: "tbs-nrt-07",
+      models: ["anthropic/claude-opus-4.7"],
+      supportedProtocols: ["chat_completions"]
+    };
+  }
+  throw new Error(`unexpected fetch url ${url}`);
+}
+
+function isBootstrapSellersAdd(args: string[]): boolean {
+  const addIndex = args.indexOf("add");
+  return addIndex >= 2 && args[addIndex - 2] === "bootstrap" && args[addIndex - 1] === "sellers";
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}